Free checklist

eQMS readiness checklist

Tick every statement that is true for your company today. Be strict: if you would have to search for the evidence, leave it unticked.

0/32

Start ticking to see where you stand.

1. Documents and training

Can you show the right version, who approved it, and who has read it?

Every SOP has one controlled, current version, and old versions are retained and marked as superseded. We can show who reviewed and approved each version, with date and reason for change. Approvals are signed in a way that is attributable and cannot be copied or edited afterwards. Nobody works from printed or local copies that could be out of date. When an SOP changes, the affected people are notified automatically. We can show, per person, that they have read and understood the current version of each relevant SOP. Periodic review dates are tracked and nothing is overdue. We could produce a list of all controlled documents and their status in under 10 minutes.

2. Deviations, CAPA and change

Does every event move from detection to closure with evidence?

Every deviation gets a unique ID, a classification and an owner on the day it is found. Investigations and root cause are documented in the record, not in email threads. Deviations are linked to the CAPA that addresses them, and the link is visible both ways. CAPA actions have owners and due dates, and overdue actions are flagged without anyone checking a spreadsheet. Effectiveness checks are planned, performed and signed off by QA. Changes to processes, equipment or documents go through a documented change control. We can see trends across deviations (repeat causes, areas, products) without manual counting. The average time to close a CAPA is known and acceptable.

3. Audit trail, e-signatures and data integrity

Would your records meet ALCOA+ if an inspector looked today?

Every change to a GxP record is captured with who, what, when and why. The audit trail cannot be edited or switched off by ordinary users. Electronic signatures show the signer's name, date, time and meaning (review, approval, responsibility). Each user has a personal login. No shared accounts are used for quality records. Access rights are role-based and reviewed periodically. Records are backed up, and a restore has been tested. We know where our quality data is stored, and a data processing agreement is in place. Records can be exported in a readable format for an inspector or a partner.

4. Suppliers, external reviewers and validation

Can people outside the company take part, and can you defend your tools?

External QPs, consultants or CDMOs can review and sign without emailing copies back and forth. Comments from external reviewers are kept with the record they relate to. Critical suppliers are qualified, and their status is easy to find. The software we use for GxP records has been assessed and validated for its intended use. We have validation documentation from our software vendors, or know how we would get it. Updates to our quality software are assessed for impact before they are used. We could host a customer audit or due diligence next week without a clean-up project. The person who owns quality spends most of their time on quality, not on chasing signatures and updating trackers.

What your score means

26–32: Well controlledYour system works. Check whether it will still work when you double in size or add external partners.

16–25: Holding, with gapsTypical for growing teams on Word, Excel and email. The gaps usually show up first in CAPA follow-up, audit trail and external review.

0–15: At riskAn inspection, partner audit or due diligence would probably find findings. A lightweight eQMS is worth considering now, before the next trigger.

Want to talk through your result?

Book 20 minutes with the QENTRA team. No pitch: we'll go through your gaps and what other small life science teams do about them.

Book a 20-min call