Fix the system, not the symptom
Quality systems get worse over time, and it happens to well-run companies as reliably as it happens to inefficient ones.
Every finding adds a control. Nothing ever gets taken away. Each addition made sense to whoever made it. And after a few years you have a system that produces non-compliance instead of demonstrating compliance, staffed by people who are all trying hard.
This is how I work, and why.
How systems accumulate
Four things happen, and none of them require anyone to make a bad decision.
Every finding adds a control or check.
Something goes wrong, so a form gets added, or a second signature, or a new procedure. That's the standard response and it's rarely questioned.
Nothing gets removed.
There's no process for taking a control away, no reward for doing it, and a fair amount of risk in being the person who suggests it.
Each addition looks reasonable on its own.
Nobody ever proposed something absurd. Every single control had a rationale on the day it was introduced.
The cumulative weight is invisible.
No one person sees all of it. The people who feel it are the ones doing the work, and they're not usually in the room where controls get added.
Why more monitoring isn't more compliance
This is the part that sounds wrong until you've watched it happen.
I was doing a facility assessment on a site and found four areas where operators weren't replacing a dirty mat outside the room. Every mat change had to be recorded in a log. During processing the operators were moving in and out constantly, and the logging added time without adding value. So the mats stayed down, and became a source of contamination rather than a control against it.
THE POINT
No regulation explicitly requires mat changes to be logged. Nobody on site knew why the log existed or when it was introduced. A control added to improve compliance was the reason compliance had failed.
The same thing happens in four predictable ways:
Workarounds appear.
When the compliant path is the hardest path, people find another one. They're not being difficult. They're trying to get the work done.
Decisions slow down.
Approvals stack up and the queue becomes its own risk. Changes stop being raised because raising one takes six weeks.
Records get completed late.
Contemporaneous recording is the first casualty of a burdensome process, and it's one of the things investigators look at hardest.
Ownership blurs.
When everything routes through QA, nobody else owns anything. Quality becomes the bottleneck and the rest of the business stops feeling responsible.
01 / 03
Customise
Understand the operation before changing anything.
START WITH THE WORK
I map the business processes, walk through the work, and spend time with the people doing it before I suggest a design or change. What are the lifecycle stages, the product risk, the actual regulatory obligation, and what can this organisation realistically sustain?
This step exists to prevent one specific mistake, which is building a system sized for an organisation you aren't. It's the most common and most expensive error in this market, and it usually arrives as a template copied from a large pharma company that had a department you don't have.
Proportionality isn't a cost argument. The regulations themselves expect a system appropriate to the size and complexity of the operation.
02 / 03
Simplify
Take out what isn't doing any work, or isn't compliant.
Duplicate approvals. Forms nobody reads. Procedures that contradict each other. Handoffs that exist because of an organisational structure that changed three years ago.
The question I'm asking is where effort exceeds risk, and there's usually more of it than anyone expects.
SIMPLIFY IN PRACTICE
What this looks like
A manufacturer had a pile of open and overdue change controls, and a long list of SOPs past their review date. A regulator had cited both. The QA team couldn't get on top of either, and the assumption was that people weren't trying hard enough.
The cause was the change control procedure itself. It required a change control form for any change at all, including reviewing or updating an SOP. The form ran to several pages, with multiple sections and multiple approvals, and for an SOP update most of those sections didn't apply. The process was heavy enough that people put off starting one. So change controls sat incomplete and SOPs went unreviewed.
The change
I rewrote it. SOP reviews and updates no longer need the full form. They need a one-page Document Revision Record with two signatures.
Nothing was removed that the regulations required. What went was the weight around it, and the compliance position was stronger afterwards than before.
What this does not mean
Simplifying isn't cutting corners and it isn't fewer controls than the risk requires. It's about having the right kind of processes and documents so that doing the work properly is easier than not. Every required control stays, along with the evidence for it. What goes is the accumulation around them.
03 / 03
Comply
Implement, then verify that the changes comply with the requirements.
Does the system meet the requirements that apply, and does it do so when it's actually being used? Is there evidence? Does anyone own each part of it? Will it still work when the people change and the volumes go up?
Compliance sits last because it's the outcome of the first two steps, not a separate activity bolted on at the end. A system that passes a document review and fails in practice is where most findings live.
The order matters
These aren't three services you choose between. They only work in sequence.
You can't simplify something you don't understand — you'll remove the wrong things.
You can't claim compliance for a system nobody uses.
And it doesn't finish, because operations keep changing and the accumulation starts again the moment you stop paying attention.
What it looks like in practice
A startup system sized for a startup, not for the company that wrote the template
A one-page document revision record where there used to be a multi-page change control form
Two approvals where there were five
One procedure replacing four that overlapped
Recording that happens at the bench, while the work is happening
Process owners outside Quality, who own their own processes
Where this came from
I kept walking into companies with complex quality systems built from off-the-shelf templates, or lifted from larger pharma companies. They'd been built to tick compliance boxes rather than to run the business, and they created more non-compliance than they demonstrated compliance.
What frustrated me most was that documents existed everywhere, and none of them explained the why behind the regulation or the control. Nobody had helped anyone understand how the work was actually meant to be done.
At the same time the regulatory guidance was moving towards risk-based and data-based decision making, which you can't do unless you genuinely understand how an organisation works. Those two things pointed at the same conclusion.
So I stopped starting with documents and started with the operation.
Where this applies
Questions people ask
Is simplifying compatible with regulatory requirements?
Yes, and the regulations support it. They expect a system proportionate to the size and complexity of the operation. What they don't expect is a system so heavy that nobody can follow it.
Does this mean removing controls?
It means removing controls that aren't doing anything, and fixing ones that aren't compliant. Every required control stays, along with the evidence for it. The test is whether a control is managing a real risk or just occupying space.
How is this different from what other consultants do?
Most start with the documents. I start with the operation, because the documents describe a version of the work and the operation is the actual one.
Does it work for a small organisation?
It works best for one. Small organisations are the most likely to be carrying a system designed for someone ten times their size.
Does it work on a system that already exists?
That's most of what I do. Building from scratch is the easier half.
Where do we start?
Usually with an assessment, if you don't yet know what's wrong. With the system itself, if you do.
Where to go next
Start with an assessment
If you suspect something isn't right but can't name it. Start with an assessment.
Start with the system
If you already know what's wrong. Start with the system.