GMP & GDP Audits · 7 min read

GMP Audit vs GDP Audit: Which Does Your Business Need?

A senior QP's guide to the GMP vs GDP audit decision: what each covers, the frameworks behind them, and how to scope the right audit for your UK or EU business.

By B. Subramanian · 9 June 2026 · Updated 26 June 2026

GMP Audit vs GDP Audit: Which Does Your Business Need?

OverviewA senior QP's guide to the GMP vs GDP audit decision: what each covers, the frameworks behind them, and how to scope the right audit for your UK or EU business.

If you supply, manufacture, import or distribute medicinal products in the UK or EU, sooner or later you will face a decision about the GMP vs GDP audit question: which one does your operation actually need, and how far should it go? The two frameworks share DNA and language, but they protect different stages of the product lifecycle, and confusing them is a fast route to findings, delays and avoidable risk to patients.

Side-by-side comparison of GMP and GDP audit scope, frameworks and roles — GMP Audit vs GDP Audit

GMP vs GDP audit: what each one actually covers

Good Manufacturing Practice (GMP) governs how medicinal products are made and tested. Good Distribution Practice (GDP) governs how they are stored, transported and traded once released. Both sit under the same regulatory umbrella in the UK, overseen by the MHRA, and both are built on the same quality philosophy set out in ICH Q9 (Quality Risk Management) and ICH Q10 (Pharmaceutical Quality System). The difference is the operation each one audits.

A GMP audit assesses the controls behind manufacture and quality control: facilities, equipment qualification, process validation, batch records, data integrity and the role of the Qualified Person (QP) who certifies each batch. A GDP audit assesses the integrity of the supply chain after the gate: temperature control, vehicle and warehouse conditions, the qualification of customers and suppliers, falsified-medicines safeguards and the role of the Responsible Person (RP). In short, GMP keeps the product right; GDP keeps it right all the way to the patient.

The regulatory frameworks behind each audit

Knowing which document a finding maps to is half the battle. The two audit types draw on distinct, though related, reference sets.

GMP frameworks

EU GMP (the EudraLex Volume 4 guide and its Annexes), retained in UK law post-Brexit, including Annex 1 for sterile products and Annex 11 for computerised systems.
21 CFR Parts 210 and 211 where product is destined for, or sourced from, the United States.
ALCOA+ principles underpinning data integrity expectations across records and electronic systems.

GDP frameworks

The EU Guidelines on Good Distribution Practice of medicinal products for human use (2013/C 343/01), again retained in the UK.
The UK Wholesale Dealer's Licence (WDA(H)) regime, which requires a named RP on the licence.
The Falsified Medicines Directive safeguards as they continue to apply to the relevant supply routes.

Both regimes expect a living quality management system, robust deviation and CAPA handling, change control and management review — the ICH Q10 backbone — but the evidence an auditor asks to see is shaped by whether you are making or moving the product.

How to decide which audit your business needs

The honest answer is that your licences and your activities decide for you. Map your role against what you actually do, not against what your job titles suggest.

Do you hold, or rely on, a Manufacturer's/Importer's Authorisation (MIA)? Then GMP applies to that site or to your contract manufacturer, and batch certification by a QP is in scope.
Do you hold a WDA(H) and trade, store or broker finished product? Then GDP applies, and your RP must be able to demonstrate control of the supply chain.
Do you import from outside the UK? You may need both — GMP for the importation and QP certification step, and GDP for onward storage and distribution.

Virtual companies and CMO clients often assume that outsourcing manufacture removes their GMP obligations. It does not. You remain accountable for auditing your contract sites, and a well-run supplier qualification programme is itself a core expectation of both GMP and GDP. If you are unsure where your boundaries sit, our full range of services is structured around exactly these licence-driven distinctions.

Where GMP and GDP audits overlap — and where they part company

The overlap is real and worth using to your advantage. A single, well-planned audit programme can cover the common ground once and apply it across both regimes.

Shared ground: quality risk management (ICH Q9), self-inspection, training and competence, documentation control, deviation/CAPA, supplier and customer qualification, and data integrity (ALCOA+).
GMP-specific: qualification and validation, environmental monitoring and contamination control strategy under Annex 1, batch manufacturing and QC records, and QP batch certification.
GDP-specific: temperature mapping of warehouses and vehicles, cold-chain qualification, returns and recalls handling, and protection against falsified product entering the chain.

A GMP auditor wants to know the batch was made correctly. A GDP auditor wants to know that same batch was still fit for purpose when it reached the patient. Both questions must be answered — but they are not the same question.

Treating them as interchangeable is where teams come unstuck. We have seen distributors audited against manufacturing expectations they could never meet, and importers caught short because no one owned the GDP storage step. Our published case studies show how a properly scoped programme avoids both traps.

Getting the audit scope right the first time

Whichever audit you need, scope discipline is what separates a useful inspection from a box-ticking exercise. Before any audit — internal, supplier or regulatory readiness — agree the standard being applied, the sites and processes in scope, the records to be sampled and how findings will be graded and tracked to closure. A focused GMP audit against a clear standard will surface more meaningful risk than a sprawling review with no anchor, and the same holds for GDP.

Use risk to prioritise. ICH Q9 is not just a phrase for the quality manual; it should drive which suppliers you audit, how often, and how deeply. A sterile manufacturer and a low-risk excipient supplier do not warrant the same intensity, and a national wholesaler and a single-product broker do not warrant the same GDP scrutiny.

GMP vs GDP audit: key takeaways

The GMP vs GDP audit choice is rarely either/or — it is a question of mapping your licences and activities to the right framework, then scoping each audit so it earns its place. GMP protects how the product is made; GDP protects it through the supply chain; and many UK and EU operations, especially importers, genuinely need both, run as one coherent programme.

If you are weighing up which audits your business needs — or you want an independent QP and RP perspective before the MHRA forms its own view — talk to our team. We will help you scope the right audit, against the right standard, the first time.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

Always confirm against the latest published version of each source.

Frequently asked questions

Can one audit cover both GMP and GDP requirements?+

Not as a single standard, because they assess different operations and reference different guidelines. However, you can run them as one coordinated programme that audits the shared ground — quality risk management, data integrity, deviations and supplier qualification — once, then adds the GMP-specific or GDP-specific elements as separate, clearly scoped modules. This avoids duplication while keeping each finding mapped to the correct framework.

Does my company need a GMP audit if we outsource all manufacturing?+

Yes. Outsourcing manufacture does not transfer your accountability for quality, so you remain responsible for auditing your contract manufacturers against GMP. A structured supplier qualification and contract-site audit programme is itself a core expectation of EU GMP, and the MHRA will look to the authorisation holder to demonstrate that oversight.

Who signs off the findings — a QP or a Responsible Person?+

It depends on the regime. GMP-related findings, particularly anything touching batch certification, fall to the Qualified Person named on the manufacturing authorisation, while GDP findings on storage, transport and distribution fall to the Responsible Person on the wholesale dealer's licence. Importers often need both roles engaged, since the same batch may cross from a GMP step into GDP-controlled distribution.