GxP Glossary
50 key terms every life sciences compliance professional needs to know — from GAMP 5 and ALCOA+ to 21 CFR Part 11, CSV, CSA, and beyond.
#
21 CFR Part 11
21 CFR Part 11 is the FDA regulation that defines the criteria for electronic records and electronic signatures to be considered trustworthy, reliable, and equivalent to paper records. It requires audit trails, system validations, access controls, and authority checks for any system generating, maintaining, or transmitting electronic records in a regulated environment.
GxP Compliance Checklist →21 CFR Part 820
21 CFR Part 820 is the FDA regulation establishing Quality System Regulation (QSR) requirements for medical device manufacturers. It covers design controls, production and process controls, corrective and preventive actions, and document controls. The regulation is being harmonized with ISO 13485 under the QMSR final rule.
A
ALCOA+
ALCOA+ is a data integrity framework used across regulated life sciences industries. The acronym stands for Attributable, Legible, Contemporaneous, Original, and Accurate, with the plus adding Complete, Consistent, Enduring, and Available. Regulators reference ALCOA+ principles when assessing whether electronic or paper records meet data integrity expectations.
Audit Trail
Audit trail is a secure, computer-generated, time-stamped record that captures the who, what, when, and why of every change made to electronic records. 21 CFR Part 11 and EU Annex 11 both require audit trails for GxP systems. The trail must be immutable, meaning it cannot be altered or deleted by any user including system administrators.
B
Batch Record
Batch record is a documented history of a single production batch, containing all instructions, in-process data, deviations, and approvals. GMP regulations require batch records to demonstrate that each step was performed according to the approved manufacturing procedure. Electronic batch records (EBRs) replace paper-based workflows with validated digital systems.
C
CAPA
CAPA (Corrective and Preventive Action) is a quality system process for investigating, correcting, and preventing recurrence of quality problems. Corrective actions address existing nonconformances; preventive actions address potential problems before they occur. CAPA effectiveness verification is one of the most scrutinized areas during regulatory inspections.
GxP Compliance in Pharma →Change Control
Change control is a formal quality system process for proposing, evaluating, approving, and implementing changes to validated systems, processes, or documents. Regulatory bodies require change control to ensure that any modification is assessed for its impact on product quality, patient safety, and data integrity before implementation. Changes without documented control are a common inspection finding.
Clinical Trial Management System (CTMS)
CTMS (Clinical Trial Management System) is software used to manage the planning, tracking, and reporting of clinical trials. It handles site management, patient enrollment, regulatory document tracking, and milestone monitoring. CTMS must be validated under GCP requirements and often integrates with EDC, IWRS, and safety databases.
Computer Software Assurance (CSA)
CSA (Computer Software Assurance) is the FDA's updated risk-based approach to software validation, replacing the traditional Computer System Validation (CSV) paradigm. CSA emphasizes critical thinking and risk-based testing rather than exhaustive documentation, focusing validation effort on the highest-risk functionality. The FDA published its final guidance on CSA in 2022.
CSV vs CSA: What Changed →Computer System Validation (CSV)
CSV (Computer System Validation) is the documented process of establishing and maintaining evidence that a computerized system consistently performs its intended function in compliance with GxP regulations. CSV traditionally follows a V-model lifecycle from requirements through testing to system retirement. While CSA is replacing CSV as the FDA-preferred approach, many organizations still use CSV frameworks.
CSV vs CSA: What Changed →D
Data Integrity
Data integrity is the completeness, consistency, and accuracy of data throughout its lifecycle, from creation to archival. In GxP environments, data integrity is assessed against ALCOA+ principles and enforced through technical controls (audit trails, access restrictions) and procedural controls (SOPs, training). Data integrity failures are among the top causes of FDA warning letters.
Design Qualification (DQ)
Design qualification is the documented verification that the proposed design of equipment, facilities, or systems is suitable for its intended purpose and meets all user requirements. DQ is performed before procurement or development begins and compares the vendor's or designer's specifications against the user requirements specification. It is the first stage in the IQ/OQ/PQ qualification sequence.
Design Specification (DS)
Design specification is a document that translates the functional requirements specification into a detailed technical design for a computerized system. It describes system architecture, data models, interfaces, algorithms, and configuration details at a level sufficient for developers to build and testers to verify. The DS bridges the gap between what the system should do (FRS) and how it does it.
Deviation
Deviation is a departure from an approved procedure, specification, or established standard. GMP regulations require that all deviations be documented, investigated for root cause, assessed for impact on product quality, and resolved through corrective actions. Unresolved or poorly investigated deviations are a frequent FDA 483 observation.
E
Electronic Batch Record (EBR)
EBR (Electronic Batch Record) is a digital version of the manufacturing batch record that guides operators through production steps and captures data in real time. EBR systems enforce process compliance by preventing out-of-sequence steps, capturing electronic signatures, and flagging deviations automatically. They are typically part of or integrated with Manufacturing Execution Systems (MES).
Electronic Batch Record Software Guide →Electronic Signature
Electronic signature is a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of a handwritten signature. Under 21 CFR Part 11, electronic signatures must be linked to their respective electronic records, include the printed name of the signer, the date and time, and the meaning of the signature (approval, review, verification).
eQMS
eQMS (Electronic Quality Management System) is software that manages quality processes including document control, training management, deviations, CAPA, change control, audit management, and complaint handling. An eQMS replaces paper-based quality systems with validated digital workflows. Leading eQMS platforms include Veeva Vault Quality, MasterControl, and Qualio.
EU Annex 11
EU Annex 11 is the European GMP guideline governing computerised systems used in pharmaceutical manufacturing and quality control. It requires risk management throughout the system lifecycle, data integrity controls, audit trails, and periodic review of validated systems. Annex 11 applies to all EU and EEA member states and is often audited alongside PIC/S guidelines.
EU Annex 22
EU Annex 22 is the draft European GMP annex addressing the use of artificial intelligence and machine learning in GxP-regulated operations. It establishes that adaptive and generative AI models may not autonomously make GMP-critical decisions without human oversight. The annex requires documented AI governance frameworks, model validation, and ongoing monitoring of AI system performance.
EU MDR
EU MDR (European Union Medical Device Regulation 2017/745) is the regulation governing medical devices placed on the European market. It replaced the Medical Device Directive (MDD) and introduced stricter requirements for clinical evidence, post-market surveillance, unique device identification, and notified body oversight. Full MDR compliance has been required since May 2021.
F
Functional Requirements Specification (FRS)
FRS (Functional Requirements Specification) is a document that describes what a computerized system must do to satisfy user requirements. It translates business and regulatory needs from the URS into specific, testable functional statements. Each FRS requirement should be traceable back to a URS requirement and forward to test cases in the OQ.
G
GAMP 5
GAMP 5 (Good Automated Manufacturing Practice, version 5) is the ISPE guideline for risk-based validation of computerised systems in the pharmaceutical industry. It categorizes software into five categories based on complexity and configurability, with validation effort scaled to risk. The GAMP 5 Second Edition, published in 2022, incorporates CSA principles and critical thinking approaches.
GAMP 5 Categories Explained →GAMP Category 1
GAMP Category 1 covers infrastructure software such as operating systems, database engines, and middleware. These are established, commercially available software products that are not configured for GxP purposes. Validation relies on vendor qualification and documented installation verification rather than functional testing.
GAMP 5 Categories Explained →GAMP Category 3
GAMP Category 3 covers non-configured products — commercial off-the-shelf (COTS) software used as-is without configuration changes. Examples include firmware and standard laboratory instruments. Validation focuses on vendor assessment and installation verification, with minimal functional testing required.
GAMP 5 Categories Explained →GAMP Category 4
GAMP Category 4 covers configured products — commercial software that has been configured to meet specific business requirements. Examples include ERP systems, LIMS, and eQMS platforms. Validation effort focuses on verifying the configuration rather than the underlying product, with risk-based testing of configured workflows.
GAMP 5 Categories Explained →GAMP Category 5
GAMP Category 5 covers custom (bespoke) applications built to meet specific user requirements. These require the most rigorous validation because no prior use history exists. Full lifecycle documentation is expected: URS, FRS, DS, code review, unit testing, and comprehensive IQ/OQ/PQ.
GAMP 5 Categories Explained →GCP
GCP (Good Clinical Practice) is the international ethical and scientific quality standard for designing, conducting, recording, and reporting clinical trials involving human subjects. GCP ensures that trial data is credible and that participants' rights, safety, and well-being are protected. ICH E6(R2) is the primary GCP guideline used globally.
GDP
GDP (Good Distribution Practice) is the set of guidelines governing the proper distribution of pharmaceutical products to maintain their quality and integrity throughout the supply chain. GDP covers storage conditions, transportation, traceability, and handling of temperature-sensitive products. Both the EU GDP guidelines and the WHO GDP guidelines are widely adopted.
GLP
GLP (Good Laboratory Practice) is the quality system governing non-clinical laboratory studies that support regulatory submissions for pharmaceuticals, pesticides, and industrial chemicals. GLP ensures the reliability and integrity of study data through defined protocols, qualified personnel, calibrated equipment, and complete documentation. OECD Principles of GLP are recognized internationally.
GMP
GMP (Good Manufacturing Practice) is the set of regulations and guidelines governing the manufacture of pharmaceuticals, medical devices, food, and other regulated products. GMP ensures products are consistently produced and controlled according to quality standards. Key GMP regulations include 21 CFR Parts 210/211 (FDA), EU GMP Annex 1-20, and PIC/S guidelines.
GxP Compliance in Pharma →I
ICH Q10
ICH Q10 is the international guideline establishing a model for a Pharmaceutical Quality System (PQS) that integrates GMP with ICH Q8 (Pharmaceutical Development) and ICH Q9 (Quality Risk Management). It describes management responsibilities, continual improvement, and knowledge management as enablers of an effective quality system. ICH Q10 applies throughout the product lifecycle from development through commercial manufacturing to discontinuation.
ICH Q9
ICH Q9 is the international guideline on Quality Risk Management for the pharmaceutical industry. It provides principles and examples of tools for assessing, controlling, communicating, and reviewing risks to quality throughout the product lifecycle. ICH Q9(R1), the revised version published in 2023, emphasizes formality and documentation proportionate to risk and incorporates lessons learned from subjectivity in risk assessments.
Installation Qualification (IQ)
IQ (Installation Qualification) is the documented verification that equipment, systems, or infrastructure have been installed correctly according to the manufacturer's specifications and design requirements. IQ checks include hardware inventory, software version verification, network configuration, and environmental conditions. It is the first execution phase in the IQ/OQ/PQ qualification sequence.
Types of Validation in Pharma →ISO 13485
ISO 13485 is the international standard specifying requirements for a quality management system in the design, development, production, installation, and servicing of medical devices. It is aligned with regulatory requirements in the EU, Canada, Australia, and other markets. ISO 13485 certification is often a prerequisite for CE marking under the EU MDR.
L
LIMS
LIMS (Laboratory Information Management System) is software that manages laboratory samples, workflows, instruments, and data. LIMS tracks sample receipt, preparation, testing, and results reporting while maintaining chain of custody and data integrity. In GxP environments, LIMS must be validated and maintain audit trails for all laboratory data.
M
MES
MES (Manufacturing Execution System) is software that monitors, controls, and documents manufacturing processes from raw material to finished product. MES enforces production procedures, captures real-time data, manages electronic batch records, and provides traceability. In pharmaceutical manufacturing, MES is a critical GMP system requiring full validation.
O
OOS (Out of Specification)
OOS (Out of Specification) is a test result that falls outside the established acceptance criteria or specifications. FDA guidance requires a thorough, timely, and scientifically sound investigation of all OOS results, starting with laboratory investigation before moving to manufacturing investigation. Inadequate OOS investigations are one of the most common FDA warning letter findings.
OOT (Out of Trend)
OOT (Out of Trend) is a test result that is within specification but shows an atypical pattern compared to historical data. OOT results may indicate a developing problem before specifications are breached. Statistical tools and trend analysis are used to identify OOT results, and organizations are expected to investigate them to determine whether corrective action is needed.
Operational Qualification (OQ)
OQ (Operational Qualification) is the documented verification that equipment or systems operate as intended throughout their specified operating ranges. OQ testing covers functional requirements, boundary conditions, alarm and interlock testing, and security controls. Test cases in OQ should trace directly back to requirements in the FRS and URS.
Types of Validation in Pharma →P
Part 11 Compliance
Part 11 compliance is the state of meeting all requirements defined in 21 CFR Part 11 for electronic records and electronic signatures. Key requirements include validated systems, audit trails, system access controls, authority checks, electronic signature controls, and operational checks. The FDA's 2003 scope and application guidance introduced a risk-based approach to Part 11 enforcement.
Performance Qualification (PQ)
PQ (Performance Qualification) is the documented verification that equipment or systems perform effectively and reproducibly under actual or simulated production conditions. PQ tests real-world workflows using production-representative data and conditions. It is the final stage in the IQ/OQ/PQ qualification sequence and confirms the system is fit for its intended use.
Types of Validation in Pharma →Periodic Review
Periodic review is the scheduled assessment of a validated system to confirm it remains in a validated state and continues to meet its intended requirements. Reviews typically evaluate change history, deviations, incidents, patches, audit findings, and regulatory updates since the last review. EU Annex 11 and GAMP 5 both require periodic review of computerised systems.
Pharmacovigilance
Pharmacovigilance is the science and activities relating to the detection, assessment, understanding, and prevention of adverse effects or other drug-related problems. It spans the entire product lifecycle from clinical development through post-market surveillance. Regulatory agencies require pharmaceutical companies to maintain pharmacovigilance systems and report adverse events within strict timelines.
Q
Qualification
Qualification is the documented process of verifying that equipment, utilities, or systems are properly installed, operate correctly, and perform as intended. The standard qualification sequence is DQ, IQ, OQ, and PQ. Qualification is distinct from validation in that it applies to physical equipment and infrastructure, while validation applies to processes and software.
Types of Validation in Pharma →R
Requirements Traceability Matrix (RTM)
RTM (Requirements Traceability Matrix) is a document that maps every requirement to its corresponding design specification, test case, and test result. The RTM provides bidirectional traceability, ensuring every requirement is tested and every test case traces to a requirement. It is a fundamental deliverable in both CSV and CSA validation approaches.
Revalidation
Revalidation is the process of repeating all or part of a validation exercise to confirm that a system, process, or method remains in a validated state after significant changes. Triggers for revalidation include major software upgrades, infrastructure changes, regulatory updates, and significant process modifications. Organizations must define revalidation criteria in their validation master plan.
Risk Assessment
Risk assessment is the systematic process of identifying hazards, analyzing the likelihood and severity of harm, and evaluating whether risks are acceptable. In GxP validation, risk assessments determine the extent of testing and controls needed for each system function. Common tools include FMEA, risk matrices, and hazard analysis, as described in ICH Q9.
GxP Compliance Checklist →S
SOP
SOP (Standard Operating Procedure) is a documented set of step-by-step instructions for performing routine operations in compliance with regulations and quality standards. SOPs are mandatory under GMP, GLP, GCP, and GDP regulations. They must be approved, version-controlled, periodically reviewed, and available to personnel performing the described activities.
Super Intelligence (SI)
Super Intelligence (SI) is, since a US executive order of 29 September 2026, the term the US federal executive branch uses in non-statutory materials for what everyone else calls artificial intelligence. The order defines SI as the technologies and systems already encompassed by "artificial intelligence" under 15 U.S.C. 9401(3), so the scope is unchanged and the two terms are equivalent. It does not carry the academic meaning of a system exceeding human performance across all domains, and it does not alter any regulation: 21 CFR Part 11, EU GMP Annex 11, the draft Annex 22 and GAMP 5 are unaffected.
What Is Super Intelligence (SI)? →Supplier Qualification
Supplier qualification is the process of evaluating and approving vendors of materials, components, equipment, or services that affect product quality. For software vendors, qualification includes assessing quality management systems, development practices, support capabilities, and regulatory compliance. GAMP 5 provides guidance on supplier assessment for computerised system vendors.
U
User Requirements Specification (URS)
URS (User Requirements Specification) is a document describing what the user needs a computerized system to do, written in business and regulatory language rather than technical terms. The URS is the foundation of the validation lifecycle — all subsequent specifications and test cases trace back to URS requirements. Each requirement should be specific, measurable, and testable.
V
V-Model
V-Model is a software development and validation lifecycle model where each development phase has a corresponding testing phase. The left side defines requirements and design (URS, FRS, DS), the bottom is development, and the right side executes corresponding tests (IQ, OQ, PQ). The V-Model ensures every requirement is verified through a traceable testing counterpart.
GxP Software Validation Checklist →Validation Master Plan (VMP)
VMP (Validation Master Plan) is a high-level document that describes the overall validation strategy, scope, responsibilities, and schedule for an organization's computerized systems. It defines the validation lifecycle, documentation standards, roles, risk management approach, and criteria for periodic review and revalidation. A VMP provides auditors with a roadmap of the organization's validation program.
Frequently Asked Questions
What is GAMP 5?
GAMP 5 (Good Automated Manufacturing Practice, version 5) is the ISPE guideline for risk-based validation of computerised systems in the pharmaceutical industry. It categorizes software into five categories based on complexity and scales validation effort to risk. The Second Edition, published in 2022, incorporates Computer Software Assurance (CSA) principles.
What is 21 CFR Part 11?
21 CFR Part 11 is the FDA regulation establishing criteria for electronic records and electronic signatures. It requires audit trails, system validation, access controls, and authority checks. Any GxP system generating or maintaining electronic records must comply with Part 11.
What is ALCOA+ in data integrity?
ALCOA+ is a data integrity framework standing for Attributable, Legible, Contemporaneous, Original, and Accurate, plus Complete, Consistent, Enduring, and Available. Regulators use ALCOA+ principles to assess whether records — electronic or paper — meet data integrity expectations in GxP environments.
What is the difference between CSV and CSA?
CSV (Computer System Validation) is the traditional documentation-heavy approach to software validation. CSA (Computer Software Assurance) is the FDA's updated risk-based approach that emphasizes critical thinking over exhaustive documentation. CSA focuses testing effort on the highest-risk functionality rather than testing everything equally.
What is CAPA in pharmaceutical quality?
CAPA (Corrective and Preventive Action) is a quality system process for investigating quality problems, correcting them, and preventing recurrence. Corrective actions fix existing issues; preventive actions address potential problems. CAPA effectiveness is one of the most scrutinized areas during regulatory inspections.
What is IQ OQ PQ in validation?
IQ (Installation Qualification), OQ (Operational Qualification), and PQ (Performance Qualification) are the three execution phases of equipment and system qualification. IQ verifies correct installation, OQ verifies correct operation across specified ranges, and PQ verifies performance under real-world conditions.
What is an eQMS?
An eQMS (Electronic Quality Management System) is software that manages quality processes including document control, training, deviations, CAPA, change control, audits, and complaints. It replaces paper-based quality systems with validated digital workflows and provides audit trails required by GxP regulations.
What is EU Annex 11?
EU Annex 11 is the European GMP guideline for computerised systems in pharmaceutical manufacturing and quality control. It requires risk management, data integrity controls, audit trails, and periodic review. Annex 11 applies across EU and EEA member states and is often assessed alongside PIC/S guidelines.
What is a Requirements Traceability Matrix (RTM)?
An RTM maps every user requirement to its corresponding design specification, test case, and test result, providing bidirectional traceability. It ensures no requirement goes untested and no test exists without a requirement. The RTM is a fundamental deliverable in both CSV and CSA validation approaches.
What is ICH Q9 Quality Risk Management?
ICH Q9 is the international guideline on Quality Risk Management for pharmaceuticals. It provides principles and tools (FMEA, fault trees, risk matrices) for assessing, controlling, and reviewing risks to quality. The revised ICH Q9(R1) emphasizes documentation proportionate to risk and addresses subjectivity in risk assessments.
See it on your own data. In 30 minutes.
Bring a system, a URS, or an AE listing. We'll show you how GxP Copilot and TraceDraft compress the validation and clinical documentation cycle without compromising Part 11 or Annex 22 posture.