AW-03 — Policy, SOP and Controlled Document Management

This is the procedure that makes every other procedure real. An uncontrolled SOP is an opinion. A controlled one has an owner, a version, an approval, a review date and a retrievable history. ISO auditors test this clause first because it is the cheapest way to find out whether a management system exists or merely a folder of documents.

1. Purpose

To ensure that every policy, procedure, work instruction, template and form used by IoL is identified, approved by the right authority, current, available where it is needed, protected from unintended change, and retired when obsolete, so that staff work from one authoritative version and an assessor can trace any practice to its documented basis.

2. Scope

Scope statement. This procedure manages IoL documented information from the proposal of a new or changed document through drafting, review, approval, publication and periodic review, to withdrawal and archiving.

Applies to. Departmental policies where IoL has authority to issue them; all IoL procedures, work instructions, templates, forms, checklists and controlled registers; both the academic pack (IoL Pilot/) and this administrative pack; any external document of origin (standards, regulator guidance, MBRU policy) that IoL relies on and must hold at the current version.

Does not apply to. Institutional policy owned by MBRU or Dubai Health, which IoL adopts but does not control; records, which are the outputs of procedures and are governed by AW-04; working drafts that have not entered the control process; teaching materials, which are curriculum content governed by WF-02 and WF-03.

Applicable requirements. ISO 9001:2015 clause 7.5.2 (creating and updating: identification, format, review and approval) and 7.5.3 (control: availability, protection, distribution, access, storage, change control, retention, disposition); ISO 21001:2018 clause 7.5; MBRU document-control requirements [IoL to confirm].

3. Trigger, boundary and endpoint

4. SIPOC

5. Accountability

Process owner. IoL Quality Lead or equivalent [IoL to confirm], with authority to refuse publication of a document that has not passed approval.

Approval matrix [IoL to confirm against MBRU delegations]

Escalation.

6. Procedure

1. Receive and log the request. Any staff member may request a new document or a change. The Document Controller logs it in the document register with a unique ID in the form AW-NN, WF-NN, WI-NN, FRM-NN or REG-NN, a title, the requester and the reason. [CONTROL] No document exists in the system without a register entry.

2. Assess the request. The Quality Lead confirms the document type, that IoL has authority to issue it (departmental policy requires MBRU confirmation), whether it duplicates or conflicts with an existing document, and which template applies. Decision point. Reject with reasons, redirect to an existing document, or proceed.

3. Assign the owner. One named role, not a person, accountable for content and for future reviews.

4. Draft. The owner drafts in the applicable template, in the working area of the repository, marked DRAFT with no version number. Drafts are never distributed for use.

5. Review. The owner circulates to every role named in the document's RACI and to any interfacing process owner. Reviewers respond within the service standard. Substantive objections are resolved or recorded as dissent in the register. [CONTROL] A document affecting another procedure is not approved without that procedure owner's review.

6. Impact assessment for changes. For a revised document, the owner records what changed, why, which records or systems are affected, whether training is needed, and whether historical records remain valid. For documents in the academic pack, the owner records the effect on any OBEF time series (a definition change breaks three-year and five-year comparability). [CONTROL] The change log in section 14 of the document is updated before approval, never after.

7. Approve. The approver per the matrix signs, dates and records the effective date. Approval is recorded in the register and in the document's control block. [CONTROL] Segregation: the drafter of a procedure does not approve it. [CONTROL] An approver does not approve a document they have not read; the approval record includes the version hash or page count reviewed.

8. Publish. The Document Controller assigns the version number (major for scope or control changes, minor for editorial), converts to the published format, places it in the published location, and removes the superseded version from that location in the same action. [CONTROL] No period exists in which two versions are both retrievable from the point of use.

9. Communicate. The owner notifies affected staff, states what changed and from when, and arranges training or briefing where the impact assessment requires it. Acknowledgement is recorded for documents with safety, legal or data-protection content.

10. Archive the superseded version. Handed to AW-04 with its full control history. Superseded versions are retrievable on request for as long as records made under them are retained.

11. Schedule the review. Default review interval: policies three years, procedures two years, work instructions and forms annually, or sooner on any trigger in section 3. The register holds the date and the Document Controller runs a monthly check.

12. Conduct the periodic review. The owner confirms the document is still needed, still accurate, still consistent with governing policy and interfacing procedures, and still used in practice. Outcome is one of: reconfirm unchanged (new review date), revise (return to step 4), or withdraw (step 13). [CONTROL] A reconfirmation without evidence that the document was checked against current practice is not a review.

13. Withdraw. On withdrawal, the register is updated, the document is removed from the point of use, affected staff are told, and the final version is archived via AW-04 with the withdrawal reason.

14. Control external documents of origin. Standards, regulator guidance and MBRU policies that IoL relies on are listed in the register with the version held and the date last checked. The Quality Lead checks for new versions at least annually and on any notification, and opens a change request where a new version affects an IoL document. [CONTROL] The OBEF guide is an external document of origin; version 11.5 is the one this pack is built on, and a new version triggers review of the academic pack.

7. Information handled and interfaces

Two packs sit under this procedure. The academic pack's 26 workflows and this pack's 25 are controlled documents from the moment this procedure is approved. Until then they are drafts, which is what their control blocks say.

8. Controls

Stated as assertions an auditor can test.

9. Exceptions and escalation

This procedure must never: allow a document into use without a register entry; allow the drafter to approve their own procedure; leave two versions retrievable at the point of use; record a review that did not check the document against practice; backdate an effective date; or alter a change log after approval.

10. Service standards

11. Records and retention

12. Risks and controls

13. Performance measures

14. Change control