A policy can be reviewed by ten people, approved by one and still fail an audit. The cause is rarely a bad policy. It is a missing record of which version was reviewed, who raised which comment and what the approver actually signed. Teams usually find the gap during an inspection or a customer audit, when the people who made the decisions have moved on and the evidence is scattered across inboxes.

What is document review and approval?

Document review and approval is the process of checking a draft for accuracy and suitability, resolving the feedback it receives and then formally authorizing a specific version for release as a controlled document.

ISO 9001:2015, clause 7.5.2, requires organizations creating and updating documented information to ensure appropriate "review and approval for suitability and adequacy." ISO published ISO 9001:2026 on September 16, 2026, and it replaces the 2015 edition. Organizations certified to the 2015 edition have three years to transition.

In everyday terms, someone writes a draft, the right colleagues check it and an accountable person confirms it is ready to use. A refund policy goes to finance and legal before a director signs it. A work instruction goes to the team that performs the task before a supervisor releases it. A contract template goes to procurement and legal before it becomes the standard version.

Review and approval are two separate decisions. Review tests whether the content is right and workable, and approval authorizes its use. The document owner is accountable for running the process, and the approver is accountable for the release decision. The record shows that identified people made a decision about a specific version. It does not prove the content is correct, which is why every reviewer needs a clear remit.

Why review and approval protect audits, accuracy and accountability

  • Reviewers comment on one identified version, meaning feedback never lands on a draft that has already changed.
  • Every comment has a recorded outcome, meaning an auditor can see why a passage changed.
  • Approval is tied to a named person, a date and a version, meaning nobody has to reconstruct who authorized the document after the fact.
  • Staff use only the released version, meaning outdated instructions stop circulating.

Five stages from first draft to released document

Each stage produces a specific output and leaves specific evidence, as the table shows.

Stage Who acts Output Evidence to keep
Drafting Author Draft with a version identifier Title, date, author and reference number
Review Assigned reviewers Comments on one version Who reviewed and what each person raised
Comment resolution Document owner Revised draft Accept, reject or other outcome with the reason
Approval Approver Authorized version Name, date and time, and the meaning of the signature
Release Document owner Controlled document Version history and distribution record

Drafting: one owner and one identified version

Drafting is the stage where an author produces a version that carries an identifier. ISO 9001:2015 clause 7.5.2 gives a title, date, author or reference number as examples of identification. A policy labeled version 0.3 with an author and date can be traced, while a file named final_v2 cannot.

Review: a clear remit for every reviewer

Review is the stage where assigned people check the draft against a defined remit such as accuracy, feasibility or legal exposure. A clear remit reduces duplicate comments and exposes missing perspectives. Finance checks the numbers in a pricing policy, for example, while legal checks the wording of the terms.

Comment resolution: a decision on every comment

Comment resolution is the stage where the document owner records an outcome for every comment. A comment that simply disappears leaves no reason for the change. A reviewer might ask for a shorter approval deadline, and the owner rejects it and records that the deadline reflects a contract term.

Approval: authorization of a specific version

Approval is the formal decision by an accountable person that a specific version may be used. The decision should attach to that version, not to a general message that the review is finished. A director approves version 1.0 of a policy on a stated date, and the record shows the name, the date and the decision.

Release: control of the approved version

Release is the point where the approved version becomes the one staff must use. Approval has no effect if earlier versions stay in circulation. Publishing version 1.0 to the policy library and withdrawing version 0.9 from shared folders ends confusion over which copy applies.

Who does what: authors, reviewers, approvers and document owners

Clear roles keep the process fast because everyone knows which decision is theirs. Assigning each reviewer a defined check, such as clinical, statistical or quality, is common in regulated teams, and Ideagen's article on clinical document review for UK pharmaceutical teams shows how that works for protocols.

  • Author: writes the draft and answers reviewer questions.
  • Reviewer: checks the draft against an assigned remit and records comments on the identified version.
  • Document owner: runs the process, resolves comments and records the outcome of each one.
  • Approver: holds the authority to release the document and approves a specific version.

Example of review and approval in practice: updating a refund policy

This illustrative scenario follows a customer service team that needs a shorter refund approval window.

  • The author, a customer service manager, drafts version 0.1 and records the date and reference number.
  • The document owner sends version 0.1 to finance, legal and the support lead. Finance checks the cost, legal checks the terms and the support lead checks that agents can follow the steps.
  • Legal asks for one sentence to be reworded and finance queries a threshold. The owner accepts the first request, rejects the second with a recorded reason and issues version 0.2.
  • The head of customer operations approves version 0.2 as version 1.0. The record shows the approver's name, the date and time and that the decision was approval.
  • The owner publishes version 1.0 and withdraws earlier copies. Months later an auditor asks why the threshold stayed the same, and the comment, the reason and the approval sit in one record.

Review, approval and document control compared by purpose, owner and timing

The three terms overlap in daily use but cover different parts of a document's life. ISO 9001:2015 clause 7.5.3.2 lists distribution, access, retrieval and use, storage and preservation, control of changes (for example version control) and retention and disposition as control activities. Ideagen's article on the gap between document review and document control covers what happens when the two run in separate systems.

Dimension Review Approval Document control
Purpose Test content for accuracy, suitability and adequacy Authorize a specific version for use Govern distribution, access, storage and changes to approved documents
Owner Reviewers, coordinated by the document owner The designated approver The person or function responsible for the controlled document system
Timing After drafting and before approval After comments are resolved From release until the document is withdrawn

UK and US requirements for review and approval records

UK: MHRA guidance on GXP data integrity

The Medicines and Healthcare products Regulatory Agency (MHRA) first published its GXP data integrity guidance on March 9, 2018 and last updated it on September 27, 2021. It applies to organizations involved in any aspect of the pharmaceutical lifecycle or GLP studies regulated by MHRA, and it does not extend to medical devices. Section 6.15 states that "There should be a procedure that describes the process for review and approval of data." It adds that data review should be documented and that the record should include "a positive statement regarding whether issues were found or not, the date that review was performed and the signature of the reviewer."

US: FDA 21 CFR Part 11 on electronic records and signatures

The Food and Drug Administration (FDA) published 21 CFR Part 11 in the Federal Register on March 20, 1997. It applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under agency records requirements, and to electronic records submitted to FDA. Under section 11.50, signed electronic records must show the printed name of the signer, the date and time of signing and the meaning of the signature, such as review, approval, responsibility or authorship. Section 11.10(e) requires secure, computer-generated, time-stamped audit trails, and record changes must not obscure previously recorded information.

Limitations of review and approval, and how to check the process works

A completed review shows that people looked at a draft, not that they looked at the right things. Reviewers see only what they are given, and an approver can only authorize what has reached them. A process that depends on informal email loses detail quickly, and a signature without a version attached proves little.

A simple test shows whether the process holds up. Pick a released document and work backward:

  • Confirm the released version matches the approved version.
  • Find the approver's name, the date and the meaning of the approval.
  • Check that every comment has a recorded outcome.
  • Confirm the reviewers named in the record were the ones assigned.
  • Check that earlier versions are no longer in use.

Any step that takes more than a few minutes to answer points to evidence that sits outside the process.

A review record that survives the next audit

A review and approval process earns its value on the day someone asks why a document says what it says. Identified versions, assigned reviewers, recorded comment outcomes and a dated approval answer that question without a search through old emails. Teams that want that record built into the review itself can see how Ideagen Please Review handles tracked versions, captured comments and defensible approvals in one secure, web-based platform.

Questions about document review and approval

Who can approve a document?

The person with authority over the content and the process can approve it. Under 21 CFR 11.10(g), systems need authority checks so that only authorized individuals can electronically sign a record. The document owner should confirm who holds approval authority for each document type before the review begins, so the approver is never chosen after the comments arrive.

Does an updated document need approval again?

Yes. ISO 9001:2015 applies its review and approval requirement when creating and updating documented information, so a changed document needs its own review and approval before release. The new version should carry its own identifier and approval record, and the earlier version should be withdrawn from use so staff cannot follow outdated instructions.

Is an electronic signature required for approval?

It depends on the requirement that applies to the record. Where FDA 21 CFR Part 11 applies, electronic signatures that meet the rule are treated as equivalent to handwritten signatures, and signed records must show the signer's printed name, the date and time and the meaning of the signature. The MHRA guidance expects electronic signatures to be attributable to an individual and recorded so they cannot be altered.