Procedural Document Control in the Pharmaceutical Industry

The drug development lifecycle from clinical trials to manufacturing to distribution is governed by procedural documents such as Standard Operating Procedures (SOPs). Therefore, SOPs are an integral part of the framework of the pharmaceutical industry. They govern and standardize the work performed by stating the requirements that must be followed, providing principles that ensure compliance with regulations.¹ The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) provides guidelines for GxP, or good practice, environments such as GCP (good clinical practice) and GMP (Good Manufacturing Practice), which require the use of SOPs. The procedural oversight requirements in SOPs ensure the safety of the clinical trial participants, the quality of clinical trial data and efficient and safe manufacturing processes, resulting in effective drug products. According to the ICH, a Quality Management System (QMS) using a risk-based approach reduces risk by ensuring adherence to SOPs.² The purpose of this article is to share best practices for writing and managing procedural documents in the pharmaceutical industry.

Procedural documents such as SOPs ensure quality and compliance with ethical and regulatory standards, retain knowledge, reduce susceptibility to errors and can be used in training.³ SOPs describe how to complete activities and state who does what, where, when and how. They document standard practice and provide a method to execute required research-related activities consistently. Other benefits are improving communication among staff, reducing dependence on individual knowledge and offering training efficiency.⁴ Méthot et al. state that ICH GCP and Good Manufacturing Practice (GMP) require that each step in the drug development of an investigational product is traceable and documented from manufacture through administration in clinical trials.¹

The requirement for SOPs comes from ICH publication E6, which requires SOPs to implement quality processes to protect human subjects. Sajdak et al. describe the relationship between regulations and SOPs: regulations spell out responsibilities and SOPs formalize them. In this way, SOPs ensure compliance and success of studies by providing reproducibility and consistency, which confirms the reliability of the data obtained.⁵

Although the ICH GCP requires SOPs, the Code of Federal Regulations (CFR) in the United States does not explicitly require them. However, CFR Title 21 (Food and Drugs) contains the following requirements which SOPs fulfill, in a variety of Good Practices (GxP) activities:

21 CFR §50.24: “ensure that there is a procedure to inform the subject”.⁶
21 CFR §312.120: “A sponsor…must provide…description of how the sponsor(s) monitored the study and ensured that the study was carried out consistently with study protocol”.⁶
21 CFR §812.25: “The investigational plan shall include…. sponsor’s written procedures for monitoring the investigation”.⁶
21 CFR §812.36: “A treatment IDE application shall include…. written procedures for monitoring the treatment use”.⁶
21 CFR §820.40 (GMP for medical devices):

“Each manufacturer shall establish and maintain procedures to control all documents… the procedures shall provide for the following:

Document approval and distribution

Each manufacturer shall designate an individual(s) to review for adequacy and approve prior to issuance all documents…the approval, including the date and signature of the individual(s) approving the document, shall be documented. Documents shall be available at all locations for which they are designated, used, or otherwise necessary and all obsolete documents shall be promptly removed from all points of use or otherwise prevented from unintended use.⁶

Document changes

Changes to documents shall be reviewed and approved by an individual(s) in the same function or organization that performed the original review and approval, unless specifically designated otherwise. Approved changes shall be communicated to the appropriate personnel in a timely manner. Each manufacturer shall maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signature of the approving individual(s), the approval date and when the change becomes effective”.⁶

Poorly written SOPs can lead to actions by regulatory authorities, including warning letters, fines and even shutting down operations. According to Gough, the most common FDA citations related to document systems include: “noncompliance with SOPs for document controls and approvals.”⁷ A review of warning letters from the FDA reveals that failure to establish procedural documents, failure to follow them, failure to train on new or revised documents and failure to maintain procedural documents are commonly cited failures. Planned Corrective and Preventive Actions (CAPAs) and remediations frequently involve revisions to existing procedural documentation, or creation of new procedural documentation, and documenting training upon the new versions.

SOP authors have a responsibility to balance a document’s regulatory aspect with the needs of the document users. Authors should consider the scope of the document and look at their work from a variety of perspectives to create an effective and compliant SOP. Frequently an author considers only the end user, which can lead to overabundance of detail. An example would be stating in the SOP that the user must send a notification email, when multiple notification methods would be acceptable. If the SOP said the user must send an email and the notification was performed via Teams, the SOP was not followed, resulting in a Quality Event or deviation. Because of this downstream effect, SOPs and the way that they are written have a significant impact. Through this example, we see that SOP authors who add too much detail may lack a holistic viewpoint.

Whether the procedural document author is at the site level (local) or corporate level (global) will affect the author’s perspective. International companies have the challenge of creating global policies at the corporate level that are flexible enough to accommodate local regulations and generalized to cover all responsibilities and areas in the organization.⁸ This can lead to sites or functions creating local procedural documents in order to include more specific requirements, which can result in overlap, contradictions and misalignment unless changes in global procedural documents are carefully assessed against related local documents. These issues can be prevented by forethought in planning document types, understanding the intent of the global SOP author and placing local detailed guidance in a supporting document type that complements but does not compete with the global, overarching SOP.

When developing controlled documents, the goal is to prevent user errors and therefore many authors choose to use a high level of detail in their procedural documents. However, a high level of proscribed detail increases the chances of deviations occurring. Choosing the correct type of procedural document, tailored to the needs of the scenario, is important for this reason. A supporting document type such as a job aid may be considered optional guidance and therefore is optimal to contain the greatest level of detail.

Every company should have an SOP regarding the management of procedural documents, including preparation, templates, approvals, maintenance and implementation.⁴ This SOP or its associated procedural documents such as Work Instructions or Required Forms should provide requirements for version numbering, issuance, training, storage, review and planned deviations (sometimes called exceptions). These procedural documents should also describe the relationship between global and local procedural documents and how to identify the scope of each document.

Before writing a new procedure, an author must search the document system to see if one already exists on that topic. This search may also identify other documents which would be impacted by the creation or revision. Identifying existing SOPs on the topic prevents rework or an accidental contradiction or overlap.

When creating or revising an SOP, consider the title of the document; make it clear and not overly wordy. Begin the title with the subject and not the action so it is easy to identify the topic. If every document title begins with the word “Management” then browsing through procedures to find one will be more time consuming; for example, use “SOP management” instead of “Management of SOPs.” Consider the range of users when authoring a procedural document; new employees, existing employees, customers, other functional areas, or auditors may need to understand the content of the document.

A best practice for writing a new SOP is to begin with a process map as a guide and write each step in the order depicted by the process map. Think about the inputs and outputs of the process and include them. Many companies choose to include a process map in the content of the SOP or link the SOP to a process management system that depicts process maps. Clearly state the beginning and ending process steps; this will make it easier to identify which processes precede and follow, creating a comprehensive system.

This author recommends the following actions when creating a new SOP:

Identify who/what groups are in the scope of the SOP and which are not.
Include the regulatory requirements for the process and how these will be met.
Create a flowchart of the process.
Create a narrative version of the process map; assign steps to roles.
Write concisely, allowing as little room for individual interpretation as possible.
Use functional/generic role names instead of specific titles which may change; ensure clarity in assigning responsibilities to particular roles.

An SOP header and/or footer will typically contain some of the following elements so that they will show on every page:

Type of document.
Document Title.
Document number or ID.
Effective date.
Version.
Pagination.
Company logo/name.
Template used.

Depending on the document control system used and what the document control SOP specifies, some document attributes may be captured in metadata, as part of a change control request, or in the document’s content. The critical aspect is that the information is available to the user. Although sometimes placed in the document content, the following elements may be found elsewhere (e.g., the document’s metadata in the document management system).

Names of reviewers/approvers/author/owner.
The effective date (may be in the overlay/watermark).
Version number and title (some newer systems display attribute values via field codes on the rendered document instead of being hardcoded in the content).
The document ID/number, which may be assigned by and contained in the system and may be comprised of the document type and a unique number. The ID/number may also indicate whether the document is global or local and what functional part of the organization it applies to. The assignment, placement and meaning of the ID/number are governed by the document control process as defined in the document control SOP.

Modern version numbering utilizes whole number version changes for revisions. For example, if the current effective version of an SOP is 5.0, the next current effective version will be 6.0. Typically, an incremental change in the tenths decimal place identifies different drafts during the revision process, such as “5.1,” or “5.2,” although some companies may choose to use different versioning schema. An administrative change for grammatical or spelling changes may be procedurally handled differently from a true revision. These differences will be described in the document control SOP. The following sections are frequently included in each SOP:

• Objective/Purpose.
• Scope.
• Acronyms/Definitions.
• Materials/Equipment.
• Roles/Responsibilities.
• References/Related/Supporting documents.
• Safety: Personal Protective Equipment (PPE), prerequisite training.
• Procedure/Process.
• Appendices.
• Revision history (which may be cumulative, or for that specific version).

Procedural documents should describe actions in the order they occur in the process. If the document states “stir the liquid when it turns purple,” the user may start stirring when they read the first part of the sentence but before the liquid turns purple, leading to error. Instead, state “when the liquid turns purple, stir the liquid.” Similarly, place any warnings or cautions before the related action. Use active voice and present tense.

If a document is lengthy, inserting a table of contents at the beginning is a good practice. Use the table of contents feature in the document processing software which pulls from headings. The table of contents should come before any numbered sections and should not have a section number. This will facilitate updating the table of contents during future revisions.

When using acronyms, spell them out the first time they are used in the document, even if they are included in a definitions/ acronyms section. Be consistent with using punctuation or no punctuation after bulleted lists. Consistency is crucial. Some authors choose to use punctuation at the end of bullets if the bullets form complete sentences and no punctuation if the bullets are phrases. A bulleted list should either have punctuation at the end of every row, or none at the end of every row.

Consider visually identifying sections of documents that are a result of a regulatory commitment (e.g., using specific font, text color, or brackets) to identify them for future authors/editors who otherwise might unwittingly alter or remove them. If such identification is implemented, the method should be described in the document control SOP and implemented for all procedural documents.

“Distribution” as a content component within an SOP is no longer standard practice. In modern usage, distribution and/or training for procedural documents are handled outside of the document content and these elements are not recorded in the document content. Distribution is handled electronically and training is handled by the training department, usually via a matrix of assignments based on roles.

Avoid including links in SOPs, even to other parts of the document (such as cross references), as they may change and provide opportunities for errors when rendered to PDF by the document management system. Use bullets when the order of actions does not matter. Otherwise, use numbers to list sequential steps.

It is a best practice to separate SOPs from associated forms. Past practice was to include the form at the end of the SOP as an appendix, but forms are revised more frequently than SOPs and the separation makes the updates easier, as well as improving findability for the form. Also, revisions to some document types may not require retraining of the users, so a revision to a form may not require training if the SOP is not being revised (if this practice is written into the document control/training procedures).

Templates are example documents that contain instructions. They are used as a starting point for a new procedural document and they drive standardization in form and content. Templates should be housed in the document management system and controlled. They contain the stylistic features desired by the company in terms of line spacing, font, outline indentations and heading styles (e.g., bold, italic). Avoid using all capital letters for document titles or headings to allow for greater flexibility for copying and pasting. Templates may be a Required Form document type or a Template document type, as defined by the document management SOP.

When creating a template, use the multi-level list settings to control how a numbering system appears in a document. Choose an outline numbering style with all numbers, no letters. An example is to use “2.2.2” instead of “2.ii.b.” Always include all digits of the numbered section in every step. If the user completes step “3.ii.a” and turns the page and sees step “b.”, in order to reference that step the user has to flip back to see what major section they are in so that they can refer to “3.ii.b”. The goal is utility and ease for the author as well as the end user. If indentations for outline numbering are difficult to standardize or confusing to authors, start all levels at the left margin in the template.

Avoid terms such as “when necessary,” “suitable,” and “when appropriate,” as those word combinations leave the action or inaction up to the judgment of the user and are ambiguous. If a requirement is mandatory, use “must” or “will.” Using “should” or “may” can confuse the user. Allow for flexibility by anticipating future change, for example by using “not limited to,” such as “items to be placed into the washer include, but are not limited to, the following.”

Use generic terms for systems, as systems change frequently. For example, use “learning management system” or “document management system” instead of the specific name of the system. Consider avoiding screenshots in higher-level documents, as a system change would prompt a document revision if screenshots were included. In all cases, remove unnecessary words to simplify and clarify.

The functional administration of procedural documents is handled within a document management system; however, the configuration of that system and the process followed by the document management team are under the control of the SOP management team. The SOP management team is responsible for standardizing document elements and functions at their company.

Some critical elements of SOPs are effective date, expiry date (or review needed by date) and availability (in case a sponsor or auditor wants to view them). The SOP management team is responsible for creating, updating, managing, issuing new and replacing obsolete SOPs and archiving old versions. In most of today’s pharmaceutical environments, SOPs are accessed electronically, but in some environments (especially manufacturing), paper copies may still be used, which present unique challenges.

In regulated industries, documents are controlled instead of just managed. Skipper states “moving forward with any document creation effort without establishing the document control function will inevitably cause quality system failure.”⁹ Document control is part of the overall quality control required in the pharmaceutical industry. It is a form of document management but more proactive and intricate. Document control ensures that only current, effective documents are used, while retaining superseded versions of documents to be accessed by certain categories of users (e.g., quality or auditors) when needed. A controlled document must be periodically reviewed to ensure it is compliant and relevant. Document control ensures that content and formats are standardized and that versions are identified to differentiate draft from effective from superseded or retired. Document control means keeping records of changes to a document over time, as well as the approvers’ names for approved versions. An assigned process owner is needed for each process to approve new versions and to ensure the SOP is applied consistently throughout the company. The life cycle of a controlled document is summarized in Table 1.

What role(s) will review and approve document versions is spelled out in the document control SOP, respective of document type. The heads of impacted departments should conduct reviews. Most types of controlled documents require approval from at least three individuals: the author or person responsible for the content; the process owner or business lead; and the quality organization.

The document control SOP establishes which document types require periodic review, how often it must occur and whether the timing of review for supporting documents is tied to the review of their governing SOP. For example, the document control SOP may state that when an SOP undergoes periodic review, the document approver also reviews all supporting documents linked to that SOP. The most common industry standard of periodic review in the United States is every two years. Electronic document management systems can be configured to notify the document control team or the business owner of the document when the review date is approaching. The review must be documented, even if the document is assessed to be compliant and correct upon review and therefore no revisions are needed.

Controlled documents exist in several types with different purposes. Top-level documents such as Policies or Quality Manuals are high level with little detail, containing business objectives or requirements. SOPs contain requirements, roles and responsibilities, major steps in the process, as well as direction regarding where to find information about detailed process steps. Work Instructions contain the detailed steps that are performed to execute a process. Forms enable creation of records to document activities or capture data. Templates standardize the appearance and content of documents. Other types of supporting documentation may be used such as specifications, job aids, style guides, or best practices. A company should define each document type, its attributes and the document hierarchy in their document control SOP.

In their document management SOP, a company may state that certain types of documents contain requirements and others contain guidelines/are optional. If the SOP says that a certain type of document is a requirement, then failure to follow that type of document is a deviation or a quality event that must be documented and corrected. For this reason, the document hierarchy needs to be well thought out and shared at all levels of the organization. All authors and users of the controlled documents need to be aware of which documents are requirements and which are optional guidelines. Some companies may choose to state that all controlled documents contain requirements and must be followed. Others may have document type(s) that they control, but procedurally identify as an optional guideline or best practice. All document types should be related to one another in a hierarchical fashion (see Figure 1).

Figure 1:
Document Hierarchy.

The top two levels of this hierarchy, containing corporate documents and Standard Operating Procedures, are usually similar at most companies. The third and fourth levels vary from company to company. A best practice is to have every document in levels three and four governed by and linked to a specific SOP in level two. This helps to prevent accidental overlap, which could lead to conflicting information. Some companies choose to align Forms and Templates with Work Instructions on level three. Some companies place Forms in level four. Not all of these levels are mandatory; some companies customize their hierarchy to omit level four and place all documents below an SOP in level three. The important aspect is for the document control SOP to describe each type of document, how it must be used and how the document types relate to one another.

SOPs must display the document’s status to the user to ensure that only current, effective documents are used. Document management software systems achieve this via an overlay, or watermark, which is added when the document is rendered. When a new or revised document moves from draft to approved status, training must take place for users. Training on a revised or new document takes place after approval and before effective status of the new document version.

When an SOP is revised, the associated training must be evaluated and updated if necessary to ensure alignment. The assignment of training for a new/revised SOP and notification of changes requires a systematic approach to reach the users of the document. Companies use different methods to achieve this goal, ranging from assigning “read and acknowledge” training to updating/assigning other methods of training. Training processes are usually managed separately from document control, although these groups working closely together is beneficial. Additional notification layers to publicize SOP revisions throughout the company are usually built into the document control process, such as email announcements or shared reports listing new or revised documents that become effective.

A challenge of document control is ensuring that related documents are revised to align with a newly created or revised procedure. This is accomplished in some companies by procedurally placing the responsibility for assessing impact on the revised document’s Business Process Owner (BPO). Other companies ensure this step by including representatives from allfunctions on the review of the draft. This is another application of email announcements or shared reports to announce document versions that become effective, as leaders who review these informational tools can identify if SOPs impacting their process are revised.

Effective SOPs must be available at the point of use and older versions must be archived, yet access to obsolete/retired/ superseded versions is usually prevented for most users. This can be achieved through settings in the document management system that prevent all but certain categories of users (e.g., Quality, document control) from viewing categories of documents outside of current effective status. Another aspect of preventing the use of obsolete/superseded document versions is to consider how users will use the documents in their daily work. Some users prefer to print documents; however, this is a compliance risk because a superseded document may be left on a desk for inspectors to find. Some companies include in the footer of their controlled documents that a printed copy is not valid and the electronic version of the document is the only version that is to be used. Printing controlled documents is a compliance risk and must be addressed in the document control SOP whether to be allowed. In some companies, official printed versions are tracked for destruction if they are superseded or retired. A controlled print system using serial numbers for tracking printed SOPs and reconciling obsolete printed versions may be used in such a scenario.

Another document control tool used by some companies is a glossary/dictionary of terms/acronyms and their definitions outside of the content of SOPs, which can then be referred to or linked. This allows for alignment across an organization to ensure standardized interpretations. The challenge for such a tool is to gain the initial alignment of all areas of the organization on the definitions and then to keep them updated. Similar treatment may be applied to roles, which may be linked to organizational charts, job titles, or job descriptions.

Procedural document authors must balance the needs of the document users against the scope and intent of the document in order to provide the appropriate level of detail. Authors must allow flexibility where specificity is not required and place the process specifics in the appropriate document types. Procedural documents should clearly reflect a process, identifying inputs to the process, the sequence of activities within the process, the roles completing the process actions and the outputs of the process. The management of SOPs must ensure that they are controlled in terms of versioning, tracking changes to the documents, proper approvals and document availability. Following these best practices in document creation and control will lead to increased compliance with regulations and will minimize deviations from procedure.