One of the controversial issues with interpretation of ISO 13485:2003 Standard and other standards is control of forms. Many companies, by some reason, treat forms differently than documents, leaving them not controlled. Per ISO 13485:2003, clause 4.2.3, "Documents required by the quality management system shall be controlled. Let's see if a form qualifies to be a "document" that "shall" be controlled.

Organizations use forms and tables within their quality management systems Often, it is not necessary to prepare a traditional instruction or a procedure with all the sections, such as scope, purpose and process description if a effortless table can provide this information. Frequently companies get non-conformities during audits of their QMS because forms used are not controlled.

Often, being asked about not controlled forms, my clients reply: "This is "just a form" a form." I always wonder why a form should be treated differently than any other instruction or a procedure. If a form is not controlled, how would we know that we need it? If it is not controlled, it cannot be referenced within one's QMS.If your forma are not controlled, how would you know that you use the latest revision of it?

Anyway, what is a form? A short review will help answering this question. If we have a list of directions telling us to:

- make a table with two columns

- note your organization's name in the first column

- enter your company's URL into the second column

Most likely, we all would call this three-line direction an instruction. If we agree that this is an instruction, it should be controlled as any other QMS.

Now, let's imagine that we were given a two-column form, only being asked to complete it. The first column is titled "You company name" and the second column "Company's Website". Obviously, we would enter our company name and our Website address in the table. It means that we interpreted the table as an "instruction".

If we concur that the first three-line instruction in written in English was a "real" instruction that needs to be controlled, the other, empty form, resulting in the same output, must also be an instruction! Shouldn't this type of an instruction be controlled also?

I think that the confusion regarding forms used in ISO 13485 quality management systems is based on the fact that forms serve two purposes. Empty forms are brief instructions written in tabular language. After forms are filled out, they become records. Records are managed in a different manner than procedures. Let's remember this and treat our blank forms as instructions letting the documentation management process govern them. There are a couple of simple tests you may take when you are tempted to use a form that has not been assigned a part number:

- Let's say that somebody changed your favorite form. Would you want to know why?

- If you changed your form, would you like personnel on the floor use the most resent revision?

- If you were absent, would you like folks to find your form just by finding a reference to it in your ISO 13485:2003 quality management system?

If there was a "yes" at least once, your form should be controlled as required by the standard.