Preparing for a GMP inspection
Most sites do not fail an inspection on compliance. They fail on retrieval speed, on inconsistent accounts of the same process, and on commitments from last time that were closed on paper but never evidenced. All three are fixable in advance, and none of them are fixable in the week the inspection is announced.
- 01What should you prepare?
- 02What documents should be available?
- 03What should management know?
- 04What should QA review?
Preparation is mostly about demonstrability rather than compliance: the controls are usually already there, and what decides the first day is whether you can show them at inspection pace.
What should you prepare?
Work backwards from the first two hours. An inspector forms a view of your document control early, and that view determines how hard they look at everything downstream. Preparation that improves the first two hours is worth more than preparation spread evenly across everything.
- Close previous commitments, with evidenceEvery action from your last inspection or client audit, closed and evidenced. Unclosed commitments are the fastest route to a repeat finding, which is treated far more seriously than a first one.
- Run a timed retrieval exerciseAsk for a named operator's training record against a named batch and time it. Fifteen minutes is a reasonable target. This single drill predicts the first day better than any document review.
- Rehearse the back roomThe function that receives requests, locates documents, logs what was provided and checks it before it goes in. It is usually the part nobody has practised, and it is where delays become visible.
- Reconcile the Site Master FileIt is often the first document read. An SMF describing a site that has since changed sets an unhelpful tone before anyone has walked the floor.
- Check narrative consistencyInterview production, QA and engineering separately about the same process. Where accounts differ, the written procedure is probably not what happens.
- Walk the floor as an inspector wouldQualification status versus the equipment actually installed, open maintenance, cleaning status labels, and anything stored where it should not be.
Sites that prepare continuously spend less in total than sites that prepare in a three-week sprint, because sprint preparation competes with the day job at exactly the moment the day job cannot absorb it.
What documents should be available?
Not a list to print in advance — inspectors ask for what they choose. The point is that each of these can be produced quickly, in a current version, with the supporting records attached.
- Site Master File and organisation chartsCurrent, with named responsibilities and the QP arrangements clear.
- Quality manual and the PQS descriptionIncluding quality objectives and how effectiveness is measured.
- Batch records for named batchesComplete, including in-process checks, deviations raised against the batch, and the release decision.
- Deviation, CAPA and change control registersWith ageing visible. Expect questions about the oldest open item and why it is still open.
- Validation master plan and qualification statusReconciled against the equipment that exists today.
- Training records and job descriptionsTraceable from a named person to a named task on a named date.
- Self-inspection plan and executed reportsPlan versus actual execution, findings raised, and how many were still open at the next audit.
- Product quality reviews and management review minutesWith the actions arising, their owners, and evidence they were completed.
- Supplier qualification files and quality agreementsCurrent status, current agreements, and evidence questionnaires were assessed.
- Environmental monitoring and trend dataFor sterile sites, with the risk rationale behind sampling locations and evidence trends are interpreted.
What should management know?
Management is interviewed, and the questions are about ownership rather than detail. An executive who cannot describe the site's current quality position is itself a finding about management responsibility under Chapter 1.
- The current state of the quality systemOpen deviations, overdue CAPAs, audit plan adherence, release cycle time — the actual numbers, not the direction of travel in general terms.
- The site's known weaknessesAnd what is being done about them. Acknowledging a known gap with a funded plan is far stronger than appearing unaware of it.
- What management review decidedRecent decisions, what was resourced, and what was deliberately deferred with a rationale.
- Quality objectives and how they are measuredSet by management, reviewed by management, and connected to resourcing.
- Where quality sits in decision-makingWhether quality is consulted before commercial decisions or informed after them. Inspectors probe this and the answer is usually evident from the minutes.
Management that has never been trained on inspection behaviour tends to over-answer under pressure — volunteering context that opens lines of enquiry nobody had started.
What should QA review?
The review that matters is the one that reads your own records the way an inspector will: looking for the pattern across events rather than the adequacy of each one.
- The deviation log as a wholeNot individual investigations — the pattern. Recurring event types, and how often 'retraining' appears as the action.
- CAPA effectiveness checksWhether criteria were defined before implementation and checked against real data. This is the most reliably challenged part of a CAPA file.
- Audit trail review recordsWho performs it, how often, what they found. An enabled but unreviewed audit trail provides no assurance.
- Self-inspection execution versus planTwo years of plan against what actually happened tells you whether the constraint is capacity, independence or authority.
- Open items across every systemDeviations, CAPAs, changes, complaints and audit findings, sorted by age. The oldest items are where the questions go.
- Data integrity spot checksShared logins, leaver accounts still active, unvalidated spreadsheets performing GMP calculations, hybrid records with no defined raw data.
The other phases
During a GMP inspection
The inspection is a sampling exercise: what the inspector finds early determines how deep they go, so the first hours carry disproportionate weight.
Read the guideAfter an inspectionAfter a GMP inspection
The response letter is a set of commitments to a regulator on a fixed deadline — and over-committing converts a quality problem into a missed regulatory commitment, which is worse.
Read the guideThe underlying requirements
A mock inspection tests this rather than assuming it
Timed retrieval, back-room simulation, SME questioning and narrative consistency, run at inspection pace. Most sites discover the gap in a rehearsal, which is the cheap place to find it.