Top GMP Findings in Pharmaceutical Supplier Audits
A consistent pattern of deficiencies emerges across supplier qualification audits. This article analyses the most frequently observed GMP findings in API suppliers, CDMOs and packaging material manufacturers, and the systemic causes behind them.
The following findings represent the most consistently observed GMP deficiencies across supplier audits conducted against EU GMP, FDA CGMP and ICH Q10 requirements. They are presented not as a checklist for suppliers to remediate before audit, but as a diagnostic tool for pharmaceutical companies assessing the maturity of their supplier quality systems.
Inadequate Deviation Management
Deviation systems that capture events but do not investigate root causes, or that classify deviations at low risk without documented justification, are among the most consistent findings across supplier audits. Common deficiencies include: deviations closed without evidence of genuine investigation, repeat deviations for the same root cause, and inadequate trend analysis to identify systemic issues. The core problem is often a deviation process designed for documentation compliance rather than genuine quality risk management.
CAPA Systems Lacking Effectiveness Verification
CAPA records frequently describe actions taken without demonstrating that those actions resolved the identified root cause. Effectiveness checks, where they exist, are often superficial: a single inspection of a procedure or a brief review of records rather than a statistically meaningful assessment of whether the improvement has been sustained. Auditors expect to see CAPA plans with defined effectiveness criteria established at the time of CAPA approval, not retrospectively.
Training Records That Do Not Demonstrate Competence
Training records showing that personnel attended a session or signed off on reading a procedure are not evidence of competence. Regulatory expectations, particularly under ICH Q10, require that training programmes demonstrate that personnel can perform their tasks correctly. Common gaps: no competency assessment for critical tasks, training records not linked to job roles, and training not repeated after procedure updates. GMP training for quality-critical roles must demonstrate understanding, not just attendance.
Incomplete or Inconsistent Batch Records
Batch manufacturing records with incomplete entries, entries made in pencil, corrections without single line through original entry, date/time inconsistencies and unexplained gaps remain frequently observed despite being a foundational GMP requirement. More concerning is when these deficiencies are systemic, affecting multiple products or multiple manufacturing areas, which indicates a quality culture issue rather than an isolated documentation error.
Change Control Without Impact Assessment
Changes to manufacturing processes, equipment, facilities and materials are frequently implemented without adequate assessment of regulatory impact. Suppliers may not notify pharmaceutical company clients of changes that should trigger regulatory submissions or quality agreement obligations. Within supplier quality systems, changes are sometimes implemented on the basis of an assumption that they are minor without documented justification for that classification.
Out-of-Specification Investigation Deficiencies
OOS investigations are an area of particular regulatory focus following FDA's 2006 OOS Guidance. Common deficiencies: Phase I laboratory investigations that attribute OOS results to analyst error without objective evidence; invalidation of OOS results without documented assignable cause; averaging of passing and failing results; and failure to conduct Phase II manufacturing investigations when laboratory investigation does not identify a root cause.
Equipment Qualification Gaps
Equipment used in manufacturing and testing is frequently found without current qualification status. Common scenarios: qualification studies conducted but not reviewed or approved; qualification status not formally maintained through periodic requalification; significant repairs or modifications implemented without assessment of impact on qualification status; and critical instruments used outside their qualified operating ranges without documented justification.
Supplier's Own Supplier Oversight
When auditing CDMOs and API manufacturers, a consistent finding is inadequate oversight of their own raw material suppliers. Pharmaceutical companies expect CDMOs to maintain a qualified supplier programme, but many CDMOs do not audit their critical material suppliers, do not have quality agreements with them, and do not have change notification provisions in place. This creates an uncontrolled blind spot in the supply chain.
Systemic Causes
Most of the findings above share a common systemic cause: quality systems designed to demonstrate compliance during inspections rather than to manage quality risk in operations. This manifests as documentation-focused processes where the record is treated as the output rather than evidence of a genuine quality activity.
Pharmaceutical companies commissioning supplier audits should consider not just whether individual GMP elements are present, but whether the quality culture at a supplier supports genuine quality management. A supplier whose deviation system is procedurally correct but whose investigations are superficial represents a greater quality risk than the audit record suggests.
Most Common Finding Categories
- Deviation Management
- CAPA Effectiveness
- Training & Competency
- Batch Record Integrity
- Change Control
- OOS Investigation
- Equipment Qualification
- Sub-supplier Oversight
Need independent supplier audit support?
Supplier Qualification ServicesIndependent Supplier Audit Programme
Sthira Assure conducts independent GMP supplier audits against EU, UK, US and India regulatory expectations.