Part 11. CAPA. Batch release. Each question answered, with its source.

GxP is shorthand for the good practice rules regulators set for medicines and related products, where the “x” names the field: good manufacturing practice (GMP), good laboratory practice (GLP), good clinical practice (GCP), good distribution practice (GDP) and good pharmacovigilance practice (GVP).

GMP and cGMP name the same discipline: the controls that make sure medicines are consistently made and checked to the quality their use requires.

21 CFR Part 11 sets the conditions under which FDA accepts electronic records and signatures in place of paper.

An FDA Form 483, Inspectional Observations, is the written list of objectionable conditions an FDA investigator hands to a company’s management at the end of an inspection, when in their judgement products may be adulterated or the law may have been violated.

A Form 483 lists the objectionable conditions an investigator observed, handed to management at the end of an inspection, and it is not FDA’s final finding.

The Quality Management System Regulation (QMSR) is FDA’s revised 21 CFR Part 820, the CGMP rule for medical devices, in effect since 2 February 2026.

21 CFR Part 211 holds FDA’s detailed current good manufacturing practice requirements for finished pharmaceuticals, from the quality control unit, buildings and equipment to production, laboratory controls and batch records.

ISO 9001 sets quality management system requirements for any organisation in any sector; its current edition is ISO 9001:2026.

A 503A pharmacy compounds drugs for identified individual patients on valid prescriptions, is overseen mainly by state boards of pharmacy and is exempt from federal CGMP requirements.

GLP, GMP and GCP are the quality rules for three kinds of regulated work.

21 CFR Part 11 is a US regulation.

The draft revision of EU GMP Annex 11, put out for consultation by the European Commission and PIC/S from 7 July to 7 October 2025, rewrites the 2011 annex in far more detail.

EU GMP Annex 1 is the guidance in EudraLex Volume 4 for manufacturing sterile medicinal products.

Responding to an FDA Form 483 is voluntary, but FDA recommends a written response within 15 business days of the date the 483 was issued.

NAI, VAI and OAI are FDA’s three final inspection classifications.

Start with FDA’s Data Dashboard: search the firm for its inspections, final NAI, VAI or OAI classifications, citations and any 483s FDA has published.

Since 2 February 2026, 21 CFR Part 820, now the Quality Management System Regulation, incorporates ISO 13485:2016 by reference, so the core quality system requirements are the same.

ICH Q7 is the International Council for Harmonisation’s good manufacturing practice guide for active pharmaceutical ingredients, finalised on 10 November 2000.

Quality by design is ICH Q8(R2)’s name for a systematic approach to development that begins with predefined objectives and emphasises product and process understanding and process control, based on sound science and quality risk management.

A Qualified Person (QP) is the person every EU manufacturing or import authorisation holder must have at its disposal under Directive 2001/83/EC.

Both require qualified staff, written procedures, complete batch records, investigated deviations and quality approval before release, but they are built differently.

EudraLex Volume 4 is the European Commission’s collection of good manufacturing practice guidelines for medicines.

PIC/S, the Pharmaceutical Inspection Co-operation Scheme, is a non-binding, informal arrangement between 57 medicines regulatory authorities, including the FDA, MHRA, Health Canada, TGA and most EU national inspectorates, that harmonises GMP standards and inspector training.

A GMP certificate is issued to a manufacturing site, not a person or product, by the regulator that inspected it, confirming the site complies with GMP for the activities inspected.

GMP’s basic principle is that medicines are made consistently to the quality their use and authorisation require.

An HCT/P is human cells or tissue intended for implantation, transplantation, infusion or transfer into a person, such as bone, skin or cord blood.

An NDA asks FDA to approve a new drug under section 505(b) of the FD&C Act, on evidence that it is safe and effective.

A drug master file is a confidential submission to FDA about facilities, processes or articles used to make, process, package or store human drugs.

The Common Technical Document is the ICH M4 format for the dossier in an application to register a human medicine.

Not as medical devices.

Yes, for device manufacturers.

A pre-approval inspection (PAI) is an FDA inspection of a manufacturing or testing site named in a pending NDA or ANDA, made before approval when FDA judges one necessary.

An FDA investigator arrives, usually unannounced for a domestic surveillance inspection, shows credentials and issues Form FDA 482.

Computer system validation (CSV) is the documented process of showing that a computerised system used in GxP work does what its intended use requires, reliably and consistently.

Computer software assurance (CSA) is FDA’s risk-based approach to establishing confidence that software used in production or the quality management system is fit for its intended use.

ALCOA describes data that are attributable, legible, contemporaneous, original and accurate.

IQ, OQ and PQ are the stages of qualifying equipment, utilities, facilities and systems.

Data integrity is the degree to which data are complete, consistent and accurate, and stay so throughout their life cycle.

An audit trail review is the documented check of who created, changed or deleted GxP data, when and why, done as part of reviewing the record itself.

GAMP 5 Second Edition groups software components into Category 1, infrastructure software, tools and IT services; Category 3, standard system components; Category 4, configured components; and Category 5, custom applications and components.

FDA’s 2011 guidance divides process validation into three stages.

Cleaning validation is documented evidence that an approved cleaning procedure reproducibly removes the previous product and cleaning agents below a scientifically set limit.

All four interpret existing GMP or GxP rules rather than adding new ones, and all expect attributable, legible, contemporaneous, original and accurate records, risk-based controls and audit trails reviewed with the data.

Under 21 CFR 11.10(e), audit trails must be secure, computer-generated and time-stamped, independently recording the date and time of entries and actions that create, modify or delete electronic records, without obscuring earlier information, and kept at least as long as the records.

EU GMP Annex 11 applies to every computerised system used in GMP-regulated work.

GAMP 5 is ISPE’s risk-based guide to compliant GxP computerised systems: industry good practice for keeping systems fit for intended use, not a regulation.

A user requirements specification (URS) is the controlled document that defines what equipment, a facility or a computerised system must do for its intended use.

A requirements traceability matrix is a table linking each user requirement to the specification that meets it and to the tests and results that verify it, so reviewers can see that every requirement was tested and every test has a purpose.

Risk-based validation sets the scope and depth of testing from a documented assessment of what each function’s failure could do to patient safety, product quality and data integrity.

The regulated company validates a SaaS or cloud system for its own intended use and stays accountable for it, even when the vendor builds, hosts, tests and runs it.

Yes.

A validation master plan (VMP) is the high-level document that sets out a site’s whole qualification and validation programme: its policy, organisation and responsibilities, the facilities, equipment, systems and processes in scope with their status, the strategy including requalification, change and deviation handling, and guidance on acceptance criteria.

Calibration compares a measuring instrument’s readings with a reference standard of known value.

Continued process verification (CPV) is the third stage of FDA’s process validation lifecycle: an ongoing programme that collects and statistically trends process and product data during commercial manufacture to show the process stays in a state of control.

There is no fixed number.

The difference is when validation happens relative to sale.

MACO, the maximum allowable carryover, is the most residue of one product that the next product made on shared equipment can safely contain.

The violations FDA and PIC/S guidance keep returning to are shared logins that hide who did what; audit trails switched off or never reviewed; real samples run as test or system suitability injections before the official run; reprocessing chromatography and keeping only the final result; invalidating failing results without a scientific investigation; recording data on scraps of paper or uncontrolled forms; and entries not made at the time of the work.

CAPA, corrective and preventive action, is the part of a pharmaceutical quality system that turns problems into lasting fixes.

Quality control (QC) checks that materials and products meet their specifications by sampling and testing them and judging each batch’s results.

A deviation is a departure from an approved instruction or established standard, such as an exceeded hold time or a test run outside its method.

Root cause analysis is the part of an investigation that finds why a deviation, defect or complaint happened, so corrective and preventive action removes the cause, not the symptom.

Change control is the system a pharmaceutical company uses to propose, evaluate, approve, implement and review changes that could affect product quality, such as changes to materials, processes, equipment, methods, facilities or software.

An annual product review is a documented evaluation, at least yearly, of each product’s quality data to decide whether its specifications, process or controls need to change.

An FMEA breaks a process into steps, lists how each step could fail, and rates each failure mode for severity, likelihood of occurrence and likelihood of detection.

Quality risk management is a systematic process for the assessment, control, communication and review of risks to the quality of a medicinal product across its lifecycle, set out in ICH Q9.

ISO does not certify anyone.

ICH Q10 is the harmonised model for a pharmaceutical quality system, finalised by ICH in June 2008 and published by FDA as guidance in April 2009; in the EU it sits in Part III of the GMP guidelines.

A correction eliminates a detected nonconformity, for example by rework or regrade.

Check whether the problem the CAPA targeted has stopped or fallen, against criteria set before the action took effect: the event definition, the population, a rate measured against exposure, the window and the pass mark.

A deviation investigation report is the written record 21 CFR 211.192 requires.

A deviation is a departure from an approved instruction or established standard, such as a skipped procedure step or an exceeded hold time.

A nonconformance report (NCR) records a product, material or output that does not meet a specified requirement: what failed, against which requirement, how it was contained and evaluated, and its disposition, such as rework, repair, concession or scrap.

A planned deviation is a departure from an approved procedure, instruction or specification that is approved before it happens.

Not on its own.

Record every written and oral complaint under a written procedure.

A management review is senior management’s formal, periodic review of whether the quality system remains suitable and effective.

Every GMP instruction, such as a procedure or specification, is reviewed and approved by authorised people, including the quality unit, before its effective date.

A GMP SOP gives directions for performing an operation.

GMP requires everyone whose work can affect product quality to be trained in the operations they perform and in GMP, and to keep being trained.

A GMP internal audit, which EU GMP calls a self-inspection, is a planned and recorded check by competent, independent people that a site follows GMP and its own quality system, with corrective actions recorded.

Pharmaceutical quality metrics are objective measures of how well manufacturing and the quality system perform, such as lot acceptance rate, right-first-time rate, invalidated out-of-specification rate, complaint rate and CAPA effectiveness.

A quality manual is the top-level document that describes a company’s quality management system: its quality policy, scope, processes and how they link, and management responsibilities.

Clinical quality assurance is the planned, systematic work that makes sure a trial is performed and its data are generated, recorded and reported in compliance with GCP and the regulations.

An electronic batch record (eBR) is a batch production record created, completed and kept in a computer system instead of on paper.

A master batch record is the approved set of instructions for making a product at a set batch size: its formula, equipment, steps, limits and expected yields.

EU GMP Annex 1 makes environmental monitoring part of the contamination control strategy.

Review by exception means QA reviews a batch record through a validated report of predetermined exceptions, such as out-of-limit values, changed data and deviations, instead of reading every entry line by line.

Before release, the quality unit must review and approve all of a batch’s production and control records, including packaging and labelling, to confirm the approved procedures were followed, and investigate any unexplained discrepancy or failed specification (21 CFR 211.192).

Under 21 CFR 211.188, every batch needs a production and control record with complete information on how it was made and controlled.

Draw a single line through the wrong entry so it stays readable, write the correct entry, and initial or sign and date the change.

Line clearance is the documented check, before a processing or packaging operation starts, that the area, line and equipment are clean and free of products, materials, labels and documents from the previous operation.

EU GMP Annex 1 defines four cleanroom grades for sterile manufacturing.

A contamination control strategy is the planned set of controls for microorganisms, endotoxin and pyrogens, and particles that EU GMP Annex 1 expects across a sterile manufacturing site.

A media fill, or aseptic process simulation, runs an aseptic process with sterile growth medium in place of the product, then incubates the filled units to show whether contamination got in.

PUPSIT, the pre-use post-sterilisation integrity test, checks a sterilising grade filter for damage after it has been sterilised and before product passes through it.

Chain of identity is the permanent link between a patient or donor and their cells, kept from collection to treatment by unique identifiers checked at each step.

Technology transfer is the planned, documented move of a product, process or analytical method, with the knowledge behind it, from a sending unit to a receiving unit: from development to manufacturing, or between sites.

Lot genealogy is the record of which material lots went into which batches, and where each batch went.

In the US, cell and gene therapies regulated as biologics need CGMP at every phase.

Under 21 CFR 211.180, US batch production, control and distribution records are kept for at least one year after the batch’s expiry date, or three years after distribution for OTC products exempt from expiry dating.

Percentage of theoretical yield is actual yield divided by theoretical yield, times 100, at each appropriate phase of manufacture.

Under 21 CFR 211.182, major equipment needs a log of its cleaning, maintenance (other than routine lubrication and adjustment) and use, showing the date, time, product and lot number of each batch processed, signed or initialled by the people who did and checked the work, in chronological order.

An OOS (out-of-specification) result falls outside a specification or acceptance criterion and must be investigated, even if the batch is rejected.

Investigate in phases.

In ICH Q1A(R2)’s general case, long-term testing is at 25 °C ± 2 °C/60% RH ± 5% RH or 30 °C ± 2 °C/65% RH ± 5% RH, intermediate at 30 °C/65% RH and accelerated at 40 °C ± 2 °C/75% RH ± 5% RH.

An alert level is an early warning: a microbial or particle level, set from your own qualification and trend data, that signals drift from normal conditions and calls for scrutiny and follow-up, not necessarily corrective action.

No GMP regulation sets a fixed calibration interval.

A certificate of analysis identifies the material, its grade, batch number, release date and expiry or retest date.

ICH Q2(R2), adopted on 1 November 2023, sets out how to show an analytical procedure is fit for its intended purpose.

Validation shows that an analytical procedure is fit for its intended purpose, through planned studies of characteristics such as specificity, accuracy, precision and range.

Reserve samples let a batch be tested or examined again.

The new ICH Q1 merges Q1A(R2), Q1B, Q1C, Q1D, Q1E and Q5C into one stability guideline for synthetic and biological products.

Sample management is the control of each sample from the plan that calls for it through sampling, labelling, receipt, storage, testing, retention and disposal, so every result traces to a known, representative sample.

Qualify a supplier by assessing its suitability before use, approving it for a defined material and supply chain, agreeing specifications and responsibilities in writing, then monitoring it.

A quality agreement is a written agreement between a product owner and a contract manufacturer or laboratory that says which party carries out each GMP activity.

Handle a temperature excursion as a deviation.

Check each delivery on arrival for correct labelling, damage, broken seals and contamination, give each lot a receipt code, and hold it in physical or administrative quarantine.

No regulation requires the √n+1 rule.

Partly.

Good distribution practice (GDP) is the part of quality assurance that keeps a medicine’s quality and integrity while it is bought, stored, transported and supplied, and keeps falsified products out of the legal supply chain.

A LIMS manages samples and their testing: it registers each sample, assigns tests, methods and specifications, records results and routes them for review and disposition.

A LIMS (laboratory information management system) is software that runs a laboratory’s testing and keeps its records.

ERP (enterprise resource planning) runs the business side of manufacturing: orders, purchasing, materials, inventory and distribution.

Software is not Part 11 or GMP compliant by itself; compliance belongs to the system as your organisation uses it.

There is no standard price for a LIMS, and no regulator sets one.

An eQMS (electronic quality management system) is software that runs a company’s quality processes and keeps their records: controlled documents and training, deviations and nonconformances, investigations and CAPA, change control, complaints, audits, suppliers and management review.

No regulator sets or publishes eQMS prices, so the licence figure comes from vendors’ quotes.

A manufacturing execution system (MES) manages and records production operations.

Start from the quality processes you run and the rules they fall under, not from a vendor’s feature list.

Choose a LIMS by writing down what your laboratory records must hold and control, then testing shortlisted systems against it.

No regulation sets a timeline for a LIMS implementation.

A document management system (DMS or EDMS) controls documents: drafting, review, approval, versions, distribution and retention.

An electronic lab notebook (ELN) is software that replaces the paper notebook: scientists record methods, samples, observations, calculations and results as they work.

No regulation requires an electronic QMS; controlled paper is acceptable.

Treat it as redesigning the batch record, not scanning it.

Choose from your process outward.

A LIMS holds samples, tests and results; an MES runs and records each batch; a QMS holds procedures, training, deviations, CAPA and change control.

No regulation sets a timetable.

Connect each instrument so its results reach the LIMS without retyping, with sample identity, units and method attached, and keep the original electronic record, raw data and audit trail where a reviewer can reach them.

Yes.

Annex 22 is a draft new annex to the EU GMP Guide for AI models in critical GMP applications, consulted on by the European Commission and PIC/S from July to October 2025.

FDA’s guidance is a January 2025 draft, still not final, on AI that produces information or data supporting regulatory decisions about drug safety, effectiveness or quality, manufacturing included.

Validate it like any GxP computerised system, from intended use and risk, then add what models need: a detailed intended use covering the input data, metrics and acceptance criteria approved before testing, test data kept independent of training data, a pre-approved test plan, and change control, configuration control and performance monitoring in use.

Warning letter 320-26-58 of 2 April 2026 to Purolea Cosmetics Lab in Livonia, Michigan, gave AI its own heading: “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing”.

Yes, for supporting work that qualified people check, but not in critical GMP applications.

AI can prepare a batch record review, but it cannot be the reviewer of record.

Yes, as a drafting and evidence-gathering aid, but people must own the investigation.

Yes, as a drafting aid, if qualified people review and approve every document before it is used.

Partly.

Human in the loop means a qualified, trained person checks an AI output before it is used in a GMP decision and stays responsible for it.