What are core elements of a quality management system (QMS)? [Examples]

Every life science company knows that quality is of the utmost importance. But defining quality and aligning that definition to regulations requires an intentional approach known as a QMS. QMS stands for quality management system and is an acronym used to describe the comprehensive system that a company uses to manage quality throughout its operations.

Before we dive into the key parts of a QMS, let’s define a quality management system and quality as a whole.

What is a QMS?

A QMS is a set of documents and processes that help an organization bring products to market that are safe and effective, meet regulatory requirements, and consistently meet customer expectations.

What is the definition of quality?

Given that we’re defining the quality system, it may be useful to understand the meaning of quality in this context. At a fundamental level, quality means that a product or service meets applicable requirements (customer, regulatory, or other).

For products, quality is often verified by inspecting the product and making sure it is the right size, color, etc., and also looking at materials records to make sure it is made of the correct materials. For a service, quality may look like adhering to processes and procedures for cleaning up a job site, using correct materials and techniques to complete the work, or simply making sure the customer receives the service they are looking for. 

What is the purpose of a QMS?

The purpose of implementing a QMS is to ensure consistent quality of products or services, especially as the organization grows and must verify that everyone is consistently meeting standards while manufacturing products or providing services.

 Having a QMS is key for most companies in the life sciences sector, but even companies in other manufacturing and service lines of business can benefit from having a QMS in place. Building an effective QMS seems like a lot of tedious paperwork and documentation, which can be time consuming and expensive, but, when implemented effectively, a QMS can result in cost savings throughout the business. 

What is an ISO 9001 quality management system?

Quality management systems are not one size fits all—each organization will need to build their own QMS to suit their needs. The primary starting point for building a QMS is to reference the ISO 9001 standard. ISO 9001: Quality Management Systems is a standard that can be applied to any type of business and provides a framework for building a QMS (it’s general enough to apply to many companies that provide services or manufacture products.)

The ISO 9001 standard has several industry specific spin-offs, most notably ISO 13485, which specifically targets QMS needs specific to medical device manufacturers. The spin-offs tend to have more stringent requirements that are tailored to the specific industry. ISO 9001 is a great place to start, then work towards other standards if they make sense. 

Of course, there are other regulations that require life science companies to have a QMS in place including FDA 21 CFR Part 820 for medical devices and 21 CFR Part 211 for drug products. Note that 21 CFR Part 820 is currently in revision to more closely align with ISO 13485. 

Building a risk-based QMS

The use of management frameworks to ensure consistent quality isn’t new, but the specifics of what makes a quality system compliant continues to evolve. Over the last 10+ years there has been increased focus on implementing a risk-based approach to quality.  This means that organizations are expected to build a QMS that has risk assessment principles built into all of the core QMS policies. Part of building a culture of quality now means a culture of risk-based thinking. 

Organizations may choose to seek certification with globally recognized standards like ISO 9001 and ISO 13485. The certification process involves having a registrar do an initial certification audit and then periodic re-assessments to ensure that the QMS remains in compliance and effectively implemented.

For medical device companies, it’s generally expected that all manufacturers will have an ISO 13485 certification. From a business standpoint, although the certification process can be costly, it may ultimately save time and money by minimizing disruptions for customer audits since having that certification will provide a level of assurance for some customers. 

Just starting or early on in your quality journey? Get helpful tips and fascinating insights from experts straight to your inbox.

9

core elements of a quality management system

A QMS structure is much like a pyramid. The pinnacle document that simply and elegantly defines the goals of the QMS is the quality policy. From there it cascades down into a quality manual, quality objectives, procedures, processes, work instructions, and more. 

Before developing and implementing a QMS, an organization must find their quality bearings. A QMS starts with a quality policy, which acts as a guiding principle for building the rest of the system. While the quality policy is just a statement, it is the ‘north star’ of the QMS and will be important for establishing a culture of quality. 

1. Quality policy

A QMS is driven by several top-level documents that guide the development of the rest of the QMS. These documents will act as anchors to ensure consistency as the rest of the QMS is developed. The top level documents for any QMS is the quality policy, quality manual, and quality objectives. When you begin creating a quality management system, the first step should be to draft a quality policy. 

Before you can do anything meaningful with a new quality management system, you first need to define what quality means within your company by writing a quality policy. A quality policy can also be your company’s mission, values, or statement of principles. Once you’ve crafted this, you’re then able to set expectations across the organization, from executives and upper-level management to supervisors and employees. The quality policy is the first step towards building a culture of quality into your organization.

A quality policy should be a simple, straightforward statement that makes it clear what the company priorities are. A quality policy can be revised down the road if necessary, but since this is a key anchoring component it is best to take some time to think it through and get it right the first time. 

Quality policy example

Let’s take a look at the following excerpt as a quality policy example and make some conclusions based on the policy:

The Widget Company is committed to building quality, compliant widgets to support our customers in their endeavors. This commitment is demonstrated through quality processes that are executed by well-trained personnel to produce consistent results every time. Our management team is dedicated to continually improving and innovating to better meet customer needs.

Based on this policy, it’s assumed that the Widget Company will  have a strong focus on processes that run well and personnel that are trained to know how to do their jobs well. It also identifies that management is responsible for continual improvement and innovation. This policy can then be used to develop quality objectives to ensure that the values outlined in the policy are adhered to.

Once the policy is established it is critical to publicize throughout the company. This should be publicly posted in the facility and personnel at all levels should be well aware of the policy. If applying for certification, ISO auditors may even quiz personnel to see if they know the policy, or at a minimum if they know where to look for it. 

2. Quality manual

A quality manual is an overview of the entire QMS that can be given to a customer or auditor to help them quickly understand how the QMS is structured and which QMS area, if any, the organization is exempt from or otherwise does not apply to their system

• Describe the scope of the QMS
• Detail the requirements of the QMS standard or framework
• List any elements of the QMS which are excluded from the implementation
• Reference specific quality procedures used within the organization
• Provide visual documentation of critical processes via flowchart
• Explain the organization’s quality policies and objectives

The quality manual should be almost an outline format and should not contain details of the procedures or processes. Flowcharts, tables, and other visual representations of the information are helpful and appropriate for the manual. The manual should also identify the hierarchy of quality documents. For example:

3.Quality objectives

These objectives are designed to encourage organizations to define strategic goals and a purpose for the QMS. Objectives translate an organization’s vision into practice by creating a link between customer requirements and specific, measurable, and attainable goals. Well-written objectives lend purpose to a quality management system initiative and establish a customer-centric culture in an organization. They also serve as guideposts to tell the organization what is working well and what areas may need more attention. 

Quality objectives should be realistic; don’t aim for the stars if you haven’t even made it to the moon yet. For example, if non-conformances have been an issue that you are now working on through quality objectives, don’t aim for perfection right out of the gate. Quality objectives should be revisited and revised periodically, so it’s okay to be realistic and then challenge yourself once things are more in control. Some example quality objectives include:

• 100% of training for new employees completed within 30 days of hire
• This goal is aligned to the quality policy with its focus on personnel training. This can be measured by looking at training records for new employees and verifying that training has been completed within 30 days. This also puts emphasis on training since management will be looking at this as part of Management Review.
• 85% of nonconformance reports closed within 45 days
• This goal makes sense for a company that has struggled with nonconformances, maybe due to a change in leadership, lack of personnel, etc. Additionally, 100% is probably not an appropriate goal for something like nonconformance reports since often you are relying on suppliers for information and there may need to be replacement product manufactured prior to closure of the report.
• Achieve zero (0) major nonconformances during ISO 13485 recertification audit.

Quality objectives should provide a clear vision for every member of the organization to understand the company’s purpose and the value of a QMS. The objectives should provide a clear metric for measuring progress against strategic goals, including the timeline for achievement and a measurable parameter of improvement.

4.Organizational structure and responsibilities

The top level documents provide a basic framework and starting point for the QMS, but they do not contain enough detail to ensure quality. A QMS needs various policies, procedures, processes, documents, and records to maintain consistent quality and document evidence of that quality.

A QMS should include a clear and current model of the organization’s structure and the responsibilities of all individuals within the organization. This is typically accomplished with an organizational chart, which visually shows the roles and the flow of responsibility. This can be embedded in the quality manual, but is typically managed as a stand alone document and referenced within the quality manual. For ISO 13485, this document should identify who is serving as a Management Representative (usually the Quality Manager). 

5. Document and records control and management

In a QMS, all documents must be controlled and all records must be retained. Think of documents as procedures, form templates, the quality manual, work instructions, approved supplier lists, and other documents that contribute to making the product in any small way. Document control means that these documents must be revision controlled so that any changes to the documents are correctly approved and evaluated for any potential effect on production or product risk. Further, these document changes must be communicated to all necessary personnel and any copies that have been distributed must be replaced with the new revision. All of these processes must be documented.

Further, an organization must have processes in place for records control and retention. Records can be thought of more like the evidence of work. So if a document is put through the revision process, all of the evidence that it was properly approved and communicated would be considered records. Key examples of records include: training records, manufacturing batch records, complaint records, nonconformance records, etc.

Effective record-keeping is crucial to the success of the QMS, the ability to obtain certification with QMS standards, and regulatory compliance. During QMS design, organizations should create specific definitions of records within the organization and policies for document creation, retention, and editing. Document and records control is commonly managed through an electronic QMS to ensure access is limited and to automate the document control process where possible.

6. Processes and procedures

The entire QMS approach to quality control is to establish standardized, replicable processes throughout the organization. This means processes out on the production floor just as much as the document control process taking place in the corporate offices. Standards for quality management require organizations to identify and define all organizational processes which use any resource to transform inputs into outputs. Virtually every responsibility in the organization can be tied to a process, including purchasing.

Initial efforts to define processes should create a high-level picture of how processes serve the organization and intersect with resources such as employees, machines, or technology. After identifying processes, organizations can begin to define standards and success metrics:

• Identify organizational processes
• Define process standards
• Establish methods for measuring success
• Document a standardized approach to ensuring quality output
• Drive continual improvement

It may be helpful to develop a process map that identifies how all of the processes are interconnected. This is useful not only for identifying potential bottlenecks that will have significant ripple effects, but also to help personnel see how their role and responsibilities has an effect on everything else in the company. Helping personnel see that their role is important to the bigger picture is helpful in building a culture of quality and personnel that know they are valued members of the team.

7. Data management and analysis

Having access to data to make data-driven decisions will allow the QMS framework to drive continuous improvement and preventative quality control activities. Data analysis should be used to identify processes or systems that are out of control as early as possible instead of waiting until major nonconformance occurs. The organization must have plans in place for collecting this data and performing statistical analysis on the data. This data may then be used to assess if the quality objectives are being met and/or other metrics that the organization has established. It is common to compile this data to create a quality dashboard to give upper management a snapshot view of how the QMS is performing. 

The types of data required to demonstrate effective QMS performance can vary significantly between organizations. However, at a minimum, it should include the following sources:

• Customer feedback
• Supplier performance
• Product and process monitoring
• Non-conformances
• Trends
• Corrective and preventive actions

These data points will also feed into an organization’s risk analysis process for products as well as for risk-based decision making pertaining to the QMS. For example, high rates of nonconformance with a specific component from a supplier may necessitate updating the risk analysis documents for any products that use that component to account for the possibility of the nonconformance making it through to finished product. Additionally, that data should be reviewed as part of the supplier review process to determine if another supplier should be sourced or if changes to the supplier evaluation process are required.

8. Continuous improvement

A QMS is most valuable to an organization when the tools and processes built into the QMS are being used for continuous improvement. This shift to innovation and improvement instead of putting out fires as they come up is where a QMS can make a huge difference in the overall trajectory of a company. Maintaining quality and process performance at consistent levels is the most basic goal of any QMS, but when fully implemented and mature, that QMS should allow for improvement of quality and processes. 

For example, continuous improvement can use kanban or similar methods to analyze a process and find ways to streamline it. This may mean reorganizing a packaging area so that production personnel can complete tasks more quickly, while also minimizing the risk for mixups on the line. 

Auditors like to see corrective and preventive actions (CAPA) that are opened for continuous improvement projects. It signals to them that the systems are in control enough that there are resources being devoted to improvement, but also shows a commitment to quality and improvement. 

9. Quality instruments

The control and calibration of tools used to measure quality are integral to the success of a QMS. If machines or equipment are used to validate products or processes, this equipment must be carefully controlled and calibrated according to industry standards. Depending on the instrument, this could involve periodic calibrations or calibration before every measurement.

The QMS system design within an organization should dictate a clear policy for the maintenance of quality instruments based on nationally or internationally recognized standards for each piece of quality equipment. This documentation should address:

• Intervals for instrument calibration
• Recognized standards for instrument calibration
• Manufacturer instructions for adjustment
• Procedures for identifying and documenting calibration
• Controls against tampering or adjustment post-calibration
• Methods to protect instruments and equipment from damage

In addition to these requirements, the QMS should address effective documentation of calibration results, including procedures for maintaining complete records of activities and calibration results.

Implementing a QMS

Quality management systems are not designed to provide a prescriptive checklist for total quality management. Instead, a QMS is intended to serve as a framework that guides the organization in achieving quality objectives, continuous improvement, and customer satisfaction. Use your QMS to keep your life sciences company’s policies and procedures aligned with launching and scaling life-saving products.

The most successful QMS implementations balance simplicity and customization. There can’t be a one size fits all QMS, since each organization is unique. A QMS needs to be purpose-built to fit an organization’s objectives, industry, and compliance requirements to have a meaningful impact on culture. The right QMS design is a mixture of flexibility and standardization. Organizations need enough standardization to produce consistent results and enough flexibility for continuous improvement to create a quality-driven culture. 

It’s important to note that having procedures written does not amount to implementation of the QMS and does not ensure compliance. A binder full of excellent and compliant procedures means nothing if there isn’t evidence to show that they are being used. Make sure that systems are setup to support the procedures and processes, training is provided, and the culture is there to ensure that personnel stick to the procedures. Even better, build a culture where employees feel comfortable suggesting improvements where processes aren’t working. 

QMS certifications

Once the QMS is implemented the organization may want to become ISO certified in ISO 9001 and/or other industry specific QMS standards such as ISO 13485.

The first step towards certification is identifying and qualifying a registrar. A registrar is an organization that certifies compliance with the ISO standard. The certification process can take awhile, so look into various registrars at least 6 months in advance to figure out any special requirements they may have and what their process is for certification. For an initial certification there will be a one or more day on-site audit that will look at your entire QMS and ensure that it is compliant with the standard(s). Once certified you will be subject to periodic recertification audits. The frequency and recertification requirements vary by registrar. 

Choosing QMS Software or electronic QMS (eQMS)

There are specific rules regarding electronic records as part of FDA 21 CFR Part 11 that can make maintaining a QMS electronically a little tricky. These regulations ensure that records and signatures are strictly controlled and cannot be edited. One of the easiest ways to ensure compliance and keep your QMS in the 21st century instead of on paper is to use QMS software. 

There are many options out there for QMS software. In most, organizations are able to purchase access to just select modules or areas that they want, or they can purchase the full suite that includes most if not all areas of the QMS. Larger organizations should definitely have an electronic QMS to assist with the burden of trying to keep track of all of the documents and records. Now that remote or hybrid work is more common, having an QMS system that can be accessed from anywhere is critical for keeping the work flowing and happier employees with greater work-life balance. 

For smaller organizations the need for QMS software isn’t always as obvious, but it can definitely benefit the company. In smaller organizations personnel often wear many hats and the QMS can help streamline things so that personnel are spending less time dealing with document and records management. Training and vendor records can be maintained through the software, making it easy to know when suppliers are due for re-evaluation and easy to show that all training records are in order when an auditor comes in. Over time, the system should pay for itself with time savings if it is a clean, easy to use system. 

When choosing an electronic QMS be sure to look for validations, 21 CFR Part 11 compliance, and modules and workflows that make sense for your organization. The initial setup of a new QMS can be onerous, so consider any setup support that the company provides. If you are just dipping your toe into the QMS software, document control and training records are typically good choices for starting out. These are manual, labor intensive processes that need input from multiple users, so they are well suited to being managed in an electronic QMS environment.

Looking for the #1 rated eQMS by quality professionals like you? Check out Qualio.