Governance, Quality Management & Compliance

The named allocation of decision rights: who may approve, who must be consulted, who can stop work, and where a disagreement goes when two functions cannot resolve it. It is expressed in delegations, forum terms of reference, and escalation paths rather than in an org chart.

Regulators hold an organisation to decisions, not intentions. When a batch is released or a study is closed, someone with defined authority made that call against defined criteria — and the absence of that clarity is why "everyone assumed someone else had checked" appears in so many investigations.

The process model itself: which processes exist, who owns each, how they interface, and how the policy, procedure and record layers relate. It is the map that makes every other branch findable.

A quality system that exists only as a folder of procedures cannot be assessed, improved or handed over. Architecture is what lets an organisation answer "what happens when X changes" without convening the people who happen to remember.

Identifying what could go wrong, judging how much it matters, deciding what to do about it, and revisiting that judgement as the operation changes — at product, process and enterprise level.

Risk is the mechanism that decides how much rigour each activity deserves. Without it, an organisation either validates everything to the same depth and runs out of capacity, or picks depth by habit and under-controls the thing that actually harms a patient.

Control over the instructions people work to and the records they generate: issue, revision, approval, retention, retrieval, archival and eventual disposal, across paper and electronic systems.

The record is the only thing that survives the people. When an investigation reopens a decision made four years ago, the organisation can either produce the contemporaneous record or it cannot — and "we always did it correctly" is not an assertion a regulator can accept.

The three coupled loops that keep an operation in control: change assessed before it happens, departures investigated when they do, and corrective action verified to have worked.

This is where a quality system is judged most often, because it is where the organisation demonstrates that it notices problems, understands them, and does something that lasts. Repeat findings are read as evidence that the loop is decorative.

Planned internal audit, supplier and external audit, and readiness for unannounced regulatory inspection — including how observations are answered and how commitments made to an authority are tracked to closure.

Audit is the organisation looking at itself before someone with enforcement power does. An audit programme that never finds anything significant is not evidence of control; it is evidence that the programme is not looking where the risk is.

The indicators leadership uses to see whether the quality system is working, and the forum where those indicators produce decisions — including resource, capacity and improvement decisions.

Management review is the designed feedback loop of a quality system. Where it functions, systemic signals reach the people who control resources; where it does not, the same deviation recurs across three sites and nobody is positioned to notice.

The observable conditions that determine whether problems surface early: whether stopping the line is genuinely available, how the organisation responds to the person who reports, and whether reporting is followed by action.

Every control in this pillar depends on someone raising something. Where reporting carries personal cost, the quality system receives a filtered view of its own operation, and the filtering is invisible from inside it.

Capturing what the organisation has learned — from development, deviations, transfers and inspections — so it is reusable by people who were not there, and converting it into standard practice.

Regulated organisations lose knowledge faster than they lose documents. When the person who understood why a parameter was set leaves, the rationale becomes folklore, and the next team either cannot change it safely or changes it without understanding what it protected.