Ask a lab director what worries them before an audit, and the answer is rarely science. It’s the paperwork behind the science — specifically, whether the SOP a technician followed at 2 a.m. last Tuesday is the same one sitting in the binder an inspector will pull off the shelf tomorrow.
Every lab has procedures. Almost none of them are the problem people assume they are. The documents exist, they’re generally well-written, and someone, at some point, approved them. What breaks down is everything that happens after approval: the slow drift between what’s written and what’s actually done, the SOP that got revised in a shared folder but never made it to the bench, the technician who’s been running a method a certain way for two years because that’s how their trainer showed them, regardless of what the current controlled copy says.
This is the quiet failure mode of laboratory quality systems. Not missing procedures — stale ones, hidden in plain sight.
The Version That Nobody Can Vouch For
Walk into a mid-sized commercial or clinical lab and ask to see the SOP for a routine test. There’s a good chance you’ll get a file with a name like “Glucose_SOP_v3_FINAL_updated_USE_THIS_ONE.docx,” sitting in a folder alongside four earlier versions nobody has deleted. The lab has not separated document control from simple file storage, and the distinction matters more than it sounds like it should.
A shared drive can hold a file. It cannot answer the four questions that actually define document control: which version is current, who approved it, who has read it, and whether it’s due for review. A folder structure doesn’t track any of that — it just stores whatever was dropped into it last, indefinitely, with no memory of what changed or why.
The consequence isn’t abstract. Document control fails in practice when a lab cannot demonstrate, for any given procedure, which version is authoritative, who signed off on it, who has confirmed reading it, and whether it’s been reviewed on schedule. When those threads aren’t connected, a lab can be doing everything technically right — competent staff, sound science, accurate results — and still fail an audit on process alone.
Auditors have learned not to take a document’s existence at face value. During an assessment, they expect to see version history, dated approval records, and evidence that staff reviewed the current version before performing the work it governs — and most labs cannot assemble that full chain quickly when asked. The gap isn’t a lack of discipline. It’s that each part of the process — writing, reviewing, approving, training — happens in its own isolated pocket, and nothing ties the pockets together into a single, provable record.
The scenario that trips up even well-run labs looks something like this: a method changes, the SOP gets revised, and everyone assumes the update reached the floor. But most labs don’t lack SOPs — they let the ones they have go stale, while instruments get upgraded, methods evolve, and new systems come online around procedures that were last touched the day they were printed. Testing continues to run correctly, day after day, right up until an inspector asks a technologist to walk through the procedure from memory — and the answer doesn’t match what’s on file.
What the Regulations Actually Ask For
It’s worth being precise about this, because “document control” gets used as a catch-all phrase that obscures what regulators are genuinely checking for.
ISO/IEC 17025 addresses SOP governance directly in Clauses 8.2 and 8.3. The standard requires that documents be approved for adequacy before they’re issued, and — this is the clause labs most often fall short on — that they be periodically reviewed and updated as necessary, with internal documents required to reflect what the laboratory is actually doing and external documents kept to their latest issued versions. That second half is where the shared-drive approach quietly fails: a procedure can be technically “approved” and still be wrong, because approval was a one-time event and review was never scheduled to follow.
The standard doesn’t stop at the procedure itself. It calls for solid version control with clear revision numbers, dates, and documented reasons for change, alongside a system for training personnel and ensuring outdated documents are actively archived or pulled from circulation rather than left to linger. A good working practice — one accreditation bodies consistently look favorably on — is treating the SOP process itself as a controlled procedure: a documented method for how SOPs get authored, reviewed, approved, distributed, and updated, ideally written by senior members of the group who will actually use them.
GMP-regulated environments raise the stakes further, because in pharma manufacturing, an out-of-date or unfollowed SOP isn’t just a documentation gap — it’s a data integrity and patient safety issue, and FDA inspectors treat it that way. 21 CFR 211.100(b) is one of the more frequently cited provisions in FDA Form 483s, specifically around procedures not being followed or properly documented — with 39 separate observations logged against that clause since 2021 alone. The broader pattern is consistent across pharmaceutical inspections: when SOPs are missing, outdated, or simply not enforced in daily practice, they become one of the most recurring root causes behind formal FDA findings. Inspectors have also flagged a subtler version of the same problem — procedures that technically exist in an electronic system but aren’t actually accessible from the processing or QC areas where staff need them in the moment, which is its own kind of document control failure even when nothing is technically “outdated.”
Across every framework — ISO 17025, ISO 15189, CAP, CLIA, GMP — the underlying expectation is the same: a procedure only counts as controlled if the lab can prove, on demand, that the version in use matches the version approved, and that the people executing it have actually seen it.
The Lifecycle, Stage by Stage
SOP management isn’t a single task — it’s a lifecycle, and most compliance gaps trace back to a handoff between stages rather than a failure within any one of them.
Authoring. The strongest SOPs come from the people who’ll actually follow them, not from quality staff working in isolation from the bench. A procedure written without frontline input tends to describe an idealized workflow that technicians quietly route around.
Review. This is a distinct step from authoring, and it needs a defined owner — typically a technical lead or section supervisor who checks the procedure against current instrumentation, methods, and regulatory expectations before it goes anywhere near approval.
Approval. Formal sign-off by authorized personnel, dated and attributable to a specific individual. ISO 17025 is explicit that documents must be approved for adequacy prior to issue — not after the fact, and not informally.
Distribution. The point where most paper-based and shared-drive systems quietly fail. Distribution isn’t complete when a file is saved to a folder; it’s complete when every person who needs the current version has access to it, and every obsolete version has been pulled from active use.
Training. A revised SOP that nobody has been trained on isn’t really in effect yet, whatever the approval date says. This is also the stage inspectors probe hardest, because it’s the one most likely to be assumed rather than verified — the CalibDue analysis of medical lab document control put it bluntly: a document without read-acknowledgment tracking functions as a library, not a control system, because a procedure only governs practice once the people doing the work have demonstrably seen it.
Revision. Triggered by method changes, equipment updates, deviations, or scheduled periodic review — and each revision needs to restart the training and acknowledgment cycle, not just replace the file.
Retirement. Obsolete versions need to be formally withdrawn, not just superseded in name while the old PDF still sits in someone’s downloads folder or a printed binder on a shelf.
Break any single link in that chain and the lab is exposed — not because the science is wrong, but because the paper trail can’t back it up.
Why the Chain Keeps Breaking in Manual Systems
The pattern across nearly every gap analysis of lab document control is the same: the individual steps get done, but nothing connects them into a single, retrievable record. Teams do follow their processes — they review documents, they collect signatures — but the system that’s supposed to hold those actions together simply doesn’t exist, and each step ends up recorded in a different place: an email, a signed cover sheet, a training spreadsheet, a shared folder.
That fragmentation is invisible on a normal day. It becomes very visible the moment an auditor asks a specific, connected question: this SOP was revised in January and the change altered a critical step — can you show me that every technician on the night shift acknowledged the new version before performing the test again? A lab running document control through folders and email usually can’t answer that in the room. It can produce the SOP. It can probably find a training record somewhere. Connecting the two, on the spot, with dates that line up, is a different exercise entirely — and it’s exactly the exercise inspectors have learned to ask for.
Where Automated Document Control Changes the Outcome
A LIMS with built-in document control doesn’t just store SOPs — it enforces the lifecycle so that a broken link becomes structurally difficult, rather than something that depends on someone remembering to close the loop manually.
Version control happens automatically: every revision creates a new, uniquely identified version with a preserved history, so there’s never a question of which file is current or what changed between iterations. Approval routing runs through the system itself rather than an email thread — designated approvers review and sign off inside the platform, with the action timestamped and permanently attached to that specific version. Distribution and obsolescence are handled together: the moment a new version goes live, the prior one is automatically withdrawn from active circulation, closing off the exact failure mode where an old printed copy keeps circulating on the floor.
Training and acknowledgment are the piece manual systems handle worst, and it’s where automation earns its keep. Rather than tracking sign-offs on a separate spreadsheet, the system ties each staff member’s acknowledgment directly to the SOP version they were assigned, and flags anyone who hasn’t yet confirmed the current release. When a revision goes into effect, the acknowledgment requirement resets automatically — nobody has to remember to reassign it.
The net effect is that the audit-trail question inspectors ask — prove this person was trained on this version by this date — stops being an exercise in reconstruction and becomes a report the system already has.
QISS LAB builds this directly into its document control capabilities, tying version history, approval workflows, and staff acknowledgment into the same connected record — so the lab isn’t assembling the chain after the fact, because the system has been holding it together the whole time. For labs still managing SOPs through shared drives and email approvals, it’s worth seeing what that looks like in practice: QISS LAB offers a free demo and trial that walks through exactly this workflow, end to end.
