SOP for Certificate of Analysis (CoA) of Finished Product in Word

In short: A finished product CoA prepared in Word is only as reliable as the controls around its template. This example SOP describes a QA-approved, access-restricted template, a controlled folder structure, version control and a second-person check of every issued CoA.

This is an illustrative template. Adapt it to your own quality system, IT environment and the version of Word you use. For what a CoA should contain, see GMP requirements for a Certificate of Analysis.

1. Objective

To describe how the Certificate of Analysis (CoA) of a finished product is prepared from an approved Word template in the Quality Control laboratory.

2. Scope

This example SOP applies to CoAs of finished products issued by the QC laboratory of the manufacturing facility.

3. Responsibility

4. Data-integrity controls for Word and spreadsheet CoAs

A CoA made in a word processor or spreadsheet is a GMP record and a typing or formula error can release a wrong result. Apply these controls:

• Controlled template. Only a QA-approved template is used. The template is locked so analysts can fill in only the result fields.
• Version control. Only one current version of each template exists in the routine-use folder; superseded versions are moved to an “Obsolete” folder and kept for reference. Changes to a template follow your change control procedure (see also documentation control).
• Access control. QA has full rights; QC has read and fill-in rights only. Creation, change and removal of access should be recorded (EU GMP Annex 11 §12.1, §12.3).
• Data protected and backed up. Stored files are protected against damage and backed up regularly, and restores are checked (EU GMP Annex 11 §7.1, §7.2; 21 CFR 211.68(b) requires appropriate controls so that changes to records are made only by authorised personnel, and a backup of data entered into a computer system).
• Changes in a controlled manner. Any change to the template or system configuration follows a defined procedure (EU GMP Annex 11 §10).
• Accuracy check. Critical manually entered data should get an additional check by a second person (EU GMP Annex 11 §6). Laboratory records need a second-person review for accuracy and completeness (21 CFR 211.194(a)(8)).
• Audit trail where available. If the file is stored in a system that records changes and deletions, review them periodically (Annex 11 §9).

Where spreadsheets are used for calculations, validate the formulas and lock the cells before use. Annex 11 applies in its own right to computerised systems used in GMP activities; a risk-based approach is expected.

5. Procedure

5.1 Setting up the folders (with IT)

1. Create a server folder “COA Templates” with sub-folders for “Verification”, “FG” (routine use) and “Obsolete”, and a “Final COAs” folder for issued CoAs.
2. Protect the folders against deletion, renaming and modification by unauthorised users, and monitor them for tampering.
3. Give QA full access to template folders and QC read-only access. Give QC fill-in access only to the CoA working copy.

5.2 Designing the template

1. Prepare the CoA layout from the approved finished product specification, so every test and limit in the specification appears on the CoA.
2. Header: company name, logo and the title “CERTIFICATE OF ANALYSIS”.
3. Put product name, batch number, batch size, quantity of sample, analytical reference (A.R.) number, manufacturing date, expiry date and date of analysis in a table at the top that repeats on each page.
4. Footer: prepared by, checked by and approved by with date, the company address, the page number, and the file path of the controlled template.
5. Set the paper size to A4. Set the header table row to “Repeat as header row at the top of each page” so long CoAs stay identifiable.
6. Enter the conclusion text and specification number once at creation; the end user should not edit them.

5.3 Locking the form (Word)

The steps below describe the usual Word form-protection method; menu names differ between versions.

1. Enable the Developer tab (File > Options > Customize Ribbon > Developer).
2. Insert text form fields (the “Forms” toolset) only where the analyst enters data: the batch details and the results column.
3. Turn off Design Mode, choose Restrict Editing, select “Filling in forms” and start enforcing protection with a password held by QA.
4. Save the file as a Word template (product name, specification number and version in the file name).

Note that Word’s editing restriction is a basic control. It does not give an audit trail and can be bypassed by someone with the password or by copying the content, so it supports, but does not replace, the second-person check and folder permissions.

5.4 Verification and approval of the template

1. Save the draft template in the “Verification” folder.
2. QA verifies the template against the approved specification and specification number.
3. Head QA approves it. After approval, QA moves it to the “FG” folder for routine use and changes the password.
4. The CoA is valid only if the footer shows the correct controlled path and version.

5.5 Preparing a CoA

1. The analyst opens a new copy of the approved template and enters the batch details and results directly from the recorded test data. Do not retype results from memory.
2. Print or save the CoA, and sign and date as “prepared by”.
3. A second person (Head QC or designee) checks every entry against the raw data and specification, and signs as “checked by”.
4. QA signs as approved where your system requires. Save the issued CoA to the “Final COAs” folder as read-only (or a locked PDF).
5. Never overwrite an issued CoA. If an error is found, issue a corrected CoA under your deviation or change procedure and keep both versions.

5.6 Specification revision

When the specification changes, prepare a new template as above, and QA moves the previous version from routine use to the “Obsolete” folder.

6. Records and retention

CoAs, the raw data they come from and the template history are kept at least 1 year after the expiry date of the respective product batch (EU GMP Part I Chapter 4 §4.11; 21 CFR 211.180(a)), or longer if local law or the marketing authorisation requires. Make sure backups cover the whole retention period.

7. Training

• Trainer: Head QC.
• Trainees: QC officers/executives.

8. Distribution

Controlled copies: QA, QC and IT. The master copy is kept by QA.

Frequently asked questions

Is a Word CoA acceptable for GMP use?

It can be, if the template is approved and controlled, access is restricted, entries are checked by a second person and data are backed up. Where possible, a validated system with an audit trail is stronger.

Is password-protecting a Word file enough for data integrity?

No. It limits editing but gives no audit trail and shared passwords hide who changed what. Combine it with folder permissions and review.

Who checks the CoA?

A second person who compares each entry with the raw data and specification before the CoA is issued.

Abbreviations

CoA: Certificate of Analysis. QC: Quality Control. QA: Quality Assurance. FG: finished goods. A.R.: analytical reference. IT: information technology.

References

1. US FDA, 21 CFR 211.194(a) (laboratory records) and 211.68(b) (controls over computer systems and backup).
2. European Commission, EudraLex Volume 4, Annex 11 “Computerised Systems” (2011), §§6, 7, 9, 10, 12.
3. EudraLex Volume 4, Part I, Chapter 4, §4.11; 21 CFR 211.180(a) (retention).