· CROSS-CUTTING
QMS

Quality Management Systems

Cross-cutting quality system and lifecycle management.

Browse all 26 QMS standards →Assess your quality system →

What this page does not claim

Educational orientation — not a determination of regulatory applicability, compliance, validation scope, or organizational approval.

WHAT IT GOVERNS

A Quality Management System is the overarching structure that ties every GxP discipline together — in pharma, the Pharmaceutical Quality System of ICH Q10 (aligned with ISO 9001 concepts) covering management responsibility, CAPA, change management, and continual improvement across the product lifecycle. It is the system that turns isolated controls into a coherent, sustained state of control.

WHY IT MATTERS

Individual controls only add up to quality when a system connects them — feeding deviations into CAPA, CAPA into change control, and performance back into management review. FDA’s Quality Management Maturity (QMM) program rates the maturity of exactly this system, and a weak QMS is what turns a single problem into a recurring pattern. The QMS is the connective tissue of GxP.

KEY FOCUS AREAS

01

Management responsibility & review

Senior-management ownership of the quality system and a management review that drives real, resourced decisions — the ICH Q10 requirement that makes leadership accountable for quality.

02

CAPA & deviation management

A closed loop from deviation to root cause to corrective and preventive action, with effectiveness checks that confirm the fix actually held.

03

Change management

Controlled evaluation, approval, and implementation of change so improvements and modifications are made without introducing new risk.

04

Continual improvement & the lifecycle

The ICH Q10 objective of continually improving process performance and product quality across the entire product lifecycle, not just at launch.

STANDARDS SPEQ DECODES · 26

Open the full library →
21 CFR Part 820FDAHIGH INSPECTION RISK
Quality Management System Regulation (QMSR) — 21 CFR Part 820
ICH Q9(R1)ICH
Quality Risk Management
ICH Q10ICH
Pharmaceutical Quality System
ISO 9001:2015ISO
Quality Management Systems — Requirements
ISO 13485:2016ISO
Medical Devices — Quality Management Systems — Requirements for Regulatory Purposes
MHLW Ordinance No. 136MHLW
Japan GQP — Quality Management for Marketing Authorisation Holders
ISO 14971:2019ISO
Medical Devices — Application of Risk Management to Medical Devices
ISO 22000:2018ISO
Food safety management systems — Requirements for any organization in the food chain
Regulation (EU) 2017/745ECHIGH INSPECTION RISK
Medical Device Regulation (MDR)
MoCRA (FD&C Act Ch. VI)FDA
Modernization of Cosmetics Regulation Act of 2022
Regulation (EC) No 1223/2009EC
EU Cosmetic Products Regulation
ISO 10993-1:2018ISOHIGH INSPECTION RISK
Biological Evaluation of Medical Devices — Part 1: Evaluation and Testing Within a Risk Management Process
Regulation (EU) 2017/746ECHIGH INSPECTION RISK
In Vitro Diagnostic Medical Devices Regulation (IVDR)
21 CFR Part 830FDA
Unique Device Identification
21 CFR Part 806FDAHIGH INSPECTION RISK
Medical Devices; Reports of Corrections and Removals
ISO 19011:2018ISO
Guidelines for Auditing Management Systems
ISO/IEC 27001:2022ISO
Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements
21 CFR Part 3FDA
Product Jurisdiction
21 CFR Part 202FDA
Prescription Drug Advertising
ICH M4(R4)ICH
Organisation of the Common Technical Document for the Registration of Pharmaceuticals for Human Use
Directive 2001/83/ECEC
Community Code Relating to Medicinal Products for Human Use
Regulation (EU) 2016/679EC
General Data Protection Regulation (GDPR)
ISO 22301:2019ISO
Security and Resilience — Business Continuity Management Systems — Requirements
ISO 31000:2018ISO
Risk Management — Guidelines
ISO 45001:2018ISO
Occupational Health and Safety Management Systems — Requirements with Guidance for Use
ISO 14001:2015ISO
Environmental Management Systems — Requirements with Guidance for Use

WHAT GOOD LOOKS LIKE

  • CAPA effectiveness — problems stay fixed and don’t recur
  • Management review that drives decisions, resources, and follow-through
  • Change control that evaluates risk before implementation
  • Quality metrics trended and used to act ahead of failure

KEY REGULATORY BODIES

Derived from the 26 standards SPEQ decodes for this discipline.

RELATED DISCIPLINES

GMPGood Manufacturing PracticeGDocPGood Documentation PracticeCSVComputerised System Validation

SECTORS THAT OPERATE UNDER QMS

CDMOCDMOs & Contract ManufacturersTesting LabsContract Testing LaboratoriesDistributionDistribution & LogisticsCompoundingCompounding PharmaciesSuppliersExcipient & Raw-Material SuppliersSponsors / MAHSponsors & Marketing Authorization HoldersCertificationNotified Bodies & CertificationVendorsSoftware & Equipment Vendors
TOPIC EXPLAINERS ACROSS THIS DISCIPLINE
123 total
Computer System Validation & CSA →
GAMP 5, the risk-based lifecycle, Part 11, and the shift from documentation to critical thinking (CSA).
Contamination Control & Annex 1 →
The Contamination Control Strategy, cleanroom classification, and the 2022 Annex 1 revision.
Process Validation Lifecycle →
The three-stage lifecycle — design, qualification, continued verification — and the science behind it.
Quality Risk Management (ICH Q9) →
ICH Q9(R1), the risk-management process, common tools, and the pitfalls the R1 revision targets.
Quality by Design & Pharmaceutical Development →
Building quality in, not testing it in — the QTPP, CQAs and CPPs, the design space, and the control strategy.
The Pharmaceutical Quality System (ICH Q10) →
ICH Q10, the four elements, the two enablers, management responsibility, and the lifecycle model of quality.
Technology Transfer →
Moving a validated process between sites without losing control — the sending/receiving-unit model, knowledge transfer, and comparability.
Medical Device Quality System (ISO 13485 / QMSR) →
ISO 13485, the FDA QMSR harmonisation with 21 CFR 820, device risk management (ISO 14971), and software (IEC 62304).
Software as a Medical Device (SaMD) →
Software that is itself a medical device — the IMDRF definition, IEC 62304 lifecycle, ISO 14971 risk, EU MDR Rule 11, and how AI/ML changes the picture.
Cold Chain & Temperature Control in Distribution →
How Good Distribution Practice keeps a medicine within its qualified temperature range from the factory to the patient — mapping, the qualified cold chain, and what an excursion actually means.
Serialization & Falsified Medicines →
How a unique identifier on every saleable pack, plus tamper-evidence and interoperable verification, keeps falsified product out of the legitimate supply chain — and why regulators specify the outcome while GS1 specifies the syntax.
CAPA: Corrective & Preventive Action →
The three words the industry uses interchangeably and shouldn’t — correction, corrective action, preventive action — and why most "CAPAs" are none of the last two.
Change Control →
The process that evaluates and approves a change to a validated state before it is made — and why "before, not after" is the entire point that separates it from a deviation.
Deviation Management →
What to do when reality departs from the approved state: how a deviation is classified, investigated to a real root cause, and turned into a CAPA — and the timing that separates it from change control.
Supplier & Vendor Qualification →
Why a certificate of analysis is not qualification, how risk sets the depth from questionnaire to on-site audit, and the reason the excipient supplier and the API supplier are governed by different guides.
Product Quality Review (PQR / APR) →
The annual look back that is supposed to find the trend before it becomes a recall — why PQR and APR are the same idea under two names, and how a real one differs from a copy-paste template.
Audit Trail Review →
Having an audit trail is not reviewing it — the distinction regulators built an entire enforcement wave on, and how a risk-based review finds the deleted run instead of drowning in keystrokes.
Environmental Monitoring (EM) →
The programme that proves a cleanroom’s controlled state actually holds during production — viable and non-viable, why a single Grade A recovery is not a normal result, and the alert-vs-action-limit distinction people get wrong.
Design Controls →
The traceable process that proves a device design is right before it is built — why verification and validation are not the same question, and how the QMSR transition folds 21 CFR 820.30 into ISO 13485 §7.3.
Complaint Handling & Device Vigilance →
Every complaint is not a reportable event, and every reportable event is not a recall — the three decisions a device maker must keep distinct, and why under-reporting is a classic finding.
OOS & OOT Investigations →
A result outside specification is not a failing batch — it is a question. The two-phase investigation that decides whether the result or the process was wrong, and why "invalidate and retest" is the classic finding.
Stability Testing & Shelf Life →
How a shelf life is actually justified — real-time and accelerated conditions, the ICH climatic zones, and why you cannot simply average three batches to a number.
Analytical Method Lifecycle (ICH Q2/Q14) →
Validation is not a one-time gate at the end — ICH Q14 reframed a method as something developed, validated, and managed across a lifecycle, and it changed what a post-approval method change requires.
Extractables & Leachables (E&L) →
Extractables are what a container could release under stress; leachables are what actually migrates into the product in real life — and confusing the two is why E&L programs over- or under-test.
Biocompatibility (ISO 10993) →
Biocompatibility is not a checklist of tests to run — ISO 10993-1 reframed it as a risk-based evaluation, and testing is what you do only where existing data leaves a gap.
Clinical Evaluation & the CER →
The clinical evidence that a device is safe and performs — why the how-to guidance and the legal requirement come from two different documents, and why the CER is never "done".
Nitrosamine Impurities →
The contamination saga that has run since 2018 — why nitrosamines forced a whole-industry risk assessment, where they come from, and why this is a living page tied to the intelligence feeds, not a fixed limit.
ATMPs: Cell & Gene Therapy Manufacturing →
When the batch is one patient, the process is the product, and starting material is a living donation, the classical GMP model bends — why advanced therapies needed their own rulebook.
Established Conditions (ICH Q12) →
The line between what legally binds your marketing application and what your quality system can change on its own — and why drawing it well is worth months of approval time.
PACMP: Post-Approval Change Management Protocol →
A regulatory agreement you make before a change — describe it, agree the tests and the lower reporting category up front, then execute later at speed instead of waiting on a supplement.
ICH E6(R3): The 2025 GCP Overhaul →
The restructured Good Clinical Practice guideline — Principles + Annex 1, quality-by-design, RBQM, and what changes for sponsors and sites.
EU MDR & IVDR Transition Timelines →
The extended MDR (2023/607) and IVDR (2024/1860) transition deadlines by device class — and the conditions to keep legacy devices on the market.
AI/ML Validation in GxP →
Validating machine-learning and AI systems in regulated environments — data provenance, model lifecycle, and the static-vs-adaptive distinction.
FDA QMSR Transition →
FDA's Quality Management System Regulation harmonizes 21 CFR 820 with ISO 13485 — what changes and what stays.
Continued Process Verification →
Stage 3 of process validation — ongoing monitoring, trending and statistical control that proves the process stays validated.
GDocP: Recording Defensible GxP Data →
The GDocP rules — attributable, legible, permanent records — that turn a GxP activity into defensible evidence.
Contemporaneous Recording →
The "C" in ALCOA — recording at the time of the activity — and why deferred entries are a data-integrity finding.
PV Audits & Inspections →
How the PV system is assured — risk-based internal audit, the CAPA loop, and what a GVP inspection actually examines.
GEP: Engineering Behind Qualification →
The engineering foundation beneath qualification — science- and risk-based design, documentation, and the GEP/GxP boundary.
Bacterial Endotoxins Test →
The LAL-based assay used to detect and quantify bacterial endotoxin in parenteral products, water systems, and components.
Sterility Testing →
The compendial test used to verify the absence of viable microorganisms in a sterile product batch, and why a pass does not prove sterility assurance.
Visual Inspection & Particulates →
The 100% and statistical inspection programs that catch visible particulate matter and container defects before a sterile product is released.
Comparability Under ICH Q5E →
The ICH framework for showing that a manufacturing change to a biotechnological or biological product has not adversely affected its quality, safety, or efficacy.
Excipient GMP →
Why pharmaceutical excipients — the “inactive” majority of most formulations — are governed by an industry-consensus GMP guide rather than a single binding global regulation.
Analytical Method Transfer →
The documented process of demonstrating a receiving laboratory can execute an already-validated analytical method with equivalent performance to the originating laboratory.
Reference Standards and Reagents →
The characterized materials every identity, purity, and potency result is measured against — and why their qualification and lifecycle management are as GMP-critical as the test method itself.
Qualified Person Batch Release →
The EU regulatory checkpoint that certifies each batch of medicinal product before it reaches the market.
Management Review →
The periodic, top-management review of quality-system performance that closes the loop from operational data to resourcing and strategy.
Internal Audit and Self-Inspection →
The organisation’s own systematic check on whether it is actually complying with GMP and its own procedures.
GxP Training and Competency →
The documented process that establishes and maintains that personnel are qualified, by education and training, for the GxP tasks they perform.
Quality Metrics Program →
The set of trended indicators an organisation tracks to know whether its quality system is actually working, before a regulator has to tell it otherwise.
Supplier Audit Program →
The structured, risk-based program of on-site and remote audits an organisation runs to verify that its critical suppliers actually meet the quality expectations they were qualified against.
Knowledge Management (ICH Q10) →
The systematic approach to acquiring, analysing, storing, and disseminating product and process knowledge across the entire product lifecycle.
Software Supply-Chain Security & SBOM →
Third-party components, software bills of materials, vulnerability intake, and supplier assurance for the software a regulated organisation did not write.
Identity & Access Management in GxP Systems →
Unique identity, authority checks, segregation of duties, privileged access and periodic review — the controls that make a GxP record attributable.
Cyber Incident Response for Regulated Records →
What happens to GxP records, batch disposition and reporting clocks when a security incident lands — and why containment is only half the response.
Regulatory Classification & Pathway Strategy →
What the product legally is in each market, which authorisation route follows, and why the rationale has to be written down.
Health-Authority Engagement →
Meetings, scientific advice, questions and responses — and why every undertaking given becomes a commitment the organisation is held to.
Regulatory Submission Strategy & Planning →
The CTD, the eCTD, and how a dossier plan built on dependencies rather than document counts survives contact with a filing date.
Establishment Registration & Licensing →
The permissions the business actually runs on — registrations, manufacturing and wholesale licences, importer roles — and why they lapse quietly.
Labelling, Artwork & Promotional Compliance →
Approved labelling and its translations, artwork under change control, and the boundary between an authorised claim and promotion.
Regulatory Policy & Standards Engagement →
Engaging with regulation while it is still being written — consultations, standards development, harmonisation — and routing what you learn back inside.
Cybersecurity Governance in Regulated Organisations →
Who owns cyber risk, what residual risk the business has actually accepted, and how an ISMS meets a pharmaceutical quality system.
Asset Inventory & Attack Surface →
Every other control depends on knowing what exists — and in regulated manufacturing the forgotten assets are the ones connected to production.
Data Privacy & Protection in GxP Environments →
Where GDPR meets GxP record-keeping — the retention-versus-erasure conflict, health data as a special category, and encryption that survives an audit trail.
Network, Cloud & Endpoint Security for GxP Systems →
Segmentation as the control that stops an ordinary compromise becoming a production outage — plus cloud responsibility and endpoints that cannot be touched.
Third-Party Cyber Risk in Regulated Supply →
Suppliers hold credentials into the estate and copies of regulated data — and concentration is the risk that appears on nobody’s register.
Vulnerability & Patch Management Under Change Control →
Most compromises exploit something known and unpatched — and in validated environments the window between disclosure and remediation is structurally wider.
Business Continuity & Recovery →
Ransomware made recovery the primary control — and in regulated manufacturing a system that is running again is not yet back in a validated state.
Security Awareness & Human Factors in GxP →
People are the most-attacked control and the fastest detector — and which one dominates depends entirely on whether reporting a mistake is safe.
Management Accountability & Decision Rights →
Regulators hold an organisation to decisions, not intentions — and "everyone assumed someone else had checked" is a decision-rights failure.
Manufacturing Strategy & Operating Model →
Campaign or dedicated, in-house or contract — each model concentrates a different risk, and the control burden follows the choice.
Operational Excellence in Regulated Manufacturing →
Most waste in regulated manufacturing is rework, investigation and delay caused by poor control — so improvement and compliance rarely trade off.
Operational Readiness, Startup & Ramp-Up →
The deviation rate during ramp-up is the highest the process will ever see — and that is the clearest information about it anyone will get.
Requirements Traceability & Critical Aspects →
Traceability converts a stack of test results into an argument — that the testing covered what mattered, which is the question actually asked.
Maintaining the Validated State →
Validation is a claim about the present, maintained by work nobody sees — and most loss of validated state is cumulative and undramatic.
Candidate Selection & Intended Use →
The intended use written here propagates into classification, clinical design, labelling and the whole control strategy.
Formulation & Product Design →
Design fixes most of the risk and most of the cost before manufacturing begins — and operations carries what design left behind.
Process Characterisation & Design Space →
Process understanding is what makes validation an argument rather than a demonstration.
Clinical Development Strategy →
A trial that runs perfectly against the wrong question wastes years and exposes participants for nothing.
Protocol Design, Estimands & Study Design →
Complexity added in the protocol multiplies across every participant at every visit — and falls on people who had no part in writing it.
Site Feasibility, Startup & Management →
Sites are where the protocol meets reality — and a site activated before it is ready produces the deviations that consume the study.
Study Closeout & Results Disclosure →
Disclosure obligations are legal duties with deadlines, enforced independently of how the trial went.
Safety Governance & Benefit-Risk →
Benefit-risk changes as evidence accumulates — and where safety governance reports into commercial ownership, the structure itself is a finding.
Postauthorisation Studies & Real-World Evidence →
Real-world data were collected for another purpose — whether they can support the question is a judgement that must be made explicitly.
Medical Information & Inquiry Handling →
A high-volume front door through which adverse events and complaints arrive disguised as questions.
Safety Systems & Partner Data Exchange →
Every exchange with a partner is a place a case can be delayed or lost — and reconciliation only works if it is periodic and two-way.
Supply Network Strategy & Resilience →
Qualification lead times mean an alternative source cannot be created during a disruption — you supply from the network you built.
Materials, Components & Packaging Controls →
A specification that omits an attribute the process depends on will be met by material that does not work — and the supplier will be right.
Quality & Technical Agreements →
It decides who does what when something goes wrong — written while nothing has.
Procurement & Contracting for Regulated Supply →
Procurement decisions create quality obligations that quality did not negotiate.
Shortage Prevention & Supply Continuity →
Most shortages trace to a single site or upstream supplier — which makes them foreseeable from the network map long before they occur.
Workforce Planning & Critical Skills →
Qualification takes months, so staffing gaps cannot be closed at the speed they open.
Learning, Training & Effectiveness →
Retraining a person who already knew the procedure addresses nothing — effectiveness evaluation is what separates a capability gap from a convenient CAPA.
Human Performance & Work Design →
Human error is an outcome, not a cause — treating it as a cause ends the investigation where the useful information starts.
Organisational Change & Adoption →
A change implemented but not adopted prohibits the old way without establishing the new one — and people improvise in the gap.
Cross-Functional Collaboration & Escalation →
Most regulated failures cross a functional boundary — the organisation had the information and never assembled it in one place.
Network, Capacity & Capital Strategy →
Capacity that is technically available but concentrated in one site is a supply risk no downstream quality work can offset.
Systems Completion & Turnover →
Turnover is the moment accountability moves — declared with open items, qualification begins on an asset nobody can fully describe.
Laboratory Network & Operating Model →
Testing scattered across laboratories with different quality systems produces results that are individually defensible and collectively inconsistent.
Sampling Plans, Specifications & Standards →
A result describes the sample — and the sample describes the batch only if the plan makes it representative.
Laboratory Capacity, Flow & Turnaround →
A laboratory running permanently at capacity has no slack for an investigation — which is exactly when it will be asked to do one.
Digital Strategy & Application Portfolio →
Regulated organisations accumulate systems faster than they retire them, and each carries a validation obligation for life.
Platforms, Cloud & Infrastructure for GxP →
Moving to a managed platform moves the work, not the accountability.
Analytics & Decision Support in GxP →
Self-service lets a good question be answered quickly and lets a wrong metric spread before anyone checks it.
Records, Content & Retrieval →
A record that cannot be found within the time an inspection allows is functionally missing.
Digital Service Management in Regulated Operations →
The validated state is maintained or lost in routine service management, not in projects.
Portfolio Strategy & Prioritisation →
A programme approved without the capacity to support it fails during scale-up, when the alternatives have expired.
Business Cases & Investment Decisions →
A business case is a set of assumptions that become commitments — and the optimistic ones are absorbed by functions that were not consulted.
Capital Planning & Project Economics →
Contingency cut at approval reappears as scope reduction during execution — and the scope cut is usually qualification and spares.
Demand, Capacity & Scenario Planning →
Forecast error becomes either shortage or write-off — and the shortage side carries patient harm.
Insurance, Liability & Risk Transfer →
Insurance is a control with conditions attached — and cover voided by a control you did not maintain transfers nothing.
EHS Governance in Regulated Sites →
A site can be fully GMP-compliant while operating an unpermitted discharge — the two systems share rooms and people and need one view.
Occupational Safety in Regulated Manufacturing →
Personal protection and product protection are the same gowning decision made for two reasons — and they can conflict.
Process Safety in Pharmaceutical Operations →
The leading indicators are ordinary — deferred maintenance, bypassed interlocks, changes assessed for product and not for hazard.
Biosafety & Biological Containment →
Containment protects people from the product; cleanroom design protects the product from people — and they impose opposite pressure regimes.
Potent Compounds & Specialised Hazards →
One toxicological assessment, two obligations — the limits driving cleaning validation and containment come from the same work.
Environmental Compliance & Permits →
A permit breach can stop production as effectively as a quality event — and pharmaceutical effluent carries specific scrutiny.
Sustainability in Regulated Operations →
Every meaningful sustainability change in a regulated plant is a GMP change — and public claims are now regulated in their own right.
Physical Security & Site Protection →
Someone in the room can defeat most logical controls — and controlled substances carry federally prescribed security, not risk-based security.
Emergency Management & Crisis Response →
An evacuation that abandons a batch mid-process creates a quality decision — far easier to make if it was anticipated.
Construction & Contractor Safety on Live Sites →
The activity that endangers a worker — a breached wall, an isolation, hot work — is the one that threatens the area beside it.
Protect vs Disclose — The Trade-Secret Seam →
One obligation requires the method and the data behind a regulated product to be written down and filed; another says their commercial value is that they are not. Where the two meet, and which disclosure bites hardest.

QMS: frequently asked questions

Reference answers on Quality Management Systems — what it governs, what regulations define it, and what it requires.

What is a Quality Management System (QMS) in GxP?

A QMS is the overarching structure that ties every GxP discipline together — covering management responsibility, CAPA, change management, and continual improvement across the product lifecycle. It is the system that turns isolated controls into a coherent, sustained state of control, connecting deviations to CAPA, CAPA to change control, and performance back to management review.

What standard defines the pharmaceutical QMS?

In pharma the model is the Pharmaceutical Quality System of ICH Q10, which aligns with ISO 9001 quality-management concepts. It sets out management responsibility, a continual-improvement objective, and the process for change management and CAPA across the entire product lifecycle.

How does the QMS relate to FDA Quality Management Maturity (QMM)?

FDA’s Quality Management Maturity (QMM) program rates the maturity of exactly the QMS described by ICH Q10 — how well management review, CAPA, and change management function as a connected system. A mature QMS is what prevents a single problem from becoming a recurring pattern.

THE FRAMEWORK

How SPEQ maps this discipline across the three layers →

FDA QMM

The maturity of the quality system behind this discipline →