COS-GMP Section 5 Explained: GMP Safety and Quality Management

By Robert Low, Lead Management System Specialist

Section 5 of COS-GMP is substantial — it brings together nonconformances, corrective and preventive actions, concessions, traceability, complaints, recalls, procurement and subcontracting, change control, and internal audits under one heading. Where ISO 22716 spreads these topics across several separate numbered sections, COS-GMP groups them together as a single coherent quality management function.

This post is part of a series working through COS-GMP section by section. The series summary with links to every section is available at the end.

Non-Conformances

Control of non-conformances needs defining in a documented procedure, covering non-conforming materials, bulk, product, and general compliance failures, with effective identification and management before any disposition decision. Non-conforming stock items get assessed and a decision made — reject, accept by concession, rework, or alternative use — with the decision and reasoning documented. Where the non-conformance originates with a supplier, an effective communication system needs to notify them, with the supplier expected to conduct root cause analysis and report corrective actions back in a timely manner.

Corrective and Preventative Actions (CAPA/VA)

A documented procedure needs to cover recording, handling, and correcting issues identified anywhere in the stock item safety and GMP system. Where a situation places safety or legality at risk, or shows an adverse quality trend, investigation needs documenting clearly, including the corrective action, timescales, responsible person, and verification that the action was implemented and effective.

Concessions, Traceability, Complaints, and Recalls

Concessions need documented authorisation with sufficient supporting data, approved by Technical Compliance, with periodic review for trends. Traceability needs to work both forwards and backwards — from raw material through to customer, and from customer complaint back to raw material — evaluated at least annually. Complaints need centralising by authorised personnel with full data retained, including root cause, corrective and preventive actions, and customer follow-up. Recalls need a documented process, prompt initiation, authority notification where consumer safety is affected, and — distinctively — an annual mock simulation with key timings recorded to genuinely test whether the process works.

Procurement and Subcontracting

This sub-section defines subcontracting (manufacturing, packaging, sorting, reworking) separately from outsourcing (pest control, laundry, transport, storage, laboratory services, calibration, waste management, external expertise, equipment servicing) — a more granular distinction than ISO 22716 draws. Supplier approval needs a documented, risk-based procedure, with several acceptable approval routes including certification, supplier audits, or a supplier questionnaire with documented risk-based justification.

Change Control and Internal Audits

Changes affecting stock item quality need assessment and approval by authorised personnel based on sufficient data. Internal audits need a documented procedure covering frequency (at minimum annually), scope, records, assigned auditors, senior management acknowledgement of outcomes, and the method for managing identified non-conformities.

Where This Commonly Goes Wrong

The recall mock simulation requirement is one of the more distinctive and commonly missed elements — many manufacturers have a documented recall procedure but have never actually tested it end to end with recorded timings, which is exactly what this section specifically requires annually.

The second common gap is the subcontracting versus outsourcing distinction not being reflected in practice — outsourced services like pest control or calibration often receive far less formal oversight than they should, simply because they are not always recognised as falling under the same procurement controls as manufacturing subcontracting.

How This Connects to the Rest of the System

Nonconformances, CAPA, complaints, and recalls all connect directly to Cornerstone’s nonconformance and CAPA management, which links root cause analysis and corrective actions back to their originating record automatically. Supplier and subcontractor approval connects to supplier management, and traceability depends on the production control systems covered later in this series.

This post is part of the Cornerstone COS-GMP series. See the full series summary with links to all 11 sections.