[ MATURITY LEVEL 2 OF 5 ]

Level 2: Defined

Documented, but inconsistently executed.

You have documented procedures but execution is inconsistent. The focus now is driving consistent application and introducing formal, risk-based decision-making across your operations.

What a level is not

The five levels are SPEQ’s progression, labelled synthesis. They are not the FDA’s Quality Management Maturity rating scale, no regulator assigns them, and reaching one is not a compliance status.

1
Foundational
2
Defined
3
Managed
4
Quantified
5
Optimized
[ WHAT LEVEL 2 LOOKS LIKE, DOMAIN BY DOMAIN ]

A quality system rarely sits at one level everywhere. This is the character of each of the twelve GxP domains when it is operating at Level 2 — and the move that lifts it to the next.

Documentation & Change Control

SOPs and a change form exist, but execution is inconsistent and impact assessment is thin.

TO ADVANCE →Make impact assessment substantive — force each change to identify and close its downstream actions before closure.

Risk Management & CAPA

A CAPA log exists but most entries fix symptoms and close without verification.

TO ADVANCE →Require an effectiveness check against a predefined criterion before any CAPA closes.

Validation & Qualification

Protocols exist but are executed inconsistently and treated as a one-time event.

TO ADVANCE →Adopt a risk- and science-based lifecycle (ICH Q8/Q9, ASTM E2500) so effort follows impact.

Environmental Monitoring

An EM program exists but is reactive; excursions drive activity rather than trends.

TO ADVANCE →Make limits and sample plans risk-based and tie EM to a documented contamination control strategy.

Regulatory Intelligence

Change is tracked ad hoc; awareness depends on individuals rather than a system.

TO ADVANCE →Make horizon scanning systematic with a defined source list and a routine impact-assessment step.

Clinical Quality (GCP)

SOPs and monitoring exist but oversight is one-size-fits-all and paper-heavy.

TO ADVANCE →Adopt risk-based monitoring/quality management (ICH E6(R2)/(R3)) focused on what matters to participants and data.

Nonclinical & Laboratory (GLP)

Study plans and SOPs exist but QA oversight and archiving are weak.

TO ADVANCE →Stand up a functioning GLP QA program with a defined inspection schedule and controlled archives.

Distribution & Cold Chain (GDP)

Basic GDP controls exist but excursions are handled reactively and lanes are unqualified.

TO ADVANCE →Qualify shipping lanes and containers and define excursion-assessment criteria in advance.

Pharmacovigilance (GVP)

Case processing works but signal management and the PSMF are underdeveloped.

TO ADVANCE →Stand up systematic signal management and keep the PSMF current.

Data Integrity

ALCOA+ is understood and some controls exist, but review and coverage are incomplete.

TO ADVANCE →Make audit-trail review routine and risk-based, and extend controls across all critical systems.

Engineering & Commissioning (GEP)

Basic C&Q exists but is document-heavy and duplicates vendor testing.

TO ADVANCE →Adopt a science- and risk-based approach (ASTM E2500) that leverages vendor evidence and focuses on critical aspects.

Quality Culture & Empowerment

A quality-culture policy exists on paper but the felt experience has not changed.

TO ADVANCE →Make it observably safe to raise concerns — visibly thank the messenger and act on what is raised.