Template: Mock Interview Question Bank for GxP Quality, CSV, and Data Integrity Roles

This is a ready-to-use mock-interview drill for GxP quality, computer system validation, or data integrity roles. It is built to be run with a partner, a mentor, a study group, or a career-services contact acting as interviewer, though it also works read solo. Each question carries a model answer and a description of what a weak answer sounds like, so the person running the mock interview has something concrete to score against, not just a gut feeling. Replace <<FILL: ...>> notes with your own specifics. Model answers are illustrative and general; verify any regulation cited against the current source before you repeat it in a real interview. This is general guidance to adapt, not legal, regulatory, or career advice. It pairs with Breaking Into GxP: A Realistic Career Guide and Interview Preparation for GxP Quality, CSV, and Validation Roles.

Session header

1. How to run the session

Budget about 45 to 60 minutes for a full pass. Ask each question cold, let the candidate answer without interruption, then compare the answer against the model answer and the weak-answer pattern before moving on. Score each answer on the four axes below; write the score and one note per question, not a running impression, because the notes are what turn into a real study plan afterward.

Score each axis 1 (weak) to 4 (strong). A candidate does not need a 4 across the board; a 2 with an honest “I would confirm the exact figure, but the principle is X” is often stronger than a confident 4 that turns out to be wrong.

2. Foundations round

These four questions are the ones almost every interviewer touches first, less to test whether you know the vocabulary and more to see whether you actually understand what sits behind it.

Q1. What does GxP mean, and why does the industry regulate it this way instead of just trusting a good scientist to get it right? Model answer: GxP is a family of good-practice frameworks (GMP, GLP, GCP, GDP, and others) that apply the same underlying idea, that products, processes, and the records proving them have to be reliable, because a mistake or a fabricated record can reach a patient. Regulation exists because trusting individual judgment alone does not scale and does not survive turnover, pressure, or a bad day; a system of controls and records is what lets a stranger, an auditor, or a new hire years later verify that the work was done right. Weak answer sounds like: reciting the GxP acronym list with no mention of patient risk, or answering as if the question were only about paperwork.

Q2. Explain ALCOA+ and give a real example of a failure for two of the attributes. Model answer: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available. A shared login breaks Attributable, because no single person’s action is provably tied to the entry. A result recorded from memory at the end of a shift rather than at the time of testing breaks Contemporaneous, because the record no longer reflects the actual moment of the activity. Weak answer sounds like: reciting the nine words with no example, or an example that does not actually map to the attribute named.

Q3. What is the difference between QA and QC in one sentence each? Model answer: QC generates and tests the data that shows whether a product or process meets specification. QA oversees the system that governs how that work happens and independently reviews and releases based on it, without being the one who generated the original result. Weak answer sounds like: naming the two departments without ever naming the function.

Q4. Verification versus validation, in one sentence each. Model answer: Verification confirms a deliverable meets its specification, did we build it right. Validation confirms the system or process performs as the user actually needs in real use, did we build the right thing and does it perform. Weak answer sounds like: using the two terms interchangeably, or defining validation only as “testing.”

3. CSV and validation round

This round matters most if your target track is CSV or validation, and an interviewer here is usually listening for whether you can move fluidly between the lifecycle vocabulary (URS, FS, DS, IQ, OQ, PQ) and a concrete, specific mechanism, because a candidate who can only recite the sequence without explaining what any one step actually proves gets found out within two follow-up questions.

Q5. Walk me through IQ, OQ, and PQ in one sentence each. Model answer: Installation qualification confirms the system is installed and configured as specified. Operational qualification confirms it functions per requirements across normal, boundary, and error conditions. Performance qualification confirms it performs as intended in the live environment with trained users and real workflows. Weak answer sounds like: defining OQ and PQ identically, or describing IQ as “just checking it turned on.”

Q6. Critique this requirement: “The system shall be user-friendly.” What is wrong with it, and how would you fix it? Model answer: It is not testable; nobody can write a pass or fail test for “user-friendly.” A fixable version states an observable, measurable behavior, for example “a trained user shall complete result entry for a standard sample in under two minutes with no more than one input error per ten entries,” something a test can actually verify. Weak answer sounds like: agreeing the requirement is fine, or rewriting it with a different vague adjective instead of a measurable behavior.

Q7. Explain what Computer Software Assurance changes, without saying “no more test scripts.” Model answer: CSA does not remove testing; it reallocates rigor by risk. High patient and product risk still gets scripted, independently reviewed testing. Lower-risk functions can use lighter approaches, unscripted or ad hoc testing, or reliance on supplier evidence, freeing effort to concentrate where harm could actually occur. Weak answer sounds like: “CSA means we test less now,” with no mention of risk-based reallocation.

Q8. A test step fails during OQ execution. What do you do in the moment? Model answer: Record the actual result exactly as observed, not the expected result. Do not edit the script to make it pass. Raise a deviation, assess the impact on the system and any other test results, determine whether it is a true failure or a documentation or environment issue, and only re-test after the cause is understood and, if needed, fixed. Weak answer sounds like: “I would just re-run it,” with no mention of documenting the actual failure first or investigating cause.

Q9. What is the requirement traceability matrix for, and what does an orphan requirement mean? Model answer: It links each requirement forward to design, risk assessment, and the specific test that proves it, so the validation can show every requirement was actually tested. An orphan requirement is one with no linked test, which means the validation cannot prove that requirement was met at all. Weak answer sounds like: describing the matrix only as “a spreadsheet.” A candidate who stops there usually has never had to defend a gap in one to an auditor, and it shows.

Q10. Name the GAMP 5 software categories and what changes in effort as the category rises. Model answer: Category 1 is infrastructure software, category 3 is non-configured (run as supplied), category 4 is configured, category 5 is custom or bespoke code. There is no category 2 in the current edition. As the category rises, the system carries more custom logic the supplier did not test on your behalf, so more of the verification burden shifts to you. Weak answer sounds like: inventing a category 2, or treating all categories as needing identical validation effort.

4. Data integrity round

Q11. Why does an audit trail need to be reviewed, not just enabled? Model answer: An enabled but unreviewed audit trail records the history but nobody looks at it, so a deletion, an unexplained re-integration, or a changed timestamp can sit unnoticed indefinitely. Review, applied at a frequency scaled to data criticality, is what turns a passive log into an actual control that catches unauthorized or unexplained changes. Weak answer sounds like: “the system already logs everything, so it’s covered,” with no distinction between logging and review.

Q12. Why do shared logins matter as a data integrity issue, specifically? Model answer: They break Attributable. If two people share a login, an action in the audit trail cannot be tied to the specific person who performed it, which means the record cannot support an investigation, a training gap cannot be traced to the right person, and the control designed to hold someone accountable for an action is defeated at the source. Weak answer sounds like: framing shared logins only as an IT security issue with no mention of attributability or investigations.

Q13. Static versus dynamic records, and what a “true copy” means for each. Model answer: A static record is fixed once recorded, like a printed chromatogram. A dynamic record can be reprocessed, reformatted, or interacted with, like the underlying electronic chromatography data. A true copy of a dynamic record has to preserve that dynamic content and its metadata and audit trail, not just a printed or PDF snapshot of one view, because a static copy of a dynamic record can hide reprocessing history. Weak answer sounds like: treating a printed report as automatically a true copy of any electronic record behind it.

Q14. What would you do if you found a re-integration in a chromatography run with no documented reason? Model answer: Raise it as an exception the same day, notify the system owner and QA, and do not release or use the affected result until it is resolved. Open a deviation if the change could affect a result or a batch decision, and hold the disposition until the analyst and QA confirm whether the reprocessing was scientifically justified and the record is corrected. Weak answer sounds like: “I’d ask the analyst about it,” with no mention of a same-day exception, escalation, or holding the affected data.

Q15. What is “review by exception,” and why does it matter for a system that produces a large audit trail? Model answer: It is a method where a validated filter or query surfaces the critical entries, changes to results, deletions, clock changes, privilege changes, so a reviewer focuses attention there instead of reading every line of a large trail. It matters because reading every entry does not scale, and an unfocused review is more likely to miss the entries that actually carry risk. Weak answer sounds like: “you just skip most of the trail.”

5. Deviation, OOS, and quality system round

Q16. Walk me through a two-phase OOS investigation at a high level. Model answer: Phase one is a laboratory investigation to rule out an obvious assignable lab error, checked against a defined, pre-approved checklist, not an open-ended search for an excuse. If phase one does not find a clear lab cause, phase two expands to a full manufacturing and process investigation. Retesting is only justified with a documented, scientifically sound basis, never simply repeated until a passing result appears. Weak answer sounds like: “you just retest it,” with no mention of the two phases or the requirement for a documented, justified basis for any retest.

Q17. Distinguish a deviation, an OOS, and an out-of-trend result. Model answer: A deviation is any departure from an approved procedure, specification, or expected result, a broad category. An OOS is specifically a test result outside a predefined specification or acceptance criterion. An out-of-trend result is within specification but outside the pattern the process normally shows, which can be an early warning before anything is technically out of specification. Getting this distinction right in an interview signals you have actually worked with real data, not just the definitions, because the three get confused constantly in practice and untangling them under a live question is a different skill than reciting them from notes. Weak answer sounds like: using all three terms interchangeably, or describing out-of-trend as simply “a smaller OOS.”

Q18. A root cause investigation keeps landing on “operator error.” What is wrong with stopping there, and what would you do instead? Model answer: “Operator error” restates the symptom rather than explaining why the system allowed the error to happen or to matter. I would ask why the error was possible at all, for example a confusing form, no independent check, inadequate training, or a system that permits an invalid entry, and keep asking why until reaching a cause that a corrective action can actually address, using a structured method such as five whys or a fishbone diagram. Weak answer sounds like: agreeing operator error is an acceptable root cause as long as the person is retrained.

Q19. How do you verify a CAPA was actually effective, not just implemented? Model answer: Effectiveness verification checks, after a defined interval, whether the corrective action actually prevented recurrence, using objective evidence such as a metric, a follow-up audit, or a documented absence of the original event, not simply confirming the action item was completed on the tracking sheet. Weak answer sounds like: “you close it once the training is done,” with no mention of a later, evidence-based check for recurrence.

6. Scenario judgment round

None of these three have a purely technical answer. They test what you would actually do under pressure, and a rehearsed-sounding answer here is itself a bad sign.

Q20. You are asked to sign off on a validation package you do not believe is complete. What do you do? Model answer: I do not sign. I document specifically what is missing or unclear, and I escalate to my supervisor or QA the same day rather than sitting on the concern. My signature is an assertion that the work was done and recorded correctly, and I do not put it on something I cannot stand behind. Weak answer sounds like: “I’d sign it and flag the issue for next time,” which fails the exact test the question is designed to check.

Q21. You discover, after the fact, that a colleague backdated an entry with good intentions, trying to make the record look contemporaneous. What do you do? Model answer: I raise it, in writing, to my supervisor or QA the same day. Backdating is a data integrity issue regardless of intent, because it makes the record no longer represent when the activity actually happened. Staying silent to protect a colleague makes me part of the same problem, and the record has to be corrected through the proper process, not quietly left as is. Weak answer sounds like: “I’d talk to them privately and let it go if they promise not to do it again,” with no escalation.

Q22. A deadline is at risk, and your manager suggests skipping a step in an approved protocol “just this once” to catch up. What do you do? Model answer: I would not skip the step. I would explain that executing outside the approved protocol makes the resulting evidence unusable and creates a bigger problem than the delay, and I would propose an alternative, such as escalating for a protocol amendment or additional resource, rather than simply refusing with no path forward. Weak answer sounds like: “I’d do what my manager says since they’re responsible,” with no acknowledgment of the compliance and evidence problem created.

7. Behavioral round

Two rounds, two stories. Prepare them properly beforehand rather than improvising in the room.

Q23. Tell me about a time you found a mistake in your own work. What did you do? Model answer structure: name the mistake plainly, in the first person, without minimizing it. Describe what you did the moment you found it (documented it, told the right person, corrected it through the proper channel) and what changed afterward so it would not recur. The STAR behavioral interview story worksheet gives the full Situation, Task, Action, Result structure to draft this properly rather than answering it cold. Weak answer sounds like: a “weakness” that is actually a disguised strength, or an answer with no real mistake in it at all.

Q24. Tell me about a time you had to explain a technical finding to someone without your technical background. Model answer structure: describe the audience and what was actually at stake for them (a business decision, a timeline, a risk they had to accept or reject), then describe how you translated the finding into terms tied to that stake rather than repeating the technical detail more slowly. Close with the outcome, specifically whether they were able to make the decision they needed to make. Weak answer sounds like: restating the technical explanation you gave, without ever addressing what changed for the audience because of how you delivered it.

Scoring sheet

Filled specimen

One mock session, partial extract, illustrative scores.

Interviewer note: the candidate’s Q7 answer described CSA as “less testing” with no mention of risk reallocation, scored technical correctness 2, decision discipline 2. After a five-minute review of the model answer, the candidate re-answered a similar prompt correctly, confirming the gap was a specific, closeable fact gap rather than a deeper reasoning problem.

Common failure modes this drill catches before a real interview

• A candidate who can define a term but cannot say what actually goes wrong when the control behind it fails.
• Confident, fluent answers that are factually wrong and would not survive a real interviewer’s follow-up.
• A scenario answer that states the compliant choice but shows no discomfort with the pressure creating the dilemma, which reads as rehearsed rather than genuinely reasoned.
• A behavioral answer with no real first-person action in it.

How to adapt this question bank

1. Run the rounds that match your target track most heavily; a QA-track candidate should spend more time in sections 5 and 6, a CSV-track candidate more in section 3.
2. Add role-specific questions for a named system (LIMS, MES, ELN) once you know which one the target role centers on.
3. For a senior-level mock, weight the scenario and behavioral rounds more heavily than the definitional foundations round.
4. Re-run the weakest round again after a week of study rather than the full bank every time.