Is Your QMS Haunted? Five Ghosts That Make Quality Hard to Use

A walk through the procedures that scare your people more than any FDA investigator.

Every October, the neighborhood fills up with inflatable ghosts, fake cobwebs, and at least one animatronic skeleton that shrieks when you walk past it. I love it. What I don’t love is how many quality systems I walk into as a consultant look a lot like a haunted house: dark corners nobody visits, things that move on their own, and procedures that make grown engineers quietly back out of the room.

Here’s my not-so-unpopular opinion: a QMS that is hard to use is not rigorous. It’s just hard to use. And a system people can’t use is a system people won’t follow. That gap between what the procedure says and what actually happens is where nonconformances and, far more importantly, patient risk like to hide.

Think about it. We would never release a medical device without asking whether a real user, in a real environment, can operate it safely. We run studies, we hunt for use errors, and we redesign the interface when people get confused. Then we turn around and release a 38-page SOP that no one except its author has ever tried to follow at 2 a.m. on second shift. Your QMS has users, too. It deserves the same human factors respect we give our products.

Grab a flashlight and let’s go ghost hunting.

Ghost #1: The Zombie SOP

Dead, but still walking. It covers equipment you decommissioned years ago, a product line you sold, or a process that moved to a contract manufacturer a year ago. Nobody uses it, but it’s still effective in the document system, still assigned in training curricula, and still sitting on the document list an investigator will see.

Zombies are dangerous because they erode trust. Once people learn that some procedures are “real” and some are “just there,” they start deciding for themselves which is which. That is not a judgment call you want delegated to the training matrix.

The exorcism: Make periodic review mean something. Instead of re-approving documents on a calendar with a rubber stamp, ask three questions. 

• Is this still performed? 
• Is it performed this way? 
• Would anyone notice if we retired it? 

If the answer to that last one is no, let it rest in peace.

Ghost #2: Frankenstein’s Procedure

I see this one constantly with startups and post-acquisition companies. The procedure was stitched together from a template the founder brought from a former employer, a section from a consultant’s library, and a paragraph somebody found online. You can see the evidence: three different names for the same record, or role titles that don’t exist on your org chart, or references to a Material Review Board you have never once convened.

Confession time: back in 1995, when I was leading my first ISO 13485 and QSR implementation, I built a few “monsters” of my own. We were going to shine, and I was convinced that more words meant more control. They didn’t. They meant more places to fail.

The exorcism: Write procedures for the company you are, not the company someone else was. Right-size to your products, your risk, and your people. A 10-person startup with one Class II device does not need the supplier management process of a 5,000-person global manufacturer. It needs one that works, gets followed, and can grow with them.

Ghost #3: The Ghost Process

This is the scariest one, because you can’t see it. The documented process says one thing; the real process lives in people’s heads, on a sticky note inside a cabinet door, or in a spreadsheet on someone’s desktop named “tracker_FINAL_v7_REAL.” Everyone knows the workaround. Nobody wrote it down.

Ghost processes almost always exist for a reason: the official process doesn’t work. People are rarely being defiant. They’re being practical. The workaround is the feedback your QMS forgot to ask for.

The exorcism: Go to where the work happens (GEMBA) and ask, without judgment, “Show me how you actually do this.” Then decide together. Is the workaround better? Update the procedure. Is it risky? Fix whatever made it necessary. Under the QMSR, investigators are following the connections from complaints and nonconformances back into your processes. The ghost process is where that trail leads.

Ghost #4: The Vampire CAPA System

Everything goes to CAPA. The label was slightly crooked? CAPA. Someone missed a training due date by a day? CAPA. Before long you have 140 open CAPAs, a CAPA board meeting that lasts three hours, and a team so drained they can’t give the real systemic problems the investigation they deserve. The vampire doesn’t just drink your resources; it drinks your credibility, because effectiveness checks quietly become “we did the thing, it’s closed.”

ISO 13485 says corrective action should be proportionate to the effects of the nonconformity. That isn’t a loophole. It’s a requirement.

The exorcism: Build a real front door for CAPA. Use risk-based criteria to decide what needs a full investigation and what can be handled through a correction, a nonconformance, or trending. Then actually watch your trends. When that crooked label shows up for the fifth time, now it has earned a CAPA.

Ghost #5: The Haunted Form

Forty-seven fields. Nine signatures. Three of the fields haven’t been filled in since the form was created, and nobody can tell you what “Reviewed By (Secondary)” is supposed to attest to. The form keeps growing because every time something went wrong, someone added a field instead of fixing a process.

Every signature should answer one simple question: what is this person confirming? If you can’t answer that, the signature isn’t a control. It’s a ritual. And rituals don’t protect patients; they just slow down batch release and DHR review.

The exorcism: Pick your three most-used forms and do an audit. For each signature, write down what that person is actually verifying, and remove anything that’s decorative. Then hand the form to someone who has never used it and watch them fill it out. Wherever they hesitate might be the next error made.

Your Ghostbusting Checklist

• Have someone who didn’t write a procedure follow it, step by step, while you watch. Take notes, not offense.
• Retire at least one zombie document.
• Ask one team to show you their “real” process, and thank them for it.
• Look at your open CAPA list and ask honestly how many truly needed to be a CAPA.
• Count the signatures on your most-used form, and justify every single one.

The Grey Area Isn’t the Scary Part

Some colleagues worry that simplifying a QMS means lowering the bar. I understand the instinct. The black-and-white answer feels safer: more procedure, more signatures, more CAPAs. But the standards and regulations are full of words like appropriate, proportionate, and where applicable for a reason. They expect us to use judgment, and to document it.

The goal isn’t the thickest QMS on the shelf. It’s the one where the documented way and the real way are the same way. That’s not scary. That’s QLaRity.

What ghost is haunting your quality system? Tell me in the comments.

Jackie Torfin is the CEO, and Principal Advisor of QLeaR Advisors, where she helps medical device, pharmaceutical, and biotech companies build quality systems people can actually use. She teaches in the MedTech Quality graduate program at St. Cloud State University and mentors quality and regulatory leaders, especially the women coming up behind her.