Guide to GxP compliance: processes, challenges and tools
GxP compliance is a crucial requirement for the modern life science organization.
But it's a complex, multifaceted requirement, combining a web of quality management considerations that vary with the context of your business operation.
GxP compliance demands airtight processes and appropriate tools. This guide gives you everything you need to know to overcome the challenges of GxP compliance and embed robust long-term GxP into the heart of your business.
Table of Contents
What is GxP compliance?
GxP compliance is the operational state of complying with the requirements of GxP.
GxP compliance means meeting GxP demands in a consistent and continuous way that satisfies regulatory inspections.
It's a key consideration for regulated businesses, usually most applicable to life science pharmaceutical and biotech organizations, though medical device and even food companies may find some elements of GxP relevant to them as well.
Unlike compliance with, say, ISO 13485, GxP compliance isn't an optional, monolithic 'pass/fail' benchmark with certification as a reward.
Since GxP means 'good something practice', with the interchangeable 'x' in the middle corresponding to different niche subsets, GxP compliance is a broad umbrella of requirements that will vary depending on what exactly your organization does.
GxP compliance therefore starts with careful assessment of which elements of GxP are appropriate to your company - then acting accordingly to embed 'good practice' for each of those areas.
If you run a testing laboratory, for instance, GxP subsets like Good Laboratory Practice (GLP) and Good Documentation Practice (GDocP) will be highly important for you - while other GxP areas like Good Distribution Practice (GDP) or Good Manufacturing Practice (GMP) won't be.
In GxP compliance, context is everything!
And crucially, it's mandatory for regulated companies like pharmaceutical organizations. Failure to instil GxP compliance puts your operation at risk of fines, recalls, reputational damage and shutdowns.
Importance of GxP compliance in life science industries
Why is GxP compliance so important for regulated life science companies?
Product quality and patient safety are of paramount importance in an industry where drug faults and defects can cause serious injury or death. GxP guidelines were initially launched by the FDA in the wake of a string of serious drug scandals.
Sulfathiazole was a widely used antibiotic in the 1940s. But in 1941, it was discovered that manufacturer Winthrop had inadvertently contaminated thousands of tablets with 350mg each of the powerful sedative phenobarbital. 300 people died.
And in 1962, the infamous thalidomide disaster led to thousands of children being born with serious developmental defects.
Such cases emphasize the importance of 'good practice' in the modern life science environment: the continuous process of ensuring your drugs meet a recognized threshold of quality and integrity, and are safe for patient use.
Are there GxP regulations?
As we've touched on above, there's not a single GxP regulation or standard you can read and work towards. GxP is a broad bundle of requirements.
As such, the GxP regulations pertinent to your business depend on the nature and scope of your business operation.
But that doesn't mean there aren't key regulatory documents you can explore to prepare yourself for GxP compliance.
To kickstart your understanding of the typical ingredients of GxP, start with the FDA's website:
1) Visit fda.gov/regulatory-information/search-fda-guidance-documents
2) Scroll down to the Guidance Document Search section
3) Filter by FDA organization and select the 'Center for Drug Evaluation & Research' (CDER)
4) View the guidance documents relevant to your operation, from electronic record best practice to clinical trial guidance
5) Add additional relevant 'Topic' filters like cGMP or GCP as required (more on these subsets below!)
FDA guidance documents highlight some current 'good practice' expectations and help to illustrate what modern GxP requires. They're a good place to start if you're just beginning your GxP compliance prep journey.
Now, let's dig a little deeper and explore some more specific GxP regulatory guidelines.
Understanding GxP guidelines
Because the 'x' of GxP is interchangeable by design, each GxP subset from Good Manufacturing Practice to Good Distribution Practice is supported by key regulations and guidelines you should familiarize yourself with and begin working towards.
Let's look at some key GxP categories and their associated regulations:
Good Manufacturing Practice (GMP)
Key guidelines: FDA 21 CFR Part 210/211/314, EudraLex Volume 4, WHO TRS 986 Annex 2
FDA GMP regulations are designed to guarantee the quality and integrity of pharmaceutical product, and are the main GxP compliance consideration for pharmaceutical manufacturers. The guidelines cover the entire manufacturing lifecycle, from sourcing of raw materials to manufacturing line operation.
FDA 21 CFR Parts 210 and 211 are the twin regulatory guidelines you should explore here, with Part 314 coming into play for US market approval and the EU's EudraLex Volume 4 crucial for European GMP compliance.
Other niche GMP guidelines also exist, like:
- Part 111: dietary supplements and therapeutic nutritional products (watch a case study from one of our customers working to this regulation!)
- Part 212: PET drugs
- Part 600: biological and biotech products
Good Laboratory Practice (GLP)
Key guidelines: FDA 21 CFR Part 58, EPA 40 CFR Part 160/792, OECD GLP principles, WHO GLP handbook
As the name suggests, GLP lays out the good practice requirements for the modern laboratory.
Unlike with GMP, the FDA was a little late to the party in terms of mapping out good practice for the laboratory space. The Environmental Protection Agency (EPA) has as much to say about Good Laboratory Practice as the FDA does.
GLP principles originated in New Zealand and Denmark in the 1970s, before taking root a few years later in the US and finally being spread internationally by the Organization for Economic Cooperation & Development (OECD).
GLP emphasizes a clean, orderly and controlled laboratory with uniform, reliable processes that deliver high-quality outputs and conclusions.
Good Clinical Practice (GCP)
Key guidelines: ICH E6(R2), ISO 14155, HHS 45 CFR Part 46 (including Subpart A, 'The Common Rule'), FDA 21 CFR Part 50/54/56/312/314
GCP guidelines are all about ensuring that clinical trials are performed in a dependable, ethical way that aligns with the World Medical Association's Declaration of Helsinki.
Subject rights, safety and wellbeing should be maximized, while trials are structured around scientifically sound risk-benefit principles free from corruption and bias.
GCP should set the quality benchmark for your trials, offering a shared and mutually accountable quality framework for sponsors, IRBs, investigators (CROs) and regulators to follow.
Good Distribution Practice (GDP)
Key guidelines: PIC/S GDP guide, USP 1079/1083, EU GDP Chapters, WHO Annex 5
It's not enough to just make high-quality and safe life science products. How they make their way from manufacturer to patient is crucial too - and it's here that GDP comes into play.
GDP compliance means ensuring your finished products are packaged and stored safely, then distributed through a controlled supply chain that provides the right environmental conditions for your product.
Good Pharmacovigilance Practice (GVP)
Key guidelines: EMA GVP modules I-XVI, FDA GVP guidance document
Pharmacovigilance is crucial for detecting, preventing and responding to adverse effects from a marketed drug.
Needless to say, GVP is an essential part of your post-market surveillance activities as a pharmaceutical organization.
The EMA is the main guiding beacon for GVP regulation, with the EU's pharmacovigilance system the most advanced in the world. The FDA is perhaps surprisingly relaxed on the topic of GVP, offering no specific binding regulatory framework for this area.
5 things you need to know for GxP compliance
Now we've examined some of the various different threads of GxP compliance, it's worth looking at the core, common and constant ingredients typical to any GxP business.
There are 5 main elements you'll need to understand and apply for GxP compliance, regardless of whether your primary focus is GDP, GLP, GMP or something else.
Quality management system
Good practice and good quality are inseparable. You could even call them synonymous.
GxP is ultimately about installing repeatable, traceable and high-quality processes that safeguard your drug and patient safety.
For that reason, a functional quality management system (QMS) is absolutely crucial for GxP compliance.
The QMS is your mechanism for instilling and embedding GxP. By coordinating key elements like documents, employee training, event management and supply chain control, your QMS brings GxP in its wake.
If GxP is the 'what', your QMS is the 'how'.
And the stronger and more robust your QMS, the sharper your GxP. Aligning your business around a QMS doesn't only slice your operational costs and risks, it makes it much easier to make uniform 'good something practice' part of how you do business.
Read up on the 9 core elements of a quality management system
Documentation and record-keeping
Documents and recorded data are a big part of GxP compliance.
We've seen how the GxP regulations are broad and varied - but they all touch strongly on data and document integrity and trust. After all, good practice can't happen without dependable, connected information behind it.
A typical GxP-compliant business needs documents like this:
There's a lot, isn't there?
And it's not enough just to have them in place to show your GxP inspector. Good Documentation Practice (GDocP) is perhaps the core of GxP compliance and the baseline upon which the rest of your GxP activity can be built.
The FDA's 9 ALCOA+ principles and cGMP data integrity guidance are handy reference points here. For airtight GxP compliance, you should ensure your documents and records are:
Needless to say, electronic records are easier (and cheaper) to maintain and control than physical paper clutter. But if you digitize your documentation, you'll need to consider FDA 21 CFR Part 11 compliance to ensure your e-records and e-signatures match GxP expectations.
Read the 4 things every pharma start-up needs for their document management
Training and personnel qualifications
The next key component of GxP compliance is ensuring your staff are adequately trained and competent to discharge their day-to-day duties.
Last year, the primary trigger for the handout of an FDA Form 483 observation to drug companies was the failure of staff to adequately follow documented procedures. Root causes included:
- Staff not following SOPs
- No records of cGMP training specific to those SOPs
- Low awareness of SOPs and current document versions
- Language barriers
A real quality management horror story shows the real-life impact of this.
After the death of a 2-year-old boy caused by contaminated surgical wipes, an audit of the manufacturer found dirty, contaminated pipes, bare-hand packing of ‘sterile’ product, and staff who couldn’t speak English - and therefore couldn’t follow the documented SOPs in the QMS.
Robust training is the fix for all these issues. Untrained and incompetent staff make GxP compliance impossible, while effective training on areas like laboratory cleanliness, manufacturing procedures or record retention are the key to instilling all the other facets of GxP you need.
Validation and qualification
Validation and qualification are tightly connected to a key subset of GxP compliance: Good Automated Manufacturing Practice, or GAMP.
Regulators like the FDA want life science companies to embrace digital platforms and tools to slice the risk of drug shortages and accelerate manufacturing speed and quality.
And modern computerized systems controlling the manufacture of a GxP product, such as a pharmaceutical drug, can now do wonderful and complex things.
A digital GxP manufacturing system provides real-time control, collects and manipulates data, and typically offers a physical interface between systems, such as connecting a programmable logic controller (PLC) to your Distributed Control System (DCS).
Electronic quality management systems, meanwhile, digitize the QMS, automating data integrity, controlling key GxP ingredients like documents and training, and eliminating time-heavy admin and upkeep.
Such tools are the key to GAMP and an exciting future of automated, accelerated and higher-quality drug manufacture.
But what about the integrity of the systems behind GAMP? After all, if anything were to malfunction, the safety of drugs and therefore patients would be at risk.
It's here that validation and qualification of these systems comes into play. It can be summed up as the process of applying critical thinking to determine:
Is the software your business adopts fit for your intended use in your regulated GxP environment?
Validation is a complex topic which we covered in its own blog post.
But in a nutshell: we live in an increasingly digitized world.
GAMP is becoming increasingly expected and default.
So, in the name of patient and product safety, the digital tools enabling GAMP need to be properly critiqued, investigated, validated and qualified before they can be put to work.
For a flavor of how this works, watch this snippet of our interview with GAMP 5 editor Sion Wyn here:
Risk management
The final thread which should run through your GxP compliance is the proper treatment and management of risk.
ISO 31000 defines risk as the 'effect of uncertainty on [your] objectives'.
Good GxP compliance means risk-based thinking is woven into your business operation, so both risks and opportunities are properly identified and acted on.
Ingredients like a risk management policy and statement, coupled with a risk register and risk management framework, should empower your business to continuously look out for risks and bring them to an acceptable residual risk score.
As with all GxP, patient safety and product quality should be your guiding light.
Some risk management frameworks to assist your GxP compliance include:
- ISO 31010 (general supporting standard to ISO 31000)
- ISO 14971 (medical devices)
- ICH Q9 (pharmaceutical)
- Failure mode and effect analysis (FMEA)
- HAZOP
- Cause and effect analysis
- Delphi technique: structured, interactive forecasting
- Scenario analysis
- Root cause analysis
- Risk indices
- Cost/benefit analysis
Challenges of GxP compliance
Of course, as you've probably figured out by now, GxP compliance isn't easy.
It's a multilayered benchmark you should be constantly meeting and pushing beyond to maximize the strength of your business and the safety and efficacy of your products.
That being said, there are a couple of main challenges you should be particularly aware of as you plot your GxP compliance journey.
1. Evolving regulations
Large parts of the GxP guidelines, such as Good Laboratory Practice, are thankfully fairly static.
What constituted a 'good' lab in 1995 is broadly similar to what makes a good lab in 2023, and so there's little regulatory change to consider.
Other areas of GxP, however, move a little faster.
As you can imagine, the areas of GxP compliance most intimately connected to cutting-edge technological innovation are those most subject to change.
GAMP is a key example.
ISPE's GAMP 5 guidelines spell out the latest expectations for how digital tools are onboarded and applied in GxP environments.
In September 2021, the supplementary 'Enabling Innovation' Good Practice Guide was published, touching on 3 main areas:
- How to onboard new, more agile software tools
- How to source suitable providers and work with them
- How to apply critical thinking and a risk-based approach to your GAMP tool adoption
Then, in July 2022, GAMP 5's 14-year-old First Edition was replaced by its Second Edition, broadening the net of GAMP to include more modern technology.
The framework of what 'good' looks like for digitizing your GxP compliance continues to evolve, forcing both regulated companies and their providers to embrace innovation.
Perhaps even more significant are the changing industry expectations for your company's relationship to GxP regulations and legislation.
FDA publications reflect an increasing desire for GxP-regulated companies to progress beyond the bare minimum of 'good practice' compliance and to embrace a more proactive and long-term quality approach.
The problem with treating GxP compliance as a static end goal is this:
So-called 'good actors', quality-centric pharmaceutical businesses who treat GxP as a springboard rather than a finish line, should in the FDA's eyes be rewarded for doing so.
That's the logic behind the launch of the so-called Quality Management Maturity program in 2022.
Pharma companies that can demonstrate continuous improvement, not just resting on the laurels of cGMP, will be rewarded with a higher quality 'score' than those who can't. The score is then circulated among the industry to help the business attract more custom.
It's clear: by all means, focus on GxP compliance as a key requirement for your organization. But use it as a doorway, not an end goal.
2. Increasing complexity of supply chains
Another element to consider is the increasing length and complexity of the modern life science supply chain.
Your GxP compliance is only as strong as the weakest link in your supply chain, so your efforts should be focused on your company's outside connections as much as its core.
7 top tips for a stronger GxP supply chain
1. Fully binding quality agreements (QAgs)
2. Planned and proactive communication
3. Independent verification beyond regulatory oversight (i.e. don't trust a supplier purely because they're in business and haven't received a warning letter - yet)
4. Risk-based supplier strategy
5. On-site audits of key suppliers where possible
6. Strong purchasing/onboarding controls via digital supplier management
7. Diversified supply chains
Importance of GxP compliance auditing
Regular and thorough auditing is a fact of life for GxP-regulated companies.
The importance of GxP that we touched on above means that your regulator, whether its the FDA, EMA or MHRA, will frequently audit and inspect your GxP facilities to ensure they pass muster.
External audits vs. internal audits
Although external third-party GxP compliance audits can be stressful and daunting make-or-break moments for your company, internal audits are your chance to practice and prepare.
Focus on the core processes that keep you up at night: product development, risk management, incident management, and so on.
Then examine them with targeted audits, applying the 'As-Is' framework to pinpoint weaknesses and get your business closer to your ideal GxP state:
Audit frequency and scope
The frequency and scope of your internal auditing program has a direct impact on the strength of your GxP compliance.
Too few audits, and your team will be underprepared for the big day and your auditor will probably find weaknesses and mistakes you had no idea about.
Too many, and audit fatigue sets in and not enough actionable value is generated from each audit.
Find a happy medium, beginning with an initial deep-dive audit. Involve key process participants - 'owners' - in mapping your core GxP processes from end to end, including all interdependencies and interactions, as you audit.
Don't audit by function or department, but by process.
Trace them across department lines to see how they vary: are new systems used to continue the same work? Do steps fundamentally change? Are lines of communication broken at handoff points?
These could all damage your GxP compliance and give your auditor something to note in the session.
Other things to look out for include:
Lots of issues found? Increase audit frequency until they're resolved.
Things improving? Increase audit scope to bring more GxP compliance weaknesses into your crosshairs.
Tools for GxP compliance
The right tools, processes, techniques and platforms will make your GxP compliance smoother and easier.
Let's take a look at the top handful you should consider.
1. Electronic quality management system (eQMS)
We've already seen how a robust QMS is vital for GxP compliance.
An eQMS makes your GxP compliance even stronger by digitizing and centralizing your key quality activities.
Qualio combines management of key digital QMS elements, from documents to quality events, with an intuitive UX and high-touch support to make GxP natural and automatic for life science organizations.
2. Computerized system assurance (CSA)
As we've seen above, any adoption of digital GxP systems should be underpinned by careful validation and qualification.
Until very recently, this process was known as computerized system validation, or CSV.
But in 2022, the FDA launched its new computerized system assurance (CSA) guidelines, intended to overhaul how regulated GxP companies perform their validation work.
Don't worry, it's good news!
CSA is all about simplifying the CSV process, encouraging GxP companies to lean on their system vendors to do most of the validation work, then performing sensible, risk-based assessment of any other areas they feel are appropriate.
To learn more, watch more from our interview with Sion:
3. Laboratory information management system (LIMS)
Another important GxP tool is the laboratory information management system, or LIMS.
Early LIMS platforms were purely for sample tracking, but they've since evolved to complex tools handling multiple informatics, from electronic data exchange to integration with other lab instruments and apps.
Unlike eQMS platforms, LIMS implementations can be incredibly expensive and time-consuming, partly due to the largely inflexible nature of most LIMS platforms.
Nevertheless, they remain a crucial investment for the modern digital lab and can unlock a range of operational GxP benefits if you choose the right system for you.
4. Electronic data capture (EDC)
Finally, the EDC system is a digital platform for the capture of clinical information.
They're typically used in clinical trials, especially late-stage Phase III and IV studies, and are therefore a bread-and-butter platform for CROs, sponsors and study sites.
Like the LIMS and eQMS, EDC systems are a useful way to digitize key GxP activities - mainly GCP, of course - and arm yourself with dependable electronic information for accelerated decision-making.
Boost your GxP compliance now
Need a hand with your GxP compliance after our whistle-stop tour?
Here's a comprehensive GxP compliance checklist to help you on your way.
