---
title: "DSRV pharma quality glossary"
canonicalUrl: "https://dsrv.io/glossary"
updated: "2026-09-07"
terms: 36
source: "DSRV public glossary; each definition paraphrases the cited official source"
---

# DSRV pharma quality glossary

36 pharmaceutical quality and regulatory terms, each paraphrased from the FDA, eCFR, ICH, WHO, or NAFDAC document that defines it, with the enforcement context DSRV tracks and links to the regulation hubs. Canonical page: https://dsrv.io/glossary (one anchor per term). Updated 2026-09-07.

## Enforcement (5)

### Form FDA 483 (483)

- Anchor: https://dsrv.io/glossary#form-fda-483
- Category: Enforcement

The list of inspectional observations an FDA investigator issues at the close of an inspection: conditions that, in the investigator's judgment, may constitute violations of the Food, Drug, and Cosmetic Act. It is not a final agency determination, and it does not by itself say the firm is out of compliance.

**In inspections.** Firms are expected to respond, usually within 15 business days, with corrective actions and evidence. An unanswered or weak 483 response is the usual road to a Warning Letter.

- Source: FDA, FDA Form 483 Frequently Asked Questions — https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-references/fda-form-483-frequently-asked-questions
- Regulation hubs: 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=How%20should%20a%20quality%20unit%20structure%20a%20response%20to%20a%20Form%20FDA%20483%20observation%3F
### Warning Letter

- Anchor: https://dsrv.io/glossary#warning-letter
- Category: Enforcement

FDA's principal tool for obtaining prompt voluntary correction of violations of regulatory significance. It cites the specific regulation for each violation, requests a written response, and is published on FDA's site with the firm's name.

**In inspections.** Warning Letters are the public record DSRV's Regulatory Snapshots are built from: each one names the 21 CFR section cited and the evidence the firm failed to produce.

- Source: FDA, Warning Letters — https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/compliance-actions-and-activities/warning-letters
- Regulation hubs: 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211); 21 CFR Parts 210/211 (https://dsrv.io/regulations/21-cfr-parts-210-211)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=What%20are%20FDA%20Warning%20Letters%20citing%20most%20often%20under%2021%20CFR%20Part%20211%20right%20now%3F
### Inspection classification (NAI, VAI, OAI) (NAI / VAI / OAI)

- Anchor: https://dsrv.io/glossary#inspection-classification
- Category: Enforcement

FDA's three-way outcome for an inspection. No Action Indicated: no objectionable conditions found. Voluntary Action Indicated: objectionable conditions found but not at a level warranting regulatory action. Official Action Indicated: regulatory or administrative action is recommended.

**In inspections.** Classifications are published in FDA's inspection database and are read by customers, auditors, and prequalification programs when they assess a site.

- Source: FDA, Inspection Classification Database — https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-references/inspection-classification-database
- Regulation hubs: 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=What%20separates%20a%20VAI%20from%20an%20OAI%20inspection%20classification%20in%20practice%3F
### Consent decree

- Anchor: https://dsrv.io/glossary#consent-decree
- Category: Enforcement

A court order, agreed between the firm and the Department of Justice on FDA's behalf, that settles an injunction case. It typically binds the firm to a remediation plan with third-party oversight and can halt manufacturing or distribution until conditions are met.

**In inspections.** Consent decrees usually follow repeated Warning Letters for the same quality-system failures. The record of what was cited before the decree is the part DSRV tracks.

- Source: FDA, Compliance Actions and Activities — https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/compliance-actions-and-activities
- Regulation hubs: 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=What%20enforcement%20history%20typically%20precedes%20an%20FDA%20consent%20decree%20for%20a%20drug%20manufacturer%3F
### Import Alert (DWPE)

- Anchor: https://dsrv.io/glossary#import-alert
- Category: Enforcement

A notice that FDA has enough evidence to detain a product or a firm's shipments at the border without physical examination (detention without physical examination). Import Alert 66-40 covers drugs from firms that do not meet current good manufacturing practice.

**In inspections.** A foreign site that fails an inspection can be placed on an Import Alert before or alongside a Warning Letter, which stops its product entering the United States.

- Source: FDA, Import Alerts — https://www.accessdata.fda.gov/cms_ia/default.html
- Regulation hubs: 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=What%20does%20it%20take%20to%20be%20removed%20from%20FDA%20Import%20Alert%2066-40%3F

## Quality system (10)

### Current Good Manufacturing Practice (cGMP)

- Anchor: https://dsrv.io/glossary#cgmp
- Category: Quality system

The minimum requirements for the methods, facilities, and controls used in manufacturing, processing, and packing a drug product, set out for finished pharmaceuticals in 21 CFR Parts 210 and 211. The word current means the systems and technology must keep up with what is presently accepted, not what was accepted when the rule was written.

**In inspections.** A drug made without conforming to cGMP is adulterated under section 501(a)(2)(B) of the Act, whether or not any defect is found in the product itself.

- Source: FDA, Facts About Current Good Manufacturing Practice (CGMP) — https://www.fda.gov/drugs/pharmaceutical-quality-resources/facts-about-current-good-manufacturing-practice-cgmp
- Regulation hubs: 21 CFR Parts 210/211 (https://dsrv.io/regulations/21-cfr-parts-210-211); 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211)
- Latest DSRV coverage: FDA’s 2025–2026 Warning-Letter Pattern: Water Systems Are Still Breaking Quality Systems, Not Just Utilities — https://dsrv.io/articles/water-systems-warning-letter-pattern
- Ask the Vault: https://dsrv.io/vault?q=Which%2021%20CFR%20Part%20211%20subparts%20carry%20the%20most%20inspection%20exposure%20for%20a%20small%20manufacturer%3F
### Quality unit (QU / QCU)

- Anchor: https://dsrv.io/glossary#quality-unit
- Category: Quality system

The organizational unit 21 CFR 211.22 makes responsible for approving or rejecting all components, containers, closures, in-process materials, packaging, labeling, and drug products, for reviewing production records, and for approving procedures and specifications that affect product quality. Its responsibilities must be in writing and followed.

**In inspections.** 211.22 is cited when the quality unit signed off on records it had not reviewed, lacked authority to reject, or had procedures that were not followed. It is one of the most-cited sections in DSRV's coverage.

- Source: 21 CFR 211.22, Responsibilities of quality control unit (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-B/section-211.22
- Regulation hubs: 21 CFR 211.22 (https://dsrv.io/regulations/21-cfr-211-22); 21 CFR 211.22(c) (https://dsrv.io/regulations/21-cfr-211-22-c)
- Latest DSRV coverage: FDA Is Treating Discarded Evidence as a Quality Unit Failure — https://dsrv.io/articles/fda-discarded-evidence-quality-unit-failure
- Ask the Vault: https://dsrv.io/vault?q=What%20has%20FDA%20cited%20under%2021%20CFR%20211.22%20about%20quality%20unit%20responsibility%3F
### Deviation

- Anchor: https://dsrv.io/glossary#deviation
- Category: Quality system

A departure from an approved procedure, specification, or expected result. 21 CFR 211.192 requires that any unexplained discrepancy or failure of a batch to meet its specifications be thoroughly investigated, that the investigation extend to other batches that may have been associated with the failure, and that a written record state the conclusions and follow-up.

**In inspections.** Investigations that stop at the first plausible cause, never look at sister batches, or close without a documented conclusion are the classic 211.192 citation.

- Source: 21 CFR 211.192, Production record review (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.192
- Regulation hubs: 21 CFR 211.192 (https://dsrv.io/regulations/21-cfr-211-192)
- Latest DSRV coverage: A Quality Unit That Averaged Away Its Own OOS Failures — https://dsrv.io/articles/abs-corp-oos-averaging-batch-record-alteration
- Ask the Vault: https://dsrv.io/vault?q=What%20does%20a%2021%20CFR%20211.192%20investigation%20have%20to%20contain%20to%20hold%20up%20in%20an%20inspection%3F
### Corrective and preventive action (CAPA)

- Anchor: https://dsrv.io/glossary#capa
- Category: Quality system

The system for eliminating the cause of a detected nonconformity (corrective action) and the cause of a potential one (preventive action). ICH Q10 names it as one of the four elements of a pharmaceutical quality system, driven by investigations of complaints, rejections, deviations, audits, and trends.

**In inspections.** FDA cites CAPA failures through 211.192 rather than a CAPA rule: a corrective action that was never verified as effective, or that treated a symptom, reads as an incomplete investigation.

- Source: ICH Q10, Pharmaceutical Quality System — https://www.ich.org/page/quality-guidelines
- Regulation hubs: ICH Q10 (https://dsrv.io/regulations/ich-q10); 21 CFR 211.192 (https://dsrv.io/regulations/21-cfr-211-192)
- Latest DSRV coverage: 108 New Drug Facilities in Nigeria. Most Have Never Been Inspected. — https://dsrv.io/articles/nafdac-5plus5-new-manufacturers-inspection-gap
- Ask the Vault: https://dsrv.io/vault?q=How%20do%20inspectors%20judge%20whether%20a%20CAPA%20was%20effective%3F
### Change management (Change control)

- Anchor: https://dsrv.io/glossary#change-control
- Category: Quality system

The formal process for proposing, evaluating, approving, implementing, and reviewing changes to processes, equipment, materials, and systems. ICH Q10 requires that changes be assessed with quality risk management and evaluated after implementation to confirm they had the intended effect.

**In inspections.** Changes made without evaluation, or implemented before approval, are cited under the section that governs the thing changed (211.100 for procedures, 211.68 for computer systems).

- Source: ICH Q10, Pharmaceutical Quality System — https://www.ich.org/page/quality-guidelines
- Regulation hubs: ICH Q10 (https://dsrv.io/regulations/ich-q10); ICH Q12 (https://dsrv.io/regulations/ich-q12); 21 CFR 211.100 (https://dsrv.io/regulations/21-cfr-211-100)
- Latest DSRV coverage: 108 New Drug Facilities in Nigeria. Most Have Never Been Inspected. — https://dsrv.io/articles/nafdac-5plus5-new-manufacturers-inspection-gap
- Ask the Vault: https://dsrv.io/vault?q=What%20should%20a%20change%20control%20record%20show%20for%20an%20inspector%20to%20accept%20the%20change%3F
### Pharmaceutical quality system (PQS)

- Anchor: https://dsrv.io/glossary#pharmaceutical-quality-system
- Category: Quality system

The ICH Q10 model for a quality system that covers the whole product lifecycle. Its four elements are process performance and product quality monitoring, corrective and preventive action, change management, and management review, all supported by knowledge management and quality risk management.

**In inspections.** Q10 is a guideline, not a rule; FDA inspects the cGMP regulations. Where the PQS is weak, the citations land on 211.22, 211.192, and 211.180.

- Source: ICH Q10, Pharmaceutical Quality System — https://www.ich.org/page/quality-guidelines
- Regulation hubs: ICH Q10 (https://dsrv.io/regulations/ich-q10)
- Latest DSRV coverage: 108 New Drug Facilities in Nigeria. Most Have Never Been Inspected. — https://dsrv.io/articles/nafdac-5plus5-new-manufacturers-inspection-gap
- Ask the Vault: https://dsrv.io/vault?q=How%20does%20ICH%20Q10%20map%20onto%20the%2021%20CFR%20Part%20211%20sections%20FDA%20actually%20cites%3F
### Quality risk management (QRM)

- Anchor: https://dsrv.io/glossary#quality-risk-management
- Category: Quality system

The ICH Q9 process for assessing, controlling, communicating, and reviewing risks to the quality of a drug product across its lifecycle. The 2023 revision, Q9(R1), adds guidance on managing subjectivity in risk assessments, on how much formality a given decision needs, and on risks to product availability.

**In inspections.** Risk assessments that always conclude low risk, or that are written after the decision they justify, are read by inspectors as a paperwork exercise rather than a control.

- Source: ICH Q9(R1), Quality Risk Management — https://www.ich.org/page/quality-guidelines
- Regulation hubs: ICH Q9(R1) (https://dsrv.io/regulations/ich-q9-r1)
- Latest DSRV coverage: Where AI Can Safely Support Pharma Quality Teams — https://dsrv.io/articles/where-ai-can-safely-support-pharma-quality-teams
- Ask the Vault: https://dsrv.io/vault?q=What%20does%20ICH%20Q9(R1)%20change%20about%20how%20a%20risk%20assessment%20should%20be%20documented%3F
### Batch production and control record (BPR / BMR)

- Anchor: https://dsrv.io/glossary#batch-record
- Category: Quality system

The record 21 CFR 211.188 requires for each batch, documenting every significant step of manufacture and control: dates, equipment, components and their quantities, in-process and laboratory results, labeling control, and the identity of the people who performed and checked each step. Under 211.192 the quality unit reviews it before the batch is released.

**In inspections.** Altered, backdated, or incomplete batch records are treated as a data integrity failure, not a documentation slip, and are cited alongside 211.68 and 211.194.

- Source: 21 CFR 211.188, Batch production and control records (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.188
- Regulation hubs: 21 CFR 211.192 (https://dsrv.io/regulations/21-cfr-211-192); 21 CFR 211.194(a) (https://dsrv.io/regulations/21-cfr-211-194-a)
- Latest DSRV coverage: A Quality Unit That Averaged Away Its Own OOS Failures — https://dsrv.io/articles/abs-corp-oos-averaging-batch-record-alteration
- Ask the Vault: https://dsrv.io/vault?q=What%20batch%20record%20gaps%20has%20FDA%20cited%20as%20data%20integrity%20failures%3F
### Product quality review (APR / PQR)

- Anchor: https://dsrv.io/glossary#annual-product-review
- Category: Quality system

The evaluation 21 CFR 211.180(e) requires at least annually for each drug product, covering representative batches, complaints, recalls, returned products, and investigations, to decide whether specifications, procedures, or controls need to change.

**In inspections.** Reviews that are late, that omit rejected batches, or that never lead to a change when the data shows a trend are cited under 211.180(e).

- Source: 21 CFR 211.180, General requirements for records and reports (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.180
- Regulation hubs: 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=What%20should%20an%20annual%20product%20quality%20review%20contain%20to%20satisfy%2021%20CFR%20211.180(e)%3F
### Quality agreement

- Anchor: https://dsrv.io/glossary#quality-agreement
- Category: Quality system

A written agreement between a drug owner and a contract facility that defines which cGMP activities each party performs and who has the final say on quality decisions. FDA's 2016 guidance on contract manufacturing arrangements sets out what it should cover, and 21 CFR 211.22 keeps the owner's quality unit responsible for the product regardless of the contract.

**In inspections.** Owners are cited when they released product on a contractor's say-so without their own review, or when the agreement was silent on deviations, changes, and record access.

- Source: FDA, Contract Manufacturing Arrangements for Drugs: Quality Agreements — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/contract-manufacturing-arrangements-drugs-quality-agreements
- Regulation hubs: 21 CFR 211.22 (https://dsrv.io/regulations/21-cfr-211-22)
- Latest DSRV coverage: FDA Is Treating Discarded Evidence as a Quality Unit Failure — https://dsrv.io/articles/fda-discarded-evidence-quality-unit-failure
- Ask the Vault: https://dsrv.io/vault?q=What%20must%20a%20quality%20agreement%20with%20a%20contract%20manufacturer%20cover%20under%2021%20CFR%20211.22%3F

## Laboratory and data (8)

### Out-of-specification result (OOS)

- Anchor: https://dsrv.io/glossary#out-of-specification
- Category: Laboratory and data

A test result that falls outside the specifications or acceptance criteria established in an application, drug master file, official compendium, or the manufacturer's own specifications. FDA's OOS guidance describes a two-phase investigation: a laboratory phase to identify assignable laboratory error, then a full-scale investigation into manufacturing when none is found.

**In inspections.** Retesting into compliance, averaging a failing result with passing ones, and invalidating results without a documented assignable cause are the OOS patterns FDA cites under 211.192 and 211.165.

- Source: FDA, Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/investigating-out-specification-oos-test-results-pharmaceutical-production-level-2-revision
- Regulation hubs: 21 CFR 211.192 (https://dsrv.io/regulations/21-cfr-211-192); 21 CFR §211.165 (https://dsrv.io/regulations/21-cfr-211-165)
- Latest DSRV coverage: A Quality Unit That Averaged Away Its Own OOS Failures — https://dsrv.io/articles/abs-corp-oos-averaging-batch-record-alteration
- Ask the Vault: https://dsrv.io/vault?q=When%20is%20it%20acceptable%20to%20invalidate%20an%20out-of-specification%20result%3F
### Out-of-trend result (OOT)

- Anchor: https://dsrv.io/glossary#out-of-trend
- Category: Laboratory and data

A result that is within specification but inconsistent with the expected trend, most often seen in stability data. The term is not defined in 21 CFR; the expectation comes from 211.180(e), which requires the evaluation of product quality data over time, and from ICH Q1E's treatment of stability trends.

**In inspections.** Stability points that drift toward a limit without any documented evaluation are read as a missed signal, and the question that follows is whether the expiration date is still supported.

- Source: 21 CFR 211.180, General requirements for records and reports (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.180
- Regulation hubs: ICH Q1E (https://dsrv.io/regulations/ich-q1e); ICH Q1A(R2) (https://dsrv.io/regulations/ich-q1a-r2); 21 CFR §211.166 (https://dsrv.io/regulations/21-cfr-211-166)
- Latest DSRV coverage: What Evidence Supports a Stability Justification? — https://dsrv.io/articles/what-evidence-supports-a-stability-justification
- Ask the Vault: https://dsrv.io/vault?q=How%20should%20a%20stability%20program%20define%20and%20act%20on%20an%20out-of-trend%20result%3F
### Data integrity (ALCOA+)

- Anchor: https://dsrv.io/glossary#data-integrity
- Category: Laboratory and data

The completeness, consistency, and accuracy of data across its lifecycle. FDA's 2018 question-and-answer guidance describes the expectation as ALCOA: attributable, legible, contemporaneous, original, accurate; industry extends it with complete, consistent, enduring, and available. The applicable cGMP provisions include 211.68 (computer controls), 211.188 (batch records), and 211.194 (laboratory records).

**In inspections.** Shared logins, disabled audit trails, unreported trial injections, and paper records that do not match the electronic record are the citations behind most data integrity Warning Letters.

- Source: FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers
- Regulation hubs: 21 CFR 211.68 (https://dsrv.io/regulations/21-cfr-211-68); 21 CFR 211.194(a) (https://dsrv.io/regulations/21-cfr-211-194-a); 21 CFR Part 11 (https://dsrv.io/regulations/21-cfr-part-11)
- Latest DSRV coverage: Your Next 483 Observation Is Running on a Timer — https://dsrv.io/articles/managed-agents-scheduled-runs-483-inspection-risk
- Ask the Vault: https://dsrv.io/vault?q=What%20data%20integrity%20failures%20is%20FDA%20citing%20under%2021%20CFR%20211.68%20and%20211.194%3F
### Audit trail

- Anchor: https://dsrv.io/glossary#audit-trail
- Category: Laboratory and data

A secure, computer-generated, time-stamped record of who created, changed, or deleted an electronic record and when, that does not obscure the earlier entry. 21 CFR 11.10(e) requires it for electronic records, and FDA's data integrity guidance expects audit trails that capture changes to critical data to be reviewed as part of the record review under 211.68, 211.188, and 211.192.

**In inspections.** An audit trail that exists but is never reviewed, or that can be switched off by the analyst, is cited as if it did not exist.

- Source: FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers
- Regulation hubs: 21 CFR Part 11 (https://dsrv.io/regulations/21-cfr-part-11); 21 CFR 211.68 (https://dsrv.io/regulations/21-cfr-211-68)
- Latest DSRV coverage: Your Next 483 Observation Is Running on a Timer — https://dsrv.io/articles/managed-agents-scheduled-runs-483-inspection-risk
- Ask the Vault: https://dsrv.io/vault?q=How%20often%20should%20audit%20trails%20be%20reviewed%2C%20and%20by%20whom%2C%20to%20satisfy%20FDA%3F
### 21 CFR Part 11 (Part 11)

- Anchor: https://dsrv.io/glossary#part-11
- Category: Laboratory and data

The regulation that sets the criteria under which FDA accepts electronic records and electronic signatures as equivalent to paper records and handwritten signatures: system validation, audit trails, access controls, record retention, and signature linkage. FDA's 2003 scope-and-application guidance narrowed enforcement to records required by predicate rules such as Part 211.

**In inspections.** Part 11 is rarely cited on its own; the failures surface as 211.68 (computer controls) and 211.194 (laboratory records) citations with the Part 11 requirement named in the narrative.

- Source: FDA, Part 11, Electronic Records; Electronic Signatures: Scope and Application — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application
- Regulation hubs: 21 CFR Part 11 (https://dsrv.io/regulations/21-cfr-part-11); 21 CFR 211.68 (https://dsrv.io/regulations/21-cfr-211-68)
- Latest DSRV coverage: Your Next 483 Observation Is Running on a Timer — https://dsrv.io/articles/managed-agents-scheduled-runs-483-inspection-risk
- Ask the Vault: https://dsrv.io/vault?q=Which%20Part%2011%20controls%20does%20FDA%20actually%20enforce%20through%2021%20CFR%20211.68%3F
### Certificate of analysis (COA)

- Anchor: https://dsrv.io/glossary#certificate-of-analysis
- Category: Laboratory and data

A supplier's report of the test results for a specific lot of a component. Under 21 CFR 211.84(d)(2) a manufacturer may rely on a supplier's COA in place of its own full testing only after establishing the reliability of the supplier's analyses through validation at appropriate intervals, and it must still run at least one specific identity test on each lot.

**In inspections.** Accepting COAs without ever having qualified the supplier, or skipping the identity test, is one of the most repeated 211.84 citations in recent Warning Letters.

- Source: 21 CFR 211.84, Testing and approval or rejection of components (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-E/section-211.84
- Regulation hubs: 21 CFR 211.84 (https://dsrv.io/regulations/21-cfr-211-84)
- Latest DSRV coverage: A Quality Unit That Averaged Away Its Own OOS Failures — https://dsrv.io/articles/abs-corp-oos-averaging-batch-record-alteration
- Ask the Vault: https://dsrv.io/vault?q=What%20does%2021%20CFR%20211.84%20require%20before%20a%20manufacturer%20can%20rely%20on%20a%20supplier's%20certificate%20of%20analysis%3F
### Laboratory controls

- Anchor: https://dsrv.io/glossary#laboratory-controls
- Category: Laboratory and data

The 21 CFR 211 Subpart I requirements for the laboratory: scientifically sound specifications, sampling plans, and test procedures (211.160), testing of each batch before release (211.165), a written stability program (211.166), and laboratory records that include complete data from every test (211.194).

**In inspections.** Subpart I is where OOS handling, method validation, and stability failures are cited; 211.165 and 211.194 together cover most laboratory observations.

- Source: 21 CFR 211.165, Testing and release for distribution (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-I/section-211.165
- Regulation hubs: 21 CFR §211.165 (https://dsrv.io/regulations/21-cfr-211-165); 21 CFR 211.194(a) (https://dsrv.io/regulations/21-cfr-211-194-a); 21 CFR §211.166 (https://dsrv.io/regulations/21-cfr-211-166)
- Latest DSRV coverage: FDA's Evolving Stance on Real-Time Release Testing (RTRT) — https://dsrv.io/articles/fda-real-time-release-testing-rtrt
- Ask the Vault: https://dsrv.io/vault?q=What%20laboratory%20control%20failures%20does%20FDA%20cite%20under%2021%20CFR%20211%20Subpart%20I%3F
### Pharmaceutical water system (PW / WFI)

- Anchor: https://dsrv.io/glossary#pharmaceutical-water
- Category: Laboratory and data

The system that produces, stores, and distributes water used in manufacturing, from purified water to water for injection. 21 CFR 211.48 requires a potable supply under continuous positive pressure and free of defects that could contaminate product; USP general chapter 1231 describes design, qualification, and monitoring expectations.

**In inspections.** Water citations rarely stay on 211.48: a biofilm or endotoxin excursion that was not investigated is cited under 211.192, and one that was averaged away under 211.194.

- Source: 21 CFR 211.48, Plumbing (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-C/section-211.48
- Regulation hubs: 21 CFR 211.48 (https://dsrv.io/regulations/21-cfr-211-48); 21 CFR 211.192 (https://dsrv.io/regulations/21-cfr-211-192); USP (https://dsrv.io/regulations/usp)
- Latest DSRV coverage: FDA’s 2025–2026 Warning-Letter Pattern: Water Systems Are Still Breaking Quality Systems, Not Just Utilities — https://dsrv.io/articles/water-systems-warning-letter-pattern
- Ask the Vault: https://dsrv.io/vault?q=What%20is%20FDA%20citing%20about%20pharmaceutical%20water%20systems%20in%20recent%20Warning%20Letters%3F

## Stability (4)

### Stability testing program

- Anchor: https://dsrv.io/glossary#stability-program
- Category: Stability

The written program 21 CFR 211.166 requires to assess the stability characteristics of a drug product and to set its storage conditions and expiration date: sample size and test intervals based on statistical criteria, storage conditions, validated stability-indicating methods, and testing in the marketed container. ICH Q1A(R2) defines the long-term and accelerated conditions and testing frequency used for registration.

**In inspections.** Missing pull points, unvalidated methods, and expiration dates without supporting data are cited under 211.166; the question that follows is what happens to product already on the market.

- Source: 21 CFR 211.166, Stability testing (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-I/section-211.166
- Regulation hubs: 21 CFR §211.166 (https://dsrv.io/regulations/21-cfr-211-166); ICH Q1A(R2) (https://dsrv.io/regulations/ich-q1a-r2)
- Latest DSRV coverage: What Evidence Supports a Stability Justification? — https://dsrv.io/articles/what-evidence-supports-a-stability-justification
- Ask the Vault: https://dsrv.io/vault?q=What%20does%2021%20CFR%20211.166%20require%20a%20stability%20program%20to%20document%3F
### Expiration date and shelf life (Retest period)

- Anchor: https://dsrv.io/glossary#expiration-date
- Category: Stability

The date, required on the label by 21 CFR 211.137, through which a drug product is expected to meet its specifications when stored as labeled, determined by appropriate stability testing. ICH Q1E describes how to evaluate stability data and when a shelf life may be extrapolated beyond the real-time data available. For drug substances the equivalent concept is the retest period.

**In inspections.** A shelf-life claim that leans on extrapolation without the statistical basis Q1E describes, or on batches that are not representative, is where stability Warning Letters start.

- Source: 21 CFR 211.137, Expiration dating (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-G/section-211.137
- Regulation hubs: ICH Q1E (https://dsrv.io/regulations/ich-q1e); ICH Q1A(R2) (https://dsrv.io/regulations/ich-q1a-r2); 21 CFR §211.166 (https://dsrv.io/regulations/21-cfr-211-166)
- Latest DSRV coverage: What Evidence Supports a Stability Justification? — https://dsrv.io/articles/what-evidence-supports-a-stability-justification
- Ask the Vault: https://dsrv.io/vault?q=When%20can%20a%20shelf%20life%20be%20extrapolated%20beyond%20the%20available%20real-time%20stability%20data%3F
### Bracketing and matrixing

- Anchor: https://dsrv.io/glossary#bracketing-matrixing
- Category: Stability

Reduced stability study designs described in ICH Q1D. Bracketing tests only the extremes of a design factor such as strength or container size, on the assumption that intermediates are covered. Matrixing tests a subset of the possible samples at each time point. Both trade full data for a justified reduction in testing.

**In inspections.** A reduced design needs its justification on file before the study starts; a bracketing rationale written after a middle strength failed does not hold up.

- Source: ICH Q1D, Bracketing and Matrixing Designs — https://www.ich.org/page/quality-guidelines
- Regulation hubs: ICH Q1D (https://dsrv.io/regulations/ich-q1d)
- Latest DSRV coverage: When Stability Data Gaps Become Inspection Exposure — https://dsrv.io/articles/when-stability-data-gaps-become-inspection-exposure
- Ask the Vault: https://dsrv.io/vault?q=When%20is%20a%20bracketing%20or%20matrixing%20stability%20design%20justified%20under%20ICH%20Q1D%3F
### Photostability testing

- Anchor: https://dsrv.io/glossary#photostability
- Category: Stability

The ICH Q1B evaluation of whether light exposure produces unacceptable change in a drug substance or product. It comprises forced-degradation studies and confirmatory studies at a defined overall illumination and near-ultraviolet energy, in the immediate pack and, if needed, the marketing pack.

**In inspections.** Photostability comes up when a product is repackaged or its container changes and no one revisited whether the original Q1B study still covers the new pack.

- Source: ICH Q1B, Photostability Testing — https://www.ich.org/page/quality-guidelines
- Regulation hubs: ICH Q1B (https://dsrv.io/regulations/ich-q1b)
- Latest DSRV coverage: What Evidence Supports a Stability Justification? — https://dsrv.io/articles/what-evidence-supports-a-stability-justification
- Ask the Vault: https://dsrv.io/vault?q=Does%20a%20container%20change%20require%20repeating%20ICH%20Q1B%20photostability%20testing%3F

## Validation (5)

### Process validation (PPQ / CPV)

- Anchor: https://dsrv.io/glossary#process-validation
- Category: Validation

The collection and evaluation of data, from process design through commercial production, that establishes scientific evidence a process is capable of consistently delivering quality product. FDA's 2011 guidance describes three stages: process design, process qualification (including process performance qualification, PPQ), and continued process verification. The underlying rule is 21 CFR 211.100(a).

**In inspections.** Validation citations under 211.100 name processes that were never qualified, PPQ batches that failed and were explained away, or a continued verification program that exists on paper only.

- Source: FDA, Process Validation: General Principles and Practices — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/process-validation-general-principles-and-practices
- Regulation hubs: 21 CFR 211.100 (https://dsrv.io/regulations/21-cfr-211-100); 21 CFR 211.100(a) (https://dsrv.io/regulations/21-cfr-211-100-a)
- Latest DSRV coverage: Your Next 483 Observation Is Running on a Timer — https://dsrv.io/articles/managed-agents-scheduled-runs-483-inspection-risk
- Ask the Vault: https://dsrv.io/vault?q=What%20has%20FDA%20cited%20under%2021%20CFR%20211.100%20about%20process%20validation%3F
### Analytical procedure validation (Method validation)

- Anchor: https://dsrv.io/glossary#analytical-procedure-validation
- Category: Validation

The demonstration that a test method is suitable for its intended purpose. 21 CFR 211.165(e) requires the accuracy, sensitivity, specificity, and reproducibility of test methods to be established and documented. ICH Q2(R2) sets out the validation characteristics and Q14, its companion, describes lifecycle development of the procedure.

**In inspections.** A method transferred from a supplier or a compendium without site verification, or changed without revalidation, is cited under 211.165(e) and 211.194(a)(2).

- Source: ICH Q2(R2), Validation of Analytical Procedures — https://www.ich.org/page/quality-guidelines
- Regulation hubs: ICH Q2(R2) (https://dsrv.io/regulations/ich-q2-r2); ICH Q14 (https://dsrv.io/regulations/ich-q14); 21 CFR §211.165 (https://dsrv.io/regulations/21-cfr-211-165)
- Latest DSRV coverage: ICH Q14 Analytical Procedure Development: What QA Teams Need to Know — https://dsrv.io/articles/ich-q14-analytical-procedure-development
- Ask the Vault: https://dsrv.io/vault?q=What%20does%20ICH%20Q2(R2)%20change%20about%20validating%20an%20analytical%20procedure%3F
### Computerized system validation (CSV / CSA)

- Anchor: https://dsrv.io/glossary#computerized-system-validation
- Category: Validation

The documented evidence that a computer system used in production or control does what it is intended to do. 21 CFR 211.68 requires that such systems be routinely calibrated, inspected, or checked, that input and output be verified for accuracy, and that program changes be made only by authorized personnel. Computer software assurance (CSA) is FDA's risk-based framing of the same objective.

**In inspections.** 211.68 citations name systems that were validated once and then changed, spreadsheets used for release calculations with no controls, and backups that were never tested.

- Source: 21 CFR 211.68, Automatic, mechanical, and electronic equipment (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-D/section-211.68
- Regulation hubs: 21 CFR 211.68 (https://dsrv.io/regulations/21-cfr-211-68); 21 CFR Part 11 (https://dsrv.io/regulations/21-cfr-part-11)
- Latest DSRV coverage: Your Next 483 Observation Is Running on a Timer — https://dsrv.io/articles/managed-agents-scheduled-runs-483-inspection-risk
- Ask the Vault: https://dsrv.io/vault?q=What%20computer%20system%20controls%20is%20FDA%20citing%20under%2021%20CFR%20211.68%3F
### Aseptic processing

- Anchor: https://dsrv.io/glossary#aseptic-processing
- Category: Validation

Manufacturing a sterile product by sterilizing the product, container, and closure separately and assembling them in a controlled environment, as opposed to terminal sterilization. 21 CFR 211.113(b) requires written procedures designed to prevent microbiological contamination of sterile products, including validation of all aseptic and sterilization processes; FDA's 2004 guidance sets out the expectations for facility design, personnel, media fills, and environmental monitoring.

**In inspections.** Media-fill failures, interventions that were never simulated, and environmental excursions without investigation are the sterile citations that carry the highest inspection exposure.

- Source: FDA, Sterile Drug Products Produced by Aseptic Processing: Current Good Manufacturing Practice — https://www.fda.gov/regulatory-information/search-fda-guidance-documents/sterile-drug-products-produced-aseptic-processing-current-good-manufacturing-practice
- Regulation hubs: 21 CFR Part 211 (https://dsrv.io/regulations/21-cfr-part-211)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=What%20aseptic%20processing%20failures%20is%20FDA%20citing%20under%2021%20CFR%20211.113(b)%3F
### Quality Management System Regulation (QMSR)

- Anchor: https://dsrv.io/glossary#qmsr
- Category: Validation

The amended 21 CFR Part 820 for medical devices, which incorporates ISO 13485:2016 by reference and took effect on 2 February 2026, replacing the former Quality System Regulation. It applies to devices and combination products with a device constituent, not to drug products under Part 211.

**In inspections.** For drug-device combination products, 21 CFR Part 4 decides which device provisions apply alongside Part 211; risk management under ISO 14971 is the early citation theme in QMSR inspections.

- Source: FDA, Quality Management System Regulation (QMSR) — https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr
- Ask the Vault: https://dsrv.io/vault?q=What%20is%20FDA%20citing%20in%20the%20first%20months%20of%20QMSR%20inspections%3F

## Regional and international (3)

### WHO Prequalification (WHO-PQ)

- Anchor: https://dsrv.io/glossary#who-prequalification
- Category: Regional and international

The World Health Organization programme that assesses medicines, vaccines, diagnostics, and manufacturing sites so that United Nations agencies and national procurers can buy products of assured quality. It includes a dossier assessment and an inspection of the manufacturing site against WHO GMP guidelines.

**In inspections.** WHO-PQ inspection reports are public, and a site's FDA and EU inspection history feeds into its prequalification risk assessment.

- Source: WHO, Prequalification of Medical Products — https://extranet.who.int/prequal/
- Regulation hubs: WHO-PQ (https://dsrv.io/regulations/who-pq); WHO-PQ GMP Guidelines (https://dsrv.io/regulations/who-pq-gmp-guidelines)
- Latest DSRV coverage: 108 New Drug Facilities in Nigeria. Most Have Never Been Inspected. — https://dsrv.io/articles/nafdac-5plus5-new-manufacturers-inspection-gap
- Ask the Vault: https://dsrv.io/vault?q=How%20does%20a%20manufacturer%20prepare%20for%20a%20WHO%20Prequalification%20site%20inspection%3F
### NAFDAC 5+5 policy (5+5)

- Anchor: https://dsrv.io/glossary#nafdac-5-plus-5
- Category: Regional and international

The Nigerian National Agency for Food and Drug Administration and Control directive under which the registration of certain imported finished pharmaceutical products is limited to an initial five-year period, with any further five-year renewal conditional on a plan to move manufacturing into Nigeria. It is a market-access rule, not a GMP standard, but it drives site qualification and technology transfer decisions.

**In inspections.** For an importer the exposure is the registration itself; for the local partner it is the GMP inspection that comes with a new or transferred line.

- Source: NAFDAC, National Agency for Food and Drug Administration and Control — https://www.nafdac.gov.ng/
- Regulation hubs: NAFDAC 5+5 Policy (https://dsrv.io/regulations/nafdac-5-5-policy)
- Latest DSRV coverage: 108 New Drug Facilities in Nigeria. Most Have Never Been Inspected. — https://dsrv.io/articles/nafdac-5plus5-new-manufacturers-inspection-gap
- Ask the Vault: https://dsrv.io/vault?q=What%20does%20the%20NAFDAC%205%2B5%20policy%20require%20from%20a%20company%20that%20currently%20imports%20finished%20products%20into%20Nigeria%3F
### USP general chapters (USP)

- Anchor: https://dsrv.io/glossary#usp-general-chapters
- Category: Regional and international

The United States Pharmacopeia's numbered chapters. Chapters numbered below 1000 are enforceable requirements when referenced by a monograph or by general notices; chapters numbered 1000 and above are informational. A drug that claims a USP name must meet the monograph, and 21 CFR 211.194 requires that compendial methods be verified as suitable under actual conditions of use.

**In inspections.** Compendial methods used without suitability verification, and water systems that ignore chapter 1231, are the recurring USP-related citations.

- Source: 21 CFR 211.194, Laboratory records (eCFR) — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.194
- Regulation hubs: USP (https://dsrv.io/regulations/usp)
- Latest DSRV coverage: COAs Are Not Component Verification. Five FDA Warning Letters Just Said So. — https://dsrv.io/articles/coa-not-component-verification-fda-june-cluster
- Ask the Vault: https://dsrv.io/vault?q=Which%20USP%20general%20chapters%20are%20enforceable%2C%20and%20how%20does%20FDA%20cite%20them%3F

## AI in quality (1)

### Model Context Protocol (MCP)

- Anchor: https://dsrv.io/glossary#model-context-protocol
- Category: AI in quality

An open protocol that standardizes how AI applications connect to external tools, data sources, and services. In a regulated quality environment an MCP server that reads batch records, LIMS data, or document systems is a computerized system under 21 CFR 211.68, and a change to the protocol or the server is a change to that system.

**In inspections.** No FDA citation names MCP yet. The exposure is indirect: a validated system whose AI integration changed without change control, or whose outputs were used in a release decision without human review.

- Source: Model Context Protocol, specification — https://modelcontextprotocol.io/
- Regulation hubs: 21 CFR 211.68 (https://dsrv.io/regulations/21-cfr-211-68)
- Latest DSRV coverage: Your Next 483 Observation Is Running on a Timer — https://dsrv.io/articles/managed-agents-scheduled-runs-483-inspection-risk
- Ask the Vault: https://dsrv.io/vault?q=How%20should%20a%20pharma%20quality%20team%20treat%20an%20MCP%20server%20change%20under%20change%20control%3F

## Boundaries

Definitions are paraphrases of the cited source, not the source itself; the inspection notes are DSRV interpretation. DSRV content is decision support and regulatory intelligence, not medical advice, legal advice, or a replacement for the responsible quality unit. Verify against the official FDA/ICH source before acting.