Document Retention in a Quality Management System: Why Keeping the Right Records Matters

A strong Quality Management System (QMS) is not just about having procedures and policies. It is also about having proof. Every inspection, approval, training session, manufacturing step, customer complaint, audit and corrective action can leave behind a record. These records show how an organization runs its operations and upholds product quality. That is why document retention matters: it ensures there is evidence that quality standards were followed, and that the evidence can still be found when someone asks for it.

Document retention is the process of deciding which quality records must be kept, how long they should be kept, where they should be stored, how they should be protected, and how they should be disposed of when the time comes. For medical device manufacturers it is especially important, because records may need to show that regulations and quality standards were followed years after the activity took place.

In ISO 13485:2016, this topic sits in two linked clauses: 4.2.4 Control of documents and 4.2.5 Control of records. This blog focuses mainly on records.

What is Document Retention? #

Document retention is how an organization manages and keeps documents and records for a defined period of time. A company should not simply keep every document forever, and it should not throw records away as soon as they seem unnecessary. A retention policy states how long each document or record must be kept and how it must be handled.

It is important to understand the difference between a controlled document and a quality record. A procedure or work instruction tells employees how to carry out a task. A record provides evidence that the activity was actually performed.

For example:

• A manufacturing procedure explains how a device should be manufactured.
• A batch manufacturing record provides evidence that the manufacturing process was carried out.
• A training procedure explains how employee training is controlled.
• A training record demonstrates that a particular employee completed the required training.

Why is Document Retention Important in a QMS? #

Imagine an auditor asks:

"How can you demonstrate that this employee was trained before performing this activity?"

If the company cannot find the training record, having a training procedure may not be enough to show that the training really happened. Properly kept records provide proof that activities were done correctly.

Effective document retention helps organizations to:

1. Demonstrate compliance Regulatory authorities and auditors may review quality records to determine whether an organization has followed its established processes and applicable requirements. Well-maintained records make it easier to demonstrate compliance with the QMS and with regulations.

2. Support traceability Traceability is especially important in medical device manufacturing. Records can connect a finished device with information such as:

• Raw materials and components
• Suppliers
• Manufacturing activities
• Inspection and testing
• Equipment used
• Personnel involved
• Batch or lot number information
• Release activities
• Complaints and post-market information

Without appropriate records, establishing this history can become difficult.

3. Support investigations and CAPA When a complaint, nonconformity or quality issue occurs, historical records give an organization the details it needs to understand what happened. Retained records may help answer questions such as:

• What changed?
• Who approved it?
• Which batch was affected?
• What testing was performed?
• Was the process followed correctly?

Records provide a historical trail that does not depend on individual employees remembering what happened. In that sense, document retention protects not only compliance evidence but also the organization's institutional knowledge.

What Types of Records Should Be Retained? #

The exact records and retention periods depend on the organization's QMS, applicable regulations, product type and business activities. In a medical device environment, commonly controlled records include:

• Medical device file and technical documentation (called the Device Master Record, or DMR, under the former US FDA QSR)
• Design and development records
• Risk management records
• Manufacturing and batch records
• Inspection and testing records
• Equipment calibration and maintenance records
• Supplier evaluation records
• Training records
• Internal audit records
• Management review records
• Nonconformity records
• CAPA records
• Complaint records
• Change control records
• Verification and validation records

Not every record has the same retention period. The period should be set based on applicable requirements and the organization's documented QMS controls.

How Should a Document Retention System Work? #

An effective document retention process should answer five basic questions:

• What? What document or record is being retained?
• Who? Who is responsible for maintaining and controlling it?
• Where? Where will the record be stored?
• How long? What is the defined retention period?
• What happens next? When the retention period ends, will the record be disposed of securely, archived, or handled in another way?

Example retention schedule (illustrative only):

Disposal and Legal Hold #

Disposing of records is part of retention, but it must be controlled:

• Dispose of records only according to the approved retention schedule, and only with proper authorization.
• Place a legal hold on relevant records during any open investigation, CAPA, complaint, recall, audit, inspection or litigation, even if the normal retention period has ended.
• Protect confidential information, including health information, during storage and disposal. ISO 13485 clause 4.2.5 requires this.

Document Retention in the Digital Era #

Document retention is no longer just about paper files in drawers. Today's quality systems depend heavily on digital records and document management tools. This raises points such as:

• Access control
• Backup and recovery
• Version control
• Data integrity
• Electronic approvals and signatures

A file stored on a computer is not automatically under control. A good electronic retention system makes sure records can be found, viewed, kept safe, and removed when the retention period ends.

Common Document Retention Mistakes #

Even organizations with established QMS procedures can struggle with retention. Common mistakes include:

• Keeping records without defined retention periods. This creates unnecessary storage and makes it hard to decide what can be archived or disposed of.
• Deleting records too early. Premature disposal can mean losing important compliance and traceability evidence.
• Using uncontrolled copies. A record may exist, but if its authenticity or integrity cannot be established, its value as objective evidence may be questioned.
• Poor indexing. A record that exists but cannot be retrieved when needed causes almost as much difficulty as a missing record.
• Ignoring electronic records. Digital files need the same level of control and protection as physical quality records.

Document Retention is About More Than "Keeping Documents" #

A good document retention system does not mean keeping every document. It means keeping the right records, for the right period, under the right controls. A well-run system makes a real difference during audits, inspections, investigations, complaints, recalls and regulatory submissions. Well-controlled records help build a QMS where decisions and activities are supported by evidence rather than assumptions.

How Long Should You Keep a Record? #

Retention periods are not the same under every framework, and the longest applicable period governs.

Example: A company manufactures a non-implantable medical device with an expected lifetime of 5 years and sells it in the European Union.

• ISO 13485:2016 requires records to be kept for the device lifetime (5 years), or as regulations require, and not less than 2 years after release.
• EU MDR Article 10(8) requires technical documentation, the Declaration of Conformity and certificates to be kept for at least 10 years after the last device is placed on the market.

So even though the device lifetime is 5 years, those EU MDR documents must be kept for at least 10 years. ISO 13485 applies to all QMS records, while MDR Article 10(8) applies to specific documents, and the longer applicable period governs.

The lesson: Do not choose a retention period from ISO 13485 alone. Also check the regulatory requirements of every market where the device is placed.

Final Takeaway #

Document retention is a core part of a strong QMS. It provides proof that processes were followed, products were controlled, employees were trained and quality activities were performed properly.

A practical approach is simple:

Identify → Classify → Define Retention → Store → Protect → Retrieve → Dispose

By treating document retention as a planned QMS activity rather than an administrative task, organizations can improve traceability, maintain data integrity, support regulatory compliance, and respond to audits with confidence.

V Reg Solutions supports medical device companies in strengthening their quality management systems and maintaining regulatory compliance through expert guidance on quality management and regulatory requirements.

Ultimately, effective document retention is about more than keeping records—it's about ensuring that the right evidence is available whenever it is needed.

“Show me the record.”