[ ENTERPRISE PILLAR 02 ]
Translate product intent and changing authority expectations into viable pathways, maintained licenses, and controlled commitments.
This pillar governs market and authority strategy; it does not duplicate the source-level regulator, standard, citation, or live-intelligence catalogs.
The capability framing below, its failure modes and the boundary with neighbouring pillars are SPEQ’s practitioner reading — not a regulatory requirement, and not an assessment of any organization.
THE CAPABILITY
This is the organization's working map of what applies to it, held as a live position rather than a filed conclusion. It runs in two directions at once, and the two are one object read from opposite ends. Outward, it is the case the organization intends to put to an authority: what the product is, which route it will travel, what evidence will support the ask, and what the organization is prepared to promise in return for permission. Inward, it is the machinery that notices the outside world has moved and routes that movement to whoever now has to act. The record of promises made and the record of obligations imposed are the same record, because both constrain the same operations and both are read by the same reader. Split them, and an organization ends up with an intelligence function that knows the rules, a submission function that knows the promises, and nobody holding the position.
The subject matter changes on somebody else's schedule and in somebody else's vocabulary. Every other capability moves when the organization moves it; here a published change arrives phrased in an authority's terms and someone has to decide whether it touches products described in the company's terms. That is a mapping problem with no key, performed under time pressure by whoever happened to receive the alert. The economics of the decision then push steadily one way. Concluding that something does not apply generates no assessment, no task, no owner and no reviewer; concluding that it does generates visible work for people who did not ask for it. The screening step is therefore biased toward not-applicable, and because non-events leave no trace the bias never surfaces in any measure of how the function is performing. Layered on top is the strange half-life of what this pillar creates. A sentence in a meeting record, a paragraph answering a question, a value written into a submitted document — each becomes a binding constraint on operations, made by people who will have moved on before it bites, and stored in correspondence archives that nothing operational ever queries. An organization can hold an immaculate view of external requirements and still be in breach of a promise it made about itself.
Each of these happens with the individual branches below being run competently. That is what makes them capability failures rather than performance problems.
A digest goes out weekly to a wide audience, and the act of circulating it is recorded as the control. Every recipient reasonably assumes the applicability judgement happened upstream; upstream assumes the recipients are the judges. Nothing is refused and nothing is assessed. The gap surfaces the first time somebody asks who evaluated one specific change, and the honest answer turns out to be the mailing list.
Undertakings are made in meetings, in answers to questions and in the fine print of documents that were submitted years ago. Some of them reach a register; the rest live in an archive organized by date and correspondent rather than by obligation. The usual discovery route is somebody reading that file for an unrelated reason, long after the operation the promise constrains has quietly changed shape.
Each change was individually assessed, each assessment concluded no notification was needed, and each conclusion was reasonable on its own terms. What nobody holds is the cumulative distance between what was authorized and what is now run, because the assessment unit is the single change while the exposure unit is the sum of them. The discovery event is nearly always external, and nearly always arrives as a question about something else.
Incoming change is matched against a portfolio list or a therapeutic grouping, because that is how the register is organized and how people think about the business. What gets missed is everything sharing the attribute the change actually addresses — a component, an excipient, a sterilization step, a claim on a carton — while sitting under a label nobody thought to open.
WHERE THIS STOPS
This pillar decides what must be true and what must be told. It does not create the evidence that makes it true: development, clinical, manufacturing and the laboratory own the underlying work, and a function that writes the scientific justification itself has moved the argument out of the place where it can be defended. The seam that generates the most argument is change assessment. This capability owns whether a change must be notified or approved before it takes effect; governance owns whether the change is acceptable at all. The two judgements are made on the same form, at the same meeting, and each side can quietly assume the other has answered the question of whether the change is a good idea. The second seam is labelling: the approved text belongs here, while the artwork, the print vendor and the carton on the line belong to operations, and the version that was approved and the version being printed sit in different systems with different change clocks. The third is the reporting clock in safety, which starts on somebody else's document even when the notification eventually leaves over this function's signature.
Scanning is the collection step and the easier half. Intelligence is what happens after collection: deciding applicability against a specific portfolio, sizing the impact, naming an owner, and tracking the result to a change that is either made or consciously declined. A function that only scans produces a stream. A function with intelligence produces decisions with owners attached to them.
This pillar makes that judgement, but it cannot make it alone, because the answer turns on technical facts only the change owner holds: what exactly moved, how far, and against what was originally described. The arrangement that works is that the change owner supplies the characterization and this function supplies the classification, both recorded in one assessment rather than in two that never meet.
Anything the organization has said it will do that a reader could later hold it to: a study offered at a meeting, a monitoring frequency written into a submitted document, a value stated as a limit, a date given in a response. The practical test is whether an operation would have to change if the statement were withdrawn. If it would, it is a commitment and it needs a named owner.
A catalogue of sources answers what exists in the world. This capability answers what applies here, to this product, in this market, this quarter, which is a judgement about the organization rather than a fact about the world. Keeping the two apart stops the library from being quietly edited to fit a position somebody has already taken.
CAPABILITY BRANCH MAP
Determining what the product legally is — drug, biologic, device, combination, food, cosmetic — in each market, and which development and authorisation route follows from that. The answer sets the evidence, the timeline and the regulator.
Classification is the decision every other regulated activity inherits. Get it wrong and the studies run to the wrong standard, the quality system is built against the wrong regulation, and the error surfaces at submission when it is most expensive to correct.
Watching the sources that can change what the organisation must do, deciding whether a given publication applies, and routing it to an owner who can act — before the effective date rather than after an inspection.
Regulatory change is continuous and mostly published in plain sight. The failure is almost never that a change was secret; it is that nobody was accountable for noticing it, so a transition period elapsed while the organisation was busy.
The conduct of the relationship with health authorities: meeting requests, scientific advice, questions and responses, inspection interactions, and every undertaking given in the course of them.
What an organisation says to a regulator becomes a commitment it will be held to, often years later by different people. Engagement is therefore a controlled activity, not a conversation — and inconsistency between what two functions tell the same authority is read as a quality-system failure.
Designing the dossier: what modules exist, which functions own which content, what each depends on, when it must be ready, and how it is compiled, validated and dispatched in the required electronic format.
A submission is the point where every other function is asked to produce evidence simultaneously. Where the plan is weak, the critical path is discovered late, and content is written to a deadline rather than to the standard the reviewer will apply.
The authorisations that let an organisation operate at all — product approvals, manufacturing and wholesale licences, establishment registrations, importer and responsible-person designations — and keeping each current in every market served.
These are the permissions the business runs on, and they lapse quietly. A registration that expired because a renewal was missed stops supply just as effectively as a failed batch, and with no quality signal to warn anyone.
Control of what the product says about itself and what the organisation says about the product: approved labelling and its translations, artwork change control, and the boundary between authorised claims and promotion.
Labelling is a regulated output that reaches the patient directly, and a claim beyond the authorisation is an enforcement matter rather than a marketing dispute. Artwork errors are also among the most common causes of recall.
Everything that happens to an authorisation after it is granted: variations and supplements, renewals, annual reports, commitments made at approval, transfers of ownership, and eventual discontinuation.
Most of a product’s regulatory life is post-approval, and this is where the gap between the approved product and the manufactured product opens. A change made on the line that was never filed means the product being sold is not the product that was authorised.
The systems and disciplines that hold regulatory information: the RIM platform, dossier and correspondence archives, structured content, publishing standards and the controlled vocabularies underneath them.
Regulatory information is only useful if it can be found and trusted years later. When the archive is unreliable, teams re-derive what was already filed — and occasionally file something that contradicts it.
Engagement with regulation while it is still being written: consultations, standards development, harmonisation initiatives and trade-association positions — the layer above compliance with what already exists.
Requirements are shaped long before they are enforced, and organisations that engage understand the intent behind a rule rather than only its text. It is also the earliest possible warning of a change that will be expensive to implement late.
CONNECTED OPERATING MODEL
MATURITY ORIENTATION · SPEQ SYNTHESIS
HIGH-VALUE INTERSECTIONS
SOURCE BASIS
REGULATORY BASIS
The 12 standards SPEQ maps to this pillar, and the 5 regulatory bodies behind them. Which standards belong to a pillar is a SPEQ judgement; the bodies, disciplines and industries below are read from the standards themselves.
EC · EDQM · FDA · ICH · IMDRF
Ranked by how many of this pillar’s standards each one cites — showing 10 of 44.
These 17 standards govern the system classes this pillar depends on rather than the pillar itself. The distinction matters: a standard that governs a system is not thereby a standard of every capability that uses it.
ICH Q10EU GMP Annex 1621 CFR Part 11EU GMP Annex 11ISPE GAMP 5 (2022)MHRA GxP DI (2018)ICH Q9(R1)21 CFR Part 21121 CFR Part 820ISO 13485:2016ISO 9001:2015EU GVP ModulesICH E2AICH E2B(R3)ICH E2C(R2)21 CFR 314.8021 CFR Part 312
PROFESSIONAL · READINESS ORIENTATION
Rate observable operation from 0 (not established) to 4 (adaptive). The protected output prioritizes operating dimensions and evidence—not a compliance score.