GMP inspection readiness: what inspectors examine and how to prepare

What is a GMP inspection?

A GMP inspection verifies that a site manufactures medicines in line with Good Manufacturing Practice and holds a state of control across quality, facilities, materials, production, packaging, and the laboratory. It is conducted by agencies including the US FDA, EU authorities (EMA and national bodies), the MHRA, WHO Prequalification, India's CDSCO and state FDAs, ANVISA, TGA, and PMDA. Procedures differ; expectations converge, so a site should build to the strictest standard that applies to its markets.

What are the types of inspection?

• Routine / surveillance GMP: periodic verification across all systems. Recent deviations, CAPAs, and changes get attention.
• Pre-approval inspection (PAI): tied to a specific application. Focus on data integrity of the submission batches, process validation, and whether the filed process matches the commercial process.
• For-cause: triggered by a complaint, recall, field alert, or signal. Narrow, deep, and adversarial.
• Records request / distant assessment: documents reviewed remotely. Retrieval speed and the quality of written records carry the assessment.

What systems does an inspector examine?

Most GMP inspections are organised around six systems:

• Quality: deviations, CAPA, change control, complaints, recalls, APQR, management review, internal audits, supplier qualification
• Facilities & equipment: qualification, calibration, preventive maintenance, HVAC and water systems, cleaning validation
• Materials: receipt, sampling, testing, release, storage, dispensing
• Production: executed batch records, in-process controls, yields, process validation, reprocessing
• Packaging & labelling: line clearance, reconciliation, coding, artwork control, serialisation
• Laboratory control: methods and validation, OOS/OOT investigations, stability, reference standards, data systems and audit trails

"Inspection-ready" for each means records that are current, retrievable in minutes, and internally consistent.

What is data integrity, and why does it drive most findings?

Data integrity means records are Attributable, Legible, Contemporaneous, Original, and Accurate, plus Complete, Consistent, Enduring, and Available — the ALCOA+ principles. Inspectors test against them by looking for shared logins and analysts with administrator rights, audit trails disabled or not reviewed, uncontrolled spreadsheets performing GMP calculations, aborted or unreported test injections, and records completed ahead of or after the activity from memory.

The governing frameworks are 21 CFR Part 11 (US), EU GMP Annex 11, MHRA and WHO data-integrity guidance, and India's Revised Schedule M. Electronic signatures, complete audit trails, access controls, and periodic system review have to be designed in, not added afterward. Data-integrity findings are the fastest route to a warning letter or an import alert.

What are the most common Form 483 observations?

Publicly reported inspection findings cluster in a small number of areas year after year:

• Data integrity and computerised-system controls in the laboratory
• Inadequate investigation of deviations, discrepancies, failures, and out-of-specification results
• Laboratory controls: method validation, system suitability, stability
• Aseptic processing and contamination control
• CAPA not implemented or not effective
• Quality unit oversight — procedures not followed, insufficient independence or resource
• Production records not complete or not contemporaneous

How do you prepare for a GMP inspection?

Assemble the document set and assign each item an owner and a current-status date: Site Master File, SOP index, recent executed batch records with deviations cross-referenced, APQR for every commercialised product, the validation lifecycle, the stability programme, deviations and CAPA, change control, OOS/OOT investigations, training records, complaints and recalls, supplier qualification, and — for clinical sites — the eTMF.

Confirm the data-integrity controls above. Run a full mock inspection with an independent reviewer 8 to 12 weeks before an expected visit, log the findings as CAPAs with owners and dates, and close them before the real inspection. Drill the front-room / back-room roles, the document-QC step before anything enters the front room, and the request and commitment logs. Understand the response process and, for an FDA Form 483, the 15-business-day response expectation.