How do life sciences companies build a quality management system that actually steers day-to-day operations rather than merely satisfying the standard?
We implement, optimize, and audit quality management systems for Pharma, Biotech, MedTech, and IVD in accordance with ISO 13485:2016, ISO 9001:2015, and the GMP requirements of the EU GMP Guidelines. We build the process landscape, document control, CAPA, and management review as one coherent system. The most common failure is not a missing SOP, but a QMS that is formally certified yet not used by the line organization, because documentation effort and operational benefit have drifted apart.
- Pharma
- Biotech
- MedTech
- IVD
Overview
Which QMS challenges arise in regulated industries?
QMS implementation and audit support for Pharma, Biotech, MedTech & IVD · ISO 13485:2016, ISO 9001:2015, EU GMP Guidelines
Last updated: 2026-06-13
A functioning quality management system is a prerequisite for every regulatory approval and for every successful audit. In practice, a QMS rarely fails because of missing documents, but because of the gap between formal conformity and the way the system is actually lived. These levers determine whether a QMS holds up:
- Choice of standard and scope: ISO 13485:2016 is the product-specific foundation for MedTech and IVD manufacturers and is aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746); ISO 9001:2015 is the general standard; in the GMP-regulated pharmaceutical environment, the EU GMP Guidelines (EudraLex Volume 4) apply. Choosing the wrong foundation results in a system that does not cover the regulatory expectations.
- Control of documents and records: ISO 13485:2016 requires controlled management of documents and records with defined responsibilities and version states; a QMS without end-to-end control reproducibly generates findings in an audit.
- CAPA and complaint handling as core processes: corrective and preventive actions as well as the handling of complaints are mandatory requirements under ISO 13485:2016 and, in the GMP environment, are mapped through deviation and CAPA management. Without effective closure they remain a paper process.
- Risk-based approach: ISO 13485:2016 calls for risk-based thinking across the entire product lifecycle; for medical devices and IVD, risk management in accordance with ISO 14971 feeds directly into QMS processes.
- Growth, M&A, and recertification: rapid growth and mergers tear apart organically grown quality structures; expiring certificates become a crisis without lead time, because recertification requires preparation and audit slots.
Services
How we support you
QMS Design & Implementation
Implementation of a complete QMS in accordance with ISO 13485:2016, ISO 9001:2015, or the EU GMP Guidelines. Deliverable: documented process landscape, quality manual, SOP structure, responsibility matrix, and defined quality metrics, integrated into the existing organizational and operational structure.
QMS Optimization & Gap Analysis
Review of an existing QMS against the current state of the standard. Deliverable: documented gap analysis with identified process gaps and documentation deficiencies, plus a prioritized action plan that separates quick-win corrections from structural measures.
CAPA & Complaint Handling
Implementation of effective corrective and preventive actions and a complaint process in accordance with ISO 13485:2016. Deliverable: documented CAPA and complaint SOPs with root cause analysis, effectiveness verification, and traceable closure.
Learn more →Certification & Recertification Preparation
Preparation for external certification and surveillance audits through internal pre-reviews and mock audits. Deliverable: audit readiness report with closed findings and coordination with the accredited certification body.
Learn more →eQMS Introduction & System Migration
Selection and introduction of electronic QMS systems including data migration and training. Deliverable: validated eQMS with validation documentation in accordance with computer system validation, as well as migrated and verified legacy data.
Learn more →Integrated Management System (IMS)
Consolidation of multiple standards into a single shared system, for example ISO 13485:2016 and ISO 9001:2015. Deliverable: consolidated process and document structure that maps shared requirements once and enables combined certification audits.
How we work together
What it comes down to
A quality management system does not hold up because it is fully documented, but because its core processes mesh with one another. The standard is the first thing that decides the scope: ISO 13485:2016 for medical devices and IVD, aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746), ISO 9001:2015 as the general foundation, and the EU GMP Guidelines (EudraLex Volume 4) in the pharmaceutical environment. On this foundation sits document control, because without traceable version states and approvals every downstream process loses its evidentiary weight. Only on top of that do CAPA, complaint handling, and management review build, which reveal in operation whether the system steers or merely administers. Anyone who reverses this order and starts with SOP texts before the standard and the control framework are settled produces documents that fall apart in the audit.
The sticking point lies not in the volume of documents, but in the effectiveness of the core processes. A CAPA closed without documented root cause analysis and effectiveness verification produces recurring deviations and thus reproducible findings. For medical devices and IVD this intensifies, because risk management in accordance with ISO 14971 feeds directly into QMS processes and a gap there propagates through design control, CAPA, and post-market surveillance. We therefore start with the gap analysis, which makes visible which process is critical before SOPs are written and audit slots are booked. This shifts the effort to where corrections are cheap, instead of into the certification audit, where they delay the entire undertaking.
Our approach
Our approach
Step
Result
QMS Assessment
Inventory of the existing system and determination of the governing standard (ISO 13485:2016, ISO 9001:2015, or EU GMP Guidelines) for the scope.
Gap Analysis
Documented gaps against the current state of the standard, prioritized by criticality and effort.
Process & Document Architecture
Defined process landscape, document hierarchy, and responsibilities, including control of documents and records.
Implementation of Core Processes
Effective CAPA, complaint, and management review processes, linked in the MedTech/IVD context to risk management in accordance with ISO 14971.
Audit Readiness
Internal audits and mock audits conducted, findings closed, certification body coordinated.
Certification & Maintenance
Successful certification or surveillance audit and a QMS that is steered through management review and metrics.
Common pitfalls
Where projects commonly fail
The QMS formally satisfies the standard but is not used by the line organization.
Documentation effort and operational benefit drift apart, and the SOP landscape describes a target process that no one lives. In the audit, the gap between description and actual practice becomes apparent.
The wrong standard is made the foundation.
MedTech and IVD manufacturers build on ISO 9001:2015, even though ISO 13485:2016 is the product-specific foundation aligned with the MDR (EU 2017/745) and IVDR (EU 2017/746); the missing product safety and risk orientation surfaces at the latest during conformity assessment.
CAPA is run as a documentation obligation instead of an effectiveness process.
Actions are opened and closed without evidence of root cause analysis and effectiveness verification; recurring deviations show that the actual root cause was never addressed.
The control of documents and records is incomplete.
Version states, approvals, and responsibilities are not consistently traceable; ISO 13485:2016 requires exactly this control, which is why such gaps reproducibly lead to nonconformities in the audit.
Recertification is planned too late.
The expiry of a certificate and the lead time for audit slots are underestimated; without timely preparation, the surveillance or recertification becomes a crisis rather than a routine.
FAQ
Frequently asked questions
Sources
- ISO 13485:2016 - Quality management systems for medical devices (primary text)
- ISO 9001:2015 - Quality management systems (primary text)
- ISO 14971 - Application of risk management to medical devices
- EU GMP Guidelines (EudraLex Volume 4) - primary text
- https://theentourage.de/expertise/qualitaetsmanagement/ (existing page content, revised)
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- ISO 13485:2016 (Quality management systems for medical devices)
- ISO 9001:2015 (Quality management systems - general standard)
- ISO 14971 (Application of risk management to medical devices)
- EU GMP Guidelines (EudraLex Volume 4)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
Related topics
ISO 13485 Certification →
The path to certification under ISO 13485:2016
ISO Audit Consulting →
Audits and certification preparation for the QMS
CAPA Management →
CAPA as a QMS core process under ISO 13485:2016
Good Manufacturing Practice (GMP) →
Pharmaceutical Quality System in accordance with the EU GMP Guidelines
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences