Part 11. CAPA. Batch release. Each question answered, with its source.

GxP means good “x” practice, a collective term for the quality rules regulators set for medicines, where the x names the field: manufacturing (GMP), laboratory safety studies (GLP), clinical trials (GCP), distribution (GDP) and pharmacovigilance (GVP).

There is no difference in kind.

Part 11 requires validated systems, secure time-stamped audit trails and access limited to authorised people.

An FDA Form 483, Inspectional Observations, is the signed list of significant objectionable conditions an FDA investigator gives a site’s management at the close of an inspection.

A Form 483 lists conditions an FDA investigator observed, handed to management as the inspection closes.

The Quality Management System Regulation (QMSR) is FDA’s current 21 CFR Part 820, the good manufacturing practice rule for medical devices, effective 2 February 2026.

Part 211 is FDA’s detailed CGMP rule for finished drug products: 60 sections in 11 subparts, from the quality unit to returned goods, the part inspectors cite.

ISO 9001 sets quality management requirements for any organisation; its sixth edition, ISO 9001:2026, was published in September 2026.

A 503A pharmacy compounds for identified patients on valid prescriptions, is overseen mainly by state boards of pharmacy and is exempt from federal CGMP.

GLP, GMP and GCP are the quality rules for three kinds of regulated work.

21 CFR Part 11 is a US regulation setting when FDA accepts electronic records and signatures in place of paper, for any record its rules require.

The draft revision of EU GMP Annex 11, consulted on until 7 October 2025, would replace the 2011 annex with a 19-page text.

EU GMP Annex 1 is the European Commission’s guideline for manufacturing sterile medicines, part of EudraLex Volume 4 and shared with PIC/S.

You don’t have to respond to an FDA Form 483, but FDA recommends one response within 15 business days of the date it was issued, and reviews a timely response in detail before deciding on a warning letter.

NAI, VAI and OAI are FDA’s final inspection classifications.

Search the site on FDA’s Data Dashboard by its FDA Establishment Identifier (FEI): it shows final NAI, VAI or OAI classifications, 483 citations, recalls, import refusals and any 483 published in the OII FOIA Electronic Reading Room.

Since 2 February 2026, 21 CFR Part 820, the Quality Management System Regulation, incorporates ISO 13485:2016, so the core requirements are the same.

ICH Q7 is the harmonised good manufacturing practice guide for active pharmaceutical ingredients.

Quality by design is ICH Q8(R2)’s systematic approach to development: begin with predefined objectives, understand how materials and process affect quality, and control them using science and quality risk management.

A Qualified Person (QP) is the legally qualified individual every EU manufacturing or import authorisation holder must have at its disposal.

Both require trained staff, written procedures, complete batch records, investigated deviations and a quality function independent of production.

EudraLex Volume 4 is the European Commission’s EU GMP guide.

PIC/S, the Pharmaceutical Inspection Co-operation Scheme, is a non-binding arrangement between 57 medicines regulators, including the FDA, MHRA, Health Canada, TGA and most EU inspectorates, that harmonises GMP standards, trains inspectors and assesses inspectorates.

A GMP certificate is a regulator’s statement that one manufacturing site complied with GMP for the activities inspected.

GMP’s core principle is that medicines are consistently made and controlled to the quality their use and authorisation require: quality is built in, not tested in.

An HCT/P is human cells or tissue intended for implantation, transplantation, infusion or transfer into a person, such as bone, skin or cord blood.

All three ask FDA to allow a product onto the US market.

A drug master file (DMF) is a confidential submission to FDA describing facilities, processes or articles used to make, package or store human drugs.

The Common Technical Document (CTD) is the ICH M4 format for the dossier that registers a human medicine.

Not as medical devices.

Yes, for device manufacturers.

A pre-approval inspection (PAI) is FDA’s on-site check of a facility named in a pending application; for an original BLA it is called a pre-license inspection.

FDA usually arrives unannounced for a domestic drug surveillance inspection and calls ahead for pre-approval and most foreign ones.

A site master file describes one manufacturing site’s GMP activities in, as far as possible, no more than 25 to 30 pages plus appendices.

It depends on how likely the change is to harm the product’s identity, strength, quality, purity or potency.

The approving application decides.

Type IA has minimal or no impact: make it, then notify, usually in one annual update 9 to 12 months after the first.

Each constituent part keeps its own CGMP rules, and a site making both can meet every set in full or run one base system plus named provisions of the other.

A device manufacturer or importer must report a correction or removal to FDA within 10 working days of starting it if it was started to reduce a risk to health, or to remedy a violation that may present one.

The design history file records how a device’s design was developed; the device master record holds the specifications and procedures for building it; the device history record shows how each lot or unit was built.

Computer system validation (CSV) is documented evidence that a GxP computerised system is fit for its intended use and stays that way.

CSV and CSA both show software is fit for its intended use.

ALCOA+ names the attributes regulators expect of GxP data, on paper or electronic: attributable, legible, contemporaneous, original and accurate (ALCOA), plus complete, consistent, enduring and available.

IQ, OQ and PQ are the three test stages that qualify equipment, utilities and facilities.

Data integrity is the completeness, consistency and accuracy of data, kept that way from creation to disposal.

An audit trail review is the documented check that the creations, changes and deletions behind GxP data are complete, attributable and justified.

GAMP 5 Second Edition groups software components into four categories: 1, infrastructure software, tools and IT services; 3, standard system components; 4, configured components; and 5, custom applications and components.

FDA’s 2011 guidance divides process validation into three stages.

Cleaning validation is documented evidence that an approved cleaning procedure reproducibly removes the previous product, cleaning agents and microbial contamination from shared equipment to below a scientifically justified limit, in the EU one based on toxicology.

Four guidances set the reference: FDA’s Data Integrity and Compliance With Drug CGMP Q&A (December 2018), MHRA’s GxP Data Integrity Guidance and Definitions (Revision 1, March 2018), PIC/S PI 041-1 (July 2021) and WHO TRS 1033 Annex 4 (2021).

An audit trail is a secure, computer-generated, time-stamped record of who created, changed or deleted a GxP record, what changed and when, without obscuring the earlier value.

EU GMP Annex 11 applies to every computerised system used in GMP work.

GAMP 5 is ISPE’s guide to risk-based validation of GxP computerised systems; GAMP stands for Good Automated Manufacturing Practice.

A user requirements specification (URS) is the approved, controlled document stating what equipment, a utility or a computerised system must do for its intended use.

A requirements traceability matrix links each user requirement to the design or configuration that meets it, the test or other verification that proves it, and the result.

Risk-based validation sets how much you test each function of a computerised system from a documented assessment of what its failure could do to patients, product quality and data integrity.

You validate a SaaS system for your own intended use, and you stay accountable even though the vendor builds, hosts, tests and runs it.

Yes.

A validation master plan (VMP) is a site’s short summary of its whole qualification and validation programme: policy, responsibilities, an inventory of facilities, utilities, equipment, systems and processes with status and schedule, and how changes, deviations, acceptance criteria and requalification are handled.

Calibration shows an instrument’s readings agree with a reference standard within set limits.

Continued process verification (CPV) is Stage 3 of FDA’s process validation lifecycle: an ongoing programme that collects and statistically trends data from commercial batches to show the process stays in a state of control.

No regulation fixes the number.

They differ in when the evidence is gathered relative to sale.

MACO, the maximum allowable carryover, is the most residue of one product that the next product made on shared equipment can safely contain.

FDA’s 2026 warning letters cite familiar violations: shared logins and analysts with administrator rights; audit trails off, or changes made outside them; trial injections of real samples; failing results dropped while a passing retest is reported; deleted data with no backup; original printouts thrown away; backdated or fabricated records; and uncontrolled blank forms.

No regulation sets a numeric blend uniformity limit.

Manufacturers must control the critical aspects of their operations through qualification and validation across the lifecycle, planned in a validation master plan and scoped by documented risk assessment.

A smoke study makes cleanroom airflow visible with a tracer and films it, at rest and during the real interventions of a run.

Manual integration is allowed when the validated method’s automatic integration cannot integrate a peak correctly and an approved SOP covers that situation.

Under FDA’s guide, phase 1 is two to four weeks of daily sampling after each purification step and at each point of use, to set operating ranges and SOPs; WHO says the water is not used.

USP <1058> is an informational chapter: it recommends a risk-based way to show analytical instruments are fit for intended use but prescribes no exact tests or limits, which come from technique chapters and your methods.

21 CFR 211.68 allows automatic, mechanical and electronic equipment, including computers, if it is calibrated, inspected or checked under a written programme, with records.

CAPA, corrective and preventive action, is the pharmaceutical quality system process that finds why a problem happened or could happen and removes that cause.

Quality control (QC) samples and tests materials and products against their specifications and judges each batch’s results.

A deviation is a departure from an approved instruction or established standard, such as an exceeded hold time, a skipped check or an instrument used past calibration.

Root cause analysis finds why a deviation or failure happened, so the CAPA removes the cause, not the symptom.

Change control is the GMP system for proposing, assessing, approving, implementing and reviewing planned changes that could affect product quality, a validated state or the marketing authorisation.

An annual product review is a documented evaluation, at least once a year, of a product’s batches, complaints, recalls, returns and investigations, to decide whether its specifications, process or controls need to change.

Break the process into steps, list how each can fail, and rate each failure mode for severity, occurrence and detection.

Quality risk management is a systematic process for assessing, controlling, communicating and reviewing risks to a medicine’s quality across its lifecycle, set out in ICH Q9.

ISO 13485 certification comes from a certification body, not ISO: a Stage 1 readiness audit, a Stage 2 audit of the whole system, then a three-year certificate with yearly surveillance.

ICH Q10 is the ICH guideline, final since 4 June 2008, that describes a pharmaceutical quality system for a product’s whole lifecycle, run under senior management’s responsibility.

A correction fixes the nonconformity itself, for example by reworking, regrading or rejecting a batch.

A CAPA effectiveness check, or verification of effectiveness, tests whether the problem stopped, not whether tasks were done.

A deviation investigation report is the written record GMP expects: 21 CFR 211.192 requires one for unexplained discrepancies, and EU GMP 1.8(vii) requires significant deviations to be investigated to root cause.

A deviation is a departure from an approved instruction or established standard, such as a skipped step or an exceeded hold time.

A nonconformance report (NCR) records an item that fails a requirement: what failed, against which specification, how it was contained and evaluated, and the authorised disposition.

A planned deviation is a one-off departure from an approved instruction, approved in writing by QA before the work and limited to a set scope such as one batch.

Only when the investigation proves it.

Log every written and oral complaint under a written procedure, then sort it: possible quality defect, adverse event or suspected falsification, and class any defect as critical, major or minor.

A management review is senior management’s formal, periodic review of whether the quality system remains suitable, adequate and effective.

Document control means every GMP instruction, from SOPs and specifications to master batch records and blank forms, is uniquely identified, approved by authorised people, given a defined effective date and available in its current version where the work happens.

Write a GMP SOP for your own facility: a header with number, revision and effective date; purpose, scope and responsibilities; numbered imperative steps in order, each check with its limit and each decision with its criteria, including what to do when a step fails; then records, change history and approvals.

Everyone whose work can affect quality must be trained in their operations and in GMP, continually; no general refresher interval is set.

A GMP internal audit, which EU GMP calls a self-inspection, is a planned, recorded check by competent people independent of the area that a site follows GMP and its own procedures, with corrective actions tracked to completion.

Pharmaceutical quality metrics are objective measures of how well manufacturing and the quality system perform, such as lot acceptance, right first time, invalidated out-of-specification results, complaints and CAPA effectiveness.

A quality manual is the top-level document describing a company’s quality system: its policy, scope, processes and how they link, responsibilities and documentation structure.

Clinical quality assurance is the sponsor’s system of documented procedures and risk-based checks, applied throughout a trial, that finds the causes of serious noncompliance with the protocol, GCP and the law so they can be corrected and prevented.

Pick a released batch and start the exercise without warning, sometimes out of hours.

FDA assigns the class after its own health hazard evaluation.

Handwritten GMP entries are made legibly in indelible ink, at the time, by the person who did the task, with their own initials or signature.

A complaint is MDR reportable when information reasonably suggests your device may have caused or contributed to a death or serious injury, or malfunctioned in a way likely to cause or contribute to one if it recurred; FDA presumes recurrence.

An electronic batch record (eBR) is a batch’s production record, issued from the approved master and completed in a computer system as work happens: entries saved when made, values checked against limits, changes kept in an audit trail, signatures linked to the record.

A master batch record is the approved set of instructions for making one product at one batch size: its formula, equipment, steps, limits and expected yields.

EU GMP Annex 1 asks for a documented, risk-based environmental monitoring programme within the contamination control strategy.

Review by exception means QA reviews a batch record through a validated report of predetermined exceptions, such as out-of-limit values, changed data, alarms and deviations, instead of reading every entry.

Before release, the quality unit reviews and approves every production and control record, packaging and labelling included, and has any unexplained discrepancy, out-of-limit yield or failed specification investigated (21 CFR 211.192).

Under 21 CFR 211.188, every batch needs a production and control record with complete information on how it was made and controlled.

Draw a single line through the wrong entry so it stays readable, write the correct entry beside it, and initial or sign and date the change.

Line clearance is the documented check, made immediately before a packaging or processing operation starts, that the line, room and equipment hold nothing from the previous job, whether product, printed materials, documents or printer settings, and that equipment is clean and set up for the next one.

EU GMP Annex 1 defines four cleanroom grades for sterile products.

A contamination control strategy (CCS) is the documented, site-wide set of controls for microorganisms, endotoxin and particles that EU GMP Annex 1 expects of sterile manufacturers.

A media fill, or aseptic process simulation, runs an aseptic process with sterile growth medium instead of product and incubates the units to show whether contamination got in.

PUPSIT, the pre-use post-sterilisation integrity test, checks a sterilising grade filter after sterilisation and before product passes through it, so damage from preparation is found before product can mask it.

Chain of identity is the permanent link between a patient or donor and their cells, kept from collection to treatment by unique identifiers checked at every handoff.

Technology transfer is the planned, documented move of a product, process or analytical method, with the knowledge behind it, from a sending unit to a receiving unit: from development to manufacturing, or between sites.

Lot genealogy is the record of which material lots went into which batches, and where each batch went.

In the US, cell and gene therapies need CGMP at every phase.

In the US, batch production, control and distribution records are kept at least one year after the batch’s expiry date (21 CFR 211.180(a)), or three years after distribution for expiry-exempt OTC products.

Percentage of theoretical yield is actual yield ÷ theoretical yield × 100, at each appropriate phase; theoretical yield is what the components could give with no loss.

An equipment logbook records, in time order, each use of a piece of major equipment with the date, time, product and batch number, and each cleaning and non-routine maintenance, signed by the person who did it and, in the US, the person who checked it.

21 CFR 211.111 asks for production time limits where appropriate.

F0 is a steam cycle’s lethality in equivalent minutes at 121 °C for organisms with a z-value of 10 °C.

Put the lot’s assay on the as-is basis, then scale the label-claim quantity by it.

EU GMP Annex 1 gives guidance values of at least 10 Pa between rooms of different grades, a clean-up time under 20 minutes and unidirectional airflow of 0.36 to 0.54 m/s.

Gowning qualification proves a person can don a sterile gown without contaminating it: training, an observed gowning against a checklist, and samples from gloved fingers, forearms, chest and hood over enough sessions to show consistency.

A RABS is a rigid-walled enclosure with integrated gloves that keeps grade A air around the critical zone but is not fully sealed.

Reprocessing repeats a step in the established process, such as a repeat crystallisation; reworking uses a step the process lacks, such as recrystallising from a new solvent.

Qualify each manual inspector at least annually (EU Annex 1) on a controlled test set of good and defective units from the defect library, under worst-case time, speed, container size and fatigue, with eyesight checks.

An OOS (out-of-specification) result falls outside its specification and must be investigated.

Investigate in phases.

Under ICH Q1A(R2), for synthetic drugs, long-term studies run at 25°C/60% RH or 30°C/65% RH, intermediate at 30°C/65% RH and accelerated at 40°C/75% RH, each ±2°C and ±5% RH, with 12 months of long-term and 6 months of accelerated data on three batches at submission.

An alert level is an early warning of drift, set from your qualification and trend data; a result above it calls for assessment and follow-up.

The GMP rules require a schedule, not a number: US CGMP asks for calibration “at suitable intervals”, EU GMP “at defined intervals”.

A certificate of analysis identifies the material, grade, batch number, release date and expiry or retest date.

ICH Q2(R2), adopted on 1 November 2023 and implemented by FDA in March 2024 and the EU in June 2024, asks for a protocol, written before the study, that fixes the procedure’s purpose, the performance characteristics its use needs and their acceptance criteria.

Validation proves a procedure is fit for its intended purpose by studying characteristics such as specificity, accuracy, precision and range.

Reserve samples, called reference and retention samples in the EU, let a batch be retested or its pack examined later.

ICH Q1 will replace Q1A(R2) to Q1F and Q5C with one stability guideline for synthetic and biological products, cell and gene therapies included.

Sample management is the control of each sample from the plan that calls for it through sampling, labelling, receipt, storage, testing, retention and disposal, so every result traces to a known, representative sample.

An in-use study simulates use after the container is first opened, or the product reconstituted or diluted: real withdrawals, storage as labelled, and physical, chemical and microbial tests at intermediate points and on the last remaining amount.

Each batch of medium must grow the pharmacopoeial test organisms from not more than 100 CFU.

A retest date is when an API or intermediate must be re-examined; if it still meets its specification it should be used immediately, and can be retested again later.

Unless otherwise justified, EU GMP 6.32 asks for at least one batch a year of every strength and every primary packaging type made that year.

Start from a high-purity batch that meets the monograph.

Rank the material’s risk, trace its supply chain to the original manufacturer, assess the supplier, audit where required (EU GMP requires it for active substance manufacturers and distributors), agree specifications and responsibilities in writing, then have the quality unit approve a named manufacturer, site and material.

A quality agreement is a written agreement between a product owner and a contract manufacturer, laboratory or other GMP service provider that says which party performs, approves and reports each GMP activity.

Treat it as a deviation.

Check each delivery against the order and approved supplier list, inspect every container for labelling, damage, broken seals and contamination, and code each lot in each shipment.

None of FDA, EU GMP or Health Canada requires √n+1.

Partly.

Good distribution practice (GDP) is the part of quality assurance that keeps a medicine’s quality and integrity while it is bought, stored, transported and supplied, and keeps falsified products out of the supply chain.

ICH Q3E is still a draft.

Temperature mapping uses calibrated loggers to find hot and cold spots that decide where product and monitoring probes go.

Controlled room temperature (CRT) is USP’s storage condition of 20 to 25 °C, with mean kinetic temperature (MKT) not above 25 °C.

No FDA rule is titled shipping validation.

A LIMS manages samples and their testing: it registers each sample, assigns tests, methods and specifications, records results and routes them for review and disposition.

A LIMS (laboratory information management system) is software that runs a laboratory’s testing and keeps its records.

ERP (enterprise resource planning) runs the business side of manufacturing: orders, purchasing, materials, inventory and distribution.

Software is not Part 11 or GMP compliant by itself; compliance belongs to the system as your organisation uses it.

There is no standard price for a LIMS, and no regulator sets one.

An eQMS (electronic quality management system) is software that runs a company’s quality processes and keeps their records: controlled documents and training, deviations and nonconformances, investigations and CAPA, change control, complaints, audits, suppliers and management review.

No regulator sets or publishes eQMS prices, so the licence figure comes from vendors’ quotes.

A manufacturing execution system (MES) manages and records production operations.

Start from the quality processes you run and the rules they fall under, not from a vendor’s feature list.

Choose a LIMS by writing down what your laboratory records must hold and control, then testing shortlisted systems against it.

No regulation sets a timeline for a LIMS implementation.

A document management system (DMS or EDMS) controls documents: drafting, review, approval, versions, distribution and retention.

An electronic lab notebook (ELN) is software that replaces the paper notebook: scientists record methods, samples, observations, calculations and results as they work.

No regulation requires an electronic QMS; controlled paper is acceptable.

Treat it as redesigning the batch record, not scanning it.

Choose from your process outward.

A LIMS holds samples, tests and results; an MES runs and records each batch; a QMS holds procedures, training, deviations, CAPA and change control.

No regulation sets a timetable.

Connect each instrument so its results reach the LIMS without retyping, with sample identity, units and method attached, and keep the original electronic record, raw data and audit trail where a reviewer can reach them.

Yes, with DocuSign’s Part 11 module or Acrobat Sign’s enterprise service, once you switch on their Part 11 settings, validate them and control who signs; no with a pasted signature image.

Treat the migration as a validated process with its own plan.

Validate a LIMS against your intended use: write requirements, assess the supplier, record the configuration, rate each function’s risk, then test with approved scripts and report before GMP use.

Yes.

Annex 22 is a draft new annex to the EU GMP Guide for AI models in critical GMP applications, consulted on by the European Commission and PIC/S from July to October 2025.

FDA’s guidance is a January 2025 draft, still not final, on AI that produces information or data supporting regulatory decisions about drug safety, effectiveness or quality, manufacturing included.

Validate it like any GxP computerised system, from intended use and risk, then add what models need: a detailed intended use covering the input data, metrics and acceptance criteria approved before testing, test data kept independent of training data, a pre-approved test plan, and change control, configuration control and performance monitoring in use.

Warning letter 320-26-58 of 2 April 2026 to Purolea Cosmetics Lab in Livonia, Michigan, gave AI its own heading: “Inappropriate Use of Artificial Intelligence in Pharmaceutical Manufacturing”.

Yes, for supporting work that qualified people check, but not in critical GMP applications.

AI can prepare a batch record review, but it cannot be the reviewer of record.

Yes, as a drafting and evidence-gathering aid, but people must own the investigation.

Yes, as a drafting aid, if qualified people review and approve every document before it is used.

Partly.

Human in the loop means a qualified, trained person checks an AI output before it is used in a GMP decision and stays responsible for it.

Yes.