5 Common Questions to Prepare for GMP Inspections

FDA inspectors rarely issue observations to factories for problems that were anticipated. Instead, they often point out vulnerabilities that no one thought about checking. We have identified five common weak points - each corresponds to a specific issue. These problems also frequently appeared in the 483 observation records and warning letters.

We have distilled these five issues, explaining why the FDA is concerned and highlighting the specific weaknesses that we repeatedly discovered during the audit - even in a quality management system that is functioning well overall.

Please consider the following content as a test. If you cannot provide verifiable documents to answer these questions within 5 minutes, it indicates that there is a vulnerability that needs to be immediately fixed. It would be best to resolve it before the next inspection team arrives.

1. Please demonstrate how the quality department conducts the review of all audit tracking events related to critical cGMP data.

The FDA clearly states in the Data Integrity and Compliance With Drug CGMP: Questions and Answers: Metadata (such as timestamps, user IDs, and status identifiers) are part of the records and must be verified with the same level of rigor as the main results.

Many enterprises still rely on printed documents (signed and archived) while neglecting the underlying electronic data. Even when audit trails are enabled, they often only actively review them after deviations or investigations occur.

Common problems

• Administrator accounts are shared by multiple people.
• Passwords are not changed in a timely manner.
• There is a lack of regular and independent review mechanisms.
• Some systems generate audit trails, but no one knows how to extract them or view them.

Improvement points

• Clarify the SOP and define what constitutes GMP critical data, as well as which systems generate relevant audit trails.
• Assign independent auditors (who are not the original users or system owners) to simultaneously review the data and audit trails before batch release.
• Train the auditors to identify key events (such as logins, deletions, and modifications), ensuring that no unexplained operations are present.
• Integrate the audit trail review into the daily batch release process and ensure that any anomalies are entered into the deviation/CAPA system instead of remaining in email communications.

Self-check

Could you at any time access the audit trail of the critical system to show who conducted the review and when, and ensure it is completed before batch release?

2. Please explain how you conduct qualification verification and ongoing monitoring of the SaaS or cloud platform used for storing cGMP data.

The CSA guidelines of the FDA emphasize that outsourcing infrastructure does not imply outsourcing liability. As long as these systems store, transmit or process GMP data, they must comply with Part 11 and data integrity requirements, and compliance responsibility remains with you.

Common problems

• The enterprise regards cloud-based LIMS or eQMS as a stationery supplier.
• Risk assessment is lacking.
• Supplier audits are conducted solely based on a brochure.
• Quality agreements have not been signed.
• Penetration testing reports are unavailable.
• There is a lack of reconfirmation or continuous monitoring of performance/safety controls.

Improvement points

• List all systems that handle GMP data, even those that are externally hosted or accessed via browsers.
• Conduct a risk assessment and categorize key suppliers.
• Complete system qualification upon launch (document review, remote audit, summary of penetration testing, SOC 2 report).
• Sign quality agreements with suppliers, clearly defining roles, responsibilities, data ownership, backup, and change control mechanisms.
• Regularly review SLAs and reconfirm them when system functionality or regulatory requirements change.

Self-check

Could you provide the signed quality agreement, the initial qualification confirmation documents, and the most recent SLA performance assessment?

3. Which molecule did you choose as the worst-case for cleaning validation? How can you justify this choice?

The FDA requires that the worst-case for cleaning validation be determined based on risk and scientific evidence, especially in multi-product workshops. The selection criteria should include toxicology, solubility, cleaning difficulty, and not just potency.

Many enterprises are still stuck in outdated practices:

• They mechanically apply the minimum dosage of 1/1000.
• They simply consider the most potent drug to be the most difficult to clean.
• The recovery rate study is conducted only once, lacking re-validation.
• The toxicology report is outdated and lacks signatures.

Improvement points

• Determine toxicological risks using HBEL/ADE, which should be provided or confirmed by professional toxicologists.
• Consider product solubility, dosage, and production frequency.
• Record and justify the selection of the worst-case scenario in the cleaning validation plan.
• Conduct recovery rate studies for different equipment materials.
• Reassess the worst-case scenario whenever there is a change in product combination or the discovery of new risks.

Self-check

Could you please provide the toxicological basis, the data on swab recovery rate, the reasons for the "worst-case" selection, and the date of the most recent review?

4. Please provide effectiveness verification records of your latest three GMP changes.

According to 21 CFR 211.100 and ICH Q10 regulations, any new or revised procedures must prove their actual effectiveness.

Common problems

• The change records are closed on the same day, with only the option "Validation of effectiveness" selected.
• The deviation log shows that the related issues have not been traced.

Improvement points

• Define quantifiable success criteria before the change (such as "three batches without relevant deviations" or "≥90% training pass rate").
• The change record can only be closed once the criteria are met and there is evidence.
• Review the results during quality meetings or management reviews.

Self-check

Could you provide objective evidence for the last three changes to demonstrate that they have achieved the expected results and have been approved by someone?

5. Please provide verification data for all temperature-controlled transportation routes (including last-mile delivery).

21 CFR 211.150 and USP <1079> regulations mandate that it must be proven that the product is properly protected throughout the entire distribution process.

Common problems

• Verification only covers long-distance transportation.
• Branch lines, express delivery, and extreme seasonal environments are not covered.
• The default setting is "2–8℃", but it does not match actual stability.
• Alarm information only reaches the operation department, and the quality department does not participate.
• Transportation delays result in overtime, but there is a lack of formal investigation.

Improvement points

• Conduct temperature mapping verification for the entire chain (including junction points, logistics stages, and extreme weather conditions).
• The acceptance criteria should be based on product stability rather than general ranges.
• Enable real-time monitoring, and the alarms must be reviewed and trend-analyzed by the quality department.
• Revalidate when there are changes in transportation methods, packaging, or carriers.

Self-check

Could you provide the verification study of the transportation route, stability data (including allowable temperature excursions), as well as the review records of all temperature excursions during transit?

Disclaimer: The above content is compiled based on existing public information and is for reference only.

Our Services

Proregulations has a thorough understanding of the FDA inspection process and key concerns, and possesses extensive practical experience. We are dedicated to providing targeted guidance to our clients, helping them successfully address 483 forms or warning letters challenges and smoothly pass FDA inspections.

• Regulatory consultation and interpretation
• Regulatory and inspection readiness training
• Gap analysis
• Control and compliance assessment of the quality system
• Record and document review
• Risk point identification
• Response to defect items and support for rectification
• Assist in communication with the FDA

Proregulations collaborates deeply with clients to help them establish a continuous compliant quality management system, fundamentally enhancing the quality of their products and providing a solid compliance guarantee for their products to enter the global market. If you are interested in our services, please contact us.

Related Service

U.S. New Drug Application (NDA)

U.S. Abbreviated New Drug Application (ANDA)