Quality by Design (QbD) – Designing Quality Into Products, Processes, and Data From Day One

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated October 2025 • Risk‑Based Development & Lifecycle Control • R&D, QA, Manufacturing, Regulatory Affairs

Quality by Design (QbD) is a systematic, science‑ and risk‑based approach to development that builds quality into a product and its manufacturing process from the outset—rather than trying to “test quality into” finished goods at the end. In QbD, teams identify critical‑to‑quality attributes, understand how inputs and parameters drive those attributes, and then implement a control strategy that keeps the process in a proven space of success. QbD sits comfortably alongside modern global frameworks such as ICH Q10 and GMP/cGMP, and it is made operational through digital execution systems (MES), validated records (eBMR), real‑time analytics (PAT), and trustworthy data (Part 11/Annex 11).

“QbD turns development into an evidence engine—understand, design, control, and continuously learn.”

1) QbD in Plain Language

QbD starts with the product’s intended use and the outcomes customers and regulators care about: identity, potency/strength, purity, safety, performance, and reliability. From there, teams identify quality attributes that must be achieved (CQAs) and the material attributes (CMAs) and process parameters (CPPs) that influence them. Development work is then planned to understand how changes in inputs and settings move the CQAs, and to define a control strategy: specifications, ranges, in‑process checks (IPC), alarms, and monitoring that keep the process on target—day one and day 1,000.

2) Design Space, Control Strategy, and Knowledge Management

Three ideas make QbD stick:

• Design space: The multi‑parameter region within which you’ve proven the process yields conforming product. You don’t just assert it—you demonstrate it through experiments and data, then manage it under change control (MOC/Change Control).
• Control strategy: The practical controls you run—specs, limits, sampling, sensors, Process Control Plans, SPC charts, alarms—and the governance behind them (SOP, training, escalation).
• Knowledge management: The system that makes learning cumulative and searchable—lab data in ELN, method results in LIMS, and manufacturing evidence in eBMR—captured under Knowledge Management so the organization does not re‑learn the same lesson every year.

3) The QbD Lifecycle: From Concept to Commercial

1. Define the target: Intended use and target quality profile (what “good” looks like).
2. Map risks: Use PFMEA, HAZOP, or (for foods) HACCP to identify hazards, severities, and detection gaps.
3. Design experiments & models: Plan studies that vary inputs and parameters; ensure you can measure outcomes with suitable MSA.
4. Define the control strategy: Specifications, sampling (AQL where applicable), online checks (PAT), and SPC limits.
5. Transfer to manufacturing: Author effective‑dated MBR/MMR and execute under MES.
6. Validate & monitor: Complete Process Validation (incl. PPQ) and run CPV to prove control over time.
7. Learn & improve: Feed trends, OOT/OOS events, and changes through MOC and Internal Audit.

4) Building a QbD Development Plan That Auditors Respect

Write a simple, testable plan: list each CQA (e.g., potency, viscosity, particle size), hypothesize the CMAs/CPPs that drive it, and spell out what you will test, how you will measure it (methods, ranges, accuracy/precision per MSA), and what “success” looks like. For analytical methods, document principles and suitability (e.g., HPLC). Record everything under Document Control and ensure raw data are protected by audit trails and Data Integrity. Your control strategy should cross‑reference the PCP, sampling strategy, and disposition logic.

5) Risk Tools That Power QbD

PFMEA links failure modes to controls and monitoring. HAZOP complements PFMEA where process safety is critical. In food contexts, HACCP defines CCPs and verification. A good QbD plan uses these not as paperwork, but as the very map from which tests, interlocks, and sampling are chosen.

6) Analytical Methods, MSA, and PAT in QbD

Analytical capability limits what you can learn and control. Without adequate MSA, you risk chasing noise or missing drift. Mature programs move critical measurements closer to the process, leveraging PAT for at‑/in‑line sensing and models to predict CQAs. Data flow from ELN and LIMS into production systems, where SPC and Cp/Cpk quantify stability and capability over time.

7) Specifications, Sampling, and Release Strategy

In QbD, specifications are justified—they are not arbitrary. Process behavior informs spec limits, and capability indices show how comfortably the process meets them. Sampling plans (e.g., AQL) are selected based on risk and CQA sensitivity. When exceptions occur, treat them vigorously: classify OOT versus OOS, and make sure your QC release evidence remains complete and attributable in the eBMR.

8) Technology Transfer: From Bench to Plant

QbD makes transfer concrete: knowledge (models, limits, CQAs), methods (validated analytical packages), and execution (recipe logic) are handed over as controlled artifacts—effective‑dated MBR/MMR managed by Document Control. On the shop floor, MES enforces line‑clearance checks, roles and signatures (Part 11), and IPC/SPC with device integrations (e.g., gravimetric weighing, vision). Qualification of equipment (IQ/OQ/PQ) precedes Process Validation and PPQ.

9) QbD Inside Validation: PV → PPQ → CPV

QbD and validation are two sides of the same coin. QbD defines what to control and why; validation proves the process can and does deliver. After development, you lock critical ranges and test them under PPQ with representative materials, shifts, and operators. Then, through CPV, you actively trend CQAs/CPPs against control limits and capability metrics to keep the process in control and detect drift early.

10) Data Integrity, Part 11/Annex 11, and the Digital Thread

QbD’s credibility depends on trustworthy data. Ensure unique users, meaningful signatures, time‑sync across instruments and servers, and immutable audit trails per Part 11/Annex 11. Keep the digital thread intact from ELN and LIMS through MES into the eBMR. Under Data Integrity and ALCOA, raw data are preserved, attributable, and retrievable for the full retention period.

11) QbD Across Sectors

Pharmaceuticals/biologics: QbD thinking is embedded in lifecycle quality systems such as ICH Q10 and the cGMPs (210/211). Medical devices: Concepts translate via robust design control, validation, and production controls, with release evidence captured in eBMR/DHR. Food/cosmetics: A QbD mindset pairs with HACCP and modernization frameworks such as MoCRA, emphasizing risk‑based controls, labeling, and traceability.

12) Materials & Supplier Quality in QbD

Materials aren’t just inputs—they’re a major source of variation. Strengthen your control strategy with identity confirmation (Identity Testing), verified certificates (CoA), risk‑based incoming checks (Incoming Inspection), and escalation via SCAR when trends go south. Nonconformances are processed through NCMR to MRB, with learning fed back into PFMEA and specs. When a parameter is supplier‑controlled, capture it in genealogy (Lot Traceability).

13) The Execution Layer: PCP, IPC/SPC, and Release by Exception

At runtime, QbD lives in a Process Control Plan and in the IPC/SPC rules that MES enforces. Effective‑dated instructions from the MBR/MMR ensure operators do the right thing, in the right order, with the right verifications. Evidence accumulates automatically into the eBMR; QA then reviews by exception using alarms, deviations, and capability dashboards instead of re‑inspecting every line in every record.

14) Example: QbD for a Weigh‑Blend Process

Target: content uniformity and dissolution. CQAs: blend uniformity, particle size, moisture. CMAs: API PSD and moisture; excipient density. CPPs: feed rate, blender speed/time, sequence. Experiments show that API PSD and blender speed drive uniformity; moisture drives dissolution variability. The control strategy: supplier controls on PSD and moisture (CoA + verification), in‑process near‑infrared (PAT) for blend endpoint, and gravimetric weighing interlocks with tolerances. Capabilities are trended (Cp/Cpk), and alarms stop progression on OOT/OOS. The recipe is versioned in the MBR and executed under MES with sign‑backs (Part 11) and an eBMR trail for QA release.

15) Governance, Metrics, and Continual Improvement

Make QbD visible in management review with metrics that show design and control maturity: number of CQAs under PAT, share of IPCs with live SPC, capability indices for top CQAs, OEE impacts, and rate of deviations tied to design gaps (a worsening trend means revisit the control strategy). Periodic reviews (APR/PQR) should explicitly test whether your design assumptions still hold in production—and trigger changes via MOC.

16) Common QbD Pitfalls & How to Avoid Them

• “Specifications first” thinking. Fix: let process data inform spec limits; justify limits with capability and risk.
• Weak MSA. Fix: confirm method precision/accuracy and range before modeling; otherwise you model noise.
• Happy‑path development. Fix: include fail‑intent tests and edge conditions in experiments and transfer plans.
• Paper‑only knowledge. Fix: centralize learning in Knowledge Management and connect ELN/LIMS→MES→eBMR under Data Integrity.
• Static control strategy. Fix: refresh the PCP via CPV trends; align with MOC/Internal Audit.
• Transfer gaps. Fix: translate design knowledge into executable, versioned MBR/MMR and validate equipment/process (IQ/OQ/PQ, PV/PPQ).
• Label/traceability blind spots. Fix: bake labeling control and label verification into the control strategy to prevent recalls from identity errors.

17) How This Fits with V5 by SG Systems Global

V5 Solution Overview. The V5 platform turns QbD into daily practice. Configuration is versioned, evidence is attributable, and cross‑module interlocks (identity, status, signatures) are enforced and reportable—perfect for design‑space control and lifecycle learning.

V5 MES. The V5 MES executes effective‑dated MBR/MMR, enforces IPC/SPC, captures device data (scales, vision, PAT), and produces an inspection‑ready eBMR for QA release by exception.

V5 QMS. Within the V5 QMS, development knowledge, procedures, SOPs, validation (PV/PPQ/CPV), and lifecycle changes (MOC) are orchestrated under Document Control with full audit trails.

V5 WMS. The V5 WMS extends QbD to materials and distribution: status segregation, FEFO/FIFO, bin/zone topology, and scan‑verified label verification—ensuring the right material, in the right condition, flows through the validated process every time.

Bottom line: V5 embeds QbD in the daily run plan—your design assumptions become live controls, and your production data becomes tomorrow’s smarter design space.

18) FAQ

Q1. How is QbD different from traditional quality control?
Traditional QC focuses on testing end product; QbD designs the process so quality emerges consistently, with in‑process controls, alarms, and digital evidence proving control.

Q2. Do we need PAT to do QbD?
No—but PAT accelerates learning and deepens control by measuring CQAs closer to real time, reducing lag between cause and effect.

Q3. Where do PFMEA and PCP fit?
PFMEA identifies risks and critical controls; the PCP operationalizes them into sampling, limits, interlocks, and responses.

Q4. How does QbD relate to validation (PV/PPQ/CPV)?
QbD defines CQAs/CPPs and the control strategy; validation proves the process can deliver (PPQ) and continues to deliver over time (CPV).

Q5. What documentation must be controlled?
Development plans and reports, methods and MSA, specifications, MBR/MMR, validation protocols/reports, PCP, and SOPs—under Document Control with audit trails.

Q6. How do we pick spec limits?
Use process data (capability), method performance (MSA), clinical/functional relevance (where applicable), and risk. Limits should be defensible—and revisited when CPV trends shift.

Q7. How do we maintain QbD after launch?
Trend CQAs/CPPs, investigate OOT/OOS, run periodic APR/PQR, and apply MOC to adjust controls.

Q8. What if our measurement system is weak?
Improve methods and re‑establish MSA first; otherwise capability and models are misleading.

Q9. How do labels and genealogy fit into QbD?
Identity and traceability are part of control—enforce labeling control, scan‑based label verification, and full genealogy through storage and shipping.

Q10. What evidence convinces auditors we practice QbD?
A clear line from CQAs→risk analysis→experiments→design space→control strategy→MBR/MES execution→validation and CPV trends—supported by attributable records and audit trails.

Related Reading
• Foundations & Governance: ICH Q10 | GMP/cGMP | Document Control | SOP | Internal Audit
• Analytics & Methods: MSA | HPLC | ELN | LIMS | PAT
• Execution & Control: MES | MBR | PCP | IPC | SPC Control Limits | Process Capability (Cp/Cpk)
• Validation & Lifecycle: Equipment Qualification (IQ/OQ/PQ) | Process Validation | PPQ | CPV
• Records & Integrity: 21 CFR Part 11 | Annex 11 | Audit Trail (GxP) | Data Integrity | eBMR
• Materials & Suppliers: Identity Testing | CoA | Incoming Inspection | NCMR | MRB