What FDA’s First QMM Scorecard Tells Us
Nine drug manufacturers. All inspection-cleared. Quality maturity scores from 2.4 to 4.6.
In April, FDA’s Center for Drug Evaluation and Research (CDER) shared the first public scorecard from its Quality Management Maturity (QMM) Prototype Assessment Program. The data is worth a careful look. It is also, I think, more revealing than most early commentary has acknowledged.
This post does two things. First, it walks through what the data actually shows, in plain language. Second, it draws the three conclusions that I think follow from it. I attended the FDA Generic Drug Forum where the scorecard was presented and have spent the weeks since thinking about what it means.
Quick background: what is QMM?
The QMM Program is FDA’s voluntary effort to assess how mature a drug manufacturer’s quality system actually is — not whether it meets cGMP requirements, but how well it functions, learns, and improves over time. QMM is not enforcement. It does not replace inspection. It cannot find a site out of compliance. It scores establishments across five practice areas: Management Commitment to Quality, Business Continuity, Advanced Pharmaceutical Quality System, Technical Excellence, and Employee Engagement and Empowerment.
Nine drug manufacturing establishments volunteered for the first cohort, assessed between June and December 2024. Every site had recently been inspected by FDA and had cleared cGMP requirements. They were not problem sites — they were sites confident enough in their own quality to invite CDER to score them.
What the scorecard shows
Each establishment received a score from 1 to 5 in each of the five practice areas. The site-by-site results presented at the Generic Drug Forum are reproduced in the table below. Site labels (A through I) follow CDER’s anonymized presentation. Averages are computed across the five practice areas.
| Site | Management commitment | Business continuity | Advanced PQS | Technical excellence | Employee engagement | Average |
| A | 2.8 | 2.7 | 2.6 | 2.7 | 3.4 | 2.84 |
| B | 4.8 | 4.3 | 4.2 | 3.6 | 4.9 | 4.36 |
| C | 4.2 | 4.4 | 3.6 | 3.6 | 4.5 | 4.06 |
| D | 4.0 | 3.8 | 3.7 | 4.3 | 4.1 | 3.98 |
| E | 4.6 | 4.5 | 4.7 | 4.4 | 4.9 | 4.62 |
| F | 4.5 | 4.4 | 4.4 | 4.3 | 4.7 | 4.46 |
| G | 2.2 | 2.5 | 2.2 | 2.7 | 2.4 | 2.40 |
| H | 3.7 | 3.8 | 3.5 | 3.7 | 4.0 | 3.74 |
| I | 3.8 | 3.8 | 3.6 | 3.4 | 3.8 | 3.68 |
Site E (highlighted in green) is the highest scorer; Site G (highlighted in red) is the lowest. Average is across all five practice areas, rounded to two decimals.
If you order the nine site averages from lowest to highest, the spread is wide: 2.40, 2.84, 3.68, 3.74, 3.98, 4.06, 4.36, 4.46, 4.62. Two sites cluster below 3. Five sites cluster between 3.5 and 4.1. Two sites cluster above 4.4. The cohort’s range — 2.40 at the bottom, 4.62 at the top — is more than two full points on a five-point scale.
Within individual sites, the picture is also worth looking at. CDER published not just the practice-area scores but the sub-element scores under each one. Site G, the lowest scorer overall, scored a 1.8 on Rewards and Recognition — a single sub-element under Employee Engagement and Empowerment. That is the lowest single number in the entire cohort.
Across the cohort, the highest-scoring practice areas were Management Commitment to Quality and Employee Engagement and Empowerment. The lowest-scoring practice areas were Advanced Pharmaceutical Quality System (driven down by Quality Risk Management scores) and Technical Excellence (driven down by Data Excellence scores). In other words: even sites that scored well on culture and leadership often scored lower on data discipline and risk management.
Two cohort findings stand out. The site averages range from 2.4 to 4.6. And every one of those sites had cleared FDA cGMP inspection.
Three conclusions that follow from the data
1. cGMP-cleared does not mean quality-mature
All nine sites had passed a recent FDA cGMP inspection. Yet two of them averaged below 3 on quality maturity. One scored a 1.8 on a single sub-element. These were not unknown sites. They were inspection-classified, recently engaged with the agency, and confident enough to volunteer for assessment.
The data makes a point that is hard to argue with: a clean cGMP inspection confirms that documented controls were executed on the day. It does not confirm that the underlying system is mature. Inspections look at artifacts; QMM looks at the system that produced them. A site can pass an inspection and still have a quality system that is brittle, reactive, or culturally weak — and that difference will show up in maturity scoring even if it does not show up in inspection findings.
For organizations confident in their own quality system, this is the most important takeaway from the 2024 data. That confidence has been calibrated against an instrument — inspection — that is not designed to detect the kinds of failures QMM is designed to detect. Most organizations that use the QMM lens honestly will find gaps they did not know they had.
2. Quality maturity behaves like a single property, not a portfolio
Look again at the individual site scores. Within each establishment, the scores across the five practice areas cluster tightly. Site E rated 4.4 to 4.9 across all five areas. Site F rated 4.3 to 4.7. Site G rated 2.2 to 2.7. Site I rated 3.4 to 3.8.
The average within-site spread across the cohort is roughly 0.66 of a point. The between-site spread on any single practice area is much larger — Management Commitment ranged from 2.2 to 4.8 across the nine sites, more than four times the average within-site variance. In plain terms: a site that scores high on one practice area tends to score high on all of them. A site that scores low tends to score low across the board.
This is an important finding. It suggests that quality maturity is not a collection of separate capabilities you can fix one at a time. It is a single organizational property — culture, leadership, data, technical capability, and engagement rising or falling together. The implication for improvement strategy is significant: targeted interventions in one practice area, without addressing the underlying substrate, are likely to underperform.
3. The cohort’s weak spot is data and risk, not culture
If you look at where the cohort scored lowest, two sub-elements stand out: Quality Risk Management (under Advanced PQS) and Data Excellence (under Technical Excellence). Across the cohort, these were the weakest performance areas. Even the strongest performers stumbled here. Site F, which scored 4.8 on Technological Advancement and 4.8 on Knowledge Management, still scored only 3.2 on Data Excellence. Site B, which scored a perfect 5.0 on Continual Improvement, also scored 3.2 on Data Excellence.
Quality risk management and data excellence are linked. You cannot make risk-informed decisions without data you can trust. You cannot govern data you have not properly architected. The two weakest areas in the 2024 cohort are, in effect, one weakness with two names: the underlying data foundation that supports both risk thinking and operational decisions.
For organizations working at the intersection of life sciences and AI, this is where the practical work lies. The QMM rubric is naming, explicitly, the gap that AI-enabled quality systems are best positioned to close — not as a bolt-on, but as the substrate that makes maturity defensible. Strong culture and engaged leadership are necessary, but they are not enough on their own. The next decade of quality work will be measured against whether organizations can build the data and risk-management foundation that mature quality actually requires.
What this means for QA leaders
If you take only one practical thing away from this scorecard, take this: the gap between cGMP compliance and quality maturity is wider than most organizations assume, and it shows up in the areas inspections are not designed to evaluate.
Three concrete moves are worth considering, regardless of whether your organization plans to enroll in a future QMM cohort. First, run an honest internal self-assessment against the five practice areas. Most organizations will discover unevenness they did not expect — and the unevenness itself is informative. Second, look hardest at your data and risk management. The 2024 cohort scored lowest there, and the pattern is likely to hold in any organization that has invested in compliance documentation without building the underlying data discipline. Third, do not treat quality maturity as a portfolio problem. The within-site clustering in the 2024 data suggests that fixing the substrate matters more than picking a single practice area to improve.
The QMM Program is voluntary today. The shift it represents — toward measurable, sustainable, organization-wide quality maturity — is not. Organizations that begin building toward that shift now will find themselves describing what they already do, rather than scrambling to comply, when the formalization arrives.
If you are exploring how to apply the QMM lens to your own organization — including honest self-assessment, building data and risk discipline, and the practical work of moving from concept to practice — Regller works with organizations on confidential readiness diagnostics and adoption sequencing. To start a conversation, reach out at [email protected].
— Kamal Biswas
Founder & CEO, Regller
Source: Eric Twum, “An Update on CDER’s Quality Management Maturity Program,” Generic Drug Forum, U.S. Food and Drug Administration, April 22, 2026. Scores are reproduced from the published presentation; averages and within-site comparisons computed by the author.
