Pharma
- What applies
- ICH Q10 carries the pharmaceutical quality system, ICH Q9(R1) quality risk management; manufacturing: EU GMP Guide (EudraLex Volume 4).
How do life sciences companies combine quality management and operational excellence, instead of playing an audit-ready quality system and efficiency off against each other?
We build, optimize and audit quality systems to ISO 13485:2016, ISO 9001 and the EU GMP Guide and connect them with Lean and Six Sigma. The lever is using the same data from deviations, CAPA and metrics for both compliance and improvement.
Overview
What distinguishes a steering quality system from a merely documented one?
QM system build, audit readiness and process optimization for pharma, biotech, MedTech & IVD · ISO 13485:2016, ISO 9001, EU GMP Guide (EudraLex Volume 4), ICH Q10
Last updated: October 4, 2026
In regulated industries the quality system is both a prerequisite for any market authorization and a lever for operational performance. It rarely fails because documents are missing, but because compliance and operations are kept apart: audit preparation and process improvement run as separate initiatives, even though they draw on the same data.
- Choice of standard and scope: for MedTech and IVD manufacturers, ISO 13485:2016 is the product-specific basis and is aligned with MDR (EU 2017/745) and IVDR (EU 2017/746); ISO 9001 is the general standard; in the GMP-regulated pharma and biotech environment the EU GMP Guide (EudraLex Volume 4) applies. The wrong basis produces a system that fails to cover the regulatory expectations.
- Pharmaceutical quality system in line with ICH Q10: the EU GMP Guide incorporates ICH Q10 as a model for a quality system across the entire product lifecycle, one that explicitly requires management responsibility, continual improvement and knowledge management. This makes improvement not a voluntary add-on but part of the GMP expectation.
- Risk-based approach: ISO 13485:2016 requires risk-based thinking across the product lifecycle; in the pharma environment, ICH Q9(R1) makes Quality Risk Management concrete. Without a risk basis, audit findings and improvement actions are not prioritized but treated alike.
- Deviations, CAPA and metrics as a shared data foundation: deviation and CAPA data demonstrate effectiveness in an audit and at the same time show where the process is unstable. If the two analyses are run separately, the effort doubles and improvement loses its robust foundation.
- Operational excellence within the regulated framework: Lean and Six Sigma methods reduce cycle times and defect rates, but they must stay within change control and validation. A process change that ignores the qualified state creates efficiency at the expense of compliance.
Industries
What this means in your industry
Biotech
- What applies
- ICH Q10, ICH Q9(R1) and the EU GMP Guide (EudraLex Volume 4) apply as in pharma.
MedTech
- What applies
- ISO 13485:2016 carries the QM system under the MDR (EU) 2017/745, ISO 14971:2019 risk management.
IVD
- What applies
- Under the IVDR (EU) 2017/746, ISO 13485:2016 and ISO 14971:2019 apply likewise.
Services
How we support you
How we work together
What it comes down to
A quality system creates value when the same data foundation serves two purposes: the evidence in an audit and the steering of operations. The order matters here.
First, the standard sets the scope: ISO 13485:2016 for medical devices and IVD, aligned with MDR (EU 2017/745) and IVDR (EU 2017/746), ISO 9001 as the general basis, and the EU GMP Guide (EudraLex Volume 4) with ICH Q10 as the model of the pharmaceutical quality system in the GMP environment.
On top of this sits document control, because without traceable version states every piece of evidence loses its probative value. Only then do deviation management, CAPA and change control mesh together and supply the data from which both audit findings and improvement actions are derived.
Starting with efficiency projects before this foundation is in place optimizes processes whose qualified state is not documented.
The central sticking point does not lie in the volume of measures, but in their linkage. A Lean initiative that streamlines a validated process but bypasses GMP change control creates efficiency at the expense of the documented state and returns as an inspection finding. A CAPA closed without root cause analysis produces recurring deviations and therefore reproducible findings.
ICH Q9(R1) orders these measures by risk through Quality Risk Management; ICH Q10 anchors continual improvement as part of the system rather than as an individual initiative.
The cluster assessment therefore lays out which process is critical and which improvement can be demonstrated from the existing deviation and CAPA data, before audit slots are booked and processes rebuilt. The audit is the expensive place to discover any of this.
Our approach
Our approach
Step
Result
01
Cluster assessment
Stock-taking of the quality system, audit history and process metrics, and definition of the governing basis (ISO 13485:2016, ISO 9001 or the EU GMP Guide).
02
Gap & risk analysis
Documented gaps against the standard and ICH Q10, prioritized by risk and effort, separating compliance obligations from efficiency potential.
03
System & process architecture
A defined process landscape with document control and a metrics system that uses the same data for both audit evidence and improvement.
04
Core processes & improvement
Effective deviation, CAPA and change control processes, combined with Lean and Six Sigma measures within change control and validation.
05
Audit & inspection readiness
Internal audits and mock audits conducted, findings closed, and the process coordinated with the certification body or authority.
06
Steering & maturity
A quality system steered through management review and metrics, with continual improvement embedded as a core element in line with ICH Q10.
Common pitfalls
Where projects commonly fail
Audit readiness and process improvement are run as separate projects.
Audit preparation collects evidence, improvement optimizes processes, and neither draws on the same data foundation of deviations and CAPA. The effort doubles, and improvement loses its robust connection to the findings that actually occur.
Lean measures bypass change control and validation.
A process is streamlined without the change being assessed against the qualified state and against GMP change control; the efficiency is there, but the validated state is no longer documented and gets flagged at the next inspection.
CAPA is run as a documentation obligation rather than an effectiveness process.
Actions are opened and closed without documented root cause analysis and effectiveness checks; recurring deviations then reveal that the actual cause was never addressed, and the same finding returns at the next audit.
The wrong standard is made the basis.
MedTech and IVD manufacturers build on ISO 9001 even though ISO 13485:2016 is the product-specific basis aligned with MDR (EU 2017/745) and IVDR (EU 2017/746); the missing product safety and risk orientation gets flagged at the conformity assessment at the latest.
Continual improvement is not anchored in the quality system.
In the pharmaceutical quality system, ICH Q10 explicitly requires continual improvement and knowledge management; if this remains a loose set of individual initiatives without metrics and a review cycle, the GMP audit lacks the evidence that the system is steered across the lifecycle.
Quality Management & Compliance
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
The quality management page covers the build and maintenance of the quality system in line with ISO 13485:2016, ISO 9001 and the EU GMP Guide in detail. This cluster additionally brings together audit and inspection readiness as well as operational excellence with Lean and Six Sigma, and shows how these topics connect through a shared data and metrics foundation.
No, not when they draw on the same foundation. Deviation and CAPA data demonstrate the effectiveness of the system in an audit and at the same time show where processes are unstable. In the pharmaceutical quality system, ICH Q10 already expects continual improvement, so efficiency work is part of compliance and does not stand in opposition to it.
ICH Q10 describes a pharmaceutical quality system across the entire product lifecycle and requires, among other things, management responsibility, continual improvement of processes and product quality, and knowledge management. In the GMP-regulated environment it therefore provides the framework in which operational excellence measures are anchored as part of the quality system, not as a separate initiative.
Yes, but only within change control and validation. Every process change to a qualified or validated process must be assessed through GMP change control and the validated state must be re-established and documented. An optimization that skips this step jeopardizes compliance and gets flagged at inspection.
Yes. Biotech manufacturers work predominantly in the GMP-regulated environment under the EU GMP Guide, while IVD manufacturers work under ISO 13485:2016 with alignment to the IVDR (EU 2017/746). The common core of quality system, audit readiness and data-driven improvement applies across all four industries; the specific standard basis differs by product and market.
Sources
- ISO 13485:2016, quality management systems for medical devices (primary text)
- ISO 9001:2015, quality management systems (primary text)
- ISO 14971:2019, application of risk management to medical devices (primary text)
- EU GMP Guide (EudraLex Volume 4), primary text
- ICH Q10, Pharmaceutical Quality System (primary text)
- ICH Q9(R1), Quality Risk Management (primary text)
- https://theentourage.de/quality-management-operational-excellence/
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Regulations & standards considered
- ISO 13485:2016 (quality management systems for medical devices)
- ISO 9001 (quality management systems, general standard)
- ISO 14971:2019 (application of risk management to medical devices)
- EU GMP Guide (EudraLex Volume 4)
- ICH Q10 (Pharmaceutical Quality System)
- ICH Q9(R1) (Quality Risk Management)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
Related topics
Quality Management →
QMS build in line with ISO 13485:2016, ISO 9001 and the EU GMP Guide in detail
GMP Consulting (Good Manufacturing Practice) →
Pharmaceutical quality system in line with the EU GMP Guide and ICH Q10
Lean Six Sigma →
Process optimization within change control and validation
ISO Audits at a Glance →
Audit and certification preparation for the quality system
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences