FDA Has a Quality Rating System Coming. Most Companies Aren't Ready to Be Scored.

There's a program running quietly inside FDA's Center for Drug Evaluation and Research that deserves far more attention from quality leadership than it currently gets, in part because it's voluntary and easy to file under "not urgent." That would be a mistake. The Quality Management Maturity (QMM) Program is FDA's attempt to build a standardized, objective way to measure how mature a drug manufacturer's quality system actually is — not just whether it meets minimum CGMP requirements, but whether it demonstrates the kind of proactive, resilient quality culture that predicts fewer failures and better performance under stress. On February 11, 2026, FDA opened participation for the third year of its voluntary QMM Prototype Assessment Protocol Evaluation Program, with room for up to nine drug manufacturing establishments and a participation deadline of April 13. The program itself has been building toward this moment since 2020.

What QMM actually measures, and why it's different from a standard audit

A conventional FDA inspection asks whether a facility meets CGMP requirements — the regulatory floor. QMM asks a different question entirely: how far above that floor does the facility's quality management actually operate, and can that be measured in a standardized, comparable way across different manufacturers. The evaluation protocol covers five practice areas: management commitment, business continuity, technical excellence, advanced quality systems, and employee engagement. That list is worth sitting with, because it includes categories — business continuity, employee engagement — that a traditional CGMP inspection has no real mechanism to assess at all. CGMP compliance tells you whether a facility is currently following its procedures correctly. It tells you very little about whether that facility would keep performing if a key supplier failed, a critical piece of equipment went down unexpectedly, or a substantial share of trained staff left within a short window — which is precisely the kind of resilience question that determines whether a facility contributes to a drug shortage or absorbs a disruption without one.

The program didn't arrive out of nowhere. FDA ran two initial pilot programs between 2020 and 2022 — one evaluating seven domestic finished-dosage-form manufacturers, another evaluating eight foreign API manufacturers — using third-party contractors to conduct assessments alongside FDA staff. Those pilots fed into a refined prototype protocol and scoring rubric, which CDER has now run for a third consecutive year. The trajectory is clear even though FDA has been deliberately cautious about the pace: this program is steadily moving from experimental pilot toward something closer to a formal, standing rating system, even though CDER hasn't committed to a specific timeline for that transition or announced exactly what a mature version of the program will require or offer.

What's actually in it for a manufacturer, and what's genuinely at risk

The upside case for participation is concrete. FDA and industry analysts have both floated the idea that high QMM scores could eventually influence procurement decisions — a mature, well-scored quality system becoming a genuine commercial differentiator when health systems, group purchasing organizations, or government stockpile programs are choosing among suppliers, particularly for critical or shortage-prone drug categories. There's also a case that participating early gives a manufacturer direct, structured feedback on quality management gaps from FDA-aligned assessors, which is a different and arguably more useful kind of information than what a standard inspection typically surfaces, since inspections are built to find CGMP violations rather than to benchmark quality maturity against a broader standard.

The risk side is real too, and it's specific: participation is voluntary, but the assessment results are not automatically shielded from disclosure. A negative or middling QMM assessment obtained voluntarily could, in principle, become discoverable under the Freedom of Information Act, which creates a genuine strategic tension for any executive team considering participation. A facility that's confident in its quality maturity has real upside from participating and demonstrating that strength in a standardized, FDA-recognized format. A facility that suspects its quality system would score in the middle of the pack, or worse, has to weigh the value of early, structured feedback against the risk of that assessment eventually becoming visible to competitors, customers, or the public in a way a standard, more narrowly-scoped inspection report typically doesn't invite scrutiny of.

The part that connects to inspection risk directly

QMM isn't happening in isolation from FDA's broader inspection modernization either. The same week industry was digesting the QMM Program's third-year announcement, FDA was also finalizing a new Pre-License Inspection compliance program (published April 14) and, in late June, a revised Pre-Approval Inspection compliance program — both explicitly framed around risk-based inspection approaches rather than the older, more uniform models. The connective tissue across all of these initiatives is the same underlying philosophy: FDA is trying to move away from a binary pass/fail compliance model and toward something that differentiates between facilities based on demonstrated quality maturity, with that differentiation increasingly shaping how much scrutiny, and what kind, a given facility receives. A facility that scores well on a QMM-style maturity assessment, formally or informally, is a facility FDA has more institutional reason to trust with a lighter-touch, risk-based inspection posture. A facility that doesn't have a story to tell about its quality maturity beyond "we pass our CGMP inspections" is, by definition, not distinguishing itself in an inspection environment that's increasingly built to reward that distinction.

This matters for supply chain resilience in a very direct, practical way too. FDA's own stated rationale for QMM ties explicitly back to drug shortages: mature quality systems promote proactive detection of vulnerabilities, prevent problems before they occur, and foster a culture that rewards process and system improvements — all of which reduces the odds that a given facility becomes the point of failure behind the next major shortage. For any manufacturer whose customers, whether hospital systems, group purchasers, or government programs, are increasingly asking supply-chain resilience questions as part of procurement decisions, having an internal answer to "how mature is our quality system, in a way that's benchmarked against something more rigorous than our own internal audit" is becoming a genuinely commercial question, not just a regulatory one.

The assessment process itself is more involved than a typical audit, which is part of why it functions as genuinely different information rather than a repackaged inspection. FDA's protocol documentation describes multiple assessment phases, including facility interviews and site visits conducted by evaluators trained specifically on the QMM rubric — a deeper engagement model than the checklist-driven walkthrough a standard CGMP inspection typically follows, and one closer to how a maturity-model assessment works in other industries that have adopted similar frameworks for operational resilience. FDA has also published an economic-perspective white paper through CDER's Office of Pharmaceutical Quality specifically making the business case that strategic investment in quality management maturity yields returns for both companies and public health — a signal that the agency sees this as more than a compliance exercise and is actively trying to build the case for voluntary adoption on commercial grounds, not just regulatory ones.

Turning this into practice

A few concrete steps make the QMM framework useful even without formal participation this year:

• Pull the publicly available QMM Practice Areas and Prototype Assessment Protocol from FDA's website and run an honest internal gap assessment against all five categories, not just the ones that overlap with existing CGMP audit criteria.

• Specifically stress-test business continuity planning with a real scenario: what would actually happen, in concrete operational terms, if your single most critical supplier had a facility shutdown next month? Most quality teams can answer this in the abstract and struggle considerably once asked for specifics.

• Loop procurement and commercial teams into this conversation, not just quality — if customers are starting to ask supply-chain resilience questions as part of vendor selection, quality maturity is becoming a commercial answer as well as a regulatory one.

• Watch how CDER develops the program over the next year or two rather than assuming it stays permanently voluntary and low-stakes; three consecutive prototype years with a consistent five-category framework looks like an agency building toward something durable, not testing something it plans to abandon.

  
  

What to actually do with this if you're not one of the nine

Most manufacturers reading this won't be one of the nine establishments selected for this year's formal QMM prototype program, and the April 13 deadline to apply has already passed for CY2026 regardless. That doesn't make the program irrelevant to you. The published QMM Practice Areas and Prototype Assessment Protocol — publicly available from FDA — function as a genuinely useful internal benchmarking tool even for organizations that never formally participate. Running an honest internal self-assessment against the five practice areas (management commitment, business continuity, technical excellence, advanced quality systems, employee engagement) surfaces gaps that a standard internal CGMP audit, built to check compliance rather than measure maturity, typically misses entirely. Business continuity planning in particular is worth an honest look: most quality organizations can describe their CAPA process in detail and struggle considerably more to describe, in specific and tested terms, what actually happens if a critical supplier, a key piece of equipment, or a substantial share of trained staff becomes unavailable without warning.

The broader signal worth carrying forward, even for companies with zero plans to ever formally participate in QMM, is that FDA is visibly building the infrastructure to differentiate between facilities based on quality maturity rather than treating "passes CGMP inspection" as a single, undifferentiated category. Whether that differentiation eventually shows up as a public rating, a procurement input, an inspection-frequency input, or some combination FDA hasn't specified yet, the underlying trend is consistent with everything else the agency has done this year across both device and drug inspection modernization: checklist compliance is becoming necessary but insufficient, and demonstrated quality maturity is becoming the thing that actually differentiates a facility in FDA's eyes.

Sources: U.S. Food and Drug Administration, CDER Quality Management Maturity Program; Federal Register, Voluntary Quality Management Maturity Prototype Assessment Protocol Evaluation Program, February 11, 2026; Arnold & Porter; PharmExec; AAPS Journal, Lessons from CDER's Quality Management Maturity Pilot Programs.