Documentation in a Quality Management System: Clear Instructions, Reliable Records and Effective Control

Documentation is one of the most important, and often overlooked, elements of an effective quality management system. Whether supporting laboratory testing, manufacturing operations or medical device activities, documentation provides the instructions needed to perform work consistently and the records needed to demonstrate that requirements have been met.

When documentation is poorly controlled, organisations can face audit findings, difficulty investigating issues and challenges demonstrating compliance. A well - designed documentation system helps ensure that information is accurate, accessible and retained for the period required.

Define the documentation your Organisation needs

An effective QMS begins with defining the documentation needed to support organisational activities and compliance obligations.

The documentation structure should reflect the organisation’s activities, process complexity, regulatory obligations and personnel competence. More documents do not necessarily mean better control. The aim is to provide sufficient detail for personnel to perform their work consistently and demonstrate that requirements have been met.

While Chapter 4 (Documentation) of the PIC/S GMP Guide, ISO 9001, ISO 13485, ISO/IEC 17025 and ISO 15189 share common documentation principles, each sets out distinct requirements. Organisations should establish documentation systems that meet the standards and regulatory requirements applicable to their activities.

A practical structure might include:

Document Type	Purpose	Examples
Policies and system documents	Describe commitments, scope and how the system operates	Quality policy, Quality Manual, Site Master File
Plans	Define an approach, responsibilities and planned activities	Validation Master Plan, Audit Plan
Instructions	Explain the requirements and steps to follow	SOPs, work instructions, test methods, specifications
Templates and forms	Provide a consistent structure for capturing information	Equipment check forms, batch record templates
Records and reports	Preserve evidence, results and conclusions	Completed forms, batch records, certificates of analysis, validation reports
External documents	Provide requirements or information used in operations	Standards, supplier manuals, regulatory guidance

A blank form provides a controlled recording format. Once completed, it becomes a record and needs protection as evidence of the activity.

In practice, organisations often assume that more documentation results in better control. However, excessive or overly complex documentation can increase maintenance requirements, create training burdens and make it harder for personnel to locate the information they need.

Instructions describe the work - records demonstrate it

GMP Chapter 4 distinguishes between instructions and records or reports. An approved procedure explains the expected process, while the resulting records show how it was performed.

For example, an equipment cleaning SOP may describe the cleaning agent, method and acceptance criteria. The cleaning record captures the equipment identity, date, person performing the work and relevant checks. If an unexpected result occurs, the record should provide information and support investigation.

Instructions should be clear enough to guide the intended user. Records should be detailed enough to reconstruct relevant activities and understand the decisions made.

Control documents from creation to withdrawal

Document management is a lifecycle process. Writing and approving an SOP/document is only part of the work.

1.     Create and identify - Give documents a clear title and unique reference, define the format and identify the revision. Use language appropriate to the people performing the task. Include responsibilities, steps, acceptance criteria and recording requirements where needed.

2.     Review and approve - Check technical accuracy, suitability and consistency with related documents. Define who can review and approve each document type. Approval should be completed before a document is released for use.

3.     Release and make accessible - Establish the effective date and make the current approved version available where the activity occurs. Arrange any necessary training before personnel use the revised instruction.

4.     Review and change - Define review arrangements and triggers, including changes to processes, equipment, specifications or applicable requirements. Record what changed and consider its effect on associated forms, training and other procedures.

5.     Withdraw and preserve - Prevent unintended use of obsolete instructions while preserving the versions needed to interpret historical records. A superseded procedure may still be needed to understand how work was performed at an earlier date.

Many document control issues do not arise during document creation. They occur later when reviews are missed, obsolete versions remain accessible, or associated documents and training records are not updated following a change.

Protect records through good documentation practices

A record should allow another person to understand what happened, when it happened, who performed the work and what outcome was obtained.

Practical recording controls include making entries when work occurs, using legible and durable recording methods, identifying the person making the entry and ensuring corrections preserve the original information. Unused fields and missing entries should be addressed through defined rules.

For manual records, the form needs enough space for clear entries. For electronic records, the system needs controls appropriate to its intended use, including permissions and traceability of relevant changes.

A completed record should not become freely editable simply because it is stored in a shared folder. Changes need to remain identifiable, and confidential health information requires protection in accordance with applicable regulatory obligations.

Retention should be defined by document or record type. For example, under the ISO 13485 provisions, records are retained for the organisation defined device lifetime or the period specified by applicable regulatory requirements, with a minimum of two years from device release. Retention requirements vary significantly between industries and record types.

Relevant obsolete manufacturing and testing documents must also remain available for the required period. A single retention period applied to every file may therefore be unsuitable.

Connect document control to data governance

Document control manages instructions and records. Data governance also considers how the information within those records is created, processed, checked, used and preserved.

This lifecycle approach can be translated into six practical questions:

1.Creation – Is the original information captured accurately with its context?

2.Processing – Can calculations and transformations be traced back to the source data?

3.Verification – Are completeness, consistency and accuracy checked?

4.Decision making – Can the evidence supporting a quality decision be retrieved?

5.Retention – Will data remain protected, readable and accessible for the required period?

6.Disposal – Is destruction authorised and controlled once retention obligations have been met?

Controls should reflect the importance of the data and the opportunity for undetected alteration or loss. For example, data used to support a product release decision deserves particular attention.

Paper, electronic and hybrid systems need defined controls

Changing the medium changes how controls are implemented. It does not remove the need for reliable documentation.

A hybrid arrangement might involve an electronic master template, a paper working copy and a scanned completed record. The organisation should define which version is authoritative, how issued copies are controlled, whether scans are complete and how the original records are retained.

FDA guidance recognises that paper and electronic components can coexist when the underlying record requirements are met and the content and meaning are preserved.

A paper printout or PDF does not automatically preserve every element of an electronic record. FDA specifically cautions against assuming printouts always satisfy pharmaceutical record requirements.

For hosted or outsourced services, define responsibilities for access, preservation, retrieval, backup, recovery and the return of records when the service ends.

Common documentation challenges

Common issues identified during audits and quality system reviews include:

• Multiple versions of the same document being available for use

• Uncontrolled templates used to generate records

• Missing evidence of document approval

• Undefined retention periods

• Inadequate control of externally sourced documents

• Electronic records that lack appropriate access or change controls

  
  

Addressing these issues early can significantly improve both compliance and operational efficiency.

Put the process into a practical SOP

A Document Management SOP should explain how the organisation manages document identification, ownership, preparation, review, approval, release, access, revision, external documents, obsolete versions, retention and disposal.

The procedure should match how people actually work and make their responsibilities clear. An eQMS can support approvals, version control and retrieval, but effective control also depends on suitable procedures, system setup and personnel training.

Conclusion

Finally, effective document management is not simply about maintaining procedures and forms. It is about ensuring that personnel have access to accurate information, quality decisions can be supported by objective evidence, and records remain trustworthy throughout their lifecycle. Regardless of whether an organisation uses paper-based systems, an eQMS or a hybrid approach, the principles of control, traceability and accessibility remain fundamental.

References and scope

This article draws on ISO 9001 clause 7.5, ISO 13485 clauses 4.2.1–4.2.5 and GMP documentation guidance. It is a practical overview, not a clause-by-clause demonstration of conformity. Sector specific requirements and retention periods need to be assessed separately.