# Engineering document control explained for hardware teams

Document lifecycles, numbering, revision schemes and distribution to suppliers, plus what ISO 9001 and ISO 13485 require from a document control procedure.

## The aim of document control

**Engineering document control** is the set of rules and records that decide which version of a drawing, specification or procedure is valid, who approved it, and who is allowed to use it. A controlled document has a unique identifier, a revision, an approval and a status. The aim: everyone who builds, inspects or buys from a document works from the current released revision, and you can prove it.

## What counts as a controlled document

A document needs control once people other than its author act on it. In a hardware company that usually means:

- Drawings, CAD models and 3D data used for manufacture or inspection.
- Specifications, bills of materials and material declarations.
- Work instructions, test procedures and inspection plans.
- Labelling, artwork and instructions for use.
- Quality procedures, forms and templates.
- Documents of external origin you depend on, such as supplier datasheets and standards.

**Records** are a special case. A record is evidence that something happened: a test report, a signed approval, an inspection result. You revise documents; records stay as created, and any correction must remain visible.

## The controlled document lifecycle

Most document control systems use a handful of states with similar logic, whatever the names.

![Draft, in review, released, superseded. Reviewers can send a draft back. A released document changes only through a new revision, and can be withdrawn as obsolete.](https://neopdm.com/diagrams/document-lifecycle.en.svg)

| State | What it means | Who can use it |
|---|---|---|
| **Draft** | Work in progress. Its authors can edit it | Authors only |
| **In review** | Submitted for approval. Content is frozen while reviewers decide | Reviewers |
| **Released** (approved) | Approved for use. Cannot be edited; changes require a new revision | Everyone with access |
| **Superseded** | Replaced by a newer revision, kept for history and traceability | Reference only |
| **Obsolete** | Withdrawn with no replacement, marked so nobody uses it by mistake | Reference only |

![Screenshot of the lifecycle panel in neo with three steps: edited, approved, and released and locked, each with person and time.](https://neopdm.com/screenshots/lifecycle-panel.webp "An item's lifecycle in neo. 1: edited. 2: approved. 3: released and locked; the next change needs a new revision.")

Define the transitions as carefully as the states. Moving from draft to released should require the defined approvals. Nobody should be able to move a released document back to editable; the only path is a new revision, usually through an [engineering change](https://neopdm.com/en/engineering-change-management).

## Numbering and nomenclature

Treat a document number as a pure identifier. Good numbering schemes share a few properties:

- **Unique and permanent.** A number is never reused, even after the document is obsolete.
- **Independent of revision.** The number stays the same across revisions A, B and C.
- **Lightly structured, if at all.** A prefix for document type (for example DWG, SPEC, WI) helps people scan lists. Encoding project, product line and department into the number tends to break when the organisation changes.
- **Linked, not embedded.** Keep relationships between parts and documents in the system, outside the number.

Part numbers follow similar rules, with one extra decision: when a change needs a new part number instead of a new revision. Most teams settle that with the form, fit, function test.

## Revision schemes

Your revision scheme should show at a glance which state is released and which is a working copy.

| Scheme | Example | Common use |
|---|---|---|
| Letters | A, B, C | Released revisions of drawings and specifications |
| Numbers | 1, 2, 3 | Released revisions in some industries, or working versions |
| Pre-release prefix | 0.1, 0.2 or X1, X2 | Prototypes and drafts before first release |
| Combined | B.3 | Released revision B, third working version toward the next revision |

Many teams skip letters that look like numbers, such as I, O, Q and S. Write your scheme down and use it for every document type; auditors often flag mixed schemes.

![Prototypes X1 and X2 before the first release, released revision A, working versions A.1 and A.2 towards the next revision, then released revision B.](https://neopdm.com/diagrams/revision-scheme.en.svg)

## Controlled and uncontrolled copies

A **controlled copy** is one the system knows about: when the document is revised, the controlled copy is updated or withdrawn. An **uncontrolled copy** is anything else, such as a printout, a PDF attached to an email or a file saved to a laptop.

You cannot avoid uncontrolled copies, so mark them. Many teams add a footer or watermark stating that printed copies are uncontrolled and valid only on the day of printing. Better still, make the controlled copy so easy to reach that nobody needs a private one.

## Distribution to production and suppliers

After release, the document has to reach the point of use, and the old revision has to leave it.

- **Production** needs the released revision at the workstation, and only that revision.
- **Suppliers and contract manufacturers** need the documents for the parts they make, and nothing else.
- **Revision changes** go to the people who hold the previous revision, and they confirm receipt.

![Revision C is released in neo. The supplier portal shows the current revision C. A PDF emailed when revision A was current still shows revision A.](https://neopdm.com/diagrams/controlled-copies.en.svg)

Most document control breaks down at PDFs sent by email. The email stays as sent when the document changes, and nobody can tell later which revision the supplier had.

## Records retention

Retention rules set how long you keep documents and records and how you dispose of them. Set them per document type, based on product lifetime, contractual requirements and regulation. For medical devices, ISO 13485 sets minimums (see below). Keep superseded and obsolete revisions as well: when a field issue appears years later, you need to know exactly what you built.

## What ISO 9001 and ISO 13485 require

Both standards expect controlled documents, in different wording.

**ISO 9001:2015, clause 7.5 (documented information)**

- When creating and updating documented information, ensure appropriate identification and description, format and media, and review and approval for suitability and adequacy (7.5.2).
- Control documented information so that it is available and suitable for use where and when needed, and adequately protected (7.5.3.1).
- Address distribution, access, retrieval and use; storage and preservation, including legibility; control of changes, such as version control; and retention and disposition (7.5.3.2).
- Identify and control documented information of external origin, and protect retained evidence from unintended alteration.

**ISO 13485:2016, clauses 4.2.4 and 4.2.5**

- A documented procedure for control of documents (4.2.4), covering review and approval before issue, review and re-approval of changes, identification of current revision status and changes, availability of relevant versions at points of use, legibility, control of external documents, prevention of deterioration or loss, and prevention of unintended use of obsolete documents.
- Changes to documents are reviewed and approved by the original approving function or another designated function with access to the relevant background.
- At least one copy of obsolete documents is retained for a defined period, at least the lifetime of the device as defined by the organisation, but not less than the retention period of any resulting record.
- A documented procedure for control of records (4.2.5), covering identification, storage, security and integrity, retrieval, retention time and disposition. Changes to a record must remain identifiable, and records are kept for at least the lifetime of the device, but not less than two years from release.

For devices sold in the US, FDA's [Quality Management System Regulation](https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr) (21 CFR Part 820) has incorporated ISO 13485:2016 by reference since 2 February 2026, and keeps its own section on control of records (820.35). Where documents and signatures are electronic, [21 CFR Part 11](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11) also applies. For the exact wording, read the standards themselves.

## Checklist for a document control procedure

Your written procedure should answer these questions:

1. Which document types are controlled, and which are not?
2. How are documents and parts numbered, and who assigns numbers?
3. What revision scheme is used, and what marks a pre-release version?
4. Which states can a document be in, and who can move it between them?
5. Who reviews and approves each document type?
6. How are changes requested, approved and linked to the documents they affect?
7. How do released documents reach production and suppliers, and how are old revisions withdrawn?
8. How are uncontrolled copies identified?
9. How are external documents identified and kept current?
10. How long is each document and record type kept, and how is it disposed of?
11. Who can view, edit, approve and release, and how is access reviewed?
12. How is the audit trail kept, and how quickly can you produce the history of one document?

## How neo supports document control

neo is a cloud PDM system that keeps documents, CAD files, revisions and approvals in one controlled place.

- **Configurable nomenclature** for part numbers and document IDs, set up with our success team during onboarding.
- **Check-in of files**, with revisions and approvals tracked on each document.
- **Role-based permissions** for view, edit, approve and release, inherited from the project.
- **Approval chains and validated electronic signatures**, with audit trails designed to meet 21 CFR Part 11 requirements.
- **Configurable templates** that check a document set is complete before release.
- **Supplier and customer portals** where external partners see only the released documents they need.
- **Complete audit logs** and export of all data at any time.

neo supports FDA, ISO 13485 and ISO 9001 style document control; your procedure decides how you use it. To see it with your own documents, [take the product tour](https://neopdm.com/en/demo) or [talk to us](https://neopdm.com/en/contact).