GMP Audits: How to Plan and Run Internal, Supplier and Mock Inspection Audits

Three kinds of GMP audit

A GMP audit is a planned, independent check that operations and records meet GMP. Drug companies run three kinds:

Audit type	Purpose	Basis
Self-inspection (internal audit)	Find and fix your own gaps	EU GMP Chapter 9; ICH Q7 section 2.4 for APIs
Supplier and contract manufacturer audit	Confirm partners meet GMP on your behalf	Quality agreements; supplier qualification under 21 CFR 211 and ICH Q7
Mock inspection	Rehearse a regulatory inspection under realistic conditions	Inspection readiness program

EU GMP is explicit: “Self inspections should be conducted in order to monitor the implementation and compliance with Good Manufacturing Practice principles and to propose necessary corrective measures,” and they “should be conducted in an independent and detailed way by designated competent person(s)” (EU GMP Chapter 9). For APIs, ICH Q7 says “regular internal audits should be performed” on an approved schedule, and “Agreed corrective actions should be completed in a timely and effective manner” (FDA, ICH Q7).

Why GMP audits matter more in 2026

• Less notice before inspections. FDA expanded unannounced inspections at foreign facilities in May 2025 (Hogan Lovells). A self-inspection program is now the only reliable rehearsal.
• Supply chain shifts. Onshoring and tariff changes are moving products to new sites and new suppliers, each of which needs qualification (FDA, PreCheck).
• Familiar findings keep recurring. The top FY2025 drug citation was 211.22(d), quality unit procedures not written or followed, with 243 observations (GMP Insiders). Good internal audits catch exactly this.

Scoping the audit with FDA’s six systems

FDA structures drug inspections around six systems: quality, facilities and equipment, materials, production, packaging and labeling, and laboratory control. A full FDA inspection covers “at least four systems, one of which must be the quality system” (FDA, CP 7356.002F). Use the same structure for your audit program:

• Annual coverage of all six systems across the year
• Quality system in every audit, because it is in every FDA inspection
• Risk-based depth: more time where deviations, complaints or changes are concentrated

How to run a GMP audit

1. Plan: scope, criteria (21 CFR 211, ICH Q7, EU GMP, quality agreement), team and schedule.
2. Pre-review documents: procedures, recent deviations, OOS results, CAPAs, change controls and prior audit findings.
3. Open: confirm scope and logistics with the auditee.
4. Walk the floor and lab: compare practice with procedures, check records in real time.
5. Trace samples end to end: a batch, a complaint, a deviation, a change.
6. Test data integrity: audit trails, access controls, raw data versus reported results.
7. Close: present findings with requirement, evidence and gap.
8. Report and follow up: classify findings, agree CAPAs, verify completion and effectiveness.

Supplier and contract manufacturer audits

The owner of a product stays responsible for its quality, whoever makes it. FDA’s quality agreements guidance expects agreements to define which party “has primary responsibility for fully complying with cGMPs,” and FDA “intends to review quality agreements during facility inspections” (FDA Law Blog). Audit partners against both GMP and the agreement: notification of deviations and OOS results, change control, data access and subcontracting.

GMP audit checklist

• Annual audit program covering all six systems and all GxP areas
• Auditors independent of the area audited and trained
• Pre-review of deviations, OOS, CAPA, changes and prior findings
• Procedures compared with actual practice
• Batch, complaint and deviation samples traced end to end
• Data integrity checks in lab and production systems
• Findings written as requirement, evidence and gap
• CAPAs agreed, tracked and verified for effectiveness
• Supplier and CMO audits aligned with quality agreements
• Mock inspection held at least yearly, including unannounced scenarios

Pre-review the document set before you arrive

The document pre-review is where audits are won or lost, and it is where auditors spend most of their preparation time. AskDona reviews SOPs, investigations, batch records and quality agreements against 21 CFR 211, ICH Q7, EU GMP or your audit criteria, flags gaps and contradictions, and cites the passage behind every finding, so auditors arrive knowing where to look.

Run a sample GMP audit pre-review on one site’s procedure set. AskDona shows the evidence; your auditors decide.

FAQ

What is a GMP audit? A planned, independent check of whether operations and records meet good manufacturing practice.

Are internal GMP audits required? EU GMP Chapter 9 requires self-inspections, and ICH Q7 expects regular internal audits for APIs (EU GMP; ICH Q7).

How often should GMP audits be done? On an approved, risk-based schedule that covers all systems over a defined cycle, commonly annually.

What is a mock FDA inspection? A rehearsal run like a real inspection, often by external auditors, to test readiness and responses.

Who is responsible for a contract manufacturer’s GMP compliance? Both parties have duties, defined in the quality agreement; the product owner remains accountable for its product.

References

All pages opened and checked by October 14, 2026.

Source	Type	Date	Used for
EU GMP Chapter 9: Self Inspection	Regulator	n.d.	Self-inspection principle
FDA: ICH Q7 guidance	Regulator guidance	Sep 2016	Internal audits for APIs
Hogan Lovells: Unannounced foreign inspections	Law firm	May 8, 2025	Inspection policy
FDA: PreCheck program	Regulator	Aug 7, 2025	Onshoring
GMP Insiders: FY2025 observations	Trade analysis	Jan 5, 2026	Citation counts
FDA: Compliance program 7356.002F	Regulator	Aug 1, 2025	Six systems
FDA Law Blog: Quality agreement guidance	Law firm blog	Nov 27, 2016	Contract manufacturer oversight