Custom QMS Software in 2026: Build vs Buy, Architecture

Quality management system software runs the processes ISO 9001, ISO 13485, IATF 16949 or GxP require: controlled documents, training, nonconformities, CAPA, audits, supplier quality and change control, with an audit trail behind every record. Commercial eQMS platforms (MasterControl, Qualio, Greenlight Guru, ETQ, Intellect) are the right default for most small and mid-sized regulated companies. A custom QMS pays off when quality work is inseparable from ERP, MES or LIMS data, when licensing scales badly with headcount, or when data residency rules exclude the vendor cloud.

What a quality management system software actually manages

The standards differ, but the operational core is the same across industries. Any QMS platform, bought or built, needs these modules:

• Document control. Policies, procedures (SOPs), work instructions, forms and specifications with a controlled lifecycle: draft, review, approval, effective, obsolete. Every version is kept; only the effective version is visible on the shop floor.
• Training records. Who has been trained on which version of which document, with evidence (read-and-understood, classroom, assessment). A new SOP version triggers retraining for affected roles.
• Nonconformities (NC). Deviations in product, process or service: description, containment, disposition (rework, scrap, use-as-is, return to supplier), and the link to a CAPA when the issue repeats or is severe.
• CAPA. Corrective and preventive actions with root cause analysis, action plan, owner, due date, verification of effectiveness and closure. Regulators read CAPA records first during an inspection.
• Audits. Internal audits, supplier audits and third-party audits: plan, checklist, findings, and findings that flow into NC or CAPA.
• Supplier quality. Approved supplier list, qualification status, scorecards, supplier corrective action requests (SCAR), incoming inspection results.
• Change control. Formal evaluation of changes to products, processes, equipment or software: impact assessment, approvals, implementation plan, verification. In pharma and medical devices this is the module regulators scrutinize most after CAPA.
• Management review. Periodic review of quality objectives, KPIs, audit results, customer feedback and CAPA status, with minutes and actions as records.
• Complaints and risk. Complaint handling with reportability assessment, and risk registers (ISO 14971, FMEA) tied to products or processes.

Industry-specific additions sit on top: device history records and UDI data under ISO 13485 and the FDA QMSR, PPAP and APQP artifacts under IATF 16949, batch records and deviations under GxP.

Custom QMS vs commercial eQMS platforms: comparison table

MasterControl and ETQ serve large life-sciences and manufacturing organizations. Qualio and Greenlight Guru target medical device and pharma companies from startup to mid-market. Intellect positions itself as a configurable, low-code QMS. All ship pre-validated modules. The question is not whether they work; it is whether they fit.

Criterion	Commercial eQMS (MasterControl, Qualio, Greenlight Guru, ETQ, Intellect)	Custom QMS
Regulatory validation	Vendor provides validation packages and IQ/OQ evidence; you still own PQ and intended-use validation	You own the full validation lifecycle (URS, risk assessment, IQ/OQ/PQ, traceability); reusable if built into the delivery process
Time to first use	Weeks to a few months, depending on data migration	Months for a validated first release
Customization	Configuration within the vendor's workflow model; deep changes require professional services or are not possible	Any workflow, data model or UI; the cost is discipline in change control
Cost model	Per-user or per-module subscription, plus implementation and validation services; grows with headcount and modules	Upfront engineering, then hosting and maintenance; flat with respect to users
Integration with ERP/MES/LIMS	Standard connectors for major ERPs; MES and LIMS integrations vary and are often custom projects anyway	Native integration designed around your data (batch, lot, work order, equipment IDs)
Data residency and hosting	Vendor cloud, usually with EU regions; on-premise options exist mainly at the enterprise tier	Any hosting: EU cloud, private cloud, on-premise, air-gapped
Audit trail and e-signatures	Built in and Part 11 ready	Must be designed and tested explicitly (see architecture below)
Vendor risk	Roadmap, pricing and sunset decisions are outside your control	You own the lifecycle; you also own the on-call rota
Fit for non-standard processes	Weak when the plant or lab works differently from the template	Strong; the system is the process

Rule of thumb: if your quality processes fit on one page and none depends on live data from another system, buy. If half of your NC and CAPA records need lot, equipment or work-order context from ERP or MES, evaluate a custom build. The same trade-offs appear when weighing a custom ERP against a packaged one; the QMS decision usually follows the ERP decision.

Reference architecture for a custom QMS

Four subsystems carry the regulatory weight.

Document control with versioning and electronic signatures

Document control is a document management system with a strict lifecycle. Design drivers:

• Immutable versions. A version, once approved, is never modified; a change creates a new version through the change workflow.
• Controlled distribution. Only the effective version is served to readers; obsolete versions remain retrievable for audits.
• Electronic signatures compliant with 21 CFR Part 11 and EU Annex 11: the signature captures the signer's identity, timestamp, and meaning (authored, reviewed, approved), is bound to the exact content signed, and requires re-authentication at signing time.
• Rendered PDF of the signed version stored alongside the source, with a hash to prove integrity.

A minimal signature record looks like this:

CREATE TABLE e_signature (
  id            uuid PRIMARY KEY,
  record_type   text NOT NULL,          -- 'document_version', 'capa', 'change_request'
  record_id     uuid NOT NULL,
  content_hash  bytea NOT NULL,         -- SHA-256 of the signed payload
  signer_id     uuid NOT NULL,
  signer_name   text NOT NULL,          -- captured at signing time, not joined later
  meaning       text NOT NULL,          -- 'approved', 'reviewed', 'authored'
  signed_at     timestamptz NOT NULL DEFAULT now(),
  auth_method   text NOT NULL           -- 'password+otp', 'sso+reauth'
);

The signer's name is stored, not joined from the user table, because user records change and the signature must not.

Workflow engine

NC, CAPA, change control, audits and supplier actions are all state machines with approvals, due dates, escalations and conditional routing. Do not hand-code each one: use a durable workflow library (Temporal) or a BPMN engine (Camunda) when quality managers need to edit process definitions themselves. The workflow definition is itself a controlled document: changing the CAPA process is a change control event, and the workflow version a record followed must be retrievable.

Audit trail

Every create, update, state transition and signature on a quality record is logged with who, what, when, old value, new value and reason. The trail must be:

• Generated by the system, not by the user.
• Append-only: application roles can insert and nothing else.
• Time-stamped from a trusted clock, in UTC.
• Reviewable per record; auditors will ask for the trail of a specific CAPA.

Postgres triggers writing to an append-only table are enough for most builds. If the risk assessment calls for tamper evidence, add a hash chain.

Reporting and management review

Management review needs trend views: open CAPAs by age, NC by product line, training compliance by department, supplier scorecards, audit findings by clause. Build these on a read model so reporting never touches transactional performance. The patterns from dashboard development for business data apply; the difference in a QMS is that every number must be traceable to the records that produced it.

Cross-cutting concerns

• Role-based access with segregation of duties: the author of a document cannot approve it; the owner of a CAPA cannot verify its effectiveness.
• Retention for the legal period; deletion is a controlled exception. Training records and signatures are personal data, so GDPR obligations must be reconciled with quality retention rules.

Validation of a custom QMS: CSV and CSA

In pharma, biotech and medical devices, a computerized system that maintains quality records must be validated. This is where custom builds were historically expensive, and where the approach has changed.

Classic CSV (Computer System Validation) follows GAMP 5: a User Requirements Specification, functional and design specifications, IQ, OQ and PQ, plus a traceability matrix from every requirement to every test. Custom software falls into the highest GAMP category, which meant the most paperwork.

CSA (Computer Software Assurance), the FDA's current guidance for production and quality system software, shifts effort to risk: features that affect product quality or patient safety get scripted testing with documented evidence; lower-risk features get exploratory testing with lighter records. GAMP 5 second edition moved the same way and explicitly accepts agile delivery and automated testing as validation evidence.

What this means for a custom build in practice:

• Automated tests are validation evidence if they are traceable to requirements and their execution is recorded. A CI run that stores test results, the commit hash, and the environment description is an OQ artifact. Good CI/CD practices are therefore part of the validation strategy, not separate from it.
• Requirements need IDs from day one. Each user story that touches a quality record carries a requirement ID and a risk class; tests reference the ID. The traceability matrix is generated, not written.
• The pipeline itself is qualified. Build reproducibility, environment definitions as code, and controlled promotion between environments replace much of the classic IQ paperwork.
• Every release is a change control event. Release notes, the risk assessment of the changes and the regression evidence form the validation record for that version.
• Vendor components are assessed, not validated by you. The database, workflow engine and cloud platform go through supplier evaluation; your validation covers how you use them.

Put validation deliverables in the backlog with the same priority as features. A team that treats validation as a final phase doubles the schedule.

Integrations: ERP, MES, LIMS and identity

• ERP (SAP, Dynamics, Odoo, custom): master data for suppliers, materials, products and customers; purchase orders for supplier quality; nonconformities that block or release stock. The QMS should consume ERP master data, never duplicate it.
• MES: work orders, equipment, batch and lot genealogy. A shop-floor NC created in the MES context carries the equipment ID and the lot automatically. Deviations may originate in the MES and be managed in the QMS.
• LIMS: out-of-specification (OOS) results open investigations in the QMS; approved specifications flow from document control to the LIMS.
• Identity: SSO through the corporate IdP (Entra ID, Okta, Keycloak) with re-authentication for signatures; Part 11 requires unique identities and no shared accounts.
• LMS: completions become training records; document releases push training assignments.

Prefer events for state changes (a CAPA closed, a document made effective) and synchronous lookups for master data. Every integration message that changes a quality record must produce an audit-trail entry naming the source system.

Requirements checklist before you start

Use this list to decide whether to build and to scope the first release.

Regulatory scope

• Which standards apply: ISO 9001, ISO 13485 / FDA QMSR, IATF 16949, GxP with Part 11 and Annex 11
• Retention periods per record type

Process scope

• Modules in phase one, and which existing tools they replace (spreadsheets, shared drives, an old eQMS)
• Process owners for each module, with authority to approve the workflow definition
• Number of users by role, including read-only shop-floor and lab users

Data and integration

• Systems of record for suppliers, materials, products, equipment and users
• Which integrations are mandatory for phase one versus later
• Data migration: which historical records move, searchable or archive-only

Hosting and security

• Data residency constraints (EU only, on-premise, air-gapped)
• Backup and restore tested as part of validation; a QMS rarely needs five nines but must never lose a record

Validation

• Risk classification approach (CSA or classic CSV) agreed with the quality lead
• Who writes and approves the URS and the validation plan

Decision: buy, build, or hybrid

• Buy when processes are standard, the user count is modest, integrations are limited to ERP master data, and the vendor cloud meets your residency needs.
• Build when integration depth, user count, residency or process fit cannot be met by a vendor, and you have or can hire a team able to maintain a validated system.
• Hybrid when a commercial eQMS handles document control and training but shop-floor NC and deviations need a custom, MES-integrated layer; many manufacturers land here.

Phased delivery plan for a custom QMS

A first validated release in a few months is realistic if scope is disciplined.

Phase 0 — Discovery and validation planning (weeks). Confirm regulatory scope, write the URS with requirement IDs and risk classes, agree the CSA approach with quality, define the audit-trail and e-signature design, choose hosting. Output: URS, validation plan, architecture decision records.

Phase 1 — Document control, training and users. Document lifecycle, versioning, e-signatures, training assignments, SSO, audit trail, training-compliance reporting. This replaces the shared drive and the training spreadsheet. Output: validated release 1.0 with IQ/OQ evidence from the pipeline and PQ from user acceptance testing.

Phase 2 — Nonconformities and CAPA. NC capture (including from MES or LIMS if integrated), disposition, CAPA workflow with root cause, effectiveness verification, links to documents and training. Output: release 2.0 and the management-review dashboard for NC and CAPA trends.

Phase 3 — Change control, audits and supplier quality. Change requests with impact assessment, internal and supplier audits with findings feeding NC and CAPA, approved supplier list and scorecards integrated with ERP purchasing.

Phase 4 — Industry extensions. Complaints and vigilance (medical devices), PPAP and APQP (automotive), deviations and batch-record links (GxP), risk registers.

Each phase ends with a change-controlled release and its validation record. Keep any parallel run with the old tools short; two systems of record for the same process is a nonconformity waiting to happen.

Recommendation

Buy a commercial eQMS if your quality processes are standard, your user base is small, and your integration needs stop at ERP master data; Qualio or Greenlight Guru for regulated startups, MasterControl or ETQ for larger organizations, Intellect if configurability is the priority. Build a custom QMS when integration with ERP, MES or LIMS defines how quality work happens, when per-user licensing for shop-floor and lab users is out of proportion, or when data residency rules out vendor hosting. If you build, design document control, the workflow engine and the audit trail first, treat automated tests and the pipeline as validation evidence under CSA, and deliver in phases starting with document control and training. At Arvucore we usually recommend a hybrid for manufacturers: a commercial platform for documents and training, and a custom, MES-integrated layer for nonconformities and deviations, unless the integration surface is large enough that owning the whole system is cheaper over five years.