GMP Basics of Good Documentation Practices (GDocP)
Good documentation practice (GDocP) is a crucial component of GMP compliance.
More frequently referred to as Good Recordkeeping Practice, good documentation practices are not only helpful during a regulatory inspection (GMP audit), non-conformance/deviation investigation, or product recall. These practices are mandatory to ensure that your documentation — and your products — meet industry standards and other legal responsibilities in the pharmaceutical sector.
Good Documentation Practice (GDocP — or GRK for Good Recordkeeping) is an essential component of your overall pharmaceutical quality system (PQS) and quality risk management strategies (QRM).
Good documentation practice is good business practice no matter what your organisation services, produces, or sells.
- Recordkeeping procedures (SOPs) help manufacturing organisations meet their PIC/S GMP requirements (quality standards/risk management standards) and ISO certification expectations.
- Reliable, accurate, consistently recorded information helps ensure product safety, quality and efficacy.
- While recordkeeping procedures are an important part of ANY business — they are particularly crucial in pharmaceutical, veterinary medicine and medical device manufacturing industries in view of the potential risks to end-users of their products (i.e. consumers/patients, pets, or livestock).
Good documentation practices are also essential for attaining and sustaining ISO-9001-2015 certification — or other ISO certification specific to your industry, such as ISO/IEC 17025 (for laboratory testing and calibration standards); ISO/IEC 27001 (for information security management system / ISMS), or ISO 13485:2016 (for medical device manufacturing).
FDA Audits and TGA Audits – Recordkeeping/Documentation Citations
You can nearly guarantee your documentation procedures, recordkeeping systems, and data integrity compliance measures will be targeted in your next GMP/EU cGMP audit or other PQS inspection.
Breaches of GMP regulations in relation to documentation practices/data systems are frequently cited in FDA audits, TGA audits, and inspections by other Regulatory Authorities. To avoid audit findings — and reduce your chances of releasing a substandard product batch into the pharmaceutical supply chain (necessitating a recall) — good recordkeeping is essential.
Good recordkeeping, the foundation of data integrity, requires managerial-level prioritisation of data governance measures.
Your entire organisation must stay up to date with good documentation practices training requirements and QMS/compliance monitoring.
This applies not only to your employees but to your contractors, suppliers/vendors, and distribution personnel (e.g. warehouse workers, product transport companies, and other individuals and businesses involved in manufacturing, packaging, storage, transportation, logistics, and delivery). Good recordkeeping is also mandatory for complaints handling systems, CAPA systems, and post-marketing surveillance activities (pharmacovigilance/adverse event reporting).
Inadequate documentation practices and recordkeeping weaknesses are key targets for FDA inspections, TGA inspections and QMS audits.
GDocP vs GDP (Good Documentation Practice vs Good Distribution Practice)
Before we discuss the basics of good documentation practices for beginners, good documentation practices should not be confused with good distribution practices (for which the acronym is GDP).
- Documentation practices should always be referred to as GDocP — not GDP
- However, some industry publishers still use the same acronym (GDP) for documentation practices as well as for distribution practices (an error).
Double meanings for the acronym GDP could impact your quality management systems and guidelines. Be sure to specify GDocP for good documentation practices or refer to Good Recordkeeping Practice (GRK) as per PIC/S Guidelines.
For Beginners | GMP Basics for Good Documentation Practices
GMP expectations, as well as ISO certification, depends upon organisation-wide good documentation practices/good recordkeeping practices.
These expectations including a high-level commitment to data governance, such as maintaining data integrity and computer system/data system validation activities, timely data monitoring, and continuous improvement initiatives.
Aim and purpose of good documentation practices (GDocP) in pharmaceutical and medical device manufacturing
- Are you new to GMP regulations, compliance requirements, self-inspections and audits?
- If you’re new to regulated manufacturing sectors, learn more about GMP through PharmOut’s PIC/S Annexes/GMP compliance training store.
- Good Recordkeeping Practice (GRK)/Good Documentation Practice compliance training/presentation.
Online GMP courses are typically available immediately upon completion of the online order. These courses will help you (and/or your new employees or contractors) better understand GMP compliance guidelines and industry expectations.
Requirements for GDocP/GRK compliance
In brief, Good Documentation Practice (GDocP) guidelines from organisations such as PIC/S helps to ensure globally-expected standards are met during ALL stages of manufacture and distribution of medicinal products (pharmaceuticals, medical devices, veterinary medicines, etc).
GMP, PIC/S and ISO9001-2015 documentation standards relate to:
- data accuracy
- recorded accurately
- cross-checked for errors
- not intentionally misleading (prevents fraudulent entries, editable entries)
- data integrity/validation
- genuine, true data
- validated and supported/witnessed; vs intentionally falsified
- relevant to the reporting requirement
- not changeable after original recordkeeping entry (extensively tracked changes)
- reporting/recordkeeping timeliness
- information is recorded contemporaneously
- real-time record keeping including date stamps (e.g., automated time-stamping)
- prevents errors from human memory-reliance issues and prevents editing of original data
- legible (readable by anyone, removing guesswork)
- readily accessible
- clear records that can identify the person who actually records the data
- Blockchain is increasingly being discussed as part of Pharma 4.0 innovations
- watch for other new technology adaptations for GDocP as systems evolve
- Especially given growing global concerns about counterfeit pharmaceuticals and cosmetic medicines and substandard medicines and fake antibiotics entering global pharmaceutical chains
- GMP and GDocP requires no shared passwords (and high-tech digital security for data integrity purposes and data entry tracking/logging identification)
- clear records that can identify the person who actually records the data
Documentation/manufacturing records must meet ALCOA+ standards.
- What does the “+” represent in ALCOA+?
- Learn more about ALCOA+.
Tips for beginners: additional information on the basics of Good Documentation Practice (GDocP)/GRK.
All personnel, including contractors, are responsible for following regulatory guidelines.
- Expectations for GDocP/GRK compliance go well beyond being an organisation-wide requirement.
- These expectations also apply to contractors, service vendors/maintenance workers, equipment installation engineers, raw material suppliers, and any other individuals or companies involved in your manufacturing, production, labelling/packaging operations (and supply chains).
It’s important to be aware of the compliance gaps that lead to GMP audit citations and/or audit failures (audit findings/citations/production line shutdowns and/or facility closures).
Documentation AND distribution practices are two key areas where companies often end up inadvertently breaching GMP requirements/PIC/S guidelines for documentation practices.
As the manufacturer (product sponsor), your organisation is ultimately responsible for ensuring EVERY person involved in the production and distribution of your products has attained appropriate GDocP compliance training (with proof, e.g. assessments/training certificates).
GDocP Investigations, Self-Inspection Findings and GMP Audits
Averting GMP audit findings (GMP compliance breaches, e.g. to avert failing an ISO certification audit, or being subjected to a TGA warning letter/citation or an FDA warning letter/audit citation/fine):
- GDocP compliance investigations need to be performed regularly.
- Management must provide/ensure adequate training and monitoring of documentation practices and quality systems, including those used by contractors, key suppliers, and transportation personnel.
Self-Inspections for GDocP compliance are recommended to be performed more frequently than your annual self-inspection requirement.
- Many manufacturing businesses perform self-inspections more frequently than their annual requirement.
- More frequent self-inspections (internal audits) can help improve compliance, reduce product risks, and provide ideas for continuous improvements — as well as ensuring the effectiveness of the Pharmaceutical Quality System (PQS).
“Self-inspections” in the pharmaceutical industry are internal GMP compliance investigations. Internal audits can help reduce product safety and supply chain risks, such as product interception (theft/diversion) and/or product tampering.
And good recordkeeping, along with internal audits, ensures crucial evidence if available for quality assurance, batch release, and batch traceability (a necessity for a product recall).
GDocP/GRK training, and recordkeeping compliance monitoring, in conjunction with other data governance measures, can help reduce your risks of ‘failing’ a GMP compliance audit.
Just remember that good recordkeeping requirements apply to everyone in your distribution supply chain, not just manufacturing-site personnel.
It is applicable to your casual workers/contractors, contract service providers, source material/API suppliers, warehouse workers, and transport/delivery organisations.
All people who have contact with your product, at any stage of production or delivery:
- require documented, ongoing training in GDocP/GRK compliance
- are expected to be monitored for GMP/GxP compliance
- should understand how to identify potential issues with records/data integrity
The FDA and TGA will likely investigate your employee records, and the documentation practices of your suppliers and service providers — including contractors — and they’ll do so in-depth!
That’s because good documentation practices are part of the 10 golden rules of GMP.
Applicability of GDocP/GRK
- Good documentation practices (requirements) apply to nearly all delivery regions and countries.
- While PIC/S guidelines aim to ensure global consistency in terms of manufacturing standards, some regions may have slightly different documentation requirements — DO check before you ship.
Digital recordkeeping systems
If you’re relying on any type of digital recordkeeping system, you must ensure your computerised systems and data collection/data analysis processes are validated according to GMP guidelines/regulatory expectations.
Ensure you comply with data integrity requirements.
Documentation Types | Good Documentation Practices
What types of documents or recordkeeping is required in the pharmaceutical industry or in the production of medicinal cannabis, medical devices, blood and tissue products and veterinary medicine production?
Examples of records for which employees/contractors and suppliers must adhere to good documentation practices (GDocP as part of GMP including GDP or distribution) include, but are not limited to:
- Analytical Methods
- Annual Self-Inspection (Procedures, Implementation and Findings/Actions)
- Batch Records / Supply Sources
- Bills of Materials (BOMs)
- CAPA (Corrective Actions and Preventative Actions)
- Clinical Study Records
- Cold Chain reports and climate testing measurements/records
- Complaints and complaint handling/monitoring
- Continuous Improvements
- Certificate of Analyses (CoA)
- Certificate of Compliance (CoC)
- Distribution records including Routes, Storage and Delivery Records
- Incident Reports
- Laboratory Notebooks / Logbooks
- Labels (Product Labels and sampling labels)
- Policies (documentation including approvals and distribution/employee training records)
- Protocols and changes to protocols (change management system documentation including approvals)
- Quality management records / QMS systems
- Recalls and Recall Policies
- Releases (QMS approvals by trained, competent and authorised personnel)
- SAE reporting (serious adverse events reporting)
- Source suppliers and source supply testing/monitoring
- Standard Operating Procedures
- Test Methods / Quality Testing methods including validation and recordkeeping
- Training | GMP training for Employees, Contractors, Suppliers/Vendors including your distribution/warehouse and transportation personnel or contractor(s)
- Work Instructions (Workflow, procedures, SOPs)
- Workplace Safety reports/record keeping
- Validation (methods, reports and related documentation including IQs, OQs and PQs)
Documents and records can fall into various classification systems, and in general, there are 4 key classifications for documentation.
- Primary Records (examples: production formulas, supply source documents, contracts, packaging instructions)
- Procedures or supporting procedures (instructions and guidebooks, SOPs)
- Subsidiary records (help meet GMP, e.g. calibration readings reports, print outs, other supporting documents)
- Quality Control records (testing results, testing methods, recall procedures, investigations, self-inspection reports, CAPA, more)
GDocP | What are the specific requirements for good documentation practices in pharmaceutical production including medicinal cannabis and other herbal medicines, veterinary medicines and medical device manufacturing?
Check your organisations SOPs (Standard Operating Procedures) and work instructions for details.
You must also attend training and refresher training for good documentation practices.
Basic requirements for good documentation practices will include, but not be limited to, the following components:
- Data Integrity (protected, secure and backed-up data systems)
- Contemporaneous recordkeeping (timely, immediately/real-time)
- Readily identifiable as to who recorded it (no shared passwords or shared data system log-ins, no forging of signatures even if requested)
- Readily accessible when required
- Signature record log and register
- initials and signatures of all employees, contractors and suppliers who fill in documentation
- a secure database to match initials and signatures with the actual identity of the person who recorded the data
- Security / Data Integrity
- Data must not be able to be altered or erased once entered or recorded
- No white-out is permitted in GMP facilities and no gel pens (specific writing instruments are designated in your SOPs and working instructions)
- Specific rules must be followed when altering a record, such as a legible cross through of the data and the correction listed with your registered initials and the time/date (and reason for the change, depending on the recordkeeping requirements)
For GMP consultancy or GMP audit assistance, including quality management systems and data integrity consultancy, contact PharmOut’s leading consultants (international expertise in GMP industries and PICS compliance including QMS and audit failure recovery.
References, Sources and Further Reading
Or for individual or onsite training courses, review GMP training courses by PharmOut’s GMP Training, learning and development expert, Maria Mylonas and other GMP manufacturing and medicinal cannabis TGA industry experts.
For GMP consultancy and/or GMP audit assistance, validated quality management systems (QMS) and other data integrity or production engineering and distribution practice consultancy, visit PharmOut’s site.
You can also browse our top online GMP training courses for industry-specific training, available in bundles. Onsite custom courses by Maria Mylonas are also available at your facility anywhere in the world.
Page last updated: October 4, 2021.