PIC/S Guide to Good Manufacturing Practice for Medicinal Products
Pharmaceutical Quality System

PIC/S Guide to Good Manufacturing Practice for Medicinal Products PICSGMP-1: Chapter 1: Pharmaceutical Quality System (PQS) and Quality Risk Management

Per PIC/S Guide to GMP Chapter 1: implement Pharmaceutical Quality System (PQS) including Quality Risk Management. Requirements include (a) implement Pharmaceutical Quality System (PQS) integrating GMP including senior management responsibility + (b) operate Quality Management System covering all activities affecting product quality + (c) implement Quality Risk Management (QRM) including formal process for assessment + control + communication + review of risks throughout product lifecycle aligned to ICH Q9 + (d) operate Product Quality Review (PQR) at least annually including raw materials + in-process controls + finished product + complaints + deviations + change control + (e) ensure adequate organisational structure + resources + responsibilities + (f) maintain documented PQS + ongoing improvement.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 123 controls across 57 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-6.4 Privacy risk treatment
  • 27557-6.6 Recording and reporting
  • 27557-7.3 Risk-based privacy program implementation

Aged Care Quality Standards 2019 (repealed edition) · 4 controls

  • ACQS-3-1 Safe and Effective Care
  • ACQS-8-2 Clinical Governance
  • ACQS-8-3 Continuous Improvement
  • ACQS-8-4 Risk Management

EASA Part-IS - Information Security in Aviation · 4 controls

  • IS.AR.210 Findings and Corrective Actions
  • IS.D.OR.210 Information Security Risk Treatment
  • IS.I.OR.210 Information Security Risk Treatment
  • IS.I.OR.220 Information Security Risk Management

ICH Q10 - Pharmaceutical Quality System · 4 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 4 controls

  • 60601-1.12 Accuracy of controls and instruments
  • 60601-1.4.1 General requirements
  • 60601-1.4.2 Risk management process
  • 60601-1.5.1 General requirements for testing

IEC 62304:2015 Medical Device Software Lifecycle Processes · 4 controls

  • IEC62304-4.1 Quality Management System
  • IEC62304-5.1 Software Development Planning
  • IEC62304-7.4 Risk Management of Software Changes
  • IEC62304-9.6 Analyze Problems for Trends

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 4 controls

  • ISO-15189-5.6 Risk management
  • ISO-15189-7.4 Post-examination processes
  • ISO-15189-8.1 General requirements
  • ISO-15189-8.4 Control of records

ISO/IEC 27003:2017 · 4 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

FFIEC IT Examination Handbook · 3 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

ISO/IEC 23894:2023 · 3 controls

  • ISO23894-5.1 Leadership and Commitment
  • ISO23894-5.2 AI Risk Management Integration
  • ISO23894-5.5 Framework Evaluation

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders

NIST SP 800-53 Rev 5 · 3 controls

PCI P2PE · 3 controls

  • PCI-P2PE-16 Due diligence and onboarding
  • PCI-P2PE-18 Ongoing monitoring and assessment
  • PCI-P2PE-19 Concentration risk management

PCI PIN Security · 3 controls

  • PCI-PIN-16 Due diligence and onboarding
  • PCI-PIN-18 Ongoing monitoring and assessment
  • PCI-PIN-19 Concentration risk management

PCI SSF · 3 controls

  • PCI-SSF-03 Risk appetite and tolerance for IT risk
  • PCI-SSF-16 Due diligence and onboarding
  • PCI-SSF-17 Contractual security requirements

Regulation on the European Health Data Space (EHDS) · 3 controls

  • EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29)
  • EHDSREG-3 Secondary Use - Health Data for Research and Innovation
  • EHDSREG-5 Cross-Border Health Data Flows

APRA CPS 234 · 2 controls

  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

AS9100D - Aerospace Quality Management System · 2 controls

  • AS9100D-10.2 Nonconformity and Corrective Action
  • AS9100D-8.1 Operational Planning and Control

BS 65000:2014 - Guidance on Organizational Resilience · 2 controls

  • BS65000-RM-01 Resilience Journey
  • BS65000-RM-02 Integrated Approach

COSO Internal Control - Integrated Framework (2013) · 2 controls

  • CA-10 Selects and Develops Control Activities
  • CA-12 Deploys Through Policies and Procedures

FFIEC Cybersecurity Assessment Tool (CAT) · 2 controls

  • CAT-D1-2 Risk management
  • CAT-ML-2 Evolving

Florida Digital Bill of Rights (FDBR) · 2 controls

  • FDBR-704 Exemptions (§501.704)
  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

ISO 20400:2017 - Sustainable Procurement · 2 controls

  • ISO-20400-4.5 Key considerations for sustainable procurement
  • ISO-20400-6.5 Monitoring and continuous improvement

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration · 2 controls

  • ISO-17025-8.1 Options
  • ISO-17025-8.7 Corrective actions

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management · 2 controls

  • NFPA1600-7.2 After-Action Reporting
  • NFPA1600-8.2 Corrective Action

SWIFT CSCF · 2 controls

  • SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1)
  • SWIFTCSCF-3 Physically Secure the Environment (Objective 3)

South Korea ISMS-P · 2 controls

  • ISMSP-MS-02 Risk Management
  • ISMSP-MS-04 Management Review and Improvement

TEFCA - Trusted Exchange Framework and Common Agreement · 2 controls

  • TEFCAREC-1 Common Agreement Conformance and Onboarding
  • TEFCAREC-2 Privacy, Security, Minimum Necessary

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-82 Part A Compliance

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment

Annex 11 to EU GMP - Computerised Systems · 1 control

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • P1-S2 Risk-Management Systems

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DIQ-2 Data Quality Management

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

FDA Quality Management System Regulation (QMSR) · 1 control

  • QMSR-820.10 Requirements for a Quality Management System - ISO 13485:2016 Sections 4-8 incorporation (§820.10)

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)

IEC 62443 · 1 control

  • IEC62443-21 Supply chain risk management for critical components

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3) · 1 control

  • ISO-14064-1-8 Quality management of the GHG inventory

ISO 22320:2018 · 1 control

  • ISO-22320-4.3 Risk-based approach

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-SA-04 Security Risk Treatment Planning

ISO 30401 · 1 control

  • ISO30401-15 Nonconformity and corrective action

ISO 39001:2012 - Road Traffic Safety Management · 1 control

  • ISO-39001-10.1 Nonconformity and corrective action

ISO 41001:2018 - Facility Management Systems · 1 control

  • ISO-41001-10.1 Nonconformity and corrective action

ISO 56002 · 1 control

  • ISO-56002-10.2 Deviation, nonconformity and corrective action

ISO/IEC 27014:2020 · 1 control

  • 27014-5.6 Continuous improvement

ISO/IEC 27019:2024 · 1 control

  • ISO27019-21 Supply chain risk management for critical components

Kuwait National Cybersecurity Framework · 1 control

NIST SP 1800-32 · 1 control

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

SQF Code Edition 9 - Safe Quality Food · 1 control

  • 2.5.2 Verification Activities

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-TPM.4 Supply Chain Risk Management

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

Voluntary Principles on Security and Human Rights (VPs) · 1 control

  • VPSHR-3 Implementation Guidance and Reporting

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 123 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll PIC/S Guide to Good Manufacturing Practice for Medicinal Products controls