CannyPQMS: The Pharmaceutical Quality Management System Built for Zero FDA Warning Letters.
Enterprise pharmaceutical quality management system with 18 integrated modules. FDA 21 CFR Part 11 compliant. Audit-ready from Day 1.
What is a Pharmaceutical Quality Management System?
A pharmaceutical quality management system (pharma QMS) is a formalised, documented framework of policies, processes, procedures, and records that a pharmaceutical manufacturer puts in place to ensure every product it makes is consistently safe, effective, and of the quality intended. Under international regulatory frameworks:including the US FDA's 21 CFR Parts 210 and 211, the ICH Q10 guideline on Pharmaceutical Quality System, the EU's GMP Annex 11, and the WHO's Good Manufacturing Practice guidelines:a QMS is not optional. It is a legal prerequisite for manufacturing, importing, and exporting pharmaceutical products to regulated markets. A QMS covers every lifecycle stage of a medicine: raw material qualification, in-process controls, batch release, deviation and CAPA management, equipment qualification, analytical validation, change control, and post-market complaint handling. For manufacturers operating in countries such as India, Nigeria, or the USA, the pharmaceutical quality management system is the single most scrutinised aspect of any regulatory inspection. An inspector from the FDA, NAFDAC (Nigeria), EMA, or WHO is not examining your factory walls:they are examining your QMS records. Failures in the QMS:missing CAPA root causes, uncontrolled SOP versions, undocumented deviations:are directly cited in FDA Warning Letters, Form 483 observations, and import alerts. A robust, technology-enabled pharmaceutical quality management system is therefore both a patient safety obligation and a business survival requirement for any company participating in the global medicines supply chain.
CannyPQMS: Pharmaceutical Quality Management Software for Regulated Manufacturers
CannyPQMS is an enterprise pharmaceutical quality management system (pharma QMS software) developed by CannyMinds Technology Solutions. It unifies 18 GxP-critical quality processes:including CAPA management, document control, deviation tracking, audit management, and 21 CFR Part 11 electronic signatures:into a single on-premise platform purpose-built for regulated pharmaceutical environments.
Unlike generic enterprise software adapted from manufacturing or ISO-only industries, CannyPQMS is designed exclusively for pharma, biotech, medical device manufacturers, contract research organisations (CROs), and API producers who operate under FDA 21 CFR Part 11, ICH Q9, EMA GMP, WHO GMP, and CDSCO India Schedule M compliance frameworks. Every module generates an immutable, timestamped change record. Every workflow enforces multi-level approval before a quality record is closed. Every record is signed with a 21 CFR Part 11 compliant electronic signature that displays the signatory's printed name, date, time, and the meaning of the signature act.
CannyPQMS is deployed on-premise:meaning all quality data resides within the pharmaceutical manufacturer's own IT infrastructure, satisfying data sovereignty requirements for FDA, NAFDAC, and EMA inspections. No third-party cloud dependencies. No data residency concerns. CannyPQMS is deployed across pharmaceutical manufacturers in India, Nigeria, and the USA:helping quality teams pass FDA inspections, respond to Form 483 observations, and achieve zero critical audit findings.
What Happens When Pharmaceutical Quality Management Fails?
The consequences of inadequate pharmaceutical quality management are not theoretical. The US FDA publishes Warning Letters and import alerts publicly. A single critical finding:an unlinked CAPA, a missing deviation log, a calibration overdue by 47 days:can trigger consequences that cost a manufacturer months or years of market access.
FDA Form 483:CAPA Not Linked to Root Cause
Problem:
12 open CAPAs with no documented root cause analysis. No answer on record. Warning Letter. Export ban. Revenue loss in the crores.
CannyPQMS Fix:
CAPA module mandates root cause linkage before closure. Every CAPA traces back to its originating event with timestamps and e-signatures at every stage.
SOP Version Chaos:Operator Follows Obsolete Procedure
Problem:
Batch manufactured using SOP v2.1. Current approved version is 3.0. SOPs in a shared drive anyone could edit. Batch recall. Investigation. CAPA spiral.
CannyPQMS Fix:
DMS enforces version control with controlled distribution. Obsolete SOPs automatically superseded. Operators only access the currently approved version.
Audit Finding:No Deviation Log for OOS Result
Problem:
OOS result verbally discussed, never formally logged. No investigation. No CAPA. The batch was released.
CannyPQMS Fix:
Deviation module mandates formal logging of every OOS/OOT event with investigation timeline and mandatory CAPA linkage before closure.
Calibration Overdue:Batch Released with Uncalibrated Instrument
Problem:
HPLC calibration expired 47 days ago. Discovered during EMA inspection. Batch recall. GMP certificate withdrawal.
CannyPQMS Fix:
Calibration module tracks every instrument, sends alerts at 30/15/7 days before expiry, and blocks batch release when any linked instrument is overdue.
Supplier Quality Failure:Unqualified Vendor Supplied API
Problem:
API supplier onboarded without qualification. No AVL entry created. Contamination event triggers multi-batch recall and regulatory notification.
CannyPQMS Fix:
Supplier module enforces full qualification before AVL activation. Periodic requalification auto-scheduled. No qualified supplier, no purchase order.
Change Control Gap:Process Change Made Without Validation
Problem:
Granulation speed adjusted verbally. No change control. No impact assessment. Six weeks later batch fails dissolution testing.
CannyPQMS Fix:
Change Control mandates formal request, cross-functional impact assessment, multi-level e-signature approval, and post-implementation effectiveness check before any change is physically implemented.
What Are the 18 Modules of CannyPQMS?
CannyPQMS covers every GxP process in a single pharmaceutical quality management system. No separate point solutions. No data silos between quality functions. Every module shares one immutable activity log, one user permission framework, and one compliance dashboard.
Module 1
Document Management
Module 2
Change Control
Module 3
Deviation Management
Module 4
CAPA Management
Module 5
Audit Management
Module 6
Training Management
Module 7
Supplier Quality
Module 8
Complaint Management
Module 9
Risk Management
Module 10
Non-Conformance
Module 11
Calibration
Module 12
Equipment / Assets
Module 13
Validation
Module 14
Regulatory Compliance
Module 15
Management Review
Module 16
Dashboard & Reporting
Module 17
Electronic Signature
Module 18
Collaboration Tool
Module 1 of 18
Document Management System (DMS)
Uncontrolled documents are the most frequently cited category in FDA 483 observations:because when operators access SOPs from shared drives, email attachments, or printed binders, there is no guarantee they are working from the current approved version. CannyPQMS DMS controls the complete lifecycle of every GxP-critical document:from first-draft creation through multi-level review, approval, controlled distribution, periodic review, and final archival:ensuring the only version an operator can access is the one QA has approved.
What it does:
- Create SOPs, policies, work instructions, and quality records with structured templates
- Route through configurable multi-level review and approval workflows with e-signatures
- Automatically supersede and retire obsolete document versions upon approval
- Distribute controlled copies exclusively to authorised, role-matched recipients
- Schedule periodic document reviews with automated reminders to document owners
- Log every document action in a tamper-evident, timestamped action history
Regulatory Compliance
FDA 21 CFR Part 11, FDA 21 CFR Part 211.68, EU GMP Annex 11, ICH Q10 Section 4
Why This Matters
Failure to maintain version-controlled documents is one of the top three most-cited observations in FDA 483s. An operator following an obsolete SOP is a GMP violation regardless of intent.
Module 2 of 18
Change Control Management (CCM)
When a process change is implemented without a formal change record:even a minor equipment setting adjustment:and that change affects a validated parameter, the entire validation for that process must be reassessed. Every batch manufactured between the undocumented change and its discovery is in question. CannyPQMS CCM enforces an impact-first philosophy across every proposed change to pharmaceutical processes, equipment, materials, facilities, computer systems, and quality documents: no change is physically implemented without a documented impact assessment and multi-level approved sign-off.
What it does:
- Initiate change requests with mandatory classification (minor / major / critical)
- Conduct cross-functional impact assessment and risk evaluation
- Route multi-level approval workflows with 21 CFR Part 11 compliant e-signatures
- Verify and document effectiveness of the change after implementation
- Link change records bidirectionally to Validation, Deviation, and CAPA modules
Regulatory Compliance
ICH Q10 Section 3.2, FDA 21 CFR Part 211.100, EU GMP Chapter 4, Schedule M (India)
Why This Matters
One unapproved change to a validated process parameter can collapse years of validation work. The cost is not just the investigation:it is the revalidation protocol, the process performance qualification batches, the regulatory notification if the change is post-approval, and the batch review for every batch made since the change occurred without authorisation.
Module 3 of 18
Deviation / Incident Management
Deviations managed verbally:a supervisor told, a decision made on the floor, no record written:leave a batch with no auditable justification for its release. Under FDA 21 CFR Part 211.192, every unexplained discrepancy must be fully investigated with a written record. CannyPQMS enforces a mandatory, structured pathway for logging, investigating, and closing every quality deviation:including OOS results, OOT observations, process parameter excursions, equipment failures, and environmental monitoring excursions:so that every deviation has a paper trail from detection to resolution.
What it does:
- Log every deviation with automatic severity classification (critical / major / minor)
- Assign investigators with due-date tracking and automated escalation alerts
- Track root cause analysis methodology with structured evidence attachment
- Block deviation closure until a CAPA has been raised, assigned, and accepted
- Generate investigation reports formatted for regulatory inspection submission
Regulatory Compliance
FDA 21 CFR Part 211.192, FDA 21 CFR Part 211.100, ICH Q10 Section 3.1, EMA GMP Chapter 1
Why This Matters
A deviation verbally discussed but not formally documented does not legally exist in the eyes of a regulatory inspector. An FDA auditor who finds an OOS result with no corresponding deviation record can trigger a Critical GMP finding.
Module 4 of 18
CAPA Management
Drives the complete corrective and preventive action lifecycle:from root cause-linked initiation through action planning, evidence collection, effectiveness verification, and final closure:for every quality event that requires systematic corrective action. CAPA is the cornerstone quality system element under FDA 21 CFR Part 820.100 and ICH Q10.
What it does:
- Initiate CAPAs from deviations, audit findings, complaints, NCRs, and management review
- Build structured action plans with owner assignment, action type, and due dates
- Mandate documented effectiveness verification before the CAPA can be formally closed
- Analyse CAPA trends by event source, product, site, and root cause category
- Display open CAPA ageing by 0–30, 31–60, 61–90, and 90+ day buckets on the dashboard
Regulatory Compliance
FDA 21 CFR Part 820.100, ICH Q10 Section 3.1, ISO 13485 Section 8.5.2, EU GMP Chapter 1, WHO GMP
Why This Matters
Inadequate CAPA systems are the single most frequently cited category of FDA 483 observations. An FDA inspector who finds CAPAs closed without root cause verification will issue a repeat observation:escalating directly to Warning Letter territory.
Module 5 of 18
Audit Management
Paper-based audit binders tell a different story during an inspection than the reality of your programme:findings logged in one folder, CAPA responses in another, follow-up status unknown. CannyPQMS gives QA teams a complete, paperless platform for planning, scheduling, executing, reporting, and closing every type of GxP audit:internal self-inspections, supplier/vendor audits, regulatory mock audits, and follow-up audits:with every finding, response, and CAPA link stored in one place and retrievable instantly.
What it does:
- Schedule and plan internal GMP self-inspections, supplier audits, and mock audits
- Execute audits in real time with digital checklist completion and finding entry
- Automatically link every critical or major finding to a CAPA record
- Generate formatted audit reports ready for internal review and regulatory submission
- Track outstanding audit findings and CAPA closures on a dedicated audit-status dashboard
Regulatory Compliance
ISO 19011, FDA 21 CFR Part 211.180, WHO GMP TRS 986 Annex 2, EU GMP Chapter 9
Why This Matters
When an FDA investigator asks for the last three years of internal audit findings on Day 1 of an inspection, searching through binders, email folders, and file shares is not a credible response. It signals a quality programme that exists on paper rather than in practice:and experienced inspectors know the difference immediately.
Module 6 of 18
Training Management
An operator who signed a training record last quarter may be working from a procedure that was revised last week. The training gap is not intentional:the SOP changed and retraining was never triggered. CannyPQMS automatically assigns new training tasks to every affected operator whenever an SOP is approved or revised, ensuring every person performing GxP-critical activities is documented as trained on the current, approved version before they are permitted to perform that activity.
What it does:
- Build role-based training matrices linking job functions to required SOPs
- Automatically assign SOP-based training tasks whenever an SOP is approved or revised
- Track training completion, competency assessment scores, and pass/fail records
- Alert training coordinators when SOP revisions require retraining of impacted personnel
- Generate training effectiveness reports with department-level compliance rates
Regulatory Compliance
FDA 21 CFR Part 211.68, EU GMP Chapter 2, WHO GMP TRS 986, CDSCO Schedule M
Why This Matters
If an operator executes a GxP step using a procedure that was superseded last month, the training record cannot shift liability to the operator:the quality system allowed it to happen. The site bears the GMP violation, the batch investigation, and the CAPA. Under both FDA and EMA frameworks, responsibility for ensuring personnel are trained on current procedures rests with the quality system, not with individual operators.
Want to see these modules live?
Get a 30-minute walkthrough with a pharma QMS specialist. No slides — live system only.
Module 7 of 18
Supplier / Vendor Quality Management
A supplier audit failure looks like this in practice: a critical excipient supplier passed qualification two years ago, periodic requalification was never scheduled, and the supplier changed their manufacturing site without notifying you. The contamination event that follows is entirely your liability:under FDA 21 CFR Part 211.84, the finished-dose manufacturer bears full responsibility for the quality of every material used. CannyPQMS governs the complete supplier lifecycle:from initial qualification through ongoing performance monitoring, periodic requalification, and disqualification of underperforming vendors.
What it does:
- Execute structured vendor qualification workflow before a supplier can be approved
- Plan, schedule, and execute supplier facility audits with digital finding entry
- Score and track supplier performance with configurable evaluation scorecards
- Manage the Approved Vendor List (AVL) with QA-only approval controls
- Trigger automatic disqualification alerts when a supplier's score drops below threshold
Regulatory Compliance
FDA 21 CFR Part 211.84, ICH Q10 Section 3.3, ISO 9001:2015 Section 8.4, EU GMP Chapter 7, WHO GMP
Why This Matters
A supplier approved two years ago and never requalified may have changed their manufacturing site, process, or quality team since then. Using an out-of-requalification supplier puts every batch that consumed their material at risk of rejection during QP release:because the approved vendor list entry cannot demonstrate current qualification status. One question from an inspector about your last supplier requalification date should not require searching through paper files.
Module 8 of 18
Complaint Management
A pharmacist calls to report a foreign particle in a blister pack. The complaint is logged in a spreadsheet, the sample is sent to QC, and the investigation sits open for six weeks with no formal root cause and no CAPA linked. Under FDA 21 CFR Part 211.198, every written complaint must be reviewed, evaluated, and responded to:with records accessible to FDA inspectors. CannyPQMS gives you a structured, inspection-ready system for receiving, classifying, investigating, and resolving every post-market product complaint before it becomes a regulatory finding.
What it does:
- Intake every complaint with mandatory classification by type and severity
- Conduct complaint investigations with root cause analysis and impact assessment
- Generate regulatory reports for FDA MedWatch, CDSCO, EMA EVDAS, and NAFDAC
- Link systemic complaints to CAPA records for product and process improvement
- Analyse complaint trends by product, batch, market, and root cause category
Regulatory Compliance
FDA 21 CFR Part 211.198, FDA 21 CFR Part 314.81, EU GMP Chapter 8, ICH Q10 Section 3.4
Why This Matters
Manufacturers that fail to maintain adequate complaint files, or that fail to evaluate whether a complaint constitutes a potentially serious adverse drug reaction, are in violation of both FDA and EMA post-marketing surveillance requirements.
Module 9 of 18
Risk Management (QRM)
ICH Q9(R1):updated in 2023:now explicitly requires that quality risk management be prospective, documented, and proportionate to the risk level. Manual risk registers in spreadsheets cannot demonstrate this: they have no version history, no linkage to mitigating actions, and no evidence of review. CannyPQMS applies the structured, science-based risk assessment methodology defined in ICH Q9(R1) to help manufacturers identify, quantify, mitigate, and monitor quality risks throughout the product and process lifecycle:with every risk assessment stored as a retrievable, signed, timestamped record.
What it does:
- Identify and document quality risks using FMEA, HACCP, fault tree, and cause-and-effect analysis
- Score risks on a configurable probability × severity × detectability matrix (RPN)
- Assign mitigation actions with owner, target date, and expected residual risk score
- Monitor residual risk and control effectiveness on a live QRM dashboard
- Generate ICH Q9-compliant risk assessment reports for regulatory filings
Regulatory Compliance
ICH Q9(R1) 2023, ISO 14971, FDA Process Validation Guidance 2011, EU GMP Annex 20
Why This Matters
A process risk identified post-market:after batches have shipped:costs vastly more than the same risk identified pre-production. You are looking at a batch recall investigation, root cause analysis across multiple lots, customer notifications, potential regulatory reporting, and a revalidation exercise. The same risk, identified during a pre-batch FMEA and mitigated with a control measure, costs an afternoon of structured assessment. The difference is whether the risk management programme was prospective or reactive.
Module 10 of 18
Non-Conformance Management (NCR)
Provides a mandatory quality gate for every material, component, intermediate, and finished product that fails to meet its specification. Under FDA 21 CFR Part 211.165 and 211.192, OOS results must trigger a formal investigation, and no material or batch may be released without a complete, auditable disposition record.
What it does:
- Log every non-conformance with mandatory reference to batch number, material code, and specification
- Route rejected material and batch disposition decisions through QA-approval workflow
- Track investigations with root cause analysis and automated alerts for overdue NCRs
- Record final disposition with e-signature of authorising QP or QA manager
- Link systemic or recurrent NCRs to the CAPA module for corrective action
Regulatory Compliance
FDA 21 CFR Part 211.165, FDA 21 CFR Part 211.192, ISO 9001:2015 Section 8.7, ICH Q10
Why This Matters
A non-conformance fixed on the production floor with no NCR raised means no root cause was documented, no CAPA was triggered, and no one was watching for recurrence. Eight months later the same issue returns:but now the investigation team has no prior history to reference, no corrective action to assess for effectiveness, and an inspector who will ask why the same problem occurred twice with no record of the first occurrence.
Module 11 of 18
Calibration Management
Tracks the calibration status of every instrument, measurement device, and reference standard in the pharmaceutical manufacturing and QC environment:ensuring no measurement used to make a quality or release decision is generated by an instrument of unknown or expired calibration status.
What it does:
- Maintain a complete calibration register for every instrument including HPLC, balances, and pH meters
- Schedule calibration tasks with configurable frequencies based on instrument criticality
- Send multi-stage automated alerts at 30, 15, and 7 days before calibration due dates
- Display a real-time calibration compliance dashboard with in-calibration / due-soon / overdue status
- Initiate out-of-tolerance investigation workflow when calibration result falls outside acceptance criteria
Regulatory Compliance
ISO/IEC 17025, FDA 21 CFR Part 211.68, EU GMP Annex 15, CDSCO Schedule M
Why This Matters
When an out-of-calibration instrument is discovered during an inspection, the question is not just "why did this happen":it is "which batches were released based on data generated by this instrument since the last verified calibration?" Every analytical result produced over that period is now under formal review, every batch that passed specification using that data is a potential recall candidate, and the investigation scope has just expanded to six months of production history.
Module 12 of 18
Equipment / Asset Management
Tracks the complete lifecycle of every pharmaceutical manufacturing and testing asset:from initial installation qualification through routine preventive maintenance, breakdown repair, and final decommissioning. Integrates directly with the Validation Management module to link every IQ/OQ/PQ record to the corresponding equipment asset record.
What it does:
- Maintain a complete asset register with qualification status and current operational status
- Schedule and manage preventive maintenance (PM) activities with automatic work orders
- Log every breakdown event with downtime duration, repair performed, and root cause
- Link equipment qualification protocols (IQ/OQ/PQ) to each asset record
- Maintain a complete, searchable maintenance history for every asset
Regulatory Compliance
FDA 21 CFR Part 211.67, EU GMP Chapter 3, GAMP 5, CDSCO Schedule M
Why This Matters
An unplanned equipment breakdown during a batch run costs more than just the downtime hours:it costs the batch if contamination cannot be ruled out, it costs the investigation to determine whether any in-process results generated before the failure are valid, and it costs the requalification if the repair constitutes a change. A missed preventive maintenance window is a predictable event that became an unpredictable one. That is the real cost of an unmanaged maintenance schedule.
Evaluating pharma QMS software?
Talk to our team about your facility size, regulatory markets, and which modules matter most for your inspection readiness.
Module 13 of 18
Validation Management
Provides a structured, protocol-driven platform for managing every validation and qualification activity:including process validation, cleaning validation, equipment qualification (IQ/OQ/PQ), analytical method validation, and Computer System Validation (CSV) under GAMP 5. FDA's Process Validation Guidance (2011) defines validation as a three-stage lifecycle.
What it does:
- Create, version-control, and route for approval all validation and qualification protocols
- Track validation execution with real-time progress and deviation logging during execution
- Manage Computer System Validation (CSV) activities in accordance with GAMP 5
- Generate validation summary reports compatible with FDA, EMA, and WHO filing requirements
- Display a validation status dashboard showing current qualification status for every process and system
Regulatory Compliance
FDA Process Validation Guidance 2011, EU GMP Annex 15, GAMP 5, ICH Q2(R2) 2022
Why This Matters
When a piece of equipment is changed:replaced, upgraded, or significantly repaired:without triggering a revalidation assessment, the validated state of every process that uses that equipment is broken from that moment forward. Batches manufactured after the change, under a validation that no longer covers the actual equipment state, cannot be defensibly released. The CannyPQMS Equipment and Validation modules are linked: an equipment change event automatically flags all associated validation records for impact review.
Module 14 of 18
Regulatory Compliance Management
Provides a centralised tracking system for every regulatory commitment, inspection finding, submission deadline, and correspondence across every market in which the pharmaceutical manufacturer operates simultaneously. For manufacturers across multiple regulatory jurisdictions, managing commitments in spreadsheets creates systemic risk of missed deadlines.
What it does:
- Track regulatory commitments simultaneously across FDA, EMA, WHO, ICH, NAFDAC, and CDSCO
- Use built-in inspection readiness checklists to conduct pre-inspection gap assessments
- Log every regulatory commitment with configurable escalation alerts for approaching deadlines
- Track regulatory submission status, correspondence history, and regulatory authority responses
- Maintain an inspection history log with documented responses and CAPA linkages
Regulatory Compliance
FDA 21 CFR (all applicable parts), EMA GMP Directive 2003/94/EC, WHO GMP, CDSCO Schedule M, NAFDAC Nigeria
Why This Matters
A commitment made in a Form 483 response that is not implemented by the stated deadline escalates directly from an observation to a Warning Letter, and from a Warning Letter to an import alert.
Module 15 of 18
Management Review (MRM)
Without a structured QMS, management review meetings become slide-deck presentations with no binding decisions and no follow-up mechanism:meeting minutes that record what was discussed but not what was decided, by whom, or by when. An inspector reviewing three years of management review records with no action items closed will cite this as evidence of a non-functioning quality system. CannyPQMS structures the periodic executive-level quality review required by ISO 9001 Clause 9.3 and ICH Q10 Section 3.5 into a data-driven process with traceable decisions, assigned actions, and verified outcomes.
What it does:
- Automatically pull live KPI data from all 18 QMS modules into a management review input screen
- Build structured management review agendas with pre-configured input categories
- Log management decisions, quality commitments, and action items within the meeting record
- Track status and closure of all management review action items across review cycles
- Generate formatted management review reports for regulatory inspection presentation
Regulatory Compliance
ISO 9001:2015 Clause 9.3, ICH Q10 Section 3.5, EU GMP Chapter 1
Why This Matters
An FDA or EMA inspector who finds management review minutes with no meaningful quality data and no action items will cite this as evidence of insufficient senior management engagement:a systemic finding affecting the entire QMS rating.
Module 16 of 18
Dashboard & Reporting
During an unannounced inspection, a quality director needs to answer questions immediately: how many open CAPAs are overdue? When was the last internal audit conducted and what findings are still open? Which instruments have calibration expiring this month? If that information requires pulling files from three systems and a spreadsheet, the answer comes too late and looks too fragile. CannyPQMS pulls live data from all 18 QMS modules into a single, role-configurable compliance and performance view:so the answers are always current to the minute, in one place.
What it does:
- Display real-time quality KPIs from all 18 QMS modules on a single configurable dashboard
- Show CAPA ageing by time buckets (0–30, 31–60, 61–90, 90+ days) across the open CAPA portfolio
- Generate compliance reports pre-formatted for FDA, EMA, WHO, and CDSCO inspection submission
- Provide trend analysis for deviations, NCRs, complaints, and audit findings
- Export all dashboard views as audit-ready PDFs with generation timestamp and user identity
Why This Matters
A quality director who can answer every inspector question in real time from a live compliance dashboard demonstrates precisely the quality culture that regulators are looking for. Inspection readiness is a continuous state, not a pre-inspection sprint.
Module 17 of 18
Electronic Signature (e-Sign)
A non-compliant electronic signature:one that lacks two-component authentication, does not display the signatory's printed name and the meaning of the signature act, or uses a shared login credential:fails every Part 11 test. Those quality records carry no more legal weight than an unsigned document, and an inspector who identifies the deficiency can challenge the integrity of every record signed that way. CannyPQMS provides fully compliant 21 CFR Part 11 electronic signatures across every approval, review, and quality record closure workflow in all 18 modules:replacing paper signatures while meeting or exceeding their regulatory evidential value.
What it does:
- Apply 21 CFR Part 11 compliant e-signatures on every quality record:SOPs, CAPA, deviations, validation, batch records
- Require two-component authentication (unique user ID plus password) before any signature is applied
- Log every signature event with printed name, date/time to the second, IP address, and terminal identifier
- Display meaning of each signature (Reviewed / Approved / Verified / Released) on the signed record
- Enforce signature sequence rules:a record cannot be approved before reviewed, or released before approved
Regulatory Compliance
FDA 21 CFR Part 11, EU GMP Annex 11 Section 12, CDSCO Schedule M, NAFDAC Nigeria GMP Guidelines
Why This Matters
Electronic signatures that do not satisfy all requirements of 21 CFR Part 11 are not legally equivalent to handwritten signatures:meaning quality records are technically unsigned from a regulatory standpoint. Non-compliant e-signatures can invalidate the entire electronic quality record system.
Module 18 of 18
Collaboration Tool
When approvals happen outside the QMS:in email threads, over the phone, in verbal team meetings:those decisions have no tamper-evident record, no timestamp, and no named signatory. During an inspection, the approver may not remember the decision, the email may not be findable, and the record will not satisfy a 21 CFR Part 11 review. CannyPQMS gives quality teams a visual, drag-and-drop workflow builder to design, deploy, and modify custom multi-stakeholder approval and review workflows for any recurring quality process:keeping every approval inside the QMS, where it is attributable, reviewable, and permanent.
What it does:
- Build fully custom quality approval workflows visually with drag-and-drop interface
- Route workflow tasks to QA, production, regulatory affairs, validation, and executive management
- Send real-time in-system and email notifications to every workflow participant
- Track real-time approval status with complete, timestamped traceable record of every action
- Create and save reusable workflow templates for recurring quality events
Why This Matters
A QA approval that was sent as an email reply and saved in a personal inbox cannot be produced during an inspection. The approver may have left the company. The email thread may be buried or deleted. The record does not carry a timestamp that a regulator will accept as tamper-evident, and it cannot demonstrate that the right person with the right authority approved the right version of the right document. Any quality decision made outside the QMS is a decision the QMS cannot stand behind.
Ready to Replace Spreadsheets with an Electronic Quality Management System?
CannyPQMS is a purpose-built electronic quality management system for pharma:not a generic ERP module or an ISO-only tool adapted for GxP. Every workflow, every record, and every e-signature is designed around the specific documentation and traceability requirements of FDA, EMA, WHO, CDSCO, and NAFDAC inspections.
No cloud dependency. No per-user SaaS pricing. On-premise deployment means your quality data stays inside your facility:exactly what regulators expect.
Which Regulatory Standards Does CannyPQMS Support?
| Regulatory Body | Standard | What CannyPQMS Covers |
|---|---|---|
| US FDA | 21 CFR Part 11 | Electronic records, e-signatures, audit trails |
| US FDA | 21 CFR Part 211 | Current GMP for finished pharmaceuticals |
| US FDA | 21 CFR Part 820 | Quality System Regulation for medical devices |
| EMA | EU GMP Annex 11 | Computerised systems in regulated environments |
| EMA | EU GMP Chapter 1 | Pharmaceutical quality system |
| WHO | WHO GMP TRS 986/1025 | Good Manufacturing Practice for global export |
| ICH | ICH Q9(R1) 2023 | Quality Risk Management:FMEA, HACCP |
| ICH | ICH Q10 | Pharmaceutical Quality System:lifecycle approach |
| ICH | ICH Q2(R2) 2022 | Analytical procedure validation |
| CDSCO | Schedule M (revised) | Indian GMP requirements:revised 2023 |
| NAFDAC | Nigeria GMP Guidelines | West Africa and Nigerian regulatory compliance |
| ISO | ISO 9001:2015 | Quality Management System certification |
| ISO | ISO 13485 | Medical devices quality management system |
| ISO/IEC | ISO 17025 | Calibration and testing laboratory requirements |
For Indian Pharmaceutical Manufacturers
India is the world's largest producer of generic medicines, supplying approximately 40% of generic drugs consumed in the USA and 25% of all medicines in the UK. Indian pharmaceutical manufacturers face a demanding dual-regulatory environment: satisfying CDSCO Schedule M (significantly revised and strengthened in 2023) for domestic market approval while simultaneously maintaining compliance with FDA 21 CFR, WHO GMP, and EMA GMP for export markets. CannyPQMS is deployed by pharmaceutical manufacturers in India and is aligned with the revised CDSCO Schedule M requirements. For companies seeking WHO-GMP certification for export to Nigeria, other African markets, and the USA, CannyPQMS provides the documentation infrastructure, audit trail depth, and inspection readiness tools required to satisfy WHO-GMP assessors.
For Nigerian & African Pharmaceutical Manufacturers
NAFDAC (the National Agency for Food and Drug Administration and Control) regulates pharmaceutical manufacturing in Nigeria. NAFDAC GMP requirements are aligned with WHO GMP guidelines, meaning manufacturers operating under WHO-GMP documentation frameworks are broadly positioned to satisfy NAFDAC inspection requirements. For Nigerian pharmaceutical manufacturers, CannyPQMS provides particular value in tracking NAFDAC commitments alongside WHO GMP requirements, providing the controlled SOP infrastructure that NAFDAC inspectors examine first, and delivering the documented CAPA and Deviation evidence that demonstrates to NAFDAC assessors the manufacturer's commitment to continuous improvement. South African and Nigerian manufacturers handling patient-level data must comply with POPIA (2021) and Nigeria's NDPR (2019):CannyPQMS's on-premise architecture directly supports these data residency requirements.
How Does CannyPQMS Achieve FDA 21 CFR Part 11 Compliance?
FDA 21 CFR Part 11 establishes the technical and procedural criteria under which the FDA considers electronic records and electronic signatures to be trustworthy, reliable, and equivalent to paper records. Meeting Part 11 requires both technical system controls and procedural safeguards. The following table maps each applicable Part 11 requirement to the specific CannyPQMS implementation.
Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records
Validation Management module manages IQ/OQ/PQ for CannyPQMS itself. Full CSV conducted under GAMP 5 methodology.
The ability to generate accurate and complete copies of records in both human readable and electronic form for inspection, review, and copying by the agency
All records exportable as PDF with complete metadata, generation timestamp, and user identity captured.
Use of secure, computer-generated, time-stamped audit trails
Every record action logged with user ID, date/time to the second, IP address, action type, and before/after data state.
Use of authority checks to ensure that only authorised individuals can use the system, electronically sign a record, access the operation or computer system input or output device
Role-based access control. Users can only perform functions within their configured role. Every role and permission change is logged.
Signature manifestations on electronic records
e-Signature displays printed name of signatory, date and time of signing, and the meaning of the signature act on every signed record.
Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else
Each user has a unique, non-reassignable user ID. System enforces uniqueness and prevents credential sharing.
Electronic signatures shall employ at least two distinct identification components such as an identification code and password
Two-component authentication (unique user ID plus password) required before any e-signature can be applied. Failed attempts are logged and accounts locked after a configurable threshold.
Which Regulated Industries Does CannyPQMS Serve?
Pharmaceutical Manufacturers
Bulk drug and finished formulation manufacturers operating under CDSCO Schedule M, WHO-GMP, or FDA 21 CFR Part 211 approval. CAPA management, deviation tracking, document control, change control, and validation management are the core processes these manufacturers need to maintain continuous regulatory approval status across all applicable markets. CannyPQMS provides all 18 of these processes in a single, audit trail-integrated system purpose-built for pharmaceutical GMP environments.
Biotech & Biopharmaceutical Companies
Biopharmaceutical developers and manufacturers managing complex biological processes:including monoclonal antibody manufacturing, cell and gene therapy production, and vaccine manufacture:where risk management (ICH Q9), robust CAPA systems, and thorough validation (IQ/OQ/PQ) are essential for clinical and commercial manufacturing compliance. The ICH Q9 Risk Management and Validation Management modules are particularly relevant for biotech manufacturers.
Medical Device Manufacturers
Companies manufacturing Class II and Class III medical devices under ISO 13485 and FDA 21 CFR Part 820 requiring CAPA management, non-conformance management, complaint handling, calibration management, and supplier quality as mandatory QMS elements. CannyPQMS's CAPA and NCR modules are specifically designed to satisfy the requirements of FDA 21 CFR Part 820.100 and ISO 13485 Section 8.5.
Contract Research Organisations (CROs)
CROs managing GCP-critical documentation, SOP training compliance, supplier quality assurance, and audit management across multiple concurrent client projects require quality system infrastructure that can simultaneously manage multiple project-specific quality requirements without creating data silos or traceable record gaps. CannyPQMS's Document Management and Training modules are particularly valuable for CROs managing multi-sponsor quality programmes.
API Manufacturers
API producers:including those manufacturing under ICH Q7 (Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients):managing raw material NCRs, in-process deviation management, change control for synthetic process steps, and supplier qualification for reagents and starting materials. API manufacturers exporting to FDA-regulated markets must maintain ICH Q7-compliant quality systems, and CannyPQMS provides the QMS infrastructure to satisfy ICH Q7 documentation and control requirements.
Frequently Asked Questions about CannyPQMS Pharmaceutical Quality Management System
Detailed answers to technical and operational questions about CannyPQMS pharma QMS software, FDA 21 CFR Part 11 compliance, and GxP implementation.
CannyPQMS is a pharmaceutical-specific quality management system built exclusively for GxP-regulated industries:pharmaceutical manufacturers, biotech companies, medical device manufacturers, contract research organisations (CROs), and API producers. The fundamental difference between CannyPQMS and generic QMS software lies in design intent and regulatory depth. Generic QMS tools are designed for ISO 9001 compliance across all industries, then adapted for pharmaceutical use. CannyPQMS is designed from first principles to satisfy FDA 21 CFR Part 11, ICH Q9, EMA GMP Annex 11, and WHO GMP requirements:meaning every module generates a regulatory-grade audit trail, every approval workflow enforces the multi-level, e-signed approval chains required by GxP, and every module is integrated with every other module. In practice, a deviation automatically triggers a CAPA, which links back to the originating audit finding or batch record:and every step of that chain is visible in a single activity log query.
Yes. CannyPQMS is designed to satisfy all applicable requirements of FDA 21 CFR Part 11. Specifically, CannyPQMS implements system validation (Part 11.10(a)) through Computer System Validation conducted under GAMP 5 methodology; generates secure, computer-generated, time-stamped audit trails (Part 11.10(e)) for every record action; enforces authority checks and role-based access (Part 11.10(g)); displays complete signature manifestation on every signed record (Part 11.50); ensures each user has a unique, non-reassignable user ID (Part 11.100); and requires two-component authentication:unique user ID plus password:before any electronic signature can be applied (Part 11.200). The Validation Management module manages the IQ/OQ/PQ documentation for the CannyPQMS system itself, ensuring the system's own validation lifecycle is conducted in compliance with both GAMP 5 and Part 11 requirements.
Yes. The CAPA module is designed to accept CAPA initiation from every quality event source in the QMS:including deviations (manufacturing process, laboratory, environmental monitoring), audit findings (internal self-inspection, supplier audit, regulatory mock audit), customer complaints (product quality, adverse events, labelling), non-conformance reports (materials, intermediates, finished product), supplier quality failures, and management review action decisions. When a CAPA is initiated from any of these sources, the system automatically captures the bidirectional link to the originating event. The CAPA system tracks the complete action plan with owner, action type, due date, and evidence of completion for every action item:and mandates a documented effectiveness verification check with objective evidence before the CAPA can be formally closed.
Yes. CannyPQMS is deployed by pharmaceutical manufacturers across India and is aligned with both the revised CDSCO Schedule M (revised 2023) and WHO-GMP requirements as published in WHO Technical Report Series publications including TRS 986 and TRS 1025. For companies seeking WHO-GMP certification in support of export to Nigeria, other African markets, and the USA, CannyPQMS provides the complete quality documentation infrastructure, audit trail depth, and inspection readiness capability that WHO-GMP assessors examine during facility inspections. The Regulatory Compliance module tracks WHO-GMP commitments, inspection findings, and corrective action deadlines in a structured, auditable format ready for regulatory submission.
A standard CannyPQMS implementation:including system installation and configuration on the client's on-premise infrastructure, user role and permission setup, document template configuration in the DMS module, SOP and quality record migration from existing paper or electronic systems, training matrix setup, and Computer System Validation (CSV) conducted under GAMP 5 methodology:typically takes 8 to 12 weeks depending on the number of modules deployed, the complexity of existing quality workflows, and the volume of existing documents and records to migrate. The implementation is conducted by CannyMinds implementation consultants with pharmaceutical GxP experience, ensuring the system configuration reflects regulatory requirements rather than generic software defaults.
Yes. CannyPQMS integrates bidirectionally with CannyeBMR (Electronic Batch Manufacturing Records). Batch deviations captured and logged in CannyeBMR during batch execution automatically initiate corresponding deviation records in CannyPQMS:eliminating the risk of a batch-level deviation being documented in the BMR but not formally tracked in the QMS. Conversely, batch release approval workflows in CannyeBMR can be configured to query the open CAPA and deviation status for the relevant batch from CannyPQMS:preventing batch release authorisation when any unresolved quality events linked to that batch remain open in the QMS.
CannyPQMS is deployed exclusively on-premise, within the pharmaceutical manufacturer's own IT infrastructure. This is a deliberate architectural decision based on the specific requirements of GxP-regulated pharmaceutical quality data. For FDA-regulated manufacturers, quality records are subject to inspection under 21 CFR Part 211.180:meaning all records must be within the manufacturer's own controlled environment. For manufacturers operating in jurisdictions with data sovereignty requirements:including India's Digital Personal Data Protection Act (DPDPA) 2023, South Africa's POPIA 2021, and Nigeria's NDPR 2019:on-premise deployment ensures patient and quality data never leaves the manufacturer's own national infrastructure.
CannyPQMS supports simultaneous multi-market regulatory compliance tracking across FDA 21 CFR (all applicable parts), EMA GMP Directive 2003/94/EC, WHO GMP TRS 986 and 1025, ICH Q9(R1) and Q10, CDSCO India Schedule M (revised 2023), and NAFDAC Nigeria GMP Guidelines. For manufacturers exporting to multiple markets simultaneously:for example, an Indian API manufacturer supplying active ingredients to a US generic company and a Nigerian finished-dose producer:CannyPQMS provides a single compliance dashboard that tracks all applicable regulatory commitments, inspection findings, and submission deadlines across every jurisdiction without requiring separate quality systems for each market.
Chief Executive Officer | B.E. (Electrical), PSG
Udayakumar Murugan is the Chief Executive Officer of CannyMinds Technology Solutions, bringing over 20 years of hands-on experience in enterprise software, quality management systems, and compliance technology. He has led the successful deployment of pharmaceutical QMS, document management, and records management solutions for clients across pharmaceutical manufacturing, biotech, medical devices, and regulated manufacturing sectors:ensuring 100% audit readiness and regulatory compliance across FDA, EMA, WHO, and CDSCO inspections.
Professional Expertise:
Ready to Pass Your Next FDA or WHO-GMP Inspection?
CannyPQMS gives your pharmaceutical quality team 18 fully integrated QMS modules, complete FDA 21 CFR Part 11 compliance, Africa and India regulatory depth including NAFDAC and CDSCO Schedule M support, and a real-time compliance dashboard that makes audit readiness your default operational state:not a crisis response mounted in the weeks before an inspector arrives.
Every quality event is documented. Every CAPA is linked to its root cause. Every deviation is investigated. Every SOP version is controlled. Every instrument is calibrated. Every supplier is qualified. Every management review is recorded.
Join pharmaceutical manufacturers across India, Nigeria, and the USA who have deployed CannyPQMS to pass FDA inspections, achieve WHO-GMP certification, and eliminate critical audit findings.
Related Products & Solutions
CannyPQMS works seamlessly with our other enterprise solutions for pharmaceutical manufacturers.
CannyeBMR
Electronic Batch Manufacturing Records
Bidirectional integration with CannyPQMS. Batch deviations in eBMR automatically create deviation records in the QMS.
Learn about CannyeBMRCannyECM
Enterprise Content Management
Digital document management with workflow automation, OCR, and FDA 21 CFR Part 11 compliance for unstructured content.
Learn about CannyECMCannyRMS
Physical Records Management
Enterprise physical records management with barcode tracking, audit trails, and 30-second document retrieval for pharma batch records.
Learn about CannyRMSPharma Solutions
Pharmaceutical Solutions Hub
Explore CannyMinds' complete suite of technology solutions designed for pharmaceutical and life sciences manufacturers.
Explore Pharma Solutions