QC-ANL-004 — Outsourced Testing Governance

Field	Value
Document ID	QC-ANL-004
Title	Outsourced Testing Governance
Document Type	Authoritative QC Specification
Owner	Quality Unit (QU)
Approver	Quality Unit (QU)
Effective Date	MM/DD/YYYY
Version	v1.2
Change Control Reference	QMS-####

2. Purpose

This specification establishes mandatory governance requirements for analytical testing performed by external laboratories that generate GMP-relevant data used to support component acceptance, in-process evaluation, finished product release, stability assessment, complaint investigation, deviation investigation, and regulatory response.

This specification mitigates risk of unqualified laboratory engagement, use of non-validated or unsuitable analytical methods, incomplete or falsified laboratory documentation, adverse analytical trends, data integrity breaches, and unsupported acceptance or release decisions. These failure modes directly impact identity, purity, strength, composition, contaminant control, and consumer safety.

21 CFR Part 111 requires scientifically valid testing, documented quality control review, complete and retrievable laboratory records, and independent oversight of acceptance decisions. Failure to govern outsourced testing creates regulatory exposure under 21 CFR 111.75, 111.95, 111.105, 111.117, and 111.605.

3. Regulatory Basis

21 CFR 111.75 — Requires testing and examination of components and dietary supplements prior to release to verify identity and determine compliance with specifications.
21 CFR 111.95 — Requires use of scientifically valid methods that are appropriate for the intended purpose of the test.
21 CFR 111.105 — Establishes Quality Control responsibilities for reviewing and approving results and material disposition decisions.
21 CFR 111.117 — Requires calibration, inspection, and checks of instruments and controls used in testing.
21 CFR 111.605 — Requires retention and availability of laboratory and quality control records.

4. Scope

Applies To: All external laboratories generating analytical data used for GMP-related component acceptance, in-process decisions, finished product release, stability evaluation, complaint investigation, deviation investigation, and regulatory submission support.

Excludes: Internal laboratory operations governed under separate QC-ANL specifications and non-GMP exploratory research testing not used to support acceptance or release decisions.

5. Definitions

Compliant State: External laboratory is active on the Approved Supplier List (ASL); approved scope includes analyte and method; method is validated or verified for intended use; laboratory report is complete and traceable to an authorized test request; analytical result meets approved specification.

Nonconforming State: Analytical result exceeds or fails an approved specification limit using an otherwise qualified laboratory and validated method.

Invalid State: Laboratory not qualified for required scope; method not validated or verified; laboratory report incomplete; traceability to authorized test request absent; calibration or system suitability evidence unavailable; or confirmed data integrity breach.

Escalation Trigger: When an objective condition defined in Section 6 occurs, entry into the defined QMS process is mandatory.

Stop-Execution Condition: Execution is prohibited when laboratory qualification status, approved scope, method validation status, or traceability to an authorized test request cannot be verified.

6. Acceptance Criteria

Attribute	Compliant State	Nonconforming State	Invalid State	Escalation Trigger	Required QMS Process Entry	QU Authorization Required?
Laboratory Qualification Status	Active on ASL; approved scope includes analyte and method	Analytical result fails approved specification using qualified laboratory	ASL inactive; laboratory suspended; or scope does not include analyte or method	When ASL status is inactive or scope mismatch is identified	Deviation	Yes
Method Validation / Verification	Documented validation or verification supports intended use	OOS result using validated method	No documented validation or verification for intended use	When validation or verification evidence is absent	Deviation	Yes
Report Completeness & Traceability	Report includes result, units, specification reference, analyst identification, test date, lot/sample identifier, and authorized test request reference	OOS result with complete and traceable report	Missing required report element or missing linkage to authorized test request	When required report element or traceability reference is missing	Deviation	No
Adverse Trend Threshold	No confirmed adverse trend within rolling 12-month period	Two confirmed OOS results within rolling 12 months for same analyte or laboratory	Trend monitoring not performed or undocumented	When two confirmed OOS results occur within rolling 12 months	CAPA	Yes
Data Integrity Status	No evidence of alteration, falsification, unexplained discrepancy, or manipulation	Unresolved discrepancy without confirmed falsification	Confirmed falsification, manipulation, or intentional misrepresentation	When falsification or intentional misrepresentation is confirmed	Quality Defect	Yes

7. Decision Logic Matrix

Trigger Condition	Execution May Continue?	Required Action	QMS Process Entry	Workflow (W)?	QU Authorization (A)?	Required Record
Compliant State	Yes	Record and proceed under defined QC evaluation controls	None	No	No	Approved Laboratory Report
Nonconforming State (OOS)	No	Execution is prohibited. Enter Deviation workflow.	Deviation	Yes	Yes	Deviation Record
Invalid State	No	Execution is prohibited. Reject data. Enter Deviation workflow.	Deviation	Yes	Yes	Deviation Record
Systemic / Repeated Failure	No	Execution is prohibited. Enter CAPA workflow.	CAPA	Yes	Yes	CAPA Record

8. Exception Handling

When analytical result exceeds an approved specification, Deviation entry is mandatory.
When laboratory qualification lapse or scope mismatch is identified, Deviation entry is mandatory.
When two confirmed OOS results occur within a rolling 12-month period, CAPA entry is mandatory.
When falsification or intentional misrepresentation is confirmed, Quality Defect entry is mandatory.
When laboratory scope, ownership, accreditation status, or validated method changes, Change Control entry is mandatory prior to continued use.

10. Authority Classification (E / W / A)

E — Execution: Personnel verify laboratory qualification, method validation status, report completeness, traceability, and result compliance against predefined criteria. Execution does not confer product disposition authority.

W — Workflow Entry: When defined trigger conditions are met, entry into Deviation, CAPA, Quality Defect, or Change Control workflow is mandatory.

A — Authorization: QU authorization is required for final lot disposition, supplier disqualification, CAPA closure, reassessment of previously released lots, reinstatement of laboratory qualification, and approval of laboratory re-engagement following suspension.

11. Control State Definitions

Compliant State: Meets all defined acceptance criteria.

Nonconforming State: Approved specification not met.

Invalid State: Record incomplete, required authorization missing, laboratory unqualified, or control parameter undefined.

Escalation Trigger: Objective condition requiring mandatory QMS entry.

Stop-Execution Condition: Execution is prohibited until resolved under QMS governance and QU oversight.

1. Document Control