Corpex-eQMS runs the pharmaceutical quality system an SFDA inspector asks about: deviations, CAPA, change control, complaints, product quality review, training, supplier qualification, self-inspection and management review. It installs on your own servers or private cloud inside the Kingdom.
Or meet us in Riyadh during CPHI Middle East, 26–28 April 2027.
On 12 May 2023 the SFDA announced that it had been admitted to the Pharmaceutical Inspection Co-operation Scheme, the first Arab authority to join. The PIC/S member list shows the SFDA as a participating authority from July 2023. The SFDA says membership makes it a reference authority for inspecting pharmaceutical factories and builds other members' confidence in its inspections, which helps Saudi exports.1
The base is growing. In January 2026 the SFDA reported an 18% rise in licensed factories and warehouses in 2025: 9,155 facilities against 7,750 in 2024. That figure covers every sector the SFDA regulates, not drugs alone.2 In December 2025 it held a Generic Drugs Conference in Riyadh under the theme “Empowering Local Pharmaceutical Manufacturing”, and the National Biotechnology Strategy of January 2024 sets a localization track for biologics and biosimilars.3 A new Saudi plant, or an existing one preparing for biologics or more generics, has to show an inspector a working quality system from its first batch.
Nine areas of the pharmaceutical quality system, with the clause of the SFDA Guide to Good Manufacturing Practice that sets the expectation and the Corpex-eQMS module that holds the record.
Root cause proportionate to risk
The guide asks for an appropriate level of root cause analysis on deviations and suspected defects. Corpex-eQMS holds the event, impact, investigation and root cause on one record, with e-signed approval at each decision. Deviation management
Actions whose effect is monitored
CAPAs must be taken in response to investigations and their effectiveness monitored. Each CAPA links to its source record and carries an effectiveness check with a result of effective or not effective. CAPA
Evaluated before and after
Planned changes are evaluated and approved before implementation, then checked afterwards. The register keeps the impact assessment, a linked risk assessment, the implementation plan and final approval. Change control
Investigation, root cause, CAPA
Chapter 8 covers complaint handling, investigation, root cause analysis and recalls. The complaint register runs the investigation and raises a CAPA; the recall decision itself stays in your procedures. Complaints
Normally documented annually
The review verifies process consistency and trends. Corpex-eQMS builds it from the deviations, complaints, CAPAs and changes in the system, plus batch data imported from Excel. Product quality review
Staff whose work affects quality
Training for everyone whose duties touch production, storage or the laboratory. A new document version raises read-and-acknowledge or exam retraining, and the matrix shows overdue staff by role. Training
Selection, approval, maintenance
Supplier qualification is expected to be documented within the quality system. The register shows each supplier's approval status, audits and responses, with a next-due date. Supplier management
Pre-arranged programme, recorded
Self-inspections follow a programme, are recorded with observations and corrective proposals, and the actions taken are recorded too. Audit plans, checklists, observations and CAPA replies live together. Audit management
Periodic, senior management
A periodic review of the quality system by senior management. The yearly plan, numbered meetings, agenda and KPIs computed from deviations, CAPA, change and risk are frozen with each review. Management review
Clause numbers are those of the SFDA Guide to Good Manufacturing Practice for Medicinal Products, version 4.4. Corpex-eQMS holds the records; the procedures, decisions and sign-offs remain your quality unit's.
The SFDA guide uses the same nine-chapter structure as Part I of the PIC/S GMP Guide (PE 009), so the table works for both. An eQMS is not a production or laboratory system; the gaps point to the other Corpex products.
| Chapter | Subject | Corpex-eQMS |
|---|---|---|
| 1 | Pharmaceutical quality system, PQR, quality risk management | Deviations, CAPA, change control, risk management (ICH Q9(R1) terms), management review, product quality review |
| 2 | Personnel and training | Training management: curricula, retraining on new document versions, training matrix |
| 3 | Premises and equipment | Equipment only: maintenance and calibration with asset register, plans, work orders and calibrated instruments. Premises are not covered |
| 4 | Documentation | Document control: controlled register, e-signed approval, controlled copies, periodic review. Batch records belong in Corpex-EBR |
| 5 | Production | Not covered. See Corpex-EBR; deviations raised on the floor can carry an eQMS reference |
| 6 | Quality control | Not covered. See CORPEX LIMS |
| 7 | Outsourced activities and suppliers | Supplier management: approval status, audits, findings, evaluations |
| 8 | Complaints and product recall | Complaint register with investigation and CAPA, customer feedback |
| 9 | Self-inspection | Internal audit programmes, plans, checklists, observations; external and regulatory audits |
| Annex 11 | Computerised systems | See the data-integrity section below |
The deviation moves through eight stages, from open to closed. Final approval raises the CAPAs that must be done before closure, and an effectiveness tab records whether they held.
The PQR has 16 sections, each with regulatory references (PIC/S PE 009 and others) shown against it. Batch data is frozen at submission with a SHA-256 hash, and the report prints with the signatures of everyone who approved it.
When a procedure changes, staff are retrained on the version they work to. The self-inspection programme then checks it, and any finding goes to a CAPA.
Annex 11 of the SFDA guide applies to every computerised system used in a GMP activity. It asks for risk-based validation, audit trails that are reviewed, controlled changes, periodic evaluation and restricted access. SFDA’s data-integrity expectations sit in Annex 11 and Chapter 4 of the GMP guide, which asks regulated users to define which electronic data count as raw data.
Changes and deletions, with reasons
Each audit row stores a SHA-256 of the previous row, with the user, time, old and new value and reason. Seals of the chain are HMAC-signed and kept outside the database.
Access limited to authorised people
Role-based access per module, password rules, lockout after failed sign-ins and idle sign-out.
Attributable and bound to the record
Signing re-enters the password and records a meaning and reason. The signature is refused for the person who produced the record.
Risk-based, documented
The Corpex team supplies validation document templates (URS, functional specification, IQ, OQ, PQ and a traceability matrix) under GAMP 5. See CSV services.
Procedures you own
Annex 11 asks for controlled changes and periodic evaluation of the system. Both are your procedures; the change control module records a change to the system like any other change.
Never in place
Entries are attributed to the signed-in user, terminal statuses are locked, and corrections are made by new version.
Compliance belongs to the validated system and the procedures around it. Corpex-eQMS supplies the technical controls and the Corpex team supplies validation document templates for your own validation.
Corpex-eQMS is not a hosted service. We install it on servers in your own data centre or in a private cloud you control inside Saudi Arabia, so the quality records, the audit trail and the uploaded evidence stay where you put them.
That matters for personal data. An eQMS holds names, job roles, training records, signatures and complainant details. The Personal Data Protection Law applies to processing of personal data in the Kingdom, and SDAIA publishes a separate regulation for transfers outside it.4 Keeping the system on your own Saudi infrastructure removes the question of an outside host. It is a fact about how the product is installed, not a certification: your legal team still decides what your own PDPL obligations are.
On-premise or in your own cloud tenancy in the Kingdom. No subscription and no vendor-hosted copy.
A new site can start with document control, deviations and CAPA, then add change control, audits and PQR as the system grows.
Configuration, data migration, training and validation delivered by the Corpex team, then supported after go-live.
The screens on this page are the English interface of Corpex-eQMS. Corpex is based in the New Capital, Egypt, and serves pharmaceutical manufacturers across the region.
Laboratory results, out-of-specification investigations and stability data for SFDA-licensed manufacturers.
Recipes, dispensing, signed execution and exceptions on the shop floor.
All modules, the workflow engine and the full compliance mapping.
Book an online demo and we will walk one deviation from report to closed CAPA. Or meet us in Riyadh during CPHI Middle East, 26–28 April 2027.
Book an online demoYes. The SFDA announced its admission to PIC/S on 12 May 2023 as the first Arab authority to join, and the PIC/S member list shows it as a participating authority from July 2023. The SFDA says membership makes it a reference authority for inspecting pharmaceutical factories. The SFDA GMP guide keeps the nine-chapter structure of Part I of the PIC/S guide, so the same quality-system records are what an inspector asks to see.
The SFDA Guide to Good Manufacturing Practice sets out the expectations: root cause analysis and CAPA with effectiveness monitoring, evaluation of changes before and after implementation, complaint investigation, an annual product quality review, training for staff who affect quality, documented supplier qualification, a recorded self-inspection programme and periodic management review. Corpex-eQMS holds the records for each of these in one system.
Annex 11 of the SFDA guide asks for risk-based validation, reviewed audit trails, controlled changes, periodic evaluation and restricted access. Corpex-eQMS supplies the technical controls: a hash-chained audit trail, e-signatures that re-authenticate, role-based access, lockout and idle sign-out. Compliance belongs to the validated system and your procedures, and the Corpex team supplies validation document templates under GAMP 5. We do not claim an SFDA certification of the software.
Yes. It is installed on your own servers or in a private cloud you control in the Kingdom, never as a vendor-hosted service. The Personal Data Protection Law applies to processing of personal data in the Kingdom, and SDAIA publishes a regulation for transfers outside it. Hosting on your own Saudi infrastructure keeps the data where you put it. That is a deployment fact, not a PDPL certification.
No. In the PIC/S Part I structure the eQMS covers the quality system chapters: quality system and PQR, personnel and training, equipment maintenance, documentation, suppliers, complaints and self-inspection. Production (Chapter 5) and quality control (Chapter 6) belong to the batch record and the laboratory system. Corpex offers EBR and LIMS for those and they work alongside the eQMS.
The screens shown on this page are the English interface of Corpex-eQMS. If Arabic is a requirement for your site, raise it when we meet so we can answer for your specific scope rather than assume.
No. CORPEX Informatics is based in the New Capital, Egypt, and serves pharmaceutical manufacturers across the region. We run demos online, and will be in Riyadh during CPHI Middle East, 26 to 28 April 2027.
