From spreadsheets to a controlled QMS: the four things the foundation must do

The first CAPA log I ever maintained lived in a shared Excel file with version numbers in the filename. Last modified by initials in the footer, like a medieval manuscript colophon. It worked — until it did not.

I lead quality at a contract manufacturing organisation in Bangalore. Three global medtech OEMs route components through us. We sit on roughly forty active suppliers feeding our own line. Two years in, the CAPA log had grown past the point where anyone could confidently say which actions were open, which were overdue, and which had quietly been closed in a chat thread that never made it back to the file.

That is the moment you discover what "controlled" actually means in a QMS context.

The three records that have to stay linked

In plain terms, ISO 13485 wants you to demonstrate three things with evidence:

1. That a defined process exists, was followed, and produced a record (forms and process records).
2. That the people doing the work were competent to do it (training records).
3. That when something went wrong, it was investigated, addressed, and prevented from recurring (CAPA records).

The hard part is not any one of those. The hard part is the link between them. The training record needs to point back to the procedure the person was trained on. The CAPA needs to name the nonconformity it was raised against, the process record that triggered it, and the training update that came out of it. When those links live in separate spreadsheets — or worse, in separate people's memories — the system is no longer a system. It is a collection of documents that happens to live in the same folder.

What spreadsheets actually break

Most medtech SMEs start with spreadsheets and many stay there longer than they should. The pattern is predictable:

• Shared files accumulate versions faster than anyone reviews them. Latest_FINAL_v3_use_this_one.xlsx is not a controlled record.
• Filename discipline erodes the moment someone is on leave.
• Audit trails are absent by default. Who changed which cell, and why, is unfindable.
• Cross-references are typed by hand. The CAPA log says "see NCR-127." Does NCR-127 actually exist in the same workbook? Is it part of a connected workflow at all, or stranded two folders away?
• Review and approval happen out of band — in email, in chat, or verbally. The record never reflects that approval happened.

ISO 13485:2016 §4.2.4 and 21 CFR 820.180 both ask for records that are legible, readily identifiable, and retrievable. The clause reads simply. Living with it for ten years tells you how strict the expectation actually is.

What the foundation has to give you

If you are evaluating — or building — the first controlled QMS for a small manufacturer ahead of a notified-body audit, the foundation should do four things well, in order:

• Hold records, not just files. A form submitted today needs to be timestamped, attributable, and immutable once approved. If your team can edit last month's inspection record by opening the file, you do not have a controlled record.
• Link records by reference, not by copy-paste. A CAPA should open against a specific nonconformity. A training assignment should attach to a specific procedure revision. The link is the system.
• Make review and approval a visible workflow. Reviewers need to see what they are approving, record their decision, and produce evidence that the decision was made on a specific date by a specific person. A small amount of process automation here — routing, escalation, reminders — pays for itself faster than any dashboard you can build.
• Survive your first audit. If an auditor asks for every CAPA raised in the last year and every record linked to each one, you should be able to produce that list in minutes, not days.

Notice what is missing from that list: dashboards, AI assistants, supplier portals, fancy analytics. Useful, eventually. Not the foundation.

What I would tell someone starting now

If a two-person QA-RA team asked me which capabilities to prioritise for their first controlled system, the answer is unglamorous.

• Forms that enforce fields — dates, signatures, required attachments — instead of capturing whatever the operator typed.
• A training register that ties each role to specific procedures and shows competence status at a glance.
• A CAPA log that does not allow closure without a verified effectiveness check and linked evidence.
• A document control workflow where revisions are versioned and superseded files are not deletable.

Everything else — risk management integration, supplier qualification, complaints handling, change control — is downstream of those four. If the foundation is right, the rest of the modules slot in. If the foundation is spreadsheets pretending to be records, every module you bolt on top inherits the rot.

The CAPA log in our shop today is traceable back to the inspection records, the training records, and the change tickets that touched the affected procedure. When a notified body auditor asks how a particular NCR was handled end to end, the answer is a single search, not a tour through four shared drives.

That is what "controlled" buys you. Not software. Connected, reviewable, traceable records — whatever system holds them.

Open question

For the small medtech teams reading this: what broke first in your current setup — the CAPA log, the training register, or the links between them?