Turn revised Schedule M into a scoped digital gap assessment

A software purchase is not a gap assessment

A site wants to improve its position against revised Schedule M. A supplier presents a “compliant” system, and the project discussion moves directly to modules and licences. Nobody has yet established which site processes lack evidence, which controls already work or which problems software could actually resolve.

A useful assessment starts from the site's applicable requirements and operating reality. It should produce a traceable register of confirmed gaps, owners, actions and verification evidence. Software may support some actions, but it cannot by itself establish suitable facilities, competent personnel or an effective quality culture.

For Indian drug manufacturers, the starting instrument is the revised Schedule M notification, G.S.R. 922(E) of 28 December 2023, read with relevant subsequent instruments. The CDSCO register also contains a 2024 corrigendum and later timeline-related notifications. Do not infer the site's current legal position from an old implementation-date summary. Revised Schedule M notification, CDSCO Gazette register.

Establish the assessment boundary first

Record the legal entity, site, licensed activities, product categories and relevant manufacturing operations. Identify which parts of the requirements apply to that scope and who has reviewed the interpretation. A multi-site group may share software while operating under different licences, products and local arrangements.

Keep a controlled source register containing the instrument, date, status, relevant provision and applicability decision. Distinguish a final notification, corrigendum, circular and draft proposal. An item appearing in a notification list does not establish that every proposed change is operative.

For example, the 25 October 2024 corrigendum makes specific corrections to the 2023 notification. Its existence is a reason to control the source set rather than work from a detached copy labelled “latest”. G.S.R. 666(E) corrigendum.

Resolve site-specific applicability with the responsible regulatory and quality specialists. The assessment can proceed with a clearly identified interpretation question, but that question should not be silently converted into either compliance or non-compliance. Record the owner and evidence needed to settle it.

Map requirements to processes people perform

Translate each relevant provision into the operating activity it affects. For a computerised-system requirement, identify the actual GMP-related system and its use. For a training requirement, identify the roles, activities and evidence. For a facility requirement, identify the physical area and control being assessed.

The revised text includes validation of GMP-related computerised systems, with scope and depth related to the application's characteristics. That is a requirement to assess the actual use and evidence, not a declaration that a purchased product is validated everywhere it is installed. Schedule M, computerised systems section.

Avoid one assessment row covering an entire department. “QC compliant” is too broad to support an action. Use a level at which the team can identify a specific control, inspect its evidence and agree a closure criterion without fragmenting every sentence into an administrative task.

Check the process where it happens

Walk through a representative activity with its operators and reviewers. Compare the approved procedure, the records produced and the work actually performed. Ask how the team handles missing information, unavailable equipment or an unexpected result. These exceptions often reveal dependencies that a desk review misses.

Use a defined sampling rationale for the evidence inspected. Looking at one convenient record cannot establish the condition of every shift, product or system. Record the assessment's coverage and important limits, then expand the review when an observed issue suggests a wider population may be affected. This gives leadership a realistic basis for prioritising further work.

Build a requirement-to-evidence register

The register should preserve the source interpretation, observed state and resulting decision. It is the working backbone of the assessment, not a substitute for the underlying records. Link evidence to its authoritative location and version.

Use separate states for evidence not yet inspected, an interpretation question, a confirmed gap and a verified closure. A blank attachment field should not automatically mean the control does not exist. Equally, an uploaded procedure does not establish that people follow it in practice.

Worked example of a computerised workflow gap

Consider an illustrative site where a warehouse application displays material status received from a quality system. The application has a vendor test pack, but the site's assessment cannot find evidence covering its configured interface, stale messages or local role permissions.

The gap is not simply “buy a validated warehouse system”. The observed issue is missing or inadequate evidence for the site's intended workflow and controls. The action plan includes defining intended use, assessing the existing evidence, identifying necessary tests and resolving any design weaknesses found.

The register links the requirement to the actual systems, interface version, process owner and relevant records. It identifies the validation lead for the evidence strategy, IT for technical configuration and quality for the applicable approval. Procurement may support supplier documentation, but closing the purchase order does not close the gap.

Suppose testing shows that a disconnected interface leaves an old released status visible without warning. The team now has a specific design issue as well as an evidence issue. The remediation must address stale-data behaviour, verify the changed workflow and update the relevant operating instructions.

Closure evidence includes the approved assessment, implemented control, test results, resolved deviations and required operational readiness. A screenshot of a new status label alone is insufficient. The verifier checks that the evidence addresses the original gap and the tested failure, rather than merely confirming that the project delivered a screen.

Distinguish digital and operating remediation

Some gaps concern missing information or weak coordination and are good candidates for software support. Examples include broken links between training and document versions, unreconciled sample status or difficulty retrieving approved records. Even then, ownership and procedures must be defined.

Other gaps concern physical facilities, equipment suitability, scientific knowledge or staffing. A digital tracker can make the work visible but cannot perform the remediation. Mark the primary action type so leadership does not mistake an implementation dashboard for a completed improvement.

This distinction helps select an appropriate pharma QMS. Evaluate the system against confirmed workflow needs instead of using the supplier's module list as the assessment framework.

Prioritise with dependencies and consequences

Use the site's approved risk and remediation approach to rank confirmed gaps. Consider product and process impact, the reliability of existing controls, exposure and the dependencies required to resolve the issue. Do not use a generic numerical score as a substitute for specialist judgement.

Some actions must precede others. A system cannot be verified against an intended use that has not been defined. Training cannot establish readiness for instructions that are still changing. A qualification milestone may depend on utilities and equipment evidence. The validation master-plan guide shows how to organise those dependencies.

Where an interim control is proposed, record its scope, authority, monitoring and end condition. It should address the actual risk while the permanent action is completed. A temporary measure that is repeatedly extended without review can become an unexamined operating model.

Compare implementation options against the same gap

For a confirmed digital need, compare process improvement within existing tools, configuration of an established platform, a focused integration and a new application. Use the same acceptance evidence for each option. This prevents the evaluation changing to favour whichever proposal has the most attractive presentation.

Include operating cost and responsibilities. Who maintains mappings, reviews access, assesses releases, supports outages and retrieves records after retirement? A low licence price can conceal a large internal support burden, while a larger platform may add complexity that the site cannot sustain.

Prepare the automation business case around measured effort and a bounded improvement. Keep compliance obligations and discretionary efficiency benefits distinguishable; do not justify an essential control solely through a speculative payback calculation.

Verify closure independently of delivery

Define closure criteria before implementation. The verifier should inspect evidence against the original gap and any issues discovered during remediation. Completing tasks is necessary but may not establish that the control operates effectively.

Use representative operating cases and relevant failure paths. For a record-retrieval gap, retrieve historical evidence with an authorised user. For an interface gap, test stale and conflicting messages. For a training gap, apply the site's appropriate assessment of readiness for the activity.

Preserve the original observation, remediation history and closure decision. If later evidence shows the gap persists, reopen or reassess it through the established process. The register should make that learning visible rather than protecting a previously green status.

Keep the assessment current without restarting it

Assign ownership for changes in applicable instruments, site activities, products and systems. When a relevant change occurs, identify affected assessment rows and review their applicability and evidence. This is more manageable than recreating a large checklist for every audit.

Record the review date and scope of each update. A source register checked for one topic should not be described as a complete legal review of every site obligation. Likewise, a digital workstream can be complete while facility or scientific remediation remains open.

NextEdge Labs can support the process mapping, evidence register and bounded digital implementation. The useful deliverable is a reviewable chain from confirmed requirement to operating control and verified evidence, with remaining responsibilities visible to site leadership.

Summary and next actions

A Schedule M digital gap assessment should establish what applies, inspect how the site actually operates and connect each confirmed gap to verifiable remediation. Technology supports that chain; it does not replace the quality and operating decisions within it.

• Confirm the site scope and controlled set of applicable instruments with regulatory and quality owners.
• Map one priority process from relevant provisions to existing controls and inspected evidence.
• Separate software, procedural, competence and physical remediation, including their dependencies.
• Approve closure criteria before delivery and verify the resulting control with representative operating cases.