How do life sciences companies build a quality management system that actually steers day-to-day operations rather than merely satisfying the standard?
We implement, optimize and audit quality management systems (QMS) to ISO 13485:2016, ISO 9001:2015 and GMP requirements: process landscape, document control, CAPA and management review. More common than a missing SOP is an unused QMS: formally certified, avoided by the line because effort and operational benefit drift apart.
Overview
Which QMS challenges arise in regulated industries?
QMS implementation and audit support for Pharma, Biotech, MedTech & IVD · ISO 13485:2016, ISO 9001:2015, EU GMP Guide
Last updated: June 13, 2026
A functioning quality management system is a prerequisite for every regulatory approval and for every successful audit. In practice, a QMS rarely fails because of missing documents, but because of the gap between formal conformity and the way the system is actually run day to day.
- Choice of standard and scope: ISO 13485:2016 is the product-specific foundation for MedTech and IVD manufacturers and is aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746); ISO 9001:2015 is the general standard; in the GMP-regulated pharmaceutical environment, the EU GMP Guide (EudraLex Volume 4) applies. Choosing the wrong foundation results in a system that does not cover the regulatory expectations.
- Control of documents and records: ISO 13485:2016 requires controlled management of documents and records with defined responsibilities and version states; a QMS without end-to-end control reproducibly generates findings in an audit.
- CAPA and complaint handling as core processes: corrective and preventive actions as well as the handling of complaints are mandatory requirements under ISO 13485:2016 and, in the GMP environment, are mapped through deviation and CAPA management. Without effective closure they remain a paper process.
- Risk-based approach: ISO 13485:2016 calls for risk-based thinking across the entire product lifecycle; for medical devices and IVD, risk management in accordance with ISO 14971 feeds directly into QMS processes.
- Growth, M&A, and recertification: rapid growth and mergers tear apart organically grown quality structures; expiring certificates become a crisis without lead time, because recertification requires preparation and audit slots.
Services
How we support you
QMS Design & Implementation
Implementation of a complete QMS in accordance with ISO 13485:2016, ISO 9001:2015, or the EU GMP Guide. Deliverable: documented process landscape, quality manual, SOP structure, responsibility matrix, and defined quality metrics, integrated into the existing organizational and operational structure.
QMS Optimization & Gap Analysis
Review of an existing QMS against the current state of the standard. Deliverable: documented gap analysis with identified process gaps and documentation deficiencies, plus a prioritized action plan that separates quick-win corrections from structural measures.
Integrated Management System (IMS)
Consolidation of multiple standards into a single shared system, for example ISO 13485:2016 and ISO 9001:2015. Deliverable: consolidated process and document structure that maps shared requirements once and enables combined certification audits.
How we work together
What it comes down to
A quality management system does not hold up because it is fully documented, but because its core processes mesh with one another.
The standard is the first thing that decides the scope: ISO 13485:2016 for medical devices and IVD, aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746), ISO 9001:2015 as the general foundation, and the EU GMP Guide (EudraLex Volume 4) in the pharmaceutical environment.
On this foundation sits document control, because without traceable version states and approvals every downstream process loses its evidentiary weight. Only on top of that come CAPA, complaint handling, and management review, which show in day-to-day operation whether the system steers or merely administers.
Reverse this order and start with SOP texts before the standard and the control framework are settled, and the documents fall apart in the audit.
The sticking point lies not in the volume of documents, but in the effectiveness of the core processes. A CAPA closed without documented root cause analysis and effectiveness verification produces recurring deviations and thus reproducible findings.
For medical devices and IVD this intensifies, because risk management in accordance with ISO 14971 feeds directly into QMS processes and a gap there propagates through design control, CAPA, and post-market surveillance.
We therefore start with the gap analysis, which identifies which process is critical before SOPs are written and audit slots are booked. Whatever is left undone surfaces in the certification audit at the latest, and there it delays the entire undertaking.
Our approach
Our approach
Step
Result
QMS Assessment
Inventory of the existing system and determination of the governing standard (ISO 13485:2016, ISO 9001:2015, or EU GMP Guide) for the scope.
Gap Analysis
Documented gaps against the current state of the standard, prioritized by criticality and effort.
Process & Document Architecture
Defined process landscape, document hierarchy, and responsibilities, including control of documents and records.
Implementation of Core Processes
Effective CAPA, complaint, and management review processes, linked in the MedTech/IVD context to risk management in accordance with ISO 14971.
Audit Readiness
Internal audits and mock audits conducted, findings closed, certification body coordinated.
Certification & Maintenance
Successful certification or surveillance audit and a QMS that is steered through management review and metrics.
Common pitfalls
Where projects commonly fail
The QMS formally satisfies the standard but is not used by the line organization.
Documentation effort and operational benefit drift apart, and the SOP landscape describes a target process that no one follows. In the audit, the gap between description and actual practice becomes apparent.
The wrong standard is made the foundation.
MedTech and IVD manufacturers build on ISO 9001:2015, even though ISO 13485:2016 is the product-specific foundation aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746); the missing product safety and risk orientation surfaces at the latest during conformity assessment.
CAPA is run as a documentation obligation instead of an effectiveness process.
Actions are opened and closed without evidence of root cause analysis and effectiveness verification; recurring deviations show that the actual root cause was never addressed.
The control of documents and records is incomplete.
Version states, approvals, and responsibilities are not consistently traceable; ISO 13485:2016 requires exactly this control, which is why such gaps reproducibly lead to nonconformities in the audit.
Recertification is planned too late.
The expiry of a certificate and the lead time for audit slots are underestimated; without timely preparation, the surveillance or recertification becomes a crisis rather than a routine.
Quality Management & Compliance
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
Sources
- ISO 13485:2016 - Quality management systems for medical devices (primary text)
- ISO 9001:2015 - Quality management systems (primary text)
- ISO 14971 - Application of risk management to medical devices
- EU GMP Guide (EudraLex Volume 4) - primary text
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Related insights
All insights →Regulations & standards considered
- ISO 13485:2016 (Quality management systems for medical devices)
- ISO 9001:2015 (Quality management systems - general standard)
- ISO 14971 (Application of risk management to medical devices)
- EU GMP Guide (EudraLex Volume 4)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
Related topics
ISO 13485 Certification →
The path to certification under ISO 13485:2016
ISO Audits at a Glance →
Audits and certification preparation for the QMS
CAPA Management →
CAPA as a QMS core process under ISO 13485:2016
GMP Consulting (Good Manufacturing Practice) →
Pharmaceutical Quality System in accordance with the EU GMP Guide
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +39 02 8904 1000
info@theentourage.it
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences