In nearly every training session I hold, I ask the same question: who is responsible for quality in this organization? Every single time, fingers point the same direction — at the quality manager, the quality engineers, the quality inspectors. As if a word in someone’s title makes them wholly responsible for a system the rest of the company just has to comply with.
It’s simply not true. I think the misconception is baked into the name itself.
Rearrange the words
Try this: instead of “Quality Management System,” say “Management System – Quality.” Do the same with the others you’re probably already running: “Management System – AI,” “Management System – Environmental,” “Management System – Information Security.” We’ve been burying the lede so to speak.
These are systems put in place to manage an aspect of the organization. Read them in that order and the ownership question answers itself: it’s a management system, owned by the organization as a whole, that happens to be about quality (or AI, or the environment, or information security). Not a Quality Assurance department system that the rest of the org tolerates.
What “own” actually means
Top management is accountable for implementing and ensuring the effectiveness of these systems. Period.
In practice, “top management” means whoever directs and controls the organization at the highest level – the CEO, executive team, or, in a small company, the owners or founders.
They may assign a custodian (e.g. a management representative, a quality systems manager, an ISMS lead) to oversee and facilitate the day-to-day: keeping processes effective, closing gaps, reporting up. But a custodian isn’t an owner, and this distinction isn’t mine to invent – the standards themselves make it clear.
Ownership sits with the organization (“The organization shall establish, implement, maintain and continually improve….”). Accountability for it sits with top management. (“Top management shall ensure, appoint, provide…) By implementing and enforcing policies and procedures, they seek to instill a culture in which every employee is responsible for following and supporting the system which is a very different thing from a department or an individual “owning” it.
This is not say that an individual cannot be a change “owner”, process “owner” or a CAPA “owner” or a complaint “owner”. (In one particular eQMS – they are called “responsible parties” which is far more preferable to “owner.”) Rather an “owner” should be viewed as the person or person(s) responsible for shepherding the change, or process, or complaint, or CAPA through reporting, investigation, implementation and effectiveness.
Why the shared language matters
International standards exist to make these systems portable across companies, industries, cultures, and borders. If I’m a manufacturer in the US and my supplier is in Asia, a shared standard means we’re talking about the same requirements when we say “quality system,” not two locally-invented interpretations of risk management. That’s a far more efficient way to regulate an industry that touches people’s health and safety than leaving everyone to reinvent their own approach.
This isn’t just philosophy, ISO structures them this way. Standards like ISO 9001, 14001, 27001, 42001, 45001, and 22301 share a harmonized high-level structure (Annex SL), which means document control, change management, and nonconformity/corrective action live in the same numbered clauses across all of them. That’s deliberate. It’s the standards body building in the very point I’m making: these systems are variations on one organizational skeleton, not separate fiefdoms.
Which is why four components sit underneath all of them: document and record control, change control, nonconformities, and corrective action. Everything else – audits, risk assessments, training records, supplier evaluations, complaints and feedback, design, product acceptance – flows in and out of those four.
No system stands alone
None of this lives in isolation, either. The QMS pulls records from HR (job descriptions, competency evidence), from IT (software validation, data preservation), from finance (purchase orders, sales orders). When HR says “we don’t touch product, so we don’t need to work in the system,” they’re missing that they’re still accountable for the competency of the people who do. Same with sales, same with purchasing. The system’s boundary isn’t the org chart.
Even outside the ISO world, this logic holds. A company preparing to go public has to stand up internal controls over financial reporting (the SOX 404 obligation) and that discipline tends to ripple outward into how the rest of the organization thinks about risk, even where SOX itself doesn’t reach. The instinct is the same one this whole piece is arguing for: these systems are enterprise-wide, not department-deep.
The correction
So the next time someone in your organization says “that’s a Quality problem, not mine”- or an AI problem, or a security problem – the correction isn’t to retrain everyone to the quality policy. It’s a reminder from top management that when we all work within management systems, it is everyone’s problem. At the end of the day, a problem in any management system is a problem with the organization that will affect the ability of the organization to thrive and succeed. Since our livelihoods and, in the case of medical device manufacturers, the lives and wellbeing of patients depend on the success of the organization – we should all work together to address the problem – and not just point to the nearest person with quality in their job title.An Overdue Correction: Who Actually Owns the Quality Management System