Quality assurance: the definition
The international definition comes from ISO 9000:2015 and is quoted by both ASQ and NIST: quality assurance is “part of quality management focused on providing confidence that quality requirements will be fulfilled.”
The key word is confidence. QA is not mainly about checking finished products. It is the planned, systematic set of activities (procedures, training, audits, reviews, change control and records) that lets management, customers and regulators trust that a process will reliably produce what it should.
Quality assurance vs quality control
ASQ defines quality control as “part of quality management focused on fulfilling quality requirements”, in other words the operational checks that confirm a specific output meets specification.
| Quality assurance (QA) | Quality control (QC) | |
|---|---|---|
| Focus | The process and system | The product or output |
| Timing | Before and during work (prevention) | During and after work (detection) |
| Typical activities | Procedures, training, audits, supplier qualification, change control, document review | Inspection, testing, sampling, measurement |
| Question answered | ”Will our process reliably produce conforming output?" | "Does this batch, unit or report conform?” |
| Relationship | Covers most of the quality system | ASQ describes QC as a subset of QA |
| Audience | Management, customers, regulators | Production and release decisions |
ASQ’s examples make the line clear: measuring and testing items coming off a production line is QC; a planned, independent, documented audit of whether the process follows a standard or regulation is QA.
Quality assurance vs quality control examples
- Pharmaceutical manufacturing: testing a tablet batch for assay and dissolution is QC; approving the test procedure, reviewing the batch record and investigating deviations before release is QA.
- Medical devices: final functional testing of a device is QC; design reviews, supplier audits and CAPA are QA.
- Clinical trials: source data verification of a case report form is a QC step; an independent audit of the trial master file and site processes is QA.
- Laboratories: running control samples with each analytical run is QC; proficiency testing oversight and internal audits are QA.
What a quality assurance program includes
Whatever the industry, a QA program usually rests on the same building blocks:
- Quality policy and objectives set by top management.
- Documented procedures (SOPs) and controlled documents.
- Training and competence records for everyone whose work affects quality.
- Supplier and contractor qualification, with written quality agreements.
- Change control so that changes are assessed before implementation.
- Deviation, nonconformance and CAPA processes.
- Internal audits and management review to test whether the system works.
- Records that prove each of the above happened.
A quality assurance plan applies those building blocks to one project or product: what standards apply, which reviews and audits will happen, who signs off, and what records will exist at the end.
Quality assurance in regulated industries
In regulated sectors, QA is not optional and is often written into law.
- Pharmaceuticals: US drug GMP requires a quality control unit with the responsibility and authority to approve or reject components, products, procedures and specifications, and to review production records, with those duties written down and followed. That unit performs what most companies call QA.
- Pharmaceutical quality systems: ICH Q10, adopted by FDA in 2009, describes a quality system built on process monitoring, CAPA, change management and management review.
- Medical devices, laboratories, healthcare and clinical research each have their own QA frameworks, covered in our companion articles.
Regulators look closely at whether QA actually works. An analysis of FDA’s FY 2025 inspection data found that the most frequently cited drug GMP provision was 21 CFR 211.22(d), with 243 observations: the requirement that quality unit responsibilities and procedures be written and followed.
Principles of quality assurance
- Prevention over detection: design processes so defects do not occur.
- Process approach: manage activities as connected processes, not isolated tasks.
- Independence: QA decisions are made by people who are not judging their own work.
- Evidence-based decisions: conclusions rest on records and data.
- Risk-based effort: spend the most assurance effort where failure would hurt most.
- Continual improvement: use audits, trends and CAPA to raise the bar.
Common weaknesses
- QA treated as final inspection, with little influence on process design.
- Procedures that describe an ideal process nobody follows.
- Audits that check documents exist, not whether they are used.
- CAPA that closes on paper without verifying effectiveness.
- Records scattered across systems, so evidence cannot be produced quickly.
- QA staff approving their own team’s work.
Checklist: is your QA program working?
- Quality policy and measurable objectives exist and are reviewed
- Procedures match what people actually do
- Training records cover every role that affects quality
- Suppliers are qualified and covered by quality agreements
- Changes are assessed and approved before implementation
- Deviations and CAPA are trended, and effectiveness is verified
- Internal audits cover every process on a defined schedule
- Evidence for any requirement can be produced within hours, not weeks
How AskDona helps
Quality assurance is about proving, with records, that the system works. AskDona reads your SOPs, batch or device records, audit reports and CAPA files against the requirements you choose, such as 21 CFR 211.22, ISO 9001 or your own quality manual, and shows which requirement each document supports and where evidence is missing, with citations to the page. Run a sample QA evidence review against your own procedures before your next audit. AskDona shows the evidence; your quality team decides.
Editor’s note: The ISO 9000 definitions are quoted through ASQ and NIST because the ISO standard itself is paywalled. The FY 2025 citation counts come from an industry analysis of FDA’s public inspection-observation dataset, which covers system-generated Form 483 observations rather than every inspection. Industry examples are illustrative.
FAQ
What is quality assurance in simple terms? The planned activities that give confidence a process will consistently deliver what it should: procedures, training, audits, change control and records.
What is the difference between quality assurance and quality control? QA focuses on the process and prevention; QC focuses on checking the output. ASQ describes QC as a subset of QA.
Is quality assurance the same as testing? No. Testing is a quality control activity. QA decides how testing is planned, approved and reviewed.
What does a quality assurance program include? A quality policy, controlled procedures, training, supplier qualification, change control, deviation and CAPA management, internal audits, management review and records.
Why is quality assurance important in regulated industries? Regulators require it. For example, US drug GMP requires a quality unit with written, followed responsibilities, and FDA cites failures there more than any other drug GMP provision.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| ASQ: Quality assurance vs. quality control | Professional society | QA/QC definitions, examples |
| NIST glossary: quality assurance | Government | ISO 9000 definition |
| 21 CFR 211.22 (LII) | Regulation | Quality unit responsibilities |
| FDA Q10 guidance page | Regulator | Pharmaceutical quality system |
| GMP Insiders: FY 2025 observations | Industry analysis | Most-cited drug GMP provisions |