ICH Q10 PQS audit checklist

The PQS scope must explicitly cover both drug substances and drug products, and must be adapted to the lifecycle stage. A development-stage PQS will look different from a commercial manufacturing PQS. The scope statement should be documented and periodically reviewed.

Drug substance (API) manufacturing must be within PQS scope. This includes chemical synthesis, fermentation, cell culture, and extraction processes. ICH Q11 linkage ensures development and manufacturing of APIs are covered.

Drug product (finished dosage form) manufacturing, packaging, labeling, and testing must all be within PQS scope. ICH Q8 linkage ensures Quality by Design principles are integrated. Auditors should confirm that all dosage forms in the portfolio are explicitly listed, and that the PQS governs the full chain from formulation through distribution, including any outsourced packaging or labeling operations.

ICH Q10 does NOT replace GMP — it builds on top of it. Organizations must be compliant with regional GMP (EU GMP, FDA cGMP, PIC/S, etc.) as the baseline, and use ICH Q10 to enhance their PQS beyond minimum GMP. The relationship between Q10 and regional GMP should be documented.

A mature ICH Q10 implementation can enable enhanced regulatory approaches such as real-time release testing, reduced post-approval submissions, and science-based regulatory flexibility. The PQS should demonstrate how it supports regulatory confidence.

Organizations must demonstrate their PQS achieves all three ICH Q10 objectives. This is the overarching framework: products must be realized consistently, processes must be in a validated state of control, and mechanisms for continual improvement must be active and measurable.

Product realisation means consistently manufacturing products that meet all quality attributes defined in regulatory filings. The PQS must ensure every batch meets specifications, from raw materials through final release.

State of control means validated processes operating within established parameters, monitored continuously. Organizations must have systems to detect deviations from the controlled state and respond appropriately. Quality risk management informs what to monitor and how.

Continual improvement must be systematic, not just reactive. Organizations should identify improvement opportunities from multiple data sources (CAPA, deviations, process data, complaints, audits) and implement changes that measurably reduce variability and enhance quality.

Knowledge management and quality risk management are the two foundational enablers of the PQS. They are not standalone activities but must be integrated into all PQS processes (CAPA, change management, process monitoring, management review).

Knowledge management must cover the entire product lifecycle. Organizations must have systems to capture, store, retrieve, and share product and process knowledge. This includes tacit knowledge from experienced personnel, not just documented procedures.

QRM per ICH Q9 must be integrated throughout the PQS. Risk assessments should inform process monitoring strategies, change control priorities, CAPA root cause analysis, and management review focus areas. Risk management should be proactive, not just reactive.

The PQS must be right-sized. A small single-product company does not need the same complexity as a global multi-site corporation. The system design should be justified and periodically reassessed as the organization evolves.

The organization chart must reflect quality responsibilities. The quality unit must have adequate authority and independence. Reporting lines must support escalation of quality issues to senior management.

The quality manual (or equivalent) must describe the entire PQS scope, structure, and processes. It serves as the top-level document that provides an overview of how the quality system operates and who is responsible for what.

The quality policy must be included in or referenced by the quality manual. It should be specific to pharmaceutical manufacturing, not generic boilerplate. The policy should articulate commitments to patient safety, regulatory compliance, and continual improvement. Auditors should verify that the policy is communicated to all levels of the organization and that employees can describe how their work relates to it.

The scope section must clearly define boundaries: which products, sites, operations, and lifecycle stages are included. Any exclusions must be justified. Auditors should verify that the scope is updated when new products are launched, sites are acquired or divested, or contract manufacturing arrangements change. A stale scope creates blind spots where products or processes may operate outside PQS governance.

The quality manual must show how PQS processes interact — not just list them. Visual tools (process maps, flow charts, turtle diagrams) should show inputs, outputs, and linkages between processes like CAPA, change management, monitoring, and management review.

The quality manual must clearly define who is responsible for what within the PQS. This includes quality unit authority, production management responsibilities, and senior management obligations. Organizational charts should support these definitions.

Senior management must be visibly and actively engaged with the PQS, not merely approving documents. They must demonstrate commitment through resource allocation, participation in reviews, and championing improvement.

Senior management must be personally involved in PQS design decisions, not just approving what the quality department proposes. Evidence of participation in design workshops, implementation reviews, and ongoing PQS governance is expected.

Visible support means management actions that employees can observe: attending quality events, communicating quality priorities, allocating resources, and holding people accountable for quality. 'Tone at the top' must be demonstrable.

A formal escalation process must exist with defined triggers, timeframes, and escalation levels. Critical quality issues (recalls, serious deviations, safety concerns) must reach senior management within defined timeframes.

Every unit involved in the PQS must have clearly defined roles and authority. This includes quality, production, engineering, regulatory, supply chain, and any other function that impacts product quality. Interrelationships between units must be documented.

The quality policy must be more than a generic statement. It should specifically address pharmaceutical quality, regulatory compliance, and continual improvement commitment. It must be communicated to and understood by all personnel.

Quality objectives must be SMART (specific, measurable, achievable, relevant, time-bound) and cascaded throughout the organization. Quality plans should detail how objectives will be achieved, by whom, and by when.

Resource management encompasses all types of resources needed for the PQS. Management must ensure that quality activities are not compromised by resource constraints. Resource adequacy should be periodically assessed.

Communication must be bidirectional — top-down for policy/objectives and bottom-up for quality issues/escalations. Timeliness is critical for quality escalations that may affect product on the market.

Management review is a formal governance mechanism. It must systematically evaluate PQS performance using defined inputs, and produce actionable outputs. Reviews should occur at a defined frequency (typically annual at minimum) and cover all required input topics.

All regulatory inspection outcomes, internal and external audit results, and periodic PQS assessments must be presented to and reviewed by management. Trends in findings should be analyzed across multiple inspection cycles to identify systemic weaknesses. Management must demonstrate awareness of open commitments made to regulatory authorities and track their timely closure.

The PQS itself must be periodically assessed — not just product quality. This is a meta-review: Is the quality system working? Are processes effective? Are resources adequate? This feeds into Section 4 (PQS continual improvement).

Management must monitor and discuss external factors that could impact the PQS: new regulations, updated guidelines, emerging science, technological advances, competitor recalls, supply chain disruptions. A structured horizon-scanning process should feed into management review so that the organization can proactively adapt its PQS before external changes become compliance gaps.

The four PQS elements (monitoring, CAPA, change management, management review) must feed into management review. Key metrics: CAPA closure rates, change control backlogs, process capability trends, deviation rates.

Outsourcing does not absolve the pharmaceutical company of quality responsibility. Robust qualification, monitoring, and oversight of contract organizations (CMOs, CROs, testing labs) must be maintained. Purchased materials must be controlled through qualified suppliers.

Before outsourcing any GMP activity, the contract acceptor must be qualified. This includes on-site audits, capability assessment, regulatory history review, and documented approval. Re-qualification should occur periodically.

Quality agreements must clearly define who does what, how quality issues are communicated, and what the escalation process is. This includes deviation notification, change notification, complaint handling, and recall coordination.

Ongoing performance monitoring is required — qualification alone is not sufficient. KPIs should track quality, timeliness, deviation rates, and CAPA effectiveness at the contractor. Poor performance must trigger improvement actions or de-qualification.

The PQS must address all four lifecycle stages. Goals for each stage inform what PQS elements (CAPA, change management, monitoring, review) need to focus on. Products at different lifecycle stages have different quality risks and knowledge levels.

Development must use Quality by Design (QbD) principles where applicable. Product and process understanding gained during development forms the foundation for commercial manufacturing control strategy.

CQAs must be identified through systematic scientific evaluation, not assumed. The justification for each CQA (and for attributes not designated as critical) should be documented. CQAs link directly to patient safety and efficacy.

The control strategy must bridge development and manufacturing. It defines how CPPs are controlled to ensure CQAs are met. This is the primary deliverable of QbD that carries into commercial manufacturing.

Technology transfer is not just moving documents — it requires comprehensive knowledge transfer verified through successful process execution at the receiving site. The knowledge transferred should be sufficient to establish and maintain a state of control.

Commercial manufacturing is where the PQS is most actively applied. All four PQS elements (CAPA, change management, process monitoring, management review) must work together to maintain quality during routine production.

APR/PQR is a mandatory periodic review of all batches manufactured during the review period. It must cover: batch results, deviations, changes, stability data, complaints, returns, recalls, OOS/OOT results, and process capability. Trending must identify emerging issues.

CPV is Stage 3 of the FDA process validation lifecycle. It must use statistical tools to monitor process parameters and quality attributes on an ongoing basis. CPV complements but does not replace APR/PQR.

Product discontinuation must be planned and managed. Key obligations continue after manufacturing ceases: stability monitoring, complaint handling, regulatory reporting, and document retention must continue for the required retention periods.

The four PQS elements are the operational backbone of ICH Q10. They must work as an integrated system, not as isolated processes. Output from one element feeds into others (e.g., monitoring triggers CAPA, CAPA drives change management, all reviewed in management review).

This is the ongoing vigilance system for process and product quality. It combines statistical tools (SPC, PAT), risk-based monitoring strategies, and feedback/feedforward loops. Monitoring should be proactive, not just reactive detection of failures.

Monitoring strategy must be risk-informed. High-risk parameters need tighter monitoring frequency and limits. Risk assessments should justify what is monitored, how often, and what constitutes an alert vs. action.

Appropriate statistical or analytical tools must be deployed. SPC charts, PAT instruments, and trending analysis should be used based on the nature of the process. Raw data collection without statistical analysis is insufficient.

Process monitoring must close the loop: monitoring data should trigger corrective adjustments (feedback) and predictive adjustments (feedforward). Proactive means acting on trends before out-of-specification occurs.

The CAPA system is the engine of improvement. It must be fed by multiple sources (not just deviations), use root cause analysis, and include effectiveness verification. CAPAs should be risk-proportionate — not every event needs a full investigation.

CAPA must not be limited to deviations alone. All quality data sources must feed into the CAPA system. Trending of multiple data sources should identify systemic issues that individual events do not reveal.

Root cause analysis must use structured tools (5-Why, fishbone/Ishikawa, fault tree analysis, etc.), not just narrative descriptions. 'Human error' as a root cause is almost always insufficient — the investigation should identify why the human error occurred (system, training, design).

Not every CAPA needs a full-scale investigation. Risk categorization should drive investigation depth: critical events need formal root cause analysis with full documentation, while low-risk events may need only basic assessment. The categorization system must be documented.

Every investigation must assess whether the root cause could affect other products, processes, or sites. This is critical for preventing the same failure mode from occurring elsewhere in the organization.

Every CAPA must include a planned effectiveness check. The check must occur after sufficient time/data to evaluate whether the action worked. It must also verify no unintended consequences were introduced.

Change management must be structured, risk-based, and include post-implementation review. Changes can be driven by CAPA, process improvement, innovation, or regulatory requirements. All changes must be evaluated for regulatory impact (marketing authorisation).

Every proposed change must be risk-assessed before approval. The risk assessment should evaluate impact on product quality, validated state, stability, and supply chain. Higher-risk changes need more rigorous evaluation and controls.

Every change must be evaluated for regulatory impact: does it require a variation/supplement, annual report notification, or no filing? This assessment must be documented and should involve regulatory affairs.

Change review must be cross-functional, not limited to the initiating department. Relevant experts (QA, production, engineering, regulatory, validation, stability) must evaluate each change within their domain.

After a change is implemented, a post-implementation review must verify that it achieved its objectives and did not introduce unintended consequences. The review should include data analysis over an appropriate number of batches or time period.

This is the detailed management review requirement specific to process performance and product quality (complementing the broader Section 2.6 management review). It requires specific KPIs and metrics covering all PQS elements to be reviewed by management.

The management review must include a formal assessment of whether quality objectives (set per Section 2.3) have been met. This requires measurable objectives with defined targets and actual performance data.

A defined set of KPIs must be tracked and presented at management review. These should cover all aspects of the PQS: complaints (rate, trending), recalls, deviation rates, CAPA metrics (open, overdue, effectiveness), change control metrics, product quality trends, and regulatory status.

Section 4 closes the loop: the PQS must improve itself, not just products and processes. This meta-level improvement uses inputs from management review, internal/external factors, and outputs from Section 3 PQS elements to identify ways to make the quality system more effective. Key distinction from Section 3: Section 3 improves products/processes; Section 4 improves the quality system that manages those products/processes.

This is a PQS-level management review, distinct from the product/process review in Section 2.6/3.2.4. Here, management asks: 'Is our quality system itself working? Do we need structural changes?' This review evaluates the quality system architecture, not product quality metrics.

Inspection and audit findings should be analyzed not just for individual CAPAs but for what they reveal about PQS weaknesses. Patterns in audit findings indicate systemic PQS gaps. A mature pharmaceutical organization performs cross-site and multi-cycle trending of audit observations to identify recurring themes — such as persistent document control deficiencies or training gaps — that point to structural PQS shortcomings rather than isolated incidents.

Complaint trends should be analyzed for what they reveal about PQS effectiveness. Rising complaint rates or new complaint categories may indicate PQS gaps that need structural changes. The analysis should go beyond individual CAPA resolution to identify whether clusters of complaints point to deficiencies in change control, supplier qualification, or process validation elements of the PQS. Benchmarking complaint rates against industry peers provides an external reference for PQS adequacy.

Process performance data should inform PQS design. If monitoring reveals that certain PQS processes are not effective (e.g., change control too slow, CAPA backlog growing), these are PQS improvement opportunities. Metrics such as deviation recurrence rates, CAPA closure timelines, batch rejection trending, and process capability indices should be reviewed collectively to assess whether the PQS elements governing these processes need structural redesign or additional resources.

Changes to the organization, technology, or regulatory landscape may require PQS adaptation. This input ensures the PQS remains fit-for-purpose as the environment evolves. Examples include site transfers that introduce new regulatory jurisdictions, adoption of continuous manufacturing or PAT that outpaces existing validation frameworks, mergers that create competing quality systems, and evolving ICH or regional guidance that redefines expectations for process validation or data integrity.

Each PQS management review must start with a review of actions from the previous review. Open actions must be tracked to closure. Recurring open items indicate governance failure. Effectiveness checks should confirm that the improvement achieved its intended outcome — for example, reduced deviation recurrence or shorter CAPA cycle times — rather than merely verifying that a deliverable was produced.

Environmental scanning is required for both internal and external factors. The organization must have systematic processes to identify, assess, and respond to factors that could require PQS changes. This is about organizational awareness and agility.

Internal factors that signal PQS stress or need for change must be tracked. New product introductions stress existing processes, organizational changes can disrupt quality culture, and failed batches may indicate systemic PQS weaknesses.

Regulatory intelligence is critical: new regulations, revised guidelines (ICH, FDA, EMA), and industry events (competitor recalls, warning letters) must be systematically monitored and assessed for PQS impact.

PQS reviews must produce actionable outcomes. Vague conclusions or reviews without action items indicate a governance failure. Outcomes must be specific, assigned, tracked, and communicated. Tangible outputs include revised quality objectives with measurable targets, reallocation of budget or headcount to under-resourced PQS elements, updated quality policy language reflecting strategic direction changes, and formal communication cascades that reach shop-floor personnel.

Every PQS improvement action must have an owner, deadline, and effectiveness verification plan. Open action aging should be monitored. Overdue actions must be escalated. Effectiveness verification should use predefined success criteria — for example, a measurable reduction in deviation recurrence or improved on-time CAPA closure rates — rather than simply confirming that a document was produced or a training was delivered.

PQS improvements must be communicated to the organization — not just documented in review minutes. Personnel need to understand what changed, why, and how it affects their work. Communication should reach all affected levels.