Laboratory Control
Laboratory control is the parallel engine of the commercial phase: the quality-control laboratory testing raw materials, in-process samples, finished product, and the manufacturing environment, and producing the reportable values on which every disposition decision rests. Its regulatory spine for medicines is the laboratory-controls architecture of 21 CFR 211 — scientifically sound specifications, validated methods, qualified instruments, complete records — with the compendia supplying the tests themselves: microbiological examination under USP <61>/<62>, environmental control of aseptic processing informed by USP <1116>, and instrument qualification under the USP <1058> framework. Analytical methods live a full lifecycle here: validated per ICH Q2(R2), monitored in use, and revalidated or redeveloped as ICH Q14 thinking and method performance demand.
What this page does not claim
Phases are an organising device, not a regulatory mandate — real programmes overlap them, and a medical device, a food product and a small-molecule drug traverse them differently. Each page says where the differences bite.
What happens in this phase
Laboratory control is the parallel engine of the commercial phase: the quality-control laboratory testing raw materials, in-process samples, finished product, and the manufacturing environment, and producing the reportable values on which every disposition decision rests. Its regulatory spine for medicines is the laboratory-controls architecture of 21 CFR 211 — scientifically sound specifications, validated methods, qualified instruments, complete records — with the compendia supplying the tests themselves: microbiological examination under USP <61>/<62>, environmental control of aseptic processing informed by USP <1116>, and instrument qualification under the USP <1058> framework. Analytical methods live a full lifecycle here: validated per ICH Q2(R2), monitored in use, and revalidated or redeveloped as ICH Q14 thinking and method performance demand.
Two programmes run continuously alongside release testing. The stability programme — designed to ICH Q1A(R2) conditions — generates the data behind every expiry date and storage claim, batch after batch, year after year, with out-of-trend results as its early-warning system. Environmental monitoring, for sterile and controlled operations, delivers a rolling verdict on the contamination control strategy: viable and non-viable counts whose excursions are investigated as facts about the facility, not noise in the data. Both programmes share a property that makes them demanding: their value lies in trends across years, which makes the integrity, continuity, and retrievability of their data a first-order concern.
The laboratory is also where data-integrity regulation has concentrated its attention, because chromatography data systems and instrument software hold the raw signals behind every certificate of analysis. Audit-trail review, access control, and the ban on testing into compliance are enforced expectations, with the MHRA data-integrity guidance the common reference. The out-of-specification discipline is the phase's signature procedure: a structured investigation distinguishing laboratory error from genuine product failure, with retesting rules set in advance — because the difference between an invalidated assay and an ignored result is the difference between science and fraud. Contract and third-party laboratories add a layer: accreditation to ISO/IEC 17025 speaks to a testing laboratory's competence per method and matrix, but GMP release testing obligations still bind through the quality agreement and the owner's oversight.
- Validated analytical methods and qualified instruments for every specification the laboratory will test against.
- Approved specifications and sampling plans traceable to the registered details and the control strategy.
- A laboratory data-governance framework in place: access control, audit-trail review, and defined raw-data ownership.
- The stability programme designed and initiated, with protocol conditions and pull schedules committed.
- Reportable results delivered to disposition with complete, reviewed records from raw signal to certificate.
- OOS and OOT results investigated to conclusion under the pre-defined procedure, with invalidation only on demonstrated cause.
- Stability data generated to schedule, trended, and feeding shelf-life confirmation or revision.
- Environmental monitoring performed, trended, and excursions investigated as inputs to the contamination control strategy.
SPEQ synthesis. Phase boundaries and gate criteria are an organising device for planning and review, not a regulatory mandate. Real programmes overlap phases and re-enter them; treat these as the questions worth answering, not a compliance checklist.
- Own the OOS/OOT discipline: pre-defined procedures, investigations that follow evidence, and zero tolerance for testing into compliance.
- Enforce laboratory data integrity — audit-trail review with defined scope and cadence, access models, and raw-data retention.
- Approve method validations, transfers, and changes across the method lifecycle.
- Oversee the stability programme's design, execution, and the actions its trends demand.
- Qualify and oversee contract laboratories, holding quality agreements that survive contact with a discrepant result.
- Certificates of analysis and the complete testing records behind them
- Method validation, verification, and transfer reports
- Instrument qualification and calibration records under the USP <1058> framework
- Stability protocols, pull-point data, and trend reports
- Environmental monitoring data, trends, and excursion investigations
- OOS/OOT investigation records with their conclusions and dispositions
- OOS investigations that begin from the desired conclusion — retest to pass, invalidate on assertion — the pattern regulators read as data-integrity failure.
- Audit-trail review committed to in SOPs but performed nowhere, discovered when an inspector opens the CDS.
- Stability pulls missed or data unreviewed for months, so an out-of-trend signal ages into a market action.
- Instrument qualification treated as an install-time event, with software updates and configuration drift never reassessed.
- Environmental excursions closed as "no impact" by reflex, so the contamination control strategy loses its only feedback loop.
Derived from the 8 standards SPEQ maps to this phase, across 5 regulatory bodies: FDA, USP, MHRA, ISO, ICH.
FREQUENTLY ASKED
What makes an OOS investigation defensible?
Sequence and pre-commitment. The procedure — written before any result exists — defines how a laboratory investigation proceeds: verify the analysis, examine the data, interview the analyst, and only invalidate the original result if an assignable laboratory cause is actually demonstrated. Absent that cause, the investigation extends to manufacturing, and the batch decision confronts the result rather than the retest. Retesting rules, sample handling, and averaging limits are all pre-defined. What collapses defensibility is the reversed sequence: retest first, keep the passing number, and construct the invalidation afterwards — a pattern audit trails expose reliably.
Does ISO/IEC 17025 accreditation make a lab GMP-compliant?
No — they answer different questions. ISO/IEC 17025 accreditation attests to a testing laboratory's technical competence, and it is granted per method and per matrix, so the scope schedule matters more than the certificate. GMP obligations for release testing — specifications, OOS discipline, data integrity, the tie to batch disposition — bind through the pharmaceutical quality system, and a product owner using a contract laboratory must impose and oversee them through the quality agreement. An accredited laboratory may be an excellent starting point; accreditation alone is neither necessary nor sufficient for GMP release testing.
Why do regulators focus so hard on chromatography data systems?
Because that is where the temptation and the evidence both live. The CDS holds the raw signal behind every reportable value, and its processing choices — integration parameters, reprocessing, trial injections — can move a result across a specification limit without any wet-chemistry fraud. The enforcement record of the last decade is dense with exactly this: unofficial test injections, disabled audit trails, shared logins, and selective reporting. Hence the settled expectations: unique accounts, audit trails on and reviewed with defined scope, raw data retained and reviewable, and integration practices that are scientifically justified and consistently applied.