The SOP on the shelf is not the SOP on the floor

ISO 13485:2016 §4.2.4 is short. It asks you to control every document your quality system needs. That covers SOPs, work instructions and forms. It also covers documents that come from outside, like a manufacturer's IFU or a standard you work to.

Control means a few specific things.

• Before a document is issued, someone reviews it and approves it as adequate.
• When it changes, it is reviewed and approved again. That is done by the function that approved it first, or by another function you have named that has the background to judge it.
• Each document shows its current revision status, and you can see what changed.
• The right version is available where the work happens.
• Documents stay legible and easy to identify.
• Documents of external origin are identified, and their distribution is controlled.
• Documents are protected from deterioration or loss.
• Obsolete documents cannot be used by mistake. If you keep them, they are marked.

There is one more line people miss. You must define how long you keep at least one copy of an obsolete document. For documents used to make or test a device, that is at least the device's lifetime as you define it. It is never shorter than the retention period of the records those documents produced.

None of this asks for software. It asks for control you can show.

Document control is the plumbing. Every other area runs through it. Your CAPA procedure, your complaints procedure and your storage instructions all live as documents. If those documents are not controlled, nothing built on them can be trusted.

So document control is a natural place to start pulling a thread. Pick up any procedure and four questions follow. Is this the current version? Who approved it, and when? Is the copy in the warehouse the same one? What happened to the old version?

Each question either has an answer on paper or it does not.

The Heatmap finding for this area reads: "Uncontrolled documents in circulation." In my experience, that rarely means nobody wrote SOPs. More often the SOPs exist, but nobody can prove which copy is live.

"Are your SOPs, work instructions and forms version-controlled, approved, and current at the point of use?"

What "we do this" sounds like: "Yes, all our SOPs are on the shared drive. Everyone knows where they are."

What you could put on the table: any document, picked at random. It shows a document number, a revision, an effective date and an approval with a name and a date. Then the copy at the point of use: the receiving bench, the warehouse, the dispatch desk. It carries the same revision. The blank forms in the tray carry the same revision code as the form on file.

The gap lives at the point of use. A shared drive does not stop someone printing version 2 in March and still using it in October.

"Is there a master document list showing the current revision of every controlled document?"

What "we do this" sounds like: "We know what we have. It's all in the folder."

What you could put on the table: one list. Every controlled document, with its number, title, current revision, effective date, owner and next review date. Someone names an SOP, and you find it on the list in seconds. The revision on the list matches the revision on the document.

A folder is not a list. A list is how you prove nothing is missing.

"Are obsolete documents promptly removed from use so staff can’t follow old versions?"

What "we do this" sounds like: "We replace the old one when we update it."

What you could put on the table: a superseded version, marked obsolete, kept in a separate archive. A record of when the new version was issued and when the old copies were withdrawn. If paper copies went to the floor, a distribution record showing who got them, and that the old ones came back.

"Replace" is the risky word. Overwrite the file and you lose the history. Skip the withdrawal and the old printout lives on.

• A current master document list, with revision and effective date for every controlled document
• Every SOP, work instruction and form showing number, revision, effective date and approver
• Approval records for the current revision of each document: who, what, when
• Change history: what changed between revisions, and why
• A list of external documents you control, such as manufacturer IFUs and standards, with the version you hold
• An archive of obsolete versions, clearly marked, kept for your defined period
• A distribution record for any controlled paper copies
• Your Document Control SOP, describing how all of the above works

The shared drive is the system. Files sit in folders called "SOPs FINAL" and "SOPs FINAL v2". Nobody can say which is live without opening both.

Printouts outlive their version. Someone laminated the receiving checklist two years ago. It is still taped to the wall. The SOP has changed twice since.

Approval lives in an email. The Quality Manager replied "looks good". The document itself carries no name, no date and no link back to that email.

Forms are forgotten. SOPs get revision numbers. The forms they call up do not. Someone picks up a blank form and asks which revision it is. Nobody knows.

External documents drift. The manufacturer issued a new IFU. Your team still ships the old one, because nobody tracks which version you hold.

One person holds it all. In a small team, document control often lives in one person's head. When that person is on leave, nobody can find the current version. That is not a criticism. It is the reality of being alone in the role, and it is fixable.

SAHPRA is rolling out mandatory ISO 13485:2016 certification, or the latest version, in five phases. This is set out in its MD01 notice dated 18 September 2025.

• Phase 1, Preparation (1 April 2025): holders declared a certificate. No evidence was asked for.
• Phase 2, Renewals (1 June 2025): manufacturers and distributors or importers.
• Phase 3, Companies already holding a certificate (1 April 2026): holders "will be requested to submit". SAHPRA describes the requirement as mandatory.
• Phase 4, Amendments (1 June 2027).
• Phase 5, All new applications (1 April 2028).

When an inspector visits, your licence is what is at stake. The inspector's job is to see evidence, not intentions. Document control is where that shows first. If you cannot show which version of a procedure is live, it is very hard to show that the procedure is followed.

I carry the same SAHPRA licence you do. My own company distributes medical devices. In twenty years I never saw a company fail because it wasn't compliant. I saw them fail because they couldn't prove it.

Set a timer for 60 minutes. Do only this.

1. 10 minutes. Open a spreadsheet. Add columns for document number, title, revision, effective date, owner and where it is used.
2. 25 minutes. List every SOP, work instruction and form you can find. Don't fix anything yet. Just list.
3. 15 minutes. Walk to one point of use, such as the receiving desk. Compare the printed copies to your list. Mark every mismatch.
4. 10 minutes. For each mismatch, write one line: what is there, and what should be there.

You now have a first master list and a short list of uncontrolled copies. That is the start of evidence. It took one hour.