GxP & quality · 23 pages
GxP, quality & data integrity
Answer-first explainers for the quality systems, records and data-integrity principles behind regulated industries — GxP, QMS, SOPs, CAPA, 21 CFR Part 11 and ALCOA+ — as a neutral standards reference.
Browse the topic
All 23 gxp, quality & data integrity pages
GxP
GxP is an umbrella term for the “Good x Practice” quality guidelines and regulations — where “x” stands for a discipline such as Manufacturing (GMP), Laboratory (GLP), Clinical (GCP) or Distribution (GDP). Collectively they ensure regulated products are safe, effective and fit for purpose, and that the data supporting them is reliable. GxP frameworks are enforced by bodies such as the FDA, EMA and MHRA.
DefinitionGood Manufacturing Practice (GMP)
Good Manufacturing Practice (GMP) is the system of processes, procedures and documentation ensuring that products such as medicines are consistently produced and controlled to the quality standards appropriate to their intended use. It covers everything from raw materials, premises and equipment to staff training, hygiene and record-keeping. In the US it is enforced under FDA 21 CFR Parts 210 and 211; the “c” in cGMP stands for “current”, signalling that practices must keep pace with technology.
DefinitionGood Laboratory Practice (GLP)
Good Laboratory Practice (GLP) is a quality system concerned with the organisational process and conditions under which non-clinical health and environmental safety studies are planned, performed, monitored, recorded, archived and reported. Its purpose is to assure the quality and integrity of safety data submitted to regulators. GLP is defined in FDA 21 CFR Part 58 and in the OECD Principles of GLP, and centres on study directors, written protocols, a quality-assurance unit and full traceability of raw data.
DefinitionGood Clinical Practice (GCP)
Good Clinical Practice (GCP) is an international ethical and scientific quality standard for designing, conducting, recording and reporting clinical trials that involve human participants. Compliance assures that the rights, safety and well-being of trial subjects are protected and that the trial data are credible. The defining reference is the ICH Good Clinical Practice guideline, which moved from E6(R2) to the modernised E6(R3) adopted in 2025, built on principles set out in the Declaration of Helsinki.
DefinitionGood Distribution Practice (GDP)
Good Distribution Practice (GDP) is the quality system governing the procurement, storage, transport and supply of medicinal products, ensuring their quality and integrity are maintained throughout the distribution chain. It covers temperature control, traceability, prevention of falsified medicines, and qualified suppliers and customers. GDP extends GMP-grade discipline beyond the factory gate, so a correctly manufactured medicine is not compromised before it reaches the patient. EU GDP guidelines (2013/C 343/01) are a widely used reference.
DefinitionQuality management system (QMS)
A quality management system (QMS) is the formalised system that documents the processes, responsibilities, procedures and records an organisation uses to achieve its quality policy and objectives. In the pharmaceutical sector it provides the framework that ties together GxP activities — change control, CAPA, deviations, documentation and training — into one coherent system. ICH Q10 describes the Pharmaceutical Quality System model, and ISO 9001 provides a generic QMS standard used across many industries.
DefinitionStandard operating procedure (SOP)
A standard operating procedure (SOP) is a documented, step-by-step instruction that describes how to carry out a routine activity consistently, correctly and in compliance with quality and regulatory requirements. SOPs reduce variability and error by capturing the agreed best way to perform a task, regardless of who performs it. In GxP environments SOPs are controlled documents — formally authorised, version-controlled, trained on and periodically reviewed — and are a frequent focus of regulatory inspection.
DefinitionRoot cause analysis (RCA)
Root cause analysis (RCA) is a structured set of methods used to identify the fundamental, underlying cause of a problem, deviation or nonconformity so that it can be addressed at source. Common techniques include the 5 Whys, the Fishbone (Ishikawa) diagram and fault-tree analysis. RCA is the investigative step that precedes effective CAPA: without identifying the true root cause, corrective actions tend to address symptoms and the problem recurs.
DefinitionCAPA (Corrective and Preventive Action)
CAPA stands for Corrective and Preventive Action — the quality-system process for correcting existing nonconformities and preventing their recurrence. The corrective part eliminates the cause of a detected problem; the preventive part addresses potential causes before a problem occurs. CAPA is a cornerstone of GxP quality systems, ISO 9001 and ICH Q10. It depends on sound root cause analysis and on verifying that actions taken were actually effective.
Definition21 CFR Part 11
21 CFR Part 11 is the FDA regulation establishing the criteria under which electronic records and electronic signatures are considered trustworthy, reliable and equivalent to paper records and handwritten signatures. It applies to records required by FDA predicate rules when those records are kept electronically. Core requirements include system validation, secure audit trails, access controls, and signature controls. It enables regulated industries to use electronic systems while preserving data integrity.
DefinitionData integrity
Data integrity is the degree to which data are complete, consistent, accurate and trustworthy throughout their entire lifecycle — from creation and processing to reporting and retention. In regulated GxP environments it underpins every regulatory decision, because authorities can only trust a product if they can trust its data. Data integrity is commonly assessed against the ALCOA+ principles and is a major focus of MHRA, WHO and FDA guidance and inspection.
DefinitionALCOA / ALCOA+
ALCOA is an acronym describing the core attributes of reliable data: Attributable, Legible, Contemporaneous, Original and Accurate. ALCOA+ extends it with Complete, Consistent, Enduring and Available. Together they form the benchmark used across GxP to assess whether records and data meet data-integrity expectations. The framework applies equally to paper and electronic records and is referenced throughout MHRA, WHO and PIC/S data-integrity guidance.
DefinitionGAMP 5
GAMP 5 is the fifth-generation “Good Automated Manufacturing Practice” guide published by ISPE, providing a pragmatic, risk-based framework for assuring that computerised systems are fit for their intended use and compliant with GxP. Its second edition (2022) reinforces critical-thinking and the move from traditional computerised system validation (CSV) towards Computer Software Assurance (CSA). GAMP 5 is guidance, not a regulation, but is widely adopted to satisfy expectations such as 21 CFR Part 11 and EU Annex 11.
DefinitionElectronic batch record (EBR)
An electronic batch record (EBR) is a digital record of the manufacture of a specific batch of product, replacing the traditional paper batch record. It captures, in real time, the materials, equipment, process steps, parameters and checks performed during production. EBRs enforce sequence and acceptance criteria, reduce transcription errors, and support data integrity and review-by-exception. As electronic records they fall within the scope of 21 CFR Part 11 and EU Annex 11.
DefinitionProcess validation
Process validation is the collection and evaluation of documented evidence that a manufacturing process consistently produces a result meeting its predetermined specifications and quality attributes. The FDA’s 2011 guidance frames it as a three-stage lifecycle: Stage 1 Process Design, Stage 2 Process Qualification, and Stage 3 Continued Process Verification. It moves validation away from a one-off event towards ongoing assurance that a process remains in a state of control throughout commercial production.
DefinitionChange control
Change control is the formal, documented system used to evaluate, approve, implement and record changes to validated processes, equipment, systems, materials or documents, so the validated state and product quality are maintained. Each proposed change is assessed for its impact and risk, authorised by the appropriate functions, and implemented in a controlled way. Change control prevents uncontrolled, ad-hoc changes that could compromise quality, data integrity or compliance, and is a core element of the pharmaceutical quality system under ICH Q10.
DefinitionDeviation
A deviation is a departure from an approved procedure, specification, standard or established practice in a regulated environment. Each deviation must be documented, assessed for its impact on product quality, investigated for its root cause and, where appropriate, addressed through corrective and preventive action (CAPA). Deviations are typically classified by severity — for example critical, major or minor — and managing them well is a core indicator of a healthy quality system.
DefinitionComputer system validation (CSV)
Computer system validation (CSV) is the process of producing documented evidence, with a high degree of assurance, that a computerised system does what it is designed to do and will continue to do so. In regulated GxP settings it underpins confidence in electronic records and processes. Regulatory thinking is moving toward the FDA’s Computer Software Assurance (CSA), a risk-based approach that focuses testing effort where patient safety and data integrity risk is greatest.
DefinitionAudit trail
An audit trail is a secure, computer-generated, time-stamped electronic record that captures who performed an action on data, what action was taken, and when it occurred — and, where appropriate, why. In regulated GxP systems it is a core requirement of 21 CFR Part 11 and a foundation of data integrity, supporting the ALCOA attributes of being attributable and contemporaneous. It must not be alterable in a way that hides the original entries.
DefinitionQualification (IQ/OQ/PQ)
Qualification is the act of demonstrating, with documented evidence, that equipment, utilities or systems are fit for their intended use. It is usually staged as Installation Qualification (IQ), confirming correct installation; Operational Qualification (OQ), confirming the equipment operates across its intended range; and Performance Qualification (PQ), confirming sustained performance under real or simulated production conditions. Qualification of equipment is a building block of overall process validation.
ComparisonQuality assurance vs quality control
The difference is prevention versus detection. Quality assurance (QA) is the proactive, process-oriented system that builds quality in — designing procedures, training, and controls so defects do not arise. Quality control (QC) is the reactive, product-oriented activity that checks outputs against specifications — testing, inspecting and measuring to detect defects that have occurred. QA asks whether the right processes are in place; QC asks whether the actual output conforms. Both sit within a quality management system and depend on each other.
DefinitionValidation master plan (VMP)
A validation master plan (VMP) is a high-level document that defines an organisation’s overall validation strategy for a site, facility or project. It states the scope of what will be validated, the approach and acceptance philosophy, the responsibilities of those involved, and the schedule and documentation structure. It does not contain test results; rather, it is the governing framework under which individual qualification and validation protocols are written and executed.
DefinitionOut-of-specification (OOS)
An out-of-specification (OOS) result is a test result that falls outside the established specifications or acceptance criteria for a material, product or process. In a GMP environment an OOS result triggers a documented investigation to determine whether it reflects a genuine product problem or a laboratory or testing error. The result may not simply be ignored, retested away or invalidated without a justified, recorded investigation.
