Document Management Systems

GxP Document Control and Good Documentation Practice: Requirements for the Life Cycle of Controlled Documents

Short answer: Document control ensures that only reviewed, approved and current instructions are in use, and that every record is created, corrected and retained traceably. EU GMP Chapter 4, 21 CFR 211, ICH Q7 and ICH E6(R3) all require this explicitly.[1][3][4][8]

Terminology: In the pharmaceutical sector, GDP usually means Good Distribution Practice. This article therefore uses GDocP for Good Documentation Practice.

1. Definition

Chapter 4 calls good documentation an essential part of the quality assurance system and distinguishes two types. Instructions are directions such as specifications, manufacturing formulae and SOPs. Records/reports provide evidence of what was actually done. Either type can be paper-based, electronic or hybrid.[1] The aim of GDocP is records that meet ALCOA+ (see Data Integrity and ALCOA+).

2. Regulatory framework

  • EU GMP Chapter 4 Documentation (January 2011, in operation since 30 June 2011): instructions are approved, signed and dated by authorised persons and are uniquely identifiable. QMS documents should be “regularly reviewed and kept up-to-date” (4.5).[1] The 2025 revision draft (consulted on from 7 July to 7 October 2025) adds data governance, hybrid solutions and electronic records. No final version was available to us at the access date.[2]
  • 21 CFR 211: 211.100(a) requires written production and process control procedures, reviewed and approved by the quality unit. Under 211.100(b), deviations must be recorded and justified. Subpart J (211.180–211.198) covers records and reports, including master and batch records (211.186, 211.188), their review (211.192), laboratory records (211.194) and complaint files (211.198).[3]
  • ICH Q7 section 6: issuance, revision, superseding and withdrawal are “controlled with maintenance of revision histories” (6.11). Corrections are dated and signed and leave the original entry readable (6.14).[4]
  • ICH Q10: the pharmaceutical quality system framework in which document control and change management sit.[5]
  • WHO TRS 996 Annex 5 (2016): guidance on good data and record management practices, replaced by TRS 1033 Annex 4 (2021).[6][7]
  • PIC/S PE 009: the PIC/S GMP Guide. Part I Chapter 4 corresponds to EU GMP Chapter 4.[17]
  • GCP: ICH E6(R3) replaces “essential documents” with essential records (Appendix C), meaning documents, data and relevant metadata in any format, which must be identifiable and version-controlled.[8] Article 58 of Regulation (EU) No 536/2014 requires the trial master file to be archived for at least 25 years after the end of the trial. Alterations must be traceable and access is restricted to named individuals.[10] See TMF/eTMF and GCP.
  • In passing: for medical devices, ISO 13485:2016 clause 4.2.4 covers control of documents.[19]

3. Document hierarchy

Chapter 4 lists required GMP documentation including the site master file, specifications, manufacturing and packaging instructions, procedures (SOPs), protocols, reports and records.[1]

Document type – Purpose – Example – Typical approval route
Document typePurposeExampleTypical approval route
Quality manual / policyQMS principles and responsibilitiesQuality manual, data integrity policyAuthor QA, approval senior management
Site master fileDescription of a site's GMP activitiesSMF per EU templateQA, approval site head/QP
SOPBinding process sequenceDeviation management SOPDepartment, SME review, QA approval
Work instructionDetailed task stepsOperating a balanceDepartment, approval by area head and QA
Form / templateStructured data captureBlank batch record, logbook templateAs parent SOP, controlled issue
RecordEvidence of the activityCompleted batch record, training recordContent review and approval (e.g. 211.192)

4. Life cycle of controlled documents

  1. Creation on an approved template with a unique number and version.[1]
  2. Review by qualified persons. Under 21 CFR 211.186(a), master production records are prepared by one person and independently checked by a second, each dating and signing.[3]
  3. Approval with a defined effective date.[1]
  4. Training before the effective date, with training records retained (cf. ICH Q7 6.12).[4]
  5. Distribution of only the current version at the point of use, with superseded copies withdrawn.[1]
  6. Versioning and change control with revision history.[4][5]
  7. Periodic review: required regularly, but no fixed regulatory interval is set. The company defines the interval in an SOP on a risk basis.[1]
  8. Retirement, controlled and documented.[4]
  9. Archiving and retention: under EU GMP, batch documentation is kept for at least one year after batch expiry or at least five years after certification by the Qualified Person, whichever is longer.[1] In the US, at least one year after batch expiry (211.180(a)).[3] For APIs with retest dates, at least three years after complete distribution (ICH Q7 6.13).[4] For EU clinical trials, at least 25 years (CTR Article 58).[10]

5. GDocP rules in practice

  • Completing records: entries are made at the time of the action (Chapter 4.8), indelibly and in the spaces provided (ICH Q7 6.14).[1][4]
  • Correcting: any alteration is signed and dated, the original information stays readable, and the reason is recorded where appropriate (Chapter 4.9).[1] In practice this means a single-line cross-out, no overwriting and no correction fluid.[7]
  • Dating and signing: actual date only, never back-dating or forward-dating.[6]
  • Blank fields: unused fields are struck through or marked “N/A” with initials and date so that they cannot be completed later.[3][6]
  • Rounding and transcription: rounding rules are defined in the SOP, critical transcriptions are verified and the original is retained.[6][7]
  • Copies and uncontrolled printouts: according to the FDA, blank forms are controlled by the quality unit or another document control method, issued as numbered sets and reconciled. Incomplete or erroneous forms stay in the record with a justification.[11] Printed instructions should be marked as uncontrolled or given an expiry.

6. Electronic document management (eDMS)

A GxP-capable eDMS provides versioning, approval workflows, electronic signatures, an audit trail, read-and-understood training records and archiving. Part 11 requires electronic signatures to be unique to one individual and linked to the record, showing name, date, time and meaning.[12] Annex 11 requires electronic signatures to have the same impact as handwritten ones, to be permanently linked to the record and to include time and date.[13] See 21 CFR Part 11.

Limits of network drives and unvalidated cloud storage: a network drive normally lacks enforced versioning, approval workflows, an immutable audit trail and compliant signatures. Controlled issue, revision history and traceability can then only be achieved through substantial manual controls.[1][4][13] Unvalidated cloud storage does not meet the Annex 11 validation requirement.[13]

Benefits and prerequisites: a validated eDMS technically enforces that only the current version is available, that approvals follow the defined sequence and that every change is logged. One supplier source also stresses the efficiency and error-reduction benefits of electronic GDocP.[18] The prerequisites are validation (see Computer System Validation), documented configuration of roles and workflows, established processes and supplier assessment.

7. Typical inspection findings on documentation

  • FDA, FY2023: according to GMP Trends (January 2024), the FDA “issued 510 Form 483s to drug facilities”. 21 CFR 211.22(d) “Procedures not in writing, fully followed” was the most frequent observation with 152 citations (19%), followed by 211.192 (114) and 211.100(a) (86) (secondary analysis).[14]
  • FDA warning letters 2025 (85 analysed): 211.100(a) was cited 33 times and 211.192 22 times. 15% of the letters raised data integrity.[15]
  • MHRA GMP inspections: according to Barbara Unger, in 2018 Chapter 4 was the second most cited chapter after Chapter 1, with “almost 760 deficiencies” (PharmaWhiz: 757, 12% of 6,209). In 2019 Chapter 4 accounted for 700 deficiencies and Chapter 1 for just over 1,300 (secondary analyses of MHRA raw data).[16]
  • MHRA GCP inspections 2018/19 (91 inspections): three critical findings concerned “Record Keeping/Essential Documents”, two at commercial sponsors and one at a CRO. One stated: “The TMFs reviewed were incomplete to such an extent that they could not form the basis of inspection”.[9]

We could not find quantitative analyses of EMA inspection findings on documentation.

FAQ

What is document control?

The controlled process for creating, reviewing, approving, distributing, changing, reviewing periodically, retiring and archiving GxP documents, with a revision history.[1][4]

What is the difference between a document and a record?

A document instructs what to do. A record evidences what was done.[1]

What does Good Documentation Practice mean?

GDocP is the set of rules for creating records that are contemporaneous, legible, attributable, accurate and traceably correctable.[1][7]

How do you correct an entry in a GxP-compliant way?

Strike through once so that the original remains readable, enter the correct value, then sign, date and give a reason where appropriate. Electronic systems do this through an audit trail.[1][4]

How often must SOPs be reviewed?

Regularly. The regulations set no fixed interval, so the company defines one in an SOP on a risk basis.[1]

Is a network drive sufficient for GxP documents?

Usually not without substantial additional controls, because it lacks enforced versioning, approval workflows, an audit trail and compliant electronic signatures.[12][13]

References

  1. European Commission: EudraLex Vol. 4, Chapter 4 Documentation, revision January 2011. https://health.ec.europa.eu/system/files/2016-11/chapter4_01-2011_en_0.pdf (accessed 6 November 2026)
  2. European Commission: Stakeholders’ Consultation on EudraLex Volume 4: Chapter 4, Annex 11 and New Annex 22 (2025), including draft Chapter 4. https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en (accessed 6 November 2026)
  3. eCFR: 21 CFR Part 211. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211 (accessed 6 November 2026)
  4. ICH: Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients. https://database.ich.org/sites/default/files/Q7_Guideline.pdf (accessed 6 November 2026)
  5. ICH: Q10 Pharmaceutical Quality System (2008). https://www.ich.org/page/quality-guidelines (accessed 6 November 2026)
  6. WHO: TRS No. 996, Annex 5, Guidance on good data and record management practices, 2016 (copy: ECA Academy). https://www.gmp-compliance.org/files/guidemgr/WHO_TRS_996_annex05.pdf (accessed 6 November 2026)
  7. WHO: TRS No. 1033, Annex 4, Guideline on data integrity, 2021. https://cdn.who.int/media/docs/default-source/medicines/norms-and-standards/guidelines/inspections/trs1033-annex4-guideline-on-data-integrity.pdf (accessed 6 November 2026)
  8. ICH/EMA: ICH E6(R3) Guideline for good clinical practice, Step 5. https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e6-r3-guideline-good-clinical-practice-gcp-step-5_en.pdf (accessed 6 November 2026)
  9. MHRA GCP Inspectorate: GCP Inspections Metrics Report 2018–2019, published 12 February 2021. https://assets.publishing.service.gov.uk/media/602a8e3cd3bf7f03190cbe43/GCP_INSPECTIONS_METRICS_2018-2019_final_12-02-21.pdf (accessed 6 November 2026)
  10. Regulation (EU) No 536/2014 on clinical trials on medicinal products for human use, Article 58. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014R0536 (accessed 6 November 2026)
  11. U.S. FDA: Data Integrity and Compliance With Drug CGMP – Questions and Answers, December 2018. https://www.fda.gov/media/119267/download (accessed 6 November 2026)
  12. eCFR: 21 CFR Part 11. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11 (accessed 6 November 2026)
  13. European Commission: EudraLex Vol. 4, Annex 11 Computerised Systems, 2011. https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf (accessed 6 November 2026)
  14. GMP Trends: FY 2023 Review of FDA Inspection Observations, 15 January 2024. https://gmptrends.com/wp-content/uploads/2024/01/FY-2023-Review-of-FDA-Inspections.pdf (accessed 6 November 2026)
  15. Pazhayattil A. B. et al.: What 2025 FDA Warning Letters Tell Us About GMP Compliance. Pharmaceutical Online, 15 December 2025. https://www.pharmaceuticalonline.com/doc/what-fda-warning-letters-tell-us-about-gmp-compliance-0001 (accessed 6 November 2026)
  16. Unger B.: Analyses of MHRA GMP deficiency data 2018 and 2019. Pharmaceutical Online. https://www.pharmaceuticalonline.com/doc/top-most-cited-mhra-gmp-inspection-deficiencies-by-annex-chapter-in-0001 (accessed 6 November 2026)
  17. PIC/S: PE 009 Guide to Good Manufacturing Practice for Medicinal Products. https://picscheme.org/en/publications (accessed 6 November 2026)
  18. Docuply: The importance of Good Documentation Practice (GDP) in the pharmaceutical industry. https://docuply.io/en/good-documentation-practice-gdp-in-the-pharmaceutical-industry/ (accessed 6 November 2026)
  19. ISO 13485:2016 Medical devices – Quality management systems. https://www.iso.org/standard/59752.html (accessed 6 November 2026)