A guide to GxP compliance

1. What is GxP?

GxP refers to the ‘good practice’ guidelines and regulations created to ensure that food, medical devices, drugs and other life science products are safe, effective and usable.

The ‘X’ in GxP can refer to a number of disciplines - GMP (Good Manufacturing Practice), GDP (Good Distribution Practice), GLP (Good Laboratory Practice) and many more.

Together they define the various ways companies in regulated industries are required to control their processes, procedures, people and premises to ensure consistency and quality in their products.

Who defines and oversees GxP compliance in the Life Sciences industry?

The American Food and Drug Administration (FDA),  the European Medicines Agency (EMA), the UK's Medicines and Healthcare Products Regulatory Agency (MHRA), as well as the International Organization for Standardization (ISO) all define and refer to GxP in their publications. These organisations, among others, promote, oversee and enforce their observation around the world.

Which sectors and companies need to adhere to GxP?

This guide will concentrate on GxP as it relates to:

  • Medical Device Manufacturers
  • In Vitro Medical Devices (IVD)
  • Pharmaceuticals
  • Life sciences
And those working across these industries in other capacities:
  • Subcontracting suppliers
  • Importers and distributors

The disciplines of GxP can also be relevant for those working in the following sectors:

  • Agritech
  • Food production
  • Novel food production
  • Medicinal Cannabis Producers
  • Cosmetics

GxP is all about control

The GxP requirements outlined by the regulating bodies, ask businesses to formally define the protocol and controlled processes vital to the safety of their end products. For example,

  • How products are consistently manufactured
  • How new technologies are researched
  • How product designs are tested and challenged
  • How laboratory and manufacturing equipment is calibrated and maintained
  • How their processes are traced from start to finish through controlled documentation
  • How different kinds of products are stored and transported
  • How their workers are trained
  • How records of all these processes are captured and maintained to monitor the ongoing effectiveness of these systems

So, no matter what sector you operate in and the specific GxP standards that apply to you, you need the tools and quality systems to:

gxp protocol

Because these are the methods by which you will:

  • Create high performing products of consistent quality in the most efficient way
  • Minimise risk of product failure - proportional to its potential to harm
  • Provide evidence that regulated products are in conformity with regulatory requirements
  • Ensure knowledge is maintained in your organisation
  • Establish a mechanism for communication in all levels of your company
  • Achieve accountability across an organisation for regulated activity

Why is GxP compliance so important?

Due to the potential risk to human health of the products they oversee, the powers of the regulators in these sectors are far-reaching.

GxP compliance is monitored and enforced by agencies and government bodies through certification requirements, regular inspections and unannounced auditing.

In many cases the scope of the regulator’s remit continues to widen taking in new sectors and product categories. This reflects the extent of innovation in these industries, as well as cross-sector dependencies in the production techniques they use.

For this reason, regulators often require companies to verify and vouch for the GxP compliance of their partners throughout the supply chain.

As a result more and more companies are finding they need to adopt GxP - and prove they have adopted them - to protect their markets, supplier status and future business.

So, what are the specific areas of best practice which GxP covers?

GxP defines the best practices that cover every part of the life sciences industry and value chain.

But all GxP can be seen as subsets of Good Manufacturing Practice (GMP) - because they all feed into and support the safe production and delivery of regulated life science products.

GxP is about controlling the processes by which these products are developed, manufactured and handled in defined ways throughout the supply chain - ensuring they are of consistent quality and can be used as intended by consumers:

gxp best practices

The central pillars of GxP

Documentation, Communication, Traceability and Accountability

To demonstrate that required controls have been observed and ensure potential non-conformance in end products can be identified and corrected - there must be accountability and traceability in data and documentation throughout the product lifecycle.

Data integrity is key

Knowing that data and documentation is accurate, up-to-date and accessible (and that they cannot be changed or tampered with) gives a high level of confidence to companies and regulators. It tells regulators that required activity has been undertaken and faithfully recorded by the right people at the right time.

Good Documentation Practices (GDocP) are central to all GxP

Underpinning all GxP, therefore, are the record-keeping and documentation requirements that keep processes trackable and companies fully accountable for the integrity of their data and the quality of their end products. This is referred to by the FDA and others as:

GdocP - Good Documentation Practice

It should be noted that GDocP is not a ‘standard’ in its own right, but is a key part of all the practices described above.

GxP: If it isn’t documented - it didn’t happen

To be compliant with GxP organisations need to specify, document and log every critical action made by every employee in the development, manufacture and delivery of a product or project by every employee. But they should do this in a way commensurate with the risk that non-conformance poses. And in a way that is ultimately auditable.

Quality Systems are needed to implement and validate GxP

To ensure all these required actions are understood and observed across an organisation, companies need Quality Management Systems to be in place. These Quality Management Systems need to:

  • Qualify
  • Control
  • Record

all the key GXP processes, systems and procedures that ensure the safety of their end products.

Who needs a QMS?

Quality Management Systems are a ubiquitous requirement for operators in every part of the life science industry and supply chain. From farmers cultivating raw ingredients and researchers testing their safety in laboratory settings - to the manufacturers and distributors responsible for turning them into products and delivering them to end users.

The risks of non-compliance in GxP

The risks of non-compliance in life sciences GxP are many and varied, which is why these standards are codified and harmonised in regulated sectors as much as possible around the world.

Consequences of the breakdown of best practice include product failure, wasted time and resource. But at the more serious end of the scale they include serious physical harm to end users resulting in the revocation of licenses, major fines and even imprisonment for those with liability.

Inadequate documentation: a major factor in GxP non-compliance

Many of the fines and sanctions issued around non-compliance in GxP are as a result of inadequate and incomplete documentation. Data shows the FDA Observation Form 483 is most commonly issued because there is an absence of written procedures and CAPA processes are not adequately defined or followed. At the same time the MHRA in the UK cite insufficient or incomplete validation of computer systems and processes as a common reason for failed inspections.


Want this guide to take away? We'll deliver it to your inbox.

GxP compliance

2. What is GMP? - Good Manufacturing Practice

GMP, also known as cGMP (Current Good Manufacturing Practice) ensures pharmaceutical products, medical devices and other regulated items are consistently manufactured and controlled according to quality standards - thus reducing the risk of harm to consumers.

Rules and interpretations differ from country to country (and change frequently) but all GMP require that products

  • are of consistently high quality;
  • are appropriate for their intended use;
  • meet the requirements of the marketing authorisation or clinical trial authorisation.

The US FDA inspects manufacturing facilities producing drugs, medical devices and In Vitro Diagnostics to ensure cGMP are in place. These include facilities around the world that manufacture active ingredients and finished products. Inspections follow a standard approach and are conducted by highly trained FDA staff.

What’s different about life science manufacturing?

The kind of items these regulations cover are difficult to dismantle (or individually check) for quality testing purposes after they have been assembled in a production process. And their failure could represent a substantial risk to human health. Think of a strip of pills or a complex software-controlled medical device. Although batch testing is an important part of QC, GMP instead, seeks to ensure quality is ‘built into’ a product, through the effective and consistent control of the processes used to create it.

The 5ps of GMP- are the best practice areas of focus for life science manufacturers. They prioritise reducing the risk of non-conformities in end products by ensuring the consistent implementation of processes and procedures, equipment and personnel training, across the product lifecycle.

The 5Ps of GMP

Through proper SOP documentation, implementation and record keeping GMP ensures:

  • Standard operating procedures are defined and well-documented.
  • Manufacturing processes are defined and controlled. Any changes to processes are evaluated and validated.
  • The manufacturing process is recorded to prove that all required procedures and instructions are properly followed.
  • Manufacturing occurs in a controlled environment that prevents cross-contamination.
  • The causes of any quality defects are investigated and action taken to ensure that the defect does not occur again.

GMP also sets out best practice methods for manufacturers to ensure their products are packaged and labelled correctly, and that they have the ingredients and strength they claim to have.

 GMP is a crucial element of end to end quality management. Together with quality control and quality risk management, it needs to form part of an overall QMS, designed to reduce the risk of contamination, errors and deviations in production.

3. What is GAMP - Good Automated Manufacturing Practice?

Good Automated Manufacturing Practice (GAMP) are the guidelines for companies involved in the development and implementation of automated systems for the Pharmaceutical and Food Industries.

Increasing automation presents huge opportunities for Pharmaceutical manufacturers as they seek to produce drugs more quickly, efficiently and cost-effectively. But more automation inevitably means more complexity and an increasing risk of failure and non-conformance in end products.

For a pharma production line controlled by computer systems much of the focus on regulating quality of output shifts to the development and maintenance of the software itself.

What is Computerised System Validation?

Computerised Systems Validation (CSV) is a way of proactively guarding against the failure of such automation, and it has become a key feature of the regulatory landscape.

A CSV process establishes documentary evidence that a specific computerised system will consistently produce a product meeting its predetermined specifications and quality attributes.

This V model of software validation ensures quality is ‘built into’ your product development and management processes rather than simply ‘tested for’ and corrected retrospectively in an end Product.

V Model (1)

The V-model provides a logical sequence that helps to organise the complex activities of defining a project scope, executing it, and qualifying it at every stage.

The V model provides an excellent basis for design control and tracking changes as a project proceeds. And the right document management system can help companies organise and generate the documentation required to execute and record this process of specification, qualification and validation - with all the relevant files indexed and stored for future auditing purposes.

But there is a logistical problem with this. This kind of validation can be a time consuming and expensive process to execute. Where end products are complex and product updates are frequent, these validation requirements can overwhelm a business resource and undermine their agility. In fact, when a company is using other manufacturers software to automate their systems, it might be impossible to achieve. That’s where the GAMP5 guidelines are intended to help.

What is GAMP5

GAMP 5 ® refers to the ISPE's best practice guidance (Version 5) which has been adopted by the industry as a framework for companies to successfully validate their computerised systems using a risk-based approach.

GAMP5 provides guidelines for required validation processes that take into account the following concepts

  • A holistic understanding of product and process
  • The way products can be managed and validated using a QMS
  • The way lifecycle management can be levered for more scalable validation processes
  • Encouraging a scientific approach to risk management that focuses on the systems that pose the most potential risk to end-users
  • Levering the involvement of suppliers in the validation process to avoid duplication of effort and speed up compliance

4. What is CSV for GxP?

Computerised Systems Validation is a requirement in many different parts of life science regulation including around the systems used to support GLP and GCP.

Adopting a Document Management System that functions as part of your QMS, can help a business verify and validate the operation of its required functionality while creating software systems. They can trigger validation processes to take place when new features are added, which are automatically documented as part of your change control process.

Defining and setting up these systems early on will help companies more successfully pass audits and inspections that increasingly focus on validation as a proactive measure against systems and product failure.

In the UK, the MHRA inspectorate have explained how inadequate CSV documentation frequently contributes to companies failing their audits:

“Many of these specific accounts point to a failure of systems and training when it comes to documentation, with processes of validation being sketchily defined or left half complete - pointing to a kind of process fatigue setting in at key moments in a company’s evolution of best practice.”

Inspecting and certifying bodies around the world have echoed these issues.

Validation for electronic Quality Management Systems

It should be noted that electronic Quality Management Systems themselves are ‘computerised systems’ that require validation.

ISO 13485 Clause 4.1.6, for example states that “software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application”

A good supplier will be able to supply ‘validation packs’ to assist you in meeting these application validation requirements.

5. What is GCP? - Good Clinical Practice

Good Clinical Practice (GCP) is a set of internationally recognised ethical and scientific quality requirements that must be followed when designing, conducting, recording and reporting on clinical trials that involve human beings.

The guidance on good clinical practice has been produced by the International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use.

Here's a summary of the 13 core principles of GCP, as outlined by the ICH.

What are the 13 Principles of Good Clinical Practice (GCP)?

Those who plan and administer clinical trials must ensure:

  1. Ethical Conduct: Uphold the highest ethical standards in all trials.
  2. Subject Well-being: Prioritise the well-being, rights, and safety of trial subjects.
  3. Risk Assessment: Assess foreseeable risks against anticipated benefits before initiation.
  4. Benefit Justification: Proceed with trials only if benefits justify the risks.
  5. Scientific Soundness: Ensure trials are scientifically sound with clear written protocols.
  6. Protocol Approval: Obtain prior IRB/IEC approval for all trial protocols.
  7. Qualified Medical Care: Assign qualified physicians or dentists for medical decisions and care.
  8. Individual Qualification: Ensure all involved are qualified to perform their tasks.
  9. Informed Consent: Obtain freely given informed consent from all subjects.
  10. Accurate Recording: Accurately record all clinical trial information.
  11. Information Handling: Handle and store trial information securely and accurately.
  12. Precise Reporting: Enable precise reporting, interpretation, and verification of trial information.
  13. Regulatory Compliance: Adhere to GCP and applicable regulatory requirements.

These principles of GCP form the basic framework for the safe and accountable planning, governance and administration of every part of a clinical trial. 

How to manage clinical trials and meet GCP guidelines with Cognidox

Adopting a Quality Management System is part and parcel of establishing a robust, compliant and reproducible approach to clinical testing.

6. What is Good Pharmacovigilance Practice (GPvP)

GPvP refers to a minimum set of standards defined by the EMA which ensures companies continue to monitor the safety of the medicines they have developed after they have been launched in the market.

What is Pharmacovigilance? (PV)

Pharmacovigilance refers to the scientific process of data collection, analysis, monitoring and prevention of any adverse effects in drugs and therapies.

It is a set of ongoing requirements intended to determine which adverse events are acceptable side effects of a drug or therapy, given their overall benefit to human health - and which are not.

The proper administration of PV within a business authorized to market and sell drugs is vital to prevent the catastrophic failures of oversight experienced in the past, where medicines such as Thalidomide continued to be licensed and sold, despite strong evidence appearing of its horrifying side effects.

What is GPvP compliance?

GPvP entails constructing and maintaining a Quality Management System capable of storing and allowing access to vast quantities of safety data, which, in turn, is used to monitor and report on the safety of all the drugs a company has authorisation to market.

The QMS describes and defines all the measures, processes and procedures necessary to ensure that suspected adverse reactions to medicinal products are collected, processed and acted upon.

There are many requirements for the effective and auditable administration of this system including:

  • The appointment of a Qualified Person Responsible For Pharmacovigilance (QPPV) - an individual who is personally responsible for the safety of the human pharmaceutical products marketed by that company.
  • The creation and maintenance of a Pharmacovigilance System Master File. A PSMF is a document describing the pharmacovigilance system used by the marketing authorisation holder (MAH) with respect to one or more authorized medicinal products.
  • The preparation for the attention of the authorities of notification of serious adverse effects (ICSRs), periodic safety reports (PSURs) and reports on studies of post-authorisation safety (PASS);

In the UK the MHRA inspects marketing authorisation holders ( MAH ) to determine that they comply with these obligations.

7. What is GLP? - Good Laboratory Practice

Good laboratory practice (GLP) are principles which ensure the quality and integrity of non-clinical laboratory studies that support research or marketing permits for products regulated by government agencies. They are defined in FDA 21 CFR Part 58 and other regulatory codes.

GLP should govern studies around the hazards and risks to health and the environment posed by:

  • Medicines
  • Pesticides
  • Cosmetics
  • Veterinary drugs
  • Food and feed additives
  • Industrial chemicals

A key objective of GLP is securing data integrity through Good Documentation Practice (GDocP). GDocP ensures that regulated documentation is always accessible to those who need it - as well as data that is, Attributable, Legible, Contemporaneous, Original and Accurate (ALCOA+).

Adherence to these and other elements of GLP ensures that published data properly reflects the results obtained during those studies and can therefore be relied upon when making risk/safety assessments in development projects.

Good Laboratory Practice is recognised and reproduced through a company’s Quality Management System. A Quality Management System ensures that every study undertaken by a laboratory is planned, performed, monitored, recorded, archived and reported under the proper conditions in a consistent and repeatable way.

8. What is GDP? - Good Distribution Practice

Good Distribution Practice (GDP) governs the wholesale distribution of medicinal products and is designed to ensure quality and integrity is maintained throughout the supply chain.

The World Health Organisation describes GDP as:

“an essential tool to secure the distribution system from counterfeits, unapproved, illegally imported, stolen, counterfeit, substandard, adulterated, and/or misbranded pharmaceutical products”

GDP keeps products safe and in a usable condition for their intended consumers

Distribution is important in the life science industry because of the way sensitive or fragile medical products are stored and transported can impact their APIs (Active Product Ingredients) and future intended performance.

Regulators such as the EMA and the FDA have begun to increase focus on this area, specifying the way processes and procedures should be implemented and recorded for GDP compliance. In the UK, the MHRA certifies adherence to GDP through inspection and auditing - and licenses businesses accordingly.

Anyone importing, holding, procuring, supplying or exporting medicinal products or active substances have to adhere to these guidelines - and be able to demonstrate how they comply.

Operators in this sector need to have auditable systems that specify and define the measures they take to ensure:

  • Medical products are always transported and stored under the right conditions
  • Contamination, theft or tampering is prevented
  • Recalls and complaints can be effectively managed
  • Only authorised products enter the distribution network

It should be noted that the number of critical dependencies within the supply chain means that in the EU, distributors, manufacturers and their agents are now facing ‘joint and several liability’ for quality failings in end products. Manufacturers need to be confident that their suppliers and distributors are implementing GDP in a trackable and auditable way.

For all these reasons regulators around the world are increasingly requiring distributors to have auditable Quality Management Systems that encourage greater accountability, traceability and co-operation throughout the supply chain.

Digital QMS are needed to prove the  GDP  processes and procedures distributors have in place to handle and deliver products in ways that ensure their integrity and usability.

9. What is GACP? - Good Agricultural and Collection Practice for Medicinal Plants

Good Agricultural and Collection Practices (GACP) as defined by the WHO and others to address the specific concerns of growing, collecting and primary processing of herbs and plants that are used for medicinal purposes.

These include the QA practices, training responsibilities, and good document management practice - including the creation of Quality Management Systems to ensure repeatability and consistency in the standards of end products supplied to the market.

GACP - Documentation Requirements

  • For cultivated medicinal plants it is essential to document the type, quantity and the date of harvest as well as the chemicals and other substances used during production such as fertilizers, pesticides, herbicides and growth promoters.
  • All batches from each designated area should be unambiguously and unmistakably identified by batch number.
  • All processes and procedures that could affect the quality of the product must be documented and used to promote best practice throughout the collection and storage of the regulated materials

In recent years with the growth of interest in medicinal cannabis and as a legalised and regulated ingredient in ‘novel foods’ - producers, distributors and manufacturers of associated products are having to rapidly respond to new regulatory requirements.

One of the most challenging areas for these evolving companies - has been the requirement to build the Quality Management Systems, with which they can document and help implement best practice in an agile and auditable way.

So, you want to be a successful medical device developer?

Then download this guide to get an eBook version delivered to your inbox, featuring an additional Med Tech glossary.

pages shadow (1)

10. What is GDocP? - good documentation practice

GDocP (Good Documentation Practices) are the standards by which data and documents should be created and maintained in the life sciences industry.

All GxP have at their heart GdocP which allows for auditable and accurate record-keeping, good governance and quality management.

For example, compliance with the Food and Drug Administration's GLP as well as GMP regulations for drugs and medical devices (21 CFR Parts 211 and 820) all speak about the observation of Good Documentation Practices.

What types of document need to be created and maintained using Good Documentation Practices?

  • Batch Records
  • Bills of Materials (BOMs)
  • Certificate of Analyses (CoA)
  • Certificate of Compliance (CoC)
  • Laboratory Notebooks
  • Logbooks
  • Policies
  • Protocols
  • Quality records (including CAPAs, internal inspection reports and change control)
  • Standard Operating Procedures
  • Test Methods
  • Training Documentation
  • Validation Documents (IQs, OQs and PQs)
  • Product and Sample Labels

Good documentation practice reflects the principles of ALCOA+.

11. What is ALCOA+?

ALOCA+ is an acronym that defines the fundamentals for ensuring data integrity in ‘source data’. It defines the critical elements of Good Documentation Practice:

Definition of ALOCA+ acronym

12. GxP and Quality Management Systems

Throughout the regulatory literature - Quality Systems are cited as the way GxPs are expected to be defined, implemented, audited and subject to a process of continuous improvement.

The definition and replication of all these GxPs across a business depends on the ability to build a robust Quality Management System that is accessible to the people who need to refer to it in their daily work. 

A good digital Quality Management System can underpin a company’s ability to control the administration and observation of GxP standards across a business.

The right digital QMS (with all its document control capabilities) gives workers the tools to create and maintain a ‘single, accessible and definitive source of truth’ when it comes to recording and implementing GxP in their working practices.

9 ways a digital QMS can help Gxp compliance

13. What does it take to be GxP compliant?

Whether you are manufacturing a drug or medical device, warehousing active ingredients (APIs) or carrying out laboratory testing, the demands of GxP compliance are fundamentally the same.

GxP compliance is about having the ability to implement (and prove you have implemented) all the controls identified as necessary for the delivery of a reliable, safe and usable end product or service.

Compliant businesses mitigate the risk of product failure (and, therefore, harm to consumers) through consistent process definition, training, procedural control and record keeping around all their working practices.

It's a proactive approach to quality and risk management through the implementation of best practice that notified bodies and regulators around the world need to inspect, audit and certify.

But while you need a QMS robust enough to protect consumers against the risk of product failure, your approach to GxP needs the flexibility to keep pace with new commercial opportunities and legislative changes.

In the end, the accessibility and agility of the digital tools you use to manage your quality management system will be pivotal to your successful and scalable compliance with the regulation.

Read more about GxP in the life science sector

Understanding FDA 21 CFR Part 11: A Guide for Life Science Developers

WTH is FDA 21 CFR Part 11? That’s a question many life science developers wanting to access the US market ...

10 Steps for Seamless EQMS Data Migration

Transferring data to a new electronic Quality Management System (eQMS) can seem like a daunting prospect. ...

What happened at CogniCon24?

On the 16th of May, Cognidox welcomed nearly 100 attendees from across the high-tech, medical device, and ...

5 Steps to a Robust Corrective Action Process

It’s the job of your corrective action process to identify and eliminate the systemic issues that will ...