"We did the work. We just can't find the record."

Clause 4.2.5 is short. It carries more weight than its length suggests.

Records are your proof that the quality system works. The standard asks for:

• A documented procedure that defines the controls for identifying, storing, protecting, retrieving, keeping and disposing of records. 6 things. Your procedure should cover each one.
• Security and integrity. Records are protected from loss, damage and unauthorised change.
• Legible, identifiable, retrievable. A record you can't read, can't place or can't find doesn't count.
• Changes stay identifiable. If someone corrects a record, you can see what changed.
• Confidential health information. You define how you protect it, in line with the law that applies to you.
• A retention period. At least the lifetime of the device as you define it, and never less than 2 years from the date the product was released. Longer if a regulation says so.

2 neighbouring rules matter too. Under 4.2.4, you define how long you keep at least one copy of obsolete controlled documents, and it is never shorter than the retention period of the records they produced. And software you use to hold records is software used in the quality system, so 4.1.6 asks you to validate it for its use.

Notice what the standard doesn't do. It doesn't give you a list of retention periods. You set them, per record type, and then you have to live by them.

Every other area in this series ends at a record. A CAPA is closed by an effectiveness check record. A supplier is signed off on an evaluation record. A management review is proven by minutes.

If records fail, everything fails with them. A perfect process that left no trace looks exactly like a process that never happened.

Records are also the easiest place to test a system. Ask for a record from 3 years ago and watch what happens next. Calm retrieval in 2 minutes says a lot. 10 minutes of searching email says more.

1. Are quality records defined, legible and protected from loss or damage?

What "we do this" sounds like: "Everything's saved on the server. IT backs it up."

What you could put on the table: A records procedure. A records list naming each record type, its owner, where it lives and its format. Access controls that stop people changing signed records. Evidence that a backup has actually been restored, not just run.

2. Are retention periods defined per record type and enforced?

What "we do this" sounds like: "We keep everything. We never throw anything away."

What you could put on the table: A retention schedule per record type, with the reason for each period: device lifetime, the 2-year minimum, or a specific regulation. A record of what was disposed of, when and by whose authority. Proof that old records you still need are still readable, including ones in formats or systems you no longer use.

"We keep everything" sounds safe. It isn't enforcement. It usually means nobody knows what is there, or whether the oldest files still open.

3. Can you retrieve any required record quickly during an inspection?

What "we do this" sounds like: "We'd find it. It might take a while."

What you could put on the table: An index. Pick any record type and date, and pull it up in minutes, with its signatures intact. Records named and filed consistently, so the next person can find them too.

• A documented records procedure covering identification, storage, security and integrity, retrieval, retention and disposition
• A records list: record type, owner, location, format
• A retention schedule with a period and reason for each record type
• Your definition of device lifetime for each product or family
• Access controls on signed records
• A tested backup restore, with the date and result recorded
• A disposal log: what, when, who authorised
• Copies of obsolete documents kept for the retention period
• A rule for protecting confidential health information
• Validation of any software you use to hold records
• A way to show what changed when a record was corrected

These are patterns I see, not statistics.

Records that live in people. The person who ran supplier evaluations kept them in their own folders. They left. The records are somewhere on a laptop that was wiped.

Retention written, never applied. The procedure says 10 years. Nobody has ever checked what is older than that, or what is younger and missing.

Email as a filing system. The sign-off happened in a reply-all thread. It is real. It just isn't a controlled record, and finding it takes a search across 4 inboxes.

Backups never restored. The backup runs nightly. Nobody has ever tried to get a file back. The first test is during the emergency.

Old formats nobody can open. Records from the system you replaced 6 years ago are "archived". No one still has the software to read them.

A word that causes confusion. Holders of a medical device establishment licence pay an annual retention fee to SAHPRA, on or before the last working day of June each year. That is about keeping your licence, not keeping your records. Both matter. Put the fee date in your calendar, and keep the proof of payment as a record.

SAHPRA is rolling out mandatory ISO 13485:2016 certification in 5 phases, set out in its MD01 notice dated 18 September 2025. Phase 1, from 1 April 2025, asked licence holders to declare a certificate, with no evidence asked for. Phase 2, from 1 June 2025, covered renewals for manufacturers and distributors or importers. Phase 3, from 1 April 2026, covers companies already holding a certificate: they "will be requested to submit", and SAHPRA describes the requirement as mandatory. Phase 4 covers amendments from 1 June 2027. Phase 5 covers all new applications from 1 April 2028.

An inspector's job is to see evidence, not intentions. Records are the evidence.

Under 60 minutes. Do this today:

1. Run a retrieval drill (20 minutes). Write down 5 records: a supplier evaluation from 2 years ago, a training record for your newest staff member, last year's management review minutes, a closed CAPA, and a delivery note for one lot. Find each one. Time each search.
2. Note what slowed you down (10 minutes). Wrong folder? Someone's inbox? No signature? Couldn't open the file?
3. Start a records list (20 minutes). One line per record type: name, owner, where it lives, how long you keep it. Leave the retention column blank where you don't know. Blanks are useful. They show you what to decide.
4. Test one restore (10 minutes). Ask IT to restore one file from backup. Record the date and whether it worked.

Your retrieval times and your blank cells are your starting list.