Operating domain: Computerized systems, validation, and data integrity

What this domain asks

Risk that a quality or regulatory system is not fit for intended use, remains insufficiently controlled through change, or cannot preserve complete, consistent, accurate, attributable, legible, contemporaneous, original, and available records across its lifecycle.

The domain should retain its own evidence, decision owner, materiality criteria, exception path, and consequence even when it shares organization identity, workflow, or technology with adjacent domains. Aggregation can support oversight; it should not erase the evidence behind different risks or operating outcomes.

Buyer questions

What is the intended use, and which product functions can affect product quality, patient safety, or regulated records?
Which supplier evidence is available for requirements, design, testing, traceability, release, security, and known issues?
What must the customer configure, verify, approve, and maintain, and how does that responsibility change with each release?
How are audit trails generated, reviewed, exported, retained, and linked to the records they describe?
How are identity, access, signatures, interfaces, data migration, backups, continuity, archival, and retirement tested?
Can the organization produce a current validation state and change-impact record without relying entirely on the supplier?

Mapped workflows

Controlled Documents

A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for controlled documents within this domain.

Training Management

A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for training management within this domain.

Change Control

A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for change control within this domain.

Audit And Inspection Management

A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for audit and inspection management within this domain.

Quality Risk Management

A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for quality risk management within this domain.

Computerized-System Validation Support

A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for computerized-system validation support within this domain.

Analytics And Management Review

A demonstration should show the trigger, source, accountable role, decision, exception, evidence, and downstream handoff for analytics and management review within this domain.

Authority context

FDA QMSR

The QMSR amends FDA's device current good manufacturing practice requirements in 21 CFR Part 820 and incorporates ISO 13485:2016 by reference, while retaining FDA-specific statutory and regulatory requirements. FDA began using a new device inspection process when the rule became effective.

FDA 21 CFR Part 11

Part 11 defines criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records trustworthy, reliable, and generally equivalent to paper records and handwritten signatures.

FDA drug CGMP

Parts 210 and 211 establish current good manufacturing practice requirements for drug manufacture, processing, packing, and holding, including organization, facilities, equipment, components, production controls, laboratory controls, records, reports, returned products, and complaints.

ICH Q9(R1)

ICH Q9(R1) provides principles and examples for systematic quality risk management across the pharmaceutical product lifecycle and addresses formality, risk-based decision-making, subjectivity, product availability, and managing risk through assessment, control, communication, and review.

EU GMP Annex 11

Annex 11 applies GMP principles to computerized systems and addresses lifecycle risk management, personnel, suppliers, validation, data, accuracy checks, storage, printouts, audit trails, change control, incident management, periodic evaluation, security, signatures, continuity, and archiving.

Relevant operating models

Evidence boundary

RegQuality Review is not a regulator, certification body, law firm, or validation authority. Its records support research and decision review; they do not establish compliance for an organization, system, release, configuration, or intended use. A provider's documented capability can identify a research candidate but cannot establish buyer-specific adequacy for this domain.