EDMS Periodic Review Checklist: Evidence and Decisions

An EDMS periodic review asks whether the system still supports its approved use with adequate controls and evidence. Compare today's configuration, workflows and operating history with the accepted baseline. The useful output is a decision about continued use, specific actions and the next review trigger, not a signed statement that nothing has changed.

This checklist is for owners of document systems supporting pharmaceutical GMP processes. Its EU discussion concerns human-medicine GMP; US applicability depends on the actual regulated activity and records. Reviewing the system is different from reviewing the scientific content of each SOP or inspecting the audit trail for an individual transaction. Those activities provide inputs but do not replace one another.

The worksheet below is a proposed operating method. Adapt its acceptance criteria and responsibilities to your approved procedures before using it. It is fully available in the article; no separate download is needed.

Define the review before collecting reports

Create a review header containing system/tenant; application and configuration baseline; intended use; sites and document classes; assessment period; prior review; applicable obligations; process owner; technical owner; quality reviewer; decision authority; evidence cutoff; and planned completion date.

Define the period from the previous accepted review cutoff to the new cutoff, and reconcile any gap or overlap. Include earlier open actions even if their creation dates precede the current period. A review beginning at the new calendar year can otherwise miss an unresolved finding from December.

Use the system inventory, supplier release history and internal change log to establish what actually exists. If one site began using an external-review portal halfway through the period, include it or document the approved boundary and separate assessment. Calling the portal a pilot does not answer whether the organization already relies on its records.

The regulatory basis does not prescribe an annual ritual

Current EU GMP Annex 11, section 11, calls for periodic evaluation of continued valid state and GMP compliance, considering relevant functionality, problems, changes, security and validation information. The Commission's current index lists the January 2011 Annex 11; the PDF identifies revision 1, operational from June 30, 2011. Section 11 does not specify a universal annual interval.

For US drug-manufacturing systems within scope, 21 CFR 211.68 addresses routine checking under a written program, authorized changes and verification tied to system complexity/reliability. Do not relabel this as a universal FDA annual EDMS-review rule. FDA's August 2003 Part 11 scope guidance also distinguishes applicable record obligations and risk-based controls.

Sources were checked October 6, 2026. The 2025 Annex 11 consultation remains identified as a consultation with draft documents; its closed deadline is not an effective date for a replacement requirement.

Use four explicit results

Assign a result to every applicable row. Do not use a percentage-complete score as a substitute for disposition of consequential findings.

A failed result stays in the history even after correction. Add the correction and verification outcome; do not rewrite the original finding as though it never occurred. A missing report may initially produce Unknown, while evidence that a required scheduled activity was never performed may establish a separate failure against the approved procedure.

Periodic-review worksheet

For each row, enter the result and actual evidence location. The suggested owners are starting points; name individuals or accountable roles in your review. “See quality system” is too broad to let another reviewer reconstruct the conclusion.

For every Fail or Unknown, create an action row with finding ID; affected workflow/records; immediate protection; required action; owner; due date; closure evidence; closure reviewer; and current disposition. Link it to the worksheet ID so a closed ticket cannot become detached from the criterion it was supposed to satisfy.

These checks are practical implementation choices, not a claim that Annex 11 mandates this exact table. Its sections 7.2 and 17 address recovery-related checks and archived-data accessibility; they support investigating recoverability and usable retained records rather than accepting a backup-job badge alone. See Annex 11.

Resolve the checks that often produce misleading passes

No incidents is a finding only if reporting coverage is credible. Confirm which queue, sites and integrations were searched and whether users know how to report problems. A blank export from one helpdesk cannot establish that no relevant supplier incidents occurred.

Release assessment is different from reading release notes. P3 asks whether the changes were dispositioned for this use. A supplier calling an update minor does not establish that its effects on signing, routing or export are minor for your configuration. If the release notes are incomplete, record the clarification needed.

Recovery and archive retrieval are separate. P10 investigates restoration after loss or disruption. P11 investigates whether retained content and its required context can still be accessed and understood. A current file opened in the live tenant proves neither that a backup restores correctly nor that a five-year-old archived revision remains usable.

Current evidence need not mean repeating every historical test. Explain why supplier or earlier customer evidence remains applicable, then identify gaps introduced by changed use, configuration or dependency. A new full test campaign is not automatically required for every review, but unsupported assumptions cannot become a passing validation status.

Operating-procedure currency does not replace SOP-content review. P13 concerns instructions for using the EDMS. Whether a manufacturing procedure's technical content remains suitable belongs to its document-owner review process. Similarly, this worksheet checks whether required audit-review arrangements and associated incidents remain controlled; it is not a substitute for the transaction review described in our audit-trail guide.

Completed example: three findings change the decision

Fictional Westbridge Pharma reviews its one-site SOP EDMS. The agreed scope includes electronic approval and record retention; external partner access is excluded and disabled. Its current review compares configuration C17 with the previously accepted C16. The following results are illustrative, not tests of a named product.

The P8 result is not a default for SaaS. Change the deployment to one with supplier support accounts and that row becomes applicable. An agreement saying “support only” would not replace the access evidence.

Westbridge cannot describe the system as having an unqualified satisfactory review while the unauthorized account and recovery uncertainty remain undispositioned. It first protects the affected signing path and establishes the consequences of the access gap. It then makes a documented continued-operation decision for the actual remaining scope, considering recovery uncertainty and any effective interim arrangements.

Obtaining the restore report might resolve Unknown to Pass if the evidence supports the criterion. A report for a different configuration without a justified relationship does not. If it demonstrates an unsuccessful recovery, change the result to Fail and act on the demonstrated issue.

Challenge the release reconciliation

Change only the release evidence in the example. REL-17 now lists three deployed releases, but the impact register contains the following entries:

The reconciliation is two documented dispositions for three deployed releases. P3 cannot remain Pass. Record Unknown while the location or existence of R17.3's assessment is unresolved. If the change owner confirms that the required assessment never occurred, record Fail against that requirement and assess the deployed change. A green dashboard does not supply the missing evidence. Preserve the original P3 finding and identify this as a corrected evidence set, rather than quietly replacing the review history.

Decide, schedule and close the review

The decision authority should record one of three conclusions: continued use supported; continued use supported within explicit restrictions/actions; or continued-use assurance not established for the affected scope. State the evidence, remaining risks and operational response. This is a suggested decision vocabulary, not a regulatory scoring scheme.

Do not automatically shut down every function because one row fails, or continue every function because most rows pass. Evaluate the affected records and process, the available protection and whether the proposed restriction actually works. An unresolved risk of incorrect approval deserves a different response from a harmless typo in help text.

Set the next planned review from a documented rationale: importance of the records/process, change rate, incident history, supplier/dependency stability, effectiveness of monitoring and remaining actions. Follow any applicable specific requirement and your approved procedure. A stable archive and a frequently changing multi-site approval platform may justify different intervals; neither receives an automatic exemption from review.

Record event triggers for an earlier assessment, such as a new regulated use, a significant access or workflow change, a recurring integrity problem, an important supplier-service change or loss of recovery confidence. An overdue review needs a recorded impact assessment and revised action, not a backdated signoff.

Close with approved conclusion; covered configuration and period; accepted restrictions; open-action references; next review due date and rationale; earlier-review triggers; and authorized signoff. Action closure belongs to the designated reviewer after evidence verification. Completing the review document does not close its unresolved actions.

Use the results to update the system's current assurance picture. Our computerized-system-validation guide explains how requirements, evidence and change decisions connect. The next useful step is to obtain the missing evidence or correct the specific failure the worksheet exposed.