This free GMP audit checklist is for QA managers, internal auditors and heads of quality at sites that make or pack medicines. One run is one self-inspection of one site, building or area. It plans the audit and sets its scope and criteria, checks the auditors are independent, and reviews earlier findings and quality data before the opening meeting. Two audit days cover the quality system and documentation, personnel, premises and equipment, production, packaging and the quality control laboratory, then deviations, complaints, returns and CAPA. Findings are logged with their evidence, graded critical, major or other, and presented at the closing meeting. The report, the CAPA plan, verification and close-out follow. Choose UK or EU GMP, US 21 CFR 210 and 211, or both, and the matching checks appear. A for-cause audit adds a review of the event behind it, and a critical finding adds containment and escalation the same day.
Good manufacturing practice (GMP) is the minimum standard a medicines manufacturer must meet in its production processes. A GMP audit run by the site itself, called a self-inspection in the EU GMP Guide, is how a manufacturer checks that it still meets that standard between regulatory inspections. Chapter 9 of the Guide asks for self-inspections of personnel, premises, equipment, documentation, production, quality control, distribution, complaints and recalls, and self-inspection itself, at intervals following a pre-arranged programme. In the US, 21 CFR Parts 210 and 211 contain no section on self-inspection, so the internal audit is set by the site’s own quality system, and it audits against the Part 211 subparts.
A GMP audit is narrower and deeper than a general quality audit. The QA compliance audit and the ISO 9001 internal audit test a quality management system against its own procedures or a standard. A GMP audit follows product: the batch record, line clearance, label reconciliation, laboratory raw data and the release decision. Its findings then run through the site’s CAPA process.
Who: your own designated, competent auditors, independent of the area they audit.
Against: the GMP rules for your market, your licence or application commitments and your site procedures.
Produces: a report of every observation with proposed corrective measures, and a record of the actions taken.
When: on applying for a licence, then periodically based on the site’s risk rating, sometimes with little or no notice.
How: inspectors interview staff, review documents and visit manufacturing areas, laboratories, storage and returns.
Ends with: deficiencies graded critical, major or other, and a written response with corrective actions and dates.
Supplier audit: a second-party audit of another company’s site against your requirements.
ISO 9001 internal audit: one process tested against the standard’s clauses.
GMP audit: your own manufacturing site tested against the GMP rules for the medicines it makes.
Eight phases take one self-inspection from planning to close-out, with two days on site. Choose UK or EU GMP, US 21 CFR 210 and 211, or both on the first task and the matching checks appear: the product quality review, Qualified Person certification and defect reporting for the UK and EU, and the annual product review, the quality unit’s batch record review and adverse drug experience reporting for the US. A for-cause audit adds a review of the event behind it, a critical finding adds containment and escalation the same day, and nothing after the CAPA plan approval can be completed until it is given.
One run is one self-inspection of one site, building or area. Set the audit date first, because every due date counts from it, and choose the rules the site works under so the matching checks appear.
The desk review decides where the audit looks hardest. Choose the records to sample yourself rather than accepting the ones the area offers.
Test whether the system works, not only whether a procedure exists. Every claim needs a record behind it.
Walk the areas and talk to the people who do the work. Compare what you see with what the records say.
Follow one batch through the area and the laboratory. Trace what you see back to the batch record and the raw data.
These systems show whether the site learns from its problems. Sample closed records as well as open ones.
Agree the facts before discussing the grade. A critical deficiency is acted on the same day, not when the report is written.
The audit is not finished when the report is issued. It closes when every action is done and shown to work, and nothing after the CAPA plan approval can be completed until it is given.
The two rulebooks cover the same ground in a different order. The table maps each area this checklist audits to the part of 21 CFR Part 211 and the chapter of the EU GMP Guide (EudraLex Volume 4) that governs it, and to the phase that checks it. The MHRA’s GMP guidance points to EudraLex Volume 4 and to the Orange Guide. It is a map, not the text: audit against the current version your site is licensed or registered under.
| Area | 21 CFR Part 211 (US) | EU GMP Guide, Part I (UK and EU) | Checked in |
|---|---|---|---|
| Quality unit, quality system and product reviews | Subpart B, 211.22; annual product review, 211.180(e) | Chapter 1, Pharmaceutical Quality System | Phase 3 |
| Documents, records and computerised systems | 211.68(b), 211.100; Subpart J, Records and Reports | Chapter 4, Documentation | Phase 3 |
| Personnel, training and hygiene | Subpart B, 211.25 and 211.28 | Chapter 2, Personnel | Phase 4 |
| Premises, utilities and equipment | Subpart C, Buildings and Facilities; Subpart D, Equipment; 211.160(b)(4) calibration | Chapter 3, Premises and Equipment | Phase 4 |
| Materials, production, packaging and labelling | Subpart E, Components, Containers and Closures; Subpart F, Production and Process Controls; Subpart G, Packaging and Labeling | Chapter 5, Production | Phase 5 |
| Laboratory, stability and reserve samples | Subpart I, Laboratory Controls; 211.194 laboratory records | Chapter 6, Quality Control | Phase 5 |
| Release | 211.165 testing and release; 211.192 production record review | Qualified Person certification, 1.4(xv) and 2.6 | Phase 5 |
| Deviations, complaints, returns and recalls | 211.192 investigations; 211.198 complaint files; Subpart K, Returned and Salvaged Drug Products | Chapter 8, Complaints, Quality Defects and Product Recalls | Phase 6 |
| Self-inspection | No section; set by your own quality system procedures | Chapter 9, Self Inspection | Phases 1, 7 and 8 |
Grading findings. Part 211 sets no grades for internal findings, and neither does Chapter 9. The MHRA grades its own inspection deficiencies at three levels, which make a ready-made scale if your procedure has none. In summary, a critical deficiency has produced, or significantly risks producing, a product that is harmful to human or veterinary patients. A major deficiency is non-critical but has produced or may produce a product that does not comply with its marketing authorisation, or shows a major deviation from GMP or from the licence, or a failure in batch release or in the Qualified Person’s duties; several other deficiencies together can add up to a major one. An other deficiency cannot be classed as critical or major but is still a departure from GMP.
Where the US and EU differ most. In the EU and UK, no batch is sold or supplied until a Qualified Person has certified it, and confirmed quality defects that may lead to a recall or an abnormal restriction in supply are reported to the competent authorities. Under Part 211, the quality control unit reviews and approves every production and control record before a batch is released, and complaints are reviewed to decide whether they are serious and unexpected adverse drug experiences that must be reported to FDA. The checklist adds those checks when you choose the rules.
Choose UK or EU GMP, US 21 CFR 210 and 211, or both on the first task and the matching checks appear in the audit-day phases. A for-cause audit adds a review of the event behind it. Mark areas outside this audit’s scope not applicable, or adapt the checks to your own procedures in the template designer.
Grading a finding critical adds containment and escalation tasks for the head of quality, due the same day. The report and the CAPA plan are assigned to the head of quality alone, and nothing after the CAPA plan approval can be completed until it is given, so the record shows each action was approved before it was verified.
Start each self-inspection from a recurring schedule, so every area in the programme comes round when it is due. Findings, sampled records and the CAPA plan sit in tables on the tasks that produced them, and the Reports Grid shows every open audit and overdue action across your sites.
CheckFlow does not inspect your site and does not replace your quality management system, your batch records or a Qualified Person’s judgement. It runs the steps of a self-inspection around your own procedures, so every audit is planned, carried out and closed in the same order with a record of who did what. If you keep GMP records in CheckFlow, assess and validate it under your own computerised system procedures first. See how CheckFlow’s manufacturing checklist software handles quality and safety routines on the shop floor.
This template audits one site or area against GMP. Run each finding through the CAPA (Corrective & Preventive Action) Checklist, dig into a stubborn one with the Root Cause Analysis (8D) Checklist, audit the companies that supply you with the Supplier Audit Checklist and keep instruments in date with the Calibration Management Checklist.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
A GMP audit checks whether a medicines manufacturing site meets good manufacturing practice. When the site runs it on itself, the EU GMP Guide calls it a self-inspection: Chapter 9 says it monitors the implementation of, and compliance with, GMP and proposes corrective measures. A regulatory inspection is different. The MHRA, FDA or another authority sends its own inspectors, and serious findings can lead to regulatory action. A supplier audit is different again: you audit another company’s site against your requirements.
The areas the EU GMP Guide lists for self-inspection: personnel, premises, equipment, documentation, production, quality control, distribution, complaints and recalls, and the self-inspection system itself. In practice that means the quality unit and change control, document control and good documentation practice, training and hygiene, premises, utilities, cleaning and calibration, materials, batch manufacture, in-process controls and labelling, laboratory records and stability, release, deviations, complaints, returns and CAPA. The checklist should also cover planning, graded findings, the report and verified close-out of every action.
Neither rulebook sets a fixed interval. The EU GMP Guide asks for self-inspections at intervals following a pre-arranged programme, and Chapter 1 asks for a process that regularly appraises the effectiveness of the quality system. 21 CFR Part 211 has no self-inspection section, so the frequency comes from your own procedures. Set a cycle in your procedure that covers every area, and visit higher-risk areas, and areas with recent problems, more often. A deviation, complaint or trend can also trigger a for-cause audit between scheduled ones.
The EU GMP Guide says self-inspections should be conducted in an independent and detailed way by designated competent people from the company, and that independent audits by external experts may also be useful. In practice, auditors should not audit their own work, should be trained in GMP and in auditing, and should bring in a subject expert for specialist areas such as sterile manufacture, the laboratory or computerised systems. Under 21 CFR 211.34, any consultant who advises on manufacturing must have the education, training and experience for the subject.
They are the MHRA’s three grades for inspection deficiencies. A critical deficiency has produced, or significantly risks producing, a product that is harmful to human or veterinary patients. A major deficiency is non-critical but has produced or may produce a product that does not comply with its marketing authorisation, or shows a major deviation from GMP or the licence, or a failure in batch release or the Qualified Person’s duties. Other covers any remaining departure from GMP. If your procedure has no grades of its own, using these three keeps internal findings comparable with an inspection’s.
Part 211 has no section on self-inspection or internal audit, and neither does Part 210. It does require a quality control unit with written responsibilities, an evaluation of each drug product’s quality standards at least annually under 211.180(e), and thorough investigation of unexplained discrepancies and failures under 211.192. An internal audit programme is how a site can check it meets these requirements before an FDA investigator does. Check your own procedures and any commitments in your applications for the frequency you have set.
An ISO 9001 internal audit tests a quality management system against the clauses of a voluntary standard and the organisation’s own procedures, usually one process at a time. A GMP audit tests a medicines manufacturing site against the GMP rules a manufacturer must meet for the products it makes, and follows the product: batch records, line clearance, label reconciliation, laboratory raw data and the release decision. ISO 9001 certification does not show GMP compliance, so a certified site still needs its own GMP self-inspections.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting
