Regulatory & Validation Constraints (quick readiness check)

• Which regulatory frameworks apply to the processes this QMS will govern? Select all that apply. Options: FDA 21 CFR Parts 210/211, FDA 21 CFR Part 820 (medical device), EU GMP Annex 11 or Annex 1, ISO 13485, Contains PHI or patient-identifiable data, Other (please specify)
• Do you have required validation deliverables, templates, or an internal validation SOP we should align to (for example IQ/OQ/PQ artifacts)? Please summarize.

Technical and Data Fit

• Which systems will the QMS need to integrate with or replace, and what are the primary data migration sources? List key systems (for example MES, ERP, LIMS, shared drives).

Workflow Configurability and Adoption

• Who will be the primary day-to-day users by role and approximate headcount?
• Which approach to configuration and adoption fits you best right now? Options: We have internal change and training resources and will co-own adoption, We can support configuration but need vendor-led validation and training, We need a low-touch, turnkey configuration plus vendor training, Unsure, would like to discuss options

Budget, Authority, and Timeline

• Is there an allocated budget range for this QMS initiative? Options: Less than $50,000, $50,000 to $150,000, $150,000 to $350,000, $350,000 to $750,000, More than $750,000, No budget allocated / under discussion
• Who will approve the purchase and which roles will materially influence the decision? Select all that apply. Options: Head of Quality / VP Quality, Quality System Manager, IT Director or Head of IT, CFO / Finance, Procurement, Site Operations / Manufacturing Lead, Other (please specify)
• What is your target go-live timeframe and is there a fixed deadline driving it (for example an inspection, contract milestone, or product launch)? Options: Within 3 months, 3 to 6 months, 6 to 12 months, More than 12 months, Driven by a fixed regulatory or audit deadline (please specify)

Mapping Your Current Quality Picture

• How would you briefly describe your current end-to-end quality system and where most controlled records live?
• Tell me about the source systems that create quality evidence for manufacturing, lab, and suppliers, and which of those you consider authoritative. Options: Your MES, Your LIMS, Your ERP, Shared drives and file servers, Paper logbooks, Point solutions (legacy QMS modules), Other
• On average, how many active controlled documents, open CAPAs, and open deviations does your quality team manage at a time? Options: <100, 100–499, 500–1,999, 2,000–5,000, >5,000
• Walk me through the last time your team had to pull evidence for an inspection, who gathered the records, and how long it took to provide them.
• Which single process between document control, CAPA, deviation handling, and training creates the most daily manual work for your staff? Options: Document control, CAPA management, Deviation/nonconformance handling, Training records, Change control, Supplier qualification, Audit management

Where the Current System Actually Breaks

• When an inspection or regulatory query lands, what single gap in your current quality setup would most likely trigger an observation or warning?
• Give a recent example of a time your team could not produce a required record quickly, what the missing element was, and the downstream cost or delay.
• How many users routinely bypass formal workflows because they are slower than manual workarounds? Options: None, A few power users, A departmental pattern, Across multiple sites
• Describe what breaks downstream when training records or batch-linked documents are not current, for example release holds or repeat investigations.
• If a regulator asked for full traceability on affected batches for the past 24 months, could your team assemble signed, time stamped evidence within 7 days? Options: Yes, Partially, with manual effort, No

Hidden Compliance Risks That Nobody Volunteers

• Who on your team is responsible for maintaining electronic signature, audit trail, and Part 11 or Annex 11 procedures, and where are those procedures documented?
• Which types of quality affecting data currently live outside your primary systems and would need to be brought under control for validation purposes? Options: Paper forms, Spreadsheets, Homegrown databases, Third-party lab portals, Email attachments, Other
• Estimate the monthly volume of paper only records that are created and the current reconciliation steps you use to capture them electronically. Options: <50 records, 50–199, 200–999, 1,000–4,999, >=5,000
• When was the last time a documented validation gap delayed a product release or resulted in corrective actions? Options: In the last 6 months, 6–12 months ago, Over a year ago, Never
• Is there any active regulatory hold, ongoing inspection, or legal review that would prevent starting validation work in the next 60 days? Options: Yes — detail in follow up, No

The Options You Are Seriously Considering

• Tell me which external vendors, incumbent systems, or internal build efforts you are currently evaluating for quality management. Options: Incumbent enterprise QMS, Point solutions or modules, Internal custom build, Spreadsheet based controls, No formal plan yet, Other
• Rank the options you are considering for their ability to deliver complete IQ OQ PQ documentation, from most to least confident. Options: Highest confidence, High, Moderate, Low, Not confident
• What would have to be true about keeping your current approach for you to decide not to replace it?
• Is anyone internally advocating for a do it ourselves approach instead of buying a validated platform, and if so who would sponsor that path? Options: Yes — internal sponsor identified, Yes — proposed but no sponsor, No internal build advocacy
• If you decided to stay with the incumbent or build internally, what single risk would most likely force you to revisit that decision within 12 months?

Who Signs Off and Who Picks Up the Work

• Who are the people that must sign the commercial agreement and the validation plan before go live, and what are their roles?
• List the day to day owners for document control, CAPA, training, and integrations and their functional areas.
• Provide the headcount in each functional owner group and indicate who will require admin level access during and after deployment. Options: 1–3, 4–10, 11–25, 26–50, >50
• Walk me through your escalation path for a critical quality event, who is notified, and typical response times at each step.
• Identify any person or committee with veto power over implementation or validation decisions and how that invocation works. Options: Executive steering committee, Quality head only, Legal or compliance holds, No formal veto process

What Success Looks Like in Practice

• Imagine overdue CAPAs falling by 50% in six months, how would that change your release timelines and audit posture?
• Name the primary quality KPIs you will use to judge a pilot and the first 12 months of deployment. Options: Open CAPAs, Average CAPA closure time, Overdue training percentage, Deviation closure time, Audit findings, User adoption rates
• Within what timeframe do you expect measurable improvements—3 months, 6 months, or 12 months—and which is your target window? Options: 3 months, 6 months, 12 months, More than 12 months, Unsure
• What single acceptance criterion would compel you to sign a commercial commitment immediately following a successful pilot?
• Assuming the pilot misses the agreed KPI targets, what decision will you take: cancel, extend, or reallocate resources to fix gaps? Options: Cancel and walk away, Extend the pilot, Allocate additional internal resources, Re-negotiate acceptance criteria

Can Your Infrastructure and Team Support This?

• Do you have API access and a named owner for each integration the project depends on, for example MES, LIMS, ERP, and the supplier portal? Options: Yes, owners and APIs in place, APIs available but no owner assigned, APIs not available, Partially available
• List the systems that must be integrated and whether standard APIs, custom connectors, or manual exchange will be required. Options: Standard API available, Custom connector required, File exchange, Manual transfer, We do not know yet
• Provide the estimated record volumes to migrate by domain, for example controlled documents, training records, CAPAs, and supplier files.
• Name the full time internal technical contact and summarize their experience with validated SaaS integrations.
• Are there regulatory approvals, IT security gates, or legal reviews that regularly add months to projects at your site? Options: Yes, regulatory or legal reviews, Yes, IT security or SOC reviews, Both types, No major gates exist
• Can you commit to provisioning API access and a named owner for every required integration within 8 weeks if needed? Options: Yes, No, Need more information

Practical Acceptance Checklist and Timing

• Identify the single nonnegotiable test, migration reconciliation, or regulatory signoff your team requires before accepting production go live.
• Choose the validation deliverables you require the seller to deliver as part of IQ OQ PQ and handover. Options: IQ protocol and report, OQ protocol and report, PQ protocol and report, Traceability matrix, CSV/CSV to validated system mapping, Test scripts and results
• State your target go live date or window and list any immovable regulatory deadlines tied to that date.
• Detail the roles and teams that must complete training and the evidence you will accept for regulatory acceptance, for example signed certificates or LMS records. Options: Signed training certificates, LMS completion records, Manager attestation, Attendance logs with assessments
• Describe the open risks or blockers that would stop procurement or the steering committee from approving funding today.
• State the role and title of the person authorized to sign and commit budget immediately once acceptance criteria are met.

Environment and site access

• Deployment scope — is this a single site/environment rollout, a multi-site rollout (please confirm number of sites), or a pilot then phased rollout? (This determines sequencing and resource allocation.) Options: Single site / single environment, Multiple sites — will provide per-site details, Pilot site first, phased rollout thereafter
• Is the target production environment provisioned and accessible for the seller's deployment work? If not, select the current state (so we can schedule provisioning and cutover windows). Options: Yes — accessible now, Partial — only staging/test accessible, No — production not yet provisioned (date to be provided)
• Site owners and environment contacts — for each site/environment, list the site name, the named site owner, and the IT contact (so we can schedule access and approvals).

Data and configuration

• Primary data migration scope — which record types must be migrated into the new system? Select all that apply (these choices drive migration sizing and mapping). Options: Document control metadata, Training records and completions, CAPA history, Deviation / nonconformance records, Change control history, Supplier / vendor records, Audit findings and corrective actions, Other (please specify)
• Is a source-of-truth owner identified for each record type who will sign migration acceptance? (This person/role will approve migration verification.) Options: Yes — owners named (will provide), No — owners TBD, Central data team will own, Multiple owners per site
• Are field-mapping decisions and migration acceptance criteria finalized, or will mapping workshops be required? (Indicate level of readiness so we can plan mapping sprints.) Options: Finalized — ready for migration, One mapping workshop required, Multiple mapping workshops required, Not started — need the seller's assistance

People and ownership

• Named deployment sponsor and primary buyer owner (name and role) — who has authority to approve Go/No‑Go decisions?
• Per-workstream owners — provide the named owner or enter 'the seller-managed' for each: system configuration, data migration, integrations, validation, and training (one line per workstream).

Timing, integrations, and constraints

• External systems in-scope for integrations (select all that apply). We will request endpoint and credential readiness in DeploymentConfig. Options: ERP, MES, LIMS, Identity provider / SSO, E-signature system, Other (please specify)
• For the in-scope integrations, is a named integration owner assigned and is a test endpoint available for initial integration testing? (This indicates whether integration work can start immediately.) Options: Yes — owner and test endpoint ready, Partial — owner assigned, endpoint pending, No — the seller's assistance required to coordinate
• Validation readiness — is the IQ/OQ/PQ approach agreed and are responsibilities assigned (buyer, the seller, or third party)? (This determines validation scheduling and deliverable ownership.) Options: Agreed — buyer owns execution, Agreed — shared buyer/the seller responsibilities, Not agreed — decision required, Buyer's third-party validation vendor will execute
• Site blackout windows or regulatory constraints that must be avoided during the rollout (e.g., audits, production freezes). If none, select 'None'; if yes, indicate 'Yes' and we will request dates/sites. Options: None, Yes — dates and sites to follow

ENVIRONMENTS & API ENDPOINTS

• Enter the production instance base URL the deployment will configure (format: https://your-subdomain.example.com)
• Enter the staging/UAT instance base URL to be configured (format: https://your-subdomain-uat.example.com). Enter NONE if not used.
• Select the API version to lock for all environments (Default: v1) Options: v1 (default), v2, v3
• Enter the system timezone that all timestamps, exports, and audit logs should use (Default: UTC — use IANA name, e.g., Pacific/Auckland)

SSO / IDENTITY PROVIDER (IdP)

• Select the identity provider type to configure for the buyer (Default: None) Options: SAML-based IdP, OIDC-based IdP, None (no SSO)
• If using SAML or OIDC, enter the IdP metadata or discovery URL the platform should consume (format: https://... ). Enter NONE if IdP type is None.
• Provide the technical contact email for the IdP administrator who will approve the service-provider configuration (format: name@domain)
• Select how the integration secret (SP private key / client secret) will be exchanged at kickoff (we will not accept the secret in this sheet) Options: Your secrets manager (recommended), Secure deployment portal, Secure email to designated owner, Other — we will coordinate
• Enter the name of the credential owner who controls the IdP secret (person or team name; e.g., 'IT Identity Team')

CORE INTEGRATIONS — AUTH METHODS (MES / ERP / LIMS)

• Select the authentication method you will use for MES integrations (choose a single value) Options: OAuth2 client-id (secret exchanged later), API key name (secret exchanged later), Service account username (secret exchanged later), Mutual TLS certificate name (certificate exchanged later), None — no MES integration
• Enter the non-secret identifier for the MES credential chosen above (client-id, API key name, service account username, or certificate name). Enter NONE if no MES integration.
• Select the authentication method you will use for ERP integrations (choose a single value) Options: OAuth2 client-id (secret exchanged later), API key name (secret exchanged later), Service account username (secret exchanged later), Mutual TLS certificate name (certificate exchanged later), None — no ERP integration
• Enter the non-secret identifier for the ERP credential chosen above (client-id, API key name, service account username, or certificate name). Enter NONE if no ERP integration.
• Select the authentication method you will use for LIMS integrations (choose a single value) Options: OAuth2 client-id (secret exchanged later), API key name (secret exchanged later), Service account username (secret exchanged later), Mutual TLS certificate name (certificate exchanged later), None — no LIMS integration
• Enter the non-secret identifier for the LIMS credential chosen above (client-id, API key name, service account username, or certificate name). Enter NONE if no LIMS integration.
• For any integration secret above, confirm the secrets manager or channel name where the secret will be stored or handed off (e.g., 'your secrets manager', 'deployment portal')

INTEGRATION ENDPOINTS — TYPE & HOST

• Select MES endpoint type (the deployment uses this to choose connector logic) Options: REST API (HTTPS URL), SFTP host (hostname or IP), JDBC/ODBC database (JDBC URL), None — not connecting to MES
• If MES endpoint type is REST API, enter the MES API base URL (format: https://host.example.com/api). If not applicable enter NONE.
• Select ERP endpoint type (the deployment uses this to choose connector logic) Options: REST API (HTTPS URL), SFTP host (hostname or IP), JDBC/ODBC database (JDBC URL), None — not connecting to ERP
• If ERP endpoint type is REST API, enter the ERP API base URL (format: https://host.example.com/api). If not applicable enter NONE.
• Select LIMS endpoint type (the deployment uses this to choose connector logic) Options: REST API (HTTPS URL), SFTP host (hostname or IP), JDBC/ODBC database (JDBC URL), None — not connecting to LIMS
• If LIMS endpoint type is REST API, enter the LIMS API base URL (format: https://host.example.com/api). If not applicable enter NONE.

FIELD MAPPINGS & MIGRATION FILES

• Enter the file path or URL for the Document Control migration CSV that contains field mappings (format: /path/filename.csv or https://...). If no migration, enter NONE.
• Enter the file path or URL for the CAPA migration CSV that contains field mappings (format: /path/filename.csv or https://...). If no migration, enter NONE.
• Enter the file path or URL for the Training records migration CSV that contains field mappings (format: /path/filename.csv or https://...). If no migration, enter NONE.
• Specify the date format used in all migration files (Default: YYYY-MM-DD) Options: YYYY-MM-DD (default), MM/DD/YYYY, DD/MM/YYYY, Epoch seconds
• Primary key to use for migrated records (choose one — this value will be set in the migration mapping) Options: Source record ID (default), External system ID, Custom field — specify in mapping file

FEATURES, WORKFLOWS & COMPLIANCE SETTINGS

• Select which lifecycle modules to enable on go‑live (multi-select) Options: Document Control, Change Control, CAPA, Deviation/Nonconformance, Training Management, Supplier Qualification, Audit Management, Risk Management
• Electronic signature enforcement level for regulated actions (Default: Enforce on approval only) Options: Enforce on approval only (default), Enforce on submit and approval, Enforce on final sign-off only, Disabled (not recommended)
• Select default locale for the tenant (Default: en-US) Options: en-US (default), en-GB, de-DE, fr-FR, es-ES, Other — specify below
• If you selected 'Other' for locale above, enter the locale code you require (format: ll-CC). Enter NONE if not applicable.
• Default retention period for closed records and audit trails in days (Default: 3650 — 10 years)

VALIDATION (IQ / OQ / PQ) — TEST PLAN LOCKS

• Enter the validation owner role or person who will sign IQ deliverables (e.g., 'Quality Systems Lead')
• Enter the validation owner role or person who will sign OQ deliverables (e.g., 'Validation Engineer')
• Number of PQ scenarios to execute and lock into the PQ test plan (Default: 5)
• Enter the file path or URL for the approved PQ scenario list (format: /path/filename.xlsx or https://...). If none yet, enter TBD.
• Acceptance pass threshold for validation tests as a percentage (Default: 100) Options: 100 (default), 99, 95, Other — specify below
• If you selected 'Other' for acceptance threshold, enter the numeric percentage (format: integer between 1 and 100). Enter NONE if not applicable.
• Enter the repository path where validation evidence will be collected (format: https://... or /shared/path). This is the authoritative evidence location.

DATA MIGRATION RUN & RECONCILIATION

• Number of months of historical records to migrate into the system (Numeric — Default: 36)
• Primary owner (person or role) for migration reconciliation (format: 'Name — Role' or team name)
• Allowed reconciliation mismatch tolerance as a percentage of migrated records (Numeric — Default: 0)
• Primary strategy for handling primary key conflicts during migration (choose one) Options: Abort on conflict (default), Skip duplicates and log, Source wins — overwrite target, Target wins — ignore source

OPERATIONAL LIMITS & POLICIES

• Maximum allowed concurrent user sessions per account (Numeric — Default: 5)
• Minimum password length for locally managed accounts (Numeric — Default: 12). If using SSO only, enter 0.
• Audit log retention period in days (Numeric — Default: 3650)
• Select user provisioning method to configure (Default: CSV bulk upload) Options: SCIM (automatic provisioning), CSV bulk upload (default), Manual by admin

CONTACTS, OWNERSHIP & SIGNOFFS

• Enter the primary technical contact for integrations (Name — Role — email)
• Enter the primary quality contact for validation and acceptance (Name — Role — email)
• Enter the owner who will approve final configuration build for go‑live (Name — Role)

FINAL CONFIG LOCK & DEPLOYMENT NOTES

• Are you ready to lock these configuration values for the deployment build? (Once locked, changes require a configuration change request) Options: Yes — lock configuration, No — still collecting values
• If there are any one-line special instructions the deployment build must honor (e.g., 'Disable automated notifications for pilot site'), enter that instruction here. If none, enter NONE.
• Confirm you have not provided any secret values in this sheet and that all secrets will be exchanged via the selected secrets channel (Yes/No) Options: Yes — no secrets provided, No — there are secrets here (do not proceed)

• Receive signed IQ/OQ/PQ completion reports
• Archive validation artifacts in the agreed repository
• Execute and approve final data migration reconciliation
• Create verified production rollback point and test rollback
• Complete full cutover dry run with signed checklist
• Confirm training completion and update training records
• Validate integrations and external endpoints in production configuration
• Verify electronic signature and audit-trail functionality
• Obtain written regulatory/compliance acceptance where required
• Obtain per-site production readiness sign-off
• Hold go/no-go approval meeting and capture production release authorization