GMP Audit Preparation Guide | Auriga Research

Good Manufacturing Practice (GMP) audits are among the most consequential events in a pharmaceutical manufacturer’s quality calendar. Whether conducted by CDSCO inspectors, WHO assessors, international regulatory agencies, or major customers, a GMP audit evaluates whether your facilities, processes, and quality systems are genuinely capable of producing medicines of consistent quality.

Preparation for GMP audits is not a matter of creating documentation for the inspection — it is about ensuring that what is documented is what is actually practiced, every day. This guide provides a practical framework for audit preparation across documentation, facility readiness, personnel, and quality systems.

What Is GMP and Why Audits Happen

Good Manufacturing Practice is a system of quality controls for the manufacture of pharmaceutical products (and other regulated products including medical devices and food) that ensures products are consistently produced and controlled to quality standards appropriate to their intended use.

GMP is defined and required by:

• CDSCO (India): Schedule M of the Drugs and Cosmetics Rules, 1945, updated per WHO GMP guidelines. Required for all pharmaceutical manufacturers licensed in India.
• WHO: WHO Technical Report Series guidelines (TRS 961 Annex 9 for basic manufacturing, TRS 1010 for water, TRS 992 for sterile products). Required for WHO prequalification.
• US FDA: Current Good Manufacturing Practice (cGMP) — 21 CFR Parts 210 and 211 for finished pharmaceuticals, 21 CFR Part 212 for OTC products.
• European Union: EU GMP — Eudralex Volume 4 Parts I-III, updated with Annexes covering specific manufacturing types.

Why audits happen:

• Regulatory licensing inspections: CDSCO inspects manufacturers periodically and prior to license grant/renewal
• WHO prequalification assessments: Required for manufacturers seeking WHO prequalification of their products
• Customer/buyer audits: Large pharmaceutical buyers (branded companies, government procurement) audit their contract manufacturers and API suppliers
• Pre-approval inspections: Before a regulatory authority approves a new product, they may inspect the manufacturing site

Types of GMP Audits

Self-Inspections (Internal Audits) Systematic internal reviews conducted by trained internal auditors against GMP requirements. Required by all major GMP guidelines. Best practice: comprehensive annual audit covering all GMP elements, plus targeted audits of specific systems or departments.

Regulatory Inspections Conducted by CDSCO (for Indian manufacturers), WHO (for prequalification), US FDA, MHRA, EMA, TGA, and other regulatory agencies. These have legal and license implications. Outcomes include:

• Satisfactory (or Acceptable): No significant findings — proceed
• Warning Letter / Import Alert: Significant findings requiring corrective action
• Suspension / Closure: Critical findings requiring immediate remediation

Customer Audits (Second-Party Audits) Multinational pharmaceutical companies conduct GMP audits of their contract manufacturers and API suppliers. Failed customer audits can result in contract termination.

Third-Party Audits Conducted by independent auditing organizations on behalf of a client or for certification purposes.

Documentation: The Foundation of GMP Compliance

Documentation failures are the most common GMP audit finding. The principle is simple: if it is not documented, it did not happen. And if documentation does not match what actually happens, both are failures.

Standard Operating Procedures (SOPs)

Every manufacturing, quality, and support activity must have an approved, current SOP. Key SOP system elements:

• Controlled document numbering: Every SOP has a unique identifier and version number
• Review and approval: SOPs are reviewed by subject matter experts and approved by appropriate authority (typically QA)
• Periodic review: SOPs are reviewed at defined intervals (typically annually or biannually) for continued applicability
• Training on change: Personnel are trained before implementing changed SOPs; training is documented with signatures and dates
• Obsolete versions removed: Old versions are archived and cannot be accessed in work areas

Audit preparation action: Review your SOP index. Identify:

• SOPs not reviewed within the required period
• Activities that lack SOPs
• SOPs that describe how things should be done but are no longer consistent with actual practice

Batch Manufacturing Records (BMRs)

BMRs document everything that happens during manufacture of a specific batch. They must be:

• Completed contemporaneously (not reconstructed from memory)
• Signed and dated by the operator performing each step
• Reviewed by a second person (two-person check) for critical steps
• Complete — no blank fields, strike-throughs with single line, initials, and date for corrections
• Retained for the period specified by regulation (typically 1 year beyond expiry date of the batch)

BMR preparation: Ensure your BMR templates are current and match current process parameters. Review a sample of recent BMRs for completeness and consistency.

Specifications and Analytical Test Methods

Every raw material, packaging material, intermediate, and finished product requires approved specifications. Methods must be:

• Validated (or verified for compendial methods) with documented validation data
• Stability-indicating (for finished product methods)
• Referenced in the BMR and test request forms

Equipment Calibration and Maintenance Records

All instruments used in quality testing must be calibrated and calibration documented. All manufacturing equipment must be maintained per approved schedules.

Common findings:

• Calibration certificates expired — the instrument was in use but its calibration was not current
• No calibration records for balance or pH meter in production area
• Preventive maintenance schedule not followed

Audit preparation: Pull the calibration schedule for all quality instruments. Identify any overdue calibrations and address before the audit.

Training Records

Personnel training requirements are among the most scrutinized GMP elements:

• All personnel have initial GMP orientation training documented
• Job-specific training for each role documented before the person performs that task independently
• Training on updated SOPs documented before the update takes effect
• Annual refresher GMP training documented
• Training effectiveness is assessed (not just attendance)

Audit preparation: Review your training matrix. Ensure all current employees have current training records for all relevant SOPs. New employees and role changes require particular attention.

Facility Readiness

Environmental Controls

Manufacturing areas for pharmaceutical products require controlled environments — temperature, humidity, air pressure differentials, particulate cleanliness, and microbial monitoring.

Key requirements by area:

• Sterile manufacturing: ISO 5 (Grade A) at critical zones; Grade B background for aseptic processing; Grade C for preparations and container filling
• Oral solid dosage: Classified areas typically Grade D (ISO 8) or better; relative humidity controlled (30-60% typical) to prevent moisture-related degradation
• API manufacturing: Temperature and humidity control; containment for potent compounds

Audit preparation:

• Review environmental monitoring data for the past 6-12 months
• Identify any excursions — were they investigated, root cause found, and corrected?
• Verify HVAC systems are qualified and re-qualification is current

Equipment Qualification

Manufacturing and testing equipment must be qualified before use (installation qualification, operational qualification, performance qualification — IQ/OQ/PQ). Qualification records must be available.

Common findings:

• Equipment in use without completed qualification records
• Requalification not performed after relocation, major maintenance, or parameter change

Water System Validation

Pharmaceutical grade water (purified water, water for injection) systems must be validated and continuously monitored. The water system is one of the most complex and frequently cited areas in pharmaceutical GMP audits.

Audit preparation:

• Review Phase I, II, III validation data (or current continuous validation data)
• Review water quality monitoring results for the past 12 months
• Identify any OOS water quality results and confirm they were investigated and resolved

Personnel Readiness

An audit is partly an assessment of whether your people understand GMP principles and practice them, not just whether your documents say the right things.

Key personnel areas:

Authorized Signatories The Quality Assurance/Quality Control person with product release authority must be able to articulate the release criteria and the basis for their release decision. Auditors often directly question the QA head.

Production Personnel Operators on the floor should be able to describe what they do, why they do it, and where the relevant SOP is. They should not need to check documents for basic, daily tasks.

Training Awareness All personnel should understand basic GMP principles — the why behind the rules, not just the rules themselves.

Audit preparation:

• Brief all staff on the purpose of the audit and what to expect if approached by an inspector
• Remind staff that honest, clear answers are better than guessed answers
• Ensure department heads can present their area’s GMP status with data

Quality System Elements

Deviation Handling and CAPA

Every GMP deviation (any departure from an approved procedure or specification) must be:

• Identified, documented, and classified (minor, major, critical)
• Investigated for root cause
• Corrected (immediate action)
• Subject to CAPA (Corrective Action / Preventive Action) if the root cause indicates systemic issues
• Closed out with effectiveness verification

Audit red flag: A site with few or no deviation records. GMP inspectors know that any manufacturing operation generates deviations. Absence of records suggests they are not being detected and reported — which is worse than having them.

Audit preparation: Review your open CAPA log. Ensure actions are on track, overdue CAPAs have justification for extension, and closed CAPAs have effectiveness verification.

Change Control

All changes to manufacturing processes, specifications, equipment, facilities, and methods must go through formal change control:

• Change proposed and documented
• Impact assessment (what could this change affect?)
• Approval by appropriate functions (QA, regulatory, technical)
• Implementation plan
• Post-change verification

Unauthorized changes — even ones that “improved” the process — are major GMP findings because they bypass the risk assessment process.

Annual Product Reviews / Product Quality Reviews

Comprehensive review of each product’s quality data over the past year — batch yields, OOS results, stability data, complaints, deviations, returns. Required under WHO GMP and most regulatory frameworks. Must be completed on schedule and documented.

How Third-Party Testing Supports GMP Compliance

Contract testing laboratories play a specific role in supporting pharmaceutical manufacturers’ GMP compliance:

Raw material testing: When manufacturers use external labs for incoming material testing, those labs must be qualified suppliers with appropriate accreditations (NABL, GLP as applicable). Supplier audits of the testing laboratory may be required.

Finished product testing: Some manufacturers use contract laboratories for finished product release testing or stability testing. The contract laboratory must meet the same GMP and documentation standards as an in-house laboratory.

Method transfer and validation: When transferring methods to a new site or contract lab, a formal method transfer study is required. The receiving lab must demonstrate equivalence to the originating lab.

Stability testing: Contract stability testing (ICH-compliant conditions, stability-indicating methods, regular time-point testing) supports regulatory dossier preparation and shelf life assignment.

Auriga Research’s pharmaceutical testing services are conducted under a GMP-compliant quality system, supporting pharmaceutical manufacturers with contract analytical testing, stability testing, and method validation services. Our facilities include GMP-compatible analytical areas, and our documentation meets the standards required for regulatory dossier support.

Request a pharmaceutical testing quote to discuss how contract testing can support your GMP compliance program.

Conclusion

GMP audit preparation is ultimately about ensuring your quality system is genuinely operational, not just documented. The key elements — complete and current documentation, qualified facilities and equipment, trained personnel, and functioning quality systems (deviation handling, CAPA, change control) — must be verified systematically before an audit, not assembled in haste.

The best GMP audits are the ones that confirm what your internal self-inspection program already knows: that the site is operating in compliance. Building a culture where GMP is practiced every day, not just during audit preparation periods, is the only sustainable approach to inspection readiness.