Michael Sassano: GMP Series Part 6 – Quality Assurance Implementation

Authored by Michael Sassano 


Quality Assurance System Implementation 

The difference between Quality Control (QC) and Quality Assurance (QA) is not always clear. Quality Control refers to the process that analyzes every raw material, excipient, intermediate material and finished product, in the laboratory.  Quality Assurance is a complex system that includes: Site Master File (SMF), Quality Manual (QM), Main SOPs, Equipment Validation, Process Validation, Cleaning Validation, Computer System Validation, Product Quality Review, Risk Analysis, Audits and Inspections.


Site Master File

The SMF contains information about the QA policies and the site activities. Specifically, the SMF describes the products manufactured in the facility, production processes, QC procedures, positions, cleanrooms classification, HVAC, utilities, maintenance, layout, flow of personnel, product recall and countless other pieces of critical information about the site. This document is prepared by the Pharmaceutical Manufacturer and your QA team. It should not exceed 30 pages.

Quality Manual

The QM describes the organization of controlling the quality of your products. This manual can be used for employees, customers, and auditors. It is required to comply with GMP. The description of the pharmaceutical quality system in the Quality Manual  should include certain sections such as the quality policy, scope of the pharmaceutical quality system, identification of the pharmaceutical quality system processes, as well as their sequences, linkages and interdependencies, process maps and flowcharts. These varying sections depict pharmaceutical quality system processes in a visual manner and management responsibilities within the pharmaceutical quality system. The QM should be written in a clear, concise, and user-friendly style since it will be read, understood, and used by all grades of staff. This document will be prepared by your QA Team.

Main SOPs

Many standard operating procedures are required in the pharmaceutical industry. The most common SOPs are for Personnel Gowning Qualification, Equipment Qualification, Failure Investigation, Data Integrity, Documentation and Data Control, Password Policy and Data Backup and Storage for Computer Systems, Reprocessing and Reworking, Deviation Control, Product Recall, Process Validation, Corrective Action and Preventive Action (CAPA), Collection and Storage of Retained Samples of Raw Material, Out of Specification (OOS) for Pharmaceutical Results, Incident Reporting and Investigation, Discipline in Manufacturing Area, and Sampling of Finished Product. Generally, it is best practice to develop these yourself. However, general SOPs can be purchased from a Consulting Company in a standard form and adapted accordingly by your QA team.

Equipment Validation

Equipment validation ensures consistent and high-quality manufacturing of pharmaceutical products. These are a set of protocols such as User Requirements Specifications (URS), Factory Acceptance Test at the site of manufacturer (FAT), Site Acceptance Test at the site of user (SAT), and Installation Qualification (IQ), developed to ensure the equipment has been installed and configured to comply with manufacturer’s specifications. Operational Qualification (OQ)ensures the equipment performance is according to User Requirement Specification, and Performance Qualification (PQ) is recorded and verified by the QA to certify the equipment is operating in a reproducible way. The supplier of the equipment should provide these protocols; however, many times you have to either make them yourselves or hire an outside consultant. Later, these tests will be conducted by your QA team.

Process Validation

Process validation is the collection and evaluation of data which starts from the process design stage and goes through commercial production. This document establishes scientific evidence that a process is capable of consistently delivering quality products. Process validation was founded on the acknowledgement that one-time testing of a final drug product is not enough to assure public safety and high-quality patient care. For each new product manufactured in your facility, you’ll need to produce three batches of the product along with a  Process Validation Report.

Cleaning Validation

Pharmaceutical products can be contaminated with detergents, microbes, cleaning agents and other pharmaceutical products. It is necessary to have adequate cleaning procedures to prevent contamination and cross-contamination. Validation of cleaning methods are critical to ensure  your clean procedure will provide equipment to produce clean pharmaceutical products. The cleaning procedure will have to take into consideration the surfaces that are in contact with the products you are producing. It is important to quantify the number of batches between cleaning operations which will depend on your products and workflows. The cleaning validation must include the description of the operation, disassembling of equipment, sampling, analytical methods, acceptable limits of contaminants, and other critical factors. Further, the Cleaning Validation Report must include the data report of at least three unique cleaning operations.

Computer System Validation (CSV)

Your computer system validation will document a computer-based system and assure accuracy, security, reliability and consistency. The CSV is necessary to show the system is producing the right values according to specific identifiers. There must be clear protocols to prove recorded data cannot be changed nor dates or other critical data. Access controls must be put in place to prevent unauthorized people from making changes. Furthermore, authorized users must be recorded if they make changes, showing the changes they made, the time and username. Some of the CSV’s are: Laboratory Information Management System (LIMS), Chromatography Data System (CDS), Enterprise Resource Planning (ERP) Systems and Building Management Systems (BMS). These systems are developed over time with your personnel resources and specialized programmers that usually sell you the systems.

Product Quality Review (PQR)

Every year, your QA team will have to prepare a PQR for all products manufactured in the facility. Periodic reviews of all manufactured registered pharmaceutical products must be conducted to highlight overall trends and identify process improvements by verifying consistency of the existing process, trends in product data, appropriateness of current specifications for starting materials, intermediates and finished products, deficiencies not detected by routine testing and identify opportunities for product and process improvements. At the start of your business, you need to have a procedure and a protocol standardized. After first year operations, your QA team will improve and elaborate on the PQRs.

There are more methodologies in the Pharmaceutical QA, the two most important being CAPA and Risk Analysis:

Corrective Action and Preventive Action  (CAPA)

When you face an unusual situation, correct it immediately or ensure it will not happen again. This is the basis of the CAPA system. Either there is a Corrective Action which consists of fixing a deviation, defect or an unusual situation, or there is a Preventive Action which is an action to eliminate the cause of the deviation, defect or abnormal situation.

Risk Analysis

Risk analysis is an overall, continuing systematic process that reviews the risks to the quality of a pharmaceutical product. It is based in various scientific methodologies and ensures that you identify, analyze and appropriately respond to risks that may adversely affect the products or the process.

Authority Inspection

A Pharmaceutical Manufacturing facility can only operate if it is inspected and approved by the authorities. The inspection by the Authority must show the facility and the QAsystem are in place and that it complies with Pharmaceutical GMP. This inspection may take five days and may require two or three inspectors. You must be prepared on short notice and provide unlimited access to all rooms, including small spaces and outside of the facility. Their report will classify the eventual nonconformities found as critical, major or simply comments.

Time Schedule

The time schedule of QA implementation needs to be set according to the progress of the building of the facility. The major steps are initially to: buy SOPs and main documentation in standard form, recruit the QA Manager, prepare the QA plan implementation. In later phases of building, adapt the SOPs to represent the real facility and make the Equipment Qualification. Then, during startup, produce three batches of finished product for Process Validation, engage Cleaning Validation, ERP implementation and validation, and perform an Internal Audit of the QA system. Finally, get ready for Authority Inspection and answers to the Authority Inspection Report.



SMF European Union:  https://ec.europa.eu/health/sites/default/files/files/eudralex/vol-4/2011_site_master_file_en.pdf


SMF WHO: https://www.who.int/docs/default-source/medicines/norms-and-standards/guidelines/distribution/trs961-annex14-guidelinesdraftingsitemasterfile.pdf?sfvrsn=29ee9d0_2


SMF ICH 10:  https://www.fda.gov/media/71553/download


Risk Analysis FDA GuideLine:  https://www.fda.gov/media/71543/download#:~:text=Risk%20analysis%20is%20the%20estimation,in%20the%20estimation%20of%20risk.


Risk Analysis WHO GuideLine:  



Risk Analysis EMA GuideLine:



Top 200 Cannabis Lawyers

We Support

Cannabis Law Journal – Contributing Authors

Editor – Sean Hocking

Author Bios

Matt Maurer – Minden Gross
Jeff Hergot – Wildboer Dellelce LLP

Costa Rica
Tim Morales – The Cannabis Industry Association Costa Rica

Elvin Rodríguez Fabilena


Julie Godard
Carl L Rowley -Thompson Coburn LLP

Jerry Chesler – Chesler Consulting

Ian Stewart – Wilson Elser Moskowitz Edelman & Dicker LLP
Otis Felder – Wilson Elser Moskowitz Edelman & Dicker LLP
Lance Rogers – Greenspoon Marder – San Diego
Jessica McElfresh -McElfresh Law – San Diego
Tracy Gallegos – Partner – Fox Rothschild

Adam Detsky – Knight Nicastro
Dave Rodman – Dave Rodman Law Group
Peter Fendel – CMR Real Estate Network
Nate Reed – CMR Real Estate Network

Matthew Ginder – Greenspoon Marder
David C. Kotler – Cohen Kotler

William Bogot – Fox Rothschild

Valerio Romano, Attorney – VGR Law Firm, PC

Neal Gidvani – Snr Assoc: Greenspoon Marder
Phillip Silvestri – Snr Assoc: Greenspoon Marder

Tracy Gallegos – Associate Fox Rothschild

New Jersey

Matthew G. Miller – MG Miller Intellectual Property Law LLC
Daniel T. McKillop – Scarinci Hollenbeck, LLC

New York
Gregory J. Ryan, Esq. Tesser, Ryan & Rochman, LLP
Tim Nolen Tesser, Ryan & Rochman, LLP
Cadwalader, Wickersham & Taft LLP

Paul Loney & Kristie Cromwell – Loney Law Group
William Stewart – Half Baked Labs

Andrew B. Sacks – Managing Partner Sacks Weston Diamond
William Roark – Principal Hamburg, Rubin, Mullin, Maxwell & Lupin
Joshua Horn – Partner Fox Rothschild

Washington DC
Teddy Eynon – Partner Fox Rothschild