Mind the Gap: Key Takeaways from This Year’s Global QA Conference

If one phrase ran through this year’s RQA Global QA Conference, it was the one you hear all day on the London Underground: mind the gap. Nearly every theme came back to it. The gap between what the regulations now expect and what systems, suppliers and sites can actually deliver. The gap between a finding and a genuine fix, between a signed document and the quality it is meant to evidence, between the people doing the work and the people auditing it. Here are the themes that stood out.

ICH E6(R3) is reshaping how oversight works

E6(R3) is now in force across the major regions, and the shift it drives is real. Quality is moving from clinical-operations-led, risk-based monitoring to quality designed across the whole trial, built in from protocol design. Risk-based quality management, agreed Critical-to-Quality factors, data governance across the lifecycle, and oversight that is reviewed and reassessed dynamically are now the expected shape of things, not a one-time sign-off.

The principle repeated all week was that you can delegate the activity but never the responsibility. Sponsors retain accountability for everything a service provider does, including anything that provider subcontracts further. For anyone on the service-provider side of audits, that means client oversight is becoming more structured and more risk-based. The same logic runs down our own supply chains, calling for documented, risk-proportionate selection and ongoing monitoring of suppliers rather than just an approved list.

“Fit for purpose” not just “validated”

This was the single most-repeated idea of the conference. You cannot demand a perfect system, and “Is it validated?” is increasingly the wrong question. The better one is “Is this configured system fit for its intended use, proportionate to the importance of the data it handles, and are the residual risks controlled and documented?”

The sharpest examples came from site EMRs, which were built for patient care rather than regulated research and often cannot meet every expectation. But the principle generalises. Auditors increasingly want to see a system work, pulling an audit trail live, tracing a correction from original entry to current record, confirming access is unique and role-based, rather than hearing that controls exist. The defensible position is not perfection. It is clear, consistent evidence of assessment, decisions and mitigations. That is a useful lens for how we present our own inventory, custody and environmental-monitoring systems to clients.

Validation is getting lighter, on purpose

The computerised-systems track was, collectively, an argument for less paper and better thinking. With FDA’s Computer Software Assurance guidance now final, the direction is explicit: assurance proportionate to risk, “least burdensome”, automated outputs and logs accepted as evidence rather than endless screenshots. A few points are worth carrying into practice:

• • Treat vendor documentation as evidence, not the answer. Leveraging a supplier’s validation means reviewing it, mapping it to your intended use, justifying acceptance and testing only the gaps. It does not mean filing it, rebadging it, or treating a security certification as GxP qualification. Evidence, audit-rights and change-notification expectations belong in contracts before signing.
• • Follow the data, not just the process. A simple one-page data flow is often more useful to an auditor than a large validation pack, and the question that lands is “show me it works in real life,” not “do you have a procedure?” For a storage provider, that flow naturally runs from receipt through storage, monitoring, retrieval, transfer and eventual return or destruction, with the same test at each step. Can it be changed, is the change traceable, is the transfer reconciled?
• • Assurance continues after go-live, through risk-based change control that re-tests only what a change affects.

AI is now an audit subject

If an AI or ML component touches a regulated record, auditors will now expect to see its intended use, the model version behind each record, evidence of human oversight as a genuine control rather than a rubber stamp, and change control over the retraining and updates suppliers can push without telling you. Regulators are already citing this in warning letters. The defence that “the tool did not tell us it was required” was explicitly rejected. Anyone building out AI governance should treat models as part of the system inventory and audit universe, not a separate conversation.

Deviations and CAPAs: the story matters more than the count

Two of the strongest threads were about quality of thinking. The first was to stop over-rewarding low deviation counts and fast closures, because a thin narrative can hide more risk than a thorough one. A good deviation reads like a condensed scientific record. What happened, the chronology, the impact, the rationale for the conclusion, and what was learned. Years later that record is the last witness for an inspector or client. For us, that is exactly the standard a controlled-temperature excursion write-up should meet, capturing not just what occurred but the impact on sample integrity and the evidence behind the conclusion.

The second was that when a finding keeps recurring, it may reflect a failure of change, not of compliance. “Revise the SOP and retrain everyone” is activity, not improvement. Effectiveness checks should ask whether the behaviour actually changed and whether the risk dropped, not simply whether the action closed on time. The reminder that landed hardest came from real regulatory responses. In all three FDA cases examined, the site had SOPs and had submitted a CAPA, and FDA still rejected the response. Test the mechanism that made the failure likely, not just the event in front of you.

A single QMS and “regulatory creep”

One of the most pointed sessions was a panel on whether a single quality system can satisfy every regulatory framework an organisation works under. It was built around a real and growing problem: quality teams are increasingly asked to support activities that do not sit neatly inside one framework, where GLP, GMP, GCP, CLIA and ISO expectations land on the same systems, people and data.

With regulators on the panel, the answer to the central question was a clear no. A single QMS cannot by itself be compliant with every applicable regulation. The frameworks share a common foundation, and a great deal of good quality practice holds regardless of which regulation applies, but they also diverge in ways that one undifferentiated system will not cover. The goal is not to collapse everything into a single set of procedures and assume it satisfies every regime. It is to build on the shared principles while retaining the framework-specific controls each activity genuinely requires.

That means the risk runs in two directions. One is over-compliance, often called regulatory “creep”, where the heaviest requirement of one framework is imported into every process and creates burden that adds no protection. The other is false coverage, assuming a single system satisfies a framework it was never designed to meet. The answer in both cases is risk-based judgement: find the genuine common ground and apply it once and treat the real points of divergence as exactly that rather than papering over them.

Data privacy belongs inside the quality system, not bolted on

Because research data so often carries linked personal, health or genetic information, privacy drew real attention. The argument was that GxP and GDPR share most of their ground, including accountability, risk management, “by design and by default”, and full-lifecycle coverage, so privacy should run through one connected governance framework rather than a separate, duplicating system. In practice that means privacy risks considered in supplier agreements, change control and risk assessments, retention periods defined once against the applicable regulations, and secure disposal with documented evidence of destruction.

GLP modernisation, and the archive in the frame

GLP modernisation got sustained attention, with the Mutual Acceptance of Data system, “conducted once, accepted everywhere”, now being tested by cloud, AI, remote working and global supply chains. An industry survey flagged documents on suppliers, multi-site studies, the sponsor role and archives as most in need of updating. One recurring pain point is directly relevant to any custodian of records and material. Retention requirements differ across countries, which complicates global, multi-site custody, and authorities differ on whether external archives and returned-to-sponsor data sit inside the GLP programme at all. The anchors worth holding onto are the durable ones. A named person responsible for the archive, records and samples safeguarded in their original format for at least the required retention period, and controlled, evidenced disposal at end of life.

E-Archiving is a conversation everyone wants to have

The conference sessions focused heavily on closing the gap between documenting compliance and demonstrating quality. For many of the people we spoke to at our stand, the first step is simpler: knowing exactly where everything is and being able to prove it.

• • Fragmentation is an everyday problem. Again and again, people told us the same thing. To find a single study’s records or samples, they sign into several supplier portals, cross-check a handful of spreadsheets, and hope the versions agree. That is slow on a normal day and stressful before an inspection. It also sits uncomfortably against everything the conference said about oversight. Under E6(R3), Sponsors are accountable for everything their providers do, and it is very hard to oversee what’s scattered.
• • Audit readiness depends on visibility. The shift from “do you have a procedure?” to “show me it works” puts real pressure on any organisation whose answers are spread across multiple systems. When an auditor asks to trace a sample from receipt to its current location, or to confirm who accessed a record and when, the answer should take minutes, not days of reconciling spreadsheets.
• • Space is quietly holding growth back. Several visitors told us that records and materials stored in their own offices are taking up space they need for active work, and in some cases are stopping them from taking on new projects. Storage that was meant to be temporary has become a limit on the business.

E-archiving speaks to all three problems at once: fewer places to look, a clearer audit trail, and less physical material taking up valuable space.

The human side: communication, culture and the value of audits

Finally, several sessions were a reminder that quality is delivered by people. Multicultural and cross-site teams work best with low-context communication. Spell out decisions, confirm who owns each next action, circulate a written recap. That happens to double as a GxP traceability strength. And internal audits land better as a strategic tool than a compliance ritual when the right people are involved early, scope and expectations are aligned up front, and there are no surprises at the closing meeting.

The one-line summary

Across every discipline, the conference converged on the same shift: from documenting compliance to demonstrating quality. Risk-proportionate effort, evidence that something actually works, and the judgement to tell a real improvement from a tidy paper trail. That is the gap worth closing.