How to Prepare for a GMP Inspection: What Auditors Actually Look for and How to Get Your Team Ready
Most GMP inspection failures are not caused by genuinely non-compliant systems. They are caused by compliant systems that the team cannot demonstrate — under pressure, in real time, to a skeptical auditor who has seen every version of every excuse. Preparation is not about cleaning up your facility before someone arrives. It is about building the operational discipline so that what the auditor sees on inspection day is indistinguishable from every other day.
This guide covers what GMP auditors actually look for — not the generic checklist version, but the specific observations, behavioral patterns, and documentation gaps that generate findings — and how to build the preparation program that makes them unlikely.
What Kind of GMP Inspection Are You Preparing For?
The preparation approach differs meaningfully depending on the inspection type. Before building a preparation program, it is worth being precise about what you are actually facing.
Conducted by a regulatory authority — FDA, EMA, MHRA, Health Canada, or equivalent. Triggered by routine surveillance scheduling, application review, complaint-driven investigation, or import alert follow-up. These carry the highest stakes: findings can result in warning letters, import alerts, consent decrees, or facility shutdown.
Conducted by a GFSI-recognized certification body (FSSC 22000, SQF, BRCGS) or ISO certification auditor. Required for certification maintenance. Unannounced audits are increasingly common under GFSI schemes and carry significant supply chain consequences for non-conformances.
Conducted by a major customer — typically a retailer, brand owner, or contract manufacturing client. Standards and scope vary by customer, but findings can affect supply agreements regardless of regulatory status.
Your best preparation tool. An internal audit run with the rigor of an external inspection identifies gaps before someone else does. A mock inspection conducted by an external auditor provides an even more reliable read of your actual readiness.
What GMP Auditors Are Actually Looking For
Auditors are trained to see the gap between what an organization says it does and what it actually does. The most experienced ones do not start with documents. They start with people — because people reveal system weaknesses faster than any document review.
Here is what experienced GMP auditors focus on across the eight areas most consistently associated with inspection findings:
Data integrity — the dominant finding category
Data integrity is the single most cited category of GMP observation globally, and it has been for nearly a decade. Auditors are specifically looking for evidence that data has been altered, backdated, or selectively recorded — and for the system weaknesses that make those behaviors possible.
In practice, this means auditors will review audit trails in computerized systems to verify that entries were made contemporaneously and that deleted or modified records are flagged and explained. They will compare raw instrument data against transcribed results. They will check whether shared login credentials or blank signature lines exist in paper systems. They will look for analyst test results that were invalidated and re-run without documented justification — a pattern sometimes called "testing into compliance."
Audit trails disabled or not reviewed. Raw data files accessible to analysts who can modify them without a record. Paper records corrected with correction fluid rather than single line strikethrough, date, and initials.
Conduct a data integrity gap assessment against the ALCOA+ framework across every data-generating system: instruments, LIMS, manufacturing systems, paper records. Ensure audit trails are enabled and periodically reviewed. Train all data-generating personnel on ALCOA+ principles — not as a compliance exercise, but as an understanding of why each requirement exists.
Out-of-specification (OOS) investigations
When a test result falls outside its specification, GMP requires a formal investigation to determine whether the result is a genuine product failure or a laboratory error. This process — the OOS investigation — is one of the most scrutinized areas in pharmaceutical GMP inspections.
Auditors look for OOS investigations that are thorough, unbiased, and reach their conclusion through evidence rather than convenience. The most common finding is an OOS investigation that stops at "laboratory error" without sufficient scientific justification — effectively invalidating a failing result without proving it was wrong. This pattern suggests a quality culture where failing results are managed rather than understood.
OOS investigations closed as laboratory error without documented root cause. Retesting performed before completing Phase 1 investigation. Investigations that lack scientific rationale for invalidating the original result.
Review your last 12 months of OOS investigations. What percentage were closed as laboratory error? If the number is high, examine whether your investigation procedure is being used correctly or being used to manage results. Ensure investigators understand the difference between a genuine laboratory error and a result the team does not want to be true.
Following written procedures — exactly
GMP requires that processes be performed according to written, approved procedures. Auditors verify this not only through document review but by watching operations and asking operators to describe what they do. The gap between what the procedure says and what actually happens on the floor is one of the most reliable indicators of systemic quality culture problems.
This area generates more observations than most quality teams expect — not because procedures are missing, but because the procedures have drifted from actual practice over time, or because operators have developed informal workarounds that nobody has officially acknowledged.
Operators performing steps in a different order than specified in the SOP. Procedures that have not been updated to reflect current equipment or process changes. Operators unable to locate or describe the procedure governing their current task.
Walk the process. Observe operators performing their tasks and compare what you see against the written procedure. Where gaps exist, determine whether the procedure needs updating or whether the practice needs correction — and act on both. Confirm that all procedures are current, accessible at point of use, and that operators can locate them without assistance.
Training records and competency
GMP requires documented evidence that all personnel performing GMP-relevant tasks have been trained for those tasks. Auditors check not only that training records exist, but that training was completed before the employee performed the task, that training content reflects current procedures, and that retraining occurred when procedures were revised.
Beyond records, experienced auditors assess competency through conversation. They will ask operators questions about their work — not to trick them, but to determine whether training produced genuine understanding or just a signature on a record.
Training records that show completion dates after the employee began performing the task. Training that was not updated following SOP revisions. Operators unable to explain the purpose of the procedure they are following.
Audit your training matrix. Verify that every employee who performs a GMP-relevant task has a training record that precedes their first performance of that task. Identify any SOP revisions in the last 12 months and confirm that affected employees were retrained. Then test comprehension — not just compliance.
Deviation and CAPA management
Deviations — departures from approved procedures or specifications — are expected in manufacturing. What GMP requires is that they are captured, investigated, corrected, and that the root cause is addressed so the deviation does not recur. Auditors look at the deviation system as a window into the quality culture of the organization.
A well-functioning deviation system shows a reasonable volume of events, thorough investigations, and CAPAs (Corrective and Preventive Actions) that address root causes rather than symptoms. A poorly functioning system shows very few deviations — suggesting under-reporting — or many deviations with shallow investigations and recurring events that indicate CAPAs are not effective.
Recurring deviations of the same type with different investigation numbers but identical root causes. CAPAs closed without evidence of effectiveness verification. Deviations opened significantly after the event occurred.
Pull your deviation data for the last 12 months and look for recurring event categories. For each, ask whether the CAPA addressed the true root cause or just the immediate symptom. If you find patterns of recurrence, address them before the inspection — and document that you found and fixed them. An auditor who sees a proactive trend analysis is seeing a quality system that works.
Cleaning validation
Cleaning validation demonstrates that your cleaning procedures remove product residues, cleaning agents, and microbial contamination to below established acceptance limits between production runs. Auditors examine cleaning validation for both its initial scientific rigor and its ongoing maintenance — because cleaning validation that was sound at commissioning but has not been reviewed as products and processes change no longer meets GMP.
Cleaning validation protocols that do not cover the worst-case product or equipment configuration. Acceptance limits that were set without scientific justification. Cleaning validation not revalidated following changes to cleaning agents, equipment, or product formulations.
Review your cleaning validation documentation against your current product list and equipment inventory. Identify any products introduced since validation was last performed. Verify that acceptance limits are scientifically justified and documented. Confirm that your cleaning validation covers actual worst-case conditions — not the scenario that was easiest to validate.
Laboratory controls and equipment qualification
The quality control laboratory is one of the most scrutinized areas in a pharmaceutical GMP inspection. Auditors examine equipment calibration and qualification records, analyst training, reference standard management, stability programs, and the handling of reagents and solutions.
Equipment that is in use but has lapsed calibration or qualification is a direct GMP observation — it means every result generated by that equipment during the lapse period is potentially unreliable. This is a finding with potentially significant product impact, and auditors treat it accordingly.
Instruments in use with expired calibration certificates. Reference standards stored or used without appropriate documentation of receipt, testing, and expiry. Laboratory notebooks with gaps, unsigned entries, or correction fluid.
Generate a complete list of all laboratory instruments and their current calibration and qualification status. Any instrument with a lapsed or approaching calibration date requires immediate action. Walk through your reference standard management process and verify it matches the written procedure. Review a sample of recent analyst notebooks against your documentation requirements.
Management and quality culture
Experienced auditors assess quality culture — not as a soft concept, but as a leading indicator of system reliability. They look for evidence that quality is embedded in how decisions are made across the organization, not just in how the quality department performs its function.
During inspections, auditors pay attention to how senior management engages with quality questions. They notice whether operators appear comfortable or anxious when observed. They look for evidence of quality system metrics being reviewed at the leadership level. A facility where the quality department has to fight for resources and visibility presents a different risk profile than one where quality is visibly supported from the top.
Quality metrics not reviewed at senior leadership level. Quality department that cannot demonstrate management review of GMP performance data. Senior personnel who cannot articulate key quality indicators for their area of responsibility.
Ensure that your management review records document meaningful engagement with quality data — not just the presentation of data, but evidence that data was discussed and decisions were made in response to trends. Brief senior leaders on key quality metrics before the inspection. They will be asked about them.
Building Your Inspection Preparation Program
The organizations that consistently perform well under GMP inspection are not the ones that clean up before an auditor arrives. They are the ones that have built inspection readiness into how they operate every day. Here is how to build that program:
Six months out: Gap assessment
Run a structured internal audit against your applicable GMP standard. Map current practices against written procedures in every area. Review the last 12 months of deviation and CAPA data for patterns. Identify any validation, calibration, or qualification items approaching expiry. This assessment becomes your preparation roadmap.
Three to four months out: Remediation
Address the gaps identified in your assessment. Update procedures that have drifted from current practice. Complete any outstanding retraining. Close overdue CAPAs with genuine effectiveness verification. Resolve any equipment calibration or validation gaps. Prioritize by inspection risk — what will an auditor look at first, and what findings will carry the most significant consequences?
Four to six weeks out: Mock inspection
Run a mock inspection with the rigor of the real thing. If possible, use an external auditor who will not soften observations out of familiarity. Mock inspections reveal preparation gaps that internal reviews consistently miss — particularly in how personnel respond to auditor questions under pressure. Document all findings formally and address them before inspection day.
Two weeks out: Personnel preparation
Brief every area of the facility on what an inspection involves and what is expected of them. Personnel should understand: answer only what is asked, do not volunteer additional information, it is acceptable to say "I don't know — I can find out"; never falsify or fabricate a record under any circumstances. Role-play common auditor questions with supervisors and operators in each area.
Inspection day: Logistics and response
Designate a front room team — typically quality management, regulatory affairs, and legal where applicable — to accompany the auditor and manage document requests. Assign a back room team responsible for retrieving documents and briefing area personnel before the auditor arrives in their area. Every document request should be logged. Every verbal commitment made to the auditor should be recorded and followed up without fail.
The One Thing Most Facilities Get Wrong
The most common preparation mistake is treating inspection readiness as a project rather than a state.
Organizations that run intensive preparation programs every time an inspection is scheduled — and then return to normal operations afterward — are repeatedly building the same temporary compliance that temporarily passes. The effort is real. The results are not sustainable.
The facilities that consistently perform well under GMP inspection are the ones where an unannounced inspection would find the same conditions as an announced one. That is the standard worth building toward — and it is built through training, system discipline, and quality culture, not through cleaning schedules.
Building that kind of organizational capability requires investment in GMP knowledge at every level — not just in the quality department, but across manufacturing, laboratory, supply chain, and management. The professionals who genuinely understand GMP requirements, data integrity principles, and deviation management are the ones who maintain compliance between inspections, not just during them.
ComplyStrong's Global GMP/cGMP Certification is designed for exactly this: building comprehensive, current GMP knowledge across the professionals who need it — covering regulatory frameworks, data integrity requirements, validation principles, laboratory controls, and audit readiness in a single, fully online program.
Build the GMP knowledge that makes every day inspection-ready.
Enroll Now — Global GMP/cGMP CertificationFrequently Asked Questions
What do GMP auditors look for first when they arrive?
Most experienced GMP auditors begin by reviewing the facility's quality system overview — deviation trends, CAPA status, recent OOS results, and management review records. This gives them a map of where quality system weaknesses are most likely to be found before they begin reviewing individual areas. Auditors also pay close attention to how the opening meeting is conducted and how personnel respond to initial questions — as early signals of quality culture.
How long does a GMP inspection typically take?
Duration varies significantly by inspection type and scope. A routine FDA surveillance inspection of a mid-sized pharmaceutical manufacturer typically runs two to five days. GFSI certification audits are typically one to two days for an initial audit. Customer audits can range from half a day to two full days depending on the scope defined in the audit plan. Regulatory inspections triggered by specific concerns or applications may run longer.
What is a 483 observation?
An FDA Form 483 is a document issued at the conclusion of an FDA inspection that lists the specific observations — conditions or practices the investigator observed that may constitute violations of GMP requirements. Receiving a 483 does not necessarily mean enforcement action will follow, but it requires a formal written response from the facility within 15 business days addressing each observation. 483 observations that are not adequately addressed may escalate to a warning letter.
How should employees respond to auditor questions?
Employees should answer honestly, answer only what is asked, and avoid volunteering additional information beyond the scope of the question. If an employee does not know the answer to a question, the correct response is to say so and offer to find out — not to guess or speculate. Employees should never fabricate information or alter records under any circumstances. Preparation for this should be part of every inspection readiness program.
What is the difference between a GMP observation and a GMP finding?
The terms are often used interchangeably but can carry different weight depending on the inspection framework. In FDA terminology, an "observation" typically refers to a 483 item — a noted deficiency that may or may not rise to the level of a violation. In certification auditing (FSSC 22000, SQF, BRCGS), "finding" usually refers to a non-conformance that must be formally addressed for certification to be maintained or awarded. "Minor" and "major" non-conformances carry different remediation timelines and certification consequences.
How often should internal GMP audits be conducted?
GMP regulations and certification standards generally require internal audits at least annually, with a schedule covering all areas of the quality system within each audit cycle. However, high-risk areas — data-generating systems, OOS processes, cleaning validation — benefit from more frequent review. Organizations that treat the annual internal audit as their only self-assessment activity consistently perform worse in external inspections than those that maintain ongoing monitoring of quality system performance.
Sources
- U.S. FDA — Inspection Guides and Compliance Program Guidance Manuals
- U.S. FDA — Facts about Current Good Manufacturing Practices
- European Medicines Agency — Good Manufacturing Practice Inspections
- World Health Organization — Good Manufacturing Practices
- U.S. FDA — Guidance for Industry: Data Integrity and Compliance with Drug CGMP (2018)
