A specialist GxP IT quality practice. We audit computerised systems and the suppliers who build them, to a depth most audit programmes do not reach — and we measure software product quality rather than infer it from documentation.
Founded in 2006, based in Northern Ireland, working with clients worldwide. We establish whether a computerised system — and the organisation that built it — can be relied upon, and provide the evidence either way.
Pharmaceutical and biotechnology organisations, medical device and combination product manufacturers, CROs, and the IT suppliers who serve them.
GLP, GCP, GMP and pharmacovigilance environments. Remote and on-site, across Europe, North America and beyond.
The Audit Depth Model, and Level 3 auditing — measuring software product quality, not documentation compliance.
Most organisations spend heavily proving they are compliant. Far fewer can say whether their systems are efficient, secure or scalable, because the paperwork does not distinguish between the two.
Empowerment Quality Engineering has worked both sides of that gap since 1997. Before auditing computerised systems, we built them — architecture, coding, database migration, performance and penetration testing, installation, maintenance and decommissioning. That is why an EmpowermentQE audit looks different from a documentation review: we know where the problems hide.
Over 300 global computerised system audits since 1997, across GLP, GCP, GMP and pharmacovigilance, for pharmaceutical organisations and the IT suppliers who serve them. We have also built software life cycles and the quality systems that govern them, so the procedures we audit against are ones we have had to write and make work.
Regulators have settled on AI as a priority, and the EU AI Act is live. Prohibitions have applied since February 2025, general-purpose AI obligations since August 2025, and Article 50 transparency duties since 2 August 2026. High-risk obligations were deferred by the Digital Omnibus (Regulation (EU) 2026/1744) to December 2027 and August 2028 — more time to prepare, not a change of direction. EU GMP Annex 11 is under revision and Annex 22, covering AI in GMP applications, is in draft.
The high-risk regime turns on post-market monitoring by the provider and monitoring of operation by the deployer. Monitoring means measuring how a system behaves in use and acting on the result — the same discipline we apply to software releases, applied to a model. Provenance, determinism, drift, bias and retraining control are engineering questions, and none of them can be answered by documentation review. This is a Level 3 audit — read about the Audit Depth Model.
EmpowermentQE is represented on the Research Quality Association (RQA) I.T. Committee, and holds memberships of the IEEE, ISACA and ISPE, contributing to the ISPE Data Integrity Project team. We write and present regularly for the GxP community — 18 articles, white papers and conference presentations, all freely available. Browse the publications library
Testing is quality control — inspecting the product to detect defects. Procedures, training and change control are quality assurance — governing the process so defects are less likely. Most GxP quality systems are built almost entirely from those two, and they are good at both.
Neither of them measures whether the software that came out of the process is any good.
Testing. Detective, after the fact.
SOPs, change control, the QMS. Preventive by design.
Measurement through the build and operational cycle.
That third discipline is quality engineering. It is what the wider software industry has practised for decades and what regulated software has largely left out. Defect removal efficiency, defect density and escaped defect analysis are not exotic; they are ordinary engineering measures. Their absence is what allows a system to carry a clean audit history and an unknown quality level at the same time.
We have been called Empowerment Quality Engineering since 2006. The name was always the argument.
A 30-minute conversation about your systems, your suppliers and where the real risk sits. No obligation, and you get a short written summary afterwards.
Let's Talk