How to Run a Supplier GMP Audit, Step by Step

A well-run supplier GMP audit is the difference between a supply chain you can defend in front of the MHRA and one that exposes your products, your patients and your licence to unnecessary risk. Done properly, it is far more than a checklist exercise: it is a structured, risk-based evaluation of whether a manufacturer or material supplier can consistently deliver against your quality requirements. This guide walks through the audit lifecycle as a UK Qualified Person would run it, from planning to closure.

Start with risk, not the supplier list

Before you book a single visit, decide why you are auditing and how often. The principles of ICH Q9 (Quality Risk Management) should drive your audit programme: high-risk suppliers of sterile products, active substances or critical excipients warrant deeper, more frequent on-site scrutiny than a low-risk supplier of a stable packaging component. Map each supplier against the criticality of what they provide, their regulatory history and any prior quality signals such as deviations, complaints or out-of-specification trends.

This risk ranking feeds directly into your quality management system under ICH Q10 and underpins the supplier qualification expectations in EU GMP Chapter 5 and Chapter 7 on outsourced activities. If you are building or refreshing this programme, our consultancy services can help you set proportionate audit frequencies that an inspector will accept.

Plan and prepare the audit

Preparation determines audit quality. Define the scope precisely: which site, which products or materials, which processes, and which GMP areas (for example sterile manufacture under Annex 1, or active substance manufacture). Agree the audit type up front, whether that is an initial qualification audit, a periodic re-audit, a "for-cause" audit triggered by a problem, or a remote/desktop assessment.

Build the audit pack

• A written audit plan and agenda shared with the supplier in advance.
• A review of the site master file, previous audit reports, CAPAs and any regulatory inspection outcomes.
• A tailored aide-memoire or checklist mapped to EU GMP (and, where the supplier ships to the US, the relevant parts of 21 CFR 210/211).
• Clear auditor competence: the lead auditor should be independent of the area being audited and trained in both GMP and audit technique.

Send a focused pre-audit questionnaire so you do not waste on-site time gathering basic facts. The objective is to arrive already knowing where the likely weak points are.

Conduct the supplier GMP audit on site

Open with a short meeting to confirm scope, agenda and logistics, then audit against the flow of the process rather than wandering room to room. Follow the product: from incoming materials, through manufacture and packaging, to release, storage and distribution. Use open questions, ask to be shown the activity, and verify what you are told against objective evidence.

What to examine in depth

• Quality system maturity: change control, deviation and CAPA management, and how effectively the supplier closes issues.
• Data integrity: test records, audit trails and electronic systems against ALCOA+ expectations. Data that is not attributable, legible, contemporaneous, original and accurate is a recurring finding.
• Contamination control: for sterile and high-risk products, the contamination control strategy required by Annex 1, including environmental monitoring and aseptic practice.
• Premises, equipment and validation: qualification status, calibration, cleaning validation and maintenance.
• Personnel and training: evidence that staff are trained and competent for the tasks they perform.

Take contemporaneous notes and grade what you find as you go. A finding without supporting evidence is an opinion, not an observation.

Classify findings and report objectively

Hold a closing meeting before you leave the site. Present your findings clearly, classify them consistently (typically critical, major and minor, plus recommendations), and give the supplier the chance to correct any factual misunderstanding. Critical findings are those that pose a real risk to product quality or patient safety, or indicate a serious data integrity breach.

Issue a written report promptly, usually within ten to fifteen working days. A strong report is factual, references the specific GMP requirement against each finding, and avoids speculation. Vague observations such as "documentation could be improved" help no one; instead, state exactly what was seen, where, and why it does not meet the standard. Our case studies show how a tightly written report accelerates supplier remediation.

Drive CAPA, follow-up and re-qualification

The audit is only valuable if it changes behaviour. Require a documented corrective and preventive action plan with realistic timescales and named owners. Assess each response for genuine root-cause analysis rather than a quick fix to the symptom, and verify completion, by evidence review or a follow-up visit, before you consider a finding closed.

Feed the outcome back into your supplier qualification status and your risk ranking. A supplier with repeated majors or an unresolved critical should not retain approved status. Schedule the next periodic audit on a risk basis, and ensure any technical or quality agreement reflects what you actually observed. This closed loop, audit to CAPA to re-assessment, is exactly what an MHRA inspector expects to see when they review your oversight of outsourced activities.

Key takeaways and next steps

A credible supplier GMP audit is risk-driven, well prepared, evidence-based and closed out with verified CAPA. Anchor it in ICH Q9 and ICH Q10, audit the process flow, hold your findings to ALCOA+ and Annex 1 where relevant, and write reports an inspector could pick up and follow.

• Rank suppliers by risk before setting audit frequency.
• Prepare thoroughly so on-site time is spent verifying, not learning.
• Classify findings consistently and report against the specific requirement.
• Insist on root-cause CAPA and verify closure before re-qualifying.

If you need experienced QPs to design your audit programme, run audits on your behalf, or strengthen your supplier oversight, explore our GMP audit service or get in touch with our team to discuss your requirements.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EudraLex Volume 4 — EU GMP Guidelines
• EU GMP Chapter 9 — Self Inspection
• MHRA Inspectorate Blog
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.