White Paper

Automating Document
Control Processes to
Comply with FDA and
ISO Requirements:
Increase Efficiency, Ensure Compliance
and Improve Profitability
 White Paper

Document control systems exist to ensure that manufacturers build products

that are safe and reliable. ISO and FDA Current Good Manufacturing Practices
(CGMP) presume that both the process and documentation that directs company
processes follows pre-approved methods, and that any change to these methods
is restricted to authorized personnel and tracked for future review. ISO standards
and FDA regulations mandate that all companies that manufacture regulated
products have a document change control system.

Inefficient document control systems slow the time it takes to get a regulated
product to market, which subsequently causes manufacturers to lose millions
of dollars of potential profits. This significant revenue loss can primarily be
attributed to the inefficiencies that occur when using a paper/hybrid-electronic
system. (Wherein document change control is managed in a manual fashion
or using a combination of both paper and electronic files.) Manual systems are
error-prone, cause delays, and introduce product quality problems that can
result in stringent regulatory penalties. In fact, the FDA cites inadequate change
management as a major cause for “Form 483” observations. Examples of common
shortcomings include documents with missing dates or missing numbering
schemes, uncontrolled copies and document changes without approvals or
explanations. To eliminate these inadequacies, regulated companies are turning to
electronic quality management systems to automate document control.

Today’s quality management systems provide integrated solutions to handle

everything from corrective and preventive actions (CAPA) to change control and
training. This white paper concentrates on document control processes within
the quality system lifecycle, and provides insight into the capabilities needed
to automate change control processes that will increase efficiency, ensure
compliance with FDA requirements and improve overall profitability.

Overview
To eliminate the problems regulated companies are being cited for during
inspections and audits, a change management / change control software solution
must incorporate the following capabilities:

• Compliance Management
• Document Management
• Revision Control
• Intuitive System Administration Tools
• General User / Viewer Usability
• Open Architecture
• Complete Implementation and Validation Tools

Automating Document Control Processes to Comply with FDA and ISO Requirements 1
 White Paper

Compliance Management
In order to move from a manual, paper-based system to an electronic, automated
system, manufacturers must follow the guidelines outlined in regulation 21 CFR
Part 11 for using electronic records and signatures. These guidelines include the
following:

• Multi-password access and signature…forced expiration - The FDA

requires two distinct identification components for compliant document
change control: one for login and one for document approval. Options should
be available for configuring the length of the password and alphanumeric
combinations to maintain the highest level of security for the system.
Password expiration, encryption and certification are also necessary.

• Account and intruder lockout - An account should automatically be locked

for both login and approval any time a password or login is compromised. If
any unauthorized attempt is made during either login or approval, the intruder
lockout feature is activated (after a certain number of unauthorized login
attempts or approval attempts has been reached). The system administrator
should be able to customize the number of password attempts.

• Signature manifestation on the document - Signature manifestations are

required for FDA-regulated companies to meet Part 11 requirements and
should automatically be appended to each document. Manifestations should
include first name, last name, date, time and meaning of the electronic
signature. Manifestations should also appear on all human-readable forms
that are either viewed electronically or printed on paper.

Figure 1 – Change control as

part of the quality management
lifecycle

Automating Document Control Processes to Comply with FDA and ISO Requirements 2
 White Paper

• Change control rationale - Changes made to document metadata should

be tracked. (Metadata contains document attributes like title, author, etc.)
Each time a change is made to any metadata, a user must enter a reason for
the change. The system must track each of these changes and make them
available for review.

Document Management
Document management capabilities boost efficiency and ensure compliance by
eliminating labor-intensive tasks such as the physical routing of documents for
approval, storage and distribution.

• Format agnostic - The system must be able to control any document (e.g.,
Microsoft Word® documents, Excel® spreadsheets, CAD, video, audio, etc.)
regardless of the application used to create it.

• Document lifecycle management - Documents must be managed through

their lifecycle statuses of Draft, Released and Archived. (See Figure 2.)
Lifecycles can be based on document type and need to automatically adjust
document security based on lifecycle status.

• Audit trail history / record archiving - A secure, time-stamped audit trail

of all changes made to any record should be maintained and accessible to
the appropriate users and departments. All of this information needs to be
automatically captured and secured. Reporting functionality should track
past versions, metadata and approval history of the record, from the time it
was created until the present.

• Centralized, secure repository - Documents should be securely stored to

ensure only authorized access and protection against disaster.

• Document cross-linking - In manufacturing environments, documents

complement one another. For example, a form may be associated to a
standard operating procedure (SOP), or an equipment manual associated
with a maintenance drawing, etc. A document control system should allow
document linking to provide users the relevant information needed to do their
jobs.

Revision Control
Document revision control represents one of the most time-consuming tasks,
and one that is most ripe for automation. When automating document control
processes, users will find that with the right solution they can accomplish the
following:

• Ensure control of all document versions/revisions - Be able to present the

currently released document, while simultaneously managing collaborative
changes that will result in a new revision.

Automating Document Control Processes to Comply with FDA and ISO Requirements 3
 White Paper

• Control rogue documents - A system should alleviate the consequences

of uncontrolled electronic documents by enabling copies to “self destruct”
after the configurable time allotted to the document expires. For example,
a document that is saved outside the system and emailed to another person
would be impossible to open 48 hours after it is copied from the system.
Similarly, a system should offer capabilities to manage printed documents.
Any time a document is printed from the system, expiration dates and times
should be automatically watermarked prominently on the document.

• Automate document routing, approval and escalations - Document routing

and approvals should be automated to notify all approvers or collaborators
in the authorization chain. Configurable, time-based escalation features
can expedite approval and collaboration cycles in case users are delayed
or unavailable. Upon approval, old versions should automatically revision,
while users affected by the change are assigned a task to be trained or re-
trained. (Training is addressed in a supplementary white paper available from
MasterControl.)

• Automatic document replacement (draft to release to archive) - As

documents are approved, old versions should automatically move to an
archive vault and be replaced by the newest version. This eliminates any
possibility of employees using the incorrect version. (See Figure 2.)

• Unlimited pre-determined and ad-hoc routing steps - Routes for document

collaboration or approval should be pre-configurable for use at any time or
have the option to be added on the fly. Each step in a route can have one or
many approvers assigned to it to allow for the creation of a combination of
serial and parallel routing.

• Real-time, repeatable email notification - Customizable email notifications

should be provided to alert users in a route to take action on their specific
tasks. Managers would be notified when tasks are completed to proactively
monitor collaboration, change management, approval and training cycles.

Figure 2 - Document change

control lifecycle

Automating Document Control Processes to Comply with FDA and ISO Requirements 4
 White Paper

• Electronic signature/approval history tracking - Managers should be able

to view electronic signature details, approval history and cycle statuses as
needed during the change management process.

• Automatic distribution upon approval - After the completion of approval

cycles, documents should be automatically distributed to users affected by
the change and old versions should be archived. (See Figure 2.)

Intuitive System Administration Tools

Easy-to-use system administration tools should be provided to comfortably
manage the entire system:

• User-friendly route builder capabilities with drag-and-drop visual interface

- System administrators should be able to easily build approval routes,
thereby reducing the need for dedicated IT resources.

• Configurable user rights and roles - The system should provide built-
in tools that enable system administrators to easily create a variety of
individually tailored user and security roles. For example, some users may
only need limited “find and view” rights while others may need broad edit
privileges. Managing these roles when adding users and passwords for login
or electronic signatures within a centralized location improves usability and
saves time.

• Automated conversion/publishing to PDF - Optional document publishing

to PDF throughout the document lifecycle should be completely automated.
PDF conversion from multiple document types into a common, unalterable
format improves efficiency and reduces costs by eliminating additional
desktop software that would be required for users to view documents.

Figure 3 - Route Builder -

What you see is what you get
(WYSIWYG), drag and drop

Automating Document Control Processes to Comply with FDA and ISO Requirements 5
 White Paper

• Advanced system reporting - A variety of standard and custom reports like

audit trail, master list, cycle time and revision history should be available
to help system administrators proactively manage the system and provide
peace of mind with audit and inspection preparedness.

General User / Viewer Usability

A change control management system should provide users an intuitive interface
to increase usability and system acceptance:

• Browser-based / thin client access - A browser-based system provides

industry standard connectivity, ease-of-use and company-wide access
regardless of physical location. This helps connect remote employees,
customers and supply chain members to the change management loop.
These members can participate in processes like collaboration, document
change, notification and training from any location.

• Full-text / metadata searching - Capabilities to search either the metadata

or the full text of all documents using any keyword or string of words should
be available. Search results should provide only a list of documents that
both meet the search criteria and match user security rights. Boolean and
wildcard search operators should be provided to narrow down search results.

• Finding documents through graphically linked groupings - The system

should offer users a helpful graphical interface that allows them to quickly
find the information required to do their jobs. Similar to a Windows® or
Macintosh® desktop tree, users should be able to point and click on folders
that contain additional folders, projects and individual documents like work
instructions, procedures, etc. Documents must be able to reside in multiple
trees to facilitate the search logic of different users and should automatically
update upon revision to ensure that the most current document is always
used.

Open Architecture
A change control system should provide system administrators a platform that is
industry-proven and easy to deploy. Users need a familiar and intuitive interface to
enhance usability and system acceptance.

• Web-based - Cloud-based systems provide users and IT managers alike with

a powerful, industry standard platform that is easy to use and offers access
to authorized users. With Web-based solutions, companies can leverage
industry-standard SSL and 128-bit encryption capabilities to secure the
data communications that take place between the Web browser and the
application, while still maintaining the benefits of 24x7, anytime-anywhere
access for authenticated users.

Automating Document Control Processes to Comply with FDA and ISO Requirements 6
 White Paper

• Integration with other applications - Open system architectures, platforms

and industry-common SQL database technologies provide flexible integration
gateways to other quality system applications like CAPA, training, etc.
(See Figure 1.) Integrating quality subsystems to work in tandem helps
organizations leverage all the necessary data and information to enable
decision making that enhances product quality, ensures compliance and
increases profits. Large corporate systems like MRP software can also be
integrated to share information and data affected by changes in procedures,
drawings, bills of lading, etc.

• Easy-to-use graphical user interface (GUI) - An intuitive interface

throughout the application allows system administrators to easily build
“visual” routes and manage the system for collaboration and change
management approval cycles. And, end users can quickly find the information
they need. An easy-to-use GUI is an important ingredient for a successful
implementation because it improves overall system use and acceptance.

Complete Implementation and Validation Tools

FDA-regulated companies looking for document control, change management
or change control systems should search out applications that have complete
services for implementation and validation.

• Training for IT managers, system administrators and general users - A

variety of training should be available for system administrators, advanced
users (Power Users) and general users (Viewers) that is mindful of the
product, the industry and the customer’s unique practices. Such training
should be available at the vendor’s facility, at the customer site, live over the
Web, and/or pre-recorded.

• Validation tools and services - Organizations should ensure the solution

provider has been audited by similar companies within the appropriate
industry and have a good user-base of references. Vendors should provide
all the necessary validation tools and services for buyers to either perform
their own validation or elicit complete services from the vendor. The vendor’s
validation tools and services should follow Good Automated Manufacturing
Practice (GAMP) guidelines for computer systems validation. Vendors that
offer their own validation tools and services are more familiar with the
system and can usually accelerate validation.

Conclusion
FDA-regulated companies would agree that moving from a manual, paper
environment to an electronic system for document control and change
management is challenging. It is an endeavor that includes costs for user training,
IT infrastructure upgrades (if necessary) and system validation. However, most (if
not all) of the companies that have made the transition can prove that the benefits

Automating Document Control Processes to Comply with FDA and ISO Requirements 7
 White Paper

of automation include a faster return on investment (ROI).More importantly, the

automation of these change control tasks eliminates common errors that are
cited in FDA 483 observations yielded by companies that still use manual, paper-
based/hybrid-electronic systems.

About MasterControl
MasterControl Inc. creates software solutions that enable life science and other
regulated companies to deliver life-improving products to more people sooner.
MasterControl’s integrated solutions accelerate ROI and increase efficiencies by
automating and securely managing critical business processes throughout the
entire product lifecycle. More than 1,000 companies worldwide, ranging in size
from five employees to tens of thousands, rely on MasterControl cloud solutions
to automate processes for new product development, clinical, regulatory, quality
management, supplier management, manufacturing and postmarket surveillance.
MasterControl solutions are well-known for being scalable, easy to implement,
easy to validate and easy to use. For more information, visit
www.mastercontrol.com.

© 2019 MasterControl Inc. All rights reserved.

WPXXXXUSENLT-01/19

Automating Document Control Processes to Comply with FDA and ISO Requirements 8