GMP audits: types, auditors, and what FDA cites that internal audits miss

A GMP audit is a planned, documented examination of a manufacturing facility, supplier or quality system that checks whether products are made and controlled to Good Manufacturing Practice requirements. Companies run GMP audits on themselves, on their suppliers and through outside firms; regulators such as FDA run inspections that follow the same logic.

Most guides stop at the audit types. This one adds what FDA investigators wrote on 779 human drug Form 483s citing 21 CFR Part 211 from January 2025 to July 2026, taken from the Atlas Form 483 directory (release of August 15, 2026, pulled November 6, 2026), and turns it into an audit scope you can use in November 2026.

Key facts:

• EU GMP Part I, Chapter 9 requires self-inspections by designated competent persons, recorded in a report with proposed corrective measures.
• ICH Q7 section 2.4 requires regular internal audits of API manufacturing against an approved schedule, with findings brought to responsible management.
• FDA's Compliance Policy Guide Sec. 130.300 says FDA will not routinely review or copy a drug company's internal audit reports.
• 21 CFR 211.22, quality unit responsibilities, appeared on 354 of 779 Part 211 drug 483s (45.4%) from January 2025 to July 2026.
• 21 CFR 211.192, investigation of discrepancies and failures, appeared on 296 of the same 779 forms (38.0%), up from 36.7% in 2025 to 41.8% in January to July 2026.
• Two in three of those forms (523, or 67.1%) cited 211.22, 211.192 or both.

What are the types of GMP audits?

GMP audits come in four types: internal audits (self-inspections), supplier or vendor audits, third-party audits, and regulatory inspections. The first three are tools a company uses on itself and its supply chain. The fourth is run by a regulator such as FDA and can end with a Form 483.

Internal audits test whether your own procedures work and are followed. EU GMP Chapter 9 lists what a self-inspection should cover: personnel, premises, equipment, documentation, production, quality control, distribution, complaints and recalls, and the self-inspection program itself. ICH Q10 section 4.1 names audit results as an input to management review, so a finding that never reaches senior management fails the guideline even if the CAPA closes.

Supplier audits check the companies you buy from. Under 21 CFR 211.84, you may rely on a supplier's certificate of analysis only after you establish the reliability of its test results and recheck them at intervals, and an on-site audit is the usual evidence. Our guide to supplier qualification covers the full process.

Third-party audits bring in outside auditors. Companies use them before a pre-approval inspection, for shared supplier audits, or when the internal team has audited the same area for years.

Regulatory inspections are the reference point for all three. An FDA investigator who finds objectionable conditions lists them on a Form 483. How to host an inspection day belongs to the FDA inspection playbook; this guide stays with the audits you run.

Who can be a GMP auditor?

A GMP auditor is a person trained in GMP requirements and audit technique who is independent of the work being audited. EU GMP Chapter 9.2 asks for "designated competent person(s)" working in an independent and detailed way, and 21 CFR 211.25 requires that anyone doing GMP work has the education, training and experience for the job.

In practice, a qualified GMP auditor brings four things:

1. Technical knowledge of the area: sterile manufacturing, oral solids, APIs, laboratories or packaging. An auditor who has never worked in a QC laboratory will miss what an experienced analyst spots in an HPLC audit trail.
2. Audit training. ISO 19011:2018, the guideline for auditing management systems, sets out auditor competence and the audit stages most GMP procedures follow. Many companies send lead auditors on a certified lead auditor course.
3. A documented qualification. Keep a training record, a number of shadowed audits and a sign-off by the head of quality. ASQ's Certified Quality Auditor (CQA) and Certified Pharmaceutical GMP Professional (CPGP) are common credentials, though no regulation requires them.
4. Independence. Production staff should not audit their own line, and QA auditors should not audit the QA procedures they wrote. The FDA data below shows why the second rule matters.

How often should GMP audits be done?

GMP audits follow a risk-based schedule that the quality unit approves in advance. EU GMP Chapter 9 calls for self-inspections under a "pre-arranged programme" and ICH Q7 2.40 for "an approved schedule"; neither sets a fixed interval, so the frequency is your decision and you must be able to defend it.

A schedule an investigator will accept usually has these features:

• Every GMP system is covered within a set cycle, often a year, with sterile and high-risk areas audited more often.
• Areas with a recent deviation trend, open CAPAs, a recall or a regulatory finding are moved forward.
• Critical suppliers are audited on site before approval and again at an interval tied to risk; low-risk suppliers may be assessed by questionnaire.
• The schedule shows planned against completed audits, and missed audits are explained.

What are the steps in a GMP audit?

A GMP audit runs in seven steps: plan and scope, prepare, opening meeting, fieldwork, closing meeting, report, and CAPA follow-up. The steps match ISO 19011:2018 and the recording and follow-up duties in EU GMP 9.3 and ICH Q7 2.41.

1. Plan and scope: choose the systems, the auditor and the dates. Use risk and FDA citation data, covered below.
2. Prepare: read the previous audit report, open CAPAs, deviations, complaints and the facility's own inspection history.
3. Opening meeting: agree scope, schedule, escorts and how document requests will be logged.
4. Fieldwork: walk the floor, pull records, interview operators, and trace at least one batch from component receipt to release.
5. Closing meeting: read each finding back with its evidence and the requirement it breaks.
6. Report: grade findings as critical, major or minor and issue the report to management.
7. CAPA and follow-up: assign owners and due dates, check effectiveness, and verify closure at the next audit.

Step 1 carries the most weight: an audit scoped away from the systems FDA cites can close clean and leave those systems unchecked.

What should a GMP audit cover in each system?

A GMP audit should cover the six systems FDA uses in Compliance Program 7356.002 for drug manufacturing inspections: quality, facilities and equipment, materials, production, packaging and labeling, and laboratory controls. Scoping your audit the same way makes it comparable with how an investigator will read your facility.

For record checks inside each system, the ALCOA principles guide lists five data integrity tests, and the FDA GMP overview explains how Part 211 is organized.

What does FDA cite that internal GMP audits miss?

FDA cites the quality unit and investigations more than any other area. In the Atlas Form 483 directory (release of August 15, 2026), 21 CFR 211.22 appeared on 45.4% of 779 human drug Form 483s citing Part 211 from January 2025 to July 2026, and 211.192 on 38.0%. Both sit in the quality system that internal audits are run from.

The two sections fail in specific ways. Of the 354 forms citing 211.22, 296 cite paragraph (d), which FDA's observation title words as "Procedures not in writing, fully followed". The rule behind it is plain: quality unit procedures must exist in writing and be followed. Paragraph (a) appeared on 60 forms, including 27 observations titled "Lack of quality control unit".

The 296 forms citing 211.192 carry 307 observations. FDA titled 219 of them "Investigations of discrepancies, failures", 38 "Written record of investigation incomplete", 23 "No written record of investigation" and 15 "Extent of discrepancy, failure investigations", meaning the firm did not check other batches. The section is also rising: 36.7% of Part 211 drug 483s in 2025, 41.8% in January to July 2026. Foreign facilities drew it more often than US facilities, 42.9% against 36.7%.

Internal audits miss these findings because QA usually runs the audit program, so the quality unit's own procedures and its own investigation reports get the least independent review. A typical audit confirms that deviations closed on time, while an investigator reads the root cause and asks whether the firm checked other batches.

The forms below show the pattern. Each cites both 211.22(d) and 211.192.

Forms that cite 211.192 run longer: 5.4 observations on average, against 3.5 for Part 211 forms without it. A weak investigation system tends to leave findings elsewhere too. Investigator habits matter as well. All six human drug 483s in the window that name investigator Crystal Monroy cite 211.192.

Before scoping your next audit, look up which sections the investigator likely to visit your facility has cited at other firms.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

How do you use FDA citation data to scope your next internal audit?

You use FDA citation data by ranking audit time against the sections investigators cite most, then writing one test per section that reads evidence rather than confirming a procedure exists. The table below covers the eight most-cited Part 211 sections in the 779-form Atlas sample.

Weight the list by your site profile. Foreign facilities drew 211.113 on 28.0% of their Part 211 drug forms, against 18.2% for US facilities, so an overseas sterile site should move it up. Score each test as pass, minor or major, and send any 211.22 or 211.192 failure to management review under ICH Q10 section 4.1 rather than closing it inside QA. To check your own record and your peers', search the FDA Form 483s directory by company or facility.

New 483s and warning letters keep shifting these shares, and the digest below sends the citations that matter for audit scope as FDA posts them.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe