4.4 Publication SOPs, Documentation, Quality Control & Audit Readiness
Key Takeaways
A publication SOP should assign roles, decision rights, review and approval steps, quality controls, disclosure, data access, deviations, corrections, archiving, and escalation in a way proportionate to the organization and work.
ICMJE requires every named author to approve the final version; organizations should retain contemporaneous evidence under their SOP, although ICMJE does not require one particular signature format.
Quality control should reconcile every material claim and number to the appropriate validated source and document the scope, reviewer, findings, and resolution.
A publication dossier should preserve the evidence needed to reconstruct decisions without collecting unnecessary personal or confidential information.
Retention periods come from applicable law, contracts, trial records, corporate schedules, litigation holds, privacy rules, and venue requirements—not a universal 5-to-10-year GPP rule.
Publication SOPs, Documentation, Quality Control & Audit Readiness
Note
GPP 2022 promotes clear, accountable processes but does not prescribe a single corporate SOP, software platform, quality-control percentage, inspection program, or retention period. Controls should match the organization's obligations and the publication's risk.
What an SOP Should Control
A publication SOP or controlled working instruction should address:
- scope and definitions;
- roles and segregation of responsibilities;
- publication planning and approvals;
- author and contributor identification;
- author agreements and opportunities to meet criteria;
- sponsor, legal, regulatory, safety, IP, and compliance review;
- professional writing support;
- data access and final data checks;
- disclosure and funding;
- version control;
- target-venue submission;
- preprints and congress materials;
- quality control;
- deviations and escalation;
- post-publication corrections;
- documentation and retention;
- training and periodic review.
An SOP should not claim that internal process preferences are requirements of ICMJE or GPP. Distinguish the external principle from the organization's control.
Author Documentation
Under ICMJE, each named author must meet all four criteria, including final approval and accountability. ICMJE does not state that approval must take one specific written form. For an auditable workflow, organizations commonly retain contemporaneous evidence such as:
- author agreement or invitation;
- contribution record;
- substantive comments or revision history;
- final-approval email or system entry;
- disclosure form;
- authorship-change correspondence;
- submission confirmation.
If an SOP requires electronic or written final approval, missing evidence is an internal control deficiency even if someone recalls a verbal conversation. Do not forge a signoff or backdate a record. Document the deviation, determine whether genuine approval occurred, obtain appropriate confirmation if still possible, and improve the control.
Permission is needed before naming a person in acknowledgments because recognition can imply endorsement. Retain the permission and the final contributor wording.
Publication Dossier
The dossier should allow an independent reviewer to reconstruct what happened. Depending on the project, it may contain:
- approved concept and plan;
- protocol, SAP, registry information, and relevant amendments;
- validated source outputs used for the publication;
- author and contributor records;
- writer and agency agreements;
- version history and substantive reviews;
- quality-control evidence;
- disclosures, funding, and sponsor-role statements;
- permissions and licenses;
- venue submission, decision, revision, and acceptance records;
- final presented, posted, or published version;
- correction or retraction correspondence.
Do not retain unnecessary identifiable participant information in a publication repository. Apply access controls, privacy rules, confidentiality, and records-management policy.
Version Control
Each controlled draft should be identifiable by version, date, status, and owner. Avoid parallel “final” files. A system may be a validated publication platform, a document-management system, or another controlled repository appropriate to the organization's requirements. GPP 2022 does not mandate a vendor.
The audit trail should show major decisions without preserving every trivial formatting exchange forever. The SOP defines what is material.
Quality Control
Quality control asks whether the publication accurately represents the validated evidence and complies with the applicable requirements. The correct source may be a final validated table, listing, figure, dataset, statistical output, protocol, SAP, registry, or study report. The clinical study report is not always the only or latest source for every publication.
A risk-based QC plan may cover:
- participant counts and denominators;
- endpoints and analysis populations;
- effect estimates, confidence intervals, and p-values;
- adverse events;
- dates and registration identifiers;
- table, figure, abstract, text, and supplement consistency;
- citations;
- reporting-guideline elements;
- author, funding, writer-support, and conflict disclosures;
- privacy and permissions;
- consistency with venue formatting and word limits.
“100% QC” should be defined if used. It may mean checking every numerical statement, not checking every word against a CSR. Record who checked, which source and version were used, findings, corrections, and resolution.
Discrepancies
If a manuscript uses an interim hazard ratio but a later final validated output supersedes it, pause release and determine the correct approved analysis. Update every affected location and document the change. Do not average results or retroactively alter a study report to match a preferred narrative.
If two validated sources disagree, escalate to data owners and statisticians. QC personnel should not choose a value merely because it is more favorable.
Deviations and CAPA
A deviation is a departure from the controlled process. Assess:
- what requirement was missed;
- whether the scientific record, authorship, disclosure, privacy, or compliance was affected;
- immediate containment;
- correction;
- root cause;
- preventive action;
- owner and due date;
- effectiveness check.
A corrective and preventive action (CAPA) should be proportionate. A one-time filing error may require correction and coaching; a systemic approval failure may require workflow changes, training, or system controls.
Retroactive documentation must be clearly dated as retrospective. It is not a substitute for contemporaneous evidence.
Post-Publication Issues
When an error is found, contact the journal or conference and follow its process. Correction terminology varies by publisher; COPE does not impose a universal rule that “erratum” always means publisher error and “corrigendum” always means author error. The goal is a transparent, linked correction that preserves the record. Unreliable findings may require retraction rather than correction.
Retention
No universal GPP rule says every publication dossier must be kept 5, 10, or 25 years. Determine retention from:
- applicable research and regulatory record laws;
- clinical-trial master-file obligations;
- contracts;
- company records schedules;
- journal or conference terms;
- tax or transparency records;
- litigation or investigation holds;
- privacy and data-minimization rules.
Document the rule used for each record class. When the retention period ends, use authorized, secure disposition unless a hold applies.
Audit Readiness
Periodic review can test:
- whether required approvals exist;
- whether numbers trace to validated sources;
- whether disclosures match agreements and records;
- whether permissions are present;
- whether deviations were handled;
- whether access and retention controls work.
An audit should verify the defined process, not invent new requirements after the fact.
Important
Audit readiness means a truthful, reconstructable record: who decided, what evidence was used, which version was approved, what was checked, how issues were resolved, and why records were retained.
Five authors approved a manuscript, but the repository lacks evidence for one approval required by the company SOP. How should the finding be handled?
Assume compliance because four approvals are enough
Treat it as a documentation-control deficiency, verify whether final approval occurred, document any retrospective confirmation honestly, and remediate the process
Forge the missing approval
Immediately seek a court order to remove the author
A draft reports an interim hazard ratio that differs from the final validated analysis. What should happen?
Average the two values
Use the more favorable value
Pause release, confirm the controlling validated analysis with the data owners, correct every affected element, and document resolution
Alter the CSR to match the draft
How should a publication-dossier retention period be determined?
Always 12 months
Always 5 years
Always 25 years
By the applicable legal, regulatory, contractual, corporate, venue, privacy, and hold requirements for the record class
Sections you finish are checked off in the contents.