.png)
Documentation is one of the most important, and often overlooked, elements of an effective quality management system. Whether supporting laboratory testing, manufacturing operations or medical device activities, documentation provides the instructions needed to perform work consistently and the records needed to demonstrate that requirements have been met.
When documentation is poorly controlled, organisations can face audit findings, difficulty investigating issues and challenges demonstrating compliance. A well - designed documentation system helps ensure that information is accurate, accessible and retained for the period required.
Define the documentation your Organisation needs
An effective QMS begins with defining the documentation needed to support organisational activities and compliance obligations.
The documentation structure should reflect the organisation’s activities, process complexity, regulatory obligations and personnel competence. More documents do not necessarily mean better control. The aim is to provide sufficient detail for personnel to perform their work consistently and demonstrate that requirements have been met.
While Chapter 4 (Documentation) of the PIC/S GMP Guide, ISO 9001, ISO 13485, ISO/IEC 17025 and ISO 15189 share common documentation principles, each sets out distinct requirements. Organisations should establish documentation systems that meet the standards and regulatory requirements applicable to their activities.
A practical structure might include:
Document Type | Purpose | Examples |
Policies and system documents | Describe commitments, scope and how the system operates | Quality policy, Quality Manual, Site Master File |
Plans | Define an approach, responsibilities and planned activities | Validation Master Plan, Audit Plan |
Instructions | Explain the requirements and steps to follow | SOPs, work instructions, test methods, specifications |
Templates and forms | Provide a consistent structure for capturing information | Equipment check forms, batch record templates |
Records and reports | Preserve evidence, results and conclusions | Completed forms, batch records, certificates of analysis, validation reports |
External documents | Provide requirements or information used in operations | Standards, supplier manuals, regulatory guidance |
A blank form provides a controlled recording format. Once completed, it becomes a record and needs protection as evidence of the activity.
In practice, organisations often assume that more documentation results in better control. However, excessive or overly complex documentation can increase maintenance requirements, create training burdens and make it harder for personnel to locate the information they need.
Instructions describe the work - records demonstrate it
GMP Chapter 4 distinguishes between instructions and records or reports. An approved procedure explains the expected process, while the resulting records show how it was performed.
For example, an equipment cleaning SOP may describe the cleaning agent, method and acceptance criteria. The cleaning record captures the equipment identity, date, person performing the work and relevant checks. If an unexpected result occurs, the record should provide information and support investigation.
Instructions should be clear enough to guide the intended user. Records should be detailed enough to reconstruct relevant activities and understand the decisions made.
Control documents from creation to withdrawal
Document management is a lifecycle process. Writing and approving an SOP/document is only part of the work.
1. Create and identify - Give documents a clear title and unique reference, define the format and identify the revision. Use language appropriate to the people performing the task. Include responsibilities, steps, acceptance criteria and recording requirements where needed.
2. Review and approve - Check technical accuracy, suitability and consistency with related documents. Define who can review and approve each document type. Approval should be completed before a document is released for use.
3. Release and make accessible - Establish the effective date and make the current approved version available where the activity occurs. Arrange any necessary training before personnel use the revised instruction.
4. Review and change - Define review arrangements and triggers, including changes to processes, equipment, specifications or applicable requirements. Record what changed and consider its effect on associated forms, training and other procedures.
Many document control issues do not arise during document creation. They occur later when reviews are missed, obsolete versions remain accessible, or associated documents and training records are not updated following a change.
Protect records through good documentation practices
A record should allow another person to understand what happened, when it happened, who performed the work and what outcome was obtained.
Practical recording controls include making entries when work occurs, using legible and durable recording methods, identifying the person making the entry and ensuring corrections preserve the original information. Unused fields and missing entries should be addressed through defined rules.
For manual records, the form needs enough space for clear entries. For electronic records, the system needs controls appropriate to its intended use, including permissions and traceability of relevant changes.
A completed record should not become freely editable simply because it is stored in a shared folder. Changes need to remain identifiable, and confidential health information requires protection in accordance with applicable regulatory obligations.
Retention should be defined by document or record type. For example, under the ISO 13485 provisions, records are retained for the organisation defined device lifetime or the period specified by applicable regulatory requirements, with a minimum of two years from device release. Retention requirements vary significantly between industries and record types.
Relevant obsolete manufacturing and testing documents must also remain available for the required period. A single retention period applied to every file may therefore be unsuitable.
Connect document control to data governance
Document control manages instructions and records. Data governance also considers how the information within those records is created, processed, checked, used and preserved.
This lifecycle approach can be translated into six practical questions:
1.Creation – Is the original information captured accurately with its context?
2.Processing – Can calculations and transformations be traced back to the source data?
3.Verification – Are completeness, consistency and accuracy checked?
4.Decision making – Can the evidence supporting a quality decision be retrieved?
5.Retention – Will data remain protected, readable and accessible for the required period?
6.Disposal – Is destruction authorised and controlled once retention obligations have been met?
Controls should reflect the importance of the data and the opportunity for undetected alteration or loss. For example, data used to support a product release decision deserves particular attention.
Paper, electronic and hybrid systems need defined controls
Changing the medium changes how controls are implemented. It does not remove the need for reliable documentation.
A hybrid arrangement might involve an electronic master template, a paper working copy and a scanned completed record. The organisation should define which version is authoritative, how issued copies are controlled, whether scans are complete and how the original records are retained.
FDA guidance recognises that paper and electronic components can coexist when the underlying record requirements are met and the content and meaning are preserved.
A paper printout or PDF does not automatically preserve every element of an electronic record. FDA specifically cautions against assuming printouts always satisfy pharmaceutical record requirements.
For hosted or outsourced services, define responsibilities for access, preservation, retrieval, backup, recovery and the return of records when the service ends.
Common documentation challenges
Common issues identified during audits and quality system reviews include:
Multiple versions of the same document being available for use
Uncontrolled templates used to generate records
Missing evidence of document approval
Undefined retention periods
Inadequate control of externally sourced documents
Electronic records that lack appropriate access or change controls
Addressing these issues early can significantly improve both compliance and operational efficiency.
Put the process into a practical SOP
A Document Management SOP should explain how the organisation manages document identification, ownership, preparation, review, approval, release, access, revision, external documents, obsolete versions, retention and disposal.
The procedure should match how people actually work and make their responsibilities clear. An eQMS can support approvals, version control and retrieval, but effective control also depends on suitable procedures, system setup and personnel training.
Conclusion
Finally, effective document management is not simply about maintaining procedures and forms. It is about ensuring that personnel have access to accurate information, quality decisions can be supported by objective evidence, and records remain trustworthy throughout their lifecycle. Regardless of whether an organisation uses paper-based systems, an eQMS or a hybrid approach, the principles of control, traceability and accessibility remain fundamental.
References and scope
This article draws on ISO 9001 clause 7.5, ISO 13485 clauses 4.2.1–4.2.5 and GMP documentation guidance. It is a practical overview, not a clause-by-clause demonstration of conformity. Sector specific requirements and retention periods need to be assessed separately.