The Risk of Using the GMPs to Design Your Quality System

Jack Garvey |

Holmes on Homes

Over the last few months, I’ve become a big fan of a TV show called Holmes on Homes.   The show features super-hero contractor Mike Holmes coming to the rescue of homeowners across Canada and the United States that have been the victims of shoddy home contracting work.   Wildly successful on HGTV, Holmes on Homes provides viewers with technical insight into the highly inconsistent world of home contractors, and highlights how “doing the minimum” or worse, can result in high levels of frustration, a very big repair bill, and incredible amounts of lost time by the affected homeowners.

As I watched Mike Holmes come to the rescue week after week, it became clear to me that many of the compliance problems that we encounter within FDA-regulated companies stem from a common problem that Mike runs into, namely, building something to “minimum code.”    Now, to a lot of people, the last statement might not seem to make sense, and goes against much of what they’ve been taught.   If we try to meet minimum code, then how could that be a problem?    If our quality systems meet the minimum stated requirements of the law, then how could the FDA have a problem with them?   Why should we do more?  And even if we wanted to, what should we do?    If I have a validation program – if I have a CAPA system –  if I do annual product review or management review – if I perform calibration – haven’t I done enough?

In short, the answer to these questions is an emphatic “no!”

GMPs:  Design Document or Checklist?

The reason that following the minimum code – in this case, the GMPs (or rather, using the GMPs as the sole basis for how your quality system should function) is not sufficient to meet FDA requirements or expectations is that the GMPs are not design documents! In other words, whether it’s the GMPs, (or as Mike Holmes often finds, the building code) these documents are not, and never were, intended for the purpose of designing something that needs building.   These documents are intended solely to establish basic minimum requirements – legal requirements – but they are most certainly not design documents!    Now these documents are important – I’m not recommending you ignore the GMPs;   however, they are important within a very specific context only, i.e., the verification of the adherence of design and function of your quality system to the stated regulations and FDA expectations.     And for the purposes of this discussion, I won’t even discuss the fact that much of what is required by the FDA is not found within the GMPs and is often extremely difficult to identify and apply.

In addition, what happens within many FDA-regulated companies is that people that have no experience with the design and building of systems, even if they had the proper design documents, are given the task of designing, developing, and building these complicated quality systems, using nothing more than the minimum code – the GMPs.     As a result, these systems are almost always built without consideration of the  products’ particular technologies, intended purpose, patient population, the company’s facilities, the complexity of the processes, the company’s organizational model, personnel capabilities, risk tolerance, product supply strategies, fulfillment strategies, etc.,

Given this, it’s no wonder why there is a poor
track record of compliance within FDA-regulated industry.

Thinking further about the challenges Mike Holmes encounters, it is likely that more design effort is typically expended in building a $300,000 residential home than is spent by most companies on the quality systems that form the basis for hundreds of millions of dollars in operational spend!    At least most residential homes have blueprints – which are at least design documents;   most quality systems have nothing approximating blueprints.

Savvy companies can use these failings of their competitors to great competitive advantage.   Well designed quality systems can improve your product quality, fulfillment and compliance outcomes; can help maintain or reduce fixed costs; and will result in a more predictable supply-chain operation for executive management.   Also, well-designed quality systems can keep you on the right side of the law.   The investment in a solid quality system design effort – or often, a re-design effort – can yield better performing systems and improved inspection outcomes.

Design for Compliance Points to Consider

Given the foregoing, what are some things executives of FDA-regulated companies should consider to improve their quality systems and ensure they are designed and built to meet FDA requirements and expectations:

1)       To use an analogy, consider that that just because you live in a house, doesn’t mean you can build one! Your company’s quality team may do an excellent job with managing base business; however, that doesn’t mean they know how to design and build effective, compliant quality systems.    The skills to manage and operate within a well-designed system are not the same skills required to build one.   Get professional assistance with designing these systems for maximum outcomes and effectiveness.

2)     The FDA will not, and cannot, tell you what you need to do to comply with legal requirements.   FDA personnel are severely constrained with what they can tell you about how to comply with their regulations and expectations.  More importantly, FDA personnel aren’t quality system design professionals and really don’t know how to design quality systems for business and compliance success.    To use another analogy, would you hire a building inspector to build your house??   No, you wouldn’t.    The skills that an FDA Investigator brings to bear on assessing your operation are not the same skills that are necessary to design and build good quality systems in the first instance.

3)     Even if you were fortunate to have a well-designed quality system a number of years ago, due to the natural evolution of business operations, it’s a good bet that these systems need re-development.    Changes to your business through outsourcing, new products, changes in personnel, changes in individual procedures, acquisitions, mergers, in-licensing, etc. all create disconnects and dis-integration of systems that can create significant quality, compliance and operational failure possibilities.   Have skilled design professionals “re-engineer” your systems every few years to be sure they are operating at maximum effectiveness.

4)     Be careful with focusing too much on spending just the minimum to comply with the GMPs.     There is no bright-line of compliance when dealing with the FDA, and many a company has played the game of nickel and dime-ing quality and compliance expenditures only to be stuck with a very, very big bill later on!     The saying, “penny-wise and pound-foolish” exists for a reason, and it could not have more relevance than in the context of FDA-regulation.

Companies that look at FDA compliance as merely a checklist activity to engage in to write some SOPs for an FDA Investigator to look at when they walk in the door are doing themselves a grave disservice.     The development of FDA-compliant quality systems takes an extraordinary combination of subject matter expertise, high-level design effort, visualization, integration activities, and document drafting expertise (among other things) to ensure successful outcomes.    Although doing so requires significant investment, when you eventually have to sit across the table from an FDA Investigator, you will be able to feel confident that you are well-positioned for compliance success and ultimately, for long-term business benefits.

For further information on how to develop high-performing quality systems for pharmaceutical, medical device and other FDA-regulated companies, please contact Compliance Architects® at or call us at 888-734-9778.

7 thoughts on “The Risk of Using the GMPs to Design Your Quality System

  1. Jack,

    Great article. Can you add any thoughts on how to make sure your quality system has the flexibility built in to ensure you are compliant. I have had experiences with systems built that are so detailed that anything you do in the normal course of business becomes a nonconformance or so built up no one person or group can consider all applicable procedures and you fall into nonconformances. Talk about that balance while designing systems.


  2. Hugo, Thanks for the comment! You’re absolutely correct that good system builds are about balance — and the balance point is different for different companies. The key is to have sufficient structure to 1) cover the elements that require structure for compliance, and 2) cover the elements that your business needs to be done reproducibly, so you don’t operate by “ad hoc” management. The latter is a HUGE business benefit. I also have coined a term (I’ve only seen it used once elsewhere) that I call “structured flexibility.” The essence of this is that structure actually CREATES greater flexibility, since you spend a lot less time as a company making things up, and you are actually more flexible as an organization to address opportunities. The whole concept of e-commerce / internet commerce would be impossible without structure, as the business processes have to be tightly reproducible to be efficient and effective.

    Developing this balance point is part of the design process I mention in the main article — You need to think about this up front before you go off building documents that you THINK will solve your problem, but ultimately can create more problems than they solve.

    Thanks again!

  3. I found Jack Garvey’s article right on the money! From my 20+ years of experience in the Med Dev industry, I have seen too many efforts focused entirely on percieved compliance and not enough on inherent compliance. Even some of the “builders,” of quality systems (consultants) create what the people living in the house (executives & QA system managers) request. They often want an “off-the-shelf” system. I recently had an executive ask me why they could not just obtain a copy of the quality documents in a foreign facility and have a Notified Body audit it to get ISO 13485 Registration in their U.S. facility. (The problem exists in the ISO world too.)

    As Jack points out in his article, the process for each business has to work. This will be different, not only for each different company but even for different facilities of the same company.

    I recommend process mapping each area of the business to provide the “structure” Jack mentioned to Hugo. This process mapping exercise yields flow charts to use in writing the procedures for compliance. If it is process mapped correctly, the flexibility will be there for easier revision later.

    Brian Dense
    CiNQ systems, LLC

  4. Good Jake, there it is, and just to support you…if we just follow the RULES, put in mind THEY CHANGE, so is not rare start a building with some cGMP, and at the end …surprise THE PLANT DON’T COMPLY…Thank you ,by this opportunity and keep talking regarding this subject.

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.