Document Control Basics for SOPs

An SOP is controlled when its versions, approvals and distribution are managed. In practice that means five things: a unique ID that never changes, a version number that changes with every approved edit, a named owner and approver, an effective date, and a revision history that lists what changed and why.

Use a simple scheme and apply it the same way every time. Many teams use whole numbers for approved versions (1, 2, 3) and decimals for drafts (1.1, 1.2), so it is always clear which version is in force. Whatever you choose, never reuse a number, and keep the retired versions.

They usually ask for three things: the current version and its approval, the history of earlier versions, and evidence that the people doing the task were trained on the current one. For FDA-regulated electronic records, 21 CFR 11.10(e) requires secure, computer-generated, time-stamped audit trails, and 11.10(k) requires controls over systems documentation.

Software enforces the rules; it does not set them. SOP tools differ widely in how much they enforce: version history kept for 14 days on some plans and indefinitely on others, approval steps on some tools and plans but not all. Our version control and approvals guide compares nine tools plan by plan.

When a new version takes effect, the old one must stop being used. Mark it as superseded with the date, remove it from every place people look for current SOPs, and keep it in an archive that only document controllers can change. Printed copies are the hardest to control. If you must print, mark printed copies as uncontrolled, or keep a list of where each controlled copy is so it can be replaced.

Only the people with an author role for that SOP, and only in a new draft version. Approved versions should be read-only for everyone. Approval rights should belong to named people, not to anyone with edit access. In software this is role-based access control, covered in the lesson on SOP roles.