Document Control (Metadata)

Table of Contents

• Section 0 - Quality Unit Authority & Governance Inheritance
• Section 1 - Family Summary
• Section 2 - Purpose, Scope & Regulatory Anchors
• Section 3 - General Training Requirements
• Section 4 - Roles & Governance Responsibilities
• Section 5 - Required AAs & Traceability Matrix
• Section 6 - AA Deliverable Requirements
• Section 7 - WIN Layer (High-Level Execution & Control Enforcement)
• Section 8 - Governance Inheritance

Quality Unit Authority, QC Control Framework, & QMS Governance Inheritance

This Family Pack operates under the authority and governance of the Sawgrass Nutra Labs Quality Management System (QMS) and the Quality Unit (QU).

In accordance with 21 CFR Part 111, the Quality Unit (QU) retains final, non-delegable authority for all quality-impacting decisions, including but not limited to:

• Approval or rejection of components, in-process materials, labels, and finished products
• Final authorization of disposition (release, rejection, hold, rework, reprocessing, destruction)
• Approval of deviations/quality events, investigations, and CAPA
• Approval of changes that may impact product quality, specifications, or compliance status
• Final quality-impacting escalations, including stop-work when warranted

Quality Control (QC) represents the Control Framework established under Quality Unit authority (e.g., specifications, acceptance criteria, sampling/testing requirements, and release rules). QC is not an organizational role within this Family Pack unless explicitly defined as such in the enterprise governance model.

Quality Assurance (QA) administers QMS processes and executes QU-governed quality system activities through approved procedures, work instructions, and records under delegated authority. QA provides independent oversight of GMP operations; QA does not execute GMP operations.

Operational teams execute GMP activities defined by this Family Pack and generate GMP evidence. Deviations, excursions, nonconformances, and quality risks identified during execution are escalated through the standardized QA-owned escalation pathway (e.g., WIN-QA-EXCEPTION-ESCALATION).

All SOPs, WINs, and supporting documents contained within this Family Pack:

• Inherit QMS governance and Quality Unit authority
• Shall not redefine, override, or dilute Quality Unit decision rights
• Shall preserve required QA/QU review, approval, and escalation points
• Shall execute QC-defined acceptance criteria and release rules as governed under QU authority

In the event of any conflict between execution instructions and Quality Unit authority, Quality Unit authority prevails in accordance with QMS governance rules.

Section 1 - Family Summary

This Family inherits the governance requirements defined in the Unified Governance Manual (SOP-QMS-GOV), including the Quality Manual, Risk Management Program (RMP), Internal Audit Program (IAP), and Material Review Board (MRB) governance (SOP-QA-MRB). All PROC responsibilities and WINs must align with these L2 authorities.

The Procurement (PROC) Process Family governs the controlled sourcing, qualification, evaluation, and ongoing oversight of suppliers providing components, ingredients, packaging, labels, and GMP-impacting services. PROC ensures that all purchased materials originate from qualified, approved, and verified suppliers and that procured materials meet GMP, regulatory, and internal specifications.

Outsourced Manufacturing & GMP-Impacting Service Provider Oversight: Procurement governance applies to suppliers that provide GMP-impacting services, including contract manufacturers, contract laboratories, packaging/labeling service providers, and other outsourced providers that may affect product quality, identity, purity, strength, composition, or regulatory compliance.

Such providers shall be treated as qualified suppliers and must meet the same governance expectations defined by this Family Pack, including:

• Inclusion on the Approved Supplier List (ASL) with defined scope-of-approval (service, site, and intended use)
• Completion of required risk-based qualification and approval prior to use
• Presence and current status of required Quality Agreements (or equivalent governed control) where applicable
• Ongoing monitoring and requalification based on risk and performance signals
• Escalation of provider changes (site/process/specification/supply-condition) through controlled change pathways (QC-CHG-002) prior to implementation

PROC provides WHAT-level governance for:

• Supplier qualification and approval
• Approved Supplier List (ASL) creation and maintenance
• Sourcing and purchasing controls
• Supplier documentation management (questionnaires, certifications, COAs)
• Verification of material specifications
• Ongoing supplier monitoring and requalification

Supplier Risk Classification and Tier Alignment:

Supplier risk classification outputs generated through qualification and ongoing performance monitoring shall be used as controlled inputs to Quality Unit (QU) supplier tier assignment under QC-MAT-003.

Supplier tier classification is not determined by risk level alone and shall reflect overall supplier reliability considering risk classification, performance history, verification status, and quality signals.

Final supplier tier assignment, modification, or reclassification remains under exclusive Quality Unit authority and shall be documented and controlled in accordance with QC-MAT-003.

Procurement is critical because 21 CFR 111 requires manufacturers to:

• Establish specifications for components (§111.70)
• Verify suppliers and materials meet those specifications (§111.75)
• Receive materials only from qualified suppliers (§111.123)

NSF/ANSI 455-2 strengthens these requirements by mandating:

• Risk-based supplier evaluations
• Documentation controls for supplier records
• Verification of COAs and supporting test data
• Monitoring of supplier performance and trends
• Oversight of contract manufacturers and service providers

Key PROC risk themes include:

• Unqualified or unverified suppliers
• Incomplete or inaccurate supplier documentation
• Fraudulent or unverifiable COAs
• Inadequate material testing verification
• Lack of supply-chain traceability
• Failure to detect supplier nonconformance trends
• Inconsistent purchasing practices

PROC requires strong cross-functional interaction with:

• Quality Assurance (QA): Supplier approval, risk review, COA verification
• Laboratory Operations (QC function under QU): Material identity testing and verification
• Warehouse (WH): Receipt, quarantine, rejection, and traceability
• Production (PROD): Material requirements and availability planning
• Finance: Purchase authorization, vendor controls
• Regulatory: Ingredient compliance & claim verification

Risk Tier Classification: HIGH. Procurement is classified as HIGH risk because supplier failures can directly lead to adulterated materials, misidentified components, contaminated ingredients, specification failures, and systemic supply-chain noncompliance. As the entry point for all components and materials, PROC plays a foundational role in GMP compliance, product quality, and material integrity.

Section 2 - Purpose, Scope & Regulatory and QC Anchors

The following table includes all Procurement (PROC) SOPs from the frozen L2 hierarchy. Each SOP is mapped to its WHAT-level purpose, operational scope, applicable regulatory anchors, and Quality Control (QC) requirement anchors that are enabled or supported by Procurement activities. Procurement operates as a QC-Enabling domain and does not perform QC testing, acceptance, release, or disposition activities.

Procurement (PROC) operates as a QC-Enabling domain. QC requirement anchors listed in this section identify where Procurement activities provide prerequisite controls, inputs, or documentation required for Quality Control decision-making. Procurement does not execute QC testing, acceptance, release, or disposition decisions, which remain governed by Quality-owned procedures.

Section 3 - General Training Requirements

The following WHAT-level training requirements apply to all personnel who work within or support the Procurement (PROC) Process Family. Training expectations are grouped by governing SOP to improve clarity, traceability, and audit alignment. These requirements establish foundational GMP behaviors and do not include HOW-level task instructions or Work Instructions.

SOP-PROC-SOURCE — Sourcing

• Personnel must understand the importance of sourcing materials and services only from suppliers capable of meeting GMP, safety, and regulatory requirements.
• Personnel must understand how preliminary supplier evaluation and risk screening impact downstream qualification and purchasing decisions.
• Personnel must understand the requirement to use current, approved supplier information when evaluating sourcing options.
• Personnel must be trained to recognize incomplete or insufficient supplier information and escalate prior to proceeding.

SOP-PROC-QUAL — Supplier Qualification

• Personnel must understand how supplier qualification activities verify supplier capability, compliance, and material quality.
• Personnel must understand how supplier risk level influences qualification depth, approval status, and monitoring expectations.
• Personnel must be able to identify when supplier issues, complaints, or nonconformances require QA involvement.
• Personnel must understand requirements for ongoing qualification, re-evaluation, and potential disqualification.

SOP-PROC-ASL — Approved Supplier List

• Personnel must understand the purpose and control of the Approved Supplier List (ASL).
• Personnel must understand that only suppliers listed on the ASL may be used for GMP-related materials and services.
• Personnel must understand the requirement to verify supplier status prior to purchasing activity.
• Personnel must understand how supplier status changes are controlled, documented, and reviewed.

SOP-PROC-P2P — Procure to Pay

• Personnel must understand that purchase orders may only be issued to approved suppliers for approved materials or services.
• Personnel must understand the requirement to verify material specifications prior to purchase authorization.
• Personnel must understand documentation and traceability requirements associated with purchasing decisions.
• Personnel must understand when purchasing activities must be paused or escalated due to compliance concerns.

SOP-PROC-DOCS — Supplier Documentation

• Personnel must understand the importance of accurate, complete, and authentic supplier documentation.
• Personnel must understand how COAs, certifications, specifications, and questionnaires support GMP compliance.
• Personnel must be trained to identify missing, expired, or inconsistent supplier documentation and escalate appropriately.
• Personnel must understand requirements for confidentiality, retention, and periodic review of supplier records.

Cross-SOP Foundational GMP Expectations

• Personnel must complete initial qualification training prior to performing controlled Procurement activities, and must complete periodic refresher training (at least annually or per QMS-defined risk-based cadence), and retraining when controlled requirements, systems, or procedures affecting their responsibilities change.
• Personnel must understand ALCOA+ principles and apply them to all Procurement records and documentation.
• Personnel must understand that only approved systems, forms, and controlled documents may be used.
• Personnel must understand how Procurement activities interface with QA, QC, Warehouse, Finance, and Production.
• Personnel must understand that Procurement activities must not bypass or replace defined Quality responsibilities.
• Personnel must understand how to escalate supplier risks, documentation issues, or compliance concerns.

Section 4 – Roles & Governance Responsibilities

This section defines organizational roles that perform, supervise, review, trend, escalate, or own any Procurement (PROC) Family obligations, and the assigned governance responsibilities for each role. This section is intentionally WHAT-level and contains no procedural HOW, SOP, or WIN steps.

A Role represents a defined structural position within the enterprise governance architecture (Authority, System Administration, Operational Execution, Cross-Functional Governance, or Support). Responsibilities define outcome-based accountabilities and do not confer authority beyond that defined by the Quality Unit.

Architectural Clarification: Quality Control (QC) represents the Control Framework — acceptance criteria, specifications, and release rules — established under Quality Unit authority. QC is not an organizational role.

Terminology Note: Where this Family Pack references “Laboratory Operations” or “QC function,” it refers to the operational laboratory capability performing testing and verification activities under Quality Unit (QU) authority and QC-defined requirements. This does not alter the governance model that QC represents the control framework and QU retains final decision authority.

Section 5 — Required AAs & Traceability Matrix

Quality Event Escalation (Cross-Domain Governance)

All Auditable Artifacts (AAs) defined in this section leverage a common, Quality Assurance (QA)–owned Quality Event escalation process. Deviations, excursions, or failures to meet defined acceptance criteria are identified within the executing domain and escalated using WIN-QA-EXCEPTION-ESCALATION.

This standardized escalation mechanism is applied consistently across Warehouse, Quality Control (QC), Manufacturing, and other GMP domains to ensure independent QA oversight, uniform investigation, and controlled disposition in accordance with Quality Assurance procedures.

Domain-specific SOPs and Work Instructions (WINs) define exception identification triggers only and do not establish independent escalation, investigation, or disposition pathways.

Section 6 — AA Deliverable Requirements

This section defines the minimum required content and evidentiary intent for each Auditable Artifact (AA) listed in Section 5. These requirements establish WHAT must be captured to demonstrate effective control of Procurement (PROC) activities.

The AA set is intentionally risk-based, consolidated, and sufficient. Each AA represents the authoritative GMP evidence for its associated procurement control domain. No additional PROC-specific records are required beyond those defined in Section 5.

Individual executions are distinguished through operational metadata (e.g., date, supplier, material, transaction ID, system user), not through creation of additional forms or document variants.

QC Enforcement Alignment: Where Procurement execution intersects with QC-defined trigger conditions (e.g., supplier invalid state, Tier restriction, change trigger, missing QU approval), the associated AA must contain objective evidence that the required QMS workflow entry (e.g., Deviation, Change Control, or QA exception pathway) was initiated prior to continuation of implementation or purchasing. Absence of required escalation linkage renders the execution record incomplete.

AA-PROC-SOURCE-VERIFY — Sourcing Verification

This artifact provides evidence that sourcing decisions are risk-based, documented, and approved prior to supplier qualification or purchasing, and that sourcing-related changes are identified and escalated to enable required Quality impact and risk assessment prior to implementation.

Minimum evidentiary expectations include:

• Identification of proposed supplier and the material/service in scope
• Intended use and GMP relevance (what product/process the supplier will support)
• Sourcing rationale (why this supplier is being considered)
• Preliminary supplier capability/compliance screening results (risk signals noted)
• Defined sourcing risk assessment outcome (risk level + rationale)
• Verification of current ASL status (if already listed) OR defined qualification pathway to be used
• Determination of whether the sourcing activity constitutes a change trigger requiring escalation (e.g., new supplier/material vs. supplier/site/specification/supply-condition change)
• Defined change-trigger evaluation outcome (Yes/No) with rationale when applicable
• When change trigger = Yes: linkage to escalation and/or Change Control reference prior to implementation (e.g., QA review reference or Change Control ID as applicable)
• Quality review and approval of the sourcing decision (who/when)

Auditor focus: confirmation that suppliers are not engaged or advanced without documented, risk-based sourcing approval, and that sourcing-related changes are identified and escalated prior to implementation to enable appropriate impact and risk assessment.

QC-REQ Anchor: QC-CHG-002

AA-PROC-QUAL-APPROVE — Supplier Qualification Approval

This artifact provides evidence that supplier qualification requirements are fulfilled and formally approved prior to supplier use.

Minimum evidentiary expectations include:

• Supplier identity and scope of qualification
• Qualification type recorded as Initial or Requalification
• Requalification basis when applicable (e.g., periodic due, performance trigger, change trigger, audit finding), including next review due date or review cadence category
• Assigned supplier risk level
• Completed qualification activities (documentation, audit, verification)
• Identification of approval limitations or conditions
• QA review for completeness and authorization under delegated authority; obtain QU/QCO approval where required by Quality governance for non-delegable decisions
• Clear recording of supplier status outcome and any restrictions/conditions intended to be reflected in the Approved Supplier List (ASL)

Auditor focus: ability to reconstruct why a supplier is approved, restricted, or disqualified based on documented evidence.

QC-REQ Anchor: QC-MAT-003 (enabling)

AA-PROC-ASL-MAINTAIN — Approved Supplier List Maintenance

This artifact provides continuous evidence that the Approved Supplier List (ASL) is accurately maintained, controlled, and traceable, and that supplier qualification status is current and suitable to constrain purchasing decisions.

Minimum evidentiary expectations include:

• Supplier additions, removals, and status changes
• Effective dates for ASL changes
• Associated risk level and approved materials or services
• Authorization and approval of ASL updates
• Traceability to qualification or performance drivers
• Defined supplier status category recorded in a standardized form (e.g., Approved / Conditional / Restricted / Disqualified, or equivalent)
• Scope-of-approval and/or intended-use applicability where relevant (e.g., approved materials/services, sites, or other approval boundaries)
• Rationale for restrictions/conditions and reference to the approving authority
• Where applicable, linkage of supplier status changes to controlled change evaluation and/or Change Control reference prior to implementation

Auditor focus: confirmation that only qualified suppliers are authorized, that supplier status categories are clearly defined and controlled, and that ASL changes are justified, approved, and traceable (including to change evaluation where applicable).

QC-REQ Anchor: QC-MAT-003, QC-CHG-002

AA-PROC-P2P-AUTHORIZE — Procure-to-Pay Authorization

This artifact provides evidence that purchasing transactions are executed only with approved suppliers and for approved materials or services, and that supplier qualification status is verified at the time of transaction authorization.

Minimum evidentiary expectations include:

• Purchase order or transaction reference
• Supplier identity (name and unique supplier/vendor ID where applicable)
• Supplier ASL status at time of authorization, including confirmation the supplier is approved for the intended use (or equivalent scope-of-approval control)
• Status gating outcome recorded as one of:
  • Approved (authorized to proceed), or
  • Blocked (non-approved/restricted supplier), or
  • Exception Used (QA-authorized exception record reference required)
• When an exception is used: reference to the QA-authorized exception record ID (or equivalent escalation/authorization ID) and the documented authorization outcome
• Confirmation of approved material/service specifications applicable to the purchase
• Authorization of purchasing activity (who/when in the system of record)
• Traceability to downstream receipt or financial records (as applicable)

Auditor focus: verification that purchasing does not bypass supplier qualification, ASL status controls, or specification controls, and that supplier status effectively constrains purchasing decisions.

QC-REQ Anchor: QC-MAT-003

AA-PROC-DOCS-VERIFY — Supplier Documentation Verification

This artifact provides evidence that required supplier documentation is current, complete, reviewed, approved, and that documentation changes are evaluated as potential change triggers requiring escalation where quality impact may exist.

Minimum evidentiary expectations include:

• Identification of required supplier documents (e.g., COAs, certifications, quality agreements, specifications, questionnaires)
• Verification of document completeness, validity (effective/expiry), and authenticity
• Alignment confirmation to approved specifications / intended use requirements
• QA review for completeness and approval of documentation under delegated authority; QU/QCO approval is required where governance defines non-delegable Quality Unit decision rights.
• Identification and resolution of documentation gaps (missing, expired, inconsistent, unverifiable)
• Identification of whether the activity is a periodic review or a change-driven review, including capture of the change trigger source (e.g., revised certificate, updated quality agreement, regulatory status change, supplier notification)
• Change trigger classification using a standardized category (e.g., Supplier Documentation Change, Site Change Indication, Specification Change Indication, Supply-Condition Change Indication, Other) with rationale
• Defined change-trigger evaluation outcome (Yes/No) with rationale when applicable
• When change trigger = Yes: documented linkage to required escalation and/or Change Control prior to continued implementation, including:
  • Change Control ID (required)
  • Risk assessment record reference/location (required)
  • Approval status/reference showing required Quality review/acceptability decision prior to continued implementation (as applicable)
• QC-CHG-002 element evidence (as applicable) documented or linked within the record:
  • Impact areas assessed (product quality, regulatory commitments, data integrity, consumer safety)
  • Risk evaluation outcome (risk level + rationale)
  • Mitigation required? (Yes/No) and defined actions when applicable
  • Scope determination outcome (verification/validation/monitoring/controls) when applicable
• Documentation acceptance basis (Accept / Reject / Escalate): For each required supplier document set (including COAs where applicable), record a clear outcome as Accepted for use, Rejected, or Escalated.
  • Accepted for use requires documented verification that the document set is complete, current (effective/expiry), authentic/traceable to the supplier, and aligned to the approved specification and intended use.
  • Rejected requires documentation of the deficiency (e.g., missing/expired/inconsistent/unverifiable) and confirmation that the supplier/material is not advanced for GMP use based on the deficient documentation.
  • Escalated requires linkage to the QA-owned exception pathway (e.g., WIN-QA-EXCEPTION-ESCALATION) and/or Change Control ID where applicable, prior to continued implementation or continued supplier use.
• COA authenticity & reliability checks (when COAs are used as supporting evidence): Record evidence that the COA is attributable to the correct supplier/site and lot/batch, and that the COA is suitable for the intended use per the approved supplier qualification status and QC-defined requirements. Where the QMS requires periodic confirmation or verification of supplier-provided results, record the reference to the applicable verification evidence (e.g., laboratory confirmation record ID or program reference), or the escalation/exception record when verification is not available.

Auditor focus: confirmation that material quality and compliance are supported by controlled and reviewed supplier documentation, and that supplier documentation changes are evaluated and escalated when they may impact quality.

QC-REQ Anchor: QC-CHG-002 (supporting)

Section 7 — WIN Layer (Structured Execution & Control Enforcement)

This section defines the structured execution framework for Procurement (PROC). Execution of all WINs shall be performed under Procurement supervisory oversight, documented contemporaneously within the applicable Auditable Artifact (AA), and maintained within the approved controlled System of Record in accordance with ALCOA+ principles and enterprise documentation governance requirements.

Each WIN establishes:

• Trigger Event — When execution activates
• Preconditions — Required conditions prior to execution
• Execution Controls — High-level control sequence aligned to QC requirements
• Mandatory Evidence — Required Auditable Artifact (AA)
• Escalation Pathway — Required QA workflow entry when trigger conditions occur
• Authority Gate — Conditions that prohibit continuation without QA/QU direction

Procurement operates as a QC-Enabling domain. Execution of procurement controls does not confer supplier approval, change authorization, or material release authority. When defined QC trigger conditions are met, entry into the applicable QA-governed QMS workflow (e.g., Change Control, Deviation) is mandatory prior to continuation. Final quality decisions remain under Quality Unit (QU) authority.

WIN-PROC-SOURCE-VERIFY

Trigger Event: Identification of a new supplier, material, service, or sourcing change.

Preconditions:

• Defined material/service scope and intended use
• Preliminary GMP relevance assessment completed

Execution Controls:

• Perform and document sourcing risk screening.
• Verify ASL status or define qualification pathway.
• Assess for change triggers (supplier/site/specification/supply condition).
• Enter Change Control per QC-CHG-002 when required.
• Obtain required Quality review prior to implementation.

Mandatory Evidence:

• AA-PROC-SOURCE-REC
• Change Control ID (when applicable)

Escalation Pathway:

• Supplier invalid state, Tier restriction, or change trigger → QA Change Control workflow

Authority Gate:

• Sourcing shall not proceed without defined qualification pathway and required QU/QA authorization where applicable.

Control Outcome: Only risk-evaluated and Quality-reviewed sourcing decisions proceed to qualification or purchasing.

WIN-PROC-QUAL-APPROVE

Trigger Event: Initiation or periodic review of supplier qualification.

Preconditions:

• Required supplier documentation collected
• Risk classification framework available

Execution Controls:

• Review supplier qualification documentation.
• Assign and document supplier risk tier.
• Define approval limitations or conditions.
• Route for required QA/QU authorization.

Mandatory Evidence:

• AA-PROC-QUAL-REC
• Documented QU approval record

Escalation Pathway:

• Incomplete qualification package or adverse findings → QA escalation workflow

Authority Gate:

• Suppliers lacking documented QU approval or required periodic review shall be considered in an invalid state and ineligible for GMP purchasing.

Control Outcome: Supplier qualification status is risk-based, documented, and authorized prior to use.

WIN-PROC-ASL-MAINTAIN

Trigger Event: Approved qualification outcome, status change, or periodic review update.

Preconditions:

• Documented qualification or status decision

Execution Controls:

• Add, update, or remove supplier records in ASL.
• Maintain scope-of-approval and status category.
• Link ASL changes to Change Control where required.

Mandatory Evidence:

• AA-PROC-ASL-UPDATE-LOG

Escalation Pathway:

• Unapproved status modification or undocumented change → QA escalation

Authority Gate:

• Suppliers lacking current approval status shall not be eligible for GMP purchasing.

Control Outcome: ASL remains accurate, current, and authoritative for enforcing purchasing constraints.

WIN-PROC-P2P-AUTHORIZE

Trigger Event: Initiation of procure-to-pay transaction.

Preconditions:

• Supplier present on ASL
• Material/service specification approved

Execution Controls:

• Verify supplier approval for intended use.
• Confirm no invalid-state conditions exist.
• Authorize purchasing transaction in system of record.

Mandatory Evidence:

• System transaction record

Escalation Pathway:

• Disqualified supplier, restricted tier, missing approval, or change trigger → QA workflow entry required prior to execution

Authority Gate:

• Purchasing shall not proceed unless supplier is approved for intended use or a QA-authorized exception exists.

Control Outcome: Purchasing is constrained by approved supplier status and Quality authorization.

WIN-PROC-DOCS-VERIFY

Trigger Event: Receipt, update, or periodic review of supplier documentation.

Preconditions:

• Required documentation matrix defined by supplier risk tier

Execution Controls:

• Verify documentation completeness and validity.
• Confirm alignment to approved specifications.
• Evaluate documentation changes for change-trigger conditions.
• Enter Change Control when required under QC-CHG-002.

Mandatory Evidence:

• AA-PROC-DOC-VERIFY-LOG
• Change Control ID when applicable

Escalation Pathway:

• Expired, missing, unverifiable, or change-trigger documentation → QA workflow entry required

Authority Gate:

• Supplier use shall not continue when required documentation or approvals are absent.

Control Outcome: Supplier documentation supports regulatory compliance and change impact is escalated prior to continued implementation.

Section 8 - Governance Inheritance

This Family Pack inherits all enterprise-level governance defined in the L0 Unified Governance Document (L0-QMS-UGD), which serves as the authoritative source for quality management, documentation control, data integrity, electronic systems governance, and enterprise-wide control architecture.

All SOPs, WINs, and Auditable Artifacts (AAs) within this Family shall be created, maintained, executed, and periodically reviewed in full alignment with L0 governance requirements, including:

• Enterprise documentation control, change control, and record-lifecycle governance
• ALCOA+ data integrity principles governing all GMP data
• 21 CFR Part 11 electronic records and electronic signature requirements, including periodic review and re-validation of electronic systems to ensure continued compliance, access control integrity, and data reliability
• Defined role-based authorization, qualification, and oversight requirements
• System-of-Record expectations for creation, retention, protection, and retrieval of evidence
• Enterprise escalation pathways administered under QA governance
• Risk-tier classification and governance inheritance rules

Quality Unit Authority

The Quality Unit (QU) retains final, non-delegable authority over quality-related decisions affecting compliance, authorization, system controls, and escalation pathways.

• Approval of quality system standards and control frameworks
• Authorization of independent GMP-impacting activities
• Suspension or restriction of activities when compliance risk exists
• Approval and oversight of electronic systems impacting GMP records
• Escalation and disposition of systemic control failures

Governance Supremacy Clause

L0 governance requirements apply uniformly and supersede all Family-level content. This Family Pack does not replace, dilute, or modify enterprise governance and operates fully within the enterprise-wide QMS architecture.