Multi-Site QMS: One Quality System Across Plants Without Losing Local Control

Corporate quality wants one system. Plant managers want the authority to close a deviation without waiting for headquarters. Both are right. A multi-site QMS that only centralizes records usually stalls local work. A QMS that only lives at the plant usually fails the next ISO 13485 or FDA QMSR inspection, because the investigator asks for one quality policy, one CAPA method, and evidence that similar problems do not repeat at sister sites.

This article is for Quality Directors and Heads of Quality who run two or more plants, contract manufacturers, or a mix of development and manufacturing sites. It describes how one electronic quality system can stay official everywhere without stripping local process owners of the controls they need on the floor.

Cloudtheapp is a validated quality and compliance platform with intelligent assistance that keeps your experts in control. Fast Track still assumes named owners and a first-wave process list. The multi-site design below is the work you do before you buy.

What "one quality system" must mean

ISO 13485:2016 clause 4.1 requires the organization to document the QMS and its processes, including outsourced processes. FDA's Quality Management System Regulation (QMSR) aligns 21 CFR Part 820 with ISO 13485 and still expects a coherent system, not a binder per building. See FDA's QMSR FAQ: Quality Management System Regulation – Frequently Asked Questions.

One system, in practice, means:

• One quality manual and one set of corporate procedures for how CAPA, change control, document control, and audits work
• One official record for those processes, with a single audit trail an investigator can export
• Site work instructions and forms that sit under the corporate procedure, not beside it
• Visibility for corporate quality: open CAPAs, overdue training, audit findings past due date, across plants

Local control means:

• Site quality can open and close records that belong to that plant
• Site process owners approve site work instructions
• Site-specific equipment, rooms, and product families do not wait on a global change board when the risk stays local
• Contract manufacturers see only the records and documents they are allowed to see

If you cannot write those two lists on one page, you will configure a tenant that nobody uses, or five tenants that you cannot defend as one QMS.

The failure modes you already know

Shared drive plus email. Each plant has a "controlled" folder. Corporate quality copies PDFs into a master library once a quarter. Training matrices live in spreadsheets that do not match. An investigator at Plant B will ask why Plant A's CAPA on the same supplier never reached them.

One global workflow, no site fields. Every deviation routes to the same corporate queue. Plant quality stops opening records because the queue is three weeks deep. Shadow logs appear on the line.

Separate systems per plant. You bought the same vendor twice. Master data, user roles, and SOP numbers drifted. Corporate quality cannot run a single overdue-CAPA report without a data warehouse project.

Corporate-only tenant with "view" for plants. Plants print, mark up, and scan. The electronic record is a filing cabinet.

Design the tenancy before the demo

Write the tenancy model as a controlled decision, then ask vendors to show it.

1. Legal entity versus site. If two plants share a 510(k) holder and one quality manual, they belong in one QMS instance with site as a required field. If you acquired a company that still holds its own certificates and quality manual, you may keep a second instance until the quality manuals merge. Do not merge certificates in software before you merge them in the real world.

2. Site as master data. Site, building, and (if needed) line should be controlled lists, not free text. CAPA, NCR, audit, and training records inherit site. Reports filter without Excel.

3. Corporate procedure versus site WI. Corporate procedures are approved by corporate quality and, where required, medical or regulatory. Site work instructions are approved by the site process owner plus site quality. The link is mandatory: a site WI cannot be effective unless the parent corporate SOP is effective.

4. Routing by site and risk. Local NCRs stay at the plant. Escalation to corporate is a rule, not a personality: repeat issue, supplier shared across sites, product distributed from multiple plants, potential reportable event.

5. Supplier and customer master. One supplier record. Site-specific scorecards can exist, but a SCAR on a shared supplier is visible to every site that buys from them.

6. Training by role and site. A filling operator at Plant A is not automatically qualified at Plant B. Role templates can be corporate; assignments are site.

7. External parties. Contract manufacturers and critical suppliers get a portal or guest role limited to the records you send. Guest links that bypass training and access models recreate SharePoint.

8. Validation. One intended-use statement can cover multiple sites if the configuration is the same. Site-specific workflows need site-specific test evidence. FDA's Computer Software Assurance approach (September 2024) lets you scale testing to risk. It does not let you skip intended use.

Governance that keeps local control

Name a corporate process owner for CAPA, document control, audits, and training. Name a site process owner at each plant. The corporate owner owns the procedure and the metrics. The site owner owns the records and the site WIs.

Meet monthly on a short scoreboard: open CAPA aging by site, audit findings past due, training overdue for GxP roles, changes past target. If corporate quality only sees the scoreboard after a plant emails a spreadsheet, you do not have one system.

Management review under ISO 13485 and QMSR needs multi-site inputs. Pull them from the eQMS, not from five PowerPoints.

Cutover without freezing the plants

Do not go live at five plants on the same Monday unless you have super users at each site and a freeze that operations already signed. A safer pattern:

• Corporate procedures and document control first, so the official SOP set exists
• One pilot plant for deviations/NCR, CAPA, and training
• Remaining plants on a two-week stagger
• Hypercare at each plant for five business days
• Contract manufacturers last, after internal users stop creating shadow files

Open records: migrate what is still open. Closed 2019 complaints stay in the archive unless a pending inspection needs them online.

What to demand in software

• Site-aware records and reports without a custom data warehouse
• Role model that can hide another plant's records
• Configuration (not custom code) for site routing
• Validation package with each platform update
• Export of records and audit trails per site and as a whole

Cloudtheapp Fast Track is a 30-day go-live path when process owners already exist. Multi-site still needs the tenancy page written before kickoff. If you cannot name corporate and site owners, you are not ready for a 30-day calendar.

Go / no-go

Go live on one QMS across plants when:

• Quality manuals and certificates match the tenancy you configured
• Corporate SOPs and site WI hierarchy are written
• Escalation rules are in the procedure, not in a slide
• Super users exist at each site in the first wave
• Validation file covers intended use for every site in that wave

Until then, keep the current official record. Adding a corporate dashboard on top of five unofficial systems is not a multi-site QMS.