FDA 483 Citations for Document Control Under 21 CFR 820.40

"Document control procedures have not been adequately [established] [maintained]." FDA investigators cited 21 CFR 820.40 with that wording 32 times on system-generated Form FDA 483s in fiscal year 2025, and a second version was cited another 10 times.

Document control is the base of the quality system. If people cannot be sure they are using the current, approved version of a procedure, drawing or specification, every other control is in doubt. Investigators also find document control problems while looking at something else, such as an outdated work instruction at a production station.

What the citations mean

Examples written after "Specifically" usually describe:

• No document control procedure, or one that does not cover approval, distribution or changes

• Documents in use without approval signatures and dates

• Obsolete revisions at workstations, in shared drives or in binders

• Changes made by hand on controlled copies without review and approval

• No record of what changed, why and when it took effect

• External documents, such as standards or supplier specifications, not controlled

• Change records that do not identify the approver or effective date

What 21 CFR 820.40 required

Under the Quality System Regulation, each manufacturer had to establish and maintain procedures to control all documents required by Part 820.

• Approval and distribution (820.40(a)). Documents had to be reviewed and approved for adequacy by a designated individual before issue. The approval, including the date and signature of the approver, had to be documented. Documents had to be available at all locations where they are designated, used or otherwise necessary, and obsolete documents had to be promptly removed from all points of use or otherwise prevented from unintended use.

• Changes (820.40(b)). Changes had to be reviewed and approved by an individual in the same function or organization that performed the original review and approval, unless specifically designated otherwise. Approved changes had to be communicated to the appropriate personnel in a timely manner. Change records had to include a description of the change, identification of the affected documents, the signature of the approving individual, the approval date and when the change becomes effective.

What changed under QMSR

Under QMSR, in effect since February 2, 2026, document control comes from ISO 13485:2016 clause 4.2.4, Control of documents. The documented procedure must define the controls needed to:

• Review and approve documents for adequacy prior to issue

• Review, update as necessary and re-approve documents

• Ensure that the current revision status of and changes to documents are identified

• Ensure that relevant versions of applicable documents are available at points of use

• Ensure documents remain legible and readily identifiable

• Ensure documents of external origin are identified and their distribution controlled

• Prevent deterioration or loss of documents

• Prevent the unintended use of obsolete documents and apply suitable identification to them

Clause 4.2.4 also requires changes to be reviewed and approved by the original approving function, or another designated function with access to pertinent background information, and requires at least one copy of obsolete documents to be retained for a defined period. QMSR section 820.35 adds FDA-specific record requirements on top of ISO 13485 clause 4.2.5, and electronic records remain subject to 21 CFR Part 11 where it applies.

How to respond to the 483

FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action.

Remove and replace uncontrolled documents

Sweep production, labs, warehouses and shared drives. Remove obsolete and unapproved documents and replace them with current controlled copies. Record what you found and where.

Assess the effect

If people worked from obsolete or unapproved documents, decide whether product was affected. Review records made with those documents and disposition affected product.

Fix the system

• A document control procedure that covers creation, review, approval, numbering, revision, distribution, training, obsolescence and external documents

• A master list showing the current revision of every controlled document

• Change records that capture the description, reason, affected documents, approver, date and effective date

• A link to training, so revised documents are not effective until users are trained

• Controls for electronic documents, including access, audit trails and validated systems where used

Verify

Audit points of use after the fix, and repeat the audit after a few months to show the problem has not returned.

What a compliant document control procedure contains

• Scope, document types and responsibilities

• Numbering and revision conventions

• Review and approval requirements by document type

• Distribution and points of use

• Change requests, impact assessment and change records

• Training before effective dates

• Obsolete document removal and retention

• External documents

• Electronic document controls

Common mistakes in document control responses

• Collecting obsolete copies once without changing how they got there

• Allowing handwritten changes on controlled copies with no defined process

• Forgetting external standards and supplier documents

• Separating engineering change control from document control, so drawings and procedures follow different rules

• Ignoring shared drives and personal copies

Example: how one response section might read

This illustrates structure only; your response must describe your own facts.

Observation 5: Document control procedures have not been adequately maintained. Specifically, revision C of the assembly work instruction was in use at line 2 although revision D was approved four months earlier.

Response:

• Correction: Revision C was removed from line 2. A sweep of all 14 production stations and the quality lab found three additional obsolete documents, which were removed on a stated date.

• Product assessment: The change from revision C to D clarified a torque value. Torque records for lots built in the four months were reviewed, and all values met the revision D limit.

• Root cause: Paper copies were printed locally, and the document control procedure did not require retrieval of old copies at release.

• Corrective action: Work instructions are now displayed electronically at each station. Local printing is disabled, and the procedure requires point-of-use verification at each release.

• Verification: Quality will audit all points of use monthly for three months, then quarterly.

Frequently asked questions

Do we need a document control procedure under QMSR?

Yes. ISO 13485 clause 4.2.4 requires a documented procedure that defines the controls listed above.

Can we use electronic signatures?

Yes, if your system meets 21 CFR Part 11 requirements where they apply, including validation, audit trails and controls on signatures.

Do we need to keep obsolete documents?

ISO 13485 requires at least one copy of obsolete controlled documents to be kept for a defined period, at least the lifetime of the device as defined by the organization, and not less than the retention period of related records or as required by regulation.

How A.P. Lyon documents help

A.P. Lyon's Document Control Procedure for ISO 13485 and FDA QMSR covers approval, distribution, change records and obsolete documents. The ISO 13485 Document Control Procedure Bundle adds procedures such as the Engineering Change Notice Procedure, Good Documentation Practices and Record Retention.

Documents are editable Word and Excel files and must be adapted to your organization. Your staff must be trained and the procedures followed.

Next steps

• Remove obsolete and unapproved documents from every point of use

• Assess product made with uncontrolled documents

• Revise the procedure and connect it to training and change control

• Respond within 15 business days with dates for each action

Related guides: Training Citations and Device Master Record Citations.

To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.