Quality & Compliance Glossary

1. Regulatory Compliance

6

21 CFR Part 11

The FDA regulation that defines when electronic records and electronic signatures are trustworthy and equivalent to paper under predicate rules.

Electronic Signature

The regulated digital equivalent of a handwritten signature: uniquely attributable to one person, linked to the signed record, captured with meaning and timestamp, and verifiable on inspection.

EU GMP Annex 1

The EU sterile-manufacturing standard rebuilt around a Contamination Control Strategy.

EU GMP Annex 11

The EU's computerised-systems rules for GMP — and the biggest revision in over a decade is imminent.

FDA QMSR

The regulation that ended the 21 CFR Part 820 Quality System Regulation era.

Good Distribution Practice (GDP)

The quality rules that govern medicines after they leave the manufacturing site — and the Responsible Person who owns them.

2. Quality Management

18

APQR

The yearly look-back that proves a product's process and quality stayed in control.

Batch Record

The record that tells one batch's whole story — and the document set that governs it.

CAPA (Corrective and Preventive Action)

The regulated process for investigating quality issues, removing their causes, and preventing recurrence across a QMS.

Change Control

The controlled process for proposing, assessing, approving, implementing, and verifying changes to validated GxP processes, systems, equipment, and documents.

Change Impact Assessment

The structured evaluation of a proposed change's potential effects on product quality, patient safety, validation status, training, and regulatory commitments — the analysis that drives change-control classification.

Design Controls

The governed process behind every compliant medical device design — and the file that proves it.

Deviation

An unplanned departure from an approved procedure, specification, or standard operating practice — the starting point of a GMP investigation.

Document Control

The regulated process for creating, reviewing, approving, distributing, revising, and retiring controlled GxP documents.

Document Lifecycle Management

The end-to-end control of regulated documents from initial draft through review, approval, distribution, periodic review, revision, archival, and controlled retirement.

Effectiveness Check

The verification step that confirms a corrective or preventive action actually addressed the root cause and prevented recurrence — the gate that separates closed CAPAs from credibly closed ones.

Escalation Management

The structured process for elevating quality events, risks, and issues to appropriate levels of authority based on severity, impact, and urgency — with defined criteria and time-bound expectations.

Impact Assessment

The cross-cutting discipline of evaluating a decision or event's potential consequences before acting — applied wherever risk-based thinking has to translate into a specific judgment.

Investigation Management

The controlled discipline of examining quality events to determine cause, impact, and required action — the analytical work that turns a flagged issue into a credible corrective decision.

Nonconformance

A requirement not met — the segregation, disposition, and escalation discipline that follows.

Quality Event

Anything that signals a potential or actual departure from approved processes, procedures, specifications, or regulatory expectations — and the formal entry point into investigation, risk assessment, and CAPA.

Root Cause Analysis (RCA)

A systematic method for identifying the underlying cause of a quality issue — not the symptom — so corrective action can actually prevent recurrence.

SOP Management

The controlled lifecycle that keeps standard operating procedures approved, current, trained, and used at the point of work — the substrate every other GxP control sits on.

Training Management

The controlled process for qualifying personnel to perform their assigned GxP tasks.

3. Quality Governance

2

Management Review

The periodic, documented review by senior management of the quality system's suitability, adequacy, and effectiveness, with defined inputs and traceable outputs.

Periodic Review

The umbrella discipline of recurring, documented re-verification — applied across systems, processes, documents, and suppliers to confirm each remains compliant, effective, and fit for use.

4. Data Integrity & Governance

8

ALCOA+

The data integrity framework regulators apply to GxP records.

Audit Trail

A secure, computer-generated, time-stamped record of who changed what, when, and why in a regulated quality system.

Audit Trail Review

The periodic, risk-based examination of audit trail records by an independent reviewer, with signed evidence of what was reviewed, what was found, and what was done about it.

Data Governance

The management framework — the policies, roles, and oversight — that turns data integrity from a goal into something a firm can actually sustain.

Data Integrity

The assurance that regulated data stays complete, consistent, accurate, and attributable throughout its lifecycle.

Role-Based Access Control (RBAC)

The controlled assignment of system access by defined role rather than per-user permissions — the foundation that supports unique attribution, segregation of duties, and audit trail integrity in GxP systems.

Segregation of Duties (SoD)

The control principle that no single individual should be able to create, approve, and verify a GxP record without independent oversight — operationally enforced through RBAC.

User Access Review

The scheduled re-confirmation that each user's current access in each GxP system is still appropriate, by an independent reviewer, with documented disposition per user per role.

5. Validation & Computer Systems

4

Equipment Qualification

Documented proof that equipment is fit for its GMP purpose — DQ, IQ, OQ, PQ — and that the qualified state is maintained across the equipment's operating life.

GAMP 5

The industry framework regulators and QA teams use to scope computerized system validation.

System Periodic Review

The scheduled re-evaluation of a computerised GxP system to confirm it remains validated, secure, and fit for intended use — the lifecycle control that catches validation drift before inspections do.

Validation

Documented evidence that a system, process, or method consistently produces a result meeting predetermined specifications and quality attributes.

6. Risk & Quality

2

Quality Risk Management

The structured process for identifying, assessing, controlling, communicating, and reviewing risks to product quality and patient safety across the product lifecycle.

Risk Assessment Matrix

The structured tool that translates risk principles into comparable scoring across decisions — severity, probability, detectability mapped to action thresholds, calibrated to the firm's specific processes.

7. Audit & Inspection

1

Internal Audit

The risk-based, scheduled, independent examination of a quality management system to verify it operates as designed and complies with applicable regulations and standards.

8. Post-Market Quality

1

Complaint Handling

The controlled process for receiving, evaluating, investigating, and responding to product quality and safety complaints — including the regulator notification obligations that come with them.

9. Laboratory & Data Integrity

2

Out of Specification (OOS)

A test result that falls outside registered specifications, method acceptance criteria, or established control limits — requiring formal investigation.

Out of Trend (OOT)

Test results that fall within specification but show an unexpected or unfavourable pattern against historical data — the early warning before an OOS.

10. Supply Chain Quality

2

Supplier Audit

A risk-based, structured, independent examination of a supplier's quality systems and processes — the principal way firms turn supplier qualification claims into verified assurance.

Supplier Qualification

The risk-based process for assessing, approving, monitoring, and re-qualifying suppliers of GxP materials, components, and services.

11. Training & Competence

2

Competency Management

Defining what competence means for each role, verifying people have it, and maintaining it as practice and regulation evolve — beyond training-completion-as-proof-of-competence.

Training Effectiveness

The discipline of evaluating whether training actually produced understanding, retention, and correct application — the verification step that turns training-attended into competence-demonstrated.