国际标准化组织 9001:2026 肽质量体系审查: 检查什么

何时运行此审核, 以及需要准备什么

该标准现已发布, 过渡时钟已经是一个实际问题. ANSI 发布的标志着十年来首次全面修订的版本指出，过渡期仍处于“批准过程中”，并将由 Global ACI 设定, 预期有三年的窗口期，但尚未解决. 接下来有两个后果. SGS 发布的修订公告 确认现有 ISO 9001:2015 证书在过渡期间仍然有效, 并且必须在截止日期之前与您的认证机构一起计划过渡审核. 分别地, 认可的认证机构必须自行经过其认可机构的转换后才能颁发 2026 证书, 所以你选择的身体的准备情况值得尽早确认.

修订涉及每一个条款 3 到 10 并添加了新的附录 A, 每 BSI 的修订条款逐条摘要, 同时保留Annex SL结构. ISO/TC 176 自己的发布公告, 发布 23 九月 2026, 链接“发生了什么变化”?”和“过渡指南”，供需要主要文本的读者使用.

六框审查顺序, 每个框下都有命名的证据工件.

多肽合成

开始前的一份范围说明: 以下审查来自肽质量体系必须控制的六个领域, 不是来自对标准的逐条阅读. 将其视为优先级辅助工具, 不是差距评估.

变更控制: 您的系统是否涵盖沟通和效率, 不仅仅是认可?

终止于批准的变更审核不涵盖条款 6.3 如所写. 逐个条款的演练 2026 文本报告称“变更规划”现在也期望信息的可用性, 如何传达变更, 如何监测和评估有效性, 以及如何审查结果 (等管理知识库, 检索到的 2026-09). 这 ICH Q10 变更管理指南 指向相同的方向, 描述基于质量风险管理的变革管理，并评估监管备案影响和实施后验证是否达到目标. 将 Q10 扩展视为未确认，直到直接阅读 ICH PDF.

以是/否判断来运行这些, 每个都有一个命名的神器和所有者:

• 每次改变合成路线, 纯化方法, 或评估分析方法对客户规格的影响? (变更记录, 质量保证)

• 是否根据书面阈值通知客户, 该阈值是否已记录在案? (通知程序, 质量保证)

• 是否根据定义的验收标准验证变更后的有效性, 并记录结果? (成效审查, 质量控制)

• 每个变更记录是否与受影响的批次相关联? (地段家谱, 质量保证)

• 未经正式审查，是否可以防止临时偏差成为永久性流程变更? (偏差日志, 质量保证)

要点: 单独批准不再满足条款 6.3. 沟通, 有效性监控, 和结果审查现在是变更记录本身的一部分.

供应商资质: 您的风险分级是否有记录并且是最新的?

供应商资格认证最常失败，因为分级存在于人们的头脑中而不是纸面上. ISPE 的原材料供应商资格框架将每种材料分类为起始材料 (严重影响产品质量), 钥匙 (影响过程一致性) 或非键, 然后使用ICH Q9质量风险管理来设置审核深度, 对高风险供应商保留现场审核 (ISPE制药工程, 2022).

通过这六项判断来判断肽供应商资格:

1. 是每一种原料, 树脂, 以书面形式分配到某一层的试剂和溶剂?

2. 该层级是否决定审核深度和重新认证节奏?

3. 是否已确定独家供应商, 有记录的连续性计划?

4. 每个供应商的认证状态是否经过验证并注明日期?

5. 合同是否需要变更通知, 具有定义的阈值?

6. 分析测试实验室是否与材料供应商分开进行资质认证?

   等级	审计深度	节奏重新鉴定
   开始	高风险供应商现场审核	最短间隔, 基于风险的
   钥匙	服务 桌面或远程评估	中间间隔
   非钥匙	证书及问卷审核	最长间隔

独家来源状况和供应商的其他行业属于风险问题, 不在他们之外. 一个诚实的限制: 供应商拒绝审核访问的情况, 没有分层文档可以弥补这一差距. 记录拒绝和缓解措施.

可追溯性: 你能从头到尾重建一个现场现场吗, 一经请求?

通过运行演练来测试可追溯性, 不是通过阅读程序. 选择一个已发布的批次并设置时钟: 通过合成从原材料批号重建序列, 纯化, 分析测试, 发布, 并发货给客户. The pass condition is a complete record, produced on demand, without anyone reconstructing it from memory.

The standard behind that drill is ALCOA+, which stands for attributable, legible and intelligible, 同时期的, 原来的, 准确的, 完全的, 持续的, 持久, 并可用. The “plus” attributes extend the original ALCOA set to retention and access, including after a contract ends for outsourced activities, 如载于 WHO TRS 996 附件 5 (2016) and the MHRA and FDA data integrity guidance cited alongside it.

Run these as binary checks:

• Does the lot genealogy link every input lot to the output lot?

• Are instrument files, 色谱图, and spectra retained as original records, not only as PDFs?

• Are audit trails enabled and reviewed?

• Is chain-of-custody recorded for client samples and reference standards?

• Can the record be produced after the contract ends?

Raw data retention means keeping the original source record in original or certified-true-copy form for the full retention period, with reprocessing, reintegration, and invalid injections still reconstructable through audit trails, 每 FDA’s data integrity Q&A for drug CGMP. If you can produce a CoA but not the raw data behind it, the drill fails.

分析记录: 原始数据和数据完整性控制是否已准备好进行检查?

The review question here is narrower than “do you have a CoA”: it is whether the analytical record set is complete at the raw-data level, because that is where the 2026 revision’s documentation expectations meet existing data-integrity guidance. The ALCOA+ attributes and where they come from set the standard: 可归因的, 清晰易读, 同时期的, 原来的, 准确的, 加完整, 持续的, 持久且可用.

• Is the specification version used for release the exact client-approved version?

• Are HPLC, 多发性硬化症, 氨基酸分析, endotoxin and counterion results retained with the raw instrument data?

• Are out-of-specification and out-of-trend results flagged before release, 不之后?

• Are method versions and instrument calibration records linked to each result?

• Is the endotoxin limit justified against the K/M framework for the intended route rather than copied from a monograph?

On that last item, 美国药典 <85> 内毒素限量计算 sets no single universal limit; it gives K/M, 与 K = 5 EU/kg for routes other than intrathecal and K = 0.2 EU/kg 鞘内注射, 其中 M 是单小时内每公斤人体的最大推荐剂量. Limits may be expressed as EU/mL, EU/mg 或 EU/单位.

笔记: cite USP chapters by number and name. Do not attribute a limit to a specific edition year, and treat the compendial sterility test the same way: acceptance means no evidence of microbial growth after 14-day incubation in Fluid Thioglycollate Medium and Soybean-Casein Digest Medium, not proof of sterility.

偏差处理: 每个偏差是否都与根本原因和 CAPA 链接有关?

The review tests closure, not logging. A deviation log that records events but not causes fails the improvement emphasis in the revision, where continual improvement moves from clause 10.3 到 10.1 and the old 10.1 General clause merges into it, per a clause-by-clause walkthrough of the 2026 文本 (retrieved September 2026).

Work through these binary checks:

• Every deviation carries a unique identifier and a named owner.

• A root-cause analysis is recorded, and the method used is named.

• A CAPA is raised where the cause is systemic, with effectiveness verified after a defined interval.

• Deviations are trended, and the trend is reviewed at management review.

• Temporary deviations are time-limited and formally closed or converted into a change.

• Client-facing deviations are notified against a defined threshold.

No official source quantifying the share of ISO 9001 nonconformities attributable to document control was found, so no failure-rate figure is offered here.

定制合成和客户端 QMS 界面: 谁拥有释放证据?

The interface is where most custom synthesis quality problems actually live, because two quality systems have to agree on one specification and one release record. 这 2026 revision sharpens that pressure: 条款 6.1 现在分裂成 6.1.1 (determining risks and opportunities), 6.1.2 (actions to address risks) 和 6.1.3 (actions to address opportunities), with risks and opportunities each determined, analysed and evaluated in their own right (isomanaged’s clause-by-clause walkthrough of the 2026 文本, 检索到的 2026-09). DQS’s summary of what actually changed 描述 6.1.2 和 6.1.3 as more systematic guidance on opportunities without adding bureaucracy. The revision keeps the Annex SL high-level structure, with all clauses 3 到 10 plus a new Annex A changed (BSI 的修订条款逐条摘要).

Run these as binary checks:

• Is the client specification version controlled on both sides, with a named owner for each?

• Is the change-notification threshold agreed in the quality agreement? 关于

• Is it defined who owns lot-release evidence and who holds the retained records?

• Are client audit rights and audit scope written down?

• Is the documentation package structured so the client can file it against their own QMS?

A documentation package of this kind is one way to structure the evidence. MOL Changes 作为肽供应商发布，对肽质量标准具有商业利益. 多肽生产

要避免的常见错误

The failures that surface in a clause-level review of the 2026 text are rarely missing procedures. They are records that cannot answer the question an auditor asks. Five recur.

Treating change control as an approval step. 条款 6.3 asks for more than sign-off: 沟通, monitoring, and review of the change’s effect. Teams route a form to a manager and file it, so no one can later show what the change did downstream. Fix: record who was notified, 什么时候, and what was checked afterward.

Assigning supplier tiers informally. Audit depth then follows habit rather than risk. Fix: document the tier, the criteria behind it, and the review date, using a published framework such as ISPE’s raw-material supplier qualification guidance as the reference.

Retaining only PDF reports. PDFs break the availability and reconstructability expectations described in FDA’s data integrity guidance for drug CGMP, because reprocessing and reintegration cannot be replayed from a printout. Fix: keep original instrument data alongside the report.

Closing deviations at the log entry. A log line with no root cause and no CAPA effectiveness check leaves the same failure free to recur. Fix: link each closure to its root cause and its verification step.

Letting the client specification version drift. Two quality systems, two versions, no reconciliation. Fix: name one owner for the specification and one notification route.

要点: Every one of these is a records problem before it is a procedure problem.

常见问题

ISO什么时候出 9001:2026 过渡期结束?

The three-year transition window is not yet fixed. ANSI’s note that the window is still in the approval process states that the dates will be set by Global ACI, the body that governs the accreditation and certification framework, so September 2029 is a reasonable planning assumption rather than a settled deadline. Treat any published end date as provisional until Global ACI confirms it.

我们需要立即重新认证吗?

不. Certification bodies must complete their own transition before they can issue ISO 9001:2026 证书, as ANSI’s release marking the first full revision in a decade sets out, so your first 2026 certificate cannot arrive ahead of your certification body’s readiness. SGS’s published-revision bulletin confirms that ISO 9001:2015 证书在过渡期间仍然有效, and your transition audit is planned with your certification body rather than booked unilaterally.

此次修订是否改变了我们的供应商资格要求?

Not directly. The standard does not name peptide-specific supplier criteria; it asks you to show that qualification is risk-based and current. The practical change is documentation: your tiering rationale and review dates need to be retrievable, not just held in a buyer’s memory.

如果我们的供应商不允许现场审核怎么办?

Use the evidence the supplier will release. A documented questionnaire, certificate of analysis review, and change-notification history can support qualification where site access is refused, provided you record the limitation and the compensating controls in the supplier file.

结论

You now have a six-area review you can run against your own quality system, and for every item a named evidence artifact and an owner. That mapping is the part worth keeping: a checklist that ends in “someone should look into this” does not survive an audit, while a checklist that ends in “the validation lead holds the change-effectiveness record” does.

The areas, in the order this review covered them: 变更控制, 供应商资质, 可追溯性, 分析记录, 偏差处理, and the custom synthesis interface with your QMS. Run them in that order and the later ones get easier, because traceability and deviation records depend on the change and supplier tiers you set first.

If you want the review as a working document rather than a reading exercise, request the documentation package and we will send the worksheet version, with the artifact and owner columns left blank for your team to fill. For a custom sequence, a technical feasibility assessment is the faster starting point.

披露: MOL Changes publishes this review as a peptide vendor, and holds a commercial interest in how peptide quality standards are applied.