Quality management system
Definition
Quality management system
A quality management system is the written set of rules, steps and records a firm uses to make quality repeatable. It names who does what, to which standard, and with what proof. A certificate only shows that somebody checked the system.
Two live neighbours sit close by. ISO 9001 is the international standard that says what such a system must deliver, and quality assurance is the preventive work the system organises.
Keep the direction straight. The standard governs the system; the system is not the standard. A firm can run a working quality management system and hold no certificate at all, and plenty of regulated manufacturers do exactly that.
Key takeaways
- A quality management system is documentation plus evidence: the rule written down, and the record proving it was followed.
- Four layers carry it — policy, procedures, work instructions and records — with audit checking the gap between them.
- In United States medical devices the system is law, not a choice.
- Certification proves an auditor looked; it does not grade the output.
How it works
A quality management system works by writing down the intent, the method and the evidence for every process that affects output, then auditing the distance between document and practice. Records prove the steps happened. Management review decides what gets fixed.
| Layer | What it holds | Who owns it |
|---|---|---|
| Quality policy | Intent and scope, signed by leadership | Executive team |
| Procedures | How each process runs, stage by stage | Process owners |
| Work instructions | Desk level detail for a single task | Team leads |
| Records | Evidence that the steps actually happened | Everyone doing the work |
| Internal audit | The gap between the document and practice | Audit function |
| Management review | Decisions on what gets corrected, and when | Executive team |
The procedure layer is where most firms already have material. A standard operating procedure library is half a system; it becomes a system once records, audits and review are attached to it.
Before you can write procedures you need the real route work takes, which is why process mapping comes first. Map the process people actually run, not the one on the intranet.
A document is not a record, and that distinction decides audits. A procedure says what should happen. A record proves what did happen, with a date and a name attached.
Firms with shelves of the first and none of the second fail every inspection they meet.
Nonconformance handling is the engine that makes the system improve. Log the failure, contain it, find the cause, change the process, then check the change held — that last step is the one most teams quietly drop.
Audit cadence should follow risk rather than the calendar. Processes touching a customer or a regulator get checked more often than the ones that only annoy you internally.
Law can make the system compulsory. Title 21 of the Code of Federal Regulations, Part 820, is titled the Quality Management System Regulation, and its section 820.10 sets requirements for a quality management system.
That rule took effect on 2 February 2026. Section 820.35 carries the control of records requirement, and section 820.45 covers device labelling and packaging controls.
Read that part carefully. Sections 820.20 through 820.30 now read as reserved, and section 820.7 incorporates ISO 13485 by reference instead — so the detail those sections once carried is no longer written into the rule itself.
Section 820.3 goes further and adopts the definitions in ISO 13485 and Clause 3 of ISO 9000 outright, so a device maker now reads the standard and the regulation together rather than apart.
Voluntary frameworks do similar work without a regulator. The 2026 revision of the Baldrige Excellence Framework, published by the National Institute of Standards and Technology, adds maturity pathways and scoring rubrics for firms assessing themselves.
Examples
The same four layers appear in very different places, and the evidence demanded is what changes. A regulator wants a signed record, a buyer wants an audit report, and a customer only ever sees the output.
Medical device manufacturing. A device maker selling into the United States keeps design records, supplier files and complaint handling under one documented system, because an inspector will ask for the record, not the intention.
The system is also what makes a recall survivable, because traceability is built rather than assembled in a panic.
Offshore contact centres. Providers in the Philippines and India commonly pair written call handling procedures with monitored scorecards.
COPC certification is the sector specific audit buyers ask about on the shortlist call. Ask to see the last internal audit report, not just the certificate.
Food processing. Plants run documented hazard controls with signed records at each step, so a batch can be traced back to a shift and a supplier within hours of a complaint.
Financial services back office. Offshore teams processing claims or payments keep a written check at each handover, with a named reviewer and a timestamp, because a regulator will ask who approved what and when.
Related terms
- iso 9001: the international standard setting what the system must deliver, independent of how it is built.
- quality assurance: the preventive activity the system organises and records.
- standard operating procedure: one documented process, which is a component rather than the whole system.
- cost of poor quality: the money a weak system spends on rework, scrap and claims.
- business process improvement: the change work a management review commissions once a gap is proven.
FAQ
Is a quality management system the same as ISO 9001?
No. ISO 9001 is a standard describing what the system must achieve, while the quality management system is the actual machinery a firm builds and runs. One is a specification; the other is the thing built against it.
Do you need certification to have one?
No. Certification is independent confirmation, and many regulated manufacturers run documented systems that are inspected by a regulator rather than certified by a body.
What is the minimum documentation?
A quality policy, procedures for the processes that affect output, work instructions where detail matters, and records proving each was followed. Anything beyond that should earn its place by preventing a real failure.
How often should internal audits run?
Often enough that every process is checked within a planned cycle, usually once a year. Add unplanned audits wherever defects or complaints cluster, because that is where the document and the practice have already parted company.
Who should own the system?
Leadership owns the policy and the review, while process owners own their procedures. Handing the whole thing to one quality manager is the classic failure.
Compare delivery partners with audited quality systems in the Outsource Accelerator BPO hubs before you sign anything.
Independent
