In our last post, we reviewed ICH Q10, the guideline that describes the quality management system (QMS) for drug manufacturing environments. Today, we're going to explore how the QMS was defined for Good Clinical Practice activities in the late 20th and early 21st centuries.
It's a pretty short trip. Let's take it step by step:
- Quality Unit. No E6 version requires establishment of an independent quality unit.
- Quality Policy. Not referenced in any E6 version.
- Standard Operating Procedures. "Written procedures" are required per E6 R1 (1996) and R2 (2016) and per various regional regulations, but it's not clear whether standard operating procedures are required, as opposed to study-specific procedures. See this post for a detailed breakdown. E6 R3 (2025) references "Standard Operating Procedures" in conjunction with computerized systems.
- Management responsibility. Not explicitly referenced in any E6 version.
- Supplier qualification. E6 R1 and R2 do not explicitly reference supplier qualification. R3 states that sponsors must assess "suitability" of service providers, but does not require audits or state that Quality Assurance needs to be involved in qualifying vendors.
- Process performance and quality monitoring. All GCP versions specify close monitoring of participant safety and data integrity (the latter is emphasized more in later versions). Again, this is generally expressed as a functional responsibility, not the responsibility of an independent quality unit.
- Audits. Both E6 R1 and R2 included steps for "if or when sponsors perform audits." R3 amends this language to "when performed..." and added a caveat that audits should be proportionate to risk. There are no specific requirements for an audit program or for any particular types of audits.
- CAPA system. R1 had no requirements for a CAPA system. R2 stated that non-compliance should be followed up with root cause analysis and appropriate corrective and preventive actions, but did not require this system to be administered by an independent quality unit. R3 identifies root cause analysis and CAPA as part of "quality assurance," but does not state that this system must be administered by an independent quality unit.
- Change management. E6 R1 does not address change management except to state that the IRB/EC must approve changes to the protocol. R2 states that SOPs must describe change control for computerized systems. R3 suggests throughout that risk assessments should take changes into account. All versions state that drug formulation changes should prompt re-assessment of the PK profile.
- Risk Management. R2 was the first GCP version to include a detailed process for risk management, which is intended to facilitate "continual improvement." R3 emphasizes the use of risk assessment throughout the clinical trial process. Both versions suggest that risk assessment in clinical trials is typically performed on a clinical trial level. Risk management is described as a key component of quality management, but again there is no requirement for it to be performed or facilitated by an independent quality unit.
The takeaway: Although many elements of the Pharmaceutical Quality Management System developed for GMP activities are not explicitly required by GCP, or required but are not explicitly assigned to an independent quality unit, our industry has uncritically adopted this QMS framework for use in GCP, much like schools in the United States adopted "Taylorism" in the early 20th century to improve the quality of education.
In our next series of posts, we're going to compare and contrast (another favored occupation of the US educational system!) GCP and GMP environments to assess whether or not the GMP Pharmaceutical Quality System is "fit for purpose" for GCP.
