Frameworks / ICH Q10 - Pharmaceutical Quality System / ICH-Q10-Section3-ContinualImprovement-ProcessPerformance-CAPA-ChangeMgmt-MgmtReview ICH Q10 - Pharmaceutical Quality System
ICH Q10 Section 3 - Continual Improvement
ICH Q10 - Pharmaceutical Quality System ICH-Q10-Section3-ContinualImprovement-ProcessPerformance-CAPA-ChangeMgmt-MgmtReview: ICH Q10 Section 3 - Continual Improvement + Process Performance and Product Quality Monitoring + CAPA + Change Management + Management Review Section 3 establishes continual improvement of process performance and product quality. Section 3.1 Process Performance and Product Quality Monitoring: monitor and trend process performance (process capability Cp + Cpk + process performance Pp + Ppk) + product quality (critical quality attributes CQAs) over time; analyse trends + drift + variability + special cause + common cause + identify potential issues before deviation; statistical process control (SPC) + control charts + Westgard rules + Annual Product Quality Review (APQR) per 21 CFR 211.180(e) + EU GMP 1.10; Product Quality Review (PQR) European equivalent. Section 3.2 Corrective Action and Preventive Action (CAPA) System: documented process for identifying + analysing + addressing nonconformances + complaints + recalls + audit findings + deviations + out-of-specification (OOS) + out-of-trend (OOT); root cause analysis (RCA) using 5-Whys + Fishbone Ishikawa + Pareto + Fault Tree Analysis + Failure Mode Effects Analysis FMEA; corrective action (fix nonconformance) + preventive action (prevent recurrence + similar occurrences); effectiveness verification + horizontal expansion to similar products + processes + facilities; CAPA register + tracking + closure + management review. Section 3.3 Change Management System: documented change control covering: change request + impact assessment + risk evaluation per ICH Q9 + technical review + Quality Unit approval + regulatory assessment (variations + post-approval changes) + implementation planning + validation + verification + effectiveness review; change classifications (minor + moderate + major) per EU + FDA + WHO + ICH Q12 Established Conditions; supplier-initiated change notification (SCN) handling. Section 3.4 Management Review of Process Performance and Product Quality: periodic review of monitoring data + CAPA + complaints + recalls + audit findings + supplier performance + trends + improvement initiatives. Internal Audit Programme: independent audit + risk-based + competent auditors + report + closure + management review. Coordinates with FDA cGMP + EU GMP + ICH Q9 QRM + Q12 Lifecycle + ASTM + FDA Process Validation 2011 + PIC/S. ICH Q10 Section 3 + Continual Improvement + Process Performance + CAPA + Change applies.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 284 controls across 153 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
IEC62304-4.1 Quality Management System IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures IEC62304-8.2 Change Control IEC62304-9.4 Use Change Control Process IEC62304-9.6 Analyze Problems for Trends ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-5.6 Risk management ISO-15189-6.7 Service agreements ISO-15189-7.4 Post-examination processes ISO-15189-8.1 General requirements ISO-15189-8.4 Control of records ACQS-3-1 Safe and Effective Care ACQS-8-2 Clinical Governance ACQS-8-3 Continuous Improvement ACQS-8-4 Risk Management ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO-17025-8.1 Options ISO-17025-8.7 Corrective actions NISTSP82-1 OT Security Program Governance, Policy, Roles, and Safety-Security Integration NISTSP82-5 OT Configuration Management, Patching, Vulnerability Management, and Malware Protection NISTSP82-6 OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC NISTSP82-7 OT Incident Response, Forensics, Recovery, and Continuity PICSGMP-1 Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management PICSGMP-2 Chapter 2: Personnel - Qualified Personnel, Key Responsibilities, Training PICSGMP-5 Chapter 5: Production Operations and Material Management PICSGMP-7 Chapter 7: Outsourced Activities and Supplier Management FDBR-702 Definitions (§501.702) FDBR-704 Exemptions (§501.704) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) 60601-1.12 Accuracy of controls and instruments 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-20400-4.2 Principles of sustainable procurement ISO-20400-6.5 Monitoring and continuous improvement ISO-20400-7.2 Integrating sustainability into specifications ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities ISO-41001-10.1 Nonconformity and corrective action ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-10.2 Deviation, nonconformity and corrective action ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-6.2 Scope, Context and Criteria 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27014-1 Scope 27014-3 Terms and definitions 27014-5.6 Continuous improvement 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS MDS2-Person-Node-Authentication-Authorization-Auto-Logoff-AUTH-PAUT-NAUT MDS2 Authentication + Authorization + Auto Logoff + PAUT + NAUT + AUTH + Identity Management MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles MTCS-Logging-Monitoring-Compliance-Audit-SLA-Configuration-SIEM-SOAR-Cloud-Monitoring-CSPM MTCS Logging + Monitoring + Compliance + Audit + SLA + Configuration + SIEM + SOAR + CSPM MTCS-Operations-Physical-Network-Tier-III-Data-Centre-Hardening-Patching-Network-Segmentation-DDoS MTCS Operations + Physical + Network + Tier III Data Centre + Hardening + Patching + Segmentation + DDoS AQAP2110-3 Design and Development Control - NATO plus ISO 13485 Cross-Walk AQAP2110-7 Production, Special Processes, Inspection, Testing, and Records AQAP2110-8 Internal Audit, Management Review, Corrective Action, CofC, and Continual Improvement NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NISTSP34-5 Plan Testing, Training, and Exercises (TTE) NDPA-1 Applicability, Scope, and Carve-Outs NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-2 Lawful Basis, Consent, and Data Protection Principles NG-NDPA-5 Security of Processing, Breach Notification, and DPIA ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul ORANWG11-3 Cryptography, TLS, SSH, IPsec, and PKI Lifecycle Management ORANWG11-6 Security Test Specifications, Certification, and Conformance EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) EHDSREG-3 Secondary Use - Health Data for Research and Innovation EHDSREG-5 Cross-Border Health Data Flows 58.1 Scope 58.3 Definitions AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training CA-10 Selects and Develops Control Activities CA-12 Deploys Through Policies and Procedures DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA IMO-MSC-FAL-Recover-BackupRestore-ContinuityOfNavigation-LessonsLearned-Drills IMO MSC-FAL Recover Function - Backup and Restore + Continuity of Navigation + Continuity of Cargo Operations + Continuity of Propulsion + Lessons Learned + Drills + Resilience ISO-14064-1-5.1 Organizational boundaries ISO-14064-1-8 Quality management of the GHG inventory ISO-26262-3-5 Item definition ISO-26262-8-8 Change management ISO30401-15 Nonconformity and corrective action ISO30401-18 Innovation and change management ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations 27011-1 Scope 27011-3 Terms and definitions 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy ITAR-CompliancProgram-ICP-EmpoweredOfficial-Recordkeeping-5Years-Training-IT-Cloud-SupplyChain-Coord-EAR-OFAC-Wassenaar ITAR Compliance Program + Internal Compliance Program (ICP) + Empowered Official + 5-Year Recordkeeping + Training + IT/Cloud (GovCloud + Azure Gov + GCC High) + Supply Chain + Coord EAR + OFAC + Wassenaar + MTCR ITAR-Scope-AECA-22USC2778-22CFR120-130-DDTC-USML-21Categories-DefenseArticle-Service-TechnicalData ITAR Scope + Arms Export Control Act (22 USC 2778) + 22 CFR Parts 120-130 + Directorate of Defense Trade Controls (DDTC) + United States Munitions List (USML) 21 Categories + Defense Article/Service/Technical Data Definitions IsraelPPL-Database-Registration-Definition-Document-Security-Level-Classification-Sec7-8-PPA-Registry Israel POPL Database Registration + Section 7 Database Definitions + Section 8 Registration Requirement + Database Definition Document + Security Level Classification + PPA Public Registry + Amendment 13 Threshold Changes IsraelPPL-Scope-5741-1981-Knesset-Amendment13-March2024-BasicLaw-Dignity-Sec1-Right-Privacy Israel Protection of Privacy Law 5741-1981 Scope + Knesset + Amendment No. 13 March 2024 + Basic Law Human Dignity and Liberty + Section 1 Right to Privacy + Constitutional Status + Chapter 1 Infringement of Privacy NFPA1600-7.2 After-Action Reporting NFPA1600-8.2 Corrective Action NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP144-7 Cloud Workload Protection, Containers, Serverless, and Configuration NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP146-4 IaaS Operational Recommendations and Workload Hardening NRC7354-2 Critical Digital Asset (CDA) Identification, Scope, and Boundary NRC7354-4 Security Controls Implementation per NRC RG 5.71 Appendix B/C DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training PICERL-P2 Risk Assessment PICERL-P3 CSIRT Formation SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) SWIFTCSCF-3 Physically Secure the Environment (Objective 3) C1 Organizational Boundary C3 Scope 1 and 2 Coverage ISMSP-MS-04 Management Review and Improvement ISMSP-SYS-04 Vulnerability Management TEFCAREC-1 Common Agreement Conformance and Onboarding TEFCAREC-2 Privacy, Security, Minimum Necessary CFR211-A-3 Section 211.3 - Definitions API1164-23 Change management procedures AS9100D-10.2 Nonconformity and Corrective Action 4.4.1 Resources, Roles, Responsibility, and Authority AWWA-1.1 Security Policy and Governance AZ-DPA-2 Article 2 - Basic Concepts BSI-24 Configuration change control CPG-6.B Supply Chain Incident Reporting COBIT-BAI02 Managed requirements definition IS.AR.210 Findings and Corrective Actions QMSR-820.10 Requirements for a Quality Management System - ISO 13485:2016 Sections 4-8 incorporation (§820.10) FFIEC-05 Roles and responsibilities definition CA-9 Internal System Connections CA-9 Internal System Connections Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ICP-1 Objectives, Powers and Responsibilities of the Supervisor 62351-2 Glossary of terms IEC62443-23 Change management procedures IEEE1686-Section5.5-5.6-5.7-5.8-Firmware-ConfigSW-TimeSync-DataAtRest IEEE 1686 Section 5.5-5.8 - Firmware Quality + Configuration Software Security + Time Synchronisation + Data Protection at Rest + Patch + Malware + Hardening + Vulnerability ISO28001-PI-01 Personnel Security Screening ISO-39001-10.1 Nonconformity and corrective action ISO20000-06 Change management processes 27007-5.2 Audit Programme Objectives ISO27019-23 Change management procedures ISO27043-04 Roles and responsibilities definition 27050-1.4 Terms and definitions 27400-3 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions ISO21434-04 Roles and responsibilities definition ITIL4-06 Change management processes ITU-Scope-Constitution-Convention-Radio-Regulations-WRC-Quadrennial-Treaty-Art1-Definitions ITU Constitution + Convention + Radio Regulations Scope + Article 1 Definitions + Article 2 Nomenclature + WRC World Radiocommunication Conference Quadrennial Treaty Process + Member States + Sector Members BIPA-SEC5-1 Biometric Identifier Definition RBI-AA-Ecosystem-FIPs-FIUs-Interoperability-Onboarding-Sahamati-DPI-IndiaStack RBI AA Ecosystem - Financial Information Providers (FIPs) + Financial Information Users (FIUs) + Interoperability + Sahamati SRO Onboarding + DPI India Stack + Cross-Sector Regulators ItalyCodice-DataSubjectRights-Limitations-Deceased-Minors-14-Years-Italian-2undecies-2duodecies-2terdecies Italy Codice Data Subject Rights + Article 2-undecies Limitations + Article 2-duodecies Deceased Persons Rights + Article 2-terdecies Minors Rights (14 Years Consent Age) + GDPR Articles 15-22 + Italian Civil Procedure Remedies MAS-TRM-Governance-Chapters-2-3-Board-Senior-Management-Risk-Framework-Information-Asset-Management MAS TRM Governance + Chapters 2-3 + Board + Senior Management + Risk Framework + Information Asset Management NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) PQC-4 FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NISTSP115-1 Scope, Methodology, and Assessment Planning NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP30-8 Risk Assessment Maintenance, Continuous Monitoring, and Integration with the RMF NISTSP37-7 RMF Monitor Step: Continuous Monitoring and Ongoing Authorisation NISTSP39-5 Risk Monitoring: Effectiveness, Changes, Compliance, and Reassessment Triggers NISTSP61-2 Computer Security Incident Response Team (CSIRT) Structure and Staffing NISTSP63R4-1 Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework NISTSP92-1 Log Management Programme, Policy, Roles, and Operational Runbooks NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards OSFIB13-1 Governance, Risk Management, and Three Lines of Defense OWASPASVS-1 Architecture, Design and Threat Modelling (V1) OPENBANK-2 Strong Customer Authentication (SCA), Consent Lifecycle, and Customer UX OSSFSC-1 Branch Protection, Code Review, and Repository Governance 2.2.2 2.2.2 Vendor default accounts managed PCI-P2PE-05 Roles and responsibilities definition PCI-PIN-05 Roles and responsibilities definition PCI-SSF-05 Roles and responsibilities definition PSDTWO-1 Strong Customer Authentication (SCA) Core Requirements PTESPHASE-1 Pre-Engagement Interactions and Scoping PSPF24-1 Security Culture, Governance, Risk Management 2.5.2 Verification Activities IM8-RES.2 Disaster Recovery FADP-5 Definitions (Article 5) UKBRIBE-3 Due Diligence on Third Parties OB-OPS.2 Performance Standards 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern USMCADIGITAL-1 Cross-Border Data Flows and Localisation VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) VPSHR-3 Implementation Guidance and Reporting W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 284 it maps to, and the evidence behind each claim, over MCP and REST.