GMP Quality Culture Assessment — What FDA Measures That CMC Cannot Audit

FDA investigators are trained to assess quality culture during inspections — not through a questionnaire, but through direct observation of how management responds to problems, how operators handle unexpected results, and whether the quality system functions because employees believe in it or because they are afraid of an audit.

That observation, embedded in FDA investigator training and reflected in CDER’s Quality Management Maturity (QMM) program, captures a category of organizational risk that most pharmaceutical quality systems are structurally incapable of measuring. Your quality dashboard almost certainly tracks batch release rates, deviation count, CAPA closure timelines, and right-first-time manufacturing performance. What it almost certainly does not track — and what an experienced FDA investigator begins assessing from the first hour of an inspection — is whether those numbers reflect a genuine quality culture or a well-managed compliance performance. The difference between those two things is not subtle when you know what to look for. It is the difference between organizations that receive Voluntary Action Indicated classifications and organizations that receive Warning Letters for systemic quality system deficiencies that the quality dashboard showed no sign of.

WHAT FDA INVESTIGATORS ARE ACTUALLY LOOKING FOR

The FDA’s Quality Systems Approach to Pharmaceutical cGMP Regulations guidance, published in 2006, established the foundational framework for how the agency thinks about pharmaceutical quality systems: not as a collection of procedures, but as an integrated management system in which quality is driven from the top and embedded in operational behavior throughout the organization. ICH Q10, the pharmaceutical quality system guideline that followed and which the FDA has since adopted as the reference framework for quality system expectations, is explicit about the management responsibilities that define a mature quality culture: senior management must demonstrate leadership and commitment to the pharmaceutical quality system, establish and communicate quality policy, ensure quality objectives are defined, conduct management reviews with documented decisions, and provide sufficient resources for the quality system to function. These are not bureaucratic formalities. They are observable behaviors — and FDA investigators observe them.

The first quality culture indicator that investigators assess is voluntary disclosure. When management proactively discloses a known quality issue to an investigator before being asked — a recurring deviation trend, a CAPA that has not resolved the root cause, a process that has been a source of variability — that disclosure is a direct observable indicator of quality culture. It signals that the organization operates in a framework where transparency with the agency is a professional norm rather than a liability management decision. Conversely, when investigators discover quality issues through record review that were not disclosed voluntarily — issues that site management clearly knew about — the cultural interpretation is immediate: quality information is filtered before it reaches the agency, which means quality information may also be filtered before it reaches senior management. Both inferences are damaging, but the second one is operationally far more dangerous.

The second indicator is deviation and error reporting rate in context. This requires nuance that most quality dashboards are not designed to provide. In a complex pharmaceutical manufacturing environment — biologics, sterile injectables, controlled substance manufacturing — a very low deviation rate is not evidence of strong quality performance. It is, more often, evidence of under-reporting. The relationship between operational complexity and expected deviation frequency is not linear, but it is predictable within ranges. An investigator who understands the manufacturing process — and FDA investigators who work pharmaceutical facilities are technically trained — will recognize when a deviation rate is implausibly low for the process complexity they are observing. ICH Q9(R1), the revised quality risk management guideline, explicitly addresses the relationship between risk assessment rigor and operational visibility: organizations with mature QRM programs identify more risk events, not fewer, because their systems are calibrated to see what is actually happening rather than what the organization finds comfortable to report.

The third indicator is management engagement with quality system outputs — not the existence of management reviews, but the quality of documented decisions produced by those reviews. ICH Q10 Section 4.1, “Management Review of the Pharmaceutical Quality System,” requires management to assess performance indicators and quality objective achievement on a periodic basis, and Section 4.3 requires that the outcomes of that review — including resource allocation, policy revisions, and escalation of issues to senior management — be documented and communicated. An investigator who reviews management review records and finds that they consist of dashboard summaries without documented discussion of trends, without management decisions on resource allocation or quality objectives, and without evidence that quality leadership raised issues requiring senior management action — that investigator is looking at a quality system that functions on paper without functioning in practice. Management review records that show only green metrics and no documented leadership decisions about quality system gaps are not evidence of quality performance. They are evidence of a quality system that does not surface problems to the people who have the authority and resources to solve them.

The fourth indicator is the distinction between right-first-time culture and compliance theater. This is the most difficult indicator to capture in documentation, and the most legible to an experienced investigator conducting plant observations and employee interviews. Compliance theater describes a quality culture in which procedures are followed when quality personnel or management are present, exceptions are normalized when supervision is absent, and the procedural compliance rate visible in documentation is not representative of actual operational behavior. FDA investigators are trained in direct observation techniques precisely because documentation-based assessment cannot distinguish compliance theater from genuine quality commitment. An operator who demonstrates genuine understanding of why a procedure step matters — who can explain the quality rationale, not just the procedure requirement — is an indicator that quality culture extends to the operational level. An operator who follows a procedure step correctly when observed but who, when asked why that step is required, cannot articulate any rationale beyond “it’s the procedure,” is indicating that quality behavior is externally driven rather than internally motivated. At scale, that distinction predicts how the organization behaves when no one is watching — which is exactly when quality matters most.

The fifth indicator is investigation quality. Genuine analytical investigation — root cause analysis that identifies the actual mechanism of failure, that considers systemic factors alongside immediate causes, that challenges assumptions and follows evidence wherever it leads — is one of the clearest windows into organizational quality culture available to an investigator. Investigation reports that consistently identify analyst error or operator error as root cause, without examining whether the process design, the procedure, the training system, or the environmental conditions contributed to creating conditions in which human error was the predictable outcome, are not investigations. They are documentation artifacts. ICH Q10 and the FDA’s 2006 quality systems guidance both make the same point: the investigation is the mechanism through which the quality system learns. An organization whose investigations consistently externalize root cause onto individuals, and whose CAPA plans consist of retraining, has a quality system that does not learn — it repeats.

FDA’S QMM PROGRAM AND THE QUALITY MATURITY RECOGNITION PATHWAY

CDER’s Quality Management Maturity (QMM) program represents the agency’s most explicit statement of what quality culture maturity looks like as a measurable organizational property. QMM, which CDER’s Office of Pharmaceutical Quality has been developing since its 2019 Drug Shortages Task Force report identified the absence of market incentives for quality maturity as a root cause of drug shortages, evaluates drug manufacturing establishments across five defined practice areas set out in CDER’s August 2023 white paper: Management Commitment to Quality, Business Continuity, Advanced Pharmaceutical Quality System, Technical Excellence, and Employee Engagement and Empowerment. These practice areas map directly to the management responsibilities established in ICH Q10 and to the observable culture indicators that investigators assess during inspections — CDER’s own white paper cites its review of ICH Q9(R1), ICH Q10, and ICH Q12 case studies as a direct input to the practice area framework.

The QMM program is not a compliance audit. It is a quality maturity assessment conducted by trained assessment teams — FDA staff, third-party contractors, or a combination, but never the credentialed investigators who conduct CGMP surveillance inspections — using a methodology that evaluates the organizational conditions that enable sustained quality performance rather than the procedural compliance indicators that confirm minimum regulatory requirements. FDA has stated explicitly that QMM assessments are not part of its inspection authority and cannot be used to determine CGMP compliance. Sites that achieve recognition under QMM are not sites that have no deviations. They are sites that have quality systems robust enough to identify deviations early, investigate them analytically, implement effective corrections, and demonstrate that quality performance is improving over time. The program is voluntary — CDER is currently running it as a multi-year prototype assessment protocol evaluation, with its third cohort of up to nine participating establishments announced in a February 2026 Federal Register notice — and the FDA has described it publicly as a mechanism for the agency to learn what organizational practices characterize high-quality pharmaceutical manufacturing, and to recognize establishments that demonstrate those practices.

The implication for pharmaceutical quality leaders is significant. QMM recognition requires demonstrating, across all five practice areas, that the organization’s quality performance is driven by a management system that has progressed beyond procedural compliance into genuine quality management. That progression requires measuring things that most quality dashboards do not capture. Deviation reporting rate in the context of process complexity. Investigation effectiveness measured by repeat deviation rate — not whether the CAPA was closed, but whether the same root cause recurred after the CAPA was implemented. Voluntary correction rate — the proportion of quality issues identified and corrected by the operational team before they are identified through formal quality review or management oversight. Right-first-time batch release rate as an indicator of process control, distinct from the batch release rate that includes product salvaged through exception. Employee quality understanding assessed through direct engagement, not through training record completion.

WHAT YOUR QUALITY DASHBOARD IS NOT TELLING YOU

The quality metrics that populate most pharmaceutical quality dashboards were designed to track procedural compliance: CAPA closure on time, deviation investigation within target, management review conducted on schedule, training completion rate above threshold. These metrics confirm that the quality system is operating. They do not measure whether it is functioning. The distinction is the one FDA investigators are trained to probe. A quality system that is operating produces closed CAPAs, completed management reviews, and deviation investigations filed within target timelines. A quality system that is functioning produces learning from deviations, management decisions that improve quality performance, and a workforce that understands why quality matters — not because they are being monitored, but because quality is the organizational norm.

The WHO TRS 986 Annex 2 Good Manufacturing Practices framework, which addresses quality management as a whole-system organizational function, frames this distinction in terms of quality culture as the foundation upon which all quality system elements depend. Procedures, documentation systems, and oversight mechanisms are the structure. Quality culture is what determines whether that structure generates genuine protection of product quality and patient safety, or whether it generates compliance documentation that looks equivalent until an FDA investigator with twenty years of inspection experience spends three days on your manufacturing floor.

THE XGENE QUALITY CULTURE ASSESSMENT AND DEVELOPMENT PROGRAM

The XGene Quality Culture Assessment and Development Program uses ICH Q10 management responsibility criteria, FDA QMM quality maturity practice areas, and direct interview and observation methodology to measure quality culture maturity across six dimensions. The program produces a quality culture maturity score and a targeted culture development roadmap.

Dimension 1: Management Leadership Assessment of senior management engagement with quality system outputs — documented evidence of quality decisions at management review, resource allocation driven by quality objectives, management visibility on the manufacturing floor, and tone-at-the-top messaging that makes quality a leadership priority rather than a quality department function. Source references: ICH Q10 Section 2.1, ICH Q10 Section 4.1, FDA QMM Management Commitment to Quality practice area.

Dimension 2: Deviation Reporting Environment Assessment of deviation reporting rate in the context of process complexity, comparison of reporting rates across shifts and operating conditions, analysis of near-miss reporting behavior, and evaluation of organizational response to reported deviations as an indicator of whether reporting is encouraged or suppressed. Source references: ICH Q9(R1) risk identification principles, FDA QMM Advanced Pharmaceutical Quality System and Employee Engagement and Empowerment practice areas.

Dimension 3: Investigation Quality Structured review of investigation reports against analytical root cause criteria — does the investigation identify the mechanism of failure, consider systemic contributing factors, challenge initial cause assumptions, and produce CAPA plans that address identified root causes rather than retraining individuals? Assessment of repeat deviation rate as a lagging indicator of investigation effectiveness. Source references: ICH Q10 Section 3.2.2, FDA Quality Systems Approach guidance (2006).

Dimension 4: Right-First-Time Commitment Measurement of right-first-time batch release rate distinguished from overall batch release rate, direct observation and structured interview with manufacturing personnel to assess quality rationale understanding, and assessment of operational behavior consistency across supervised and unsupervised conditions. Source references: FDA QMM Management Commitment to Quality and Advanced Pharmaceutical Quality System practice areas, ISPE APQ Guide: Cultural Excellence.

Dimension 5: Continuous Improvement Activity Assessment of quality improvement initiatives across the organization — not just CAPA closure, but proactive quality improvement projects initiated from within the operational teams, process capability improvement driven by quality data, and evidence that quality trending outputs produce management action rather than documentation review. Source references: ICH Q10 Section 4, FDA QMM Advanced Pharmaceutical Quality System practice area.

Dimension 6: Employee Quality Understanding Structured interviews with operators, technicians, and supervisors across multiple shifts using standardized quality understanding questions — assessing comprehension of the quality rationale behind critical procedure steps, understanding of how individual operational behavior connects to patient safety outcomes, and quality ownership at the operational level. Source references: ICH Q10 management responsibilities for quality culture, FDA QMM Employee Engagement and Empowerment practice area, WHO TRS 986 Annex 2.

The assessment produces a quality culture maturity score across all six dimensions, a gap analysis against FDA QMM quality maturity criteria, and a targeted culture development roadmap with specific interventions for each identified gap — including management leadership development, reporting environment remediation, investigation quality training, and operational quality engagement programs.

Ask your manufacturing floor supervisors — not your quality directors — this question: “When an operator makes an error that doesn’t affect the batch result, what do they typically do?” — the answer tells you more about your quality culture than any quality metric report.