Question

What the hell is the difference between a document and a record?

Short Answer

Documents describe how things should be done. They have a version history and they require a proper review process when updated.

Records on the other hand show how things were done. They are proof of activities performed (i.e. proof of SOPs being followed) and they do not need a release process.

Long Answer

The difference between documents and records is described in ISO 13485:2016 4.2.5.

Documents refer to written information that provides instructions, guidelines, procedures, specifications, policies, and other relevant information related to the QMS. These documents outline the processes and activities required to establish and maintain the QMS effectively. Examples of documents include quality manuals, standard operating procedures (SOPs), work instructions, forms, policies, and specifications.

It is crucial that the information in documents is accurate as all activities in the company will be derived from them. Therefore, a proper review and release process is mandatory. The “Document and Record Control SOP” outlines how to review and approve documents. You should also establish a versioning system for the documents and a version history at the end of the file where you can keep track of all the changes over time.

Records are evidence of activities performed or results achieved within the QMS. They provide documented proof that processes were carried out as planned. Examples of records include training records, calibration records, audit reports, customer complaints, corrective and preventive action (CAPA) records, and management review meeting minutes. Another example for records is the technical documentation for your product: those records - such as your list of software requirements, your software tests, your usability report or your declaration of conformity - are created by following the related SOPs for product development.

As those documents are more of a protocol for what has been done, no approval is needed. Instead, it makes sense to know who created the record and when. You might need the records to show snoopy auditors that you have performed certain actions that were demanded by your SOPs. Therefore, it makes sense to name records in a way that refers to the process where the performed activity is described. Like this: “2023-06-21-CAP-REC-Display Bug”.