Document change request (DCR): running SOP revisions that pass audit
What goes in a document change request, who approves it, and how to tie SOP revisions to training, effective dates and superseded versions under ISO 13485 and EU GMP.
An operator tells you the line clearance SOP still lists a label reconciliation step that the new printer made redundant months ago. Everyone on the shift skips it. Someone has pencilled a note on the copy in the packing room. You now have three problems: a procedure that does not match practice, an uncontrolled annotation on a controlled document, and a change that has to go through your document control procedure before anyone can rely on it.
This article sets out how to run a document change request (DCR) so that an SOP revision reaches the shop floor correctly: what the request should contain, who reviews and approves it, how training and the effective date fit together, what happens to the superseded version, and the findings auditors and inspectors raise most often when document change control is weak.
What ISO 13485 clause 4.2.4 and EU GMP Chapter 4 require
Medical device manufacturers work to ISO 13485:2016 clause 4.2.4, control of documents. It requires a documented procedure that covers review and approval of documents before issue, review and update with re-approval, identification of the current revision status and of changes, availability of the relevant versions at points of use, and prevention of unintended use of obsolete documents. Two parts of the clause matter most for a DCR. Changes must be reviewed and approved either by the function that approved the original or by another designated function with access to the background information it needs. And you must define how long at least one copy of an obsolete document is kept: at least the lifetime of the device as you define it, and never less than the retention period of any record that depends on it, which clause 4.2.5 sets at a minimum of two years from release of the device.
Medicines manufacturers follow EudraLex Volume 4, Chapter 4. Paragraph 4.3 says documents containing instructions should be approved, signed and dated by appropriate and authorised persons, be uniquely identifiable, and have a defined effective date. Paragraph 4.5 requires documents to be regularly reviewed and kept up to date, and 4.29 lists change control among the activities that need written procedures and records. A revised Chapter 4 went to public consultation in July 2025, with more weight on data governance; the expectations for approving and issuing instructions remain.
Neither text uses the phrase "document change request". The DCR is simply the record that shows these requirements were met for a given change.
What goes in a document change request
A good DCR form is short enough that people will raise one and complete enough that an auditor can follow the change years later. These fields earn their place:
| Field | What it should hold |
|---|---|
| DCR number | Unique, sequential, never reused |
| Document(s) affected | Number, title and current version of every document touched, including forms and templates |
| Originator and date | Who raised it and when |
| Description of change | What changes, section by section, with a redline or marked-up copy attached |
| Reason for change | The trigger: CAPA, deviation, audit finding, new equipment, regulatory update, periodic review |
| Linked records | CAPA, deviation, change control or complaint numbers |
| Impact assessment | Other documents, training, validation, product or regulatory impact |
| Classification | Editorial or substantive, and whether full change control is needed |
| Reviewers and approvers | Named functions, with dated signatures |
| Training requirement | Who must be trained, by what method, before what date |
| Effective date | When the new version becomes the only one in use |
| Implementation check | Confirmation that old copies were withdrawn and training completed |
The reason for change deserves more care than it usually gets. "Updated SOP" tells an inspector nothing. "Step 6.4 removed: label reconciliation now performed automatically by the printer vision system, validated under VAL-112" tells them where to look next, and it tells the next author why the step disappeared.
Attach the redline. Without it, every reviewer compares documents by eye, and some will not bother.
Who reviews and approves an SOP revision
The default under ISO 13485 is that the same functions that approved the original approve the change. If production and QA signed the first issue of the line clearance SOP, production and QA sign the revision. You can designate a different function, but your procedure should say so and that function must have the background to judge the change.
In practice, set reviewers by document type in your document control procedure, then let the DCR add reviewers when the impact assessment calls for it. A change to a cleaning SOP that alters a contact time needs the validation lead, even if validation never signed the original. Keep the approver list proportionate: six signatures on a typo correction teaches people to approve without reading.
Separate review from approval. Reviewers check content and practicality, and the people who follow the procedure are often the best reviewers you have. Approval is the accountable decision that the document is fit to issue. In a GMP setting the quality unit normally approves every GMP document. For electronic approval, the signature should be attributable and linked to the record, in line with EU GMP Annex 11 and, if you also supply the US, 21 CFR Part 11.
When a DCR is enough and when you need change control
Not every SOP revision is a change to the process. Correcting a reference, reformatting a table or fixing a spelling error is editorial. Changing a parameter, a sequence, an acceptance criterion or who does what changes how work is done, and that may need formal change control with a wider impact assessment.
Write the rule into your procedure. A common approach is that a DCR covers the document revision itself, and any DCR whose impact assessment touches validated processes, equipment, specifications, product or regulatory filings must link to a change control record that approves the underlying change first. The document then becomes the means of implementing an approved change. The order matters: an SOP that describes a new process before the process change is approved is a document describing something that is not authorised.
Editorial changes still produce a new version, still need approval and still replace the old copy. What they can usually skip is training, and your procedure should say on what basis.
Training and the effective date
This is where most document control systems leak. The SOP is approved and issued on Monday, and the night shift finds out on Thursday when the new form appears at the line.
Treat approval and effectiveness as separate events. Approval says the document is right. The effective date says when everyone is ready to follow it. Between the two sits a training window, defined in the DCR, during which the people affected are trained on the new version and the training is recorded against that version number. Chapter 4 asks you to define the effective date; the work is making it mean something.
Set the training method to suit the change. A read-and-understand acknowledgement may suit a clarified step. A changed sequence on a filling line may need practical training and an observed run. Decide, record the decision, and do not let the effective date pass while trainees are outstanding without a documented decision about who may and may not perform the task.
Watch for people absent during the window, such as those on leave and contractors. They should not perform the task until trained on the current version, and your training matrix should show that without anyone needing to remember.
Superseded and obsolete versions
When the new version becomes effective, the old one must stop being usable at every point of use. In an electronic system that means the superseded version is withdrawn from general view and clearly marked. On paper it means a reconciliation: every issued copy collected or destroyed, and the issue log updated to prove it.
Keep a controlled archive copy of each superseded version. Batch records and device production records refer to the procedure in force when the work was done, and an investigator looking at a three-year-old deviation needs to see the version that applied then. ISO 13485 ties the retention period to device lifetime and to the records that depend on the document; for medicines, Chapter 4 sets out batch documentation retention, and the instructions that governed those batches need keeping at least as long.
Distinguish "superseded" (replaced by a newer version) from "obsolete" (withdrawn with no replacement), and record why a document was retired entirely.
Common audit findings in document change control
The same findings come up in notified body audits and GMP inspections year after year, and most of them are visible from a single sampled SOP.
The first is the uncontrolled copy: a photocopy taped inside a cabinet door, or a handwritten amendment on an issued procedure. The pencilled note in the packing room from the opening example is exactly this, and it is usually the first thing an auditor sees. Close behind is the procedure that differs from practice. The auditor reads the SOP, watches the task, and the two do not match, because the work changed and the document did not.
Training produces the next group. Records are dated after the effective date, or signed against the previous version number, or missing for the night shift. The usual test is a recent revision and the training records of three people who perform the task.
Then come the paperwork gaps that show the system is not doing its job. A DCR with no reason for change, or a reason that does not explain the content. A substantive revision with no link to the change control or CAPA that triggered it. An approval signed by someone outside the defined approver list with no record of delegation. A backlog of overdue periodic reviews. And forms or templates revised without any DCR at all, because nobody treated a blank form as a controlled document, although Chapter 4 paragraph 4.1 names templates and forms among the documents that need controls.
A document change request procedure in seven steps
- Raise the DCR with the affected documents, a redline and a clear reason.
- Classify it as editorial or substantive, and link to change control where the change alters process, product or validated state.
- Assess impact on related documents, training, validation and regulatory commitments.
- Review by the defined functions, then approve by the accountable functions, with dated signatures.
- Set the training requirement and an effective date that allows training to finish.
- Make the new version effective, withdraw the superseded version from all points of use, and archive it.
- Verify: training complete, old copies reconciled, linked CAPA or change control updated.
Takeaway
A DCR is evidence that a procedure changed for a stated reason, was checked by the right people and reached the floor only after the people using it were ready. Build your form around the reason for change, the effective date and the training link, and sample one SOP revision a month against the findings above. The weak points will show up quickly.
If you would rather keep versioning, review, approval and effective dates in one system with training assignment alongside, see how InnoQualis Document Control handles it.
