Written by Dr. Richard Soltero, President, InstantGMP, Inc.

GMP Document Control: Controlled vs. Uncontrolled Documents

If you think every document in your facility deserves the same level of oversight, you have not spent much time in front of an FDA investigator.

After spending more than 30 years in pharmaceutical operations and then building the electronic quality system at InstantGMP, I can tell you that one of the most consistently misunderstood topics in a quality system is the distinction between controlled and uncontrolled documents. It sounds procedural. It is not. Getting it wrong invites observations, failed audits, and worse, manufacturing errors that reach your finished product.

The Regulatory Foundation

The requirement for document control in pharmaceutical and dietary supplement manufacturing is not ambiguous. 21 CFR Part 211 governs current Good Manufacturing Practice for finished pharmaceuticals, and 21 CFR Part 111 covers dietary supplements. Both frameworks expect that your team is always working from the current, approved version of a controlled document. The word “always” carries real weight there.

A controlled document is any record that governs how your operation runs: Standard Operating Procedures, policies, batch record templates, forms, specifications, and the like. These documents must follow a formal lifecycle. That means version control. It means review and approval before use. It means a traceable audit trail.  These documents must follow a formal lifecycle. That means version control. It means review and approval before use. It means a traceable audit trail. The FDA cGMP regulations are explicit: your people should never be operating from a superseded version or, worse, a printout someone grabbed from a shared drive three revisions ago.

What Most Facilities Get Wrong

Here is what I have seen repeatedly when I walk into a facility that has not yet deployed a proper Document Management System: a shared folder on a network drive with a mix of everything. SOPs next to vendor catalogs next to literature references next to old training slides. No version control. No approval workflow. Employees who are genuinely unsure which version of a procedure is current.

The instinct to organize everything in one place is not wrong. The mistake is treating everything as equivalent. A research article pulled from a journal is not the same compliance object as an SOP that governs how you release a batch. One needs to be controlled with iron discipline. The other simply needs to be accessible and clearly labeled as a reference.

When you blur that line, you create the conditions for error. Someone prints the wrong form. A supervisor references a superseded procedure during an investigation. An auditor pulls a document and cannot find an approval signature. These are not theoretical risks. I have watched them happen.

Defining the Two Categories

Controlled documents require version control, formal review and approval, restricted editing rights, and a complete change history. Every revision is tracked. Every approval is recorded electronically with a time stamp. Access is managed so that only the current approved version is in active use. The audit trail is automatic, not dependent on whether someone remembered to update a log.

Uncontrolled documents are a different category entirely. Reference articles, vendor literature, equipment utilization trackers, and internal research reports may be genuinely useful to your team. They belong in your system. But they should not be in your GMP workflows. They should not carry approval requirements that do not apply to them. And they should never be confused with the procedures that govern your manufacturing operations.

The right approach is to store uncontrolled documents in a separate vault within your quality management system, clearly segregated from GMP documents, with a label that makes their status unambiguous.

What a Proper Document Management System Provides

When we built the Document Management System inside InstantGMP, the architectural principle was straightforward: the system should make it structurally impossible to confuse controlled and uncontrolled documents. Not just policy-level guidance. Actual system design that prevents the error before it occurs.

Controlled documents in InstantGMP follow a formal workflow from creation through review, approval, issuance, and eventual retirement. Electronic review and approval signatures are captured with time stamps. Version control is automatic. When a revision is initiated, the previous version is preserved in history but removed from active circulation. Your team always works from the current approved document, full stop.

Uncontrolled documents live in a separate vault within the quality management system. They are accessible, searchable, and organized. But they are explicitly outside the GMP workflow. There is no risk of an employee treating a vendor catalog as though it carries the same authority as a validated SOP. The system design removes the ambiguity. This matters enormously when you are preparing for an inspection under FDA Form 483 scrutiny.

The Audit Trail Advantage

One of the outcomes manufacturers consistently undervalue until they face an audit is the automatic audit trail. Every update to a controlled document in InstantGMP is recorded without any manual intervention required. Who approved the change, when they approved it, what version it replaced, what the reason for revision was. That complete history is always available and always accurate.

When an investigator walks in and asks to see the approval history for your most recent SOP revision, the answer is two clicks away. Compliance stress is not eliminated by hoping your paper trail is complete. It is eliminated by designing a system that creates the trail automatically.

One System, Two Categories, Zero Confusion

The design goal for InstantGMP‘s document management architecture was always this: both controlled and uncontrolled documents live in one system, clearly organized and easy to manage. Your team does not have to maintain a separate filing system for reference materials. Your QA leadership does not have to wonder whether the reference articles in the vault have accidentally migrated into your SOP workflow. The system holds the boundary for you.

What this means in practice is that your team works with confidence. When someone opens a document and sees it in the controlled workflow, they know it is current, approved, and GMP-compliant. When they access a reference document in the vault, they know it is informational. No ambiguity. No guessing. No compliance risk.

The Forward View

Document control is one of those areas where the gap between facilities that have invested in proper systems and those still relying on shared folders and paper approval logs is widening every year. FDA inspection frequency is not declining. Regulatory expectations around electronic records and audit trails continue to tighten, particularly as more operations move toward electronic batch records and integrated quality management.

The facilities that will be most resilient over the next decade are those that have made the structural investment in systems that enforce the distinction between controlled and uncontrolled documents automatically, rather than relying on discipline and hope. In my experience, discipline and hope are not a quality system. They are a liability waiting to be discovered.