IndustriesContract research organizations
QMS software for CRO teams, ready for every sponsor audit
QMSdesk™ is QMS software for CRO quality teams. It runs your GCP quality system and the obligations you carry for your sponsors side by side, so every deviation, finding and fix is on the record, signed and easy to show.
Usual profiles for this work
Regulations they carry
ISO 9001; ISO 31000:2018; 21 CFR Part 11; ALCOA+ data-integrity principles; ICH E6; 21 CFR Part 312; ICH Q10
- Retention floor
- 15 years
- Event workflows
- 10, including Quality-agreement deviation and Technology-transfer issue
A typical starting set. You choose your own profiles, and can add more at any time.
What a CRO needs from an eQMS
A clinical quality management system you'd happily open to any sponsor, because a deviation from a quality agreement is reported, investigated and closed with the same signed rigor as any other.
Thursday
A sponsor's audit closes with four findings. They go into the same findings register as your own internal audits, each with an owner. One is major, so it raises a nonconformance. By the time the sponsor asks for your response, the CAPA plan is signed.
What the rules ask of you, and how QMSdesk supports it
A CRO answers twice: to the clinical trial rules, and to each sponsor's quality agreement. Both come down to the same proof: every deviation reported, investigated and closed, and every audit finding answered on time. QMSdesk keeps your own findings and every sponsor's in one register, so a sponsor audit is a walk through records you already keep.
| Regulation | What it asks of you | How QMSdesk supports it |
|---|---|---|
| GCP (ICH E6 and 21 CFR Part 312) | How clinical trials are run and recorded. | Protocol deviations, the Principal Investigator, CRA and Medical Monitor roles, and 15-year minimum retention. |
| Contract operations (ICH Q10 §2.7) | Quality when you work under another organization's quality system. | Quality-agreement deviations, technology-transfer issues, and the Sponsor Quality Manager and Quality Agreement Owner roles. |
| ICH Q10 | A pharmaceutical quality system that keeps improving. | CAPA and change management run as connected systems, including for outsourced work. |
| 21 CFR Part 11 | Electronic records and signatures you can trust as much as paper. | A hash-chained audit trail, re-authentication at every signature and a fixed list of signature meanings. |
| Computer Software Assurance | A risk-based way to show the software is fit for use. | A validated core platform, and a written scope for the validation that stays yours. |
Every customer also holds BASE, the quality baseline, which carries 21 CFR Part 11, ALCOA+, ISO 9001 and ISO 31000.
The profiles that carry your regulations
A CRO holds BASE, GCP and Contract operations.
- Event types. Protocol deviations and quality-agreement deviations, each on the deviation workflow. Technology-transfer issues, on the nonconformance workflow.
- Roles. Principal Investigator, CRA, Medical Monitor and Biosafety Officer from GCP. Sponsor Quality Manager, Clinical Project Manager, Lead Auditor, Quality Agreement Owner and Technology Transfer Lead from Contract operations.
- Retention floor in QMSdesk. 15 years, from GCP. Contract operations adds no retention minimum of its own and takes the longest of the profiles it's held with. For trials under EU Regulation 536/2014, the sponsor and investigator keep the trial master file for at least 25 years after the trial ends (Article 58); records are never deleted, so set that period in your procedures.
Your organization's data is isolated from every other organization's by row-level security in the database.
Running a bioanalytical or testing lab? Add ISO 17025 or GLP; see testing laboratories and GLP laboratories. Manufacturing for sponsors? See CDMO.
QMS software for CRO work: the modules that matter most
Deviation management
Minor deviations take a short path with one signature. Major and critical ones require containment, investigation, a signed CAPA decision and QA approval, whether the deviation is from a protocol or a quality agreement.
Audit management
Plan your audit program on a calendar, with templates and auditor qualification profiles. Sponsor audit findings sit in one register with your own, and a critical finding raises a nonconformance and a risk. Auditors never audit their own department, and the lead auditor never approves their own report.
CAPA
A signed CAPA decision raises the CAPA, and approving its action plan raises the change control and training it needs. An effectiveness check confirms the fix held.
Document control
Your SOPs are signed at authoring, review and approval, by different people. Sponsor quality agreements and external guidance are held as reference documents, published in one step, checked for currency and marked as not internally approved.
Training management
Training is assigned on document approval, change, CAPA, new hire and role change. Signed, time-limited waivers cover the exceptions.
Supplier quality
Qualify your vendors by risk tier, with reviews every 6, 12 or 24 months. Vendors answer corrective-action requests through a single-use link, with no account.
Every tier includes every module: document control, quality events, CAPA, change control, training, risk, audits, supplier quality, management review and reporting. See the whole platform
Build your regulatory profile
Start from running trials for sponsors, add lab or manufacturing work, and see your event types, roles and minimum retention period.
Questions buyers ask
Which profiles does a CRO hold?
BASE, GCP and Contract operations: protocol and quality-agreement deviations, technology-transfer issues, the clinical and sponsor-facing roles, and a 15-year minimum retention period.
Can we track sponsor audit findings?
Yes. Findings from sponsor audits and your own internal audits sit in one register, so you can see every open finding at once. A critical finding raises a nonconformance and a risk.
How is our data kept apart from other organizations?
Row-level security in the database isolates each organization's data. The audit trail is hash-chained and insert-only. The Trust Center has the detail.
We're a CRO and a CDMO. Can we hold both?
Yes. Hold GCP, GMP and Contract operations together, and QMSdesk combines them, with the tightest deadline and the longest minimum retention period applied.
How is QMSdesk priced?
By organization tier, never per seat, and every tier includes every module. See pricing.
Every sponsor commitment, on the record
Bring your last sponsor audit finding. We'll walk it through QMSdesk with you, from finding to verified fix.