Document Control – Governance of GxP Procedures, Records, and Change

This topic is part of the SG Systems Global regulatory glossary series.

Updated October 2025 • Quality Systems • 21 CFR Part 11 / EU Annex 11 / Predicate Rules

Document Control is the structured governance of GxP documents across their lifecycle—creation, review, approval, issuance, use, revision, retention, and archival. It is the connective tissue of a Pharmaceutical Quality System (PQS): procedures that define how work shall be performed, records that prove what actually happened, and change processes that keep both synchronized with validated operations. In practice, “document control” spans controlled masters (SOPs, specifications, test methods, labels, BOMs), controlled forms and templates, executed records (e.g., BMR / eBMR), and governance artifacts such as Change Control and CAPA. It must demonstrate ALCOA+ principles and comply with 21 CFR Part 11 / Annex 11 when electronic.

“If you cannot show who authored the rule, who approved it, which version was in force, and how the record links back, you don’t have control—you have paperwork.”

1) What It Is

At its core, Document Control ensures that the right version of a controlled document is accessible to the right people at the right time, and that obsolete versions cannot be mistakenly used. Controlled documents include policies, SOPs, work instructions, manufacturing formulas, test methods, material and product specifications, validation protocols/reports (see CSV and Cleaning Validation), master production and control records, label masters and artwork, and quality system procedures (deviations/OOS, Approval Workflow, CoA issuance). Executed records—e.g., signed eBMR steps, Component Release decisions, Batch Release—must trace to the master versions in force at time of use and be preserved per your Data Retention & Archival policy.

2) Regulatory Anchors & Scope

Predicate GMP rules (21 CFR 210/211, biologics 600–680, devices 820, and food 117 / supplements 111) require written procedures, accurate records, and management of changes. When these are electronic, Part 11 and Annex 11 add identity, security, audit trail, signature, and retention expectations. Document Control therefore covers:

• Authoring & change of masters (policies, SOPs, specs, methods, label art, master batch records).
• Distribution & access to current versions at point of use (shop floor, QC, warehouse).
• Execution of controlled forms into records (e.g., eBMR steps, deviation forms).
• Linkage between master version and executed record via version/effective date and audit trail.
• Periodic review to keep documents current with process and regulatory reality.
• Retention & archival ensuring readability and context for the required period.

3) Lifecycle Governance: From Draft to Archive

Creation & numbering. Drafts are authored against a template library so structure is consistent (purpose, scope, responsibilities, procedure, records, references). Each controlled document receives a unique ID, title, and classification (policy/SOP/spec/label/BMR, etc.), and is mapped to processes, assets, and products for impact analysis. Controlled fields for related masters—e.g., a BOM or test method—ensure later linkage.

Review & approval. Content moves through role-based Approval Workflow (author → technical reviewer(s) → QA → regulatory/QP as applicable). Review enforces clarity and testability; QA verifies alignment with validation status (CSV, Cleaning Validation) and related procedures. Approvals require unique electronic signatures with meaning and timestamp (review/approval/responsibility) under Part 11 controls.

Effective dating & training. An effective date balances release urgency with readiness. Training needs are derived automatically from document classification; learners are assigned by role/location and must complete training before the document is effective for them. Systems may enforce training gating—preventing execution of impacted steps until training is complete.

Distribution & control of copies. Shop-floor access to current versions is through the system; printed controlled copies are watermarked with version and validity windows. Obsolete versions are automatically superseded and made read-only (retained for history, not use).

Revision & change control. Revisions follow formal Change Control with impact assessments on validation status, labels, training, ERP/MES/LIMS interfaces, and risk documents (HACCP/FMEA). Minor vs major changes dictate approval depth and whether revalidation is required. The system maintains redlines, revision history, and rationale with audit trails.

Archival & decommissioning. On retirement, documents and their metadata (version history, signatures, trails, effective periods) are archived per policy. For electronic systems, format sustainability and rendering capability (viewer) are validated to avoid “PDF-only” traps that lose metadata; see Retention & Archival.

4) What Documents Are In Scope (Examples)

• Quality governance: Quality Manual, policies (Deviation/OOS/OOT, CAPA, supplier management), and APR/PQR procedures.
• Manufacturing control: Master Batch Records (MBR), Batch Tickets, Batch Weighing instructions, line clearance, status labels.
• Laboratory & release: test methods/specs, sampling plans (AQL), OOS/OOT handling, CoA issuance, SPC control limits.
• Warehouse & materials: Bin/Location Management, Directed Picking, Dock-to-Stock, Dynamic Lot Allocation, Traceability.
• Risk & safety: allergen and cross-contamination control, cleaning and changeover, environmental monitoring.
• IT/CSV: CSV plans/reports, data integrity, security, backup/restore, business continuity.

5) Technical Controls for Electronic Document Control

• Identity & access. Unique users, role-based permissions, segregation of duties; MFA where risk warrants. No shared accounts.
• Audit trails. Immutable logs for authoring, review, approval, effective dating, distribution, and retirement; reason-for-change capture. See Audit Trail (GxP).
• Electronic signatures. Part 11-compliant, linked to records with meaning of signature and time zone.
• Versioning & supersede logic. Automatic effective/retire states; enforced withdrawal of obsolete versions at points of use (including printing controls).
• Linkage to execution. eBMR steps bind to master version in force at start; labels and CoAs pull from approved masters via controlled interfaces.
• Training controls. Role mapping to documents; completion gating; periodic retraining on major revisions.
• Search & retrieval. Full-text and metadata filters (status, owner, product, line); rapid rendering for inspection.
• Integration. Validated data exchange with MES/LIMS/WMS/ERP via the V5 Connect API, with acknowledgement and field-level mapping.

6) Common Failure Modes & How to Avoid Them

• Shadow documents. Uncontrolled “desk SOPs” and spreadsheets. Fix: centralize in controlled repository; retire and migrate with review.
• Obsolete versions at point of use. Printed copies without expiry watermarks. Fix: controlled copy printing, expiry, and scan-back on use.
• Mismatched labels/specs. Recipe updated but label artwork lags. Fix: bind label content to approved recipe and enforce Approval Workflow.
• Weak change control. “Typos” slipping as major content changes. Fix: classify changes, require impact assessment, redlines, and QA approval.
• Training not synchronized. New SOP effective before training. Fix: training gating and effectiveness checks.
• Broken traceability. eBMR references a superseded spec. Fix: lock step-to-master link at execution start and record version in the dossier.

7) Metrics That Prove Control

• On-time periodic review rate by document class (policy, SOP, method, spec).
• Training completion before effective date (% users trained on time).
• Obsolete-at-use incidents (attempted access/print of retired versions).
• Change-control cycle time and recurrence of CAPAs tied to documentation issues.
• Inspection retrieval time to render a complete controlled set (master + record + trails).

8) How It Relates to V5

V5 by SG Systems Global embeds Document Control across MES, QMS, and WMS. In V5 MES, eBMR steps are generated from approved masters; version-in-force is locked at batch start; Dual Verification and e-signatures govern critical actions; Barcode Validation ensures the right material/spec pairing. In V5 QMS, controlled documents follow structured Approval Workflows, periodic reviews, and training assignments; Change Control links revisions to risk, validation, and downstream systems. In V5 WMS, status labels, pick instructions, Directed Picking, and Dock-to-Stock SOPs are version-controlled; transactions are blocked if linked masters are obsolete. Across the platform, Part 11/Annex 11 audit trails capture authorship, approvals, and effective states. For APR/PQR, V5 renders document change histories, training status at time of change, and evidence that batch execution used the correct versions.

9) FAQ

Q1. Are executed records part of “Document Control” or separate?
Both. Masters (SOPs/specs) and executed records (eBMR entries, CoAs, deviations) are controlled. Executed records must link to the master version in force at use and be retained with their metadata and audit trails.

Q2. Can we keep paper to avoid Part 11?
Paper reduces scope but increases risk: hybrid models create uncontrolled transcriptions and lost context. If electronic source data exist (scales, LIMS, barcode scans), regulators expect electronic controls at source.

Q3. How often should we do periodic review?
Risk-based—typically 1–3 years by class (shorter for high-impact procedures). Triggers include process/validation changes, regulatory updates, or recurring CAPAs.

Q4. What proves the right version was used?
System evidence: eBMR references to master IDs/versions; label prints bound to approved artwork version; audit-trail entries for effective/retired states; training completion prior to use.

Q5. How do we manage translations and local variants?
Treat each language as a controlled derivative linked to a global master; changes to the master trigger synchronized updates and training across locales.