Quality Management System and Quality Oversight
This domain tests whether you can describe the quality system a cGMP site must maintain: the independence and authority of the quality unit, the elements of ICH Q10, management review, quality risk management under ICH Q9, and how deviations, CAPAs, change control and supplier oversight feed back into the system. Questions usually probe who may approve or reject, what evidence proves the system functions, and how signals escalate.
The quality unit and its authority
- 21 CFR 211.22 gives the quality control unit the responsibility and authority to approve or reject all components, containers and closures, in-process materials, packaging and labelling, and drug products, and to review production records to assure no errors occurred.
- 211.22(c) requires adequate laboratory facilities and 211.25 requires adequate staffing; authority without resources is not a compliant system.
- Production staff cannot release a batch. In the EU, the qualified person certifies the batch under Directive 2001/83/EC Article 51.
- 211.192 requires that any unexplained discrepancy or batch failure be thoroughly investigated and that the investigation extend to other batches that may be affected.
ICH Q10 elements
- Four elements: process performance and product quality monitoring; corrective and preventive action; change management; management review.
- Two enablers: knowledge management and quality risk management.
- Management review is periodic, typically annual, with inputs such as regulatory actions, complaints, deviations, CAPA effectiveness, changes, supplier performance and stability trends; outputs are decisions and resource commitments.
- 211.180(e) requires an annual review of records for each product; the EU equivalent is the product quality review in GMP Chapter 1.
Quality risk management
- ICH Q9 has two primary processes: risk assessment (identification, analysis, evaluation) and risk control (reduction, acceptance), plus communication and review.
- Common tools are FMEA, fault tree analysis, HACCP and risk ranking and filtering. Formal tools are expected for high-risk decisions.
Worked example
An aseptic site sees media fill failures rise from zero to three in a year while environmental monitoring deviations trend upward. A weak answer says retrain operators. A strong answer trends both signals together, opens one investigation linking them, scores the sterility assurance risk with a formal tool, evaluates change controls for gowning and HVAC balance, defines CAPAs with owners, and sets effectiveness checks at three and six months. The output goes to management review with a resource decision. The exam rewards the closed loop: root cause, CAPA, verification, monitoring, review.
Traps that cost marks
- Treating ICH Q10 as enforceable US law. It is guidance; Parts 210 and 211 and EU GMP Chapter 1 are the binding texts.
- Confusing a correction with a corrective action, or closing a CAPA because training was delivered, with no effectiveness check.
- Forgetting that 211.192 requires extending the investigation to related batches and products.
- Describing management review as a meeting rather than a documented decision process with outputs.