skip to Main Content

Document management systems (DMS) need repositories for both controlled and uncontrolled documentation. Any company that is required to comply with GMP (“Good Manufacturing Practice” quality guidelines and regulations) must have a comprehensive document management system in place which covers controlled and uncontrolled documentation.

Depending on the industry, some aspects of documentation requirements are crystal clear, while others leave room for interpretation. When in the trenches of developing a document management system, determining how to comply with GMP requirements is a vital step in compliance.

GMP compliance needs adequate systems in place to support controlled and uncontrolled documents. Knowing the differences in requirements can prevent regulatory citation. Here we discuss three main differences between controlled and uncontrolled document requirements.

Document Control

Knowing what to control is one of the main differences between the two document types. For controlled documents, changes, distribution, access, retrieval, and use are all managed under strict requirements.

When created, controlled documents must have a version number. When updates occur, a list of all changes must be detailed with each update. The document changes must go through a review and approval panel which ensures they are suitable for use. The Quality department will always be a member of the approval panel.

Due to their quality critical nature, controlled documents must be protected from misuse or improper access. When updated, all prior versions must be removed and disposed of, while the current version is distributed and trained out to applicable staff before issue. Retention and review periods must be set, and the documents must be available for use where needed.

Electronic document systems require an audit trail and must be CFR Part 11 compliant. This requires computer validation, user levels, and administrative controls. Audit trails should be in place to allow review of the date, time, or sequence of events in a particular document’s lifecycle to ensure its trustworthiness and reliability.

Uncontrolled documents can be updated without change control and up-versioning. While uncontrolled documents may need some level of review and approval, that system can be managed by internal SOPs.

Uncontrolled documents can be accessed by general staff, and do not need an audit trail. While the data in these documents is important, it is not GMP critical, so it does not require strict controls in place for controlled documents.

Document Lifecycle

The FDA has specific retention requirements for controlled documents, such as batch records, inventory, and distribution records. To comply with their requirements, it is helpful to think of controlled documents in terms of a document lifecycle. This lifecycle should cover creation, update, reviews, approvals, archive, and destruction of documentation. Retention periods should be defined and agree with regulatory requirements. For example, pharmaceutical product records must be kept for at least one year after the expiration date.

Document destruction is equally important to dispose of controlled documents when the retention time has passed. Even the destruction process must be controlled.

Uncontrolled documents should also be retained and disposed of according to the requirements of the DMS retention policy. However, the requirements around retaining and disposing these documents are not so strict. In the case of uncontrolled documents, document retention and destruction are more of a good business practice rather than a regulatory requirement.

Storage & Preservation

Controlled documents must be stored in such a way as to ensure the information within is not compromised. Controlled electronic records must be protected from unauthorized change, loss, or damage during storage.

For paper documents, fireproof and flood-proof file cabinets can provide the needed protection. For electronic documents, electronic storage must protect from physical hazards, and backup procedures must be established and followed. Electronic-controlled document storage and preservation systems must be validated.

Uncontrolled document storage requirements should be defined by the DMS policy but are not required by the FDA. Examples of uncontrolled documentation could be those relating to routine administrative tasks, such as production schedules or overall equipment effectiveness trackers. These records can be stored in local folders, such as the Vault, available in the Quality Management System (QMS) module from InstantGMP™.

An effective QMS includes a document management system for all document types. Just because a document is uncontrolled does not mean it is not important. Document management systems need repositories for both controlled and uncontrolled documentation.

With the InstantGMP™ QMS Module, document management systems are already validated to ensure controlled and uncontrolled documents meet any regulatory requirements. Schedule a demo with InstantGMP™ to discuss how the Vault can meet the necessary storage needs for your uncontrolled documents and ensure your controlled document management system is audit-ready.

Back To Top