FDA inspectors ask four questions about your controlled vocabulary: Are terms defined? Who approved them? When? Can you prove the definition was in effect at time of use? If you manage terminology in Confluence tables, you fail all four.
Data integrity deficiencies — including undefined, unapproved, or inconsistently used terminology — are among the most frequently cited Form 483 observations in FDA pharma and MedTech inspections (FDA Warning Letter database).
The regulatory requirements are explicit:
Most pharma QA teams manage terminology in Confluence tables or shared spreadsheets. These approaches have no approval workflow, no version history per term, no audit trail of who changed what and when, and no mechanism to prevent self-approval. When the inspector asks “who approved this definition of adverse event and when was it last reviewed?” — there is no defensible answer.
During FDA inspections and ISO 13485 audits, inspectors evaluate terminology management against specific criteria. Here is what they look for and what constitutes a finding:
| # | Inspection Point | What They Ask | Finding If Missing |
|---|---|---|---|
| 1 | Term definition exists | Is every term used in SOPs, CAPAs, and batch records formally defined in a controlled glossary? | Undefined terminology in controlled documents |
| 2 | Approval evidence | Who approved this definition? Was it a different person from the author? Where is the signature? | Inadequate access/authority controls (21 CFR Part 11 §11.10(d), §11.10(g)) |
| 3 | Approval timestamp | When was it approved? Can you show the exact date and time? | Non-contemporaneous records (ALCOA+ violation) |
| 4 | Version history | What changed between version 1 and version 2? Who made the change? | Inadequate change control (ISO 13485 Cl. 4.2.4) |
| 5 | Effective date proof | Can you prove this definition was in effect when the batch record was executed? | Cannot demonstrate document currency at time of use |
| 6 | Obsolete term control | Are superseded definitions archived and inaccessible for active use? | Risk of obsolete terminology in active documents |
| 7 | Consistency across documents | Is “deviation” defined the same way in the glossary, the SOP, and the training material? | Terminology inconsistency across controlled documents |
Each inspection point maps directly to ALCOA+ data integrity principles:
Compliance Glossary is a Confluence app purpose-built for regulated terminology management. Every feature maps to a specific regulatory requirement.
The system enforces separation between author and approver in code. The person who creates or modifies a term cannot approve it. A second authorized reviewer must independently approve or reject the change. This check runs server-side in the Forge backend; it is not a UI-only restriction.
This supports the segregation-of-duties and authorized-approval controls described in 21 CFR Part 11 §11.10(d) and §11.200, and the “Attributable” principle of ALCOA+. Part 11 compliance always requires customer-led computer system validation (CSV) — no single tool “satisfies” Part 11 on its own. Learn more in our four-eyes principle guide.
Every change to every term is recorded with a timestamp, the user who made the change, and the full content diff. You can reconstruct the exact state of any term at any point in time — including proving which definition was in effect when a batch record was executed.
Compliance Glossary scans your Confluence pages for terminology that appears in documents but is not defined in the glossary. This identifies gaps before an inspection — not during one. Run a scan, see which pages reference undefined terms, and create the missing definitions with proper approval before the next audit.
When a compliance scan flags a term, your team can resolve it by adding a definition, marking it as acceptable with a documented reason, or categorizing it for future action. Every resolution is recorded with who made the decision and why — creating the evidence trail auditors expect.
The following table maps each Compliance Glossary capability to the specific regulatory requirement it satisfies:
| Feature | FDA 21 CFR Part 11 | ISO 13485 Cl. 4.2.4 | ALCOA+ | GxP (ICH Q10 / EU GMP Annex 11) |
|---|---|---|---|---|
| Four-eyes approval | §11.10(d) limited system access to authorized individuals; §11.10(g) authority checks | Document approval before use by authorized personnel | Attributable — linked to specific approver | EU GMP Annex 11 §12 Security: role-based access, second-person verification |
| Version history | §11.10(e) audit trail recording time-sequenced changes | Version identification; change control procedures | Contemporaneous — timestamped at point of change | EU GMP Annex 11 §9 Audit Trails for GMP/GLP documentation |
| Self-approval prevention | §11.10(d) limited access; §11.10(g) authority checks | Review and approval by designated function | Accurate — independent verification of content | EU GMP Annex 11 §2 Personnel: segregation of duties in document management |
| Compliance scanning | §11.10(a) system validation — ensuring records are complete | Ensuring document adequacy before use | Complete — all terms are defined and traceable | ICH Q10 Section 3 Continual Improvement: proactive compliance monitoring |
| Finding resolution | §11.10(e) audit trail capturing operator actions and reasons for change | Record retention with evidence of decisions | Original — decisions documented at source | ICH Q10 Section 3.2 CAPA-aligned issue documentation |
| Audit trail export | §11.10(c) records available for FDA inspection | Records available for audit by notified body | Available & Enduring — accessible on demand | EU GMP Annex 11 §9 Audit Trails: inspection-ready documentation |
| Obsolete term archival | §11.10(c) protection of records to enable accurate retrieval | Prevention of unintended use of obsolete documents | Consistent — only current definitions active | EU GMP Annex 11 §7 Data Storage: lifecycle management of controlled vocabulary |
Compliance Glossary is built on Atlassian Forge — Atlassian’s serverless platform that runs within the Atlassian infrastructure boundary. For pharma and MedTech teams operating under GxP, this architecture reduces an entire category of data security concerns:
For QA teams completing computer system validation (CSV) or supplier qualification, this architecture reduces documentation burden. Review the full technical details in our security documentation.
No single tool satisfies 21 CFR Part 11 on its own — Part 11 compliance is a combination of procedural and technical controls validated by the customer. Compliance Glossary supports the segregation-of-duties and authorized-approval controls described in 21 CFR Part 11 §11.10(d) and §11.200 by enforcing four-eyes approval in code, maintaining a timestamped audit trail of every change, and preventing self-approval at the server layer. Customers must still perform computer system validation (CSV) appropriate to their risk assessment.
Every term change is linked to a specific approver (Attributable), timestamped at the moment of approval (Contemporaneous), stored as the source of truth inside Confluence (Original), verified by an independent reviewer (Accurate), indexed for search (Legible), covers every controlled term (Complete, Consistent), retained in version history (Enduring), and accessible to auditors on demand (Available).
No. The Compliance Glossary Forge app runs entirely within the Atlassian platform boundary. It issues no external webhooks, performs no third-party enrichment, and emits no analytics from within Confluence. The teamkit.dev marketing site uses self-hosted, cookieless analytics, but the app itself does not.
No. Four-eyes approval is enforced server-side. The person who creates or modifies a term cannot approve it — a different authorized reviewer must approve or reject the change. This check runs in the Forge backend and cannot be bypassed through the UI.
Terminology inconsistency is a preventable gap. Compliance Glossary gives your QA/RA team the approval workflow, version history, and compliance scanning to close it — without leaving Confluence.
Evaluate in Confluence View Security WhitepaperCompliance for Confluence — approved terms, page scanning, and audit evidence for regulated teams in Confluence
ALCOA+ Documentation Principles — the data integrity framework behind every audit trail requirement
FDA Terminology Management — 43 terms for pharma and MedTech, 21 CFR Part 11 aligned
GxP Documentation Guide — good practice requirements for controlled documents in regulated environments
Four-Eyes Principle — how segregation-of-duties approval works and which regulations reference it
ISO 13485 Terminology — medical device QMS terms with document control alignment
Security Whitepaper — Forge architecture, data isolation, and platform boundaries