The terms everyone uses and nobody defines.

The compiled record showing that a medical device was developed according to its design plan and design controls. It is not a single document but the evidence trail: user needs, design inputs, outputs, reviews, verification and validation. An inspector uses it to test whether the design process actually happened as described.

The set of instructions and specifications for producing a device: drawings, composition, production processes, quality assurance procedures and packaging. Where the DHF shows how the design was arrived at, the DMR shows how the device is made.

The production record for a specific batch or unit, demonstrating that it was manufactured in accordance with the DMR. DHF is design, DMR is the recipe, DHR is what actually happened on the day.

Installation, Operational and Performance Qualification. Three stages of proving equipment or a system is fit for use: that it is installed as specified, that it operates as intended across its range, and that it performs consistently under real conditions with real materials.

Documented evidence that a computerised system does what it is specified to do, consistently, and that the evidence is traceable from each requirement to the test that proves it. The traceability is the part most often missing.

The US FDA regulation covering electronic records and electronic signatures in regulated environments. In practice it means audit trails that cannot be disabled, controlled electronic signatures, no shared accounts, and records that remain readable for their retention period.

Good Automated Manufacturing Practice, whose second edition was published by ISPE in 2022. It is guidance rather than regulation, and its organising idea is critical thinking: scale the testing and the paperwork to what the system actually does to patient safety, product quality and data integrity, and use supplier evidence instead of repeating work the supplier has already done. Teams that apply it well validate less and prove more.

The FDA approach set out in draft guidance for production and quality system software. It does not replace validation; it changes where the effort goes. Low-risk features are covered by unscripted and exploratory testing with lighter records, while high-risk features keep full scripted testing. The saving comes from writing fewer protocols, not from testing less where it matters.

Annex 11 of the EU GMP guide, the European counterpart to 21 CFR Part 11 for computerised systems in GMP environments. It covers risk management, supplier assessment, validation, data integrity, audit trails, change control and business continuity, and is read alongside Chapter 4 on documentation. A system built only for Part 11 will usually have gaps against Annex 11.

The data integrity expectations inspectors work from. ALCOA is Attributable, Legible, Contemporaneous, Original and Accurate. The plus adds Complete, Consistent, Enduring and Available. It applies equally to a paper batch record and a validated electronic system, and most findings trace back to contemporaneous or original rather than to the technology.

The quality management system standard for medical device organisations. Related to ISO 9001 but with regulatory obligations built in. Working to the standard and being certified to it are different things.

The documented set of processes, responsibilities and records through which an organisation controls quality: document control, training, CAPA, change control, supplier management, complaints and post-market surveillance, internal audit and management review. It exists whether or not it is written down well; the question an auditor asks is whether the written version and the practised version are the same.

The standard for risk management of medical devices. Requires hazard identification, risk estimation and evaluation, risk control, and evaluation of overall residual risk acceptability, connected to real design decisions rather than documented after the fact.

The European Medical Device Regulation and In Vitro Diagnostic Regulation, which replaced the earlier directives. Both raised requirements substantially for clinical evidence, post-market surveillance and technical documentation, and moved many IVDs into higher risk classes that can no longer be self-certified.

The documentation that demonstrates a device meets European regulatory requirements, called technical documentation under EU MDR and IVDR. It brings together the device description, the general safety and performance requirements checklist, the risk management file, design and manufacturing information, clinical or performance evaluation, labelling and the post-market surveillance plan. It is a living file, not a submission that is finished once.

A US premarket submission demonstrating that a device is substantially equivalent to a legally marketed predicate device. The predicate argument is usually where these succeed or fail.

Premarket Approval, the FDA route for Class III devices. More demanding than a 510(k) and generally requires clinical data supporting safety and effectiveness in its own right.

Corrective and Preventive Action. The process of investigating a problem, identifying root cause, acting on it, and verifying that the action worked. Closing a CAPA to a date rather than to demonstrated effectiveness is one of the most common audit findings.

A clinical monitoring approach that concentrates effort where risk to subject safety and data integrity is highest, using central data review between site visits, rather than verifying every field against source at every site.

Source Data Verification: checking data recorded in the study database against the original source records. Effective for transcription errors, poor value for the money at 100 per cent, which is why targeted SDV is now the norm.

Data standards for clinical research. SDTM structures the collected data; ADaM structures the analysis-ready datasets derived from it. Regulators expect submissions in these formats.

Periodic safety reports. DSUR covers products in development; PSUR and PBRER cover marketed products. All are fixed-deadline obligations rather than discretionary documents.

Individual Case Safety Report: the record of a single adverse event. Expedited reporting clocks run from the day of awareness, not the day of data entry, which is why backlogs become compliance findings.

The consultant is an employee of the staffing company, which runs payroll, withholds taxes and handles I-9 verification. The simplest arrangement for a client with compliance exposure.

The consultant works through their own incorporated entity, which invoices the staffing company or client company to company. Common for senior specialists. It shifts tax and benefits responsibility to the consultant entity.

A US independent contractor arrangement. Genuine independence has to be established against the classification tests; using 1099 to avoid employment obligations for someone who is functionally an employee is a real and expensive risk.

An engagement that runs for an agreed period with a pre-set conversion fee if the client hires the consultant permanently. Useful for roles where fit matters more than the CV can show.

Managed Service Provider and Vendor Management System. The programme and the software a large employer uses to manage contingent labour across multiple suppliers. Suppliers work within them rather than around them.

Statement of Work. An engagement priced against defined deliverables and scope rather than hours. Suits submissions, validations and implementations; suits ongoing operational support badly.

Collective shorthand for the good practice regulations: GCP for clinical, GMP for manufacturing, GLP for laboratory, and others. "GxP-aligned" describes people and processes that operate to those expectations.