Choosing a pharma QMS: 15 questions to ask vendors

1. How exactly do you describe your regulatory compliance?

Software on its own cannot be “Part 11 compliant” or “validated” — compliance depends on how it is configured, validated and used. Good answer: the system is designed to support compliance with 21 CFR Part 11 and EU GMP Annex 11, with the specific controls listed. Warning sign: “fully compliant” or “pre-validated, no work needed”.

2. What does the audit trail record, and can anyone switch it off?

Ask to see an audit trail entry: it should show the old value, new value, user, date and time, and a reason. Ask whether any role, including administrators, can disable it, and how auditors can filter and export it.

3. How are electronic signatures implemented?

Look for signatures that show the signer’s name, date and time and the meaning of the signature (21 CFR 11.50), require re-authentication at signing and are permanently linked to the record. Ask whether signature requirements can be set per workflow.

4. Where is segregation of duties enforced — and who can bypass it?

Can the same person raise, review and approve a deviation? Can an administrator override the rule, and if so is the override recorded and visible? Server-side enforcement is stronger than a convention in an SOP.

5. How do quality records link to each other?

Show a deviation raising a CAPA, then follow the CAPA’s actions to verification and closure. Can an inspector navigate from one record to everything related? Re-keying information between modules is a sign of a loosely connected suite.

6. How are CAPA effectiveness checks and overdue actions handled?

Ask how the system separates verifying actions from checking effectiveness, what happens when an action is overdue, and whether extensions need independent approval.

7. How much can we configure without custom code?

Workflows, forms, numbering, signature levels and notifications should be configurable. Custom code increases validation effort and makes upgrades harder — ask how customisations survive new releases.

8. Does the QMS connect to our lab and manufacturing records?

Deviations often start in batch execution or the laboratory. A QMS that can only receive manually entered events will miss context. Ask what is native, what is integrated through an API and what is manual.

9. What validation support do you provide, and what remains our job?

Ask for a written split of responsibilities. Good vendors explain how they test their releases, what documentation they can provide, whether they support a risk-based (GAMP 5 or CSA) approach and how they handle requirement traceability. Remember that the regulated company remains accountable for validation.

10. How are releases and upgrades managed?

How often do updates arrive, how much notice do you get, are release notes and impact assessments provided, and can you test before production is updated? This matters most for cloud systems.

11. How do SOPs and training connect?

When an SOP becomes effective, does training follow automatically? Are exams graded by the system? Is the controlled copy protected from change? Ask to see what happens to training when a new SOP version supersedes the old one.

12. Where is our data hosted, and who can access it?

Ask about hosting region, encryption, backups and restore testing, multi-factor login, and the vendor’s own access to your data. If you need on-premise deployment, confirm it is actually offered — not every vendor does.

13. Can we get our data out, and our history in?

Ask how you would export your records, including audit trails, if you left. Ask how legacy records will be migrated at go-live and how migration is verified.

14. How does the system handle multiple sites?

Can sites share global SOPs and specifications while keeping local records separate? Can each site have its own settings, users and time zone? Adding a second site later should not mean a second implementation.

15. What is the realistic timeline and total cost?

Ask for a typical go-live range for a company like yours, what drives it, and a total cost over several years covering licences, implementation, validation support, hosting, training and support. Ask to speak to reference customers in pharma.

Turn the 15 questions into a weighted scorecard. Weight what matters most to you — for a sterile manufacturer, integration with manufacturing records may outrank document control; for a contract lab, OOS and client-facing features may lead. Score each vendor on what they demonstrated, not what they claimed, and note every answer that was deferred to “after contract”.

• Must-haves: audit trail, e-signatures, segregation of duties, the core QMS workflows, data export.
• Differentiators: linkage across quality, lab and manufacturing; configurability; multi-site handling.
• Deal terms: validation responsibilities, hosting and security commitments, support, total cost.

We wrote these questions to be fair to every vendor — including us. Here is how Swat iQua Suite answers them:

• Compliance (1): designed to comply with 21 CFR Part 11, EU GMP Annex 11 and Annex 1, WHO GMP and Revised Schedule M, following ALCOA+ principles and a GAMP 5 risk-based approach. We do not describe it as validated out of the box.
• Audit trail (2): old value, new value, user, time and a mandatory reason for every change, saved together with the record; an auditor-facing report filters by site, module, user and date, with logged PDF and Excel exports.
• Signatures and SoD (3–4): three e-signature levels set per module and per site, and segregation of duties enforced on the server in 25 modules — most quality workflows have no administrator bypass, and any override is recorded and shown on the record.
• Connected records (5–6, 8): deviations, OOS investigations, lab quality events, audits, stability failures and audit trail reviews raise CAPAs directly; CAPAs have per-action verification, an optional effectiveness review and a hard overdue gate. Deviations can be raised from batch execution and environmental monitoring, because the QMS shares one platform with the lab and manufacturing modules.
• Validation (9): a CSA requirement and traceability register with a coverage report, plus validation support from our team during implementation.
• Documents and training (11): SOPs go through review, approval and a separate make-effective step that saves an unalterable controlled copy; training is created from effective SOPs, with exams graded on the server.
• Hosting and data (12–13): cloud-hosted only, in your chosen region, with encrypted connections, scheduled backups and multi-factor login. Excel and PDF exports throughout, and structured migration of your existing records.
• Multi-site (14): multi-company and multi-site from one installation, with shared or site-owned master data and per-site settings and time zones.
• Timeline and cost (15): typical go-live in 1–3 months depending on modules and sites; modular licensing, so you pay for the modules live in your current phase. Customers include ARC Pharma UK Limited (on the platform since 2016), Lunar Labs Limited and Norvium Healthcare Pvt. Ltd.

The best way to test these answers is the way this guide recommends: bring your own scenarios to a demo and ask us to show you.