Quality management
The second foundational element covers the quality management system that holds the life cycle processes, their records and their improvement.
What the public record carries
Not stated in the public record beyond the element title. The public introduction describes the four parts. The text of 5.2.3 is not public.
Basis. The public contents name the element. The four parts are not public.
Why it matters in a health estate
Health software organisations usually already have a quality management system, often certified to a general standard or to a medical device standard. The value of this element is to place the safety, effectiveness and security work inside that system rather than beside it. A programme that runs its own documents, its own reviews and its own corrective actions duplicates the audit and loses the authority of the management system.
What to do now
Map the programme's processes to the existing quality management system. Record which procedures are shared, which are separate and why. Put the register's corrective actions into the same system as the rest of the organisation's, with the same review.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Process map | Programme processes against the quality management system's procedures |
| Shared procedures | The procedures that now carry both the management system and the programme |
| Corrective actions | The register's actions in the organisation's own corrective action system |
| Audit record | The last internal or external audit that covered the programme |
What a reviewer will ask
An auditor will ask whether the programme is inside the management system or beside it. Two sets of documents is the usual finding.
Common gaps
- The programme keeps its own document set outside the certified management system
- Corrective actions from incidents are tracked in a different system from the rest
- The management review does not see the programme's position
- An audit covers the management system and not the health software work
Before the draft publishes
Map the processes and count the duplicates. Consolidation is usually cheaper than it looks.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The quality lead and the regulatory lead, because this element connects the programme to the management system the organisation is already audited against.