ISPE 博客：FDA 检查的第一问——QMS 与 CMMS 等系统间一致性（concordance）

Most people prepare for an US FDA inspection by reviewing their deviations. They make sure the corrective and preventive actions are closed. They brief the site director. They rehearse the answers.

They are preparing for the second question.

The first question is different. And most sites fail it before the investigator opens a single binder.

What the First Question Is

Investigators do not usually start with your deviations. They start by checking whether your own systems agree with each other.

This is called concordance. It is not complicated. The investigator picks a batch, an asset, or a process and asks: does what your quality management system (QMS) says match what your computerized maintenance management system (CMMS) says? Does your equipment status in one system match your equipment status in another?

If the answer is yes, they move forward. If the answer is no, they have already found what they came to find.

The deviation log is the second question. The first question is simpler: can your facility tell a consistent story about itself?

What Disagreement Looks Like

Here is a scenario that happens more often than most facilities want to admit.

A maintenance work order is complete in the CMMS. The technician signed off. The system shows "closed."

In the QMS, the deviation tied to that work order is still open. It was waiting on a review cycle. Nobody flagged the conflict. The two systems have been telling different stories about the same piece of equipment for eleven days.

On day twelve, the investigator arrives.

She does not go to the deviation log first. She checks concordance. She asks whether the equipment status in the CMMS matches the deviation status in the QMS.

It does not.

Now she knows where to look. Not just at this one conflict. At every place in the facility where two systems describe the same asset and neither one is required to be right.

Figure 1. Two systems, same asset, irreconcilable states. The gap between them is where inspection findings originate.

This Is Not a Data Problem

The first instinct is to call this a data integrity problem. It is not.

Data integrity problems are about accuracy. Did someone record the right number? Did the system timestamp correctly? Was the entry made on time?

This is something different. This is two systems that were never designed to agree, describing the same reality from different angles, with no mechanism to resolve the conflict.

Nobody is lying. Nobody made an error. The systems are working exactly as designed. They just were not designed to be compared.

That is the structural problem. The systems do not know they disagree. The people who run them often do not either. And nobody owns the gap.

What the Investigator Sees

From where the investigator stands, a facility where systems disagree has no single source of truth. That facility cannot tell what its actual state is. It can tell what each system says. Those are different things.

The regulatory question is simple: Which system forms the basis of release? Which one does the batch record reflect? Which one does the organization stand behind under examination?

If the answer is "we reconcile them before a release decision," you have described a manual workaround for a structural problem. That workaround works until it does not. The inspection is often the moment it does not.

Why This Keeps Happening

Most pharmaceutical facilities have accumulated systems over time. A QMS went in first. A CMMS came later. A manufacturing execution system was added when the line upgraded. A laboratory information management system handles the lab.

Each system was put in to solve a specific problem. Each one was validated separately. Nobody asked how they would handle a conflict, because nobody assumed they would have one.

This is not negligence. It is what happens when capability is added one system at a time without designing for what happens when those systems see the same event differently.

The result: the facility knows a great deal about its own operation, but no single system knows everything. When an investigator asks a question that crosses system boundaries, the answer requires someone to reconcile the records. Reconciliation is not control.

What Resolution Requires

Fixing this is not about training or faster deviation closure. It is about how the systems were built.

Three things are required.

A single source of truth for each GMP decision. One system is authoritative for equipment state. One system is authoritative for batch release status. When those systems report different states, there is a defined mechanism that forces resolution before anyone acts on either record.

Irreversible ownership. Every GMP system has one accountable owner. Not shared responsibility. One person whose name is on the record when the system fails to reflect reality.

Designed defensibility. The system is built so that the answer to any inspection question is the same across every record. Not because someone reconciled them. Because they were designed to be consistent.

These are not software features. They are design decisions. And most facilities have never made them deliberately, because nobody required them to.

A Practice Test

Before the next inspection, try this.

Pick any piece of equipment currently in the facility. Ask the team to identify its current state in three systems: the CMMS, the QMS, and whatever system governs its use in production.

See if all three agree.

If they do, you either this design work has already been done or the facility got lucky on that particular day. If they do not, the first check a US FDA investigator runs to understand the facility has just been performed.

The gap between what systems say and what the facility actually is—that is what inspection findings are made of. The question is whether the organization finds it first, or they do.