ISO and GMP Records Management in a Digital Environment

2025-09-24

Executive Summary

• ISO and GMP standards don’t prohibit digital records — in fact, current versions explicitly account for electronic records and set specific requirements around integrity, retrievability, and control.
• Digitalizing ISO/GMP records isn’t just moving from paper to PDF. The most important requirements aren’t about format — they’re about control, retrievability, and maintaining information integrity over time.
• Uncontrolled paper and PDF systems carry real compliance risks — not because paper or PDF is inherently wrong, but because they typically lack mechanisms to enforce records control requirements.
• This article is not compliance guidance — that’s work for qualified advisors. It analyzes from a governance perspective so Quality Directors and CEOs understand which standard requirements are relevant to digitalization decisions.

What ISO and GMP actually require from records

Before discussing digitalization, it’s important to understand what the standards actually require. Because many organizations digitalize records without evaluating whether the new digital system actually meets standard requirements better than the paper system it replaced.

ISO 9001, ISO 22000, and GMP standards all address “documented information” — a term that covers both documents and records. Although specific requirements differ across standards and versions, several principles are consistent:

Clear control and identification. Documents and records must be identifiable: what type of record it is, which process it belongs to, which version is currently in effect, and who has authority to approve changes.

Retrievability and access. Records must be retrievable when needed — by authorized personnel, in a reasonable timeframe. Standards don’t specify “within how many minutes” but in an audit or incident investigation context, “within a few days” typically isn’t sufficient.

Protection of integrity. Records must be protected from uncontrolled modification, loss, and deterioration. This applies to both paper and electronic records.

Retention for defined periods. Records must be retained for specified durations — according to legal requirements, customer requirements, or standard requirements.

Access control. Who can view which records, who can modify them, and who can approve changes — these must be defined and enforced.

These are requirements about information control and management — not requirements about format (paper or digital). The standards don’t say “must use paper” and they don’t say “must use software.” They say records must be controllable, retrievable, and protected.

Note: Specific records requirements vary significantly across ISO 9001, ISO 22000, GMP variants (EU GMP, US FDA cGMP, etc.), FSSC 22000, and other standards. This article describes general principles — not legal interpretation of any specific standard.

Limitations of uncontrolled paper and PDF approaches

Understanding the standard requirements makes it possible to analyze the risks of the most common approach: paper records or PDFs in shared folders without control mechanisms.

Issues with paper records

Paper records are not inherently a technology problem — many organizations maintain paper records that are accepted by auditors. The issues arise when paper records lack control elements:

• No mechanism to prevent overwriting or deleting information after it’s been recorded.
• Low retrievability at high volume — finding a record from two years ago can take days.
• Risk of loss or deterioration over time without backup.
• Difficult to verify integrity — no way to demonstrate a record wasn’t altered after creation.

Issues with PDFs in uncontrolled shared folders

PDFs address some paper issues (easier to back up, easier to transmit) but create new ones without accompanying control systems:

Version control: If a shared folder contains multiple versions of the same document, there’s no automatic mechanism to ensure employees are using the current version. An audit may find that operators are working from an outdated procedure.

Record integrity: PDFs can be modified. Without tight controls, it’s not possible to demonstrate that a record wasn’t changed after the activity was completed. This is a serious compliance risk, particularly in GMP environments.

Chain traceability: If tracing a product batch from finished goods back through raw materials requires records from multiple steps — and those records are in different unconnected folders — reconstructing that chain requires manual searching across multiple sources.

Access control granularity: Shared folder permissions are typically managed at the folder level — not granular enough to meet the access control requirements of many standards.

What eQMS and digital document control provide

Document and quality management systems designed for compliance — a DMS with proper document control or an eQMS — address these limitations in a structured way.

Verifiable document control. The system records: which document is currently in effect, who created it, who approved it, when it took effect, and which version it superseded. Users can only access the current version — previous versions are retained but clearly identified as superseded.

Automatic audit trail. Every action in the system is recorded with a timestamp and the user — who viewed, who modified, who approved, and when. This creates an audit trail that cannot be deleted without leaving a trace.

Verifiable electronic signatures. In GMP environments particularly (such as FDA 21 CFR Part 11), electronic signature requirements are specifically defined. Compliant systems ensure an electronic signature is bound to a specific user at a specific time and is non-repudiable.

Structured retrievability. Rather than manually searching folders, the system can be queried: “all inspection records for batch X from supplier Y during period Z” — and return complete results in seconds.

Granular access control. Control over who can view, create, modify, and approve — at the level of individual document or record types, not only at the folder level.

Specific requirements when digitalizing ISO/GMP records

When an organization decides to digitalize records, several specific requirements need to be addressed in the system design and implementation.

System validation (for GMP). In GMP environments — particularly pharmaceutical and regulated food — computer systems used to manage GMP records may need to be validated according to CSV (Computer System Validation) or CSA (Computer Software Assurance) requirements. This is particularly relevant for FDA 21 CFR Part 11 and EU GMP Annex 11.

Note: Specific validation requirements depend on the applicable standard, system type, and degree of influence on product quality. Qualified compliance advisors should be consulted before designing the system.

Historical records migration. When transitioning from paper to digital, historical records need to be addressed: retain in paper form with a controlled storage system, digitize with integrity assurance, or a hybrid approach acceptable to the certification body. There is no universally correct answer — specific assessment is needed.

Backup and disaster recovery. Digital records require frequent backup and a clear recovery plan. Losing digital records due to a technical failure without adequate backup is a more serious risk than losing paper records — because the volume of information lost can be much larger and may be impossible to reconstruct.

Continuity when systems are unavailable. If the digital system is unavailable (maintenance, incident), the organization needs a documented backup process to continue capturing records and ensure no gaps. This backup process needs to be documented and periodically tested.

Digitalizing ISO/GMP records — not an IT project, a quality management project

An important point: digitalizing ISO/GMP records should not be treated as a pure IT project — it is part of the quality management system and needs to be managed accordingly.

That means:

• The Quality Director, not the IT Manager, is the primary responsible party for requirements and decisions.
• End users (QA staff, operations, management) need to be involved in design — not only trained after the system is deployed.
• Validation and qualification of the system (for GMP) is part of the project, not an optional addition.
• Change management — how the organization transitions from old processes to new ones — may be a larger challenge than the technical implementation.

Where is your organization in the records digitalization journey?

→ Take the Digitalization Level Assessment to understand your current state and identify priorities.

Further reading:

• From DMS to eQMS to Knowledge OS: Your Digitalization Roadmap (previous)
• Digital Transformation for Manufacturing SMEs — What It Actually Means (pillar)
• AI and Compliance: What ISO/GMP Organizations Need to Consider (cross-cluster)

This article provides analysis from a governance perspective on ISO and GMP standard requirements related to records management — it is not compliance guidance or legal advice. Specific requirements vary significantly across standards (ISO 9001, ISO 22000, EU GMP, US FDA cGMP, FSSC 22000, and others), versions, industries, and certification bodies. Organizations should consult compliance advisors with expertise in their specific applicable standard when making decisions about records management systems.