Compliance

What your auditor will ask, and where the answer is.

For each regulation, which module addresses it and with which specific functionality. No boilerplate: if a regulation isn’t listed here, we don’t claim it.

Regulation by module. Request a demo

12regulatory frameworks

9modules in production

1signature and audit trail for the whole suite

Matrix

Regulation by module.

Every marked cell is backed by a functionality described below.

Regulation	DMS · BR	QMS	LIMS	EQ	MT	OEE	CPV	VL	PX
21 CFR Part 11
EU GMP Annex 11
ALCOA+
ICH Q9
ICH Q10
21 CFR 210 · 211
FDA OOS guidance
ICH Q2(R2) · Q1A(R2) · Q1E
USP <1058>
ISO 9001:2015
GMP: equipment, materials and process
CSV · GxP

Marked: the module addresses the regulation with a specific functionality.

Detail

How each regulation is met.

21 CFR Part 11

What it requires

Electronic records and signatures as trustworthy as signed paper.

DMS · BRSignature with password and one-time code, storing meaning, date and hash; a signed record can’t be altered.
QMSSigned closure of every process and batch record stored exactly as signed.
LIMSSigned approval of methods, results and certificates of analysis.
EQSigned calibrations, work orders and qualifications.
MTApproving, rejecting or destroying a material lot, and approving a formula, requires a signature.
CPVCapability studies and golden batch profiles signed and frozen.
VLProtocols approved with a signature; the signing code can’t be used for another protocol.

EU GMP Annex 11

What it requires

Audit trail, access control and integrity of computerized systems.

DMS · BRAudit trail of every document’s lifecycle, protected in the database.
QMSRisk-based audit trail review with signed closure.
LIMSChanging a result requires a reason, and it is recorded.

ALCOA+

What it requires

Data that is attributable, legible, contemporaneous, original and accurate.

LIMSResults entered in the system or imported with the file hash and duplicate blocking.
MTWeights validated at entry and verified by a second person.
OEEVariables read from the PLC, with the capture channel heartbeat.
CPVKeeps captured and inferred readings apart and never adds them up.

ICH Q9

What it requires

Quality risk management across the product lifecycle.

QMSAssessment by RPN or 5×5 matrix, signed acceptance of residual risk and periodic review.

ICH Q10

What it requires

A quality system with CAPA, change control and management review.

QMSCAPA with effectiveness checks, cross-functional change control and management review minutes with figures frozen at signature.

21 CFR 210 · 211

What it requires

Current good manufacturing practice: deviations, laboratory, batch disposition and release.

QMSRelease is blocked by open deviations, OOS or complaints, naming the records in the way.
LIMSLaboratory testing and records (subpart I and 211.194) with second-person review.

FDA OOS guidance

What it requires

Investigate every out-of-specification result, first in the lab and then in manufacturing.

LIMSApproving an out-of-specification result opens the investigation in quality and locks the result.
QMSLaboratory and manufacturing phases; no laboratory error is assigned without proof.

ICH Q2(R2) · Q1A(R2) · Q1E

What it requires

Validated analytical procedures and stability studies with shelf-life estimation.

LIMSVersioned methods, stability studies with tolerance windows, alerts and shelf-life estimation.

USP <1058>

What it requires

Analytical instruments fit for intended use.

LIMSDaily use checks; no results can be entered with an instrument whose calibration has expired.
EQCalibration with tolerances and due dates, and IQ/OQ/PQ qualification that feed the lab.

ISO 9001:2015

What it requires

Documented information, nonconformities, audits and control of external providers.

DMS · BRControl of documented information (§7.5): approval, versioning, distribution and retirement.
QMSNonconformities, internal audits with findings and continual improvement.
PXSuppliers who answer their SCARs and deliver certificates in their own portal.

GMP: equipment, materials and process

What it requires

Fit equipment, approved materials and a process that stays in control.

EQEquipment calibrated, clean, maintained and qualified; use is blocked if not.
MTOnly approved material is dispensed, and the batch is reconciled against the formula.
OEEProcess conditions recorded per batch.
CPVContinued verification of the validated process with control charts and capability.

CSV · GxP

What it requires

Demonstrate that each computerized system does what it should for its intended use.

VLProtocol approved before execution, on-screen evidence, and a pending step blocks closure.
DMS · BRURS, IQ, OQ and traceability matrix package.
LIMSURS, IQ, OQ and traceability matrix package.
QMSURS, IQ, OQ and traceability matrix package.

Integrity by design

Controls that don’t rely on good intentions.

These mechanisms repeat across the suite. They are what an inspector tries to break.

Not even an administrator rewrites history

The audit trail, signatures and closed records are protected by the database. A correction is a new record, never a deletion.

Four eyes where it matters

A second person reviews results and dispensing, and whoever performed an action can’t review their own audit trail.

LIMS MT QMS

What’s signed stays frozen

Each sample’s specification, management review figures, the batch record and an equipment exposure window don’t change afterwards.

LIMS QMS EQ

Blocks happen at the point of use

A non-effective master, quarantined material, an uncalibrated scale or an expired instrument are stopped before use, not at review.

DMS · BR MT EQ LIMS

Always with a reason

Changing a result, a material status or closing a statistical signal requires a written reason.

LIMS MT CPV

No fragile numbers

Without enough data there’s no Cpk; OEE missing a factor shows as not calculable; MTBF only counts classified breakdowns.

CPV OEE EQ

Validation

Validation-ready, with the evidence inside the system.

No software arrives validated for your intended use: validation depends on how each plant uses it. InduBatch ships the documentation to do it and a module to execute it.

OQ cases are executed in the Computer system validation module: every step keeps its annotated evidence and the report is issued as a numbered PDF. Computer system validation →

Platform and document managementURS, IQ protocol, OQ protocol and traceability matrix.

Laboratory (LIMS)URS, IQ, a 43-case OQ with negative controls, and traceability matrix.

Quality management (QMS)URS, IQ, OQ and traceability matrix.

Negative controls

An OQ that only tests the happy path proves nothing. The protocols include cases whose expected result is a rejection: what makes the system defensible is what it won’t let you do.

Access

Who gets in, and to what.

Corporate sign-in

Microsoft Entra ID or on-premises Active Directory, configured per company.

Second factor

Optional two-factor authentication at sign-in, and always at signature.

Password policy

Forced change, periodic change and account expiry.

Group permissions

Every screen and action, including approval, is granted per user group.

Third parties kept apart

Suppliers and clients use a separate portal, with lockout after failed attempts and an access log.

Scanned attachments

Every file arriving through the portal is malware-scanned before it can be opened.

Inspection questions

What auditors usually ask.

Can an administrator delete or change a signed record?

No. The audit trail, signatures and closed records are protected in the database itself: the change is rejected even when attempted directly through SQL. A correction is a new record that references the previous one.

If I change a specification or a master template, what happens to existing records?

Nothing. Each sample stores a frozen copy of the specification it was evaluated against, and a batch record stays tied to the effective version it was opened from.

How is the audit trail reviewed without reading every line?

Through risk-based review: rules flag the relevant entries, the rest is systematically sampled, each entry gets a verdict and the review is closed with a signature. Whoever performed an action can’t review it, and a finding opens a deviation.

What does the inspector see when asking for a batch record?

The PDF signed at release, stored exactly as signed, with the out-of-range parameters, quality records and analytical status at that moment.

Walk through the matrix with your quality team.

We’ll show you each control in the system and the validation package for the module you care about.

Request a demo