retraining after significant changes/incidents.

Evidence: Skills matrices, OJT cards, assessor qualifications, hygiene & medical fitness records, gowning audits.

Signals: “Read & understand only,” skills not demonstrated; lapsed re-qualification; incomplete gowning observation logs.

2) Premises, Flows & HVAC (Containment & Cleanability)

What to do. Design flows for people, materials, waste, and product to prevent mix-ups/cross-contamination. Classify rooms by risk; define pressure cascades and monitor via BMS/EMS. Keep surfaces smooth and cleanable; prevent pest ingress; segregate sampling/dispensing; control lighting and noise affecting inspection or execution.

• Acceptance: Pressures/temps/RH at setpoints; unidirectional flows where required; no backflow or dead legs (utilities); EM meets alert/action limits.
• Evidence: Layout drawings, qualification/commissioning reports, trending of pressure/EM, deviation logs & CAPA for excursions.
• Signals: Inverted gradients, uncontrolled material crossovers, ineffective segregation at changeover.

3) Equipment & Utilities (Qualification, Cleaning, Status)

What to do. Qualify equipment/utilities (IQ/OQ/PQ or fit-for-purpose equivalents). Maintain status labels (Clean/In Use/To Be Cleaned), logbooks, and preventive maintenance. Validate cleaning with limits based on MAC/PDE, visual criteria, worst-case soils, and hard-to-clean locations. Validate CCI where applicable.

• Acceptance: Qualification covers operating ranges; cleaning residues ≤ limits; CCI maintained; change parts uniquely identified and controlled.
• Evidence: IQ/OQ/PQ packs, logbooks, swab/rinse data, visual clean checks, maintenance/calibration records, CCI test results.
• Signals: Repeated cleaning failures; missing logbook entries; unverified temporary repairs.

4) Materials, Components & Suppliers (Identity & Control)

What to do. Qualify suppliers, define sampling plans, and perform identity testing for each component lot per regulatory expectations. Control containers & closures (compatibility, extractables/leachables, CCI strategy). Separate quarantine from released stock with electronic and physical controls; FEFO applies where relevant.

• Acceptance: Supplier approval on risk basis; identity tests pass; COAs verified; label status clear; holds documented and justified.
• Evidence: Quality agreements, supplier audits, incoming QC records, sampling traceability, label & status records.
• Signals: Blind reliance on COA for identity where own testing is required; uncontrolled returns or re-tests.

5) Master & Executed Batch Records (MBR/EBR)

What to do. Design MBR/EBR with clear steps, specs, IPC, and acceptance criteria; include line clearance signatures, material identification, equipment status, yield/reconciliation, and deviation capture points. For EBR, apply Part 11/Annex 11 controls: role-based access, e-signatures, audit trails, time sync, backup & restore testing.

• Acceptance: Zero ambiguous instructions; controlled versions; reconciliations and yields within predefined limits; deviations documented at point-of-occurrence.
• Evidence: Approved MBR/EBR versions, executed records with contemporaneous entries, ATR exports with reviewer notes, restore test proofs.
• Signals: “Blanket” back-dating; missing cross-references to attachments; reconciliation gaps.

6) Production & Process Controls (Validation & IPC)

What to do. Operate within validated ranges; define IPC plans and response rules (hold/rework/reject). Use control charts for critical attributes and trend alarms/interventions. Stage 1–2–3 validation applies: design & understanding (Stage 1), PPQ (Stage 2), and CPV (Stage 3) with feedback to APR/PQR and Management Review.

• Acceptance: IPC within limits; alarms handled per SOP; PPQ lots meet capability thresholds; CPV detects drift early.
• Evidence: PPQ protocols/reports, IPC logs and trends, intervention records, CPV dashboards.
• Signals: Informal “tweaks” without change control; excursions explained without data; stale CPV reviews.

7) Cleaning Validation & Changeover (Carryover Risk)

What to do. Establish worst-case product/residue sets; calculate limits (MACO/PDE-based), swab/rinse locations, and acceptance criteria (analytical + visual). Validate campaigning and matrix approaches where justified. Ensure status flips on equipment/line are documented.

• Acceptance: Residues ≤ analytical & visual limits; no cross-contamination events; campaign length justified.
• Evidence: Cleaning protocols/reports, residue maps, analytical validation for swab/rinse methods, visual inspection records.
• Signals: Reliance on visual only without justification; missing “hardest to clean” locations; inadequate rinse recovery validation.

8) Packaging, Labeling & Serialization Interfaces

What to do. Control component issuance/return and reconciliation; verify artwork versions; test scanners/vision systems; execute tight line clearance. Where serialization/aggregation applies, validate interfaces (MES L3 ↔ repository L4/L5) and ensure complaint/recall traceability links.

• Acceptance: 0 label mix-ups; reconciliations within tolerance; vision reject & rework rules applied; CCI strategy effective where relevant.
• Evidence: Issuance/return logs, reconciliation sheets, vision rejects & dispositions, interface test records, CCI data.
• Signals: Re-use of printed components; “over-stickering” without full control; serialization rework without validated process.

9) Laboratory Controls, OOS/OOT & Stability

What to do. Validate or verify methods; maintain version control and reference standards; calibrate instruments; enforce data integrity (unique IDs, audit trails). Handle OOS/OOT with a two-phase model: immediate checks (Phase 1) → full investigation (Phase 2). Design a stability program with protocolized conditions, pulls, and acceptance criteria; manage changes with justified impact to stability.

• Acceptance: Methods current and fit; OOS/OOT decisions evidence-based; stability shows claims supported; DI controls proven.
• Evidence: Method validation/verification, system suitability, OOS/OOT files, stability protocols/reports, ATR reviews, backup/restore tests.
• Signals: “Testing into compliance,” untrended OOTs, incomplete raw data, missing audit trail reviews.

10) Warehousing, Distribution & Cold Chain (GDP Touchpoints)

What to do. Qualify storage (mapping), define alarms & responses, and document excursions. Apply FEFO; segregate quarantine/approved/rejected/returns. Validate shippers for cold chain; ensure traceability through distribution with complaint & recall readiness.

• Acceptance: Mapping completed; alarms verified; excursion assessments documented; returns handled under SOP with QA decision.
• Evidence: Mapping/qualification reports, alarm logs, deviation/CAPA for excursions, distribution records, recall drill results.
• Signals: Alarm fatigue or disabled alarms; undocumented door-open events; ambiguous returned goods handling.

11) Data Integrity & Records (Paper/Electronic, ALCOA+)

What to do. Keep records Attributable, Legible, Contemporaneous, Original, Accurate—plus Complete, Consistent, Enduring, Available. For electronic records used in place of paper, apply Part 11/Annex 11 controls: access, e-signatures, audit trails, time sync, backup/restore (with tested restores), and periodic reviews. Define Audit Trail Review windows and filters (create/modify/delete, config changes, failed logins, admin actions, data exports).

12) Deviation, Investigations & CAPA (With Effectiveness Checks)

What to do. Use sharp problem statements, evidence packs (records, data, images), validated root cause (5-Why/Ishikawa + recreate/parallel tests), and effectiveness checks (EC) that are measurable and time-bound. Prefer design/engineering controls over reminders; read-across to similar lines/products where the mechanism is shared.

• Acceptance: Root cause supported by data; EC defined and verified; recurrence eliminated or within defined risk.
• Evidence: Investigation reports, EC results, trend charts, read-across logs.
• Signals: “Human error” without system analysis; repeat events; ECs closed by opinion rather than data.

13) Change Control, APR/PQR & CPV (Stage 3)

What to do. Risk-rank changes (minor/major/critical); assess impacts on validation, labels, specs, cleaning, training, data integrity, and stability; define verification/PPQ where needed. Aggregate performance in APR/PQR (complaints, OOS/OOT, yield, deviations, changes, stability signals) and run CPV to detect drift, feeding Management Review decisions.

• Acceptance: No change implemented without approved impact assessment; APR/PQR has signals and actions; CPV has owners & thresholds.
• Evidence: Change files with impact/verification, APR/PQR reports & actions, CPV dashboards and escalations.
• Signals: “Rubber-stamp” approvals; CPV with no decisions; recurring deviations not linked back to change or CPV.

14) Risk-to-Criteria Cheat Sheet (Quick Design Aid)

Risk	Control	Acceptance Criteria	Evidence to Show
Label mix-up	Line clearance; issuance/reconciliation; vision checks	0 mix-ups; reconciliation within tolerance	LC checklists; issuance/return logs; rejects; deviations
Process drift	IPC with control charts; start-up ramp sampling	Within limits; timely interventions	IPC trends; intervention logs; CPV charts
Carryover contamination	Validated cleaning; MAC/PDE limits	Residues ≤ limits; visual clean	Swab/rinse data; cleaning records; equipment logs
Data integrity breach	Part 11/Annex 11; ATR; access reviews	0 shared accounts; on-time ATR; restore success	ATR logs; access reviews; restore tests
Cold-chain excursion	Qualified shippers; alarms; SOP for excursions	Assessment documented; product disposition justified	Excursion forms; stability impact; QA disposition

15) Methods, Tools & Templates (Ready to Use)

• MBR/EBR Design Prompts: Where is each acceptance criterion recorded? What data triggers a hold? What evidence proves batch identity/strength/quality/purity?
• Line Clearance Checklist (extract): remove remnants; empty reject bins; reset counters; verify correct components/artwork; scanner/vision challenge; dual sign-off.
• Cleaning Validation Matrix: product families; worst-case soils; shared equipment map; swab locations; limits; re-clean criteria.
• OOS/OOT Flow: immediate checks → hypothesis → justified retest rules → root cause & CAPA → effectiveness checks → trend read-across.
• Warehouse Mapping Pack: temperature/RH grid, logger locations, normal/abnormal patterns, alarm tests, excursion form templates.
• Change Impact Checklist: validation, labels/specs, stability, DI controls (access/ATR/e-sig), cleaning, training, supplier notifications, regulatory filings.

16) Inspection Readiness (War-Room & Live Floor)

War-room contents. Process validation storyboards (Stage 1–3), cleaning validation, OOS/OOT governance, packaging/label control, DI/Part 11 evidence, warehouse mapping & excursion assessments, APR/PQR and CPV actions. Prepare live floor demos: line clearance, component issuance, scanner/vision challenge, ATR export with hash, restore drill evidence, environmental gradients trend.

• People prep: who answers what; location of records; how to navigate EBR; how to show a certified copy; how to demonstrate a restore test result.

17) FAQs

• Do we need EBR to be compliant? No; paper is acceptable if it meets ALCOA+. If electronic records replace paper, Part 11/Annex 11 controls must be implemented and tested.
• How many PPQ lots are required? Risk-based. Consecutive lots under routine conditions with statistical capability and edge-of-range challenges are expected.
• When can visual clean replace analytical? Only with strong justification (residue properties, detection limits, robust visual program). Otherwise, analytical verification to MAC/PDE is needed.
• What is the minimal ATR frequency? Risk-based; define per system (e.g., batch-wise for QC results, monthly for MBR/EBR, quarterly for QMS) with clear filters and evidence capture.
• Can we rely on supplier COAs? Identity testing typically required per component lot; other tests may be reduced with a robust supplier qualification and verification program.

References & Further Reading

• 21 CFR Parts 210/211 (US cGMP for finished pharmaceuticals)
• EudraLex Volume 4 (EU/UK GMP) and relevant Annexes
• ICH Q9(R1) Quality Risk Management; ICH Q10 Pharmaceutical Quality System
• WHO GMP, PIC/S GMP Guide
• FDA Guidance: Process Validation (Stage 1–3); Data Integrity and Compliance with cGMP

{
“@context”:”https://schema.org”,
“@type”:[“TechArticle”,”FAQPage”],
“headline”:”cGMP Requirements for Pharmaceutical Manufacturers — Step-by-Step, Inspection-Ready Guide”,
“description”:”Floor-level cGMP tutorial covering premises, equipment, production and process controls, lab controls, packaging/labeling, warehousing, CAPA, change control, APR/PQR, and CPV evidence.”,
“dateModified”:”2025-11-14″,
“author”:{“@type”:”Organization”,”name”:”PharmaGMP.com”},
“publisher”:{“@type”:”Organization”,”name”:”PharmaGMP.com”},
“mainEntity”:[
{“@type”:”Question”,”name”:”Do we need EBR to be compliant?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Paper is acceptable if it meets ALCOA+. If electronic records are used in lieu of paper, Part 11/Annex 11 controls must be implemented and tested.”}},
{“@type”:”Question”,”name”:”How many PPQ lots are required?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Risk-based, with consecutive lots under routine conditions and capability evidence; include edge-of-range challenges.”}},
{“@type”:”Question”,”name”:”When can visual clean replace analytical?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Only with strong justification; otherwise verify residues analytically to MAC/PDE limits.”}},
{“@type”:”Question”,”name”:”What is the minimal ATR frequency?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Risk-based by system, with defined windows and filters; capture evidence via immutable exports and reviewer notes.”}},
{“@type”:”Question”,”name”:”Can we rely on supplier COAs?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Identity testing is typically required per lot; other tests may be reduced with robust supplier qualification and verification.”}}
],
“breadcrumb”:{
“@type”:”BreadcrumbList”,
“itemListElement”:[
{“@type”:”ListItem”,”position”:1,”name”:”cGMP Requirements for Pharmaceutical Manufacturers”,”item”:”https://www.pharmagmp.com/cgmp-requirements-pharma-manufacturers-pillar/”},
{“@type”:”ListItem”,”position”:2,”name”:”Category Pillar”,”item”:”https://www.pharmagmp.com/cgmp-requirements-pharma-manufacturers-pillar/”}
]
}
}