GxP terminology, decoded

A set of data-integrity principles used by FDA, EMA, MHRA, and WHO inspectors. The original ALCOA refers to records that are Attributable, Legible, Contemporaneous, Original, and Accurate. The "+" adds Complete, Consistent, Enduring, and Available.

Volume 4 Annex 11 of the EU GMP guidelines. Defines requirements for computerised systems used in GMP regulated activities, including risk management, validation, supplier oversight, electronic records, electronic signatures, and an up-to-date system inventory.

Annual Product Review. A 21 CFR §211.180(e) requirement that pharma manufacturers review the quality of every commercial drug product at least once a year, including batch yields, complaints, deviations, and stability data.

Corrective and Preventive Action. A structured response to a quality problem. Corrective actions address the immediate issue; preventive actions stop it recurring. Required by ICH Q10 and ISO 13485.

Computer Software Assurance. A 2022 FDA draft guidance promoting a risk-based, critical-thinking approach to validating software used in medical-device manufacturing. Replaces some of the heavier traditional CSV documentation burden.

Computer System Validation. The documented evidence that a computerised system does what it is intended to do, consistently and within specification. Required by 21 CFR Part 11 and EU GMP Annex 11.

Electronic Quality Management System. Software that manages quality processes such as deviations, CAPAs, change controls, training records, audits, and document control electronically.

Factory Acceptance Test. Testing performed at the vendor site before equipment or software is shipped to the customer, to confirm it meets the user requirements.

Failure Mode and Effects Analysis. A risk-assessment technique that systematically evaluates each failure mode of a system or process for severity, occurrence, and detectability, producing a Risk Priority Number (RPN).

Functional Requirement Specification. Defines the system functions, interfaces, and behaviours required to satisfy the URS. Typically authored after URS approval.

A risk-based approach to the validation of computerised systems published by ISPE. The 2nd edition (2022) places greater emphasis on critical thinking and cloud/SaaS validation.

Good Manufacturing Practice. The regulations governing the manufacture of pharmaceutical, biological, and medical-device products to ensure they meet quality and safety requirements.

Installation Qualification. Documented evidence that the system is installed correctly in the operating environment, per the manufacturer's specifications.

Operational Qualification. Documented evidence that the system operates correctly throughout the specified operating ranges, before release for production use.

Performance Qualification. Documented evidence that the system performs effectively and reproducibly under simulated or actual production conditions.

Requirements Traceability Matrix. A document or table mapping each user requirement to the corresponding functional spec, design element, test case, and test result. Demonstrates coverage during inspection.

Software as a Medical Device. Software intended to be used for one or more medical purposes that performs these purposes without being part of a hardware medical device. Regulated under IMDRF, FDA, and EU MDR.

Standard Operating Procedure. A controlled document defining how a specific task or process is performed consistently. SOPs are the backbone of GMP quality systems.

Statistical Process Control. The use of statistical methods such as control charts and Western Electric rules to monitor and control process variability over time.

User Requirement Specification. Defines what the business needs the system to do, expressed in user/business terms rather than technical terms. The starting point of any validation project.

Validation Summary Report. The final document summarising the entire validation effort, signed by QA and the System Owner before the system is released for GxP use.