Obsolete Document Control: Withdraw Old Versions Across Sites

Obsolete document control means preventing an old instruction from being used where it is no longer authorized, while preserving the versions and records needed to reconstruct earlier work. Changing a status in the central document system is only one part of that job. Local files, printed copies, partner portals and offline devices may still expose the old instruction.

This procedure is for pharmaceutical document-control and quality teams coordinating a defined withdrawal across sites. It covers electronic and paper locations without assuming a particular EDMS. The regulatory references distinguish US drug records, API guidance and EU human-medicinal GMP; the register and closure rules are suggested operating methods to adapt to your approved process.

The intended result is a reconciled withdrawal record: each affected location has a verified disposition or an explicitly unresolved exception, and required historical evidence remains retrievable. This is a documentary procedure, not a claim that a particular software configuration has been tested.

Establish the withdrawal scope before removing anything

Obsolete is an operational status, not automatic permission to destroy a file. Determine what the item is and what action is authorized.

FDA's Q7 guidance for active pharmaceutical ingredients specifically addresses controlled issuance, revision, superseding and withdrawal through revision histories, alongside document-retention procedures. That guidance has API scope; it does not prescribe a universal colored stamp or a destruction deadline for every pharmaceutical document. FDA Q7, September 2016 revision 1, sections 6.10–6.16

For EU human-medicinal GMP, Chapter 4 addresses identifiable authorized instructions, defined effective dates, current documentation and secure record retention. Its controls support distinguishing current use from historical evidence. The specific withdrawal workflow below is an implementation approach. EU GMP Chapter 4, January 2011, sections 4.3–4.5 and 4.10–4.12

1. Confirm the authority, replacement and affected population

Start with an approved change or retirement decision. Record the document identifier, revision to be withdrawn, reason, affected activity and site scope, and the authorized transition date or event. Name the document owner, withdrawal coordinator, site custodians and quality decision-maker for exceptions.

For replacement, identify the approved revision that will become effective and its prerequisites. Confirm related forms, work instructions, translations and external references. Do not infer that the highest numbered revision is ready for use. It may be approved for a future date or unavailable to a site whose preparation is incomplete.

If the request says only “withdraw the old method,” stop to resolve the document, revision and scope. The same title may identify different methods or local adaptations. If no replacement is intended, define what users should do when they encounter the retired activity; a broken link alone does not communicate that decision.

2. Find the places where people actually obtain the instruction

Use the controlled distribution record as the starting inventory, then check the real workflow. Ask site custodians to identify operational routes such as:

• EDMS search, favorites, direct links and embedded document viewers.
• Controlled shared folders, local workstations and approved offline devices.
• Print stations, equipment binders, laboratory benches and production rooms.
• Learning materials that reproduce operational instructions.
• Contract-site portals, exchanged packages and locally maintained translations.

Classify each location as active use, retained reference or historical record storage. Do not treat every backup, historical package or completed record as an active document copy. Those may need retention protection rather than operational withdrawal.

Record discovered locations even when they were missing from the original distribution list. If uncontrolled local copies are found, assess how they were created and whether they were used. Deleting the discovered file without preserving necessary investigation evidence can conceal the problem instead of resolving it.

3. Open a withdrawal register with evidence fields

Use one row per location or separately accountable copy group. A single “all sites notified” row cannot show whether a remote site completed the action.

Define the results before using them. Pass means the required disposition was verified. Fail means evidence demonstrates the old instruction remains available for unauthorized current use or another criterion is unmet. Unknown means the location or disposition has not been established. Not applicable requires evidence that the row falls outside the authorized withdrawal scope; it must not hide a missing response.

Do not label a missing copy “destroyed” or a silent partner “complete.” An exception may have an approved containment or risk decision, but the register should still distinguish the fact of physical recovery from management's decision about the unresolved item.

4. Execute the transition and verify the user access path

For electronic locations, apply the approved status, access and distribution changes. Then check the route a normal authorized user actually follows. A new search result is insufficient if an old bookmark still opens an apparently current instruction. If historical access is allowed, verify that its status and purpose are clear and that it cannot be mistaken for the effective version in that workflow.

For physical locations, reconcile the issued copies and inspect the location after withdrawal or replacement. Delivery of a new binder does not prove removal of the old one. Retain evidence suitable for the risk and your procedure, such as a controlled return entry, verified location check or accountable custodian confirmation with specific copy details.

For offline devices, an online repository change may not affect cached content. Confirm the applicable synchronization or withdrawal mechanism. If the device cannot reconnect before transition, decide whether the affected activity must pause or use an explicitly authorized alternative. Do not report success from the server status alone.

For contract sites, specify which party performs the action and what evidence it returns. A notification receipt proves receipt; it does not necessarily prove withdrawal. Use the agreed document-exchange process and escalate missing completion evidence through the responsible quality relationship.

5. Protect completed records and authorized history

Classify forms before disposition. An unused blank may be withdrawn from future issue, while a completed or partly completed form contains evidence of work. FDA's December 2018 data-integrity guidance discusses control and reconciliation of blank forms and retaining incomplete or erroneous forms with justification for replacement. A template revision is not a reason to discard the data recorded on its predecessor. FDA data-integrity guidance, question 6

Determine the applicable retention period and trigger by record class and jurisdiction. For example, 21 CFR 211.180 distinguishes specified batch-related records and other covered records and requires availability during retention. It does not establish one blanket “keep obsolete SOPs for X years” rule. 21 CFR 211.180

Before any authorized destruction, verify that retention requirements and applicable holds have been addressed by the responsible owner. Preserve links between historical revisions, completed records and the period or work for which they applied. A historical retrieval request should not require making the old revision operational again. The electronic records guide covers the broader evidence-retention context.

6. Reconcile locations and handle exceptions

Compare expected locations with verified outcomes, including any newly discovered copies. Report unresolved items explicitly and assign actions. Do not declare global withdrawal complete because most locations passed.

If an old instruction may have been used after its authorized transition, preserve the relevant evidence and refer the event for quality assessment under the applicable deviation or investigation procedure. Establish the time window, affected work and actual content difference. Do not presume either “no impact” or batch failure from the obsolete label alone.

A recovery decision may allow activity at unaffected sites while another site remains restricted. That requires a supported scope boundary and practical controls. If the same unsegregated instruction or process serves both, partial clearance may not be workable.

Worked withdrawal: two sites and an offline device

Fictional Meridian withdraws SOP-610 revision 3 from routine use at Sites A and B when revision 4 becomes effective. The approved transition includes its associated unused form F-610 revision 2. Previously completed F-610 records remain retained. Both sites' preparation prerequisites are complete; the unresolved issue is withdrawal evidence.

The initial result is withdrawal incomplete. Two passes do not offset one failure and one unknown. Notify Site B's accountable owner and quality reviewer, preserve evidence of the exposed workstation copy, and implement the defined containment.

After the workstation is corrected and its access path rechecked, that row can pass with new evidence. T-8 remains unknown until an authorized person verifies the device disposition. If T-8 is found and the old cache is removed under the approved process, retain the device-specific verification and reassess the restriction. If it cannot be found, escalate a missing-device/copy exception; do not rewrite Unknown as recovered.

Suppose the T-8 inspection also finds a partly completed F-610 form. Separate that recorded work from the unused cached template before disposition. Preserve the entered data and route the incomplete record through the applicable quality process; withdrawing the blank template does not authorize erasing it. Add the newly discovered item to the register with its own classification, owner and evidence. The final register may contain more rows than the initial inventory because discovery improved the scope; do not omit the extra row merely to make the original count reconcile.

Change one condition: revision 3 is still explicitly authorized for a distinct Site C activity. Site C is outside this withdrawal scope until its approved transition. Keep that authorization visible instead of globally labeling all revision-3 use improper. If the scope cannot be established, obtain the decision before changing access.

Close with evidence that the transition worked

The closeout record should identify the authorized scope, final register, unresolved exceptions and their dispositions, retained historical locations and approval of the outcome. Verify that the replacement is available wherever current work may continue and that historical retrieval still works.

Use a follow-up check proportionate to the risk to look for reappearance through copied files, restored devices or reused training materials. Its timing should follow the process and risk, rather than an invented universal inspection interval.

For broader workflow design, the QMS document-control guide connects approval, effectivity, distribution and retention. For the withdrawal itself, the most useful next action is to choose one real revision and reconcile every current-use location against the register above.