A quality system can be fully documented and still not function as a system. This model separates whether procedures exist from whether the processes connect, which is the distinction inspectors actually test.
Maturity here is about whether the quality system works as a connected whole, not whether the procedures are written.
The process runs when something forces it to.
Procedures exist in places, are inconsistent between departments, and the written system does not describe how the site actually operates.
Typical weakness. The quality manual describes an organisation the site does not have.
Risk. A documented process nobody follows evidences your own non-compliance.
Procedures exist and are followed, mostly.
A defined document set exists and is generally followed, but the processes are separate: deviations, CAPA and change control do not feed each other.
Typical weakness. Informal workarounds appear because the formal route is too slow.
Risk. Drift between the written procedure and the real process, visible in records without anyone admitting it.
The process is designed, resourced and measured.
Processes are proportionate to risk, ownership is defined, and routing is tiered so minor events do not consume major-event effort.
Typical weakness. Metrics are collected because a procedure requires it rather than because anyone reads them.
Risk. The system runs but cannot demonstrate its own effectiveness.
It connects to the rest of the quality system.
Deviation trends trigger corrective action, corrective action drives change control, and management review sees all of it with decisions recorded.
Typical weakness. Review depth varies with who chairs it.
Risk. Dependence on individuals for the judgement the system should encode.
It improves itself, and the improvement holds.
The system is periodically assessed for effectiveness, weaknesses surface internally first, and improvements are verified rather than assumed.
Typical weakness. Complacency: a mature system that stops being challenged decays quietly.
Risk. Maturity is a state, not an achievement — it reverts without maintenance.
Part I, Chapter 1 — Pharmaceutical Quality System
ICH Q10 — Pharmaceutical Quality System
These five levels are a GMPConsultant.nl framework for structuring a conversation about capability. They are not an official regulatory classification, no authority recognises or issues them, and a maturity level is not a statement of GMP compliance.
The GMP Health Index scores seven domains and maps each to a maturity level, in about ten minutes. It calculates in your browser and stores history on your device only.