Document Control
Document Control for Medical Labs: Beyond the Shared SOP Folder
Every lab has SOPs. Almost every lab also has a folder — on a shared drive, in SharePoint, sometimes literally a shelf — called something like SOPs_FINAL containing files called Glucose_SOP_v3_FINAL_updated_USE_THIS_ONE.docx.
That folder is where document control goes to die. Not because anyone is careless, but because a folder cannot do the four things document control actually requires: know which version is current, prove who approved it, prove who has read it, and make sure it gets reviewed before it goes stale.
This post walks through what each of those four requirements means in practice, the failure modes of the shared-drive approach, and what a controlled system does differently.
What “controlled” actually means
ISO 15189 requires labs to control the documents that govern their work — and CAP, CLIA, and UKAS all carry equivalent expectations. Stripped of the standards language, a document is controlled when the lab can answer, for any document at any moment:
- Which version is current, and where the obsolete versions went
- Who approved it, when, and on what authority
- Who has read it — specifically, whether the people performing the procedure have acknowledged the version they’re working from
- When it was last reviewed, and when the next review is due
A shared folder can answer none of these reliably. The filename convention answers question 1 until the first person breaks the convention. Questions 2–4 have no home at all.
The register: every document, one row
The backbone of document control is a register — a single list of every controlled document with its identity and status:
| Field | Why it matters |
|---|---|
| Document number | The stable identity that survives renames and revisions |
| Title and category | SOP, policy, work instruction, form, manual, external document |
| Department / owner | Who answers for it — reviews, revisions, acknowledgments |
| Current version | The one approved version in force right now |
| Review interval | How long before it must be re-reviewed |
| Status | Active, under review, or withdrawn |
The register is also what you hand the inspector. A one-page export listing every document, its current version, its owner, and its next review date is the strongest possible opening move in a document-control audit — it says we know exactly what we have.
Versioning: one current version, a full history
The shared-drive failure mode everyone recognises: two technologists run the same assay differently because one of them printed the SOP eight months ago. The lab has two “current” versions — the file on the drive and the paper on the bench — and no mechanism notices.
Real version control has a few non-negotiable properties:
- Exactly one current version per document. When a new version is approved, the previous one is automatically marked obsolete — not deleted (history is evidence), but unmistakably superseded.
- Versions are immutable once approved. Changes mean a new version, with its own approval trail. Editing an approved document in place destroys the meaning of the approval.
- File integrity is verifiable. A checksum (SHA-256) recorded at upload proves the file attached to version 3 today is bit-for-bit the file approved two years ago.
- Access is controlled. Time-limited download links instead of a world-readable folder, so “who can see our procedures” has an actual answer.
Approval: a workflow, not a signature line
A signature on the cover page proves someone signed a page. An approval workflow proves the right people reviewed the actual content of the actual version, and records what they decided:
- The owner uploads a new version — it starts as a draft.
- The draft goes to named reviewers, each with a deadline.
- Each reviewer independently approves or rejects. A rejection requires comments — “no” without “why” helps nobody.
- Any rejection sends the version back to the owner. All approvals make it the current version, with an effective date, and schedule the next periodic review.
Two edge cases separate serious systems from checkbox systems. First, the override: sometimes an admin legitimately needs to force a version through — a reviewer left the organisation, a regulatory deadline looms. The override should exist and be loudly recorded: who forced it, when, and the stated reason. An auditor who finds a logged, justified override sees a working system. An auditor who finds approvals that don’t add up sees something else.
Second, what happens to the old version’s acknowledgments — which brings us to the part most labs skip entirely.
Acknowledgment: the requirement everyone forgets
Here’s an exchange that happens in real inspections:
Inspector: This SOP was revised in January. The change altered the centrifugation step. Inspector: Can you show me that the night-shift staff who perform this test have read the revised version?
The lab has a beautiful SOP, a signed approval, a tidy register — and no answer. Document control without read-acknowledgment is a library, not a control system. The procedure only governs practice if the people practising have demonstrably seen it.
Acknowledgment tracking means: each document is assigned to the staff who must know it; each assignee acknowledges each version they’re required to read; the acknowledgment is recorded with a timestamp and method. When a new version is approved, the cycle restarts — the people doing the work confirm they’ve seen what changed.
Periodic review: documents go stale silently
An SOP that was perfect in 2023 may describe a reagent you no longer stock and an analyser you’ve replaced. Nothing about the document signals this — it sits in the register looking exactly as authoritative as the day it was approved.
Hence periodic review: every document carries a review interval, and when it comes due, the owner re-reads it and records one of three outcomes:
- No changes — still accurate; the clock resets.
- Revision needed — triggers a new version through the full approval workflow.
- Withdrawn — the document no longer applies; it leaves active service with a recorded reason.
The operational challenge isn’t doing reviews — it’s remembering them. A register of 200 documents on staggered intervals generates a steady drip of due dates no human tracks reliably. This is a reminders problem, the same one we described in why spreadsheets fail lab compliance: review-due notices at 30, 14, and 7 days, escalating when overdue, sent to the owner who can act.
Measuring it: the document compliance score
Like every other compliance domain, document control benefits from one honest number: what percentage of active documents are current on their review schedule? Underneath it, the working lists — reviews coming due, overdue reviews, pending acknowledgments per document — turn the score into a to-do list rather than a verdict.
For individual staff, the same data inverts into a personal view: here are the documents you haven’t acknowledged yet, required ones first. Acknowledgment compliance stops being a quarterly chase and becomes a small, visible queue that empties itself.
Migrating off the shared drive
The move is less painful than it looks, because you don’t migrate the folder — you migrate the register:
- List what you actually have. Walk the folder, list every genuine controlled document, and decide its number, category, owner, and review interval. (You will find duplicates and drafts pretending to be documents. This cleanup is the most valuable step of the whole project.)
- Upload current versions only. The historical versions stay archived; the controlled system starts with the version in force today, approved through the workflow as the baseline.
- Assign and acknowledge. Map each document to the staff who must know it, and run the first acknowledgment round.
- Turn on the review clock. Set intervals, let the reminders fire, and let the system surface the documents that were already overdue for review — there will be some, and finding them yourself beats having an inspector do it.
A lab that completes those four steps has something the shared drive could never provide: for every procedure that governs patient results, a provable answer to which version, approved by whom, read by whom, reviewed when. That’s document control. The folder was just storage.
Related reading:
