Version Control Makes Your Lab SOPs Tidy — Document Control Is What Passes the Audit

Version Control Makes Your Lab SOPs Tidy — Document Control Is What Passes the Audit

The assessor doesn’t ask to see your SOP folder. They ask your analyst to run a test, then they watch. And somewhere between the method on the screen and the hands on the bench, a gap opens up — the SOP says one thing, the analyst does another, and nobody in the room can say which version is the real one. That’s the finding. Not a missing signature. A method that lives in someone’s head instead of on the controlled page.

Most labs reach for version control to fix this. Track changes, a revision number, a date in the corner — and suddenly the documents look professional. But looking professional and being controlled are two different things, and the standard your accreditation rests on cares about the second one. If you run a testing or pharmaceutical lab in South Africa, the digitisation project worth doing isn’t the one that makes your SOPs neat. It’s the one that makes the controlled version the only version anyone can act on.

The Opportunity

Here’s what document control actually buys you: when an assessor pulls a method, the version on file is the version your team is using — no parallel copies, no “oh, that one’s out of date” moment, no scramble in the corridor. The standard your lab works to requires document control precisely because uncontrolled documents are where quality systems quietly fail.

The win isn’t tidiness. It’s that you stop carrying a hidden risk you can’t see until audit day. A small lab usually has one senior analyst who holds the “real” method, an SOP last revised eighteen months ago, and three printed copies floating around the building — one in a drawer, one laminated at a workstation, one in an email thread. Every one of those is a chance for the page and the practice to drift apart. Close that gap and you’ve removed the single most common reason small labs pick up document-related findings. You also stop paying the quieter tax: the hours your senior person loses re-explaining the current method because nobody trusts the paper.

How It Works

Start with one question for every SOP: where does the controlled copy live, and how does a person know it’s the controlled copy? If the answer is “the network drive, probably the newest file,” you don’t have document control yet. You have a folder.

The practical fix doesn’t need expensive software to begin. Microsoft 365 with SharePoint — which many SA labs already pay for — gives you version history, a single source location, and check-in/check-out so two people can’t edit the same method into conflict. Set one library as the controlled home for every SOP. Turn on major-version numbering so a draft (1.1) is visibly different from an approved release (2.0). Restrict who can publish a new approved version to the quality owner, and let everyone else read-only. Now there’s exactly one place the current method lives, and exactly one person who can change what “current” means.

Then kill the printouts, or control them. An uncontrolled printed SOP at a workstation is the classic finding — it was current the day it was printed and wrong every day after. If your team needs a copy at the bench, put a tablet or a screen there pointing at the live controlled version, or stamp printed copies with a print date and a “valid for 24 hours” rule so nobody trusts an old one.

This is also where an AI assistant earns its place, carefully. You can use a tool to compare two SOP versions and summarise what changed in plain language, draft a revision-history note, or flag SOPs that haven’t been reviewed past their due date. What you don’t do is let it approve, sign, or rewrite a method unsupervised. SAHPRA has signalled it expects AI used in regulated settings to be governed, not assumed — treat any AI step as a drafting aid that a competent person checks, never the approver. The competent person stays in the loop. The tool just removes the busywork around them.

Case Study: The Consolidation Week That Found Three Live Versions

This example is illustrative — built from patterns common to small SA labs, not a single real client.

A 14-person analytical lab in Gauteng ran SOPs the way most small labs do: a shared drive, a naming convention nobody fully followed, and a senior chemist whose memory was the actual source of truth. The problem surfaced when she booked three weeks’ leave and the lab realised it couldn’t confidently say which version of its core assay method was the approved one.

What changed: they spent one focused week moving every SOP into a single controlled SharePoint library, with version numbering and a named quality owner who alone could publish approved releases. AI helped draft the change summaries between old and new versions so the review didn’t eat a fortnight.

The result: one controlled home for every method, read-only for the bench, and a clear approval trail the next assessor could follow without anyone explaining it.

The friction: consolidation week was genuinely painful. Pulling the scattered copies together exposed that two SOPs had contradictory steps living in different folders — the bench had quietly been following the wrong one for months, and reconciling them meant re-validating part of the method, not just re-filing it. The document system didn’t create that problem. It just finally made it visible, which is the point — but nobody enjoyed the week it took to fix.

Frequently Asked Questions

We already use a shared drive with dated filenames — isn’t that document control? No, and this is the most common mix-up. A shared drive gives you storage and a rough history. Document control means there’s one authoritative version, a controlled way to change it, restricted publishing rights, and a way for any user to confirm they’re looking at the current release. Dated filenames fail the moment someone saves “final_v2_REALfinal” — which someone always does. The control is in the process, not the folder.

This sounds like it needs an expensive quality-management system we can’t justify. It doesn’t, to start. The version described here runs on Microsoft 365 tools a lot of SA labs already license, plus discipline about who can publish. Purpose-built eQMS software exists and is worth it once your document set or audit load grows, but buying it before you’ve fixed the process just gives you an expensive folder. Prove the controlled workflow manually first, then decide if you need to automate more of it.

If we hold analyst records and client data in this system, where does POPIA fit? Document control and personal data sit in the same system, so treat them together. Competence records, training files, and any client data tied to results can include more sensitive personal information, so apply the basics — collect only what you need, limit who can access it, and set a retention period. POPIA’s exact conditions for sensitive data are specific, so confirm the details against current POPIA guidance rather than assuming the defaults cover you.