QMSQuality Management System

A Quality Management System (QMS) is the complete, documented framework a regulated manufacturer uses to consistently meet customer, regulatory and statutory requirements — and to keep getting better at it. It is not a software product, even though most companies now operate one through software. It is the system of intent: the policy that says "we will produce safe, conforming product", the procedures that explain how, the records that prove it happened, the roles that own each piece, and the improvement loops that close gaps when reality diverges from the plan.

In regulated manufacturing — pharmaceutical, medical device, food, dietary supplements, cosmetics, radiopharmaceuticals — a QMS is not optional. It is the structural prerequisite for being allowed to sell a product. FDA, EMA, MHRA, Health Canada, ANVISA, PMDA, TGA and notified bodies in the EU all inspect against a QMS framework. Without one, market authorisation lapses.

The QMS concept emerged from post-war manufacturing quality movements — Deming, Juran and Ishikawa in Japan, the US military's MIL-Q-9858A in 1959, and BS 5750 in the UK in 1979. ISO took BS 5750 and globalised it as ISO 9001 in 1987. Sector-specific extensions followed: ISO 13485 for medical devices, ISO/TS 16949 (now IATF 16949) for automotive, AS9100 for aerospace, ISO 22000 / FSSC 22000 for food safety.

FDA codified the same thinking into 21 CFR Part 820 (the Quality System Regulation, 1996) for medical devices. The pharma equivalent — cGMP under 21 CFR Part 211 — pre-dates ISO 9001 by two decades but covers the same domain in a different vocabulary. ICH Q10 (2008) was the global pharma industry's attempt to harmonise the language around a single "Pharmaceutical Quality System" model that maps cleanly onto ISO 9001 thinking.

By 2024 FDA had announced harmonisation: the new Quality Management System Regulation (QMSR, 21 CFR Part 820) incorporates ISO 13485:2016 by reference, with the transition deadline 2 February 2026. Pharma is heading in the same direction through ICH Q10. The regulatory world has converged: one QMS framework, sector-specific overlays.

Regardless of the standard you certify against, a real QMS contains the same building blocks. The names vary; the substance does not.

Pharmaceutical (21 CFR 211, ICH Q10, EU GMP Part I)

Pharma's QMS is anchored around the Master Manufacturing Record (MMR) and Batch Manufacturing Record (BMR). Two-person e-signature on formula approval, immutable batch records, QP / QA release, deviation per 211.192 and full CAPA effectiveness checks are inspectable on day one. The Pharmaceutical Quality System concept under ICH Q10 explicitly adds management responsibility, knowledge management and continual improvement on top of GMP.

Medical device (21 CFR 820 / QMSR, ISO 13485)

Device QMS pivots around the Design History File (DHF), Device Master Record (DMR) and Device History Record (DHR). Design controls (820.30) are mandatory; risk management per ISO 14971 is woven through every clause; complaint handling drives MDR reportability. From 2 Feb 2026 the QMSR explicitly adopts ISO 13485:2016 — so the QMS will read identically whether the inspector is FDA, BSI, TÜV SÜD or DEKRA.

Food and dietary supplements (21 CFR 117, 111, FSMA, HACCP / FSSC 22000)

Food QMS is anchored on HACCP / preventive controls plans, monitoring records, supplier verification (FSVP), allergen control, sanitation and recall readiness. Dietary supplements (21 CFR 111) add Master Manufacturing Record and Batch Production Record requirements that look very similar to pharma. FSMA 204 traceability (effective Jan 2026, enforcement begins Jul 2028) bolts on Key Data Element capture for foods on the FTL.

Cosmetics (MoCRA 2022, ISO 22716 GMP)

Cosmetics QMS used to be advisory; MoCRA changed that. Facility registration, product listing, adverse-event reporting, safety substantiation files and GMP per ISO 22716 are now federal obligations for any cosmetic sold in the US.

A common architectural mistake is to treat the eQMS as an island: a tool for SOPs, training, CAPA and complaints, separated from the shop floor. The result is two systems of truth: the eQMS knows the procedure says "weigh ingredient B within ±0.5 %", and the MES / paper batch record knows what the operator actually weighed. Reconciling the two takes a deviation, a meeting and a CAPA every time they diverge.

The cleanest QMS is one that runs the shop floor instead of sitting next to it. SOPs gate kiosk tasks. Training status hard-blocks login. Change control invalidates an in-flight work order. A deviation captured on the line opens a CAPA the same minute, with the BMR snapshot, weigh tickets and operator e-signatures already attached.

Software QMS (eQMS) products have been around for 25 years — MasterControl, Veeva Vault QMS, ETQ Reliance, Sparta TrackWise, Greenlight Guru, Qualio, Ideagen and dozens more. They digitised the binders, gave document control real version history, automated routing and signatures, and turned management review from a quarterly painful exercise into a dashboard. That was a leap forward circa 2005.

What they did not do is touch the shop floor. The CAPA system still gets its evidence by email from production. The change control still requires production planning to manually invalidate work orders. The training matrix is in one system and the kiosk login that should respect it is in another. The result is a defensible audit trail of QMS process, sitting on top of an undocumented gap between what the SOP says and what actually happened on the floor.

The market is now bifurcating. The mature pharma eQMS vendors (MasterControl, Veeva) are extending downward into manufacturing execution. The MES vendors (Tulip, Apprentice, Rockwell FactoryTalk, Honeywell, Werum) are extending upward into quality. The bet at the centre is that buyers want one record, not three.

1. Establish. Define quality policy and objectives, scope, applicable standards, organisational roles, and a documented quality manual.
2. Document. Write controlled SOPs, work instructions, forms and specifications. Approve and release them through document control.
3. Train. Map procedures to roles and ensure people are trained before they execute the work.
4. Execute. Operate the process. Capture records — batch records, device history records, in-process checks, environmental monitoring, calibrations.
5. Monitor. Run internal audits, trend complaints, OOS / OOT and deviations, track CAPA effectiveness, run management review.
6. Improve. Use the data to change procedures, materials, equipment, suppliers — under change control — and re-train.
7. Audit. Receive notified body / FDA / state / customer audits with a clean trail.

Mature QMSs run this loop continuously — the so-called PDCA cycle (Plan-Do-Check-Act) baked into ISO 9001 since the 1980s. ICH Q10 calls the same loop "continual improvement of process performance and product quality". The point is the same: a QMS that doesn't close the loop on its own data is just a filing cabinet.

• On-time training completion (≥ 95 % at any inspection moment).
• Document-control cycle time — request to effective — trend, not absolute.
• Deviation closure rate within the procedural target (often 30 days investigation, 90 days CAPA).
• CAPA effectiveness check completion within the committed date.
• Repeat deviation rate (the same root cause appearing within 12 months — the canary in the coal mine).
• Complaint trend versus production volume — abrupt spike is the inspector's first question.
• Internal audit findings open beyond commitment date.
• Management review cadence and action-item closure.
• Supplier non-conformance rate and supplier on-time CAPA.
• Right-First-Time (RFT) rate at batch release.

An eQMS or QMS-bearing MES is a GxP-relevant computerised system, and so falls under 21 CFR Part 11 (US), EU GMP Annex 11 (EU), and the validation expectations of GAMP 5. That means user requirements, risk-based testing (IQ / OQ / PQ), e-signature controls (Part 11.50, 11.70, 11.100, 11.200), audit trail (Part 11.10(e)), record integrity (ALCOA+), and change-control of the system itself.

FDA's 2022 Computer Software Assurance (CSA) draft guidance allows risk-proportional validation effort: cookbook for low-risk transactional features, deep evidence for high-risk record-bearing features. A modern eQMS vendor ships a validation pack so the customer is doing the customer-specific configuration testing only, not re-validating the platform from scratch.

1. Does it cover the full closed loop, or only documents + CAPA? If you still need a separate MES for execution, count that gap in the total cost.
2. Is 21 CFR Part 11 / Annex 11 e-signature, audit trail and ALCOA+ behaviour native — or a checkbox?
3. Does it ship a validation pack (URS, FRS, IQ/OQ test scripts, traceability matrix), and what's left for the customer?
4. Is the document number scheme flexible, or does it force a vendor convention?
5. Can training be hard-blocked at the point of work — kiosk login, equipment use, signature?
6. Does change control automatically invalidate in-flight work and trigger re-training?
7. How are deviations linked to the batch / device record they came from?
8. Does it support multi-site, multi-tenant deployments with site-level data segregation?
9. Cloud, on-premises or air-gapped — and is the deployment model the same code base?
10. What's the upgrade discipline — silent vendor pushes versus customer-controlled validation windows?
11. Can it survive an inspection cold-open: retrieve any document, training record, deviation, CAPA, complaint or batch record within minutes?

V5 Ultimate ships QMS as the spine of the platform — not as a bolt-on module. Document control, training, change control, deviation, CAPA, complaints, supplier quality, internal audit, management review and risk management are pre-configured with the records, roles, e-signatures and audit-trail behaviour each ISO clause or CFR section requires. They are then wired directly into execution: the operator's kiosk script is the controlled SOP, the training matrix gates login, change control invalidates in-flight work orders, deviations open with the batch / device record snapshot already attached, and CAPA effectiveness checks auto-pull subsequent batches.

Because V5 also runs the shop floor — eBMR / eDHR, LIMS, dispense, in-process control, QC, release — the QMS evidence is the execution evidence. There is no reconciliation between "what the SOP says" and "what actually happened". The same record carries both, signed by the right people, under the right effective version of the procedure, with the full audit trail and ALCOA+ behaviour built in. A regulator can open V5 cold and reach any document, training acknowledgement, deviation, CAPA, complaint, batch record or release decision in two clicks.