Configuring Quality Teams (QMS)

Admins can create and configure Quality Teams and Quality Team Roles to suit their needs. For example, a Change Control might require three team roles to work through from start to finish: a “Change Owner”, a “Lead QA Engineer” and “Subject Matter Experts”. Using Quality Teams allows you to dictate that every created Change Control requires exactly one “Change Owner”, exactly one “Lead QA Engineer” and between zero and five “Subject Matter Experts” in order to begin work.

Quality Teams allow users to make individual work assignments to individual Change Controls, Audits, CAPAs, or other Quality Event-related processes. Users define these assignments directly from the record detail page by selecting individual user assignments from a list of users authorized to perform that role on that record. Quality Teams integrates with object record sharing settings, allowing for a simple experience without sacrificing critical compliance tools.

How Quality Teams Work

You can create a Quality Team for any non-system object, with some limitations, that does not already have a Quality Team configured. In objects which have object types, you can configure a Quality Team for either:

• A single object type; or
• All object types which do not have a specific Quality Team definition

When defining Quality Teams, you can configure options such as lifecycle state changes that can trigger automated events. You can also lock the membership of all team roles in selected lifecycle states. For example, you might define a procedure dictating that all Change Controls are created in a “Pending Team Assignment” state that has no associated workflows. You can then configure Vault to automatically move the Change Control into the Initiated state of its lifecycle once the “Change Owner” and “Lead QA” have both been selected. The team completion can even start a workflow, assigning tasks to the team members defined.

Creating Quality Teams

How to Create a Quality Team Definition

1. Navigate to Admin > Configuration > Quality Teams.
2. Click Create.
3. Enter a Label and Name.
4. Select a Status. If you set a team to Inactive, Vault retains the team and role configuration, but the team won’t appear on associated object records. If you reactivate the team later, or create a new team for the same object and role, Vault preserves any team member assignments. This option can be helpful during initial configuration or in the event that you no longer want to use this team.
5. Select an Object that this Quality Team applies to. If the object has types, you can select an Object Type. Once you create a Quality Team, you cannot change this option. You can have only one Quality Team active per object or type (if the object is typed).
6. Optional: Select the Change record state when team is complete checkbox. See details.
7. Optional: Select one or more Locked States. See details.
8. Click Save. Vault takes you to the newly-created Quality Team definition page.

Once you create the Quality Team, Vault updates the relevant object page layouts with a Quality Team Members section. This page layout section shows team assignments and allows authorized users to select users for roles. We recommend editing your object page layout to make this section the first or second section on the page.

If associated object records exist before you configure a team and team roles, they will have Quality Team sections without assigned members after you configure the team.

Note that you cannot edit the Quality Team definition while creating or reordering Quality Team Roles.

Change Record State when Team is Complete

Select this checkbox, a Start State, and a Destination State to move an object record to a new state upon completion of the minimum Quality Team membership. This state change will also trigger any associated automated events, such as auto-starting workflows. Vault completes this event for an object record when:

• The team has at least one team role which with a Minimum Required Users of at least one (1);
• All roles which have the Minimum Required Users defined have that number of assignments; and
• A user updates the team members and the record is in the defined Start State

Locked States

When the associated object record is in one of these specified locked lifecycle states, no user in the Vault may make changes to the membership of this Quality Team, including Vault Owners. Additionally, team-enabled records in locked states will not raise alerts for invalid or incomplete team assignments. This option is intended for end-of-life states of records’ lifecycles, where assignment information must be retained.

How to Delete Quality Teams

You cannot delete a Quality Team definition if any record which uses that team has any team member assignments. To delete a Quality Team definition, you must first remove all Quality Team members on all records which use it. To simplify this process, an Admin can use the Power Delete Quality Team Members record action, or make it available on the appropriate team enabled object.

Creating Quality Team Roles

After defining your Quality Team, you can also create Team Roles. Vault associates team roles directly with Application Roles, and you can configure these with several options.

How to Create a Quality Team Role

1. Navigate to Admin > Configuration > Quality Teams and select the Quality Team for which you wish to create roles.
2. In the Team Roles panel, click Create.
3. Enter a Label and Name.
4. Select a Status.
5. Select an Application Role. Quality Team members with this team role are added to the selected Application Role on the object record. You cannot change this once you save the Team Role. See the limitations for Application Roles that can be assigned to a Quality Team Role.
6. Optional: Enter Help Content. This will appear to all users who hover over the role label in the Quality Team section of the associated object record detail page. You can use this text to provide clarity around who you can or should select for a role.
7. Optional: Select the Minimum Required Users for this role. If you do not select a number, or if you select a minimum of zero (0), this role is optional, and the Quality Team membership may be completed with this role unassigned. To make a role’s membership conditionally optional based on business logic, you can select a minimum of zero (0), then leverage the relevant entry criteria configuration options.
8. Select the Maximum Users that can be assigned to this role.
9. Optional: Select the Exclusive Membership? checkbox to make the role’s membership exclusive. A team member in an exclusive role may not be a member of any other role on the same team for a given object record. You can configure further limits on role exclusivity using role membership restrictions.
10. Optional: In the Linked Field drop-down, select a User object reference field on the team-enabled object. The value of the selected field is be linked to the User assigned in this Quality Team Role on records of that object. This option can only be used if this role definition has a Maximum Users value of one (1). See details about linked User fields.
11. Optional: Select a Constraining Application Role to allow Vault to populate the Quality Team assignment options with only users in the selected role. Note that to prevent a role from becoming unfillable, you cannot constrain an Application Role by itself. Constraining roles may be populated by matching or custom sharing rules.
12. Optional: In the Inherit Behavior field, select Inherit to allow this role to check the value of the configured Inherit From field on this role. See details about inherit behavior below.
13. Optional: Select a role to Inherit From. This field is required if you selected the Inherit Behavior. This field identifies how this team role finds a record to inherit its membership from.
14. Optional: If you selected the Inherit from Quality Event option in the Inherit Behavior field, then in the Inherit From Quality Events field, select one or more objects. Team-enabled objects for which there is an outbound reference field on this Quality Team’s object are available for selection. Records can only inherit their team role memberships from a single record at a given time, thus this function is only supported for records which only have one of the selected fields populated. Use this function for sub-processes which are commonly shared across various types of events, such as Effectiveness Checks or Extension Requests, in Vault configurations using standalone objects for their types of events, such as Deviations or Complaints.
15. Optional: Select Locked States. While an object record is in a defined locked state, no Vault user can edit or change this role’s membership, including Vault Owners.
16. Click Save. Vault creates the Team Role and associates it with its parent Quality Team.

The new role appears in the list at the bottom of the Quality Team definition page. Vault immediately adds the role to all existing records for the associated object.

Note that if users can change membership while a Quality Team Role’s workflow tasks are active, Admins should design the workflow to handle a lack of verdict due to task cancellation.

About Inherit Behavior

The Team Role checks for a value in the Inherit From field in these cases:

• You select the Inherit behavior in the Inherit Behavior field
• On record creation
• A user clicks Restore while managing a team

If the value of the field is an object record with a Quality Team definition, this Team Role will inherit the membership from that record’s team’s role (matched based on having the same Application Role configuration). If no such record exists, the record has no team, the record’s currently assigned team is invalid, or the record’s team has no role linked to this Team Role’s application role, no defaulting will occur.

The following behaviors apply with role inheriting enabled:

• Users can still manually edit a Team Role’s membership
• The Restore option is available for users managing the team
• Changes to the linked object record’s Team Role membership cascade down to the record’s team role unless membership of this role has been manually changed.

How to Reorder Quality Team Roles

If you have created more than one role for the Quality Team, their order on the Quality Team definition page matches the order of roles in the Quality Team section on the associated object records.

To rearrange roles, click Reorder. Then, click and drag the roles by their shaded top left corner. Click Save to save your changed, or Cancel to exit without changing the order. Note that you cannot create or reorder roles while editing the Quality Team definition.

Linked Role Fields

Using the Linked Field option in a team role definition can allow Quality Team Role assignments to appear in related lists, searches, filters on library views, reports, and elsewhere in Vault that a User object reference field may be accessible. Once linked to a team role, users or mechanisms may not update a given object reference field, other than via edits to the linked Quality Team Role. See the limitations for this option before deciding to implement it in your Vault.

When you change the linked team role’s membership on a given team-enabled object record, Vault updates the record’s linked field to reflect the new team role membership. The field update is asynchronous; if you change the team on a record, the linked field is updated soon after, but not instantly.

Enabling Linked Role Fields for Quality Teams

To enable linked user field functionality:

1. Create an object reference field, referencing the User object, on the team-enabled object. If that object supports types, be sure to associate the field to the same type of object that your team is defined for.
2. Add the field in the Linked Field drop-down of the team role definition.

Because this field’s functionality may not be apparent to users viewing the team-enabled object record, we recommend the following:

• Do not add the linked role field to the team-enabled object page layout, or configure security to prevent users from trying to manually edit the linked field. Once linked to a role, Vault will prohibit edits to the field value, and there’s no need to present fields as editable to your users if they’re not actually editable.
• Select the Display on default lists and hovercards object field configuration setting to expose the team role in hovercards throughout Vault.
• Define Help Content for the linked field so that users know they can’t manipulate the Quality Team assignments by changing the field’s value.

Adding Linked Role Fields for Existing Team Role Assignments

Once enabled for objects that already have records with role assignments, Admins may choose an update strategy to update existing records’ fields to match their pre-existing assignments’ values. When updating existing records, affected records may have their linked field’s values changed and Vault updates their modified-date and modified-by information accordingly.

This step is optional. If your organization chooses to keep pre-existing records untouched, you may skip this step. If you wish to update pre-existing records, Vault provides the following methods:

• To blanket update all records which use a given team, click the Sync linked role fields button on the Quality Team definition. This button appears once you select a Linked Field in one of the team’s role definitions. The button starts an asynchronous process to update records with the affected team assignments, linking their values. Vault sends you a notification email including the results of the process in a log file.
• To more precisely update individual or a subset of records using a given team, a similar action is also available as a standard record action: Sync Linked Role Fields, to be enabled and run on desired team-enabled record. You might use this record action if there are applicable team-enabled records that you do not want to update. For example, if they are already closed or locked.

Sync Linked Role Fields Job Log

The Sync linked role fields process provides a job log, which lists the following information:

• Each team-enabled record that had an assignment
• Whether or not Vault successfully updated the team-enabled record
• Errors encountered

The job skips any records that it cannot update. For example, suppose a role definition had a Maximum Users value of more than one (1), then an Admin changed that Maximum Users value to one (1) prior to adding a value to Linked Field. If there were existing records with teams that have more than one (1) assignment in that role, then the job would not be able to sync the linked role fields for those assignments or records and would log that error in the resulting job log.

Limitations for Linked Role Fields

The following limitations apply to linked role fields:

• The Maximum Users value in the Quality Team Role definition must not be more than one (1).
• A team role can only be linked to a single field.
• While a single linked role field can be linked to several teams, only one role on a given team can be linked to the same field.

About Locked States

Both Quality Team definitions and Team Role definitions include options for selecting Locked States. These states prohibit change to the respective Quality Team or Team Role membership assignments, even by Vault Owners. These options are intended for record end-of-life states, where assignment information must be retained.

Creating Role Membership Restrictions

After defining Team Roles for a Quality Team, you can also create Role Membership Restrictions. In contrast with the Exclusive Membership? checkbox available on a Team Role record, using Role Membership Restrictions allows for team role assignments to be limited among specific existing roles within a Quality Team. A Quality Team must have a minimum of two active Team Roles defined for this section to appear.

How to Create a Role Membership Restriction

To create role membership restrictions:

1. Navigate to Admin > Configuration > Quality Teams and select the Quality Team.
2. Click Edit.
3. In the Role Membership Restrictions panel, click Add Restriction. This button only appears if at least two active Team Roles exist which do not have Exclusive Membership? enabled.
4. Select a Role. If a Team Role has Exclusive Membership? enabled, it will appear in the list of roles but you cannot select it.
5. Select a value for Is Exclusive With. You cannot assign a team member in the role indicated in the Role field to the role indicated in this field.
6. Select a Status. If the status is set to Inactive, Vault does not apply the defined behavior to existing records for the associated object.
7. Click Save. Vault automatically creates an inverse relationship between the indicated roles. A team member in the role specified in the Is Exclusive With field will be unable to be assigned as a member of the Role field within the same Quality Team.

The new Role Membership Restriction appears in the list at the bottom of the Quality Team definition page. Vault automatically applies the restriction to all existing records for the associated object. Editing the Quality Team record will allow for the creation of new restrictions, and edit or delete existing restrictions.

Securing Related Objects

A Quality Team is used to manually assign users to roles for a specific process record, which may have relationships to other object records that are not Quality Team-enabled. By default, only the user who created those records can edit or delete them. The Related Objects to Secure option within a Quality Team definition can allow more flexible edit access to non-Quality Team-enabled records in cases where users are removed from a Quality Team for the main record.

For example, in a Deviation record, if the Owner adds a related Asset record to the Deviation - Asset section and then, while the deviation is still in revision, the Owner leaves the organization. Any newly-assigned Owner will be unable to edit or delete, as they would lack the necessary Sharing Settings roles on the Asset record.

Defining Related Objects to Secure

To define related object to secure on a Quality Team definition:

1. Navigate to Admin > Configuration > Quality Teams and click into a Quality Team definition.
2. Click Edit.
3. In the Related Objects to Secure section, click + Add Object.
4. Select the Related Object for which to define the security mapping.
5. Select the Outbound Reference Field from the related object which references the Quality Team-enabled object.
6. Select the Quality Team Role on the Quality Team-enabled object which defines the mapping.
7. Select the Application Role which defines the access that the Quality Team Role should possess.
8. Select a Status, either Active or Inactive. Inactive mappings will not provide any access to the related record.

You can repeat these steps to add more mappings to Quality Team Roles.

For example, on a Deviation record, the following Related Objects to Secure definition would provide the Owner team member with an Owner role in the Sharing Settings of any related Deviation - Asset records:

• Related Object: Deviation - Asset
• Outbound Reference Field: Deviation
• Quality Team Role: Owner
• Application Role: Owner
• Status: Active

Power Delete Quality Team Member Assignments

During Quality Team configuration and testing you may need to delete a team’s membership assignments on a record in order to make changes to the Quality Team’s structure or behavior, however, it may be necessary to preserve the team-enabled record itself. For example, you need to remove a Quality Team role even though there are records that have team member assignments for that role, and those records are critical to preserve as they are part of your environment’s test data setup. By default, Vault does not allow you to remove the role (or team) from the configuration of your Vault until all team members have been individually removed from all records.

The Power Delete Quality Team Members record action completely clears a Quality Team’s membership assignments for a specific record while preserving the record itself. The action deletes membership assignments only on the current record, regardless of the team or role’s inherit configurations. This action also deletes orphaned membership assignments caused by, for instance, changing the type of a Quality Event record that already has Quality Team membership assignments.

How to Configure Power Delete

You must set up this action individually for each object where you will want to use it. To configure the Power Delete Quality Team Members record action:

1. Navigate to Admin > Configuration > Objects and click into the intended object.
2. In the Actions tab, click Create.
3. In the Create Action dialog, select Power Delete Quality Team Members in the drop-down.
4. Click Continue.
5. Optional: Select the checkbox Available in All Lifecycle States to make the record action available in all lifecycle states. If selected, Admins can configure Atomic Security to further restrict access to the Power Delete Quality Team Members record action.
6. Click Save.
7. Optional: If Available in All Lifecycle States was selected, make selections in the Atomic Security dialog box for object lifecycle states in which this action should be available, then click Save.

The Power Delete Quality Team Members record action should now be available on related object records. Note that by default, enabling this record action makes it available on base object types only. You can enable it for additional object types in the Object Types tab.

Deletion Behavior for Records with Quality Team Assignments

While record deletion in Quality Vaults is not common, typically occurring only in a non-production environment, Vault supports the deletion of a record’s assigned Quality Team members automatically whenever a team-enabled object record is deleted.

Vault QMS includes additional support for deleting groups of related team-enabled records where the inheritance of team members from a top-level record to lower-level process records may be present. Depending on your Vault’s configuration, users with permissions to delete a team-enabled object record may be able to delete the team-enabled record, its assignments, and records related to the team-enabled record and their associated Quality Team assignments with a single delete action. This supports testing environment actions like deleting a Change Control and its related Change Action records, as well as all related Quality Team member assignments, with a single click.

When a user deletes a team-enabled object record with Quality Team assignments, Vault respects the object relationship’s deletion rule behavior to determine how other related records should or should not be affected. If the deletion rules indicates to delete the related record, Vault deletes both the related record and its associated Quality Team Role assignments. If the deletion rules permit the related records to exist without the team-enabled record itself, then only the team-enabled record and its assignments will be deleted, with the remaining related records and their assignments unaffected.

Reporting on Teams

You can report on your Quality teams and team members to easily assess scope and efficiency. Navigate to Admin > Configuration > Report Types to set up team member reporting. See About Report Types for more information.

Limitations

• A Vault can contain up to 100 Quality Teams. Each Quality Team can contain up to ten (10) team roles. Each team role can have a maximum of 20 members.
• Vault does not support Quality Team roles linked to Sharing Settings roles that use rule-based groups (Dynamic Access Control and custom and matching sharing rules).
• Vault does not allow the establishment of new team roles against a sharing settings role with any rules, but does not prevent Admins from adding such rules to already established roles that already have team roles for.
• In the event that an Admin adds rules to a team role’s application role, end-users will receive an error when they attempt to Manage Team on any object record using that team.
• You cannot create a Quality Team for an object that has more than one parent object reference, nor can you create a Quality Team for an object under two or more levels of parent object relationships.
• Vault does not allow configuration of a Quality Team for a child object.

The following standard Application Roles cannot be selected for a Quality Team Role:

• Owner
• Process Viewer
• Document Change Control Approver
• Document Change Control Reviewer
• Trainee
• External Collaborator (Audit)
• Learner
• Direct Manager

Related Objects & Terms

• Team-Enabled Object: An object you have defined a team for.
• Team-Enabled Record: An object type record that leverages a team.
• Quality Team Members Object: A system-managed object that Vault creates when you create a team. It stores the team role assignments of users for specific team-enabled records.
• Quality Team: This component defines a Quality Team you’ve created in your Vault. It defines the structure of the team by associating Quality Team Roles and team behavior as a team-enabled record moves through its processes. It is associated to an object or object type in order to declare records of that object or object type to use a team.
• Quality Team Role: A role defining which security rights members have and by which role they are constrained. This component defines the roles that are available or required for object records leveraging the associated Quality Team (Change Owner, Primary Investigator, QA Approver, etc). These roles link to sharing settings roles such as Owner, Reviewer, and Editor. The component further defines the behavior of these roles. For example, you can define the minimum number of users required to complete a team, the maximum number of users allowed on a team, and whether or not you can select users from any group in the Vault or from a specific role on the team-enabled record.
• Quality Team Role Membership Restriction: A component defining a Role Membership Restriction that defines Team Role exclusivity within a specific Quality Team. These restrictions are defined manually, with Vault establishing a bi-directional relationship between two roles that are exclusive to one another. For example, you can define a restriction that does not allow a user with the Owner role to be assigned as the Approver. Because of the bi-directional role relationship, Vault also automatically restricts the user given the Approver role from being assigned as the Owner without having to define an additional restriction.

Related Permissions

To view the team members section, a user requires Read permission on the relevant team-enabled object.

To add, remove, or otherwise manage Quality Team members, a user requires Edit permission on the relevant team-enabled object.

The ability to edit Quality Teams on team-enabled objects in a given lifecycle state also depends on the lifecycle’s Atomic Security on Relationships or locked state configuration.