Statistical process control is one of those tools that quality teams in regulated industries either use well or barely touch. The gap between those two groups tends to show up during FDA inspections and ISO 13485 audits, where investigators look specifically at whether your monitoring data actually drives corrective action or simply accumulates in a folder.

This guide covers what SPC is, how it applies in pharmaceutical, medical device, biotech, and food manufacturing environments, and what your quality system needs to support it properly.

What is statistical process control?

Statistical process control is the use of statistical methods to monitor, control, and improve a process. The American Society for Quality (ASQ) defines it as “the use of statistical techniques to control a process or production method.” In practice, SPC means collecting real-time or near-real-time data from a process, plotting it on control charts, and using those charts to distinguish normal variation from signals that require investigation.

The discipline traces back to Walter Shewhart at Bell Laboratories in the 1920s and was later refined by W. Edwards Deming. Its relevance to regulated industries grew significantly when FDA began incorporating statistical thinking into its process validation guidance and quality systems framework.

Why regulated industries use SPC

In a regulated manufacturing environment, the goal is not just to produce a product that passes release testing. The goal is to demonstrate that the process that produced it was in a state of control throughout production. SPC provides the documented evidence to support that claim.

FDA’s Process Validation: General Principles and Practices guidance explicitly references ongoing process verification in Stage 3 of the three-stage validation lifecycle. That stage requires collecting and analyzing data to detect undesired process variability. For pharmaceutical manufacturers operating under 21 CFR Part 210 and 211, and for medical device companies under the Quality Management System Regulation (QMSR), demonstrating ongoing process control is not optional.

ISO 13485:2016 requires organizations to use appropriate methods to monitor and measure product and process characteristics. SPC is one of the most widely accepted approaches for meeting that requirement with objective statistical evidence.

Common and special cause variation: the foundation of SPC

SPC rests on a single distinction that matters enormously in regulated environments: the difference between common cause variation and special cause variation.

Common cause variation is the inherent, random variability in any process. It reflects the combined effect of many small factors — slight differences in raw materials, minor environmental fluctuations, normal equipment wear. A process showing only common cause variation is said to be “in statistical control.” That does not mean the process is perfect. It means its behavior is predictable.

Special cause variation is variation from a specific, identifiable source: a new operator making an error, a raw material batch outside specification, equipment that has drifted out of calibration. Special cause variation produces patterns on a control chart that are statistically unlikely to occur by chance. When you see those patterns, you investigate.

This distinction matters in regulated industries because it determines what action to take. Reacting to common cause variation by adjusting the process actually makes things worse — a phenomenon Deming called tampering. A deviation report and formal root cause investigation are appropriate for confirmed special cause variation, not routine process noise.

Key SPC tools for regulated manufacturing

Control charts

The control chart is the primary SPC tool. It plots process data over time against statistically calculated control limits set at three standard deviations above and below the process mean. These limits come from the process data itself, not from product specifications. A point outside either limit, or a non-random pattern within the limits, signals a potential special cause.

The most common charts in regulated manufacturing include:

• X-bar and R charts: Used for continuous data measured in subgroups. Common in tablet weight monitoring, fill volume control, and continuous manufacturing measurements.
• Individuals and moving range (I-MR) charts: Used when only one measurement is taken at a time — frequent in pharmaceutical batch processing.
• p-charts and np-charts: Used for attribute data — pass/fail, conforming/nonconforming. Common in visual inspection and incoming inspection.
• c-charts and u-charts: Used to track counts of defects per unit. Applicable in packaging inspection and device assembly.

Process capability indices

Once a process is confirmed to be in statistical control, capability indices — Cp and Cpk — measure how well that controlled process fits within specification limits. A Cpk of 1.33 or greater is the general industry target for a capable process.

Histograms and run charts

Histograms show the distribution of process data and help identify whether output follows an expected distribution or shows skew, bimodal patterns, or other anomalies. Run charts plot data over time without control limits and are useful for spotting trends before formal SPC is established.

SPC in pharmaceutical manufacturing

Pharmaceutical manufacturers under 21 CFR Part 211 face explicit requirements to monitor process parameters and quality attributes throughout production. In tablet manufacturing, SPC routinely monitors tablet weight, hardness, thickness, and dissolution. A process running consistently within control limits builds the statistical body of evidence that supports continued process validation — the ongoing phase that FDA views as a permanent part of the manufacturing lifecycle.

The ICH Q10 pharmaceutical quality system guideline requires a system for monitoring process performance and product quality throughout the commercial manufacturing lifecycle. SPC data feeds directly into that monitoring requirement.

SPC in medical device manufacturing

Medical device manufacturers under ISO 13485 and the FDA’s QMSR apply SPC to manufacturing process monitoring and incoming component inspection. The QMSR requires statistical techniques appropriate to verifying the acceptability of process capability and product characteristics.

The analytical procedure used to generate measurements feeding an SPC chart must itself be validated to ensure the measurement system can detect the variation it is meant to track. An audit finding commonly cited in medical device inspections is the failure to define which process parameters require SPC monitoring, or the failure to act on out-of-control signals.

Regulatory expectations for SPC programs

FDA has signaled its expectation of SPC across multiple guidance documents. The FDA Guide to Inspections of Quality Systems describes data analysis and trending as a primary subsystem that investigators examine. During a process audit, investigators ask to see evidence that monitoring data is reviewed on a defined frequency, that out-of-control conditions trigger documented investigations, and that the resulting CAPA actions are tracked for effectiveness.

Building SPC into your QMS: seven practical steps

1. Identify critical process parameters and critical quality attributes. Not every measurement needs an SPC chart. Focus on parameters that directly affect product safety, efficacy, or conformance to specification. Risk assessment methods like FMEA help prioritize which parameters warrant statistical monitoring.
2. Determine subgroup size and sampling frequency. The rational subgroup concept — grouping measurements so that variation within the subgroup reflects only common cause variation — is the most important design decision in SPC setup. Subgroup size and frequency depend on production speed, sampling cost, and the sensitivity needed to detect process shifts.
3. Establish control limits from baseline data. Control limits must be calculated from actual process data collected when the process is in a known state of control, not borrowed from specification limits or set arbitrarily. Most practitioners use a minimum of 25 subgroups to establish initial control limits.
4. Define out-of-control rules. The Western Electric rules provide a standard set of patterns — a single point beyond 3 sigma, two of three consecutive points beyond 2 sigma, eight consecutive points on one side of the centerline — that indicate special cause variation. Your procedure must specify which rules you apply and what action each triggers.
5. Link control chart signals to your deviation system. Every confirmed out-of-control signal should generate a deviation report, a documented root cause investigation, and, if necessary, a CAPA. The connection between the SPC chart and the corrective action system is what regulators look for when assessing whether your SPC program is functional.
6. Review control chart data on a defined schedule. At minimum, define a review frequency and document that reviews occur as scheduled. The analytical report summarizing control chart performance becomes part of your quality record.
7. Recalculate control limits periodically. After process improvements, major equipment changes, or validated process changes, recalculate control limits from new baseline data. Using outdated control limits after known process changes is a deficiency auditors flag.

Common SPC failures in regulated environments

• Treating specification limits as control limits. Specification limits define what is acceptable to the customer. Control limits define what is normal for the process. A process can be in statistical control and still produce out-of-specification product if process capability is poor.
• Failing to act on signals. Collecting SPC data and not investigating out-of-control conditions documents that you knew the process was behaving abnormally and did nothing. FDA Form 483 observations have cited exactly this failure.
• Using the wrong chart type. Applying an X-bar and R chart to data that is not normally distributed, or using attribute charts on continuous measurements, produces misleading results.
• Poor measurement system capability. If Gauge R&R studies show that measurement error accounts for more than 30% of total observed variation, the control chart is measuring the gauge, not the process.

How eQMS platforms support SPC

Paper-based SPC creates real problems: control charts drawn by hand are prone to calculation errors, out-of-control conditions may not be flagged consistently, and the link to the deviation and CAPA system requires manual intervention. An electronic quality management system with built-in analytics automates chart generation, applies out-of-control rules consistently, and routes signals into the deviation and CAPA workflow with a complete audit trail.

Cloudtheapp’s platform includes built-in analytics and monitoring tools across its 60+ quality management applications, connecting SPC monitoring directly to deviation management, CAPA, and management review workflows in a single validated environment. Request a demo to see how Cloudtheapp supports ongoing process monitoring in regulated industries.

Conclusion

Statistical process control in regulated industries is a quality system requirement, not a statistical exercise. FDA’s process validation framework, ISO 13485’s monitoring requirements, and the general expectation of data-driven quality management all converge on the same outcome: your process data must tell you when something is wrong, and your quality system must respond. SPC is the method that provides documented, statistically defensible evidence that it does.

]]>