GMP glossary

The five attributes every GMP record should have, used by regulators as the common vocabulary for what makes a record trustworthy.

In practice. Use it diagnostically. When a record feels wrong but you cannot say why, walking the five attributes almost always names the specific failure — usually attributability or contemporaneity.

ALCOA extended with four further attributes that close gaps the original five left open, particularly around omitted data and long-term readability.

In practice. 'Complete' is the one that catches people: excluding a failing injection or an aborted run from the reported set breaks it, even when every retained record is itself accurate.

The substance in a medicinal product intended to furnish pharmacological activity or otherwise have a direct effect.

In practice. API manufacture sits under EU GMP Part II (ICH Q7), not Part I. Applying Part I requirements to an API site is a common and confusing scoping error.

A simulation of the aseptic manufacturing process using a growth medium in place of product, to demonstrate the process can be performed without contaminating the product.

In practice. The value is entirely in whether the simulation includes the awkward interventions that actually happen. A media fill that avoids them proves only that an easy day can go well.

A secure, computer-generated, time-stamped record that allows reconstruction of events relating to the creation, modification or deletion of an electronic record.

In practice. Enabled is not the requirement — reviewed is. Expect to be asked who performs the review, how often, and what they found last time.

The document set recording the complete history of a batch, from materials issued through processing steps, in-process checks and packaging, to release.

In practice. It is the primary evidence that the process ran as validated. Design it to reduce error at the line rather than to add signatures — extra signatures rarely prevent anything.

The system for removing the cause of a problem that has occurred (corrective) and for addressing a cause that has not yet produced a failure (preventive).

In practice. Judged on effectiveness, not closure. Define the measurable effectiveness criterion before implementation — one written at closure to match the outcome is not evidence.

A site-wide, risk-based strategy covering microbial, particulate and pyrogen contamination sources, the controls applied to each, and evidence those controls are collectively effective.

In practice. The most common weak form is a document that cross-references existing SOPs. That is an index, not a strategy, and it is straightforward for an inspector to dismantle.

The formal process by which proposed changes are assessed for quality, validation and regulatory impact, approved, implemented and verified.

In practice. It fails in two opposite ways: as a bottleneck everyone routes around, or as a rubber stamp with no real assessment. Risk-tiering is the fix for both.

A process parameter whose variability affects a critical quality attribute, and which therefore must be monitored or controlled to ensure the process produces the required quality.

In practice. Reconcile the CPPs identified in development against the parameters production actually controls. A CPP nobody monitors on the floor is a validation gap waiting to be found.

Ongoing monitoring during routine commercial production to provide assurance that the process remains in a state of control.

In practice. Ask whether any CPV review has ever triggered an action. If not, the data is being collected and filed rather than read, which is a documentation exercise rather than a control.

A physical, chemical, biological or microbiological property or characteristic that should be within an appropriate limit, range or distribution to ensure the required product quality.

In practice. CQAs are the 'what must be true' of the product; CPPs are the 'what we control' of the process. Confusing the two produces control strategies that monitor the wrong things.

Documented evidence that a computerised system — software, hardware and the business process together — is fit for its intended use.

In practice. Scope is where sites lose findings. Spreadsheets performing GMP calculations and standalone instrument software are systems, and are routinely missing from the inventory.

Any departure from an approved instruction, specification or established standard, whether discovered after the fact (unplanned) or approved in advance with justification (planned).

In practice. Assess impact beyond the batch in front of you — other batches sharing equipment, materials, personnel or time window. That is the question an inspector will certainly ask.

Documented verification that the proposed design of facilities, systems or equipment is suitable for the intended purpose and meets the user requirements.

In practice. DQ is only as good as the URS behind it. Requirements written in unverifiable language ('adequate mixing') make every later qualification stage an argument.

The routine monitoring of viable and non-viable particulates, and of surfaces and personnel, in classified manufacturing areas.

In practice. Locations should come from a contamination risk assessment, not from history. Inherited sampling points with no current rationale is a standard Annex 1 finding.

The EU database holding manufacturing and importation authorisations, GMP certificates and GMP non-compliance statements.

In practice. Inspection outcomes are public here. A non-compliance statement is visible to every customer, partner and competitor you have — which is why remediation timelines matter commercially as well as legally.

The EU GMP guidelines: Part I (medicinal products), Part II (active substances), Part III (supporting documents) and the Annexes.

In practice. Check the version in force and its transition dates before working to a downloaded Annex. Annexes are revised, and the copy in your document management system may not be current.

The quality standard governing the storage and distribution of medicinal products, including temperature control, transport qualification and the responsible person role.

In practice. Temperature excursions treated as a logistics matter rather than as deviations is the recurring failure — the licence is straightforward to jeopardise this way.

The part of quality assurance ensuring products are consistently produced and controlled to the quality standards appropriate to their intended use.

In practice. Two obligations underpin all of it: do what you wrote down, and be able to prove it. The distance between those two is where findings come from.

A limit derived from toxicological data, typically expressed as a permitted daily exposure (PDE), used to set cleaning acceptance criteria and assess shared-facility risk.

In practice. Legacy limits such as one-thousandth of a dose or a flat 10 ppm, carried forward without an HBEL rationale, are a well-known and easily identified gap.

The body producing harmonised guidelines for pharmaceutical development and quality, including the Q-series (Q7 to Q14).

In practice. Q7 (APIs), Q9 (risk management) and Q10 (quality system) are the three that appear most often in GMP discussions; Q9 and Q10 are reproduced in EU GMP Part III.

A pharmaceutical form of an active substance or placebo being tested or used as a reference in a clinical trial.

In practice. IMPs have their own GMP basis — Commission Delegated Regulation (EU) 2017/1569 and Annex 13 — rather than sitting under the commercial product framework.

Documented verification that equipment or systems, as installed, comply with the approved design and the manufacturer's recommendations.

In practice. The finding that surfaces fastest on a facility tour is IQ documentation describing an installation that has since been modified or relocated.

The authorisation permitting a site to manufacture or import medicinal products, conditional on continued GMP compliance.

In practice. Holding an authorisation and being compliant today are different things. The authorisation reflects a past inspection; your own records evidence the present.

A test result falling outside the specification or acceptance criteria, which stands as valid unless a laboratory investigation identifies a documented assignable cause.

In practice. A passing retest does not invalidate a failing original. Invalidation requires a demonstrated laboratory error, and the Phase II investigation is the part that gets truncated under pressure.

A result that complies with specification but is inconsistent with the expected pattern from previous results — a signal of drift while still compliant.

In practice. The earlier and more useful signal of the two. Sites monitoring only OOS have chosen to be told about problems later than they needed to be.

Documented verification that equipment or systems operate as intended across all anticipated operating ranges.

In practice. Run at the edges, not only at nominal settings. OQ performed exclusively at the set point demonstrates very little about the range you are claiming.

A substance-specific dose, derived toxicologically, that is unlikely to cause an adverse effect if an individual is exposed at or below it every day for a lifetime.

In practice. The PDE is the input to cleaning limits. It must be established by a suitably qualified toxicological assessment, and reviewed when the product portfolio changes.

An international scheme harmonising GMP standards and inspection practice between participating authorities.

In practice. PIC/S alignment is why the EU text is worth knowing even when supplying outside the EU — a PIC/S-aligned inspectorate largely recognises the same expectations.

Documented verification that equipment and systems perform effectively and reproducibly in actual use, based on the approved process and product specification.

In practice. PQ should use production materials or a justified equivalent. Performance demonstrated only with water tells you about the equipment, not about the process.

A periodic review of a product's manufacturing and quality data to verify process consistency, the appropriateness of specifications, and to identify improvements.

In practice. A PQR compiled six months after period close is a filing exercise. Restructure so it assembles continuously and produces actions the site will actually fund.

The management system directing and controlling a pharmaceutical company with regard to quality, required by EU GMP Chapter 1 and elaborated in ICH Q10.

In practice. The word that matters is 'system'. Excellent individual procedures with nothing joining them up is a set of documents, and inspectors test the joins.

The totality of arrangements made to ensure products are of the quality required for their intended use — the system-level discipline.

In practice. QA owns whether the system works; it does not own every activity in it. Sites where GMP is treated as 'QA's job' tend to have production and engineering disengaged from their own obligations.

The part of GMP concerned with sampling, specifications and testing, and with the organisation and documentation that ensures the necessary tests are carried out.

In practice. QC tests the sample; it cannot rescue a batch made outside its validated parameters. That is the whole reason GMP puts controls in the process rather than only at the end.

The named person who certifies that each batch was manufactured and tested in accordance with GMP and the marketing authorisation before release to market.

In practice. The responsibility is personal and cannot be delegated. A single QP with no trained deputy makes batch release a structural single point of failure.

The systematic process for assessing, controlling, communicating and reviewing risks to product quality across the lifecycle, set out in ICH Q9.

In practice. The give-away for a retrofitted assessment is that nothing scored high and no option was rejected. A genuine assessment changes at least some decisions.

Documented evidence that equipment, utilities or facilities are correctly specified, installed, operating and performing for their intended use.

In practice. Qualification is normally a prerequisite for validation — you cannot validate a process running on unqualified equipment.

The written agreement between contract giver and contract acceptor defining GMP responsibilities, communication and audit rights for outsourced activities.

In practice. The clause that matters most is change notification. An unnotified supplier change discovered during an investigation is a recurring, entirely avoidable finding.

A barrier system providing physical and aerodynamic separation between operators and the aseptic processing zone, sitting between conventional cleanrooms and full isolators.

In practice. The control depends on discipline about door openings and interventions. A RABS operated with routine open-door interventions provides much less separation than its classification implies.

The original record or a verified true copy of the original observation, from which the reported result is derived.

In practice. For dynamic records such as chromatograms, the source file is the raw data. Retaining only a printout loses the ability to reconstruct what was done, and is a standard finding.

The structured investigation of an event to identify the underlying cause, rather than the immediate or apparent one, so that corrective action addresses something real.

In practice. 'Human error' is where the analysis starts, not where it stops. Ask why the process permitted the error — ambiguity, layout, workload — because that is the cause you can actually remove.

A sample of a fully packaged unit from a batch, kept for identification purposes for a defined period after expiry.

In practice. Distinguish it from a reference sample, which is a sample of starting material or product kept for analysis. Procedures that use the terms interchangeably create real confusion during recalls.

The internal audit programme through which a site examines its own compliance with GMP and proposes corrective measures.

In practice. An audit programme that never produces an uncomfortable finding is usually evidence about the auditor's independence rather than about the site's health.

A document prepared by the manufacturer describing its GMP-related activities, used by authorities to plan and prepare for inspections.

In practice. It is often the first document an inspector reads. An SMF that no longer matches the site sets an unhelpful tone before anyone has walked the floor.

An authorised written instruction giving directions for performing an operation, whether or not it is specific to a given product.

In practice. The test is whether a competent newcomer could follow it in month one without asking a colleague. A procedure nobody follows is worse than none, because it documents your own non-compliance.

The document stating what the user needs a system, equipment or facility to do, forming the traceable basis for design and qualification.

In practice. Write requirements testably. 'Adequate mixing' cannot be verified; 'homogeneity within ±5% across defined sampling points' generates its own acceptance criteria.

Documented evidence that a process, method, cleaning procedure or computerised system consistently produces a result meeting predetermined acceptance criteria.

In practice. You validate activities and qualify things. It is a state to be maintained through change control, not a project that finishes.

The document summarising the scope, approach, responsibilities and current status of a site's qualification and validation activities.

In practice. Reconcile it against the equipment actually on the floor. A VMP that has drifted makes every document downstream of it unreliable — dull work, and where the real gaps surface.

The set of conditions, at the upper or lower limits of processing parameters, posing the greatest chance of product or process failure when compared to ideal conditions.

In practice. Worst-case selection needs a documented rationale and revisiting when the portfolio changes. A grouping justified five years ago may not survive a new high-potency product.