Sustainable Compliance is Spelled with 4Cs

Quality Business Leaders must visibly demonstrate responsibility for quality. However, focusing on compliance only is setting the bar very low. In this article I describe the importance of culture, competencies and capacity to get to a more sustainable compliance

Written by

Anders Vinther
4 Cs of Compliance

After almost 30 years in the pharmaceutical industry, I have seen and heard numerous scenarios of companies going through peaks and valleys when it comes to current Good Manufacturing Practice (cGMP) compliance. The story often goes something like this… 

Following years of successfully passed inspections, one of the company’s manufacturing sites “suddenly” receives a bad report card; a list of significant cGMP deficiencies at the end of an inspection requiring major improvements. Management is surprised. The quality system was deemed sufficient by the company, and the overall quality metrics have looked good for all of the manufacturing sites before. What happened this time? And more importantly, how can this be avoided in the future?  

To ensure sustainable cGMP compliance it is not enough to only work on the traditional compliance elements in the regulatory framework.  Today our traditional way of working focuses primarily on compliance metrics that show past performance and do not provide assurance of future compliance. It also can lead to bureaucracy, silos, complacency and consequently, non-compliance. There needs to be a better balance to this framework that also includes elements that build on how we work as individuals and as a team. This foster change and continual improvement and much better chances of staying ahead of the curve and remaining compliant long term. The key is to create the right balance.  The key is the 4 C’s.

In my view, we must focus not only on Compliancebut also on Culture, CompetenciesandCapacity, collectively termed here as ‘the 4Cs’. A common characteristic of each of the Cs is that they are focused broadly across the organization and with a long-term focus– in contrast to simply meeting the metrics of next month or next quarter.  In this article, I will discuss each of the 4 C’s, point out some of the pitfalls of the current system and how the 4 C’s play a critical role in staying compliant.  

cGMP expectations are defined in terms of regulations and guidelines. Batch records must document all relevant manufacturing and testing activities. People must be trained, equipment qualified, processes validated, and so on. Companies are routinely inspected by regulators for compliance to the cGMP rules and guidelines. Internal performance objectives are set on a regular basis. 

Today, compliance is more of an outcome rather than an activity in itself.This outcome shows how the company performed until the latest data point. The latest data point is a staticpoint however and doesn’t give any guarantee of future compliance with the cGMPs.Predicting future compliance performance is generally based on an extrapolation of past performance combined with a set of specific discrete planned actions. It assumes that ‘a system’ is in place to ensure continually improving performance. However, history shows that this alone is not enough to avoid the ‘valleys’ of cGMP compliance over longer periods of time. 


We all know how passionate we are when it comes to our hobbies/interests outside of work. Our passion comes from an angle of wanting to do things rather than having to. Similarly, senior management should do their very best to create a culture where employees volunteer and ‘want to’ rather than ‘have to’ be responsible for Quality; where they are comfortable speaking up about improvement opportunities at all levels in an environment that engages head and heart and where solutions are co-created in the actual workplace. It certainly is possible to create a culture where ‘quality is powered by heart’ – I’ve seen it happen at the scale of thousands across diverse cultures on a global scale.

Culture exists in every company, good or bad. Creating a desired culture of change to achieve sustainable cGMP compliance takes time, leadership commitment, and must be worked on every day at all levels. Because culture is about peoplehowever, it must be addressed very differently than putting a technology or marketing strategy together. I suspect that many senior leaders don’t recognize the difference in the approach needed for such a culture transformation – and therefore are not as successful in achieving it. Yet it is senior management’s responsibility to set the direction of the company; to outline the mission. To achieve this, it requires one to “put everybody in the company to work to accomplish the transformation. The transformation is everybody’s job”, as Deming says.

If done successfully, the company’s mission is on the forefront of every employee’s mind every day – no matter where they work in the organization. Engaging the individual in a common mission that everyone in an organization can get behind and cares about is very powerful in creating a change in culture, which helps immensely in the positive activities that aid in staying compliant.  In short, today, employees work for a mission more than they work for a company. A meaningful job is not only about an employee’s job tasks alone. It is about how the mission of the company relates to each employee’s personal beliefs. However, cGMP’s today don’t cover which type(s) of culture lead to cGMP compliance. It doesn’t cover culture at all. In a GMP environment we need structure, discipline, data, rules, and procedures, but we also need the opposite polarity i.e. flexibility, experimentation, intuition, judgment, and creativity to continually improve and create and adapt to change. Unfortunately, the GMPs are really only focused on the one side of the polarity.

I would like to note here that although a company’s mission is shaped and led by senior management, middle management is absolutely critical to develop and sustain the mission and culture throughout the company. However, often internal conflicts, bureaucracy, complexity, politics, and other ‘distractions’ prevail. The more management feeds these distractions, the more they push their employees away from the mission of the company. In my view, the only way to reduce these distractions is through senior management staying focused on the company’s mission, and middle management consistently incentivizing and demonstrating the desired behaviors within the culture. Considerable time and resources must be spent on educating leaders in how to balance structure and change culture in daily work. This takes me to the next C – Competencies.


To be successful, people need both to be motivated and have the competencies to perform their job. Every employee starts a position with existing competencies and experience and will need to learn additional specifics of their new role. What is essential in this learning journey is how and how often the training is delivered. Benjamin Franklin said “Tell me and I forget. Teach me and I remember. Involve me and I learn” and another of Deming’s 14 Points of Management states, “Institute training on the job”. Simply put, PowerPoint monologues alone are not effective in truly educating and training employees. Volume of learning courses are also not a good yardstick for ensuring that the right competencies in a company are realized. 

We need build on the “what and how” to perform a task and incorporate the “why” to truly develop employees. Pairing PowerPoint decks with modern techniques and methodologies that engage the employees is much more effective. Training materials should not be stagnant, but rather updated continually as new knowledge is gained so that it can be shared and institutionalized.

Like culture, training takes time. Often companies do not allocate enough time for learning activities. Training is often seen as an event rather than a process of lifelong learning. The read & understand model of training is easier to create and execute than an instructor lead learning session or a well-developed eLearning, but clearly not as effective. The read & understand model of training alone falls short primarily because it doesn’t allow for a dialog or a richer understanding of the “why”. It is time for our industry to transform education and spend more time on it. 

One example of how existing systems for learning are falling short today is the writing in our Standard Operating Procedures (SOPs). If you think back to how different the world operated just 40 years ago compared to today it is striking how much things have changed. Most people today wouldn’t open up a manual if they needed to know more about how a piece of equipment works. They would Google it or watch a YouTube video. Yet, generally speaking, the writing in our Standard Operating Procedures (SOPs) has not changed much over the past 40 years since the 21 CFR 211 GMPs were first published.  The lack of ease and support from the current systems may be one reason employees make mistakes. Pictures, diagrams, and flowcharts are often better than lengthy paragraphs of words to describe a process. Moving competency frameworks towards a modern direction should be expected in any company. If done successfully, it will help in each employee’s competency level and thus help in staying compliant.

I’d like to cover the role of top management when it comes to Quality. In my view, their role in Quality is to clarify expectations and explain what Quality is in a language that is well understood by the C-suite – not just once but on a regular basis. If compliance is seen as a necessary evil rather than good business sense that’s the beginning of a ride down the compliance valley. A key question every Quality leader should ask and promote is “How can we use the Pharmaceutical Quality System (PQS) to cut costs, reduce bureaucracy, speed up the delivery of products and reduce risks?”. These are key topics for most of the C-suite, hence important to communicate. As Deming stated in one of his 14 Points of Management, “Improve constantly…quality and productivity, and thus constantly decrease costs”. If the two are reversed the result is the opposite. Focusing only on short term cost reduction leads to lower quality performance.  

Top leaders need to not only demonstrate the importance of Quality in their actions but also articulate that achieving quality performance is not the sole responsibility of the Quality organization alone. It is the responsibility of every employee at every level. Reaching middle management with this message is particularly important; consistently and regularly.  


The next C to cover is Capacity; How we run our manufacturing processes and test methods. Is there a solid lifecycle management program with a good control strategy in place? Are methods and processes continually being improved and are new technologies introduced before old technologies become so old that spare parts are hard to find? Many factors need to be considered and one I want to point out here is the need for a regulatory environment that encourages innovation. Today the regulatory complexity is daunting for any company as globally registered products often need even simple changes/improvements approved individually by more than 100 countries prior to implementation.


I started this article by saying compliance is an outcome rather than an activity in itself. But how can you make compliance activities more proactive? Identifying potential risks for failure and non-compliance is time well spent because you can then mitigate the risk before it might actually happen. Having a risk register that is updated on a regular basis and completing preventive actions is a very good way of making cGMP compliance more sustainable. Having a solid approach to knowledge management is another way to improve cGMP compliance over time. And overall, the PQS must be demonstrated to be effective in ensuring cGMP compliance. The 4 C’s all tie in here to ensure that a company remains complaint long term.


For companies to avoid the valleys of inadequate cGMP compliance requires a change, expanded focus and a new way of management in the pharmaceutical industry. Today our traditional way of working focuses primarily on compliance metrics that show past performance, which doesn’t give any guarantee of future compliance.

In a GMP environment we need structure, discipline, data, rules, and procedures, but we also need the opposite polarity i.e. flexibility, experimentation, intuition, judgment, and creativity to continually improve, create and adapt to change. Unfortunately, the GMPs are really only focused on one side of the polarity – the side that reduces people to a ‘unit’, that must only follow the rules. In this article I have described a path that can drastically enhance the likelihood of long-term sustainable cGMP compliance. It requires a focus on the 4Cs- Compliance, Culture, Competencies, and Capacity. A common characteristic of each of the Cs is that they are focused broadly across the organization with a long-term objective– in contrast to simply meeting the metrics of next month or next quarter. 

Long term cGMP compliance should be the focus for both industry and regulators. For industry leaders it requires investing time in all 4Cs to balance a framework of traditional compliance systems and elements that build on how we work as individuals and as a team. For regulators it requires a shift of inspections from assessing past performance only to also assessing the company’s approach for ensuring sustained cGMP compliance. 

Anders Vinther

Executive Quality Business Leader

Similar articles you might also like

Website Design & DevelopmentAmy Greene-Dittz
Infographic and logo Lemonly