Pharmaceutical Quality Systems Explained for Cannabis Companies

SEO title: Pharmaceutical Quality Systems Explained for Cannabis Companies

Meta description: A practical guide to pharmaceutical quality systems for medical cannabis companies, covering governance, QRM, documentation, CAPA, change control, deviations and management review.

Reading time: 11 minutes

A quality system is not a folder of procedures

One of the most common weaknesses in early-stage cannabis businesses is the belief that a GMP system is mainly a document set. Procedures are important, but they are only one part of a pharmaceutical quality system. A real quality system defines how the company makes decisions, controls risk, manages change, investigates problems, trains people, qualifies suppliers, releases batches and improves over time.

For medical cannabis companies, this distinction matters because the industry often grows from cultivation, extraction or commercial entrepreneurship into regulated medicinal supply. That transition creates pressure. Companies may have good people, good intentions and many procedures, but still lack a connected system that can withstand pharmaceutical scrutiny.

A Pharmaceutical Quality System, or PQS, is the operating model that makes GMP reliable. It connects senior management, QA, production, QC, engineering, validation, regulatory affairs, supply chain and contractors into one controlled way of working.

What is a Pharmaceutical Quality System?

A Pharmaceutical Quality System is the structured set of responsibilities, processes, procedures, controls and behaviours used to ensure that medicinal products are consistently manufactured, controlled and released to the required quality standard. In EU GMP, the PQS is a central expectation. It is not limited to manufacturing operations; it covers the full lifecycle of the product and the systems that support it.

In practical terms, the PQS answers the questions a regulator, Qualified Person, customer auditor or corporate partner will eventually ask:

• Who is responsible for quality decisions?
• How are risks identified and controlled?
• How are procedures approved and kept current?
• How are personnel trained and qualified?
• How are deviations investigated?
• How are changes assessed before implementation?
• How are suppliers qualified and monitored?
• How is equipment and software qualified?
• How are batches reviewed and released?
• How does management know whether the system is improving?
• Good Documentation Practice (GDP)

If those questions are answered through isolated documents, the system will feel fragile. If they are answered through connected processes and evidence, the organisation begins to look pharmaceutical.

Why PQS matters for medical cannabis

Cannabis quality risks are not theoretical. The starting material is biological. Microbial contamination, pesticide residues, heavy metals, mycotoxins, solvent residues, variability in active content, stability concerns, packaging risks and data integrity issues can all affect patient safety and regulatory confidence.

A strong PQS helps a cannabis company control these risks systematically rather than reacting to them case by case. It also supports commercial maturity. Distributors, investors, QPs, clinics and corporate partners will usually place more trust in an organisation that can demonstrate how quality is governed, monitored and improved.

The PQS is especially important where a company wants to move from local or early-stage supply into more demanding European medicinal markets. As expectations increase, informal controls become less acceptable. Companies need evidence, traceability and a clear operating model.

Core elements of a cannabis PQS

1. Quality policy and management responsibility

Senior management must define the quality direction of the company and provide the resources needed to maintain it. A quality policy should not be a decorative statement. It should be visible in decisions about staffing, facilities, equipment, suppliers, timelines and release decisions.

2. Document control and good documentation practice

Procedures, forms, specifications, batch records, protocols and reports must be controlled. Documents should be approved before use, version controlled, periodically reviewed and accessible to the people who need them. Good Documentation Practice provides the evidence that activities were performed correctly.

3. Training and competence

Training should be role-based and linked to actual job responsibilities. A training matrix is not enough if it only tracks signatures. The company should be able to show that personnel understand the procedures they use and the quality impact of their work.

4. Deviation management

Deviations are signals from the system. A good deviation process captures what happened, assesses product impact, investigates root cause and defines actions that prevent recurrence. Weak deviation systems tend to close events administratively without learning from them.

5. CAPA

Corrective and Preventive Action is one of the clearest indicators of quality maturity. CAPA should focus on effective, risk-based actions. Too many low-value CAPAs can overwhelm the organisation, while too few may indicate that investigations are not identifying systemic issues.

6. Change control

Changes to facilities, equipment, materials, suppliers, methods, specifications, software, processes and documents should be assessed before implementation. The purpose is not to block progress; it is to ensure that changes are understood, approved and verified where necessary.

7. Supplier qualification

Cannabis supply chains can be complex. Starting materials, packaging components, laboratories, logistics providers, equipment vendors and outsourced service providers can all affect quality. Supplier qualification should be proportionate to risk and supported by documented evaluation.

8. Qualification and validation

Facilities, utilities, equipment, processes, cleaning methods and computerised systems may require qualification or validation depending on their impact. A mature PQS connects validation planning to risk, intended use and lifecycle control.

9. Product Quality Review and management review

Quality data should be reviewed periodically. Trends in deviations, CAPA, complaints, OOS results, environmental monitoring, supplier performance, audit findings and batch outcomes help management understand whether the system remains in control.

10. Self-inspection and audit readiness

Internal audits test whether the PQS works in practice. They should not be treated as a box-ticking exercise. A good self-inspection programme identifies weaknesses before customers or regulators do.

Quality governance: the missing layer

Many cannabis companies have procedures but weak governance. Governance is the layer that ensures quality issues are escalated, decisions are recorded, risks are reviewed and management stays accountable. Without governance, quality becomes reactive and dependent on individual people.

Useful governance mechanisms include quality management review meetings, deviation review boards, change control committees, validation steering meetings, supplier review, training effectiveness review and routine KPI trending. The level of formality should match the size and risk of the organisation, but the principle is the same: important quality decisions should be visible, justified and documented.

This is where a cannabis company begins to move from “we have GMP documents” to “we operate a controlled pharmaceutical system.”

Quality Risk Management

Quality Risk Management, commonly linked to ICH Q9, helps companies make proportionate decisions. It does not mean doing less. It means focusing attention and resources where risk to product quality and patient safety is greatest.

In cannabis operations, QRM can support decisions about cleanroom grades, environmental monitoring locations, supplier qualification depth, validation scope, cleaning controls, sampling plans, equipment criticality, deviation impact and training priorities.

The strongest risk assessments are based on process knowledge and data. The weakest are generic scoring exercises where the answer is already decided before the assessment starts. ECI should position QRM as a decision-support discipline, not a paperwork tool.

Common PQS mistakes in cannabis companies

• Writing SOPs before designing the system. Procedures should describe a coherent process, not compensate for the absence of one.
• Copying templates from pharma without adapting them. Templates help, but the system must fit the product, process and organisation.
• Overloading QA. Quality is owned by the company, not only the QA department.
• Closing deviations too quickly. Administrative closure is not the same as understanding root cause.
• Using change control too late. Change control should assess changes before implementation, not document decisions already made.
• Failing to review trends. Repeated minor issues often reveal major system weaknesses.
• Not linking training to competence. Training records should support effective performance, not just inspection evidence.
• Treating management review as a slide deck. Management review should drive decisions, resources and improvement.

A practical PQS implementation roadmap

1. Define the operating model. Clarify what the company manufactures, its target markets, regulatory pathway and quality responsibilities.
2. Map the core quality processes. Document how deviations, CAPA, change control, training, suppliers, documents and release decisions will work.
3. Prioritise high-risk systems first. Focus on systems directly linked to patient safety, batch release and regulatory exposure.
4. Create lean procedures. Write procedures that people can actually follow. Avoid copying complex corporate SOPs into a small organisation.
5. Train by role. Make sure each function understands its responsibilities within the PQS.
6. Start trending early. Even simple spreadsheets or dashboards can identify patterns if they are controlled and reviewed.
7. Hold management review. Use real data to decide what needs improvement.
8. Audit the system. Test whether the PQS works before an external auditor does.

Frequently asked questions

Is a PQS the same as a QMS?

The terms are often used closely. In pharmaceutical manufacturing, PQS emphasises the lifecycle, GMP and medicinal product context. A QMS may be broader or used in other industries. For ECI purposes, PQS is the preferred term when discussing pharmaceutical GMP maturity.

Can a small cannabis company have a simple PQS?

Yes. The system should be proportionate to the company’s size, product risk and regulatory pathway. Simple does not mean informal. Even a small company needs controlled processes and evidence.

What is the first PQS process to implement?

Document control, training, deviation, CAPA and change control are usually early priorities because they support almost every other GMP activity.

Who owns the PQS?

Senior management owns the system. QA manages and maintains many parts of it, but production, QC, engineering, validation, supply chain and leadership all have responsibilities.

How do you know if a PQS is mature?

A mature PQS produces reliable records, effective investigations, controlled changes, meaningful trend review, timely escalation and visible management decisions. It works during routine operations, not only during audits.

Key takeaways

• A Pharmaceutical Quality System is the operating model for controlled GMP behaviour, not just a library of SOPs.
• Cannabis companies need PQS maturity as they move into serious medicinal and European supply chains.
• Deviation, CAPA, change control, document control, training and supplier qualification form the core system.
• Quality governance and management review are often the missing layer in early-stage companies.
• A proportionate but effective PQS can be built in stages and improved over time.

References

• European Commission, EudraLex Volume 4, Chapter 1: Pharmaceutical Quality System.
• European Commission, EudraLex Volume 4, EU Guidelines for Good Manufacturing Practice.
• ICH Q9: Quality Risk Management.
• ICH Q10: Pharmaceutical Quality System.
• PIC/S Guide to Good Manufacturing Practice for Medicinal Products.