Skip to content

SOP management software under Part 11: six systems read against the SOP lifecycle

Published , reviewed

Verdict

Best for the full SOP cycle
Veeva QualityDocsIts own description covers the whole SOP lifecycle in one application: document lifecycles, periodic review reminders, controlled copies and read-and-understood sign-off. Eight of the nine rows below are verified on Veeva's Vault help pages, the most in this lineup.
Best for read-and-understood training
QualioDocuments and training sit in the same system, so a read-and-understood record lives beside the SOP version it points at. Its validation pack and an audit trail kept for the system's lifetime are verified on Qualio's own pages (six of nine rows).
Best when a revision is a change
MasterControl Quality ExcellenceOne suite covers document control, change control and training, the three processes an SOP revision runs through. At approval, its own pages describe the signature's name, date and time, and meaning, and a separate approval password apart from the login.
Chromolithograph of an open binder of gridded pages in a lectern standFig. 01
A binder of procedures on a stand: each page in it was drafted, signed, trained on and will one day be retired.

SOP management is the part of document control that carries a procedure from draft to the day people work to it, and on to its retirement. The signature is the easy half. The hard half comes after approval: an effective date, training signed against the right version, a periodic review that leaves a record even when nothing changes, and a historical file an inspector can open on any past date.

We read what six vendors publish about the Part 11 rows that matter for SOPs, on their own pages. Need the document itself first? The SOP template builds a controlled SOP with a Part 11 approval block. For specifications, forms and drawings as well as SOPs, read the document control software compare.

The SOP lifecycle, state by state

Every SOP passes the same seven states. Each one leaves a record, each record has a rule behind it, and most map to one row of the vendor table. Pick a state to see which row to read and how each vendor stands on it.

The SOP lifecycle, one state at a time

What happens
An author writes the new SOP, or a revision of the current one, under a draft version number.
The record
The draft, its author and every edit before review.
Ask the vendor
Does the draft carry its own version, and does the audit trail record who changed what before review?
What the rule says
Drug CGMP procedures and their changes are “drafted, reviewed, and approved by the appropriate organizational units” § 211.100(a). FDA's 2003 guidance says validation “would not be important for a word processor used only to generate SOPs”: the weight sits on the system that approves and issues them.

Scroll sideways for all rows

Draft: the requirement rows to read, by vendor
VendorSecure, computer-generated, time-stamped audit trail§ 11.10(e)
Montrium QMS Document Controlstated
ZenQMSstated
SimplerQMSverified
Qualioverified
Veeva QualityDocsverified
MasterControl Quality Excellenceverified

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Common misreading

“FDA requires SOPs to be reviewed every two years” is not in the rule. § 211.100 and § 58.81 set no interval. EU GMP asks for documents to be “regularly reviewed” Ch. 4 § 4.5. The interval is the one your own document control SOP names, and missing your own date is the finding.

Takeaway

Write the lifecycle down before you look at software: who drafts, who reviews, who approves, how long training has between approval and effective date, and the review cycle. The SOP template carries those fields in its header and approval block, so the procedure you configure the system from is already controlled.

Open the SOP template

The record that follows every SOP

An approved SOP that nobody has read is a procedure on paper only. Drug CGMP requires training in the “written procedures required by these regulations” as they relate to each person's job § 211.25(a), and the evidence of it is a read-and-understood record per person, per version.

Example read-and-understood record (illustrative values)

Trainee
QC analyst, balance room
SOP
SOP-QC-014 Analytical balance calibration
Version
v4.0 (replaces v3.2)
Effective
2026-11-02
Meaning
Read and understood
Signed
2026-10-29 09:42 UTC
Signed before the effective date, against the version number, never against the SOP title alone.

Three details decide whether that record holds up. It points at a version number, so a revision creates new training rather than inheriting the old sign-off. It is dated before the effective date, so nobody works to a procedure they have not signed for. And its signature carries a meaning of its own: § 11.50(a) gives review, approval, responsibility and authorship as examples (“such as”), so “Read and understood” fits.

Inspection risk

An operator signs a batch or test record on a day when the SOP it cites had moved to a new version and their training on it was still open. The training system and the SOP system disagree, and the record shows it.

Takeaway

If your SOP system does not run training, the training system has to read SOP versions from it. Compare training systems on that link in the Part 11 LMS and training records compare. Until the link is in place, record each sign-off with the training record template.

Requirement by requirement

Nine rows in SOP order: the approval signature and its link to the version first, then who may sign, the trail, the historical file, inspection copies, validation documents and Annex 11. The open-system row is left out: whether § 11.30 applies turns on who controls access to the system, not on the SOP workflow. It is on the eQMS compare.

Scroll sideways for all vendors

Part 11 requirements for SOP management, by vendor
RequirementMontrium QMS Document ControlZenQMSSimplerQMSQualioVeeva QualityDocsMasterControl Quality Excellence
Signature shows name, date and time, and meaning§ 11.50statedstatedverifiedstatedverifiedverified
Signature linked to its record so it cannot be moved§ 11.70statedstatedstatedstatedverifiedstated
Two distinct components to sign§ 11.200(a)statedstatedstatedverifiedverifiedverified
Access and authority checks by role§ 11.10(d), (g)statedstatedstatedverifiedverifiedverified
Secure, computer-generated, time-stamped audit trail§ 11.10(e)statedstatedverifiedverifiedverifiedverified
Audit trail kept as long as the record§ 11.10(e)not statedstatedstatedverifiedverifiedstated
Accurate, complete copies for inspection§ 11.10(b)statedstatedstatedverifiedverifiedverified
Validation documentation to support the customer's own validation§ 11.10(a)verifiedverifiednot statedverifiedverifiedverified
EU Annex 11 statementEU GMP Annex 11statednot statedstatedstatednot statednot stated

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

Veeva QualityDocs publishes the most of what an SOP buyer needs: its help pages describe the signature record down to its meaning and its link to the signed record. Qualio and MasterControl Quality Excellence each verify six of the nine rows, but different ones: Qualio documents how long its trail is kept, MasterControl Quality Excellence documents what its signature shows.

Montrium QMS Document Control, ZenQMS and SimplerQMS describe fewer controls on their public pages. Of their signature rows only SimplerQMS's account of what a signature shows is verified; the rest are claims, so they read stated. That is a gap in the public evidence, not proof of a gap in the product. Ask for a signed SOP printout in the demo and hold it against the signature manifestation check.

SOP management or full document control?

Both run on the same engine: versions, approval signatures and an audit trail. SOP management does a narrower job and asks more of what happens after approval.

Scroll sideways for both columns

General document control beside SOP management
QuestionDocument controlSOP management
What it controlsEvery controlled document: specifications, forms, drawings, policies, SOPsProcedures and work instructions that people carry out
What approval startsIssue of the new versionA training round that has to finish before people work to it
The date that mattersThe approval dateThe effective date, set apart from approval so training can close first
Who has to see itAnyone with access to the documentEvery role assigned to the SOP, each with a signed record
ReviewBy document type, often when something changesA periodic review of each SOP against how the work is really done
RetirementThe superseded version is archivedArchived with its training records, so you can show who worked to which version

A small lab whose controlled documents are mostly SOPs can start with an SOP-first tool and add the rest later; Montrium QMS Document Control is aimed at that buyer, growing teams that need SOP and document control first. A device maker cannot keep them apart for long: the QMSR brings in ISO 13485, and FDA's preamble notes that its Clause 4.2.4 “specifies that documents required by the quality management system shall be controlled”. Specifications and drawings sit under that clause beside SOPs, which is the case for full document control software. What changed for device makers is set out in FDA QMSR for small device makers.

A revision is also a change. If a new SOP version follows a process change, the approval belongs in the change record too, which is the job of change control software.

Vendor by vendor

One row per system, read on the SOP states that have a row in the table above. Each cell counts how many of that state's rows the vendor's own pages describe. A cell short of its total means the rest is stated or not stated: ask that vendor for its validation documentation and test the control yourself.

Scroll sideways for every state

Each system by SOP state: requirement rows verified on the vendor's own pages
SystemDraft and periodic review1 rowReview1 rowApprove2 rowsEffective1 rowRetire2 rowsVendor's own page
Montrium QMS Document Control0 of 1 verified0 of 1 verified0 of 2 verified0 of 1 verified0 of 2 verifiedPart 11 pageread 2026-10-22
ZenQMS0 of 1 verified0 of 1 verified0 of 2 verified0 of 1 verified0 of 2 verifiedPart 11 pageread 2026-10-22
SimplerQMS1 of 1 verified1 of 1 verified0 of 2 verified0 of 1 verified0 of 2 verifiedPart 11 pageread 2026-10-22
Qualio1 of 1 verified0 of 1 verified2 of 2 verified0 of 1 verified2 of 2 verifiedPart 11 pageread 2026-10-22
Veeva QualityDocs1 of 1 verified1 of 1 verified2 of 2 verified1 of 1 verified2 of 2 verifiedPart 11 pageread 2026-10-22
MasterControl Quality Excellence1 of 1 verified1 of 1 verified2 of 2 verified0 of 1 verified1 of 2 verifiedPart 11 pageread 2026-10-22

verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.

The full card for each of these six systems, with what it is, who it fits and the note behind every status, is in the document control software compare, which reads the same registry.

How we read the vendors

Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.

verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.

FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.

Some vendors' pages could not be read on the read date, so they are not in this lineup.

Questions

We write our SOPs in Word. Does Word need Part 11 controls?

Not for writing. FDA's 2003 guidance says validation “would not be important for a word processor used only to generate SOPs”. The controls belong to the system where the SOP is reviewed, signed, issued and kept. Once the approved version lives and is signed there, that system holds a Part 11 record. To check a borderline case, run the Part 11 applicability checker.

Is a read-and-understood sign-off a Part 11 signature?

Part 11's signature sections reach electronic signatures meant to equal handwritten ones that a predicate rule requires. § 211.25(a) requires the training, not a signed record of it, so the answer depends on what your own procedures make that sign-off. The safer course is to treat it as a signature: give it the meaning “Read and understood”, the printed name and the date and time that § 11.50 asks for, and sign it with both components under § 11.200(a). It is the record an inspector asks for when an operator's work is questioned.

How often do SOPs have to be reviewed?

No FDA section we read sets an interval: § 211.100 and § 58.81 say nothing about a review cycle. EU GMP asks that quality system documents be “regularly reviewed and kept up-to-date” Ch. 4 § 4.5. Pick the interval by risk, write it into your document control SOP, and keep to it: an inspector checks the cycle you set yourself.

Can we approve SOPs with a stand-alone e-signature tool?

It can carry the approval signature, and several are compared in Part 11 e-signature software. It will not set effective dates, withdraw the superseded version, assign training or run periodic review. Those steps then live in a spreadsheet and your procedure, and the inspector reads both.

Is there an FDA-approved SOP management system?

No. FDA approves no SOP system and publishes no list of Part 11 software. A vendor's claim is where your validation starts § 11.10(a): you test your configuration of the approval workflow, effective dating and training assignment for your own use.

We sell into the EU. Which row matters?

EU GMP Chapter 4 asks for approved, signed and dated instructions with a defined effective date Ch. 4 § 4.3 and an inventory of quality system documents Ch. 4 § 4.32. For the system itself, read the Annex 11 row and our guide to EU Annex 11.

Sources

Regulation text from the eCFR, the Federal Register and EudraLex; guidance from FDA. Each vendor's own Part 11 page is linked in the vendor table. General information, not regulatory advice.

  1. 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
  2. 21 CFR 211.100, Written procedures; deviations, eCFRread 2026-10-22
  3. 21 CFR 211.22, Responsibilities of quality control unit, eCFRread 2026-10-22
  4. 21 CFR 211.25, Personnel qualifications, eCFRread 2026-10-22
  5. 21 CFR 58.81, Standard operating procedures (GLP), eCFRread 2026-10-22
  6. Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
  7. Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (2024), Federal Registerread 2026-10-22
  8. EudraLex Volume 4, Chapter 4: Documentation (January 2011), European Commissionread 2026-10-22
  9. EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22