QMS for Compounding Pharmacies: USP 795 and 797

The compounding pharmacy world has a quality management problem that most pharmacies don't realize they have. They have SOPs. They have logs. They have binders full of documentation. What they often don't have is a connected, functional quality system — one where a deviation triggers investigation, where training records link to competency assessments, where environmental monitoring data actually informs decisions rather than sitting in a folder until an inspection.

That gap matters more now than it ever has. The revised USP 797 took effect November 18, 2024. The revised USP 795 followed close behind. Together, they represent the most significant overhaul to compounding standards in over a decade — and they demand a level of quality infrastructure that most pharmacy software and paper-based systems simply weren't built to support.

I want to walk through what these standards actually require from a QMS perspective, where pharmacies consistently fall short, and what a well-built quality system looks like in this context.

The Stakes: Why Compounding Compliance Is Harder Than It Looks

The 2012 New England Compounding Center (NECC) outbreak is the reference point everyone in this industry knows. Contaminated methylprednisolone acetate injections caused a fungal meningitis outbreak that infected 753 patients across 20 states and killed 64 people — a tragedy that directly catalyzed the Drug Quality and Security Act of 2013 and permanently reshaped the regulatory landscape for compounding pharmacies.

What's easy to miss looking back is that the NECC failure wasn't primarily a sterility failure. It was a QMS failure. The monitoring was inadequate, deviations went uninvestigated, training was insufficient, and the documentation didn't reflect what was actually happening on the compounding floor. A functional quality management system would have caught the problem — or prevented it from developing in the first place.

Compounding pharmacies today operate in a regulatory environment shaped directly by that event. State boards of pharmacy, the FDA, and standard-setting bodies like USP have all tightened their expectations. An estimated 7,500 compounding pharmacies operate in the United States, and the compliance demands placed on those doing sterile compounding now closely resemble pharmaceutical manufacturing requirements — even when they're operating as small independent 503A pharmacies serving local patients.

The stakes aren't abstract. They're product safety, patient outcomes, and the kind of inspection findings that result in warning letters, consent decrees, and pharmacy closures.

What the 2023-2024 Revisions Actually Changed

The revised USP 797, effective November 18, 2024, made substantial changes in four areas that have direct QMS implications.

Beyond-use dates (BUDs). The new chapter reorganizes BUDs into categories — Immediate-Use, Compounding for Administration, and Standard/Extended. Extended BUDs now require sterility and stability testing supported by documented evidence. This isn't just a clinical pharmacist concern — it requires a documentation and testing workflow that a QMS has to actively support and track.

Environmental monitoring. The revised standard significantly expanded environmental monitoring requirements. Alert limits and action limits are now required for both viable (microbial) and non-viable (particulate) monitoring. When an action limit is exceeded, a documented investigation and corrective action is required — which is, structurally, a CAPA process. Pharmacies that were collecting environmental data without comparing it against defined limits are now clearly out of compliance.

Personnel training and competency. The 2024 revision formalized competency assessment requirements, including initial and ongoing gloved fingertip sampling, media fill testing, and garbing/gowning evaluations. Each of these needs documented results tied to individual personnel records, with requalification on a defined schedule. That's a training management problem, and it's one most pharmacy systems handle poorly.

Contamination risk level restructuring. The chapter restructured compounding categories around contamination risk in ways that affect facility design, workflow segregation, and the documentation requirements at each stage of preparation.

USP 795 saw parallel changes, particularly around stability evaluation documentation. A compounding pharmacy that's been assigning non-sterile BUDs based on informal convention rather than documented stability assessment needs to revisit that practice — the 2024 standards require something more defensible.

503A vs. 503B: Two Different Compliance Profiles

The regulatory framework distinguishes between two categories of compounders, and the QMS requirements differ meaningfully between them. Understanding which category applies before designing the quality system saves a lot of rework.

503A pharmacies compound pursuant to individual patient prescriptions. They're regulated primarily by state boards of pharmacy, though FDA has authority to inspect them and they must follow USP 795 and 797 where applicable. The QMS requirements here are substantial, but they don't carry the full weight of pharmaceutical cGMP.

503B outsourcing facilities are FDA-registered and may compound without patient-specific prescriptions. The quality system expectations for 503B facilities look much more like pharmaceutical manufacturing — with explicit requirements for a quality unit, annual product review, and a formal CAPA system.

A 503A pharmacy that's operating near the 503B boundary — compounding large volumes, distributing beyond its immediate patient population, or holding inventory without patient-specific prescriptions — may be underestimating its compliance exposure. The FDA has taken enforcement action against 503A pharmacies for operating in that gray zone.

The Six Core QMS Elements for Compounding Compliance

A quality management system for a compounding pharmacy isn't a single document or a single software platform. It's a set of interconnected processes. In my view, there are six elements that matter most for USP 795 and 797 compliance.

1. Document control. Every SOP, formula record, and compounding log needs version control, review cycles, and approval history. When USP 797 requires that a batch record be complete before a compounded sterile preparation is released, that only works if the underlying formulation documents are controlled and current. Document chaos — multiple versions of the same SOP floating around, formula sheets informally updated but never officially revised — is one of the most common findings in compounding pharmacy inspections.

2. Training and competency management. USP 797 now requires documented competency assessments for all personnel involved in sterile compounding, not just initial training. Ongoing competency verification — media fills, garbing evaluations, gloved fingertip sampling — needs to be tracked with results tied to individual records, with alerts when requalification is due.

3. Environmental monitoring and data review. The new USP 797 requirements create an ongoing data stream from the cleanroom: viable and non-viable counts, temperature and humidity logs, pressure differential records, HEPA certification dates. That data needs to be reviewed on a defined schedule, compared against alert and action limits, and acted on when thresholds are exceeded. A QMS provides the workflow for that review — it's not just a repository, it's an active process.

4. Deviation and CAPA management. Every exceedance of an action limit, every batch failure, every out-of-specification result needs to be documented, investigated, and resolved. In practice, most compounding pharmacies handle deviations informally — someone notes a problem, fixes it, and moves on without documenting the root cause or verifying the corrective action held. USP 797 implies a more formal approach, and state boards are increasingly expecting it.

5. Supplier qualification. Raw materials need to come from qualified suppliers, and that qualification needs to be documented. For API sourcing in particular, a review of certificates of analysis, testing data, and supplier history is essential. Compounders who source from the first available supplier without documented qualification are taking on risk that a functional QMS would catch.

6. Complaint and adverse event tracking. Compounding pharmacies receive feedback about their products — from prescribers, patients, and occasionally through adverse event channels. A QMS should capture that information, tie it to specific lots or formulations, and trigger investigation when patterns emerge. This is where pharmacovigilance lives in the compounding context, and it's an area most pharmacies have no formal system for.

Where Most Compounding Pharmacies Fall Short

There are three failure patterns that show up repeatedly in this space.

The first is what I'd call documentation theater — the appearance of a quality system without the function. Binders full of SOPs that nobody has reviewed in three years. Training logs signed off without evidence of actual competency assessment. Environmental monitoring data collected and filed but never reviewed against defined limits. This satisfies a superficial inspection but doesn't actually manage quality, and it doesn't hold up when an inspector goes below the surface.

The second is disconnected systems. The environmental monitoring lives in a spreadsheet. Training records are in a different system. Batch records are paper. Deviations are tracked via email threads. When an inspector asks to see all deviations related to a specific cleanroom over the past twelve months, the answer requires manually searching through three systems — and things get missed. Disconnected systems create compliance gaps not through bad intent but through the friction of manual aggregation.

The third is reactive compliance. The pharmacy updates its procedures in response to inspection findings or warning letters, but hasn't built a system that surfaces problems before they become regulatory findings. The whole logic of a quality management system is preventive — it generates signals before a product reaches a patient. A pharmacy that only improves after something goes wrong is perpetually behind.

Building a QMS That Actually Holds Up

A QMS for a compounding pharmacy doesn't have to be complex to be effective. What it has to be is connected and consistent.

Connected means that a deviation in environmental monitoring links to an investigation, which links to a corrective action, which has a completion date and a verification step. A training record links to the competency assessment that justified it. A batch record links to the approved formula, the supplier lot numbers, and the environmental conditions at the time of compounding. The connections are what make the system auditable — and what make it actually useful for managing quality rather than just recording it.

Consistent means the system runs the same way every time, regardless of who's working or how busy the shift is. That's harder in compounding pharmacies than it sounds, because compounding is a craft-based practice with significant variability in products, volumes, and personnel. A QMS has to be simple enough that busy pharmacists and technicians actually use it — otherwise it exists on paper and functions nowhere.

A few practical observations for pharmacies building or upgrading their quality systems:

Start with your biggest compliance gaps, not your easiest wins. If your environmental monitoring data isn't being reviewed against action limits, that's where your immediate regulatory exposure lives — not in whether your SOP template looks polished.

Automate the alert functions where you can. Due dates for training requalification, scheduled SOP review cycles, environmental monitoring trending — these shouldn't require someone to remember. They should appear in a queue.

Separate the quality review from the production function, even in a small pharmacy. The person reviewing batch records for release shouldn't be the same person who compounded them. This is a basic quality principle that small pharmacies skip because of staffing constraints, but it's worth building the system to support even when full separation isn't always achievable.

What AI-Powered QMS Means for Compounding Pharmacies

The interesting shift happening in quality management right now is the move from passive systems to active ones. Traditional QMS platforms store documents and track task deadlines. AI-powered systems can do something more useful: they can surface patterns.

If your environmental monitoring data shows a slow upward trend in viable counts over three months — still within alert limits, but trending — a passive system won't tell you. An active system will. That early signal is exactly what prevents the investigation that happens after an action limit exceedance.

The same logic applies to supplier performance, training lapse patterns, and batch record anomalies. A system that reviews data and surfaces signals allows a pharmacist to act on quality information rather than just record it.

For compounding pharmacies where the quality function is often one person wearing multiple hats, the leverage from an AI-assisted QMS is significant. It multiplies the capacity of a small quality team without requiring additional headcount — which is, in my view, exactly the right place to invest.

Nova QMS is built with this in mind — an AI-powered quality workbench designed for regulated industries, including compounding pharmacy, where the stakes are high and the teams are lean.

Frequently Asked Questions

What's the difference between USP 795 and USP 797 from a QMS perspective?

USP 795 governs non-sterile compounding. USP 797 governs sterile compounding. Both require documentation, training, and quality oversight, but USP 797 carries significantly more prescriptive requirements — particularly around environmental monitoring, personnel competency assessment, and beyond-use dating — because sterile preparations carry higher direct patient risk. A pharmacy doing both sterile and non-sterile compounding needs a QMS that handles both standards, and the sterile requirements will drive most of the system design.

Do 503A compounding pharmacies need a formal QMS?

Strictly speaking, USP 797 doesn't use the term "quality management system" — but it requires all the functional elements of one: document control, training records, environmental monitoring review, deviation investigation, and supplier qualification. A pharmacy with those elements operating as isolated processes rather than a connected system is harder to inspect and harder to maintain. A formal QMS is the most reliable way to satisfy those requirements consistently, and state boards are increasingly treating it as the expected standard of practice.

What are the most common QMS-related inspection findings in compounding pharmacies?

The most common findings cluster around three areas: inadequate documentation (missing or incomplete batch records, training files not current, SOPs not reviewed on schedule), environmental monitoring gaps (data collected but not reviewed against action and alert limits, missing investigation documentation when limits are exceeded), and personnel competency deficiencies (initial training documented but ongoing competency assessments absent or incomplete). These aren't exotic failures — they're the predictable result of operating a quality system that stores records without actively managing the underlying processes.

How does a compounding pharmacy handle CAPA under USP 797?

USP 797 requires investigation and corrective action when environmental monitoring action limits are exceeded, when sterility testing failures occur, and when other significant deviations are identified. The CAPA process — root cause analysis, corrective action implementation, and effectiveness verification — should be formalized in a written procedure and documented for each incident. The documentation should be inspection-ready at all times. Pharmacies that handle these situations informally ("we fixed it") without documented root cause analysis and verification are creating the exact kind of gap that inspection findings are built from.

What changed most significantly in the 2024 USP 797 revision?

The 2024 revision made the most material changes in four areas: beyond-use date categories (with new documentation requirements for extended BUDs), environmental monitoring (now requiring formally defined alert and action limits with documented investigation protocols when exceeded), personnel training and competency (formalized ongoing assessment requirements, not just initial training), and contamination risk level restructuring. Pharmacies that updated procedures before the November 2024 effective date should verify their current compliance posture — the revision was extensive enough that a once-over isn't always sufficient.

Last updated: 2026-07-06