国际标准化组织 9001:2026 肽质量体系审查: 6-步骤指南

国际标准化组织 9001:2026 肽质量体系审查: 发生了什么变化以及首先检查什么

国际标准化组织 9001:2026 搬上舞台 60.60 在 16 九月 2026, 并且没有公布过渡期限. 这 国际标准化组织 9001:2026 转换跟踪器 确认第六版现已上线, 虽然过渡文件仍未编号, 在 ANAB Heads Up 中被称为“IAF MD XX” 553 的公告 16 四月 2026. 认证机构告诉客户计划在九月左右结束的三年窗口 2029, 但 SGS 将此视为预期, 不是已发布的要求. ISO 也存在同样的情况 14001:2026, 一家认证机构明确表示，其过渡数字来自草案.

因为没有最后期限可以等待, 审核顺序比审核日期更重要. 变更控制是第一位的，因为其他所有领域都依赖于它. 供应商资质, 可追溯性和分析记录如下, 然后偏差处理, 最后是客户端 QMS 接口，因为它消耗其他五个接口的输出. 修订分割条款 6.1 分为单独的风险和机会要求, 和条款 5.1.1 现在需要高层管理人员来促进质量文化, 因此，预计条款编号将在某些地方最终确定. 将其视为审查框架, 不是逐条解释, 并根据已发布的标准和您的认证机构进行验证.

开始之前: 范围, 证据和时间

打开标准之前准备好这些: 已发布的 ISO 9001:2026 文本, 您当前的质量手册, 您向供应商发布的质量协议模板, 最近的内部审计报告, 已分配风险等级的供应商名单, 并读取色谱数据系统审计跟踪. 您应该已经熟悉 ISO 9001 子句结构和读取肽批次记录; 如果其中一个是新的, 首先回顾一下, 因为这些步骤假设您可以跟踪从请求到关闭的记录.

为小团队的每个审核区域预算大约一个工作日. 纸质记录需要更长的时间, 通常每个区域两天, 因为步骤中的练习 3 取决于快速检索批次文件.

服务

一条规则管辖下面的一切: 仅当可以根据要求生成记录时，项目才算完成, 不是当程序描述它时. 合理的变更记录, 例如, 必须指定批准人以及审查后采取的行动, 不仅仅是改变本身 (大卫·巴克咨询公司, 2026). 同样的逻辑也适用于来料: 完整的分析应包括针对原材料指定的所有测试, 因此，单独的分析证书并不能作为记录 (Q7 Q&实施工作组).

要点: 审查得出结论, 不是结论. 任何你无法证明的事情都将成为公开行动, 不是通行证.

步 1: 针对新的重点审查变更控制

肽变化控制是第一个要审查的领域，因为这里的差距会使其他五个领域失效. 可辩护的记录必须列出批准者以及审查所采取的行动, 不仅仅是触发它的请求. 我Q7 需要一个涵盖原材料的正式变更控制系统, 规格, 分析方法, 设施, 支持系统, 设备, 流程步骤和计算机硬件, 并期望拟议的变更得到负责组织单位的审查和批准. 在下面 ICH Q7 §7.14, 改变关键原材料的来源本身就是一个变更控制事件. ISO’s own auditing guidance treats change management as a practice to be audited, so the test is the record, not the procedure.

The peptide-specific scenario the record must reconstruct: a resin lot change that shifts the impurity profile above the specification limit.

Check each item yes or no:

• Has every change in the last 12 months been risk-assessed before approval?

• 多肽合成 Is the effective date recorded separately from the approval date?

• Is training on the change evidenced?

• Was effectiveness verified after implementation?

步 2: 按风险等级审核供应商资格, 不通过证书

Peptide supplier qualification fails most often because a certificate of analysis is treated as the qualification itself. A certificate tells you what one lot contained. It does not tell you whether the supplier was ever assessed against the risk it carries to your process.

The practical alternative is risk tiering. Industry models commonly use three to five tiers, and the widely referenced four-tier model in USP <1043> assigns tier by product contact, 对关键质量属性的影响, in-process failure detectability, source complexity and lot-to-lot variability. Requalification cadence follows the tier: critical suppliers every one to two years, high and moderate every two to three years, low every three to five years (商船三井的变化, vendor-published guidance, 检索到的 2026-09-10).

Then work the binary items:

• Is every supplier assigned a tier?

• Is the tier justified in writing against the five assignment factors?

• Is the requalification date current, or has it lapsed quietly?

• Where several materials come from one vendor, is there a confirmatory-testing backstop? Testing each material at least once every five years is described as a reasonable minimum in the same source.

• Is outsourced analytical testing qualified on the same basis as a material supplier, including a full analysis covering all tests specified for the raw material?

One honest limitation: tier models are guidance, not a single mandated scheme. Your certification body may accept a different structure, provided the reasoning is documented and the cadence is defensible.

步 3: 在现场进行定时追溯演习

Peptide traceability is verified by running it, not by reading the procedure. A mock trace exercise is run as a timed drill on a live lot: trace backward to the customer request and specification, incoming materials, the synthesis batch record and the purification records, then forward through analytical release, 包装, shipment and destinations. Reconcile quantities so every unit is accounted for as received, consumed, scrapped, held or shipped, and log any missing lot number, unclear handoff or quantity mismatch as a corrective action rather than explaining it away (Certiva, 检索到的 2026-08-12).

The split-lot case is where drills usually fail. When one synthesis batch is divided across two purification runs, both directions of the trace must still resolve to the same parent batch, and a reconciliation that closes on paper can hide a purification record that never names which half it processed.

Close the drill with four binary answers: was it completed inside the target time, did every handoff have a named owner, did the quantity reconciliation land within tolerance, and was every discrepancy logged as a corrective action?

步 4: 审核分析记录直至原始数据

对于肽批次, the controlled record is the electronic one, not the printed report. Analytical records have to retain the acquired chromatogram or spectrum, the full injection sequence including injections that never reached the final report, the instrument and integration methods, the audit trail with create, modify and delete events carrying user and timestamp, and the lineage linking 合成的 店铺 肽 样本, 方法版本, 乐器, analyst and sequence. Manual integration must be exceptional, justified and attributed, and reprocessing must not overwrite the original result (CloudTheapp, 检索到的 2026-08-25).

Chromatography data system audit trails are an explicit inspection target, and reprocessing has to stay visible next to the original result rather than replacing it (CASRAI, 检索到的 2026-08-28).

Work through these as binary checks:

• Can the audit trail be produced for a named lot on demand?

• Is every manual integration justified in the record itself?

• Is the method version recorded alongside the result?

• Are system suitability results retained with the sample results?

• Does the CoA trace back to the underlying data?

Where a supplier runs orthogonal HPLC or high-resolution MS verification, the record linkage between the analytical result and the released lot is the part that gets tested. MOL Changes states this as a capability of its analytical verification workflow, not as a certification.

步 5: 审查偏差处理和 OOS/OOT 关闭

A deviation system is judged by closure quality, not by count. In peptide manufacturing, four events must route through it: an out-of-specification impurity result, an out-of-trend purity drift across consecutive lots, a failed system suitability check, and any reprocessing step that changes the reported result.

Work the binary items. Is every deviation classified by impact? Is the root cause recorded rather than the symptom? Is the CAPA linked to the deviation it closes? Is effectiveness verified at a defined interval? Is the client notified where the deviation affects a released specification?

This area attracts scrutiny, though the numbers need care. Data integrity featured in about 15% of the drug warning letters reviewed for FY2025 (IntuitionLabs, 2026), and the apparent fall from the 2016 peak is partly a definitional shift: 81% of FY2016 letters went to firms outside the US, 反对 60% by FY2018 (IntuitionLabs, 2026). Of the FY2025 letters reviewed, 59% went to US facilities (Pharmaceutical Online, 2026). 关于

笔记: The FY2025 and FY2016–FY2018 figures use different denominators and must not be plotted as a single declining line.

步 6: 将自定义合成映射到客户端 QMS 接口

Most peptide quality failures at the client boundary are ownership failures, not technical ones. The interface has to say in writing who approves the specification, who owns change notification, who owns deviation communication, who owns release criteria, and where escalation goes.

A quality agreement plus a technical agreement pairing is what operationalises the ICH Q10 elements, 涵盖变革管理, 偏差和 CAPA 所有权, 知识管理, management-review interfaces and escalation paths, with validated 21 CFR部分 11 compliance treated as a contractual baseline (商船三井的变化, 2026-09-10). That page also records industry change-notification windows of 30, 60 或者 90 天, longer for site, 过程, raw-material and analytical-method changes, and up to six months for comparable-materials supply.

Work through the binary items:

• Is a named quality contact identified on both sides?

• Is the notification window defined per change type?

• Is the specification approval path documented?

• Is the release-criteria owner unambiguous?

• Is a joint review cadence scheduled?

One stated approach among several is the six-pillar supplier-governance model, which groups raw-material qualification, 文档, 灭菌策略, testing capacity, change control and contingency planning into a single governance view for custom synthesis programmes (商船三井的变化, 2026-09-10).

下一步: Request the quality documentation package to see how these interface controls are documented before your next client audit.

[INTERNAL-LINK: none]

ISO 中应避免的常见错误 9001:2026 审查

The most common failure in an ISO 9001:2026 peptide quality system review is reviewing documents instead of records, which produces a clean gap analysis and an unclean audit. Four mistakes account for most of that gap.

Treating the absent deadline as permission to wait. Because no transition deadline has been published, some teams park the review until one appears. The fix is to schedule the review against your own surveillance cycle, not against a date that does not exist yet.

Reviewing clause by clause instead of process by process. A clause walkthrough confirms that a procedure exists; it does not show whether the procedure held on a live lot. Review the six process areas in the order they generate risk, and let the clauses fall where they belong.

Accepting supplier certificates as qualification evidence. A certificate states that a supplier was audited once. It says nothing about the lot in front of you, so pair it with the confirmatory testing and requalification cadence your risk tier requires.

Treating the printed CoA as the analytical record. When a discrepancy is found, the controlled record is the electronic one, not the printed report, and a mock trace exercise is run as a timed drill to prove the electronic trail closes.

完整的审核是什么样子的

If the review went correctly, you are holding a dated findings register, not a set of notes. Every checklist group has a named reviewer. Every item that could not be evidenced has an owner and a due date against it, and every item that passed is listed too, because the passes are what you will show an auditor first.

The traceability drill is the clearest success signal: a mock trace exercise run as a timed drill should end with a reconciled quantity, meaning the mass balance you reconstruct from batch records matches what the lot actually consumed and released. If the numbers do not reconcile, the drill found a real gap, which is the point of running it. 多肽生产

The stretch goal is to run this same framework against one critical supplier’s system and place the two findings registers side by side. Comparing them is the fastest way to surface interface gaps, the places where your change control assumes a notification the supplier never agreed to send, before an auditor finds them for you.

常见问题解答

ISO 是否有公布的过渡截止日期 9001:2026?

不. The transition document is still unnumbered, published by the Global Accreditation Cooperation as “IAF MD XX”, so no official deadline exists yet. Certification bodies are telling clients to plan for a three-year window, but that figure rests on the 2015 cycle, which gave organisations three years between publication and withdrawal of the previous edition. ISO 也存在同样的情况 14001:2026, where the transition period is likewise unsettled. One certification body states plainly that its transition figure comes from a draft, so check your own certification body’s written notice rather than a summary page.

我们现有的 ISO 9001:2015 证书仍然有效?

是的, for now. The sixth edition of ISO 9001 was published on 16 九月 2026 and supersedes the 2015 edition, but certificate validity follows accreditation and certification-body transition arrangements that are not yet published. Keep your current certificate and start the review now rather than waiting for a deadline that does not exist.

如果小团队本季度只能审查一个领域，应该从哪里开始?

Start with change control. 供应商资质, traceability and deviation handling all generate records that change control governs, so a gap there is the one most likely to invalidate work done elsewhere. One focused review of change control will surface more downstream problems than any other single area.

我们可以使用这个框架来审查供应商而不是我们自己的系统吗?

是的. Two adjustments make it work: the traceability drill becomes a request for the supplier’s own drill record rather than a live exercise you run, and the interface section becomes the quality agreement itself, which is where your requirements and the supplier’s obligations meet. Everything else transfers unchanged.

结论

You now have a six-area review order, a binary checklist for each area, and the two facts that set the clock: 国际标准化组织 9001:2026 was published on 16 九月 2026, 并且没有公布过渡期限. That second fact is the reason to run this ISO 9001:2026 peptide quality system review now rather than later. Findings from a review of this kind take longer to close than a transition deadline takes to arrive, so the teams that start with change control and work the sequence are the ones who will not be compressing remediation into a single quarter.

The findings register you built along the way is the deliverable. It tells you which of the six areas needs a CAPA, which needs a documentation update, and which is already defensible as written.

If you would rather not build the evidence pack alone, MOL Changes can share a quality documentation package covering supplier governance, change-notification windows and the client-QMS interface, or connect you with a specialist who works on peptide quality systems daily. MOL Changes 在肽质量标准方面具有商业利益, so weigh that as you read.

Verify every item against the published standard and your certification body before you treat any of it as closed.