GMP & GDP Audits · 7 min read
Gap Assessment vs Full GMP Audit: Where to Start
A GMP gap assessment or a full GMP audit? Learn which to choose, how they differ and where to start, with a risk-based decision guide for UK and EU quality teams.
By Balasubramanian Ramaiah · 9 June 2026 · Updated 7 September 2026
Whether you are preparing a new site for inspection, onboarding a contract manufacturer, or recovering from a difficult MHRA visit, one question comes up again and again: should you commission a GMP gap assessment or go straight to a full GMP audit? Both are legitimate quality tools, but they answer different questions, cost different amounts and land at different points in a site's compliance journey. Choosing the wrong one wastes budget, delays decisions and can leave genuine risks undetected.
What a GMP gap assessment actually is
A gap assessment is a focused, benchmarking exercise. It measures your current state against a defined standard or scope and identifies the distance between where you are and where you need to be. The output is a prioritised list of gaps, not a formal compliance verdict.
Typical reference points for a GMP gap assessment include EU GMP Parts I and II, the relevant Annexes (for example the revised Annex 1 on sterile products), 21 CFR Parts 210 and 211 where the US market is in scope, and the data-integrity expectations summarised by ALCOA+. The assessment is usually narrower and faster than a full audit, and it is deliberately forward-looking: the point is to plan remediation, not to pass judgement.
When a gap assessment is the right call
- You are designing or fitting out a new facility and want to confirm the planned design and procedures will meet GMP before you commit capital.
- A regulation or guideline has changed and you need to understand your exposure, such as aligning an aseptic facility with the updated Annex 1 contamination control strategy.
- You are scoping a remediation programme and need a credible, prioritised baseline to build a project plan and budget around.
- You are entering a new market or product type and want to test readiness before formal inspection.
What a full GMP audit covers
A full GMP audit is a systematic, evidence-based examination of a quality system against the complete applicable standard. It is broader and deeper than a gap assessment, it samples records and observes practice, and it produces formal findings, usually graded as critical, major and minor. An audit tells you not only where the gaps are, but whether your quality management system is actually working as described.
Full audits are the natural tool for routine supplier qualification under your supplier management programme, for periodic self-inspection required by EU GMP Chapter 9, for due diligence before a commercial agreement, and for confirming that a remediation programme has genuinely closed earlier findings. Because the scope is comprehensive, an audit demands more preparation, more on-site time and a clear audit plan.
How the two differ in practice
- Purpose: a gap assessment plans improvement; an audit verifies compliance.
- Output: a gap assessment produces a remediation roadmap; an audit produces graded findings and a CAPA-driving report.
- Depth: a gap assessment benchmarks against key requirements; an audit samples evidence and challenges the system end to end.
- Formality: audit findings carry more regulatory weight and are expected to feed your CAPA and quality review processes.
Where to start: a risk-based decision
The honest answer is that the right starting point depends on how much you already know about your own compliance state. ICH Q9 on quality risk management and ICH Q10 on the pharmaceutical quality system both point the same way: let risk and knowledge drive the level of scrutiny. If you genuinely do not know where you stand, paying for a full audit first can be inefficient, because you may uncover the same obvious gaps a shorter assessment would have flagged at a fraction of the cost.
As a practical rule of thumb:
- Start with a gap assessment when the site is new, recently changed, or you have low confidence in current compliance. Use it to triage and build a credible plan.
- Go straight to a full audit when the system is established, you need formal assurance, or an external party (a customer, a partner, or your own QP) requires documented evidence of compliance.
- Sequence them for serious remediation: gap assessment to define the work, remediation to close it, then a full audit to verify and provide defensible proof.
A gap assessment tells you what to fix and in what order. A full audit tells you whether you can stand behind the result. Confusing the two is one of the most common and expensive mistakes quality teams make.
Common scenarios and the smarter first step
New site or major change
For a greenfield site, a line extension, or a significant facility upgrade, begin with a gap assessment against the applicable standard and Annexes. It is far cheaper to redesign a cleanroom flow or revise a procedure on paper than to remediate it after a failed inspection.
Supplier and contract acceptance
When you are qualifying a CMO, API supplier or distributor, a full audit is usually expected, and your own quality agreement and GDP obligations will often require it. A quick gap assessment rarely satisfies the documented qualification a regulator will look for.
Pre-inspection readiness
Ahead of an MHRA or other regulatory inspection, many sites benefit from both: a gap assessment to close obvious issues quickly, followed by a mock full audit that rehearses the inspection experience and tests the system under realistic challenge.
Key takeaways
A GMP gap assessment and a full GMP audit are complementary, not interchangeable. Use the assessment to understand and plan when knowledge is low or the situation has changed; use the audit to verify and provide defensible evidence when assurance is what you need. Let ICH Q9 risk thinking decide the depth, and where remediation is significant, sequence the two so that money is spent in the right order.
If you are unsure which step fits your site, our team of independent UK Qualified Persons can help you scope the right approach. Explore our GMP and GDP audit services, see how we have supported other sites in our case studies, or review the full range of quality and compliance services we offer. When you are ready to plan your next assessment or audit, get in touch with our QP team for a confidential, practical conversation.
Regulatory sources
This guidance reflects current UK and EU GMP/GDP requirements. Primary references:
- EudraLex Volume 4 — EU GMP Guidelines
- EU GMP Chapter 9 — Self Inspection
- MHRA Inspectorate Blog
- EMA — GMP/GDP Questions & Answers
Always confirm against the latest published version of each source.
Frequently asked questions
Is a GMP gap assessment the same as a self-inspection?+
No. A self-inspection under EU GMP Chapter 9 is a periodic, full review of your own quality system to confirm ongoing compliance, and it produces formal findings. A gap assessment is a narrower benchmarking exercise that measures your current state against a defined standard to plan improvement. You can use a gap assessment to prepare for a self-inspection, but it does not replace the documented self-inspection programme regulators expect.
How long does a GMP gap assessment usually take compared with a full audit?+
A gap assessment is deliberately focused, so on-site time is often one to two days depending on scope, with a prioritised report following shortly after. A full GMP audit samples records and observes practice across the whole quality system, so it typically requires more preparation, more on-site days and a formal audit plan. The exact duration always depends on site size, complexity and the standards in scope.
Can a gap assessment be used as evidence for supplier qualification?+
Generally not on its own. Supplier qualification and quality agreements usually require a documented full audit that provides graded findings and defensible evidence of compliance. A gap assessment can be a useful early screening step, but for formal acceptance of a CMO, API supplier or distributor, a full audit is the expected standard. Always check what your own quality system and customers require.