Policy: GMP Roles, Decision Rights, and Quality Unit Authority

This is a ready-to-use corporate policy. A policy states what the organization requires and who owns it; the procedures underneath it state how to do the work. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited regulation against the current source before you rely on it.

Document control header

1. Purpose

This policy states who is authorized to make which quality-affecting decisions at <<FILL: COMPANY NAME>>, and codifies the quality unit’s independent authority to approve or reject components, materials, procedures, specifications, and finished product. It exists because GMP depends on the group that makes or tests a product not being the only group that judges it; that separation only holds if decision rights are written down, not assumed or improvised in the moment.

2. Policy statement

<<FILL: COMPANY NAME>> requires that every quality-affecting decision be made by the function with documented authority to make it, and by no other function, regardless of business pressure, schedule, or cost. The quality unit’s authority to approve or reject components, drug product containers and closures, in-process materials, packaging materials, labeling, and finished product is independent and cannot be delegated to, or overridden by, Production, Operations, Commercial, or site management. Where a Qualified Person role exists for a market that requires it, that person’s legal certification of a batch is personal and non-delegable.

3. Scope

This policy applies to every role that generates, tests, reviews, approves, or dispositions GxP records or product at the sites listed in the header, including contracted manufacturing and testing performed on the company’s behalf under a quality agreement. It covers decisions on material and component disposition, batch release and rejection, deviation approval and closure, CAPA approval, change control approval, procedure approval and issuance, and the authority to halt an operation for a quality concern. It does not itself define the procedural steps for any single decision type; those are governed by the supporting procedures referenced in section 10.

4. Definitions

• Production / Manufacturing: the function that executes the process against the approved batch record and records results contemporaneously. Cannot release its own batch.
• Quality Control (QC): the function that samples, tests, generates analytical data, and reports results. Does not decide commercial disposition alone.
• Quality Assurance (QA): the function that approves documents, dispositions batches, owns the quality management system, and decides release. Does not execute the process it judges. QA and QC together constitute the “quality unit” referenced in 21 CFR 211.22.
• Qualified Person (QP): in the EU system, the individual who personally certifies that a batch has been manufactured and controlled per GMP and the marketing authorization, under EU GMP Annex 16. Certification cannot be delegated away from a named, qualified individual.
• Site management: the function that resources the quality system, chairs or attends management review, and sets business objectives. Cannot direct or pressure QA to release noncompliant product.
• Decision right: a documented, named authority to approve, reject, or otherwise finally decide a specific class of quality-affecting question, distinct from the authority to recommend, execute, or provide input.
• Delegation of authority: a documented, time-bound assignment of a decision right to a named backup during a role holder’s planned or unplanned absence.

5. Decision rights matrix

The following states, for each major decision class, which function holds final authority. “No authority” means the function may provide input or execute an outcome but cannot make or override the decision itself.

6. Mandatory rules

1. The quality unit (QA, with QC generating the underlying data) holds independent authority to approve or reject components, containers, procedures, specifications, and finished product, per 21 CFR 211.22. This authority is not delegable to Production, Operations, Commercial, or site management.
2. No individual reviews, approves, or releases their own work product. A second, independent person or the quality unit performs the review step for any quality-affecting record.
3. Site management may resource, prioritize, and set business objectives, and may raise a quality concern or order a stop, but may not direct, pressure, or overrule a quality disposition decision. See ICH Q7, section 2.2, on the responsibilities of the quality unit(s), for the underlying principle this rule implements.
4. Where a Qualified Person role exists, the QP’s certification of a batch under EU GMP Annex 16 is personal and cannot be delegated away from a named, qualified individual, and is made independent of commercial shipping timelines.
5. Every decision-rights role in section 5 has a named, documented backup for planned and unplanned absence, so authority is never informally exercised by whoever happens to be available. Undocumented, verbal delegation does not satisfy this rule.
6. Decision rights are reviewed and re-confirmed at the frequency in the header, and immediately whenever the organizational structure, reporting lines, or site roster changes.
7. Any instance where a decision right in section 5 was exercised by a function other than the one named is treated as a quality event and investigated per <<FILL: SOP-ID for deviations>>, regardless of whether the underlying disposition turned out to be correct.

7. Prohibited behaviors

• Production, Operations, Commercial, or site management directing QA to release, approve, or close a specific record.
• A single individual holding both the role that generates or executes the work and the sole authority that approves it, with no independent review.
• Informal or verbal override of a documented reject decision.
• Recording schedule, cost, or commercial pressure as the stated rationale for a quality decision.
• Exercising a decision-rights role during another person’s absence without a documented delegation.
• Allowing a QP certification, where required, to be issued by, or attributed to, anyone other than the named qualified individual.

8. Accountability

9. Training

Every person named in section 5, or who holds a decision-rights role under the delegation-of-authority log, completes training on this policy and the underlying regulation before exercising the authority, and on a recurring basis defined in <<FILL: SOP-ID for training>>. New hires moving into a decision-rights role complete this training before the role is activated in the delegation-of-authority log.

10. Consequences of breach

An instance of a decision right being exercised by an unauthorized function, or of documented pressure to reverse a quality decision, is treated as a quality and conduct matter, investigated under <<FILL: SOP-ID for deviations / investigations>>, and may result in disciplinary action in addition to any quality and regulatory consequence. A quality unit member who raises a concern about pressure to release noncompliant product is protected from retaliation under <<FILL: reporting route, e.g. speak-up channel>>.

11. Acceptance criteria

This policy is being met when all of the following are true:

• The decision rights matrix in section 5 matches the site’s actual organizational chart and delegation-of-authority log, with no gaps.
• A review of the last 12 months of reject and deviation-closure decisions shows no instance of an unauthorized function making or reversing a quality decision.
• Every decision-rights role has a current, documented backup for absence.
• Training for decision-rights roles is current for all incumbents and their named backups.
• No open finding alleges that commercial or schedule pressure influenced a disposition decision without it having been investigated.

12. References

21 CFR 211.22 (quality control unit authority and responsibility). ICH Q7, section 2.2 (Responsibilities of the Quality Unit(s)). ICH Q10, Pharmaceutical Quality System. EU GMP Annex 16 (Certification by a Qualified Person and Batch Release). EU GMP Part I, Chapter 1 (Pharmaceutical Quality System).

Confirm the current version and clause numbers of each reference before issue. If the site also manufactures a device or combination-product constituent, add the equivalent design-control and management-responsibility references from the site’s QMSR-based quality system separately; this policy does not attempt to state those in detail.

13. Supporting procedures

14. Revision history

15. Approvals

Filled specimen

The following shows the header and one worked decision-rights entry completed for an illustrative mid-size biologics site, so you can see the level of specificity expected. The company, names, and numbers are illustrative; replace them with your own.

Specimen of one decision-rights entry as adopted:

“Release or reject a finished batch.” At this site, QC completes and reports all release testing. QA reviews the complete executed batch record, the certificate of analysis, and confirms all deviations affecting the batch are closed, then approves or rejects disposition. In Q3 2026, the Site Director requested an early release ahead of a customer shipment deadline while one deviation remained open. QA declined, documented the request and the decision in the batch disposition record, and the batch released two days later once the deviation closed. No exception to the decision-rights matrix was granted, and the request itself was logged as a training opportunity, not a violation, because it was raised transparently and QA’s decision stood unchallenged.

That short narrative is exactly what an inspector wants to see behind a policy statement: the rule, a real test of it under pressure, and evidence that the firewall held.

Common inspection findings this policy prevents

• Documents or interviews suggest Production or site management can direct or influence a QA release decision.
• No documented decision-rights matrix exists, so who can approve what is a matter of local custom rather than a written, trained-on rule.
• A single person both performs a critical task and is the only reviewer of that task, with no independent check.
• Decision-rights roles have no documented backup, so authority is exercised informally by whoever is present during an absence.
• A Qualified Person’s certification role is treated as a formality delegated in practice to someone not named for it.

How to adapt this policy

1. Set your document number, owner, effective date, and review cycle in the header.
2. Confirm the decision rights matrix in section 5 matches your actual organizational structure; add rows for any additional decision class specific to your operation (for example, a QP secondary release step, or a clinical supply release decision).
3. Point every <<FILL: SOP-ID>> cross-reference to your real supporting procedures.
4. If your site also manufactures a device or combination-product constituent, build a companion table for the device quality system’s management-responsibility and design-control decision rights rather than folding it into this drug-focused matrix.
5. Have the site head endorse the policy alongside QA so it carries operational, not only quality-function, weight.
6. Confirm every regulation and annex reference in section 12 against the current published version before issue.