Free Download · GxP + Part 11
The complete GxP compliance checklist
Every GxP family, GMP, GLP, GCP, GDP, plus 21 CFR Part 11, EU Annex 11, ICH Q9(R1), and ICH Q10. Built for QA Directors, Validation/CSV Managers, and Regulatory Affairs Leads running FDA, EMA, MHRA, and Health Canada inspection prep without a six-month consulting engagement. ALCOA+ data integrity and DSCSA Phase 2 traceability covered.
No credit card · No call required · Instant link
What's inside
Every GxP family + Part 11 + Annex 11 + ICH Q9/Q10, mapped and inspection-ready
GxP isn't a single regulation, it's a family. The checklist follows the structure FDA, EMA, MHRA, and Health Canada inspectors actually use, so what you complete maps 1:1 to what an inspector reviews on-site or what a buyer's quality questionnaire asks. 25+ control items across 8 framework families.
GMP · Good Manufacturing Practice
21 CFR 210/211 · EU GMP Vol. 4, Good Manufacturing Practice
- §211.42–58 · Facility design + environmental controls (HVAC, segregation, contamination prevention, qualified utilities)
- §211.63–72 · Equipment qualification + cleaning validation (URS, IQ, OQ, PQ, change-control)
- §211.100–115 · Process validation (lifecycle Stage 1/2/3, continued process verification, hold-time studies)
- §211.180–198 · Batch records + master production records (MPR, BPR, electronic batch record review by exception)
- §211.192 · Deviation + OOS investigations (root cause, impact assessment, batch disposition)
- §211.192 · CAPA program (corrective + preventive action, effectiveness checks, trend analysis)
GLP · Good Laboratory Practice
21 CFR 58 · OECD GLP, Good Laboratory Practice
- §58.105 · Test + control article characterization (identity, strength, purity, stability)
- §58.33 · Study director designation + responsibilities (single point of accountability)
- §58.35 · Quality Assurance Unit independence + study-based audits + master schedule
- §58.190–195 · Archive controls + raw-data retention (specimens, records, retention period, security)
GCP · Good Clinical Practice
21 CFR 50/56/312 · ICH E6(R3), Good Clinical Practice
- ICH E6(R3) §6 · Protocol + protocol amendments (objectives, design, statistical considerations, risk-based quality management)
- 21 CFR 56 · ICH E6 §3 · IRB / IEC review + informed consent (initial review, continuing review, expedited review)
- ICH E6(R3) §5 · Sponsor monitoring (risk-based monitoring plan, central + on-site monitoring, oversight of CROs)
- 21 CFR 312.32 · ICH E2A · Safety reporting + SUSAR / IND safety reports (15-day, 7-day, expedited timelines)
GDP · Good Distribution Practice
EU GDP 2013/C 343/01 · USP <1079>, Good Distribution Practice
- GDP §9.2 · Cold chain + temperature-controlled distribution (validated shipping lanes, calibrated dataloggers, excursion management)
- DSCSA · GDP §5 · Serialization + traceability (T3 transaction data, EPCIS events, suspect-product investigation)
- GDP §6 · Returns, recalls + falsified medicines (quarantine, decision tree, FMD safety features)
Part 11 · 21 CFR Part 11
21 CFR Part 11, Electronic Records + Signatures
- §11.10(e) · Audit trail (computer-generated, secure, time-stamped, capturing user, action, before/after value)
- §11.50–11.300 · Electronic signatures (unique to one individual, two distinct identification components, biometric or non-biometric)
- §11.10(a) · Computer system validation (URS · IQ · OQ · PQ · ongoing performance, GAMP 5 second-edition risk-based)
- §11.10(d) + (g) · System access controls (limited authorized individuals, authority checks, device checks)
- §11.10(i) · Personnel training (education + experience + training records for users + sysadmins of Part 11 systems)
Annex 11 · EU GMP Annex 11
EU GMP Annex 11, Computerized Systems
- §4.3 · System inventory + GxP risk assessment (classification, GAMP category 1–5, criticality, supplier audit)
- §4.1–4.8 · Validation lifecycle (URS, FS, configuration management, electronic data archive, decommissioning)
- §11 · Periodic review + business continuity (review cadence, IT disaster recovery, manual fall-back)
ICH Q9 · ICH Q9(R1), QRM
ICH Q9(R1), Quality Risk Management (in force Jan 2023)
- Q9(R1) Annex I.2 · FMEA / FMECA (process, design, equipment, severity × occurrence × detection scoring)
- Q9(R1) Annex I.4 · HAZOP for process + equipment (deviation guide-words on continuous + batch operations)
- Q9(R1) §6 · Subjectivity controls in risk scoring (formality, decision-making, documentation, addressed in 2023 revision)
ICH Q10 · ICH Q10, PQS
ICH Q10, Pharmaceutical Quality System
- Q10 §3.2.4 · Management review of process performance + product quality (cadence, inputs, outputs, action tracking)
- Q10 §3.2.2 · CAPA effectiveness verification (closure criteria, follow-up review, recurrence prevention)
- Q10 §3.2.3 · Knowledge management across the product lifecycle (development, transfer, commercial, discontinuation)
The PDF appendix includes the ALCOA+ control-mapping worksheet (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available) and a DSCSA Phase 2 T3 + EPCIS interoperability reference. 28 pages total.
Why use this checklist
Built for the inspector + the buyer questionnaire, not for slideware
FDA Form 483 observations cite Part 11 + data integrity in 80%+ of inspections. Across recent FDA drug-product and biologic inspection cycles, 21 CFR Part 11 electronic-records gaps and ALCOA+ data-integrity findings (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available) appear in roughly four of every five Form 483s. Audit-trail review failures, shared logins, post-dated entries, and uncontrolled spreadsheets are the persistent offenders. The checklist front-loads those exact controls so what you fix on paper is what an investigator asks for during the FAR-510(a) interview.
DSCSA Phase 2 enforcement is live; EU MDR backlog drives readiness urgency. The Drug Supply Chain Security Act stabilization period closed November 2024, full electronic, interoperable, package-level traceability is now the floor for U.S. dispensers, wholesalers, and manufacturers. EU MDR has pushed device certification backlog into 2027, with notified-body capacity still constrained. Both regimes assume the GMP + GDP + Part 11 + Annex 11 control set is already running underneath. The checklist treats them as one program, not eight separate audits.
ICH Q9(R1) and Q10 reset the risk + PQS bar. The Q9(R1) revision (effective January 2023) introduced explicit guidance on subjectivity in risk scoring, formality of decision-making, and risk-based decision documentation, closing the loop on a 17-year gap since the original Q9. ICH Q10 continues to shape how regulators score Pharmaceutical Quality System maturity through management review, CAPA effectiveness, and knowledge management. The checklist mirrors the question library inside the RiskWatch platform, reviewed against the Q9(R1) text and the GAMP 5 Second Edition (July 2022) risk-based CSV approach, so when you graduate from the PDF nothing has to be re-keyed.
Who is it for
Three roles, one checklist
QA Director / Head of Quality
Owns the Pharmaceutical Quality System (ICH Q10), batch release accountability, and FDA + EMA + MHRA + Health Canada inspection readiness across every site. Sponsors the GMP + Part 11 control program.
Outcome · Walk into the next FDA pre-approval or routine inspection knowing every GxP family is documented, every Part 11 control has audit-trail evidence, and every CAPA closes with effectiveness verification.
Validation / CSV Manager
Owns Part 11 + Annex 11 system inventory, GAMP 5 Second Edition risk-based validation, URS/IQ/OQ/PQ lifecycle, and periodic review on every GxP-impacting computerized system from MES to LIMS to QMS.
Outcome · Use the checklist as the single readiness diagnostic that lets you prioritize which systems need full revalidation versus periodic review, sized to GAMP category and process risk, not one-size-fits-all.
Regulatory Affairs Lead
Owns FDA submissions, EMA + MHRA dossiers, DSCSA traceability filings, EU MDR/IVDR technical documentation, and ICH Q9 quality risk artefacts that flow into every regulatory interaction.
Outcome · Answer regulator information requests and partner due-diligence questionnaires with one document set, with framework cross-references already mapped to GMP, Part 11, Annex 11, ICH Q9 + Q10, and DSCSA.
Common questions, answered
GxP family scope, Part 11 vs Annex 11, ICH Q9(R1) revision coverage, ALCOA+ data integrity, and DSCSA Phase 2 traceability.
Related
Keep going
Beyond the checklist
Run GxP + Part 11 + DSCSA on one platform?
The PDF is the readiness diagnostic. The platform runs continuous GxP scoring, Part 11 + Annex 11 system inventory + revalidation triggers, DSCSA traceability, ICH Q9 risk libraries, ICH Q10 PQS evidence, and 39 other framework libraries (ISO 13485, IEC 62304, EU MDR, HIPAA, NIST 800-66 r2, the rest) across every site, supplier, and CDMO/CRO, with the same evidence trail FDA, EMA, MHRA, and Health Canada inspectors already accept.
Or call US: +1 941-500-4525