Audits and Compliance
Verification, deviation, and the culture of quality.
Overview
GMP compliance doesn't police itself. Describe the main types of GMP audits and inspections, explain how deviations and non-conformances are managed, and outline what happens when a regulatory inspection finds serious failures.
Read before you answer
GMP audits exist to verify that a manufacturing operation is complying with applicable regulations and its own procedures. There are three main types: internal audits (also called self-inspections), which a company conducts on itself on a regular schedule to identify gaps before regulators do; supplier or vendor audits, which assess the GMP compliance of contract manufacturers, API suppliers, or other third parties in the supply chain; and regulatory inspections, conducted by authorities such as the FDA, MHRA, or EMA. Regulatory inspections may be routine, triggered by a specific concern, or conducted as part of a marketing authorisation application review. Findings are classified by severity — typically critical (direct patient risk), major (significant but not immediately critical), and minor (observation-level).
When something goes wrong in a GMP operation, it generates a deviation — a departure from an approved procedure or specification. Deviations must be formally reported, classified by impact, investigated for root cause, and closed through a Corrective and Preventive Action (CAPA) plan. The CAPA distinguishes between corrective actions (fixing the current problem) and preventive actions (changing systems to prevent recurrence). Root cause analysis — identifying the true underlying cause rather than the immediate symptom — is the critical step that determines whether the CAPA will be effective. A weak root cause investigation leads to a CAPA that addresses symptoms and allows the problem to recur.
Serious regulatory findings lead to formal written responses from the manufacturer, and depending on severity, to Warning Letters (FDA), GMP non-compliance statements (EMA), or import alerts that prevent products from entering a market. Manufacturing licences can be suspended. Products can be recalled. Behind all of this is the concept of "quality culture" — the attitudes, behaviours, and leadership that determine whether GMP is genuinely lived or merely documented. A strong quality culture means people raise concerns, deviations are investigated honestly, and systemic problems are fixed rather than papered over. Regulators increasingly assess quality culture directly during inspections.