QA vs QC in Pharma: What Lonza’s Quality System Taught Me

Ask ten pharma professionals to explain QA vs QC in pharma and you’ll get ten different answers. Honestly, I used to do the same. Then a batch of labels came back wrong in March 2023, and the difference became financial.

I’m a quality compliance reviewer at a life-science manufacturing company. I go through roughly 200 technical documents a year—certificates of analysis, batch records, labels, packaging specs—before they reach customers. In 2024, I rejected about 7% of first-round submissions. That wasn’t because QC was lazy. It was because QA wasn’t the right kind of QA.

The best way I know to explain the split is a classic biology question: why can humans digest starch but not cellulose? Starch is alpha-glucose with α-1,4 links; human amylase can break it. Cellulose is beta-glucose with β-1,4 links; we don’t have the enzyme. Same monomer, different connectivity. QA and QC look similar in an org chart, but they link to quality in different ways.

So here’s my short version: basically, QA builds the enzyme. QC runs the assay.

1. Purpose: Prevention vs Detection

Quality Assurance is process-focused. It asks, “Are we doing things right?” It covers training, change control, deviation investigations, audits, vendor qualification, CAPA. Prevention is the goal.

Quality Control is product-focused. It asks, “Did the thing that came out match the spec?” It covers sampling, testing, release data, certificates of analysis. Detection is the goal.

This distinction isn’t just semantics. According to ICH Q7 (ich.org), quality control is the part of GMP concerned with sampling, specifications, testing, and release procedures. Quality Assurance, on the other hand, is the broader system that gives confidence those quality requirements will actually be met.

In practice, the separation can collapse. In Q1 2024, our QC lab caught a pH reading 0.3 units off on a buffer we were releasing. The batch was rejected—that was QC doing its job. But the harder question was how the process produced a 0.3-unit drift in the first place. That’s a QA question. We found an outdated sensor calibration procedure, and it had been creating scattered results for months.

One bad label on a buffer tank cost us a $22,000 redo and delayed a launch by two weeks. The sticker itself was a QC miss. The root cause was a QA gap.

2. Tools: Audits vs Assays

If you look at a supplier’s quality system, the tools tell you which function is running the show.

QA tools look like audits, deviation logs, CAPA records, training files, and change control documents. QC tools look like HPLC, pH, bioburden, endotoxin testing, specs, compendial methods, and certificates of analysis.

A mature organization uses both, but it doesn’t mix the responsibilities. This is where the Lonza catalog has become a useful benchmark for me. When I order a product like RPMI-1640 or DMEM from Lonza, I don’t just see a product name. I see part numbers, lot numbers, storage conditions, and documentation. That’s QC output that makes QA auditing much easier.

The Lonza brand helps, too. It signals that the company has invested in regulatory infrastructure. But brand is a heuristic, not proof. Most buyers focus on whether a supplier has a familiar brand name and completely miss the documentation behind it. The question everyone asks is “Is this GMP?” The question they should ask is “How do their QA and QC systems actually interact?”

The same principle applies to a pharmaceutical company such as Appco Pharma. It doesn’t matter what the sign says on the building if QA and QC aren’t actually separated. A small company can have a lean quality system that works. A large CDMO can have thick SOPs and still fumble. The difference is whether people follow the process.

3. Failure Modes: Systemic vs Batch-Level

The most useful way to compare QA and QC in pharma is by what happens when they fail.

QC failure is visible. A test result falls outside spec, an OOS is opened, a batch is rejected. You know the damage quickly.

QA failure is slow. It hides in training records that aren’t updated, suppliers who haven’t been re-audited, deviations closed with weak corrective actions. By the time you see the defect, it has touched ten batches, not one.

Most people think QC is the final safety net. But the real safety net is QA, because QC can only catch what it’s designed to test. If the process is wrong, QC just documents the failure more precisely. Under FDA 21 CFR 211.22 (ecfr.gov), the quality unit has the authority to approve or reject materials and products—but that authority is only as good as the systems around it.

My rule of thumb: when a QC result surprises me, I don’t ask “why did QC miss it?” I ask “why did QA allow this process to exist?” (That question usually makes the room uncomfortable.)

This is where the conventional advice flips. People assume QC is the more rigorous function because it produces data. I think the opposite. QA is harder because it has to prevent problems that are invisible until they aren’t.

4. What Should You Do With This?

If you’re choosing a pharma supplier, or building a quality function in-house, the practical answer depends on your situation.

If you’re buying from a CDMO like Lonza: ask for both QA and QC documentation. Review a certificate of analysis (QC), then ask how deviations and CAPAs are closed (QA). A CoA can be accurate and still tell you nothing about the process that produced the batch.

If you’re a smaller pharmaceutical company like Appco Pharma: don’t start by adding more QC tests. Start by mapping the process, finding where errors can enter, and making sure QA has visibility into production decisions. Prevention costs less than detection.

If you’re automating quality processes: efficiency is a competitive advantage, but only if the process is understood before it’s digitized. We converted our change-control workflow to an electronic system in Q3 2024. The numbers said it would cut approval time by 40%; my gut said the team wasn’t ready. We ran a pilot. Turnaround actually dropped from five days to two, and the audit trail became cleaner. For the first month after go-live, I still second-guessed the decision. The data held up, and the system caught data-entry errors we used to have on paper.

Bottom Line

QA and QC in pharma are not interchangeable. One designs a process to make quality inevitable. The other proves which batch made it. Regulators expect both, but you don’t have to be a regulator to see the difference—you just have to ask which one you’re looking at.

If I could leave you with one image: starch and cellulose are both glucose, but humans can only digest one. A quality system that looks good on paper can still be indigestible if the links are wrong. The next time someone says “we have quality covered,” ask them which part they mean. If they can’t tell you, that’s your first QA gap.