Unified Governance Manual
(Quality Manual + Risk Management Program + Internal Audit Program + Management Review)

Executive Summary

This Unified Governance Manual establishes the integrated Quality Management System (QMS) governance for Sawgrass Nutra Labs. It consolidates three foundational compliance programs into a single authoritative L2 governance document:

Together, these components form a unified governance framework aligned with 21 CFR 111, 21 CFR 11, and NSF/ANSI 455-2, ensuring consistent, auditable, and compliant execution across all Process Families.

Quality Policy

Quality at Sawgrass Nutra Labs is a non-negotiable commitment. Executive leadership affirms that all products must be safe, compliant, and manufactured in accordance with applicable regulations and customer expectations. The Quality Unit (QU) maintains independent authority over batch release, deviations, CAPA, change control, and document governance. This policy is reviewed at least annually during Management Review.

All personnel must complete role-specific annual GMP refresher training that includes updates to procedures, QMS changes, data integrity requirements, and applicable regulatory expectations. Refresher training is required in addition to initial qualification.

Document Metadata

Document ID SOP-QMS-GOV
Version 01
Effective Date ________________
Approved By (Executive) ________________
Approved By (Head of QA / QU) ________________
Document Level L2 — SOP

Master Table of Contents

  1. Executive Summary
  2. Quality Policy
  3. Document Metadata
  4. Master Table of Contents
  5. Quality Manual
    1. Process Family Architecture (L1)
    2. Systems of Record (SoR)
    3. Data Integrity & Part 11
    4. Auditable Artifact (AA) Governance
    5. Change Control
    6. Document Lifecycle & Revision Control
    7. Management Review
  6. Risk Management Program (RMP)
    1. Risk Methodology
    2. Hazard Analysis
    3. Critical Control Points (CCPs)
    4. Risk Register Requirements
    5. Integration With Other QMS Systems
    6. Annual Risk Review
  7. Internal Audit Program (IAP)
    1. Audit Scope
    2. Auditor Qualification
    3. Annual Audit Plan (Risk-Based)
    4. Audit Execution
    5. Audit Reporting & CAPA Verification
    6. Annual Audit Summary
  8. Management Review (MR) — QMS Governance Overview

    1. Purpose
    2. Scope
    3. Frequency
    4. Required Inputs
    5. Required Outputs
    6. Responsibilities
    7. Meeting Execution
    8. Documentation Requirements
    9. Escalation
    10. Record Retention
  9. Roles & Responsibilities (WHO Matrix)
  10. Required Records (L4 Evidence)
  11. SOP-QA-MRB — Material Review Board (MRB) Governance
  12. Change Control Requirements
  13. Revision History

Quality Manual

Sawgrass Nutra Labs – Unified Quality Management System (QMS) Manual

The Quality Manual serves as the constitutional map of the Sawgrass Nutra Labs Quality Management System (QMS). It defines what the QMS is, who owns it, how it is structured, and why each element exists. The Quality Manual does not function as a governance or procedure document. Instead, it provides the high-level framework that connects people, processes, systems, and responsibilities across the organization. The QM is not for rules—it is for architecture. It describes: • High-level structure of the QMS • Cross-functional and Quality Unit responsibilities • System architecture and how QMS subsystems interact • WHAT each subsystem is intended to do • HOW the QMS is organized at the enterprise level • The auditable framework that shows how compliance is achieved All detailed governance, regulatory requirements, and non-delegable Quality Unit (QU) authorities are defined in the Level-0 Unified Governance Document (L0). The QM aligns to and inherits from the L0, while Level-2/3 SOPs define operational HOW activities and Level-4 records provide proof of execution. In this hierarchy, the Quality Manual establishes the structure, clarity, and responsibility model of the QMS—while the L0 governs enterprise rules and SOPs govern execution.

Process Family Architecture (L1)

Sawgrass Nutra Labs may utilize contract manufacturers, contract packagers, external testing laboratories, and GMP-relevant service providers to support manufacturing and quality operations. When outsourced activities occur, they are integrated into the Sawgrass QMS as extensions of the relevant Process Families rather than separate or standalone systems. The Quality Unit (QU) retains final authority for qualification, monitoring, and review of outsourced partners. Oversight expectations—including Quality Agreements, documentation requirements, and compliance obligations—are defined in L0 Section 36 — Outsourced Manufacturing & Contract Partner Governance. The Quality Manual summarizes this as part of the QMS structure but does not provide governance detail. Process Families remain responsible for ensuring that outsourced activities follow the same quality, data integrity, documentation, and traceability requirements as internal operations. External partners are therefore treated as controlled extensions of the Sawgrass QMS, with responsibilities mapped according to the WHAT-level architecture defined in this section.

All outsourced manufacturing, testing partners, and contract service providers must operate under GMP controls equivalent to internal standards. Oversight of contract manufacturers is governed by the enterprise requirements defined in L0 Section 25 — Contract Manufacturer Governance. This Quality Manual provides high-level expectations; governance rules reside in L0.

Family Abbreviation Table

Family Abbreviation Family Name SOP Prefix
SALESCommercial & Customer ManagementSOP-SALES-XXX
PROCProcurementSOP-PROC-XXX
WHWarehouse ManagementSOP-WH-XXX
MHMaterial HandlingSOP-MH-XXX
PRODProductionSOP-PROD-XXX
PKGPackagingSOP-PKG-XXX
SANSanitationSOP-SAN-XXX
MAINTMaintenanceSOP-MAINT-XXX
QCLQuality Control LaboratorySOP-QCL-XXX / SOP-QCP-XXX
QCPQuality Control ProductionSOP-QCP-XXX
QAQuality AssuranceSOP-QA-XXX
TALTalent ManagementSOP-TAL-XXX
ITInformation TechnologySOP-IT-XXX
EHSEnvironmental Health & SafetySOP-EHS-XXX

Process Family List

  • SALES – Commercial & Customer Management
  • PROC – Procurement
  • WH – Warehouse Management
  • MH – Material Handling
  • PROD – Production
  • PKG – Packaging
  • SAN – Sanitation
  • MAINT – Maintenance
  • QCL – Quality Control Laboratory
  • QCP – Quality Control Production
  • QA – Quality Assurance
  • TAL – Talent Management
  • IT – Information Technology
  • EHS – Environmental Health & Safety

Systems of Record (SoR)

  • Wherefour – BPR, inventory, traceability
  • Navigator – Document control, e-signature governance
  • Jira – Deviations, CAPA, Change Control
  • TalentLMS – Training records
  • FTIR – Raw material identity confirmation
  • Neogen ATP – Sanitation verification

Data Integrity & Part 11

ALCOA+ Requirements

  • Attributable
  • Legible
  • Contemporaneous
  • Original
  • Accurate
  • Complete
  • Consistent
  • Enduring
  • Available

High-level data integrity expectations follow ALCOA+ principles. The governance, validation, periodic review, revalidation triggers, and Part 11 requirements for electronic Systems of Record are defined in L0 Section 7 — Data Integrity Requirements. The Quality Manual provides high-level expectations only.

Auditable Artifact (AA) Governance

All GMP evidence used within the Quality Management System (QMS) shall comply with the enterprise-level requirements defined in L0 Section 16 — Auditable Artifact (AA) Governance. AAs include Checklists, Logs, Templates, and Records, which collectively serve as the objective evidence that GMP activities were executed as required.

The Quality Manual defines the high-level expectations for records and evidence, while L0 Section 16 provides the authoritative definitions, metadata, integrity standards, and system-of-record requirements. These rules are implemented operationally through each Process Family’s Required AAs & Traceability Matrix.

All SOPs (L2), WINs (L3), and FORMs/Records (L4) must align with the WHAT → HOW → PROOF model, where AAs constitute the controlled Level-4 proof of compliance and must adhere to ALCOA+, GDP, and 21 CFR Part 11 requirements.

Change Control

Change Control ensures that modifications to processes, documents, equipment, systems, and materials are evaluated, reviewed, and implemented in a controlled manner. The Quality Manual describes the purpose and role of Change Control within the QMS; all detailed governance requirements—including approval rules, impact assessment, version control, and documentation expectations—are defined in L0 Section 15 and executed through SOP-QA-CC.

Document Lifecycle & Revision Control

Document Lifecycle and Revision Control ensures that all QMS documents are created, maintained, revised, and retired in a controlled manner. The Quality Manual describes the purpose of document control at the architectural level, while all governance requirements—including required metadata, signatures, versioning rules, archival expectations, and System-of-Record controls—are defined in L0 Section 14 and executed through SOP-QA-DC.

Management Review

Inputs include deviations, CAPA, audits, training, supplier performance, and metrics. Outputs include improvements, CAPA assignments, and resource needs.

Risk Management Program (RMP)

The Risk Management Program defines the structured process used to identify, evaluate, control, and monitor risks that may affect product quality, safety, data integrity, regulatory compliance, and manufacturing performance. This program fulfills QMS Rule R2 requirements.

Risk Methodology

Risk assessments at Sawgrass Nutra Labs use either a Failure Modes and Effects Analysis (FMEA) or a qualitative Risk Matrix, depending on complexity and regulatory impact.

Enterprise governance for the Risk Register, risk categorization, and residual risk rules is defined in L0 Sections 18 and 27. This Quality Manual provides high-level methodology only.

Hazard Analysis (Powders & Capsules)

Critical Control Points (CCPs)

Enterprise CCP governance, monitoring requirements, verification, and escalation rules are defined in L0 Section 28. The CCP list below represents typical operational CCPs for powders and capsules.

Risk Register Requirements

The Risk Register is maintained in the designated System-of-Record. All governance requirements for required fields, categorization, ownership, mitigation documentation, residual risk scoring, and review frequency are defined in L0 Section 27. This Quality Manual provides conceptual context only.

Integration With Other QMS Systems

Annual Risk Review

This Quality Manual summarizes the intent of the Annual Risk Review. All governance requirements—including required inputs, methodology, frequency, outputs, and roles—are defined in L0 Section 29.

Internal Audit Program (IAP)

Enterprise-level governance for the Internal Audit Program, including the Annual Audit Plan, Auditor Qualification requirements, standardized checklist controls, audit reporting standards, and Annual Audit Summary expectations, is defined in L0 Section 30.

The Internal Audit Program provides the structured process for verifying compliance with 21 CFR 111, NSF/ANSI 455-2, 21 CFR 11, and all internal QMS requirements. This fulfills QMS Rule R3 requirements for scope, auditor qualification, risk-based audit planning, audit execution, reporting, and CAPA verification.

The Internal Audit Program ensures independent evaluation of QMS performance and compliance across all Process Families. Detailed governance for the audit plan, auditor qualifications, checklist requirements, audit execution, reporting, CAPA verification, and the Annual Audit Summary is defined in L0 Section 30. This Quality Manual provides high-level intent and context only.

Management Review (MR) — Execution Reference

Management Review execution is governed by SOP-QA-MR, which defines procedural requirements including meeting preparation, required inputs, execution, documentation, escalation, and record retention.

This Quality Manual describes Management Review at the system governance level only. All execution, workflows, roles, and records are defined and controlled in the corresponding SOP and associated Level-4 records.

Roles & Responsibilities (WHO Matrix)

Function Quality Manual Responsibilities Risk Management Responsibilities Internal Audit Responsibilities
QA / QU Oversight of QMS, document control, release authority Lead risk assessments, approve mitigations Lead audits, approve reports, verify CAPA
Production (PROD) Execute WINs/SOPs correctly Provide hazard inputs & process risks Support audits with evidence
Warehouse (WH) Material control & traceability Storage & receiving risk controls Support audits
Packaging (PKG) Label control, reconciliation Labeling hazard mitigation Support audits
QCL / QCP Sampling, testing, release data Analytical risk assessment Support audits
Procurement (PROC) Supplier documentation Supplier risk scoring Supplier audits
Sales Customer requirement inputs Complaint data into risk N/A
Maintenance (MAINT) Calibration & PM compliance Equipment risk mitigation Support audits
Sanitation (SAN) Cleaning & EMP execution Environmental hazard controls Support audits
IT System access & Part 11 configuration SoR risk (access, audit trails) Support DI audits

Required Records (L4 Evidence)

The following Level 4 Auditable Artifacts (AAs) and records are required to demonstrate compliance with the Quality Manual, Risk Management Program, and Internal Audit Program:

SOP-QA-MRB — Material Review Board (MRB) Governance

At Sawgrass Nutra Labs, the Material Review Board (MRB) function is performed by the Quality Assurance Steering Committee (QASC). In its MRB role, the QASC provides structured, cross-functional review of nonconforming materials, components, intermediates, labels, and finished products. This ensures that nonconformances are evaluated consistently within the overall QMS architecture and that appropriate Quality Management System pathways are engaged when systemic issues or risks are identified.

The Quality Manual defines the MRB at the architectural level only. All governance requirements—including QASC membership, MRB authorities, disposition rules, required documentation, investigations, trending expectations, and integration with CAPA and Supplier Management—are governed exclusively by L0 Section 32 — MRB Governance and executed operationally through SOP-QA-MRB.

This section is intended solely to describe the role of the MRB within the QMS structure. All operational requirements, workflows, decision criteria, and controlled records associated with MRB activities reside in the L0 Unified Governance Document and the corresponding Level-2 SOP.

Change Control Requirements

All changes to this Governance Manual must follow formal Change Control procedures, including:

Revision History

Version Effective Date Description of Change Approved By
01 ________________ Initial Release – Unified Governance Manual combining QM, RMP, and IAP Executive, Head of QA/QU