Statistical Process Control (SPC) Compliance

Statistical Process Control compliance governs how organizations implement, document, and maintain data-driven monitoring systems that distinguish normal process variation from signals requiring intervention. Across regulated manufacturing, healthcare, aerospace, and food safety sectors, SPC requirements appear in federal agency mandates, ISO standards, and customer-specific quality plans. Failure to maintain compliant SPC systems creates exposure to nonconformance findings, regulatory citations, and production shutdowns.

Definition and scope

Statistical Process Control is a methodology that uses control charts, sampling protocols, and defined statistical rules to monitor process performance over time. In a compliance context, SPC is not simply a tool — it is a documented system subject to audit, validation, and traceability requirements imposed by regulatory bodies and standards organizations.

The scope of SPC compliance extends across industries with measurable output characteristics. The FDA's 21 CFR Part 820 Quality System Regulation for medical devices explicitly references statistical techniques as a required element of process validation and production monitoring. AIAG (Automotive Industry Action Group) publishes the Statistical Process Control reference manual — now in its second edition — which automotive OEMs including General Motors, Ford, and Stellantis incorporate by reference into supplier quality requirements. ISO 9001:2015, administered through the International Organization for Standardization, requires organizations to determine when statistical methods are appropriate and to deploy them as part of quality assurance standards.

SPC compliance does not apply exclusively to high-volume manufacturing. Clinical laboratories operating under CLIA (Clinical Laboratory Improvement Amendments, administered by CMS) must run control charts on test equipment as a condition of certification. Aerospace suppliers working under AS9100 Rev D face SPC requirements when customers designate key characteristics on engineering drawings.

How it works

A compliant SPC system operates through five discrete phases:

1. Characteristic selection — Engineering, quality, and regulatory teams identify which product or process characteristics will be monitored based on risk, regulatory designation, or customer requirements. Key characteristics are typically flagged on control plans or engineering drawings.
2. Measurement system analysis (MSA) — Before data collection begins, the measurement system must be validated. AIAG's Measurement System Analysis reference manual defines Gage R&R (Repeatability and Reproducibility) studies; acceptable thresholds are generally below 10% variation attributed to the measurement system.
3. Control chart selection and setup — Chart type is determined by data type. Variables data (continuous measurements) uses X̄-R or X̄-S charts; attribute data (counts of defects or defective units) uses p-charts, np-charts, c-charts, or u-charts. The control plan, a document required under APQP (Advanced Product Quality Planning), records the chart type, subgroup size, and sampling frequency.
4. Ongoing monitoring and reaction — Operators or automated systems plot data and apply detection rules. The Western Electric Rules — codified in the Statistical Quality Control Handbook originally published by Western Electric Company — define eight patterns signaling non-random variation, including a single point beyond 3 sigma, two of three consecutive points beyond 2 sigma on the same side, or eight consecutive points on one side of the centerline.
5. Documentation and records retention — Control charts, out-of-control actions plans (OCAPs), and corrective action records must be retained per regulatory and customer requirements. Documentation requirements under ISO 9001 and FDA 21 CFR Part 820 mandate that records remain retrievable for defined periods, often a minimum of two years for medical devices under 21 CFR 820.180.

Common scenarios

Automotive supplier audits — During IATF 16949 surveillance audits, auditors examine control plans, verify that control charts are posted at the point of use, and confirm that operators can explain reaction procedures. Missing OCAPs or charts showing persistent out-of-control conditions without documented corrective action result in major nonconformance findings.

FDA inspection of medical device manufacturers — FDA investigators reviewing 21 CFR Part 820 compliance examine whether statistical methods are validated, whether process performance indices (Cpk) meet specified thresholds, and whether out-of-specification events triggered corrective action under CAPA procedures.

Pharmaceutical process validation — FDA's Process Validation: General Principles and Practices guidance (2011) requires continued process verification using statistical tools during Stage 3 validation. Manufacturers must demonstrate that processes remain in a state of control across commercial production, using control charts as primary evidence.

Aerospace key characteristic management — AS9100 Rev D Section 8.5.1 requires organizations to control key characteristics. Boeing and Airbus supplier requirements specify Cpk minimums — typically 1.33 for established processes and 1.67 for new or critical characteristics — and require documented SPC plans as part of first article inspection packages.

Decision boundaries

SPC compliance decisions rest on two distinct boundaries that operate independently:

Statistical boundaries (control limits) are calculated from process data — set at ±3 standard deviations from the process mean — and signal whether a process is in statistical control. These are not specifications; they reflect process behavior, not product acceptability.

Specification boundaries (tolerance limits) are engineering-derived and define acceptable product. A process can be in statistical control yet produce nonconforming product if the distribution is centered away from nominal or if spread exceeds tolerance. This distinction separates process capability analysis (Cp, Cpk) from control chart interpretation.

Process capability indices quantify the relationship between statistical behavior and specification boundaries. Cpk below 1.00 indicates the process is producing nonconforming output at a measurable rate; Cpk of 1.33 corresponds to approximately 63 defects per million opportunities at the process mean. Cpk at 1.67 corresponds to approximately 0.57 DPMO under normality assumptions.

Compliance failures most commonly arise from three sources: using control limits as specification limits, failing to re-calculate control limits after verified process changes, and applying Western Electric detection rules without documenting which rule set governs the control plan. The regulatory framework governing SPC in any specific sector determines which of these failures triggers a formal nonconformance versus an observation.