Pharma
- What applies
- EU GMP Guide (EudraLex Volume 4) carries the pharmaceutical quality system, ISO 9001 the general one.
How do life sciences companies build a quality management system that actually steers day-to-day operations rather than merely satisfying the standard?
We implement, optimize and audit quality management systems (QMS) to ISO 13485:2016, ISO 9001 and GMP requirements: process landscape, document control, CAPA and management review. More common than a missing SOP is an unused QMS: formally certified, avoided by the line because effort and operational benefit drift apart.
Overview
Which QMS challenges arise in regulated industries?
QMS implementation and audit support for Pharma, Biotech, MedTech & IVD · ISO 13485:2016, ISO 9001, EU GMP Guide
Last updated: October 7, 2026
A functioning quality management system is a prerequisite for every regulatory approval and for every successful audit. In practice, a QMS rarely fails because of missing documents, but because of the gap between formal conformity and the way the system is actually run day to day.
- Choice of standard and scope: ISO 13485:2016 is the product-specific foundation for MedTech and IVD manufacturers and is aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746); ISO 9001 is the general standard; in the GMP-regulated pharmaceutical environment, the EU GMP Guide (EudraLex Volume 4) applies. Choosing the wrong foundation results in a system that does not cover the regulatory expectations.
- Control of documents and records: ISO 13485:2016 requires controlled management of documents and records with defined responsibilities and version states; a QMS without end-to-end control reproducibly generates findings in an audit.
- CAPA and complaint handling as core processes: corrective and preventive actions as well as the handling of complaints are mandatory requirements under ISO 13485:2016 and, in the GMP environment, are mapped through deviation and CAPA management. Without effective closure they remain a paper process.
- Risk-based approach: ISO 13485:2016 calls for risk-based thinking across the entire product lifecycle; for medical devices and IVD, risk management in accordance with ISO 14971 feeds directly into QMS processes.
- Growth, M&A, and recertification: rapid growth and mergers tear apart organically grown quality structures; expiring certificates become a crisis without lead time, because recertification requires preparation and audit slots.
Industries
What this means in your industry
Biotech
- What applies
- EU GMP Guide (EudraLex Volume 4) and ISO 9001 apply as in pharma.
MedTech
- What applies
- ISO 13485:2016 carries the QM system under the MDR (EU) 2017/745, ISO 14971 risk management.
IVD
- What applies
- Under the IVDR (EU) 2017/746, ISO 13485:2016 and ISO 14971 carry the same.
Services
How we support you
QMS Design & Implementation
Implementation of a complete QMS in accordance with ISO 13485:2016, ISO 9001, or the EU GMP Guide. Deliverable: documented process landscape, quality manual, SOP structure, responsibility matrix, and defined quality metrics, integrated into the existing organizational and operational structure.
QMS Optimization & Gap Analysis
Review of an existing QMS against the current state of the standard. Deliverable: documented gap analysis with identified process gaps and documentation deficiencies, plus a prioritized action plan that separates quick-win corrections from structural measures.
Integrated Management System (IMS)
Consolidation of multiple standards into a single shared system, for example ISO 13485:2016 and ISO 9001. Deliverable: consolidated process and document structure that maps shared requirements once and enables combined certification audits.
External Quality Management Representative (QMR)
Taking over the role of management representative under ISO 13485:2016 clause 5.5.2, during a vacancy or when internal capacity is short. Deliverable: responsibility and authority set in writing, reporting to top management on the effectiveness of the QMS and any need for improvement, promotion of awareness of regulatory and QMS requirements across the organization. We take responsibility for carrying out the representative's tasks, while overall responsibility for the QMS stays with top management.
How we work together
What it comes down to
A quality management system does not hold up because it is fully documented, but because its core processes mesh with one another.
The standard is the first thing that decides the scope: ISO 13485:2016 for medical devices and IVD, aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746), ISO 9001 as the general foundation, and the EU GMP Guide (EudraLex Volume 4) in the pharmaceutical environment.
On this foundation sits document control, because without traceable version states and approvals every downstream process loses its evidentiary weight. Only on top of that come CAPA, complaint handling, and management review, which show in day-to-day operation whether the system steers or merely administers.
Reverse this order and start with SOP texts before the standard and the control framework are settled, and the documents fall apart in the audit.
The sticking point lies not in the volume of documents, but in the effectiveness of the core processes. A CAPA closed without documented root cause analysis and effectiveness verification produces recurring deviations and thus reproducible findings.
For medical devices and IVD this intensifies, because risk management in accordance with ISO 14971 feeds directly into QMS processes and a gap there propagates through design control, CAPA, and post-market surveillance.
The gap analysis therefore identifies which process is critical before SOPs are written and audit slots are booked. Whatever is left undone surfaces in the certification audit at the latest, and there it delays the entire undertaking.
Our approach
Our approach
Step
Result
01
QMS Assessment
Inventory of the existing system and determination of the governing standard (ISO 13485:2016, ISO 9001, or EU GMP Guide) for the scope.
02
Gap Analysis
Documented gaps against the current state of the standard, prioritized by criticality and effort.
03
Process & Document Architecture
Defined process landscape, document hierarchy, and responsibilities, including control of documents and records.
04
Implementation of Core Processes
Effective CAPA, complaint, and management review processes, linked in the MedTech/IVD context to risk management in accordance with ISO 14971.
05
Audit Readiness
Internal audits and mock audits conducted, findings closed, certification body coordinated.
06
Certification & Maintenance
Successful certification or surveillance audit and a QMS that is steered through management review and metrics.
Common pitfalls
Where projects commonly fail
The QMS formally satisfies the standard but is not used by the line organization.
Documentation effort and operational benefit drift apart, and the SOP landscape describes a target process that no one follows. In the audit, the gap between description and actual practice becomes apparent.
The wrong standard is made the foundation.
MedTech and IVD manufacturers build on ISO 9001, even though ISO 13485:2016 is the product-specific foundation aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746); the missing product safety and risk orientation surfaces at the latest during conformity assessment.
CAPA is run as a documentation obligation instead of an effectiveness process.
Actions are opened and closed without evidence of root cause analysis and effectiveness verification; recurring deviations show that the actual root cause was never addressed.
The control of documents and records is incomplete.
Version states, approvals, and responsibilities are not consistently traceable; ISO 13485:2016 requires exactly this control, which is why such gaps reproducibly lead to nonconformities in the audit.
Recertification is planned too late.
The expiry of a certificate and the lead time for audit slots are underestimated; without timely preparation, the surveillance or recertification becomes a crisis rather than a routine.
Quality Management & Compliance
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
ISO 9001 is the general quality management standard for all industries. ISO 13485:2016 is the product-specific standard for medical device and IVD manufacturers, focused on product safety and a risk-based approach and aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746). MedTech and IVD manufacturers need ISO 13485:2016 as their foundation.
ISO 13485:2016 requires, among other things, a quality policy and objectives, management review, a risk-based approach, CAPA, complaint handling, internal audits, supplier evaluation, and controlled management of documents and records. The quality manual and SOPs provide the documented structure for this.
In the GMP-regulated pharmaceutical and biotech environment, the EU GMP Guide (EudraLex Volume 4) applies as the foundation; it sets requirements for the Pharmaceutical Quality System, deviation and CAPA management, change control, and self-inspections. ISO 13485:2016, by contrast, is the medical device standard. Companies with products in both worlds need a system that maps both sets of requirements.
Yes. An integrated management system combines multiple standards, for example ISO 13485:2016 and ISO 9001, in a shared process and document structure. Shared requirements are mapped once, and certification audits can often be combined.
ISO 13485:2016 requires a risk-based approach across the product lifecycle. For medical devices and IVD, risk management in accordance with ISO 14971 provides the methodological basis; its results feed directly into QMS processes such as design control, CAPA, and post-market surveillance.
Yes, as an external quality management representative (QMR), also as an interim QMR during a vacancy. ISO 13485:2016 clause 5.5.2 defines the management representative: the role ensures that the processes needed for the QMS are documented, reports to top management on the effectiveness of the QMS and any need for improvement, and promotes awareness of regulatory and QMS requirements. The standard speaks of a member of management, so top management formally appoints the external person to that function and ideally agrees this with the certification body beforehand. We take responsibility for carrying out the representative's tasks, while overall responsibility for the QMS stays with top management.
Sources
- ISO 13485:2016, Quality management systems for medical devices (primary text)
- ISO 9001:2015, Quality management systems (primary text)
- ISO 14971, Application of risk management to medical devices
- EU GMP Guide (EudraLex Volume 4), primary text
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Related insights
All insights →Regulations & standards considered
- ISO 13485:2016 (Quality management systems for medical devices)
- ISO 9001 (Quality management systems, general standard)
- ISO 14971 (Application of risk management to medical devices)
- EU GMP Guide (EudraLex Volume 4)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
Related topics
ISO 13485 Certification →
The path to certification under ISO 13485:2016
ISO Audits at a Glance →
Audits and certification preparation for the QMS
CAPA Management →
CAPA as a QMS core process under ISO 13485:2016
GMP Consulting (Good Manufacturing Practice) →
Pharmaceutical Quality System in accordance with the EU GMP Guide
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences