Regulatory texts are public and shared across the sector. What sets a company apart is its own rules: an SOP for approving promotional material, an editorial charter, a house glossary, an approved claims matrix, the memory of past decisions. These internal frameworks almost always exist. They are rarely usable as they stand in a document review, whether a colleague carries it out or a tool assists it. Here is how to prepare them so that they produce findings you can act on.

Requirement or reference: the distinction that governs everything else

A requirement is a rule that can be checked against a document. Applied to a passage, it returns a verdict: met, or a gap. A reference is content used to support a statement: a scientific publication, an SmPC, a clinical study report, an instruction leaflet. It passes no judgement.

Take an example. Your SOP says that any efficacy data quoted in material aimed at healthcare professionals must point to a referenced publication. That is a requirement. The publication itself is a reference. Both feed the review, but not in the same place and not in the same way.

A glossary is usually a mixture. The explanatory lexicon is a reference. The instruction never to write "reference treatment" but "first-line treatment" is a requirement. Sort the two before you submit anything: this is the step with the highest return. Our page on internal requirements you can submit sets out the expected formats.

What makes an SOP usable in a document review

  • One rule per statement. A paragraph that says three things produces a vague finding. Split it.
  • An imperative style. European good manufacturing practice asks that procedures be written in an imperative, mandatory style (EudraLex volume 4, chapter 4, point 4.4). The advice holds well beyond medicinal products: write "the material states", not "it would be preferable that".
  • An observable criterion. "The mandatory particulars are present and legible" can be checked. "The presentation must remain balanced" cannot.
  • An explicit scope. Document type, country, intended audience (healthcare professionals or the general public), device class, distribution channel. A requirement with no scope applies everywhere, and therefore badly.
  • No chained cross-references. "See SOP 12, point 4" says nothing if SOP 12 has not been submitted. Copy the rule across, or submit the target.

Numbering, versions and dates: the minimum traceability

Chapter 4 of EudraLex volume 4 sets out principles that transfer well outside the medicinal product field. Instruction documents are approved, signed and dated by authorised persons; their content is unambiguous; they are uniquely identifiable; their effective date is defined (point 4.3). They are reviewed regularly and kept up to date (point 4.5).

ISO 13485:2016 asks for the same discipline for medical devices, in clause 4.2.4: approval before issue, review and re-approval of changes, identification of the current revision status, availability of applicable versions at points of use, and control of obsolete documents.

In practice, one thing is almost always missing: a stable identifier at requirement level, not only at document level. A finding that cites "SOP-COM-04, requirement 3.2" can still be traced after a revision. A finding that cites "page 7" does not survive the first reflow.

Formats: what works, what blocks

An internal framework is submitted as text. A text-based PDF works. A scanned PDF, a screenshot, a training slide deck and a tracking spreadsheet do not: the information is there, but it cannot be stated as a rule.

Three common cases need rewriting before submission:

  • Approval grids, where the rule is split between a column heading and a ticked box.
  • Committee minutes, where the decision is buried inside a discussion.
  • Training material, which explains the rule without ever stating it.

One caution: licensed standards and paid frameworks. You cannot always circulate their text, even to a wider internal audience. Check your rights before any submission and, where needed, submit your own application procedure rather than the standard itself. Hosting and confidentiality are covered on our document security and hosting page.

Past decisions are worth more than a new rule

A regulatory team accumulates decisions: a claim rejected in committee, a notified body comment on a technical file, an ANSM request to amend an advertisement, a wording accepted in one country and refused in another. That memory is the most valuable framework you own, and the least formalised.

A past decision becomes usable once you rewrite it into five fields: the general rule retained, its scope, its date, the reason, and the original trace (committee number, letter, audit report). Without that work, the same discussion returns with every campaign, and a new joiner reopens it in good faith.

Governance: who writes, who approves, who withdraws

The framework already exists in your obligations. Regulation (EU) 2017/745 requires manufacturers to hold a documented quality management system, whose components are listed in Article 10(9), starting with the strategy for regulatory compliance; Regulation (EU) 2017/746 does the same for in vitro diagnostic devices. For clinical trials, the ICH E6(R3) guideline requires the sponsor to hold written, controlled procedures.

Applied to your review frameworks, this comes down to four decisions:

  • A named owner per framework, a person rather than a department.
  • A review frequency, written into the document itself.
  • A withdrawal route: a deleted requirement must disappear from the submitted set, otherwise the review keeps applying it.
  • A change log, dated, readable by an auditor.

In practice

Start small. Pick one document type you review often, pull from your SOPs and charters the twenty to thirty requirements that come up most, write them in the imperative, date them, give each a stable identifier. Test that set on three documents already approved: the false gaps will tell you which rules are badly worded, and that is exactly the information you are looking for.

This is the principle we apply in EryonOne: the internal requirements you submit sit alongside the regulatory frameworks we cover, and every finding quotes the exact passage of the document and the text applied. The report stays working material. The decision remains yours.

Bibliographie