The Complete GMP Audit Checklist for UK Manufacturers

A robust GMP audit checklist is the single most useful tool a UK manufacturer can carry into a self-inspection, a customer audit or an MHRA visit. It turns the sprawling expectations of EU GMP into a disciplined, evidence-led walk through your site, and it stops the same avoidable deficiencies surfacing year after year. This guide sets out the structure we use as Qualified Persons to assess sites against the standards that matter, and how to use it without reducing quality to a tick-box exercise.

Why a structured GMP audit checklist matters

Auditing without a framework is how significant gaps hide in plain sight. A good checklist is built directly on the EU GMP guide — Part I for medicinal products, Part II for active substances — together with the relevant Annexes and the principles of ICH Q9 (quality risk management) and ICH Q10 (pharmaceutical quality system). For sites supplying the United States, the parallel expectations of 21 CFR Parts 210 and 211 should be mapped in too, so a single audit can serve multiple markets.

The point of the checklist is not to generate a long list of findings. It is to give you defensible coverage: a documented assurance that every critical system has been examined against a recognised standard, with risk-ranked outcomes you can actually act on. Used well, it is the backbone of the self-inspection programme that Chapter 9 of EU GMP already requires you to run.

The core systems your checklist must cover

We structure audits around the recognised quality systems rather than walking the building room by room. This keeps the assessment aligned with how regulators think, and it makes findings easier to trend over time.

Quality management system and documentation

• Is the Site Master File current and an honest reflection of activities on site?
• Are SOPs approved, in date, version-controlled and available at the point of use?
• Does the quality manual describe what people actually do — not an idealised process?
• Are management review and quality metrics demonstrably driving improvement?

Personnel, training and the quality culture

• Is the organisation chart current, with clear roles for the Qualified Person and key quality staff?
• Is training documented, role-specific and verified for effectiveness — not just attendance?
• Do operators understand the "why" behind critical steps, not only the "how"?

Premises, equipment and qualification

• Are qualification and calibration records complete, in date and traceable?
• Is the contamination control strategy coherent, and — for sterile products — fully aligned with Annex 1?
• Is preventive maintenance scheduled, performed and recorded?

Production, materials and supplier oversight

• Is the approved supplier list current, with qualification and periodic re-evaluation evidenced?
• Are materials released against meaningful specifications, with full traceability?
• Are batch records reviewed for completeness before QP certification?

Quality control and the laboratory

• Are methods validated or verified, and reference standards controlled?
• Are out-of-specification investigations rigorous, timely and scientifically sound?
• Is stability data managed against an approved protocol?

Data integrity: the thread running through every section

Data integrity is no longer a discrete topic to audit at the end; it runs through every system on the list. Walk your records — paper and electronic — against the ALCOA+ principles: data should be Attributable, Legible, Contemporaneous, Original and Accurate, and also complete, consistent, enduring and available. In practice that means audit trails switched on and reviewed, access levels matched to role, no shared logins, and no uncontrolled spreadsheet quietly performing a GMP-critical calculation.

If you cannot reconstruct who did what, when, and on which version of the record, you do not have a deviation — you have a data integrity finding waiting to be raised.

For an authoritative steer here, the MHRA's data integrity guidance remains essential reading, and it should be reflected explicitly in the relevant lines of your checklist rather than treated as a separate exercise.

Deviations, CAPA and turning findings into improvement

An audit is only as good as what happens after it. Open deviations and overdue CAPAs are the items that most reliably draw inspector attention, so your checklist should test the quality of the system, not merely its existence. Look for sound root-cause analysis, risk-based impact assessment under ICH Q9, corrective actions that genuinely address the cause, and effectiveness checks that confirm the fix held.

Risk-rank every finding as critical, major or other, and assign realistic timelines with named owners. A controlled record with a credible improvement plan inspires far more confidence than a suspiciously spotless one. If your team needs an independent, experienced eye on this, our GMP and GDP audit service is built precisely around closing these gaps before a regulator finds them, and you can see the approach applied in our case studies.

GDP and the wider supply chain

Manufacturing compliance does not end at your loading bay. If you also store or distribute, your processes must satisfy the Good Distribution Practice guidelines, with the same rigour you apply to GMP. Temperature mapping and monitoring, qualification of customers and suppliers, falsified-medicines safeguards and the role of the Responsible Person all belong on the checklist for any site that holds a wholesale dealer's authorisation. Treating GMP and GDP as a single, joined-up quality story is one of the clearest signals of a mature operation, and it is reflected across the full range of our consultancy services.

Key takeaways

A well-built GMP audit checklist does three things: it gives you defensible coverage against EU GMP, the Annexes and ICH Q9/Q10; it threads data integrity and ALCOA+ through every system rather than bolting them on; and it converts findings into risk-ranked, owned actions that actually improve the site. Treat it as a living instrument — reviewed after every inspection and regulatory update — rather than a static form.

If you would like an independent assessment, a tailored checklist for your operation, or support running a mock inspection before a date in the diary, get in touch with our team. A short, honest readiness conversation is usually the highest-value first step a manufacturer can take.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EudraLex Volume 4 — EU GMP Guidelines
• EU GMP Chapter 9 — Self Inspection
• MHRA Inspectorate Blog
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.