IndustriesContract development and manufacturing
A QMS for CDMO teams, built for GMP and your sponsors
QMSdesk™ is a QMS for CDMO and CMO quality teams. GMP discipline on your lines and accountability to your sponsors run in one system, so a batch deviation, a quality-agreement deviation and a tech-transfer issue each follow a signed path to a proven fix.
Usual profiles for this work
Regulations they carry
ISO 9001; ISO 31000:2018; 21 CFR Part 11; ALCOA+ data-integrity principles; 21 CFR Parts 210/211; EU GMP (EudraLex Vol. 4), including Annex 11; ICH Q10; ICH Q7; WHO GMP (Technical Report Series)
- Retention floor
- 10 years
- Event workflows
- 12, including Quality-agreement deviation and Technology-transfer issue
- Key deadline
- Batch deviation containment within 1 calendar day
A typical starting set. You choose your own profiles, and can add more at any time.
What a CDMO needs from an eQMS
Every batch protected, every sponsor commitment kept, and the evidence for both ready when a sponsor or a regulator asks.
Wednesday
Scale-up of a new client's process shows a discrepancy. It's logged as a technology-transfer issue, and its disposition is signed. On another line, a batch deviation is contained within the day. Both reach QA's review queue before the shift ends.
What the rules ask of you, and how QMSdesk supports it
A CDMO carries two sets of obligations on every batch: GMP for how the product is made, and the quality agreement with the sponsor who owns it. QMSdesk runs both in one system. A batch deviation, a quality-agreement deviation and a tech-transfer issue each follow a signed path, and the evidence is ready when a sponsor or a regulator asks.
| Regulation | What it asks of you | How QMSdesk supports it |
|---|---|---|
| GMP (21 CFR Parts 210 and 211, EU GMP, ICH Q7, WHO GMP) | How medicines are made, tested and released. | Batch deviations contained within 1 calendar day, OOS Phase 1 within 1 business day, and the Qualified Person role. |
| Contract operations (ICH Q10 §2.7) | Quality when you work under a sponsor's quality system. | Quality-agreement deviations, technology-transfer issues, and the Sponsor Quality Manager and Quality Agreement Owner roles. |
| ICH Q10 | A pharmaceutical quality system that keeps improving. | CAPA and change management run as connected systems, including for outsourced work. |
| 21 CFR Part 11 and EU GMP Annex 11 | Electronic records and signatures you can trust as much as paper. | A hash-chained audit trail, re-authentication at every signature, and periodic audit-trail review signed as reviewed. |
| Computer Software Assurance | A risk-based way to show the software is fit for use. | A validated core platform, and a written scope for the validation that stays yours. |
Every customer also holds BASE, the quality baseline, which carries 21 CFR Part 11, ALCOA+, ISO 9001 and ISO 31000.
The profiles that carry your regulations
A CDMO holds BASE, GMP and Contract operations.
- Event types. Batch deviation, environmental excursion and product recall from GMP. Quality-agreement deviations on the deviation workflow, and technology-transfer issues on the nonconformance workflow.
- Deadlines. Batch-deviation containment within 1 calendar day. OOS Phase 1 laboratory investigation within 1 business day. Complaint acknowledgment within 3 business days.
- Roles. Qualified Person, QC Head, Production Head, Responsible Person, Validation Engineer and Batch Release Specialist from GMP. Sponsor Quality Manager, Quality Agreement Owner, Technology Transfer Lead and Lead Auditor from Contract operations.
- Retention floor in QMSdesk. 10 years.
Your organization's data is isolated from every other organization's by row-level security in the database.
Running nonclinical GLP studies too? Add the GLP profile, and batch deviations and study deviations run side by side. Manufacturing cell or gene therapies? Add ATMP; see cell and gene therapy. Running trials for sponsors? See CRO.
CMO quality management: the modules that matter most
Deviation management
Quality-agreement deviations and batch deviations follow the same severity-routed path. Minor ones take one signature. Major and critical ones require containment, investigation, a signed CAPA decision and QA approval.
OOS/OOT investigations
A Phase 1 laboratory investigation and a signed Phase 1 review come first, then Phase 2 when no lab error is found. Lab-error invalidations are trended by method, analyst and instrument.
Change control
Changes from tech transfer and process improvement route by risk, and high-impact changes go to the Change Manager and the Quality Manager. The requester never approves their own change, and the implementer never verifies their own work.
CAPA
Approving a CAPA's action plan raises the change control and training it needs. An effectiveness check confirms the fix held, and a failed check raises a new linked CAPA.
Supplier quality
Materials and service suppliers are qualified by risk tier. Certificate alerts go out at 90, 60 and 30 days, and two rejected SCAR responses raise a supplier to the Critical tier.
Audit management
Findings from sponsor audits sit in one register with your internal audit findings. A critical finding raises a nonconformance and a risk. When a regulator inspects, give the inspector a time-boxed, read-only account.
Every tier includes every module: document control, quality events, CAPA, change control, training, risk, audits, supplier quality, management review and reporting. See the whole platform
Build your regulatory profile
Start from contract manufacturing, add GLP studies or advanced therapies, and see your event types, roles, deadlines and minimum retention period.
Questions buyers ask
Which profiles does a CDMO hold?
BASE, GMP and Contract operations: the GMP event types and roles, quality-agreement deviations, technology-transfer issues and a 10-year minimum retention period.
How are quality-agreement deviations handled?
They run on the deviation workflow, with severity routing, containment for major and critical cases, investigation and a signed CAPA decision. The Quality Agreement Owner role is there to own them.
We also run nonclinical GLP studies. Can one QMS hold both?
Yes. Add the GLP profile, and you hold BASE, GMP, Contract operations and GLP. The strictest rule applies wherever two differ.
How is our data kept apart from other organizations?
Row-level security in the database isolates each organization's data, and the audit trail is hash-chained and insert-only. The Trust Center has the detail.
How is QMSdesk priced?
By organization tier, never per seat, and every tier includes every module. See pricing.
Your lines and your sponsors, one step ahead
Bring your last tech-transfer issue or quality-agreement deviation. We'll walk it through QMSdesk with you, from first report to proven fix.