Issuu

BEYOND COMPLIANCE TURNING REGULATORY CHANGE INTO SUSTAINABLE OPERATIONAL BEHAVIOR Authors, M. KATS, L. KEGELAERS, I. LENAERTS1 1SGS

Regulatory Change Management (RCM) is often viewed as merely a compliance process: regulations are monitored and assessed, a gap analysis is conducted and the necessary actions are implemented. However, sustainable compliance can present some challenges.

ALIGNING REGULATORY MONITORING SCOPE WITH BUSINESS STRATEGY Monitoring of regulatory requirements requires strong cross-organizational involvement. To support this need, we have established a clear RCM framework:

MANAGING THE VOLUME OF REGULATORY REQUIREMENTS The growing volume of regulations, guidance updates and industry standards makes manual monitoring resource-intensive and difficult to sustain. We addressed this challenge in two ways: DEDICATED REGULATORY COMPLIANCE COORDINATORS Conduct risk-based monitoring of predefined regulatory intelligence, evaluate potential impact and coordinate follow-up with process owners.

PROCESS A procedure must be in place, defining roles and responsibilities for identifying and monitoring applicable requirements. .

OPERATIONAL BUY-IN

FIT-FOR-PURPOSE

Operational management input on regulatory scope, based on their activities and current or future business strategy.

Requirements are monitored using a risk-based approach, prioritized by criticality and reviewed at least annually.

THE GAP BETWEEN REGULATORY CHANGE 03 BRIDGING IDENTIFICATION AND IMPLEMENTATION

AI-ENABLED MONITORING We are exploring an AI-supported agent to accelerate monitoring, identify relevant updates and reduce manual effort, allowing us to focus on content.

04 FROM DOCUMENTATION CHANGE TO BEHAVIORAL CHANGE Updating procedures and training records alone does not guarantee effective compliance as this is only achieved when regulatory requirements are translated into consistent operational behavior. Sustainable compliance therefore requires:

Turning a regulatory change into a meaningful, lasting implementation requires shared accountability and clear ownership in each step of the process. Role

Accountability

Regulatory Compliance Coordinator

Coordinates monitoring, triage and change lifecycle; facilitates riskbased decision-making; and provides methodology and oversight.

Process Owner

Assesses operational impact, owns implementation of decisions, demonstrates fit-for-purpose controls and sustains adoption within the business process.

Subject Matter Expert

Interprets technical impact and defines practical control expectations.

Line Management

Ensures resources, prioritization, training completion, accountability follow-up and coaches employees to sustain required behavior.

Quality Assurance

Verifies effectiveness through audits and continuous improvement.

AWARENESS

CAPABILITY

REINFORCEMENT

Affected personnel need to understand why the change is necessary.

Developing the knowledge and skills needed to apply new requirements in daily work.

Sustaining compliance through leadership engagement, monitoring, feedback and effectiveness checks.

CONCLUSION As regulatory requirements continue to evolve, organizations must overcome key challenges: defining the right scope, managing increasing regulatory volume, establishing clear ownership and translating change into daily behavior. Addressing these challenges through structured governance, risk-based prioritization and operational accountability enables organizations to move beyond compliance and create lasting change.

8 T H GL O B A L Q A CO N F ERENCE · M I N D T HE GA P · # R Q A 2 026

The Crowned Prince: PV Auditing in the Age of AI The crown was given, not yet earned. Holding the line on audit quality. Gemma Sayers, Director, Team Lead Quality Auditing (GVP), GSK · Presented by Sam McIntyre, Manager, Quality Auditor (GVP), GSK

Mind the gap: one call, two listeners

A crown given, not earned Legitimacy assumed. AI is spoken of as the inevitable successor before it has governed anything.

Hypothetical case. A periodic audit of a call-intake vendor. An AI tool transcribed and screened every adverse event call against the standard question set.

Succession implies displacement. Budget and headcount decisions are made as if the throne has already changed hands. A prince still needs regents. Someone must rule while the heir learns. That regent is the human auditor.

What the AI tool checked Reaction asked Timing asked Outcome asked

Why now: audit volume rises while headcount stays flat, and EU IR 2025/1466 (applicable from 12 Feb 2026) raises the bar on vendor and sub-contractor oversight.

Why human judgement still wins

Concomitant medications asked Verdict: compliant. File closed.

Critical thinking asking “does this make sense?”, not just “does it match the rule?” Contextual reasoning knowing what a good call sounds like, then testing if the gap repeats

What the auditor heard

“…and then I stopped taking the other one too.”

Creativity designing the follow-up question no checklist anticipated

The call-handler moved straight to sign-off. No follow-up question. The medication change was never captured.

Judgement under ambiguity deciding what a soft signal is worth

Verdict: an undocumented signal.

Figure 1. The same call transcript reviewed by the AI tool (left) and the human auditor (right). The tool checks for completeness; the auditor listens for meaning.

6 of 40

Where AI earns its place

The auditor followed her hunch and pulled 40 more calls. Six showed the identical gap: 2 unlogged medication changes, and 1 reaction that “actually got worse for about a week”, a missed seriousness upgrade.

Screens 100% of files to sharpen risk-based sampling Spots patterns across thousands of cases Drafts first-pass summaries and timelines in seconds Flags inconsistencies for a human, every time

Figure 2. 40 further calls from the same handler. Gold = the same gap.

Every file still looked complete. A listening problem, not a data problem.

The Regency Model: human-led, AI-supported

Three things to take away 1

Use AI to see everything. Use humans to understand anything.

The audits that protect patients most are the ones a human chose to dig into.

Until the prince earns the throne, your judgement is the regency.

AI does the volume. Humans hold the crown’s actual authority.

1 AI screens

2 Human reviews flags

3 Human investigates

4 Human decides

100% of files scanned for completeness, timing, coding and outliers

Triages what surfaced against real-world risk

Listens for what is missing, then tests whether the gap repeats

Final call, rationale and accountability stay with the auditor

Figure 3. The Regency Model. AI screens every file; each later step, and the final decision, stays with the human auditor.

Hypothetical case study for illustration only. Views expressed are the author’s own and not those of GSK.

8th Global QA Conference · London · 4–6 November 2026

8TH GLOBAL QA CONFERENCE • RQA 2026 • CONNECTED BY QUALITY

Dr Thulile van Wyk

MIND THE GAP

Dr Ruan Gerber • Prof Rose Hayeshi North-West University

Digital vs. Manual Quality Management Systems: Insights into Adoption, Effectiveness, and Societal Impact

Preclinical Drug Development Platform Email: Thulile.vanwyk@nwu.ac.za 4–6 November 2026 • Novotel London West

A multi-sector survey of QMS adoption, perceived value and effectiveness

THE QUALITY GAP

Quality problems become people problems. • System Fragmentation: Heavy reliance on paper and Excel creates data silos. • Traceability Risks: Fragmented filing compromises data integrity and compliance. • Operational Friction: Disconnected workflows shift system burdens onto personnel.

THE BIG FINDING

The adoption gap is visible.

QMS knowledge and role effectiveness

Manual systems were reported almost twice as often as QMS software.

66%

QMS SOFTWARE

TODAY

GOAL

THE GAP

Paper, Excel, manual filing

WHAT WE ASKED

• Adoption Context: Digital vs. manual system distribution across sectors. • Regulated Impact: QMS effectiveness within strictly regulated environments. • Perceived Value: Direct organisational and broader societal benefits.

Connected, traceable records

BRIDGED BY

PEOPLE

74% rated the impact extremely or significantly positive

34%

MANUAL QMS

→

PROCESS

→ TECHNOLOGY

ROLE EFFECTIVENESS

35%

39%

Extremely positive Moderately positive

66% rated QMS commitment effective or very effective

Closing the gap is not only a software decision. It connects people, processes, technology and evidence.

66%

n = 32 • sector representation was uneven (retail 0%)

34%

Manufacturing

31%

Other

22%

Healthcare

Service IT / Technology

4.53 / 5

4.50 / 5

4.18 / 5

Regulatory compliance support

Error-reduction benefit

Qualityimprovement benefit

Mean scores (1–5) reflect respondents’ perceptions, not demonstrated causal effects.

31% Neutral 31%

Ineffective 3%

THE NUMBERS TO REMEMBER WHO RESPONDED?

Significantly positive Slightly positive

QMS COMMITMENT

Effective / very effective

16% 10%

INTERPRETATION

• High Perceived Value: Strong consensus on compliance, error reduction, and quality gains. • The Human Factor: Culture, change management, and skills dictate successful digital transitions. • Future Focus: Correlating QMS adoption directly to measurable operational outcomes.

W H Y T H E G A P M AT T E R S

Quality systems may sit inside organisations, but their consequences reach beyond them. Next step: connect QMS adoption to quality culture, capability and measurable operational outcomes. References: Zgirskas A, Ruzevicius J, Ruželė D. (2021) Standards 1:154–166. • Gremyr I et al. (2021) IJQSS 13(3):381–394. • CE project 186709422 • Ethics NWU-00187-24-A1

n = 32 respondents (31 for impact question) • multi-sector survey

A Quality-Driven Journey: Transforming the Clinical Pathology Unit of Santobono-Pausilipon Hospital into Paediatric Phase 1 Laboratory Unit Fara Petruzziello1 , Gaia Sepe1, Gianfranco De Feo2, Ornella Leone3 , Peppino Mirabelli 3 ,Rosanna Parasole1 , Marialuisa Siepi3 1 Department of Oncology, Hematology and Cellular Therapies, AORN Santobono Pausilipon IRCCS, Naples, Italy 2 Clinical Trial Monitoring and Research Quality Assurance Unit, National Cancer Institute IRCCS Fondazione Pascale, Naples, Italy

Artificial intelligence was used to support and verify the accuracy of the translation into British English.

3 Clinical Pathology Unit, Pausilipon Hospital, AORN Santobono Pausilipon IRCCS, Naples, Italy

BACKGROUND Participant safety and data integrity are primary requirements in Phase 1 clinical trials. A Phase 1 Laboratory must comply with AIFA Resolution 809/2015, reflecting international Good Clinical Laboratory Practice (GCLP) guidelines. GCLP integrates Good Clinical Practice and Good Laboratory Practice, ensuring reliable and accurate results with full data traceability and integrity.

The Clinical Pathology Unit of Pausilipon Hospital, AORN IRCCS Santobono-Pausilipon, obtained ISO 9001:2015 certification in March 2024. To achieve AIFA requirements and self-certify as a Phase 1 Laboratory Unit (ULF1), the ISO 9001:2015 Quality Management System (QMS) was harmonised and integrated with the Phase 1 QMS.

METHODS 1. SOPs: To traslate GCLP into operational practice, 10 cross-functional SOPs are developed.

Results: The ULF1 (F1/321) was self-certified on 04/03/2025 and has been operational since 07/03/2025. On 11/27/2025, it underwent an AIFA inspection, which was successfully passed. Furthermore, analysis of the monitoring indicators showed that the QMS is both effective and efficient.

2. Governance: To convert the QMS into measurable, auditable performance criteria, quality indicators are defined.

3. Tools: To ensure GCLP compliance, non-conformity management system, critical value reporting workflow, defined personnel roles and training pathways, continuous temperature monitoring with alarm management, equipment maintenance traceability, and Laboratory Information System (LIS) validation are implemented.

Conclusions: The implementation of an integrated and dynamic QMS, compliant with GCLP guidelines, enabled the establishment of the first pediatric ULF1 in Southern Italy. This model demonstrates the feasibility of integrating Phase 1 laboratory requirements within an ISO 9001-certified clinical laboratory, strengthening quality governance, regulatory compliance, and standardization of laboratory processes in clinical research, including for advanced therapies. The integrated QMS ensured standardized management and full process traceability, successfully passing the AIFA regulatory inspection.

Anticipating Clinical Emergencies in Phase 1 Trials: Risk Factors and Mitigation Strategies -A Proposal from the Quality Assurance Working Group of the Italian Phase 1 Centres Fara Petruzziello1, Maria Elena Marcelli2, Agostino Cauteruccio3, Catello Montagnaro1, Nicoletta Bertorello4, Erica Dugnani5, Stefania Trivillin6,

Artificial intelligence was used to support and verify the accuracy of the translation into British English.

Rossana Casti7, Vincenza Maselli8, Gianfranco De Feo7, Rosanna Parasole1 1Department of Oncology, Hematology, and Cell Therapy, AORN Santobono-Pausilipon IRCCS, Naples IT; 2Department of Anesthesia, Resuscitation, and Intensive Care, IRCCS IFO Regina Elena National

Cancer Institute, Rome IT; 3Unit of Anesthesia and Intensive Care, AORN Santobono-Pausilipon IRCCS, Naples IT; 4Pediatric Onco-Hematology Unit, Regina Margherita Children's Hospital, AOU Città della Salute e della Scienza, Turin IT; 5Quality, Accreditation, and Risk Management Department, IRCCS San Raffaele Hospital, Milan IT; 6Administrative Management of Research, Clinical Trials, and Funded Projects Unit, Azienda Sanitaria Universitaria Friuli Centrale, Udine IT; 7Clinical Trial Monitoring and Research Quality Assurance, IRCCS Pascale Foundation National Cancer Institute, Naples IT; 8Quality, Accreditation, and Risk Management Department, IRCCS San Raffaele Hospital, Vita-Salute San Raffaele University, Milan IT

Introduction: Phase 1 clinical trials involve innovative investigational medicinal products whose toxicity profiles have yet to be fully characterised. Embedding quality as an integral component of the study from its very design is therefore crucial to safeguarding trial integrity and participant safety.

Objective: To define strategies for identifying and mitigating study- and system-related critical factors that, in Phase 1 trials, may contribute to the onset of clinical emergencies or compromise their management, with the aim of optimising the timeliness of emergency interventions and strengthening participant safety.

Materials and Methods: In December 2023, the QA Working Group of the Italian Phase 1 Centres established a multidisciplinary team dedicated to clinical emergencies. Over the course of nine meetings, through a review of the literature, a comparison of the operating procedures adopted by the different Centres, and an analysis of current regulations, the potential risk factors that could arise during the conduct of trials were identified, with particular reference to the management of clinical emergencies in Phase 1 trials, the related potential risks to patient safety, and the corresponding risk-mitigation strategies.

Results: are presented in the following table. Risk management matrix Risk Factor & Prevention/Mitigation Mesaures CATEGORY

RISK FACTORS Suboptimal selection of participants

PREVENTION/MITIGATION MEASURES Define clear inclusion/exclusion criteria (Sponsor/CTQT responsibility); conduct rigorous screening

Incorrect determination of the starting dose/dose escalation (Sponsor responsibility) Dose/escalation assessment also involving a pharmacologist; gradual dose-escalation protocols; establishment of a Data Safety Monitoring Committee

STUDY

SYSTEM

Insufficient monitoring of adverse events; misinterpretation of the PEWS/NEWS assessment scoring system

Continuous and/or frequent monitoring of vital parameters; contingency plan for unexpected cases

Drug-drug/drug-food combinations (Sponsor responsibility); suboptimal assessment of patient-specific risk (concomitant medications)

In-depth screening for drug/food interactions; access to pharmacological experts for timely consultation

Inadequate communication with participants/legal representatives

Provide detailed informed consent; repeat the informed consent process, particularly before dose escalation; train participants/legal guardians on the risks involved; provide identification cards and clear, simple, easy-to-consult information materials

Incorrect or incomplete documentation

Implementation and validation of data collection, recording, communication and monitoring systems

Insufficiently detailed administration schedule (Sponsor responsibility)

Ongoing staff training on preparation and administration procedures; contingency plan for unexpected cases

Inadequacy of medical and logistical resources

Ensure adequate, timely and readily accessible medical resources; ensure availability of emergency medications; establish predefined agreements with Intensive Care Units for potential patient transfer; transfer the patient only after stabilisation

Poorly defined emergency plans

Develop and regularly test (through periodic drills) detailed emergency procedures

Insufficient training of healthcare staff

Continuous and regular training of healthcare staff on emergencies/specific emergency scenarios

Ineffective communication among staff involved in emergency management

Use of rapid, transparent and secure communication systems between the research team and emergency medical staff

Lack of real-time data access

Implementation of data collection and monitoring systems enabling rapid visualisation of vital parameters and adverse reactions; creation of an alert system to immediately notify medical staff in the event of serious adverse reactions or changes in vital parameters

Conclusions: The proposed preventive measures, relating to both study design and study conduct, could enable early mitigation of risks to participants and to data integrity, thereby enhancing patient safety and the reliability of trial outcomes.

Turning findings into foresight: Using audit insights to build a sustainable culture of quality Gary Pretsell, BSC (Hons) MRQA; Labcorp, Huntingdon, UK

Using audit intelligence, proactive engagement, and quality partnerships to drive continuous improvement beyond compliance What if the greatest value of a sponsor audit is not finding resolution outcomes, but the insight it provides? Sponsor audits generate a wealth of information that can extend far beyond individual observations and Corrective and Preventative Action (CAPA) responses. This poster demonstrates how organisations can leverage sponsor audit feedback to identify trends, highlight recurring risks, understand evolving sponsor expectations, and drive meaningful continuous improvement. Using a structured approach that combines audit intelligence, leadership engagement, CAPA effectiveness review, and proactive communication, audit hosts can help shift the focus from reactive correction to proactive prevention. The result is stronger quality culture, improved inspection readiness, and a more strategic approach to managing quality and compliance.

TECHNOLOGY AUDITING EXCELLENCE

STRUCTURED OVERSIGHT, COMPLIANCE ASSURANCE AND AUDIT LIMITATIONS ACROSS CUTTING EDGE GxP TECHNOLOGIES Presenter: Paras Shah – Principal Consultant | ComplyWell Solutions |Contact Email: Paras.shah@complywellsolutions.com | 8th GQA Annual Conference, London, UK | 2026

REGULATORY FOUNDATIONS

TECHNOLOGY AUDIT – HOW MUCH?? Technology

21 CFR Part 11

EU Annex 11

Computer Software Assurance for Production and Quality Management System Software

Good Automated Manufacturing Practice® 5

EMA Guideline on Computerized Systems and Electronic Data in Clinical Trials

EU AI Act

STRUCTURED AUDIT METHODOLOGY Risk based Sampling

Hybrid Execution

Evidence-led Evaluation

Regulatory Traceability

Periodic Reviews

Continuous Compliance Pathway

Audit Focus

Secure Document Portals

Video Validation Walkthroughs Dashboards

Controlled Live Compliance Access Demonstrations Tracking

Remote Supplier Audits

Offsite Verification

Core Standards: FDA 21 CFR Part 11 Electronic Records | EudraLex Volume 4 Annex 11 Computerised Systems.

CONTINUOUS COMPLIANCE & MONITORING

Active UAT Continuous Participation Training

Periodic System Reviews

Automated Configuration Tracking

Verify Detect & Build Human Monitor Regulatory Reverse Capability to Changes to Block Boundaries Drifts to Handle Complex Unapproved before Maintain Upgrades Modifications Go-Live Data Integrity

Verify input/output weights and decision metadata. Algorithmic processes can be reverse-engineered during standard regulatory inspections Audit integration logs to ensure patient data from multiple apps flows into the master database without errors Inspect metadata history to explicitly reconstruct the precise time, origin and modification history of clinical source data for authenticity verification

ARTIFICIAL INTELLIGENCE (AI) SYSTEMS & LARGE LANGUAGE MODELS (LLMS)

EXPLAINABILITY TRAILS & MODEL DRIFT

DECENTRALIZED CLINICAL TRIAL ARCHITECTURE

DYNAMIC DATA SYNCHRONIZATION & INTEGRATION PIPELINES

eCOA, ePRO, eCONSENT & eTMF APPLICATIONS

METADATA TRACEABILITY & AUDIT TRAILS

RANDOMIZATION AND TRIAL SUPPLY MANAGEMENT (RTSM)/ INTERACTIVE RESPONSE TECHNOLOGY (IRT)

RANDOMIZATION LOGIC, BLINDING

Check system configuration settings to prove patient data stays completely blinded

TELEHEALTH PLATFORMS

PATIENT PRIVACY, SECURE TRANSMISSION

Validate end-to-end encryption mechanics to safeguard raw patient medical files from unauthorized cloud leakage

WEARABLE DEVICES/SENSORS

DATA ACCURACY & DYNAMIC CALIBRATION LOGS

Audit continuous telemetry data streams and validation logs to ensure transmitted metrics match actual patient clinical baselines

ACCESS CONTROL, DISASTER RECOVERY

Check cloud vendors to prove your data is kept private from others and can be fully recovered after a system crash

CLOUD AND SOFTWARE AS A SERVICE (SAAS)

REMOTE/ONSITE AUDIT ENABLEMENT

Example & Rationale

READINESS

CRITICAL AI LIMITATIONS

Message: AI can support creation & monitoring but cannot replace human judgement.

Area

Limitation

Compliance View

AI- Driven Decisions

Lack of structural explainability

Automated Risk Scoring

Algorithm bias

Cannot justify regulatory outcomes to inspectors Directly violates ALCOA++ data integrity foundations

Predictive CAPA Tools

Unvalidated predictive logic pathways

Breaks validation traceability

AI-Generated Reports

Complete absence of human accountability

Non-compliant with documentation rules

Frameworks: Good Automated Manufacturing Practice® 5 A Risk-Based Approach to Compliant GxP Computerized Systems (ISPE).

GxP

Abbreviations: eCOA (Electronic Clinical Outcome Assessment) | eTMF (Electronic Trial Master File) | ePRO (Electronic Patient Reported Outcome)

Fit-for-Purpose Quality and GxP Compliance for the 100 Days Mission

Coalition for Epidemic Preparedness Innovations

QMS Adaptation During Public Health Emergency

Walter-Rodney Nagumo: GxP Quality Associate | Peter Spencer: Global Quality Lead | Xinyi Kong: Senior Quality Lead | Jasmine Miah: GxP Quality Manager | Matthew Scotney: Head, GxP Quality and R&D Compliance

Background Public health emergencies (PHE) demand rapid development, review, manufacturing, and deployment of medical countermeasures, without compromising product quality, participant safety, data integrity or compliance. COVID-19 showed compressed timelines are achievable: the first vaccine to be authorised within 327 days (Lurie et al., 2020; Ball, 2021), through overlapping activities, at-risk investment, platform technologies, and regulatory flexibility, rather than relaxed GxP standards (WHO, 2025). Pre-pandemic preparedness is key and requires prior investment in quality systems. In outbreak settings where resources may be limited, it can be challenging to define the minimum GxP-capable controls needed and which quality systems can be progressively strengthened without compromising safety, data integrity, or regulatory compliance.

Objective / Methods Propose a fit-for-purpose quality framework for rapid vaccine development within 100 days, informed by regulatory guidance, literature, and pandemic lessons.

Findings The review identified strong alignment across the available literature and regulatory guidance, including ICH E8(R1), E6(R3), Q9(R1), Q10, EMA, MHRA, FDA and WHO guidance, supporting Quality by Design, fit-for-purpose quality systems, and risk-based-quality management throughout the product lifecycle. The evidence suggests that rapid development is achievable when pre-pandemic preparedness activities (see Fig. 1) are initiated early and quality controls mature. Success depends on pre-existing quality capabilities, interoperable frameworks, networks, and sustained preparedness, with risk-based, proportionate controls aligned to Critical-to-Quality factors and lifecycle stage.

FIG. 1: FIT-FOR-PURPOSE QUALITY DURING THE FIRST 100 DAYS OF A PANDEMIC (day ranges are illustrative and activities may occur across phases)

PREPAREDNESS

ASSURANCE

BEFORE DAY 0

Pre-Pandemic Preparedness & Readiness

SCALE-UP

DAY 0–29

DAY 30–59

DAY 60–100+

Establishing Assurance

Scaling Risk-Based Controls

Regulatory Confidence

Sponsor capability & quality systems confirmed GMP investigational product readiness ICH-GCP compliant trial framework Protocol, site & contract readiness Ethics & regulatory engagement Roles, responsibilities & governance defined

Establish quality networks and GxP expertise Embed quality in preparedness and simulation exercises Strengthen risk-based GxP workflows Advance digital data quality and validated AI use Catalyse capacity building and workforce readiness OUTCOME Rapid activation of pandemic quality capabilities

REGULATORY CONFIDENCE

RBQM implementation

GMP compliance verification

Fit-for-purpose quality controls

Batch release oversight

Technology transfer oversight

Regulatory submissions

Process qualification/ validation

Pharmacovigilance maturity

Expanding vendor oversight

Inspection readiness

Ongoing regulatory engagement Data management & pharmacovigilance systems

Evidence generation for authorization (EUA / full) Enabling deployment and access

OUTCOME Confidence to initiate outbreak research rapidly and compliantly

OUTCOME Scale without compromising quality

OUTCOME Demonstrate sustained control and trust

DEVELOPMENT CONTINUUM

Preclinical

Phase 1

Phase 2

Phase 3

Commercialisation

Quality requirements evolve continuously across the development lifecycle.

QUALITY ENABLERS

NON-NEGOTIABLE REQUIREMENTS

Quality Management System (QMS)

Data Integrity

CAPA

Training & Competency

Change Control Vendor Quality Management

Ethics Approval

Informed Consent

SAE Reporting

GMP Oversight

Data Integrity

Product Traceability

Deviation Management

Protocol Compliance

These requirements apply throughout the development continuum and cannot be compromised.

The 100 Days Mission is achievable without reducing GxP standards, supported by the literature and regulatory frameworks including ICH E8(R1), E6(R3), Q9(R1), Q10, EMA PHE guidance and lessons from COVID-19. Success depends on early preparedness, pre-existing quality capabilities and interoperable networks, with risk-based, fit-for-purpose controls proportionate to Critical-to-Quality factors and lifecycle stage. Maintaining warm manufacturing, clinical, laboratory, data, pharmacovigilance and regulatory networks before an outbreak enables rapid, Conclusion compliant development. Existing GxP frameworks support fit-for-purpose quality; the next step is to develop a full position paper on this topic.

Contact:

qualityteam@cepi.net

www.cepi.net

Key References: 1. bit.ly/4iLRRMF 2. bit.ly/4yKdRxC

3. bit.ly/4yJ3IXP

Quality Agreement vs GLP Responsibilities Zuoxiang Yu, TriApex Laboratories Co., Ltd., No.9 Xinglong Rd, Jiangbei New Area, Nanjing, China

Why Quality Agreements in a GLP Facility?

GMP: Quality Agreements (Q-Agreements) are explicitly expected for outsourced activities, defining responsibilities between the Owner/Contract Giver and Contract Acceptor. GLP: FDA and OECD GLP do not specifically require a standalone Q-Agreement between the sponsor and CRO, as responsibilities are already defined within the GLP framework. As a CRO providing non-clinical safety study services, we do meet the expectations from our sponsors sometimes. This poster will explore the role and significance of a quality agreement in a full-scale non-clinical GLP lab and how we practically implement it to ensure compliance with the GLP regulations and sponsors’ satisfaction.

Implementation: When and how Preferable: during vendor selection/qualification or contract negotiation. • Sponsor requests the Q-agreement & define the scope • CRO acts as the document custodian to fit its QMS. • Focus on GLP service and regulatory terms to avoid generic GMP adaption unless the scope requires it. • The most efficient approach is a master agreement with study-specific appendices. • Sponsor and CRO jointly review/agree on responsibilities. • Relevant legal and procurement review as needed. • Authorised representatives approve and sign. • Controlled document with version and change history

What to include?

General elements • Purpose & Scope – the outsourced activities • Applicable GLP regulations (FDA/OECD/NMPA) – sponsor’s submission & CRO’s capability • Clear contractual hierarchy and relationships - the QAgreement, SLA & Work Order. Core requirements The GLP interfaces between the Sponsor & CRO: • GLP regulations to be claimed. • Quality Management System in the test facility. • Test article characterization, arrangement & transport. • Test system, facility, apparatus, methods. • GLP study: plan-perform-monitor-record-report-archive.

Benefits and Pitfalls Benefits

Support business and negotiation Unrealistic contractual processes commitments Clarify roles & responsibilities, and Over-reliance on compliance GLP interfaces assurance Align GLP requirements with CRO SLA contractual conflict and SOP QMS misalignment Maintain independent QA oversight

Core requirements (Cont.) • Communication lines between study/project sites/countries, sponsor/CRO • Deviation handling in CRO/to sponsor • SD responsible for outcome & conclusion of the study • Independent QA oversight • Special scenarios o Sponsor staff acts as study personnel in the study o Sponsor is a PI-test site o Interim report o Reopen reported study

5 Pitfalls

Excessive oversight

Set clear reporting and escalation Higher operational costs and pathways admin burden

What to include?

Conclusions A GLP quality agreement clarifies Sponsor-CRO responsibilities, complementing the contract, study plans, and existing SOPs while maintaining the scientific integrity and independence of GLP studies. References 1. FDA Guidance Contract Manufacturing Arrangements for Drugs: Quality Agreements (2016). 2. EU GMP Guide, Chapter 7 (2012) & Annex 16 (2015) 3. FDA 21 CFR Part 58 Good Laboratory Practice For Nonclinical Laboratory Studies 4. OECD No.1 Principles of Good Laboratory Practice (as revised in 1997) 5. OECD No.11 The Role and Responsibilities of the Sponsor in the Application of the principles of GLP (1998) 6. OECD No. 21 Possible Influence of Sponsors on Conclusions of GLP Studies (2020) 7. OECD No. 23 Quality Assurance and GLP 8. OECD GLP Frequently Asked Questions

Consultant at Yu Compliance Consulting AB, Sweden

Evolution of Clinical Research Quality & Compliance in India Insights from 74 GxP Audits Conducted Between 2009-2026

Background/Objective

Evolution of Audit Scope

India has become one of the world's most significant clinical research regions. Despite persistent perceptions regarding compliance risk, little audit-based evidence has been published describing the evolution of quality systems and regulatory compliance within India. This analysis examines long-term audit trends to better understand the maturity of India's GxP environment and evaluates the evolution of quality and compliance within India's clinical research ecosystem through analysis of 74 industry-driven GxP audits conducted by Advarra Consulting from 2009-2026. Audit types included: GCP, GMP, GVP, CSV, and GcLP. Organizations assessed included: Investigator Sites, CROs, Clinical Laboratories, Phase I Units, Pharmacovigilance Providers, Technology Vendors and GMP Suppliers. Analysis focus included: finding severity trends, audit scope evolution, recurring quality themes, and indicators of organizational maturity and compliance performance. The contracted audits were performed by Indian and American auditors. This is a retrospective portfolio analysis, not a populationlevel comparison of every research organization in India or other markets. Finding counts are influenced by audit purpose, duration, scope, organizational complexity, and the evolving mix of sites, CROs, vendors, laboratories, and systems assessed.

2009-2013 Predominantly investigator-site audits

What the audit data shows Across the three long-term periods presented in the source analysis, findings were predominantly minor. Critical findings remained rare and were confined to a small number of audits.

Period

# of Audits

Critical

Major

Minor

Interpretation

2009-2013

Higher finding volume; no critical findings

2014-2019

Moderation in the overall severity profile

2020-2026

147

Broader scope; limited emergence of critical findings

Contact: Jay E. Westfall, BS | Director of Quality, Advarra Consulting, LLC

2014-2019 Increased CRO and serviceprovider assessments

2020-2026 Ecosystem-wide audits

India in the global quality - Evidence of progress Indicator

What the data suggests

Critical observations

Uncommon across the portfolio; most audits reported none

Severity profile

Many audits predominantly identified minor observations

Qualification activity

Qualification and requalification audits frequently showed relatively low finding counts

Recent GVP performance

Remote GVP audits in 2024-2025 showed very low finding counts

Core GCP foundation

Generally maintained across audited organizations

Persistent themes identify the next opportunity Recurring category

Primary focus

Quality management systems

SOP execution, QA/QC, root-cause analysis, and CAPA effectiveness

Training and qualification

Role readiness, demonstrated competency, and reinforcement

Data integrity and documentation

SDV, SDR, eCRF completion, corrections, and missing data

Oversight and governance

Investigator oversight, delegation, and sponsor/CRO management

Technology and equipment

Calibration, validation, access control, audit trails, and recovery

Essential documentation

Completeness, timeliness, control, and inspection readiness

Conclusion Advarra's audit experience does not support the perception that India is inherently less compliant than other major clinical research markets. The quality issues observed are comparable in nature to those encountered globally.

Numbers Inform, Stories Transform: Mind the Gap Between Data and Decisions Monika Čápová, BSc. Clinical Study Solutions s.r.o. Czech Republic Monika.Capova@clinicalstudy.cz

The gap

Same facts, different packaging:

5% 63% recalled a story.*

recalled a statistic.

Three steps from finding to story 1. Character: who made the choice, and what did they know? 2. Stakes: the tension (fast vs right) and what it means for a patient 3. Resolution: the number, the lesson, what anyone can do next

Building on a session at the SQA Annual Meeting 2026, National Harbor, USA

The best QA finding is useless if it doesn’t change behaviour. Behaviour changes through stories, with the number still in the room. Scan for the method card & worked examples

Same finding, two ways

As reported “Staff failed to follow visit completion procedure. Deviation logged.”

As told Amanda, a study coordinator, had completed this checklist 500 times. On visit 501 she was training a new colleague while answering a sponsor email, and ticked “yes” without checking that the ECG had reached the central lab. Two weeks later a safety signal was flagged. The missing ECG was the one that could have caught it earliest. The patient was fine. This time.

Before you tell it Consequence, not blame The number stays in the story De-identified

This week Take one finding. Ask: what is the human story behind this number? Tell it at your next team meeting. https://www.clinicalstudy.cz/poster/

*Heath C, Heath D. Made to Stick. 2007 (Stanford).

MIND THE AI GAP Keeping Human Judgement in the Loop

Generated ≠ Verified

Gabriela Krumova gabriela.krumova@clarenta.com

To Risk

From output

AI output

Looks Right

Trust Grows

Less Scrutiny

The Gap

Quality Risk

Fast, fluent

Professional

Easy to accept

Fewer checks

Unchallenged

Error Persists

THE MOMENT TO QUESTION

A convincing answer is not necessarily the right answer.

But is it?

Real world example: CAPA plan

Sounds professional

Correct?

AI GENERATED CAPA

Actual root cause?

Well structured

Complete?

“Provide additional training.”

Specific to this process?

Seems reasonable

Context specific?

”Update the procedure.”

Relevant to this organization?

Ready in seconds

Source verified?

“Increase monitoring.”

Will it prevent recurrence?

Looks right ≠ is right AI Generated Output

A polished output can still be wrong for the situation.

A generic CAPA can be well written and still be the wrong CAPA.

MEANINGFUL HUMAN OVERSIGHT

READ

VERIFY

CHALLENGE

AI provides CAPABILITY

Before you accept...

RISK BASED VERIFICATION

CONTEXTUALIZE

DECIDE

INTENDED USE What is it for?

QUALITY CONNECTS

POTENTIAL IMPACT What if incorrect?

CRITICAL TO QUALITY What matters most?

Humans provide CONTEXT

Mind the Gap: What External Audits Tell Us Turning external audit outcomes into connected quality improvement at Clarenta Vania Kalaydjieva, MD, PhD vania.kalaydjieva@clarenta.com Background and rationale

Objective

Core concept

Clinical research organizations are routinely assessed by sponsors, partners and other external stakeholders. Each external audit provides a focused view of selected processes at a specific point in time. The greater value, however, comes from looking beyond individual findings and asking whether repeated themes indicate broader quality-system gaps, implementation challenges or opportunities for simplification and standardization.

To demonstrate how external audit outcomes can be transformed from isolated observations into a connected quality-improvement process that strengthens procedures, oversight, training, documentation practices and operational consistency across Clarenta.

External audits are not only a compliance checkpoint. When audit outcomes are reviewed collectively, they can reveal the distance between how a quality system is designed and how it operates in practice. The poster shows how Clarenta Ltd can use external audit feedback as a structured source of organizational learning and continuous improvement.

From individual findings to a connected quality improvement process 1. External perspective

2. Identify the gap

3. Understand the pattern

4. Connect through quality

Sponsor/client audits provide independent evidence of how processes are understood and implemented in practice.

Audit observations are grouped into recurring themes rather than considered only as individual events.

QA reviews whether similar observations point to procedural, training, documentation, oversight or implementation weaknesses.

CAPA, procedural updates, targeted training, risk reassessment and management oversight are linked to the identified themes.

The gap Between design and practice

5. Verify improvement Effectiveness checks, subsequent audits and quality metrics are used to determine whether the gap has genuinely been reduced.

Connected quality improvement at Clarenta Ltd AUDIT OUTCOME → TREND → ROOT CAUSE / SYSTEMIC GAP → QUALITY ACTION → EFFECTIVENESS CHECK → STRONGER QMS

Common external-audit outcome themes

Illustrative, anonymized example

> Proof-of-concept & clinical pharmacology

External audit observations

Quality response

> Consistency between written procedures and actual practice

> vendor documentation incomplete > missing qualification evidence > limited oversight records

> clarify the process

> Documentation completeness, traceability and contemporaneous records > Clarity of roles, responsibilities and oversight > External provider qualification and lifecycle oversight > Training effectiveness and evidence of competency > Computerized-system governance, validation and data integrity > CAPA quality, timeliness and effectiveness verification > Risk-based thinking & evidence that quality controls are proportionate to criticality

> strengthen risk rationale > define qualification conclusions > introduce more consistent oversight evidence

KEY TAKEAWAYS External audits provide valuable independent perspectives Recurring themes reveal systematic gaps

Connected analysis

Connected analysis enables targeted and effective actions

When reviewed together, these observations indicate a broader gap in how vendor lifecycle oversight is documented and demonstrated

Learning from external audits strengthens procedures, oversight and operational consistency across Clarenta Ltd.

Mind the Gap: From GxP Training to Real-World Behaviour Visit us at booth #23

info@towermains.com www.towermains.com

GxP training is fundamental to a compliant quality system. But completing training does not necessarily translate into compliant behaviour. Training records provide evidence of completion. They do not, by themselves, demonstrate that a person can apply requirements consistently, make appropriate decisions or respond effectively in real-world situations. This poster explores the journey from training → understanding → behaviour → competence, and the gap that can exist between them.

Training

Competence

Completion is the starting point, not the end point.

Competence is demonstrated through performance.

A training record can show that someone has:

It means consistently applying knowledge, skills and judgement to the work being performed. The way competence is demonstrated should depend on the activity, the risk, and the role. Evidence might include:

ATTENDED a session COMPLETED an e-learning module READ a procedure PASSED a knowledge check

TRAINING BUILDS KNOWLEDGE, BUT COMPLIANCE IS DEMONSTRATED THROUGH BEHAVIOUR

But it doesn't necessarily demonstrate that they can:

SUPERVISED activities REVIEWED records and outputs ASSESSED competency OBSERVED performance QUALITY and performance data

Understand → Apply → Decide → Act

Together, these demonstrate effective and reliable performance.

The real question is: what changed in practice?

Mind the Gap

Understanding Training tells people what to do. Understanding goes further. It means knowing: WHAT is expected WHY it matters WHEN it applies HOW it is applied in practice Understanding why requirements matter, what they protect, and the consequences of past failures helps demonstrate the importance of regulations in protecting:

Beyond Training

A person can know the right thing to do, and still not do it.

Not every compliance gap is a training gap.

Does

Look beyond retraining to understand what drives behaviour.

Knows Record data contemporaneously

Completes records later when the lab is busy

Document what actually happened

Documents what should have happened

Follows the procedure

Uses the “usual” way

Understand why the control exists

Treats the control as administrative

Report deviations promptly

Waits - “there are bigger fires”

SOP - Is it fit for purpose? RESOURCES - Are they sufficient to comply? PRIORITIES - Do they support compliance? SUPERVISION - Are expectations reinforced? CULTURE - Can people speak up?

GMP: product quality and patient safety GLP: study integrity and reliability GCP: participant protection and reliable clinical research

Behaviour is shaped by the work environment, including leadership messages, priorities, culture, and the practicality of procedures to follow.

Training alone cannot create a strong quality culture; leadership, communication, resources, supervision, and oversight are also essential to reinforce expected behaviours.

Understanding connects knowledge with action.

This is where the gap between understanding and real-world behaviour can emerge.

Understand the cause before choosing the fix.

Black and white in a grey world: Effective training in GLP auditing Phillip Dawson, BSc, MSc; Labcorp, Harrogate, UK Introduction

Considerations for facility management

Training Quality Assurance auditors in Good Laboratory Practice (GLP) can present unique challenges.

Communication • How do you communicate odd/rare/unusual examples to a wider group? In-person, lunch-and-learn sessions, or via workplace electronic communication, for example?

In contrast to operational areas where training may appear linear (e.g., perform X, once complete proceed to Y and then Z in that order), it can appear that there are no black or white answers in the world of GLP auditing. Variations of ‘it depends’ or ‘case-by-case’ are a common response to any question asked by a new trainee or experienced auditors, resulting in a grey world to navigate both as a trainer and a trainee. Indeed, the application of the principles of GLP by different auditors to studies of the same type performed in the same facility at the same time can result in different answers to the same question due to numerous variables, all of which vary the amount and intensity of the grey. Skill in auditing GLP work is a cumulative process of exposure to, and experience in, as many of these variables (such as assay types, data recording and test materials) as possible and this can take time. Often a black or white answer is achieved by asking enough of the right questions to navigate through the grey and learning to ask the right questions starts with training. What may be seen as the more traditional scenario of trainer and trainee physically sitting at desks next to each other in the office is also changing. Increased globalization typically results in training shifting to remote methods by default. Combining the training experience in both operational and quality assurance departments of various auditors within Labcorp, the following considerations are presented as discussion points for trainees, trainers and facility management to act as an aid to more effective GLP audit training.

Considerations for trainers Audience/trainee • Is the trainee an experienced auditor cross-training into a new area or a newly joined auditor either to the company or internally from an operational department? • Does the experience and/or background of either trainer and/or trainee influence decisions on direction and training progression? Culture • In some cultures, people may respond and defer to figures of authority, such as the trainer, differently. How, as a trainer, do you assess whether answers to questions aiming to determine understanding demonstrate that understanding? Language • If the trainer and trainee are geographically remote, is any potential language difference to be considered in training? For example, in writing audit findings, or with jargon and/or acronyms to avoid, or if additional measures might be needed to facilitate understanding. Quality control vs. quality assurance • Does the trainee’s background, such as academia vs. commercial, change how you approach training in sampling data and confirming that what is reported is what was meant to be done (protocol) and how it was meant to be done (SOP)? Starting point and length of training • What do you start training on: protocol, data, and then reports? And if so, which study type? • Do you establish a firm understanding of the basic principles of GLP and then address questions as they arise or do you go through examples in detail? • Does previous trainee experience or business needs drive training decisions? Training material • What training material do you have and use? Has it been recently reviewed? • Do you use actual examples that have been audited, or do you have fictitious examples with varying subtlety in errors?

Competence • How do you manage signing off a trainee as competent? • Should this be in stages and if so, how are these defined (are there milestones in other areas to achieve first)? If trainees are remote, do you need to have anything specific in place to monitor continued competence? Knowledge transfer • When an experienced auditor retires or has a career shift, how often is it heard, “I wish we could plug you into a computer and download your knowledge”? • How do you manage transfer of knowledge and experience? Are there notes to retain in a central repository? If you have a larger group of trainers, do they meet regularly? Can current and replacement trainers meet and hand over? Trainer vs. trainers • Do you have one trainer or several and are they dedicated trainers or experienced auditors with an aptitude for training? • Is it better to have several for different perspectives or one for a more consistent message initially, and do you then change it as training progresses? • Does workload impact on trainer availability? Measuring effectiveness • How do you measure effectiveness of training? Training material • How often is training material updated? How do you manage the frequency of peer reviews of audits is this reduced as sign off milestones are achieved or tailored to the trainee? Is training material changed or updated when your facility has an external inspection (client/authority) or after a specific citation from a regulatory authority? Time zones • If trainer and trainee are geographically remote, are time zones compatible and is the appropriate trainer(s) available at the same time as the trainee(s)?

Considerations for trainees Confidence

• If you’re not sure, apply basic principles of GLP, learn from the responses, and speak up to gain from the experience of colleagues. Honesty

• With yourself and your trainer; if you don’t understand something, ask questions. System access • Do you have the system and all system functionality access you need, particularly if geographically remote?

Final thoughts The considerations presented here are not mutually exclusive to trainer, trainee or management and this is not an exhaustive list. Depending on the requirements of a facility, not all the points mentioned here will apply and indeed something not considered here may additionally apply. The response to any question raised during training is likely to be a summation of an assessment of the information available, the associated risk and how quality critical something is to the overall compliance of what is being audited. As such, any response will likely be variable as a result and potentially situationally specific. In an evolving world of technology, and therefore also compliance, auditors of all experiences should embrace and become comfortable in the grey as we are all in a perpetual state of learning.