GMP compliance audits and gap assessments

An audit is only worth the days it costs if it tells you something you did not already know and gives you a route out. Our reports classify every finding, rank it by risk, and set out what to do first, who should own it and how long it should take.

The reference is agreed before we start, and it is written into the report. For most clients this is EU GMP Part I and the relevant annexes, together with ICH Q9 and Q10 where the quality system is in scope. For distribution activities the reference is the EU guidelines on good distribution practice. Where a client supplies the United States market we also assess against the corresponding parts of 21 CFR 210 and 211.

Naming the standard matters. An audit report that says a practice is “not best practice” without saying which requirement it fails is an opinion. Your management team cannot prioritise against opinions.

Every finding is graded as critical, major or minor, using the definitions in the applicable guidance rather than a house scale. Critical means a practice that has produced, or is likely to produce, a product that is harmful. Major means a significant deviation from the requirements that is not critical. Minor means a departure that is neither critical nor major but still needs correcting.

Alongside the classification, each finding carries a risk ranking that takes account of how likely it is to be seen by an inspector and how expensive it becomes if it is left. Those two things are not the same, and companies with limited resources need both in order to sequence the work sensibly.

A closing meeting on the last day, so nothing in the written report is a surprise. A written report within ten working days, containing the scope and standard, the classified findings with the evidence for each, a remediation plan with a suggested owner and timescale per finding, and a short summary written for people who are not quality specialists. That summary matters if the report is going to a board or an investor.

Where a finding is systemic rather than local we say so explicitly. Fixing eight symptoms of one broken process is the most common way companies waste remediation budget.

We are happy to help you remediate what we find, and many clients ask us to. We will not audit our own remediation work. If we have built or rebuilt a system for you, the next audit of that system should be done by someone else, and we will say so rather than take the work. Independence is the only thing that makes an audit report worth showing to a customer or an authority.

How long does an audit take?

A focused gap assessment is often one to two days. A full quality system audit of a small site is typically two to three days on site plus preparation and reporting. Larger or multi product sites take longer. We give you the number of days in the proposal and we do not extend it without agreement.

Can an audit be done remotely?

Document based parts can. Anything involving the floor, equipment, storage conditions or behaviour cannot be assessed properly through a screen. We will do hybrid audits where that is appropriate, and we will state clearly in the report which areas were not physically observed.

Will you help us fix the findings?

Yes, as a separate engagement. What we will not do is audit work we performed ourselves.

Do you sign confidentiality agreements?

Always, before any document is shared. We work under your agreement or ours, whichever you prefer.

How far in advance should we book?

Three to six weeks is realistic and gives time for the advance document review. For urgent situations following a serious deviation or a customer complaint we will try to accommodate you sooner.