How do I set up document control system workflows for SOP approvals, retention, and electronic signatures in a CDMO?

Setting up document control workflows in a CDMO usually means designing a controlled, audit-ready lifecycle for SOPs and related quality documents so that they are:

• written and reviewed by the right people
• approved with traceable sign-off
• issued and trained on before use
• periodically reviewed and revised when needed
• retained according to policy and regulations
• signed electronically in a compliant way

Here’s a practical way to structure it.

---

1) Define the document lifecycle

A simple, controlled workflow looks like this:

1. Create / Draft
2. Review
3. Approve
4. Effective / Issued
5. Train / Acknowledge, if needed
6. Revise
7. Archive / Supersede
8. Retain / Destroy per schedule

Each step should have:

• defined owners
• required approvals
• timestamps
• version control
• audit trail
• access restrictions

---

2) Set governance and roles

You should clearly define who can do what.

Typical roles

• Document Author: creates or revises content
• Functional Reviewer: checks technical/scientific accuracy
• Quality Reviewer: checks compliance and formatting
• Approver: final sign-off, often department head / QA / site leadership
• Document Control: manages numbering, issuance, archival, routing
• Trainer / LMS Owner: links training to effective SOPs
• System Administrator: maintains eQMS/EDMS permissions

Good practice

Use a RACI matrix for each document type:

• SOP
• Work Instruction
• Form
• Specification
• Policy
• Template

Not every document needs the same approval chain.

---

3) Build SOP approval workflow

For SOPs in particular, a typical workflow is:

A. Draft creation

• Author creates document in controlled template.
• System assigns document number, title, site, department, and version.
• Draft is restricted to draft status only.

B. Review routing

• Send to reviewers based on subject matter:
  • process owner
  • QA
  • regulatory/compliance
  • validation/IT if electronic systems are involved
• Review comments should be captured in-system, not only by email.
• All changes after review should be tracked.

C. Approval routing

• Final approvers sign in sequence or in parallel, depending on policy.
• Approvals should only occur on the final version.
• After final approval, the document becomes effective automatically on a defined date or immediately.

D. Issuance

• Controlled distribution to the approved population.
• Only the current effective version should be available for use.
• Obsolete versions should be archived and clearly marked “superseded.”

E. Training / acknowledgment

• If the SOP affects personnel tasks, link issuance to training completion.
• Consider effective date after training window if needed.
• Track acknowledgments and due dates.

---

4) Define revision and change control

Document control should connect to your change control process.

Use a trigger-based revision process

Examples:

• process change
• regulatory update
• deviation trend
• audit finding
• periodic review
• system implementation
• CAPA

Revision workflow

1. Change request created
2. Impact assessment completed
3. Draft revised
4. Review/approval repeated
5. New version becomes effective
6. Old version archived with reason for change

Versioning rules

Use a clear scheme such as:

• Version 1.0 / 2.0 for major revisions
• 1.1 / 1.2 for minor changes if allowed by SOP
• Or simple sequential versioning if your QMS prefers that

Document version rules should be defined in a procedure.

---

5) Design retention requirements

Retention must be driven by:

• applicable regulations
• customer requirements
• contract terms
• legal holds
• internal policy

Retention policy should specify

For each document type:

• retention period
• start of retention clock
• storage location
• destruction method
• approval needed for destruction
• exceptions for legal or regulatory hold

Examples

• SOPs: retain current + historical superseded versions for a defined period
• Training records: retain for duration of employment plus x years
• Batch records / GMP records: often long retention, sometimes product life + multiple years
• Quality records: retain per regional regulation and client agreement

Important

Retention for CDMOs is often more complex because you may need to satisfy:

• your own quality system
• client-specific quality agreements
• product-specific requirements
• multiple jurisdiction rules

When in doubt, the more stringent requirement usually wins.

---

6) Configure electronic signatures correctly

If you use e-signatures, they must be secure, unique, and audit-trailed.

Core controls for compliant e-signatures

• unique user ID and password/multifactor authentication
• signatures linked to a specific record/version
• signer identity verified
• sign date/time recorded
• meaning of signature captured, e.g.:
  • author
  • reviewer
  • approver
  • effective
  • training acknowledgment
• system prevents alteration after signing
• audit trail of all actions

Common compliance frameworks

Depending on region, you may need to align with:

• 21 CFR Part 11 for FDA-regulated operations
• EU Annex 11
• GxP data integrity expectations
• ISO 17025 / ISO 13485 if applicable
• internal corporate policies

Good e-signature practice

Each signature event should show:

• printed name
• title/role
• date/time
• meaning of signature
• document version signed

---

7) Put access controls in place

Document control systems should enforce least privilege.

Access rules

• Authors can draft only assigned docs
• Reviewers can comment but not approve unless assigned
• Approvers can only sign documents within their authority
• QA/admin can release or archive as defined
• Read access for end users should be limited to effective versions only

Protect against errors

• prevent simultaneous uncontrolled editing
• lock documents once in approval
• version history should be immutable
• obsolete documents should not be searchable as current

---

8) Set up metadata and numbering

Standardized metadata makes the system searchable and auditable.

Recommended document fields

• document ID
• title
• document type
• department/site
• effective date
• version
• status
• owner
• approvers
• review frequency
• retention category
• related records/change control/CAPA references

Numbering examples

You might use something like:

• SOP-XXXX
• WI-XXXX
• FRM-XXXX
• POL-XXXX

Keep numbering rules simple and consistent across sites if possible.

---

9) Define periodic review

SOPs should not remain unchanged indefinitely.

Review frequency

Common practices:

• every 2–3 years, or
• risk-based interval depending on criticality
• earlier review if triggered by change or deviation

Review workflow

• system sends reminders before due date
• owner confirms if revision is needed or not
• if unchanged, document may be reapproved or just review-documented depending on your procedure and regulation

---

10) Use an EDMS/eQMS with audit trail

A strong workflow is much easier with a validated system.

System capabilities to require

• controlled templates
• versioning
• review/approval routing
• e-signature capability
• audit trail
• role-based permissions
• read-and-understood training linkage
• archival and retention controls
• search/reporting for compliance evidence

Validation

If the system is used for GxP records, validate it appropriately:

• user requirements
• risk assessment
• test scripts
• traceability matrix
• access control testing
• signature/audit trail testing
• backup/restore testing

---

11) Typical SOP workflow example

Here’s a simple model:

1. Author drafts SOP
2. Document Control checks formatting and numbering
3. Functional review by process owner
4. QA review
5. Department head approval
6. QA release
7. System publishes effective version
8. Training assigned to affected staff
9. Superseded version archived
10. Retention clock starts for obsolete version
11. Periodic review reminder set

---

12) Common pitfalls to avoid

• allowing uncontrolled Word/PDF copies in circulation
• approving drafts outside the system
• not linking signatures to document version
• weak or vague retention rules
• no training linkage for new SOPs
• inconsistent numbering across sites
• allowing obsolete SOPs to remain accessible as current
• missing audit trail for edits and approvals
• using shared accounts for e-signatures

---

13) Minimum procedures you should have

At a minimum, create or update these procedures:

• Document Control Procedure
• SOP Authoring and Approval Procedure
• Document Change Control Procedure
• Electronic Signature Procedure
• Record Retention and Disposal Procedure
• Training / Read-and-Understand Procedure
• Periodic Review Procedure
• Access Control Procedure for QMS/EDMS

---

14) A practical CDMO-ready design

A robust setup for a CDMO usually includes:

• centralized EDMS/eQMS
• site-specific and global document categories
• risk-based approval routing
• QA final release authority
• client-specific document segregation where needed
• retention rules by document class and region
• validated e-signatures with audit trail
• mandatory training on effective SOPs
• periodic review alerts and escalation
• obsolete document archive with read-only access

---

If you want, I can also provide:

1. a sample SOP workflow diagram,
2. a document control procedure template, or
3. a Part 11 / Annex 11 checklist for electronic signatures and audit trails.