QMS

What is a QMS?

A QMS (Quality Management System) is the coherent set of policies, processes, procedures, responsibilities and records through which an organisation plans, controls, demonstrates and continuously improves the quality of its products and services. A QMS is therefore not a software package but a management system; software (an eQMS) merely supports it. In the process industries, pharmaceuticals, food and discrete manufacturing, the QMS is the backbone against which production data from the OT world is ultimately assessed.

A QMS ensures that you consistently meet customer and regulatory requirements and that you can prove it to customers, auditors and regulators.

🧠 Which standards and regulations is a QMS based on?

The generic foundation is ISO 9001, the most widely used management system standard in the world. On 16 September 2026 the sixth edition, ISO 9001:2026, was published, replacing ISO 9001:2015 (including its 2024 climate change amendment). It is an evolutionary revision; certified organisations are expected to get a transition period of about three years. Sectors add specific requirements on top:

All modern ISO management system standards share the same high-level structure (clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation, improvement). That makes it straightforward to combine a QMS with ISO 14001 (environment), ISO 45001 (occupational health and safety) and ISO 27001 (information security) into a single integrated management system.

🎯 Which principles underpin a QMS?

ISO 9000:2015 describes seven quality management principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making and relationship management. In practice the QMS runs on the PDCA cycle: you plan processes and objectives, carry them out, measure the results and adjust. Risk-based thinking runs through all of it: risk management determines where you need additional controls.

🔧 What does a QMS actually cover?

A QMS covers, among other things:

• Document control - procedures, work instructions and specifications with versioning and approval, often in a DMS
• Deviations and CAPA - recording non-conformities, root cause analysis and Corrective and Preventive Actions
• Change control - controlled changes through MOC, including impact assessment and revalidation
• Audit management - planning, executing and following up internal and external audits
• Risk Management - risk analyses using methods such as FMEA and HAZOP
• Training and qualification - demonstrating that staff are competent for their tasks
• Complaints and improvement actions - recording, analysing and feeding back customer complaints
• Measuring equipment - calibration and control of measuring and test equipment
• Traceability - via LOT, batch numbers, THT, SSCC and GTIN

A digital QMS (eQMS) bundles these processes into modules:

🔄 How does a QMS work with OT and IT systems?

The QMS sets the requirements; OT and IT systems provide the evidence. Increasingly, that data is exchanged automatically rather than on paper:

For the OT department this means that control and recording systems themselves fall under the QMS. In regulated environments, computerised systems must be validated according to GAMP 5, electronic records must comply with 21 CFR Part 11 or EU GMP Annex 11, and data integrity must be assured according to ALCOA+. A change to a PLC program or a recipe is then not a purely technical intervention, but a change that is assessed and recorded through the QMS.

🏭 How do you set up a QMS step by step?

A practical approach for a manufacturing company:

1. Define context and scope - which sites, products and requirements (customer, legal, sector) are covered?
2. Map the processes - core, support and management processes, each with an owner and performance indicators (KPIs)
3. Analyse risks and opportunities - use FMEA or a simple risk matrix
4. Document what is needed - quality policy, procedures and work instructions; no more documents than the process requires
5. Implement and train - staff know their role and the records they must keep
6. Measure and evaluate - internal audits, customer satisfaction, process data and a management review (usually annual)
7. Improve - handle deviations through CAPA, structural improvements with LEAN or Six Sigma

If you want certification, an accredited certification body (accredited in the Netherlands by the Dutch Accreditation Council, RvA) performs an initial audit in two stages. A certificate is valid for three years, with annual surveillance audits followed by recertification. Note that the FDA does not certify; it inspects. For GMP manufacturers and medical device makers, regulators assess the QMS during inspections and notified bodies during their audits.

✅ What does a good QMS deliver?

• Consistent quality of products and processes, with less scrap and rework
• Fast detection and handling of deviations before they reach the customer
• Demonstrable Compliance with standards and regulations
• Higher customer satisfaction and a stronger position in tenders
• Efficiency through digital workflows and less paper
• A strong basis for certification against ISO standards and for GMP inspections

❓ Frequently asked questions

Is a QMS the same as ISO 9001?

No, a QMS is an organisation’s quality management system, while ISO 9001 is the international standard that sets requirements for such a system. You can have a QMS without an ISO 9001 certificate. Many customers and tenders, however, ask for certification as proof that the QMS works.

What is the difference between a QMS and an eQMS?

A QMS is the whole of processes, roles and records, regardless of medium. An eQMS is software that supports these processes digitally, such as document control, CAPA and change control. In regulated sectors an eQMS must itself be validated and meet the requirements for electronic records.

What should I do about ISO 9001:2026?

ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015. Certified organisations are expected to have about three years to transition, usually during a regular surveillance or recertification audit. Agree the timing with your certification body.

What is CAPA in a QMS?

CAPA stands for Corrective and Preventive Actions: the QMS process through which an organisation investigates deviations, establishes the root cause and takes measures. Corrective actions prevent recurrence of a problem that has occurred, while preventive actions stop a potential problem from arising. The effectiveness of each CAPA is checked afterwards.

Does OT software fall under the QMS?

Yes, as soon as a control, MES or recording system affects product quality or quality data, it falls under the QMS. In pharmaceuticals and medical devices this means validation according to GAMP 5 and change control for every modification. In other sectors it is also wise to route PLC and recipe changes through the QMS.

How long does it take to set up a QMS?

For a medium-sized manufacturer, setting up a QMS through to certification often takes from six months to more than a year. The lead time depends on the number of sites, existing documentation and sector requirements. Organisations that already work with procedures and records are usually ready sooner.

📌 In summary

A QMS defines how an organisation plans, controls, demonstrates and improves quality. ISO 9001 provides the generic foundation; GMP, ISO 13485, IATF 16949 and ISO 22000 add sector requirements. For IT/OT, the QMS is increasingly a digital system linked to LIMS, MES and ERP, in which the OT systems themselves are subject to change control and validation.

A QMS is the central system through which organisations plan, execute, monitor and continuously improve quality - and is essential for Compliance, customer satisfaction and Risk Management.