How do life sciences companies combine an audit-ready quality system with operational efficiency, instead of playing the two off against each other?
We build, optimize and audit quality systems for pharma, biotech, MedTech and IVD in line with ISO 13485:2016, ISO 9001:2015 and the EU GMP Guide (EudraLex Volume 4), and we connect them with process optimization methods such as Lean and Six Sigma. Audit readiness and process efficiency are not opposites: a system that only documents quality creates effort without any steering value, while a streamlined system without demonstrated effectiveness gets flagged during an audit. The real lever lies in using the same data from deviations, CAPA and metrics for both compliance and improvement.
- Pharma
- Biotech
- MedTech
- IVD
Overview
What distinguishes a steering quality system from a merely documented one?
QM system build, audit readiness and process optimization for pharma, biotech, MedTech & IVD · ISO 13485:2016, ISO 9001:2015, EU GMP Guide (EudraLex Volume 4), ICH Q10
Last updated: 2026-06-13
In regulated industries the quality system is both a prerequisite for any market authorization and a lever for operational performance. It rarely fails because documents are missing, but because compliance and operations are kept apart: audit preparation and process improvement run as separate initiatives, even though they draw on the same data. These points decide whether a system steers or merely administers:
- Choice of standard and scope: for MedTech and IVD manufacturers, ISO 13485:2016 is the product-specific basis and is aligned with MDR (EU 2017/745) and IVDR (EU 2017/746); ISO 9001:2015 is the general standard; in the GMP-regulated pharma and biotech environment the EU GMP Guide (EudraLex Volume 4) applies. The wrong basis produces a system that fails to cover the regulatory expectations.
- Pharmaceutical quality system in line with ICH Q10: the EU GMP Guide incorporates ICH Q10 as a model for a quality system across the entire product lifecycle, one that explicitly requires management responsibility, continual improvement and knowledge management. This makes improvement not a voluntary add-on but part of the GMP expectation.
- Risk-based approach: ISO 13485:2016 requires risk-based thinking across the product lifecycle; in the pharma environment, ICH Q9 makes Quality Risk Management concrete. Without a risk basis, audit findings and improvement actions are not prioritized but treated alike.
- Deviations, CAPA and metrics as a shared data foundation: deviation and CAPA data demonstrate effectiveness in an audit and at the same time show where the process is unstable. If the two analyses are run separately, the effort doubles and improvement loses its robust foundation.
- Operational excellence within the regulated framework: Lean and Six Sigma methods reduce cycle times and defect rates, but they must stay within change control and validation. A process change that ignores the qualified state creates efficiency at the expense of compliance.
Services
How we support you
QM system build & optimization
Building or reworking the quality system in line with ISO 13485:2016, ISO 9001:2015 or the EU GMP Guide. Deliverable: documented process landscape, document control, responsibility matrix and quality metrics, integrated into the existing organization.
Learn more →GMP quality system in line with ICH Q10
Building the pharmaceutical quality system along the EU GMP Guide and ICH Q10, with linked deviation, CAPA and change control processes. Deliverable: documented quality system with management review and knowledge management across the product lifecycle.
Learn more →Audit & inspection readiness
Preparation for certification, surveillance and authority audits through internal pre-reviews and mock audits. Deliverable: audit readiness report with closed findings and a coordinated process with the certification body or authority.
Learn more →CAPA & deviation management
Building effective corrective and preventive actions with root cause analysis and effectiveness checks. Deliverable: documented CAPA and deviation SOPs with traceable closure and trend analysis feeding into improvement.
Learn more →Lean & Six Sigma in the regulated environment
Process optimization with Lean and Six Sigma methods within change control and validation. Deliverable: an analyzed target process with measures to reduce cycle time and defect rate, safeguarded against the qualified state.
Learn more →Continuous improvement programs
Anchoring continual improvement as part of the quality system in line with ICH Q10. Deliverable: a defined metrics system, review cycle and action tracking that turns deviation and CAPA data into measurable process improvement.
Learn more →How we work together
What it comes down to
A quality system creates value when the same data foundation serves two purposes: the evidence in an audit and the steering of operations. The order matters here. First, the standard sets the scope: ISO 13485:2016 for medical devices and IVD, aligned with MDR (EU 2017/745) and IVDR (EU 2017/746), ISO 9001:2015 as the general basis, and the EU GMP Guide (EudraLex Volume 4) with ICH Q10 as the model of the pharmaceutical quality system in the GMP environment. On top of this sits document control, because without traceable version states every piece of evidence loses its probative value. Only then do deviation management, CAPA and change control mesh together and supply the data from which both audit findings and improvement actions are derived. Whoever starts with efficiency projects before this foundation is in place optimizes processes whose qualified state is not documented.
The central sticking point does not lie in the volume of measures, but in their linkage. A Lean initiative that streamlines a validated process but bypasses GMP change control creates efficiency at the expense of the documented state and returns as an inspection finding. A CAPA closed without root cause analysis produces recurring deviations and therefore reproducible findings. ICH Q9 orders these measures by risk through Quality Risk Management; ICH Q10 anchors continual improvement as part of the system rather than as an individual initiative. We therefore start with the cluster assessment, which makes visible which process is critical and which improvement can be demonstrated from the existing deviation and CAPA data, before audit slots are booked and processes rebuilt. This shifts the effort to where corrections are cheap, instead of into the audit, where they delay the project.
Our approach
Our approach
Step
Result
Cluster assessment
Stock-taking of the quality system, audit history and process metrics, and definition of the governing basis (ISO 13485:2016, ISO 9001:2015 or the EU GMP Guide).
Gap & risk analysis
Documented gaps against the standard and ICH Q10, prioritized by risk and effort, separating compliance obligations from efficiency potential.
System & process architecture
A defined process landscape with document control and a metrics system that uses the same data for both audit evidence and improvement.
Core processes & improvement
Effective deviation, CAPA and change control processes, combined with Lean and Six Sigma measures within change control and validation.
Audit & inspection readiness
Internal audits and mock audits conducted, findings closed, and the process coordinated with the certification body or authority.
Steering & maturity
A quality system steered through management review and metrics, with continual improvement embedded as a core element in line with ICH Q10.
Common pitfalls
Where projects commonly fail
Audit readiness and process improvement are run as separate projects.
Audit preparation collects evidence, improvement optimizes processes, and neither draws on the same data foundation of deviations and CAPA. The effort doubles, and improvement loses its robust connection to the findings that actually occur.
Lean measures bypass change control and validation.
A process is streamlined without the change being assessed against the qualified state and against GMP change control; the efficiency is there, but the validated state is no longer documented and gets flagged at the next inspection.
CAPA is run as a documentation obligation rather than an effectiveness process.
Actions are opened and closed without documented root cause analysis and effectiveness checks; recurring deviations then reveal that the actual cause was never addressed, and the same finding returns at the next audit.
The wrong standard is made the basis.
MedTech and IVD manufacturers build on ISO 9001:2015 even though ISO 13485:2016 is the product-specific basis aligned with MDR (EU 2017/745) and IVDR (EU 2017/746); the missing product safety and risk orientation gets flagged at the conformity assessment at the latest.
Continual improvement is not anchored in the quality system.
In the pharmaceutical quality system, ICH Q10 explicitly requires continual improvement and knowledge management; if this remains a loose set of individual initiatives without metrics and a review cycle, the GMP audit lacks the evidence that the system is steered across the lifecycle.
FAQ
Frequently asked questions
Sources
- ISO 13485:2016 - quality management systems for medical devices (primary text)
- ISO 9001:2015 - quality management systems (primary text)
- ISO 14971:2019 - application of risk management to medical devices (primary text)
- EU GMP Guide (EudraLex Volume 4) - primary text
- ICH Q10 - Pharmaceutical Quality System (primary text)
- ICH Q9 - Quality Risk Management (primary text)
- Writer source material quality management (output/expertise-pages/quality-management/qualitaetsmanagement)
- https://theentourage.de/quality-management-operational-excellence/
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- ISO 13485:2016 (quality management systems for medical devices)
- ISO 9001:2015 (quality management systems - general standard)
- ISO 14971:2019 (application of risk management to medical devices)
- EU GMP Guide (EudraLex Volume 4)
- ICH Q10 (Pharmaceutical Quality System)
- ICH Q9 (Quality Risk Management)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
Related topics
Quality Management →
QMS build in line with ISO 13485:2016, ISO 9001:2015 and the EU GMP Guide in detail
Good Manufacturing Practice (GMP) →
Pharmaceutical quality system in line with the EU GMP Guide and ICH Q10
Lean Six Sigma Consulting →
Process optimization within change control and validation
ISO Audit Consulting →
Audit and certification preparation for the quality system
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences