ONE GOOD
IDEA
Compliance Requirement Matrix
rom working in regulated indus-
F
tries over the years, I have seen
plenty of quality system audits.
Depending on the industry, noncompli-
ant audit findings can be both embar-
1 820.1
rassing and costly. I believe one of the
best pre-audit tools is the compliance
requirements matrix (CRM). The beau-
ty of the CRM is it can be used to verify
requirements for any regulation.
A defense contractor I worked
f o r hired an ex-Defense Contract
Administration Services auditor for
internal quality auditing. The auditor
frequently asked me the same ques-
tion: “Where do you meet this require-
ment?” His intent was that I
demonstrate where and how the
requirement was met in the quality
system manual (QSM).
Of course his interest did not stop
there. He also expected to see one or
more examples of actual implementa-
tion, whenever it was appropriate. I
would start by pulling the QSM, find-
ing the correct procedure and showing
the specific paragraph that addressed
the requirement. This would be fol-
lowed by a show-and-tell of actual
implementation.
It was clear to me that a cross refer-
ence document would readily provide
the specific procedural paragraph for
any regulation. Building a CRM show-
ing the regulation and its compliance
in the QSM was the logical step prior
to the appropriate demonstration.
Use in Internal, External Audits
The CRM is useful at any stage of
the quality system. In development of
your QSM, the CRM will ensure all
regulations have been covered. The
CRM is a helpful internal auditing tool
that can be reviewed to ensure your
procedural system meets the regulato-
ry or certification level requirements.
The CRM is also the right tool for an
external compliance audit, providing
direct links between the audited sys-
tem regulations and the procedures in
place to meet them. Finally, the CRM
helps when upgrading to new versions
of a regulation or standard to verify
that all updates are in place.
A CRM is simple to create. Any
software that builds tables will work.
80 I DECEMBER 2007 I www.asq.org
Sample Section of a Compliance
TABLE 1
Requirement Matrix
21 CFR Regulation
Current good manufacturing practice
(CGMP) requirements are set forth in
this quality system….
820.3 Definitions
820.5 Each manufacturer shall establish
and maintain a quality system that is
appropriate for the specific medical….
820.20(a) Quality policy. Management with
executive responsibility shall establish
its policy and….
CFR = Code of federal regulation
QAP = Quality assurance procedure
Make one column each for the regula-
tion or requirement number, the regu-
lation text, the associated procedure
number and the procedural text (see
Table 1). It’s best to have the actual
text in the columns to verify that a
specific procedural statement meets
that regulation.
It is simple to cut and paste the text
from the procedure or specification
directly into the matrix. Use an L-
shaped matrix for compliance with a
single standard and a T-shaped or X-
shaped matrix for compliance with
multiple standards.2
After completing and verifying the
CRM, keep a copy near your QSM, so
you won’t need to search for it in the
event of an audit or if any questions
about the regulations and procedures
come up. A CRM also shows an audi-
tor that you are on top of your com-
pliance and have already done the
work to verify compliance within
your system.
Table 1 is part of an overall CRM for
compliance with the medical device
quality system requirements of the
Food and Drug Administration’s 21
CFR Part 820 quality system regula-
tion. As shown, in some cases there
may be more than one paragraph in
the QSM that addresses the regulatory
requirement. In those cases, it’s a
good idea to identify all procedures
and paragraphs.
This serves two purposes: to identi-
fy all of the procedures that address
the regulation and to ensure that no
by Alan Chow
QAP # Procedure
A0101 This quality policy and system manual
applies to all operations as described….
C0104 See document
A0101 Implementation of the policies stated
in this document is accomplished
through….
A0101 The company is committed to providing
safe and effective products, services….
B0101 The quality policy and system manual
shall be communicated to all ….
paragraph contradicts another. Too
many quality systems have one proce-
dure requiring A, and another proce-
dure requiring B, with A and B being
contradictory actions. The CRM also
indicates erroneous references. One
CRM identified contradictions in two
procedures, each of which referred to
the other for instructions on docu-
menting nonconformances, but nei-
ther provided any instruction. The
CRM quickly identified the problem.
If you have a quality system require-
ment or regulation, try building a
CRM to see how well your system
meets those requirements. It’s a valu-
able tool to have, and it could show
you some things about your system
that you didn’t know.
NOTE
A more complete table can be found at
www.asq.org/qualityprogress.
REFERENCES
1. Joe Tsiakals, “Standards Outlook: ISO 9001
and Regulatory Compliance in the Medical
Device Industry,” Quality Progress, Vol. 34, No. 4,
2001, pp. 75-77.
2. Jack B. ReVelle, Quality Essentials: A
Reference Guide from A to Z, ASQ Quality Press,
2004, pp. 98-105.
ALAN CHOW is an instruc-
tor for Mitchell College of
Business at the University of
South Alabama in Mobile. He
earned a master’s degree in
quantitative business analy-
sis from Louisiana State
University. Chow is a certi-
fied Six Sigma Black Belt and is a senior mem-
ber of ASQ.