Quality Agreement Document Control

Quality agreement document control means being able to establish which terms the parties accepted, when those terms apply, and which activities and sites they cover. A signed PDF alone does not answer all three questions. Keep the agreement, its incorporated attachments, acceptance evidence and operational status connected through one controlled record.

This procedure helps a quality or supplier-management team control an agreement from proposed revision through activation, replacement and archive. It includes a copyable control record and a fictional counterpart-version mismatch. It is a documentary workflow to adapt to your quality system and contract terms, not a tested software tutorial or a complete legal agreement template.

The regulatory examples concern U.S. commercial drug manufacturing and outsourced activities within applicable EU human medicinal-product GMP. Determine the specific framework before applying the procedure to an investigational program, clinical CRO, device supplier or other arrangement.

1. Confirm the scope and collect the controlling documents

Start with the current agreement, all incorporated schedules, the proposed amendment or revision, each party's acceptance requirements, and the change that triggered the update. Obtain access to the retained signed records and the relevant change-control system. Name an agreement owner on each side and a person responsible for maintaining the control record.

FDA's November 2016 quality-agreements guidance concerns commercial drug manufacturing. It expressly excludes investigational and development manufacturing from that definition, while recognizing the potential usefulness of its principles before commercialization. The document is guidance, not a universal mandatory agreement template. See FDA's final guidance, introduction.

For the EU example, the current Volume 4 listing links Chapter 7, revision 1, operational January 31, 2013. Its principle concerns outsourced activities covered by the GMP Guide and calls for a written contract establishing the parties' duties. It is not a rule about every outsourced business service. See the Commission's current Volume 4 listing and Chapter 7.

Record the product or product family, facilities, activities and territories actually covered. A company-wide supplier name is not enough if only one site and one testing service are included. If the applicability or contracting entities cannot be established, keep the proposed revision unresolved and refer the question to quality, regulatory and legal owners before activation.

2. Create one agreement-control record

Use the following fields in an EDMS, an appropriate contract system or another controlled register. These are proposed operational fields; neither cited authority mandates this exact form. The register points to the authoritative artifacts rather than becoming a second, manually rewritten agreement.

Add an exception ID, resolver and due date whenever a required fact is Unknown. Keep Unknown separate from No and from Not applicable. A record without a second party's returned evidence is not automatically rejected forever, but it cannot be treated as fully accepted solely because your own approval is complete.

The signed package may legitimately comprise several counterparts. Record how those counterparts establish acceptance of the same terms. Do not require byte-identical signed PDFs: signatures, certificates or scans can change the files without changing the agreed text. Conversely, matching filenames do not establish equivalent contents.

3. Separate the amendment from the operational change

Write two short impact statements: what changes in the agreement and what changes in the work. For example, revising an escalation contact differs from changing the laboratory that performs a release test. Each needs the applicable review, but they should not be processed as if they have identical consequences.

FDA's guidance addresses the agreement's lifecycle and revisions, and separately discusses allocation of manufacturing change-control activities. Its framework does not mean every change has one universal approval path. Use the agreed classifications and applicable regulatory assessment. See sections IV.B and IV.B.2.

For outsourced work under EU Chapter 7, paragraph 7.11 addresses prior evaluation and approval before further subcontracting, while 7.12 addresses unauthorized changes outside the contract that could adversely affect quality. A changed subcontractor therefore deserves more than replacing a name in a contact list. See Chapter 7, paragraphs 7.11–7.12.

Your record should identify the person deciding whether additional qualification, technical assessment, training, regulatory action or other work is needed. These are scope-dependent decisions, not automatic tasks imposed on every revision. Link to the relevant approved records; avoid copying their conclusions into several disconnected places. Our pharmaceutical change-control guide provides broader process context.

4. Reconcile the package before collecting final acceptance

Create a release candidate containing the agreed text and identified attachments. Compare it with the last accepted version and resolve open comments. Have the designated reviewers confirm which changes are included. Retain the comparison or other evidence required by your procedure.

Then send the release candidate through the agreed acceptance method. The counterpart's internal document number may differ from yours. Record the cross-reference rather than renaming its artifact in a way that obscures provenance. If the counterparty returns a modified file, treat it as a changed candidate until the responsible reviewers establish its impact and acceptance status.

Use a substantive comparison: clauses, tables, product/site schedules and referenced attachments. A checksum can help identify a particular file, but it does not prove signer authority or legal acceptance. OCR may help with a scan, but a comparison that missed an unreadable attachment is incomplete. Route uncertain differences for review instead of automatically declaring the packages equal.

Stop if the returned evidence belongs to a different revision, a signer or approval is missing under the agreed process, or an incorporated schedule cannot be identified. Preserve the received artifacts and correspondence while the exception is resolved.

5. Record acceptance dates and the effective rule separately

Use three concepts distinctly in the register:

• Actual signature/approval dates: when each recorded action occurred.
• Execution or acceptance completion: the point established by the agreed method and terms; legal owners resolve disputed interpretations.
• Effective date or event: when the agreement or amendment says the relevant provisions apply, including stated conditions.

These are operational distinctions, not universal legal definitions. A document-management system should preserve the facts and the approved interpretation instead of inventing one from the upload timestamp. If an agreement uses a retroactive effective date, keep the actual execution evidence unchanged and obtain the appropriate assessment of its meaning and consequences. Do not rewrite signature dates to make the history appear consistent.

EU GMP Chapter 4 distinguishes document identification, approval/signature/date controls and a defined effective date for instructional documents. It also addresses controlled relationships between masters, copies and hybrid records. Those principles support keeping the fields separate; they do not settle a disputed contract's legal effect. See Chapter 4, paragraphs 4.1–4.3.

Release the agreement for the relevant operational use only after the effective rule and required readiness actions are satisfied. If training or a system change is a prerequisite under your approved plan, a fully signed agreement can remain accepted/not effective or another accurately defined pending state. Do not mark it Effective merely to clear an overdue workflow task.

6. Work through a counterpart-version mismatch

The following fictional example uses an existing commercial manufacturing relationship between Aster Pharma and Brook Laboratories. Their current agreement is QA-042 revision 3, covering the defined laboratory work at Brook site BL-01 only. Change CC-108 proposes revised laboratory notification arrangements and an updated contact schedule; it does not expand the site or activity scope.

For this example, the reconciled package remains revision 4 under the parties' agreed revision convention. Another procedure might require a new revision number. The control objective is an unambiguous identity and complete history, not preserving a particular numbering convention.

Complete the register as follows: agreement QA-042; proposed revision 4; change CC-108; exception EX-09; resolver Brook quality contact; counterpart cross-reference BL-QA-17; package revision 4 plus schedule A revision 2; acceptance complete September 9; effective September 15; readiness evidence CC-108 task closure; distribution record DIST-042-4; archive owner Aster records manager; retention schedule RET-QA. All identifiers and dates are illustrative.

Before closing CC-108, have a second reviewer answer this date-and-scope check. For this fictional procedure, operational activation requires the reconciled acceptance, the agreed date and completed readiness tasks:

This table tests the stated operational rule. It does not declare that a contract's legal effective date changes whenever a task is overdue. If those facts diverge, retain both the contractual date and the operational restriction, and obtain the authorized interpretation rather than overwriting either field.

Between September 4 and resolution, determine what agreement and controls legitimately govern ongoing work. Revision 3 may remain applicable if its terms and scope support that conclusion. Do not assume either that the relationship must stop automatically or that all activity may continue unchanged. The quality and agreement owners assess affected work and document any necessary restriction, escalation or corrective action.

If work already followed the disputed clause, retain that fact and assess the consequences through the appropriate quality process. Re-signing the corrected document does not erase the earlier execution problem.

Unknown is a separate branch

Suppose Brook's returned scan omits the attachment pages. You cannot establish whether it accepted schedule revision 1 or 2. Record Unknown package completeness, request the missing evidence, and block activation of the proposed package. Do not count the visible signature as acceptance of whichever attachment happens to be in your repository.

Once evidence arrives, repeat reconciliation. If it matches, proceed through acceptance and effectiveness checks. If it differs, use the mismatch branch above. This keeps a recoverable evidence gap distinct from a confirmed disagreement.

7. Publish operational access without transferring regulatory responsibility

Make the applicable agreement accessible to the people who need its provisions, including the agreed operational contacts. Where a local procedure implements an obligation, link the relevant clause and revision so a later amendment can trigger an impact review. Avoid distributing an uncontrolled summary that quietly becomes the only instruction people use.

A duty matrix can state who performs a test, sends a notification or supplies a record. It cannot remove a party's statutory or regulatory CGMP responsibilities. FDA makes that boundary explicit in its quality-agreements guidance. For finished pharmaceuticals within scope, 21 CFR 211.22 separately establishes the quality control unit's responsibilities, including approval or rejection of products manufactured under contract. See FDA guidance, section IV and 21 CFR 211.22.

For the EU context, Chapter 7 retains the contract giver's responsibility for processes controlling outsourced work and addresses availability of the relevant records. A convenient external portal does not by itself resolve those obligations. See Chapter 7, paragraphs 7.4 and 7.16.

8. Verify retrieval, review and retirement

Ask someone other than the uploader to answer four questions from the register: which package applies to the named site and activity today, what applied on an earlier date, what remains unresolved, and where the acceptance evidence is retained. Repeat the retrieval using the intended reader's permissions, not an administrator account. Record any failed link or unclear status as an exception.

Set review triggers and a review interval under your approved procedure. EU Chapter 4 calls for regular review and keeping quality-system documents current; it does not prescribe one annual interval for every agreement. Changes in scope, parties, sites or relevant obligations may require review before the next scheduled date. See Chapter 4, paragraph 4.5.

When an agreement is superseded or terminated, preserve the relationship to its successor, the dates and the record of any obligations continuing afterward. Apply the appropriate retention schedule and legal holds; do not delete the record simply because the supplier account closes. Confirm how retained agreement evidence and required related records remain accessible if a portal or service contract ends.

For a software evaluation, bring QA-042's mismatch and missing-attachment cases to a document-workflow discussion. Ask the proposed system to preserve the evidence and distinguish acceptance, effectiveness and exceptions. A completed workflow is useful only if the team can still establish the correct agreement for the actual work.