What Is Compliance in Quality Assurance? A Canadian Guide

Ask five people in a regulated facility what compliance means and you will get five answers. Passing the inspection. Following the SOP. Doing the paperwork. Keeping Health Canada happy. Each of those is a fragment of something larger, and the space between the fragments is where most inspection findings live.

Compliance in quality assurance has a precise meaning, and it is both narrower and more demanding than most teams assume. It is not a feeling of being well organized. It is not the absence of problems. It is not even having a good product. It is the ability to demonstrate, with evidence that an outside party can examine and test, that your operations meet the requirements that apply to you.

This guide sets out what compliance actually means inside a quality assurance function in Canada, where the legal obligation comes from in each regulated sector, how Health Canada grades it, and what your evidence has to look like to hold up when it is read by someone who has no reason to trust you.

Executive Summary

• Compliance in quality assurance means documented, demonstrable conformance with the requirements that apply to your product and site. The operative word in Health Canada's own definition is "demonstrated".
• Quality and compliance are different things and they fail independently. A product can be perfectly good and still be non-compliant, because compliance is about proof, not merit.
• The obligation sits in a different instrument for every sector: Part C, Division 2 of the Food and Drug Regulations for drugs, Part 5 of the Cannabis Regulations for cannabis, Part 3 of the Natural Health Products Regulations for NHPs, and the preventive control plan under the Safe Food for Canadians Regulations for food.
• Health Canada classifies drug GMP observations as Risk 1 (critical), Risk 2 (major) or Risk 3 (other), and assigns one of only two ratings: Compliant or Non-Compliant.
• A Compliant rating is a floor, not a trophy. Health Canada states plainly that it does not mean there are no observations or corrective actions required.
• Good Production Practices for cannabis is not a quality management system. Assuming otherwise is one of the most expensive misunderstandings in the sector.

What Does Compliance in Quality Assurance Mean?

Compliance in quality assurance means conforming to the requirements that apply to your product, your site and your activities, and being able to prove that conformance with documented evidence. Quality assurance is the system you build to produce consistent, safe product. Compliance is the demonstrated, auditable proof that the system actually did what it was designed to do.

The distinction is not academic. Regulators do not assess your intentions, your culture, or in most cases even your product in isolation. They assess your evidence.

Health Canada's own language makes this explicit. In its Risk classification guide for drug good manufacturing practices observations (GUI-0023), a Compliant rating means that "the regulated party has demonstrated that the activities it conducts are in compliance with the Food and Drugs Act and its associated regulations". The load-bearing word is demonstrated. Not achieved. Not intended. Demonstrated. The burden sits with you.

The practical consequence is uncomfortable but worth stating directly: for regulatory purposes, an undocumented good practice is not a practice at all. If the only place a control exists is in an experienced operator's head, then as far as an inspector is concerned it does not exist. This is the hardest idea to sell inside a plant that is genuinely proud of its product, and it is the idea that separates sites that pass from sites that do not.

Compliance and Quality Are Not the Same Thing

Quality and compliance overlap, but they fail independently. Treating them as synonyms is the single most common conceptual error we encounter in gap assessments, and it produces two opposite pathologies: teams that chase paperwork while the process drifts, and teams that make excellent product and cannot prove it.

Four combinations are possible, and only one of them is comfortable.

• Compliant with good quality. The goal. The system works and you can prove it works.
• Compliant with mediocre quality. Entirely possible. Regulations set a floor, not a ceiling. Meeting every prescribed minimum is not the same as making a product that performs well, and a clean inspection does not certify commercial excellence.
• Non-compliant with good quality. The most common and the most misunderstood. The product may be entirely fine and the batch may be safe. But the batch record was completed the next morning from memory, the second review signature was applied by someone who did not perform the review, or the operator followed an SOP that was two revisions out of date. Health Canada does not have to prove your product is bad. You have to prove it is controlled.
• Non-compliant with poor quality. Usually the end state of the third case, left alone for two years.

This is why Health Canada is careful to note that a Compliant rating "does not mean that there are no observations or corrective actions required", and why terms and conditions can be applied to a licence even where the rating is compliant. Compliant is a floor you are standing on, not a prize you have won.

Where the Compliance Obligation Actually Comes From

There is no single Canadian law called the Quality Assurance Act. The obligation is distributed across product-specific regulations, and it takes a materially different shape in each one. Before you can say whether you are compliant, you have to be able to name the instrument, the part and the section that binds you. If your quality manual cannot do that, it is a wish list.

Read that table closely, because the differences are not cosmetic. Drug GMP requires a quality control department with a defined degree of independence from production. Cannabis Good Production Practices requires a single named individual, and only for a licence for processing. Food requires a written plan built on hazard analysis. Medical devices require a full quality management system conforming to an international standard.

Those are four genuinely different architectures. Compliance in quality assurance therefore does not mean one thing across a multi-product company, and a policy written for one sector will not transfer cleanly to another. Companies holding licences in more than one category, which is common across our cannabis and hemp, pharmaceutical and food and beverage work, routinely underestimate this and try to run one quality manual across all of them.

How Health Canada Grades Compliance

For drug establishments, Health Canada does not grade on a curve and does not issue a score. Each observation is assigned a risk class, and the inspection as a whole receives one of two ratings. Understanding the mechanics tells you where to spend a limited remediation budget.

There are only two ratings. Compliant (C) means the party has demonstrated compliance. Non-Compliant (NC) means it has not. Health Canada states that an NC rating will generally be assigned in three situations:

• When a Risk 1 observation is noted during an inspection.
• When numerous Risk 2 observations are noted, indicating that the company does not control its processes and operations sufficiently.
• When Risk 2 observations identifying overarching systemic issues are noted.

Two points deserve emphasis, because they are routinely missed.

First, fraud and falsification sit in a category apart. Situations involving fraud, misrepresentation or falsification of processes, products or data fall into Risk 1 by definition, and Health Canada states these will generally generate an NC rating regardless of the activities being conducted or the category of products involved. There is no proportionality argument available. A single falsified record is not a small compliance problem, and backdating a signature to close a gap is not a shortcut, it is the most serious finding in the framework.

Second, your quality system maturity changes the severity of the same finding. GUI-0023 states that the failure of a company to apply good pharmaceutical quality system principles, including quality risk management principles, will be considered in the assignment of risk to an observation. The identical deviation can be scored differently at two sites depending on whether the surrounding system detected it, investigated it and acted on it. That is the strongest argument we can offer for investing in root cause and CAPA capability before an inspection rather than after one. The finding you cannot avoid, you can still downgrade.

It is fair to ask what inspectors cite most often. Health Canada once published aggregate figures in its Inspectorate Program annual inspection summary reports, but that series was discontinued. The most recent edition covers 2015 to 2016 and reported 440 drug GMP inspections generating 2,353 observations, of which roughly 1 percent were critical, 57 percent major and 42 percent minor, with a 95 percent compliance rate for domestic inspections and quality control and manufacturing control as the leading observation categories. That data is now a decade old and should be treated as historical context rather than a current benchmark. Health Canada has not published a comparable aggregate since. Current outcomes are available per inspection in the Drug and Health Product Inspections Database, which is searchable by rating. Anyone quoting you a recent national deficiency ranking for Canada should be asked for their source.

What Demonstrated Actually Looks Like: The Evidence Chain

Compliance is demonstrated through an unbroken chain of records. An inspector reads the chain backwards, from the product on the shelf to the requirement in the regulation. If any link is missing, the chain does not hold, no matter how strong the remaining links are. There are seven links.

• The requirement is identified. You can name the section that applies and you have interpreted it correctly. Misreading a requirement produces confident, well documented non-compliance.
• A procedure exists. Section 80 of the Cannabis Regulations requires that activities be conducted in accordance with standard operating procedures designed to ensure they meet Part 5 and Part 6. C.02.011 and C.02.012 do equivalent work for drugs.
• People are trained before the procedure takes effect. Training dated after the effective date is a finding on its own, and it is one of the easiest for an inspector to spot.
• The work is recorded as it happens. Contemporaneous means at the time, by the person who did it. Records reconstructed later are not evidence of control, they are evidence of its absence.
• Someone independent reviews it. A review that never rejects anything is not a review, and a reviewer will be asked what they would have caught.
• An authorized person makes the release decision. Under section 88(1)(e) of the Cannabis Regulations, every lot or batch of cannabis must be approved by the quality assurance person before it is made available for sale. The decision is personal and it is documented.
• The record is retained. For the prescribed period, in a retrievable form. A record you cannot produce during the inspection is, functionally, a record you do not have.

The weakest link in most Canadian facilities is not the first or second. Almost everyone has procedures. The failures cluster at links three, four and five: training that happened after the SOP went live, records completed retrospectively, and review signatures applied without an actual review. Our mock audits and inspection readiness work targets those three links first, because that is where the findings are. If you want to test yourself before we do, work through our 25-point Health Canada GMP self-assessment.

A Caution: Good Production Practices Is Not a Quality Management System

Good Production Practices under Part 5 of the Cannabis Regulations is a prescriptive list of production and testing requirements. It is not a quality management system in the ISO or GMP sense, and the Cannabis Regulations do not require one. This surprises people, including people who have held a licence for years, so it is worth being precise about it.

Part 5 enumerates specific obligations: standard operating procedures (s. 80), pest control products, storage, distribution, buildings, filtration and ventilation, water, lighting, equipment, a sanitation program (s. 87) and hand washing facilities, plus additional requirements for processors and testing requirements at sections 90 to 92. What it does not contain is any requirement for a quality policy, quality objectives, management review, an internal audit programme, formal change control, supplier qualification or continual improvement. Those are load-bearing elements of ISO 9001 and of pharmaceutical GMP. In Part 5 they are simply absent.

Three further distinctions matter:

• The quality assurance person is one named individual under section 19, not an independent quality unit. The requirement attaches to a licence for processing. Cultivators have a master grower instead, and analytical testing licence holders have a head of laboratory.
• The closest thing to a system requirement is the preventive control plan under section 88.94, which is HACCP derived and applies only to processors conducting activities in relation to cannabis extracts or edible cannabis. It does not apply to cultivators, to dried or fresh cannabis, or to topicals.
• There is no corrective and preventive action requirement in Part 5 in the ISO or GMP sense. Section 88(1)(b) requires the quality assurance person to immediately cause measures to be taken to mitigate risk following an investigation, which is a narrower and more urgent duty than a CAPA system, not a substitute for one.

Why this matters commercially: a company holding a processing licence in good standing may reasonably believe it has a functioning QMS. It does not necessarily have one. The gap becomes visible the first time it pursues EU-GMP certification, supplies a pharmaceutical partner, or is audited by an international customer, and by then the remediation is happening under a deadline someone else set. Building the QMS elements that GPP does not require is a strategic decision rather than a compliance one, but it is the decision that determines whether a site can ever export.

One practical note on sources. Health Canada's Good production practices guide for cannabis carries a banner confirming it has not yet been updated for the March 2025 streamlining amendments, and section 88 has changed substantively since the guide was written. Where the guide and the regulation differ, the regulation governs. Read the consolidated Cannabis Regulations on the Justice Laws website, and treat the guide as commentary. Guidance documents are administrative instruments and do not have force of law.

Compliance Checklist for a Quality Assurance Function

Work through this before your next inspection, not after it.

• You can name the regulation, part and section that binds each of your activities, in writing.
• Every procedure has an owner, an effective date, a revision history and evidence of review on a defined cycle.
• Training records for every SOP predate that SOP's effective date, with no exceptions you cannot explain.
• Deviations from procedure are documented in a report, with the reason, whether it was planned, and an assessment of the impact.
• Batch and production records are completed contemporaneously, by the person doing the work, with no blank fields and no pencil.
• Out of specification results are investigated to root cause and the investigation reaches a documented conclusion, not a shrug.
• The release decision is made by the person the regulation names, and that person has the training, experience and technical knowledge the regulation requires.
• Records are retained for the prescribed period and can be retrieved in front of an inspector, within minutes, not days.
• Electronic systems have audit trails that are switched on, reviewed, and cannot be disabled by the people they monitor.
• Internal audits happen on a schedule, findings are tracked to closure, and closure is verified for effectiveness rather than just signed off.
• Suppliers and contract sites are qualified, with the evidence on file at your site, not theirs.
• What your SOPs say and what your people do are the same thing. Walk the floor and check.

Common Mistakes

• Treating compliance as the QA department's job. QA can design and verify the system, but production, engineering and procurement generate most of the evidence. A QA team policing everyone else is a QA team that will lose.
• Writing SOPs nobody follows. An aspirational SOP is worse than a plain one, because the gap between the document and the floor is itself the finding. Write what you actually do, then improve it deliberately.
• Confusing certification with compliance. ISO 9001 registration does not make you compliant with the Food and Drug Regulations. They are different requirements assessed by different parties for different purposes.
• Reading the guidance instead of the regulation. Guidance documents are helpful, non-binding, and sometimes out of date. The regulation is the law. Where they conflict, you already know which one an inspector will cite.
• Fixing the finding instead of the cause. Retraining the operator closes the observation and guarantees its return. If your CAPA always concludes with human error, your investigation stopped early.
• Preparing for the inspection in the two weeks before it. Evidence is historical. You cannot create a contemporaneous record in hindsight, and attempting to is the one act that converts a manageable problem into a Risk 1 observation.
• Assuming one sector's playbook works everywhere. A cannabis QAP model does not satisfy drug GMP, and a food preventive control plan does not satisfy ISO 13485.

Frequently Asked Questions

Is compliance the same as quality control?

No. Quality control is the testing and checking function that measures whether product meets specification. Quality assurance is the broader system that builds and verifies control across the process. Compliance is the documented demonstration that the whole arrangement meets the requirements that apply to you. Quality control is one input to compliance, not a synonym for it. You can have an excellent laboratory and still be non-compliant.

Does a Compliant inspection rating mean my site has no problems?

No, and Health Canada says so directly. A Compliant rating means the regulated party has demonstrated that its activities are in compliance. Health Canada notes that this does not mean there are no observations or corrective actions required. Terms and conditions can also be applied to a licence even where the rating is compliant. Treat a C rating as a floor you cleared, not as an endorsement.

Do the Cannabis Regulations require a quality management system?

No. Part 5 sets out Good Production Practices, which is a prescriptive list of production, sanitation and testing requirements. It does not require a quality policy, management review, an internal audit programme, change control or continual improvement. A processing licence holder must retain the services of a quality assurance person under section 19, but that is one named individual, not a quality unit. Many licence holders build a QMS anyway, and that is usually a sound commercial decision, particularly for export, but it is not a requirement of the Cannabis Regulations.

Who is legally responsible for compliance in quality assurance?

The licence holder is responsible, and specific duties are assigned to named individuals. For cannabis processing, section 19 requires a quality assurance person who is responsible for assuring the quality of the cannabis before it is made available for sale, and section 88 requires that person to approve every lot or batch before release. For drugs, Part C, Division 2 requires a quality control department. Delegation of tasks is permitted, but accountability stays with the named person and the licence holder. You cannot outsource responsibility, including to a consultant.

Does ISO certification make us compliant with Health Canada?

Not by itself, and the answer depends on the sector. ISO 9001 is a voluntary management system standard and carries no weight as proof of compliance with the Food and Drug Regulations or the Cannabis Regulations. Medical devices are the notable exception, where ISO 13485 conformity is central to the quality system expectation, and in the United States the FDA's Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016 by reference. Outside devices, treat certification as useful discipline and as evidence a customer may want, not as a defence to a regulator.

What is the difference between a Risk 1 and a Risk 2 observation?

A Risk 1, critical, observation describes a situation likely to result in a product that may present an immediate or latent health risk, or that involves fraud, misrepresentation or falsification. A Risk 2, major, observation describes a situation that may result in a drug not consistently meeting its marketing authorization. The practical difference is the rating: a Risk 1 will generally produce a Non-Compliant rating on its own, whereas isolated Risk 2 observations can still sit within a Compliant rating. Risk 2 observations can be upgraded to Risk 1 where the issue is not isolated to one area or system.

How does an inspector decide our records are not contemporaneous?

Usually by cross-referencing. Entry times are compared against shift schedules, door access logs, equipment printouts, electronic audit trails and other records that were generated independently. Uniform handwriting and ink across a record that was supposedly completed over eight hours, or entries that precede the event they describe, invite closer scrutiny. This is why audit trail review has become a focal point of data integrity inspections in Canada and abroad, and why disabling or ignoring an audit trail is treated so seriously.

How MFLRC Can Help

MFLRC is a Canadian regulatory consultancy led by Mussarat Fatima, who has more than twenty years in quality assurance, quality control and regulatory affairs across pharmaceuticals, food and cannabis. We work with licence holders who need their compliance position to be defensible rather than merely optimistic.

• Gap assessments that map your operations against the specific sections that bind you, and tell you honestly where the evidence is missing.
• SOP and QMS development, including document control, training frameworks and quality manuals that reflect what your site actually does.
• Internal, supplier and mock audits, plus CAPA review and remediation planning, so findings are closed at the cause rather than the symptom.
• Quality assurance person and QAP support for cannabis licence holders, covering release decisions, investigations and the duties that attach personally under sections 19 and 88.
• Validation and qualification across process, cleaning, equipment, analytical methods and computerized systems.
• Licensing, registration and import or export support across cannabis, pharmaceuticals, natural health products, food, cosmetics and medical devices.

If you are not certain whether your evidence would survive a careful reader, that uncertainty is itself the finding. It is far cheaper to discover it with us than with an inspector.

Conclusion

Compliance in quality assurance means conforming to the requirements that apply to you and being able to prove it with evidence that an outsider can test. It is not the same as quality, it is not the same as certification, and it is not the same as confidence. It is a documented, retrievable chain running from the regulation to the product, and it either holds or it does not.

The organizations that find this straightforward are not the ones with the biggest quality departments. They are the ones that decided, early, that doing the work and proving the work are the same job. That decision costs something up front and saves a great deal later, usually at the exact moment when there is no time left to buy anything back.

Sources and References

• Health Canada, Risk classification guide for drug good manufacturing practices observations (GUI-0023)
• Health Canada, Good manufacturing practices guide for drug products (GUI-0001)
• Government of Canada, Food and Drug Regulations (C.R.C., c. 870), Part C, Division 2
• Government of Canada, Cannabis Regulations (SOR/2018-144), Part 5 Good Production Practices
• Health Canada, Guidance document: Good production practices guide for cannabis
• Government of Canada, Natural Health Products Regulations (SOR/2003-196), Part 3
• Government of Canada, Safe Food for Canadians Regulations (SOR/2018-108)
• Government of Canada, Medical Devices Regulations (SOR/98-282)
• ICH, Q10 Pharmaceutical Quality System, Step 4, 4 June 2008
• Health Canada, Drug and Health Product Inspections Database
• Health Canada, Inspectorate Program annual inspection summary report 2015 to 2016 (historical)
• US FDA, Quality Management System Regulation (QMSR), effective 2 February 2026
• ISO 9001:2015, Quality management systems, Requirements