The 10 Most Common GMP Audit Findings (and How to Fix Them)

Most inspection failures are not exotic. Year after year, the common GMP audit findings raised by the MHRA and EU inspectorates cluster around the same handful of systemic weaknesses: weak data governance, poorly managed deviations, and a quality system that exists on paper but not on the shop floor. The good news is that recurring findings are also the most fixable, because the root causes are well understood and the corrective actions are repeatable.

Drawing on EU GMP, the MHRA's published inspection trends, and the ICH Q9 and Q10 framework, this article walks through the ten findings we see most often during contract audits and mock inspections, and sets out what good looks like for each.

Why the same GMP audit findings keep recurring

The pattern is rarely a lack of knowledge. It is a lack of system: procedures that drift from practice, training that is recorded but not effective, and a quality unit without the authority or resource to enforce standards. ICH Q10 is explicit that senior management owns the pharmaceutical quality system, yet many of the most common GMP audit findings trace back to leadership treating quality as a documentation exercise rather than a live, risk-based discipline.

If a deviation, a data integrity gap and an out-of-specification result would all be handled the same way by three different analysts on three different days, you have a procedural problem, not a personnel problem.

Findings 1 to 5: data, documentation and the quality system

1. Data integrity and ALCOA+ failures

Shared logins, uncontrolled spreadsheets, audit trails that are switched off or never reviewed, and the ability to overwrite original records remain the single most cited theme. The fix is to map every GxP record against ALCOA+ (attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available), assign unique user accounts with appropriate privileges, and build periodic audit-trail review into batch release rather than treating it as optional.

2. Inadequate investigation of deviations and OOS results

Investigations that stop at the first plausible cause, close without effective CAPA, or quietly invalidate out-of-specification results are a persistent red flag. Use a structured root-cause method, define a realistic timeline for closure, and ensure CAPA effectiveness is verified rather than assumed. An open deviation backlog is itself a finding.

3. Poor CAPA management

Corrective actions that are really just corrections, repeated identical deviations, and CAPAs with no due dates all point to a system that records problems without resolving them. Trend your deviations, escalate recurring themes through quality risk management under ICH Q9, and close the loop with documented effectiveness checks.

4. Procedures that do not match practice

When the SOP describes one process and operators perform another, the document control system has failed. Findings here include uncontrolled copies, expired review dates and missing version history. Keep SOPs lean, review them on a defined cycle, and confirm during self-inspection that the written process is the one actually followed.

5. Ineffective training and competency gaps

A signed training record is not evidence of competence. Inspectors increasingly probe whether training translates into correct behaviour, particularly for aseptic operators and data reviewers. Move from attendance-based training to assessed competency, and re-qualify staff after significant procedural or equipment changes.

Findings 6 to 10: facilities, suppliers and contamination control

6. Contamination control and Annex 1 expectations

The revised Annex 1 raised the bar for sterile and aseptic manufacture, and findings now frequently cite the absence of a holistic Contamination Control Strategy (CCS). Environmental monitoring without defined action on adverse trends, weak aseptic technique and inadequate gowning qualification are common. A documented CCS that links premises, equipment, personnel and process is now the baseline expectation.

7. Equipment qualification and calibration gaps

Missing or expired calibration, qualification protocols without clear acceptance criteria, and a lack of ongoing performance verification undermine the validated state. Maintain a current validation master plan, and ensure calibration status is visible at the point of use.

8. Weak supplier and material management

Failure to qualify suppliers, missing or out-of-date quality agreements, and reliance on certificates of analysis without periodic verification are recurrent. A risk-based supplier qualification programme, supported by audits and clear quality agreements, is essential, particularly for importers relying on third-country sites. Our consultancy services frequently start exactly here, because supply-chain weaknesses cascade into batch release decisions.

9. Inadequate self-inspection

Self-inspections that are infrequent, superficial, or never generate findings are themselves a finding. A mature programme is honest, risk-based and tracked to closure. If your internal audits never surface anything uncomfortable, an external inspector eventually will. A periodic independent GMP audit is one of the most cost-effective ways to pressure-test your own programme.

10. Premises, environmental control and flow

Poor segregation, cross-contamination risk from inadequate material and personnel flow, fabric defects and pest control gaps round out the list. Many of these are visible within minutes of walking a site, which is why they make such an impression during an inspection.

Turning findings into a defensible quality position

The thread running through every one of these is quality risk management. ICH Q9 expects risk to be assessed, controlled, communicated and reviewed, and ICH Q10 expects management to own the outcome. Where teams shift from reacting to findings towards anticipating them, inspection outcomes improve markedly, as several of our case studies illustrate.

• Treat your audit trail review and deviation backlog as live KPIs, not year-end clean-ups.
• Make self-inspection genuinely critical and act on what it finds.
• Build a Contamination Control Strategy if you operate sterile or aseptic processes.
• Qualify suppliers on risk and keep quality agreements current.

Key takeaways and next steps

The most common GMP audit findings are predictable, systemic and entirely preventable with disciplined quality risk management, honest self-inspection and a quality unit empowered to act. Fixing the root cause once is far cheaper than re-explaining the same deviation to an inspector every cycle. If you would like an independent, inspector's-eye view of where your site stands before the regulator forms one, contact our team to arrange a confidential GMP audit or mock inspection.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EudraLex Volume 4 — EU GMP Guidelines
• EU GMP Chapter 9 — Self Inspection
• MHRA Inspectorate Blog
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.