Regulatory Compliance and Validation
What the exam tests
This domain tests GMP-oriented computer system validation and data integrity: GAMP 5 risk-based validation, IQ/OQ/PQ, 21 CFR Part 11, EU Annex 11, audit trails, electronic signatures, and change control.
Core rules
- Validation demonstrates that a system consistently meets intended use. A common sequence is user requirements, functional specification, design, IQ, OQ, PQ, and traceability.
- GAMP 5 uses a risk-based, scalable approach; not every system needs the same documentation depth.
- 21 CFR Part 11 addresses electronic records and electronic signatures in FDA-regulated contexts. EU Annex 11 covers computerized systems in EU GMP. Neither is a generic IT security standard.
- ALCOA+ principles include attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available.
- Audit trails must be secure, reviewable, and retained. Electronic signatures need identity verification and must be linked to the signed record.
Worked example
An operator edits a batch record after review. The system permits the edit but creates an audit-trail entry with user, date/time, old value, new value, and reason. The reviewer checks the entry before release. Reasoning: the audit trail does not prevent correction, but it makes the change attributable and reviewable. Disabling the trail would undermine data integrity even if the final value is correct.
Traps
- Assuming Part 11 applies only to paper records; it applies to electronic records in scope.
- Treating an audit trail as sufficient without review.
- Using shared logins, which breaks attribution.
- Changing validated configuration without impact assessment and change control.