What pharmaceutical quality assurance means
In drug manufacturing, quality assurance is the function that makes sure every product released to patients was made under a system that can be trusted. In US law, that function sits in the quality control unit described in 21 CFR 211.22. It must have the responsibility and authority to approve or reject components, containers, closures, in-process materials, packaging, labeling and finished drugs; to review production records and make sure errors are fully investigated; and to approve or reject procedures and specifications affecting identity, strength, quality and purity. Its responsibilities and procedures must be written down and followed, including for drugs made under contract.
Most companies split that unit into QA (system oversight, batch record review, release, deviations, CAPA, change control, audits) and QC (laboratory testing). Regulators care less about the labels than about whether the unit is independent, resourced and actually in control.
Pharmaceutical QA vs QC
| Pharmaceutical QA | Pharmaceutical QC | |
|---|---|---|
| Core question | Was this product made under control? | Does this sample meet specification? |
| Typical work | Batch record review and disposition, deviation and CAPA approval, change control, SOP approval, supplier qualification, self-inspection, annual product review | Raw material, in-process, finished product and stability testing; method validation; lab investigations |
| Key regulations | 21 CFR 211.22, 211.100, 211.192 | 21 CFR 211.84, 211.160, 211.165 |
| Output | Release decision and quality system evidence | Test results and certificates of analysis |
The pharmaceutical quality system: ICH Q10
FDA adopted ICH Q10 Pharmaceutical Quality System as guidance in April 2009. The ICH text sets three objectives (achieve product realisation, establish and maintain a state of control, facilitate continual improvement) and four system elements:
- Process performance and product quality monitoring
- Corrective action and preventive action (CAPA)
- Change management
- Management review of process performance and product quality
Two enablers support them: knowledge management and quality risk management (ICH Q9). Q10 also places ultimate responsibility on senior management and says the quality system extends to outsourced activities and purchased materials, with competence assessed before engagement, quality responsibilities in a written agreement and ongoing monitoring.
What is CAPA in quality assurance?
CAPA is the Q10 element that investigates problems (deviations, complaints, out-of-specification results, audit findings) to find root causes, then takes corrective action to fix them and preventive action to stop them recurring. In pharma QA, the critical step is checking that the action actually worked. Investigation failures are among the most common FDA citations (see below).
Contract manufacturing and quality agreements
FDA’s 2016 final guidance on quality agreements recommends a written agreement defining which party performs which activities and which has primary responsibility for cGMP compliance, kept separate from commercial contracts because FDA may review it during inspections. With more biopharma work outsourced to CDMOs, the owner’s QA oversight of contractors is a core QA activity, not an afterthought.
What FDA cites most
The data show where pharmaceutical QA fails in practice:
- An industry analysis of FDA’s FY 2025 Form 483 data found 21 CFR 211.22(d) was the most cited drug GMP provision, with 243 observations, followed by 211.192 (investigations, 164) and 211.100(a) (written procedures, 162), out of 2,837 drug citations.
- A review of 85 drug warning letters issued in 2025 counted 54 citations of 211.22 provisions, with component testing (211.84) and validated procedures (211.100) also frequent; 15% of letters cited data integrity concerns.
The pattern is consistent: quality units that exist on paper but lack written, followed procedures, and investigations that do not reach root cause.
2026 priorities for pharmaceutical QA
- Quality management maturity. CDER’s voluntary QMM prototype assessment program entered its third year in 2026, with FDA selecting nine establishments and scoring maturity across practice areas beyond CGMP minimums. Even non-participants are using the concept to benchmark their QA systems.
- Outsourcing oversight. Quality agreements and supplier monitoring under Q10 Section 2.7.
- Data integrity. Audit trails, review of electronic records and computer system assurance.
- AI in quality work. New EU GMP drafts, including Annex 22 on AI, signal that AI used in GMP decisions will need defined intended use and validation.
Common weaknesses
- Quality unit procedures that do not describe what QA actually does.
- QA approving its own investigations without independent review.
- Root cause stated as “human error” without evidence or systemic fixes.
- Change control that assesses regulatory impact but not validation or supplier impact.
- Quality agreements with CDMOs that are outdated or silent on data integrity.
- Management review held but not documented with decisions and actions.
Checklist: pharmaceutical QA readiness
- Quality unit responsibilities and procedures are written and followed (211.22(d))
- QA is independent of production and adequately resourced
- Batch record review catches and escalates errors before release
- Investigations reach evidence-based root causes; CAPA effectiveness is verified
- Change control covers quality, regulatory, validation and supplier impact
- Quality agreements are current for every contract manufacturer and lab
- Management review covers Q10 monitoring data and records decisions
- Self-inspections test whether procedures are followed, not just present
How AskDona helps
FDA’s most cited drug GMP provision is about whether quality unit procedures exist and are followed. AskDona reads your QA procedures, batch records, investigations, CAPA files and quality agreements against 21 CFR 211, ICH Q10 or your own quality manual, and shows where each requirement is evidenced and where it is not, with citations to the page. Run a sample quality-unit evidence review against 21 CFR 211.22 before your next inspection. AskDona shows the evidence; your quality unit decides.
Editor’s note: FY 2025 citation counts come from an industry analysis of FDA’s inspection-observation dataset, which covers system-generated Form 483 observations, not all inspections. Warning letter figures come from a guest column analysing 85 letters; methods were not independently checked. Annex 22 was a draft at the time of the 2025 EU consultation. This is not legal advice.
FAQ
What does pharmaceutical quality assurance do? It oversees the quality system: approving procedures and specifications, reviewing batch records, releasing or rejecting product, managing deviations, CAPA and change control, qualifying suppliers and running self-inspections.
What is the difference between QA and QC in pharma? QC tests samples against specifications; QA ensures the whole system, including QC, is under control and makes the release decision.
What regulation defines the pharmaceutical quality unit? In the US, 21 CFR 211.22. ICH Q10 describes the broader pharmaceutical quality system.
What is a pharmaceutical quality management system? The ICH Q10 model: process monitoring, CAPA, change management and management review, supported by knowledge and quality risk management.
What is FDA’s QMM program? A voluntary CDER program that assesses how mature a site’s quality management practices are beyond CGMP requirements. Its third year began in 2026.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| 21 CFR 211.22 (LII) | Regulation | Quality unit responsibilities |
| FDA Q10 guidance page | Regulator | US adoption |
| ICH Q10 (EMA-hosted) | Regulatory guideline | PQS objectives, elements, enablers, outsourcing |
| FDA Law Blog, Nov 2016 | Law firm | Quality agreement guidance |
| GMP Insiders: FY 2025 observations | Industry analysis | Most-cited provisions |
| Pharmaceutical Online, Dec 15, 2025 | Trade publication guest column | 2025 warning letter analysis |
| Arnold & Porter, Feb 2026 | Law firm | QMM program year three |