Inspection Readiness: Preparing for GMP Inspections and Self-Inspections in a Verifiable Way

Regulatory inspections have a statutory framework

AMG § 64 governs the supervision of the activities and facilities it covers. Inspections are risk-based and, where necessary, unannounced. The authority’s powers include, among other things, inspecting business premises, examining documents, and requiring necessary information. § 66 sets out the obligation to permit inspections and cooperate. ^[1]

Preparation therefore also covers how responsible persons can be reached and how documents from different areas are brought together. A designated contact person can coordinate. This person does not replace the subject-matter experts when a specific process needs to be explained or a decision justified.

An internal GMP audit or a self-inspection serves a different purpose than regulatory supervision. Both can uncover weaknesses, but neither anticipates the authority’s verdict.

How a GMP inspection works

The Compilation of Union Procedures describes the procedure for manufacturers and importers. Inspections may be announced, but unannounced inspections remain possible. The authority prepares based on previous inspections and relevant changes, among other things. ^[2]

1. Opening meeting: The inspection team, management, and key personnel discuss the purpose, scope, and plan. The company explains significant changes and names the persons accompanying the inspectors.
2. Walkthrough and document review: The team looks at areas and activities and examines specific examples of documentation. Observations are clarified with the responsible persons; new risks can shift the focus.
3. Closing meeting: The findings and the significance of the deficiencies are discussed, along with initial proposals for correction and timelines for remedial actions. Where there is a serious risk, immediate action is required.
4. Report and response: The report describes the scope, findings, and conclusion. The company is given the opportunity to comment before the report is finalized.

Document requests accompany the walkthrough and the review.

Instruction, execution, and decision belong together

EU GMP Chapter 4 distinguishes instructions from records and reports. Documents should be accurate, have integrity, and be available and legible. Section 4.8 requires significant activities to be recorded at the time they are performed; section 4.9 describes traceable alterations in which the original information remains legible. ^[3]

For a selected case, the first step is therefore to identify the SOP that applied at the time. This is then compared with the actual entries, checks, and decisions. If the references do not match, the difference must be clarified. The current instruction does not automatically show which version an earlier step was performed under.

A work sample starts with a single material or batch reference. The responsible person locates the original entry and follows it to the associated documents. This shows whether the link is documented in a traceable way or can only be reconstructed from someone’s memory.

If a gap is discovered, the discovery must remain distinguishable from the original execution. A later addition is not presented as a contemporaneous record. Anything that can no longer be substantiated is assessed as an open question and handled under the applicable procedure.

Self-inspections examine actual implementation

For companies within the scope of the AMWHV, § 11(1) requires regular self-inspections according to a program defined in advance. Records must be kept of the inspections and of any corrective actions taken as a result. ^[4]

EU GMP Chapter 9 provides for a pre-arranged program that covers personnel, premises, equipment, documentation, production, and quality control, among other things. Self-inspections should be conducted in an independent and detailed way by designated competent persons. Observations and any proposed corrective actions, as well as actions taken later, are documented. ^[5]

In practice, the program can be combined with targeted process samples. These might cover, for example, a recently changed procedure, a recurring deviation, or a handover between two areas. The rationale for the selection and its limits are recorded.

The review also looks at how the work is performed at the workstation: Is the appropriate instruction accessible? Can the activity be performed as intended with the available means? Does the record match the observed procedure? A complete list of documents does not answer these questions.

Electronic evidence needs its data context

PIC/S PI 041-1 is addressed to inspectorates and explains existing GMP/GDP expectations for data integrity; according to section 3.7, it does not itself create binding law. Section 9.8 addresses risk-based reviews of data and audit trails; section 9.9 covers retention, including relevant metadata, and readable access. ^[6]

A results overview can help with orientation. In a specific review, however, it must be clear which source data it covers and how they were selected. PIC/S explicitly mentions verifying summaries against raw data. Where relevant, audit trail review is part of routine data review, not something done only to prepare for an inspection.

A practical retrieval test might use an older record from a retired system. The test shows whether the content, the required metadata, and the meaning of the record are still accessible. An existing file name or a successful backup message does not answer this question. Which data must be retained in which form is defined for the respective process and its requirements.

Document requests need a scope, an owner, and a reference

A request log records which document was requested, who provides it, and what is still open. The coordinator tracks the status; the subject-matter expert checks whether the evidence supports the specific statement.

Deputy arrangements can also be tested in practice: Can another authorized person find the same case when the usual contact person is absent? Can they initiate a required archive retrieval without using someone else’s login credentials? The work sample shows whether the intended responsibilities and access paths hold up in day-to-day operations. Any obstacles identified are assigned an owner and a traceable path to resolution.

RM-427 connects the evidence across process boundaries

In the fictitious RM-427 case, the chain of evidence runs from the seal finding on container 3 through deviation management to the assessment. The physical cause of the damage remains open; the substantiated procedural deficiency leads to a CAPA. Change control links V3 with the planned V4 of SOP-WE-12, while the original V3 snapshot is retained. A verifiable chain of evidence also shows that the material decision remains separate. Completing an action demonstrates neither that the material can be used nor that the finished product will later be certified by a QP.

Identified deficiencies are assessed and tracked

The EU reporting standard distinguishes three categories. Classification takes into account the impacts and risks identified; several individual deficiencies can together be rated more severely. ^[7]

Critical

A deficiency has produced a product that is harmful to humans or animals, or poses a significant risk of doing so; this also covers products with harmful residues in food-producing animals.

Major

A non-critical deficiency has produced a product that does not comply with its marketing authorization, or may lead to one. Also covered are major deviations from EU GMP or from the terms of the manufacturing authorization, inadequate batch release procedures or failure to fulfill statutory QP duties. Several other deficiencies can together constitute a major deficiency.

Other

A GMP deviation that cannot be classified as either critical or major. This can include minor deficiencies, but also cases for which the information is insufficient to classify them higher.

A GMP certificate confirms the positive overall assessment of the inspection within the scope inspected; it is issued only if the site is GMP compliant. It does not follow automatically from a single deficiency category. ^[8]

For an internal finding, the observation, the affected requirement, and the available evidence are described separately. “Documentation inadequate” is too vague as a starting point. It is more useful to state which record is missing for which step and which decision therefore cannot be reconstructed.

EU GMP Chapter 1, section 1.4(xiv), links the investigation of problems to appropriate root cause analysis, corrective and preventive actions, and evaluation of their effectiveness. Sections 1.5 and 1.6 set out the responsibility of management and the regular review of the quality system. ^[9]

In practice, the finding follows a defined path: assess possible impacts, contain them immediately if necessary, investigate the cause, and track suitable actions. Urgency depends on the specific risk. An upcoming inspection date is no reason to delay addressing a relevant hazard that has already been identified.

For regulatory inspections, AMG § 64(3d) provides that the content of the draft report is communicated to the company and that it has an opportunity to comment before the report is finalized. ^[1] The response refers to the specific finding and separates steps already implemented from planned actions.

Open tasks belong in the management of the quality system

Management needs an overview that shows impacts, responsibilities, and status. If similar findings keep recurring, the existing approach needs to be reviewed. A new due date does not explain why the previous action was not effective.

The pharmaceutical quality system under ICH Q10 links this feedback to resources and improvement decisions. A useful evaluation looks, for example, at which evidence is repeatedly difficult to access and whether the cause lies in filing, responsibilities, or system access. The result is carried forward as a specific improvement assignment.

420+ supports the link between procedure and evidence

Starting from the material or the batch, batch traceability in 420+ leads to the activity actually performed. Steps, results, deviations, and approvals stay together in the batch context. The task retains the SOP version that applied at the time as a snapshot; even after the change to V4, execution under V3 can still be explained.

A correction event links the original entry, the new content, and the intended effect. In the audit trail, the correction remains traceable together with its reference, instead of the original record being replaced by a cleaned-up final version. An open technical question can be handled as a follow-up task with an owner and a defined deadline.

Role-based process control checks authorization for each specific action. Roles, independent second-person review, deadlines, and escalation are configurable defaults for each process. This makes it possible, for example, to route the task “Inspect batch / partial batch” to the responsible Quality Control function; the material decision itself remains with the authorized person.

Frequently asked questions about inspection readiness

What distinguishes a self-inspection from a regulatory inspection?

A self-inspection reviews implementation within the company’s own quality system under EU GMP Chapter 9. Regulatory supervision has a statutory mandate and its own powers under AMG § 64. ^{[5] [1]}

Is a binder of current SOPs enough?

No. In addition, traceable records of actual execution and the matching historical instructions are needed. What matters is a demonstrable link to the case under review.

Must all open actions be closed before an inspection?

No. Open actions are part of ongoing work. What matters is the assessment, any necessary interim controls, an owner, and a due date. Urgent protective measures must not be postponed until the visit.

How are deficiencies classified in a GMP inspection?

As critical, major, or other. The definitions in the EU reporting standard and the overall situation are decisive; several “other” deficiencies can together be classified as major. ^[7]