Work Instruction: Producing Certified Copies of Paper GxP Records

This is a ready-to-use work instruction for one task: turning a paper GxP record into a certified copy that can be relied on as a record. It sits under the parent SOP <<FILL: parent SOP number>> and gives the step-by-step actions with the acceptance for each step. Replace every <<FILL: ...>> placeholder. A filled specimen certification block follows. This is general guidance to adapt and verify against your own processes and regulatory context, not legal or regulatory advice.

The limitation that governs everything below. Scanning produces a faithful copy of a static paper original. It does not rescue dynamic electronic data. If the paper you are scanning is a printout of dynamic electronic data, such as a chromatogram, a spectrum, a thermal profile, or a database query output, the image you produce is a copy of the printout, not a copy of the dynamic record. The underlying electronic data and its audit trail remain the original and must still be retained. Nothing in this work instruction permits deleting them. This is the single most common misunderstanding on the topic, and it has produced real findings where firms deleted electronic raw data on the belief that the archive now held the record. It did not. See static and dynamic records and true copies and hybrid paper-and-electronic records.

Header

Definitions

• True copy: a copy that preserves the full content and meaning of the original record, including all its data and, where applicable, its metadata.
• Certified copy: a true copy that has been verified as complete and accurate by a named person, or produced by a validated process that performs the verification, and that carries a record of that verification. A copy nobody verified is not a certified copy regardless of what the file is labelled.
• Static record: a fixed value or image with no reprocessable content, such as a handwritten batch record page or a signed worksheet.
• Dynamic record: data that can be reprocessed, re-integrated, re-queried, or re-plotted. A printout of a dynamic record is a static summary of it, not a copy of it.
• Insert: anything attached to or placed within the source record that is not part of the numbered page sequence: taped-in printouts, sticky notes, appended data slips, fold-out sheets.

When to use, and when not to

Use this work instruction to produce a certified copy for archival, for transfer to another party, for a regulatory request, or as a step preceding a controlled decision about the paper original. Use it also when a record is at risk of degradation, such as thermal output, which should be copied on the day it is produced rather than at archive time.

Do not use it to copy a printout of dynamic electronic data as a substitute for retaining that data. Do not use it on records currently in execution; a record still being written to is copied only under the exception route in the parent SOP. Do not begin if the source record is incomplete, unsigned, or under an open correction, unless the parent SOP defines that state as copyable and the reason is recorded.

Prerequisites

Task A: prepare the record

Task B: set the scanner

Task C: scan

Task D: reconcile the page count

This is the step that catches the failure nothing else catches. A double-feed produces a clean-looking file that is silently missing a page, and no amount of reviewing the file for quality will reveal it.

Task E: verify the content

Verification level is set by the criticality of the record, and the level is decided in the parent SOP rather than per job. State the level applied on the certification block.

Task F: certify

Certification block

Task G: index

A certified copy nobody can find fails on availability just as thoroughly as one that was never made.

Task H: store, protect, and back up

Task J: hold checks before any paper original is destroyed

Destruction is a separate, later, deliberately controlled decision, made under the parent SOP and the retention procedure. It is never a step in scanning. Every condition below is confirmed and recorded before a destruction request proceeds. Any single failed condition stops the request.

The hold check in J8 is the one that most often fails in practice, because it lives in a different procedure from the destruction schedule and nobody consults it. Build it into the destruction request form so it cannot be skipped.

References

21 CFR 211.180 (general records requirements) and 211.194 (laboratory records). 21 CFR Part 11 (electronic records and electronic signatures), where the copy becomes an electronic record relied on to satisfy a predicate rule. EU GMP Chapter 4 (Documentation) and EU GMP Annex 11 (Computerised Systems). FDA guidance, Data Integrity and Compliance With Drug CGMP, Questions and Answers (December 2018), which addresses true copies and the difference between static and dynamic records. MHRA GXP Data Integrity Guidance and Definitions (March 2018), which defines true copy and certified copy. PIC/S PI 041, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. ICH E6 Good Clinical Practice, for certified copy expectations applied to clinical source documents.

Confirm the current version and clause numbers of each reference before issue.

Filled specimen

The following certification block is completed for an example executed batch record. Company, names, numbers, and dates are illustrative; replace them with your own.

Two things in this specimen carry the weight. The first is that the count reconciliation failed on the first attempt and the record says so. A double-feed at sheets 31 and 32 produced a file that looked perfect, and only the arithmetic caught it; a certification that never records a discrepancy across hundreds of batch records is more likely to indicate that nobody counted than that nothing ever went wrong. The second is the last row. It says “retained”, not “destroyed”. Producing a certified copy and deciding to destroy an original are two different decisions taken at two different times under two different approvals, and the hold checks in Task J stand between them.

Common inspection findings this work instruction prevents

• Paper originals destroyed after scanning with no verification step, so the files described as certified copies were never certified.
• Double-sided originals scanned single-sided, losing corrections and second-person initials recorded on the reverse.
• A page silently missing from a scanned batch record because a double-feed was never caught by a page-count reconciliation.
• Inserts, taped-in printouts, and appended slips absent from the copy because they were removed during preparation and never logged.
• Red-ink corrections and colour-coded status stamps scanned in greyscale or bitonal mode, so the meaning carried by colour is lost.
• Pencil or faded thermal entries scanned blank because a bitonal threshold was applied by default.
• Printouts of dynamic electronic data scanned and the underlying electronic data deleted, on the reasoning that the archive now holds the record.
• Certified copies stored on media with no tested restore, or indexed so poorly they cannot be produced during an inspection within a reasonable time.
• Destruction proceeding on schedule while the batch was under investigation, because the hold check lived in a different procedure that nobody consulted.
• Verification performed by the same person who scanned the record, so the independent check never existed.

How to adapt this work instruction

1. Set the work instruction number and point the parent SOP field at your real records and archiving procedure.
2. Set the resolution, colour, and format values in Task B from your scanner qualification, not from this document. Then check that the qualification actually tested the settings you are specifying, including the low-contrast and colour cases.
3. Define the record criticality tiers in Task E and map your record types to them centrally, in the parent SOP, so the verification level is never a per-job judgement.
4. Where a source record type does not state its own page total, either introduce “page N of M” numbering on the form or accept that the verification level rises to 100 percent for that record type. Record which choice you made and why.
5. Build the Task J hold checks into your destruction request form as mandatory fields, so a request cannot be submitted without them. The J8 hold check is performed at the time of the destruction request, not carried forward from the scanning date.
6. For clinical records, add the certified copy expectations from your sponsor procedures and the trial master file filing conventions, and account for copies produced at investigator sites rather than centrally.
7. For records at risk of degradation, such as thermal output, add a trigger to your execution procedures so the copy is made on the day the record is produced rather than at archive time.
8. Confirm every regulation in the references section against the current published version before issue.