What is Quality Management in GMP?
Understand CAPA, deviations, change control, and the processes that support GMP compliance.
Quality Management in GMP – CAPA, Deviations, and Change Control
Quality management is about more than just rules and documents. It is the day-to-day system that ensures that errors are detected, analyzed, and prevented—and that the company is ready for an inspection at any time.
Quality management is a responsibility that extends across the entire organization. Management must actively support and prioritize quality, and all employees must be familiar with and follow the procedures that apply to their roles.
On this page, you'll find answers to:
- What is Quality Management in a GMP-compliant company?
- What does "compliance" mean in the life sciences?
- How to Address Quality and Compliance in Practice
- What is CAPA?
- What are deviations, and how do you handle them?
- What is change control?
- What are the authorities' requirements for employee training?
- Is Your Quality System GMP-Compliant? – Checklist.
A QMS must include, at a minimum:
- SOPs and Document Control – All procedures are documented, approved, and up to date
- Training – Employees have received documented training in relevant procedures
- Nonconformity Management – All nonconformities are recorded, investigated, and formally closed
- CAPA – Systematic Prevention and Correction of Quality Issues
- Change Control – All changes are reviewed and approved before implementation
- Internal audits – regular, independent reviews of the quality system
What is Quality Management in a GMP-compliant company?
A quality management system (QMS) is the overall framework of procedures, responsibilities, and processes that ensures products consistently meet quality requirements.
In GMP-regulated companies, a QMS is a legal requirement described in ICH Q10 and EudraLex, Vol. 4, Chapter 1.
A QMS typically involves two key quality functions—QA (Quality Assurance) and QC (Quality Control)—each of which has its own responsibilities within the system.
What is the difference between QA and QC?
Many newcomers to the industry find that the terms “QA” and “QC” are used interchangeably—but they refer to two fundamentally different functions, each with its own set of responsibilities. Confusing the two can lead to unclear lines of responsibility and gaps in the quality system.
An easy rule of thumb: QA ensures that the system is set up correctly. QC verifies that the product is manufactured correctly.
QA – Quality Assurance | QC – Quality Control | |
| Focus | Preventing System Errors | Inspect the finished product |
| Works with | Procedures, audits, CAPA, documentation | Tests, analyses, release |
| Responsibility | The entire production process | The Product and Its Specifications |
What does "compliance" mean in the life sciences?
Compliance means that the company adheres to applicable laws, regulations, and internal procedures at all times. In the life sciences, compliance is not a project—it is an ongoing state that requires active maintenance of the quality system, ongoing training, and consistent documentation.
It is important to distinguish between compliance and quality—they are not the same thing
Compliance |
Quality |
| Are we following the rules? | Does the product have the intended effect? |
| The Authorities' Perspective | The Patient's Perspective |
| To be substantiated with documentation | Supported by data and clinical results |
A culture of compliance is the responsibility of management—not just QA.
This means:
- Management actively prioritizes quality in decision-making and resource allocation
- Employees feel comfortable reporting errors and deviations without fear of repercussions
- “Inspection-ready” is not a state you achieve before the inspection—it is an ongoing standard
How to Work with Quality and Compliance in Practice
In everyday work, quality and compliance come down to three simple principles: follow approved procedures, document your actions in real time, and report deviations and errors—even when it’s uncomfortable or seems unnecessary.
The most important requirements for you as an employee:
- Follow only approved procedures (SOPs)—do not improvise
- Document everything you do—“if it’s not written down, it didn’t happen”
- Never edit documentation without ensuring traceability
- Report discrepancies—even those that seem insignificant
- Stay up to date on changes to procedures and requirements
Typical everyday situations that require action:
- If you find that a procedure is outdated, do not use it; contact QA
- A coworker asks you to sign something you didn't do yourself—refuse
- If a piece of equipment is behaving differently than usual, stop and report it
- If you're unsure whether a change requires approval, ask QA before taking any action
What is CAPA?
CAPA (Corrective and Preventive Action) is the systematic process that ensures that the cause of a deviation or quality issue is identified and eliminated—and that similar problems are prevented in the future.
CAPA is a core element of any GMP quality system.
Root cause analysis is at the heart of a good CAPA. Two commonly used methods:
- 5 Why – ask the question “why?” repeatedly until the root cause is identified
- Ishikawa / Fishbone Diagram – Identify potential causes related to people, methods, machinery, materials, and the environment
The difference between Corrective and Preventive Actions
Corrective Actions | Preventive Measures | |
| Purpose | Fix what went wrong | Prevent it from happening again |
| Starting Point | A specific deviation or error | A risk assessment or trend |
| Example | New Procedure Following an Incorrect Weighing Error | Increased Oversight for New Employees |
Example: CAPA in Practice
Start by understanding what happened, identify the root cause (not just the symptom), and close the case with documented evidence that the solution works
Step | Activity | In this example |
| 1 | An anomaly is detected | Incorrect weight recorded in the batch log three times in one month |
| 2 | Registration | Nonconformity created in QMS with date, description, and temporary quarantine of the batch |
| 3 | Root Cause Analysis | 5 Why: scale not calibrated → calibration program not updated → responsibilities not clearly defined |
| 4 | Corrective Action | Batch evaluated and released/rejected. Weight calibrated and documented. |
| 5 | Preventive action | Calibration program revised. Responsibilities assigned to specific roles. Training completed. |
| 6 | Effectiveness Evaluation | No recurrence of the same deviation within 6 months. CAPA closed by QA. |
A CAPA is not considered complete until:
- The root cause has been identified and documented
- Corrective and/or preventive actions have been implemented
- Effectiveness has been evaluated—does the solution work?
- QA has formally approved and closed the CAPA
Typical errors may include:
CAPA is being closed too quickly without a genuine root cause analysis. “We’ve spoken with the employee” is not a root cause—it’s a reaction.
The authorities are asking specifically: What does your data show to indicate that the CAPA was effective?
What are deviations?
What are deviations, and how are they handled?
A nonconformity is any occurrence in which an approved procedure, specification, or standard has not been followed. All nonconformities must be recorded, classified, and investigated—regardless of whether they appear to be insignificant.
When a discrepancy is detected — you should:
- Stop – determine whether production should be halted or the product placed in quarantine
- Register – create the deviation in the quality system immediately
- Involve QA—always in the case of critical and major deviations
- Investigate—identify the cause and assess the impact on the product and the patient
- Formally close the case—with a documented conclusion and any necessary CAPA
Deviations are classified into three levels
Level | Definition | Example |
| Critical | Direct risk to patient safety or product quality | Failure of sterility, mix-up of active ingredient |
| Major | Significant deviation from GMP requirements | Lack of QA approval for batch log |
| Minor | Minor deviation with limited impact | Late documentation of a routine checkup |
Common Errors
Deviations are resolved informally without documentation—“we just fixed it.” This is a serious GMP violation: without documentation, there is no way to learn from the incident, identify patterns, or provide evidence to the authorities.
What is change control?
Change control is the formal process that ensures that all changes to processes, equipment, raw materials, systems, or documents are evaluated, approved, and implemented in a controlled manner—before they take effect.
In GMP, it is the potential impact of a change on quality—not its magnitude—that determines whether change control is necessary.
Typical situations:
- New supplier of raw materials or packaging
- Change in production equipment or process
- Updating an SOP or batch log
- New IT system or upgrade of an existing one
- Relocating production to new facilities or equipment
Step | Activity | Description |
| 1 | Request | Describe the desired change and the reason for it |
| 2 | Risk Assessment | Assess the potential impact on quality and compliance |
| 3 | Approval | QA—and, if applicable, regulatory authorities—must approve the implementation beforehand |
| 4 | Implementation | The change will be implemented as described and documented |
| 5 | Verification: consistent, enduring, available | Confirm that the change has been implemented correctly and is working |
Regulatory Requirements for Training
GMP-regulated companies are required to ensure that all employees are trained in and understand the procedures relevant to their roles. Training must be documented and kept up to date—this is a standard inspection item for regulatory agencies such as the Danish Medicines Agency and the FDA.
The training requirements are set forth in EudraLex, Vol. 4, Chapter 2, and include, among other things:
- Basic GMP Training for All Employees
- Job-specific training in relevant SOPs
- Documented training before an employee begins working independently
- Ongoing refresher training—especially when procedures change
- Hygiene and Cleanliness Training for Production Employees
Wholesalers (GDP) must also describe internal training requirements in their quality system—and ensure that employees are kept up to date on regulatory requirements.
A typical error might be:
Training is documented as “completed,” but the employee cannot explain the content during an inspection. The authorities test understanding—not just attendance. Document what has been learned, not just that the course was held.
Checklist:
Is your quality system GMP-compliant?
Questions | Yes | No |
| Have all deviations from the past year been recorded and formally resolved? |  | |
| Do all CAPAs have a documented root cause analysis and effectiveness evaluation? | | |
| Has change control been performed for all changes made in the past year? | | |
| Is employee training documented and up to date? | | |
| Is the QMS documentation currently available and up to date? | | |
| Are you ready for an unannounced inspection—right now? | | |
Do you need to refresh your GMP knowledge, strengthen your quality system, or help new colleagues get started?
Here, you'll gain knowledge you can use for upskilling, training, and your quality-related work.
Use it in practice
- Quick exercise: Ask the team to identify two instances in their daily work where GMP principles are evident. Share and discuss.
- CAPA Reflection: Pick an old CAPA and ask: Did it work? How can we measure that? What did we learn?
- Glossary: What do 'batch', 'deviation', or 'line clearance' actually mean? Find answers in our GMP glossary
Get the GMP Glossary: App Store (iOS) or Google Play (Android)