👤 About the Author
Rajesh Sharma
Head of Quality Control
Dr. Reddy’s Laboratories · Full-time
Oct 2017 – Present · 9 yrs
Baddi, Himachal Pradesh, India
đź”— [LinkedIn profile link]
Why cGMP Is More Than a Compliance Checkbox
Every experienced professional in pharma has seen it. A batch passes all its release tests, yet the investigation file behind it is thin, the deviation was closed in two days, and nobody can explain why a critical parameter drifted at 2 a.m. The product is “within specification.” The system is not in control.
That gap is what current Good Manufacturing Practice (cGMP) exists to close. The “c” stands for current, and it matters. It tells us that yesterday’s practices are not automatically acceptable today. Regulators expect manufacturers to apply modern science, technology and risk management, not merely to follow the letter of a decades-old checklist.
The core principle is simple. Quality cannot be tested into a product. It must be designed and built into every step of manufacturing. Finished-product testing samples a tiny fraction of a batch. If the process, people, materials, equipment and environment are not controlled, no amount of testing can guarantee that every tablet, vial or milliliter is safe and effective.
This guide walks through the major elements of a cGMP-compliant manufacturing operation and shares practical observations on where organizations most often stumble.
1. The Pharmaceutical Quality System (PQS): The Foundation
Everything in cGMP sits on top of a functioning Pharmaceutical Quality System. ICH Q10 describes it as a comprehensive model covering the entire product lifecycle, from development through commercial manufacturing to discontinuation.
A mature PQS has four practical pillars:
- Management responsibility. Senior leadership must provide resources, set quality policy and review performance. When quality is treated as “the QA department’s job,” compliance decays quickly.
- Process performance and product quality monitoring. Trending of yields, deviations, complaints, out-of-specification (OOS) results and stability data should feed decisions, not just annual reports.
- CAPA (Corrective and Preventive Action). A CAPA that only retrains the operator is rarely a real root-cause fix. Effective CAPA addresses the system that allowed the error.
- Change management. Uncontrolled change is one of the most common root causes of quality failure. Every change to a process, material, supplier, equipment or method needs a documented assessment of its impact on quality and, where relevant, on the regulatory filing.
đź’ˇ Practical tip: Review your last ten deviations. If more than half are closed with “human error” as the root cause, your investigation process needs strengthening. People make errors, but well-designed systems make those errors hard to commit and easy to detect.
2. Quality Risk Management: Thinking Before Acting
ICH Q9 (and its 2023 revision, Q9(R1)) puts risk management at the center of modern GMP. The idea is that effort and controls should be proportionate to the risk to the patient.
Common tools include FMEA (Failure Mode and Effects Analysis), HACCP, fault tree analysis and simple risk-ranking matrices. The tool matters less than the discipline:
- Identify what can go wrong.
- Estimate severity, probability and detectability.
- Put controls in place proportionate to the risk.
- Review the risk as knowledge grows.
The revised Q9(R1) also stresses reducing subjectivity in risk assessments. Risk scores assigned by one person in a hurry are not risk management. Cross-functional input from production, QC, engineering and QA produces far more reliable results.
3. Personnel: The Most Variable and Most Valuable Element
Equipment can be qualified and processes validated, but people bring judgment, and sometimes variability, to every step.
Key cGMP expectations for personnel include:
- Adequate numbers of qualified staff with defined responsibilities, documented in job descriptions and organization charts.
- Initial and ongoing GMP training that is job-specific, not just a yearly slide presentation. Effectiveness of training should be assessed, not just attendance recorded.
- Clear separation of authority between production and quality. The head of Quality Assurance must have the independence to reject a batch without commercial pressure.
- Strict personal hygiene, gowning discipline and health-reporting procedures, particularly in sterile and high-potency areas.
A point often missed: gowning qualification is a skill, not a signature. Operators entering Grade B or Grade A/B environments should demonstrate competence through observed practice and microbiological monitoring of gloves and gowns.
4. Premises and Facility Design
A cGMP facility is designed to prevent mix-ups, cross-contamination and contamination from the environment. Design decisions made at the drawing-board stage are far cheaper than fixes made after an inspection finding.
Core design principles:
- Logical flow. Materials, personnel, waste and products should move in a way that minimizes crossover. Separate entry and exit points and unidirectional flow where feasible.
- Segregation. Dedicated or well-controlled areas for quarantine, approved and rejected materials; sampling and dispensing; different dosage forms; and, where hazard warrants it, dedicated facilities for highly sensitizing or potent products (for example, certain beta-lactams and hormones).
- HVAC and environmental control. Differential pressure cascades, HEPA filtration, air-change rates, temperature and humidity control all protect the product. Pressure differentials must be monitored, alarmed and trended.
- Cleanability. Smooth, non-shedding, easy-to-clean surfaces; coved floor-wall junctions; minimal ledges and exposed pipework.
- Utilities. Purified water, water for injection, compressed air and nitrogen are product-contact or product-critical utilities. They need qualification, monitoring and clear alert and action limits.
Water systems deserve special mention. Microbial control in a purified water loop depends on design (no dead legs, proper slope, continuous circulation), sanitization and disciplined sampling. Many recurring microbial excursions trace back to a design flaw rather than a sampling error.
5. Equipment: Qualification and Maintenance
Equipment must be suitable for its intended use, and that suitability must be demonstrated, not assumed.
The traditional qualification lifecycle includes:
- URS (User Requirement Specification): what you need the equipment to do.
- DQ (Design Qualification): confirmation that the design meets the URS.
- FAT/SAT: factory and site acceptance testing.
- IQ (Installation Qualification): verifies correct installation.
- OQ (Operational Qualification): verifies operation across intended ranges.
- PQ (Performance Qualification): verifies consistent performance under real conditions.
Beyond qualification, cGMP requires calibration of critical instruments against traceable standards, preventive maintenance schedules, equipment status labeling (clean, in use, under maintenance) and logbooks that tell the equipment’s story.
đź’ˇ Practical tip: A calibration sticker that is current but an instrument whose range does not cover the actual operating range is a classic finding. Make sure calibration ranges match process ranges.
6. Documentation: If It Isn’t Documented, It Didn’t Happen
Documentation is the evidence layer of cGMP. It defines what should be done (specifications, SOPs, master batch records) and proves what was done (executed batch records, logbooks, analytical records).
The widely used ALCOA+ principles describe good data practice. Records should be:
- Attributable: who did it and when
- Legible
- Contemporaneous: recorded at the time of the activity
- Original (or a certified true copy)
- Accurate
The “plus” adds Complete, Consistent, Enduring and Available.
Good documentation practices on the floor sound basic, but their absence drives many warning letters: no back-dating, no overwriting, single-line strike-throughs with initials, date and reason, and no loose paper “scrap” recording of critical data for later transcription.
Master batch records must be version-controlled and issued in a controlled manner, so that operators only ever work from the current approved version.
7. Data Integrity: The Regulatory Hot Spot
Over the past decade, data integrity failures have been among the most frequently cited findings in inspections worldwide. Regulators have made it clear that this is not about paperwork. It is about trust in every number that supports a release decision.
Typical failure modes include:
- Shared logins on chromatography or other computerized systems
- Disabled or unreviewed audit trails
- Trial injections or “test” runs that are never reported
- Deleting or overwriting raw data
- Unrestricted access to system clocks and configuration settings
What good looks like:
- Individual user accounts with role-based access
- Audit trail review as a defined, documented part of batch release and data review
- Secure, validated backup and archival
- A culture where analysts can report an error without fear of blame
Culture is the deciding factor. Data integrity is usually a behavioral problem before it is a technical one. If people feel pressure to hit timelines at any cost, workarounds become inevitable.
8. Materials Management: Control From the Gate to the Granulator
A finished product can only be as good as what goes into it. cGMP requires a controlled system for receiving, identifying, quarantining, sampling, testing, approving, storing and issuing all starting materials and packaging components.
Key elements:
- Qualified suppliers. Supplier qualification should be risk-based and include audits for critical materials, particularly APIs and excipients with a history of adulteration risk (for example, glycerin and propylene glycol have been implicated in past contamination incidents with diethylene glycol and ethylene glycol).
- Identity testing. Every container of a starting material should be identity-tested, or, where a reduced approach is justified, supplier reliability must be well-established and documented.
- Status control. Clear physical or validated electronic status: quarantine, approved, rejected.
- FEFO/FIFO. First-expired-first-out, with re-test dates managed properly.
- Storage. Temperature and humidity mapping, monitored and alarmed storage areas.
Printed packaging materials warrant strict control. Labels and inserts are high-risk items for mix-ups, so reconciliation and secure storage are essential.
9. Production: Controlling the Process
Production under cGMP means following approved procedures exactly, with in-process controls at defined points and full traceability.
Foundational practices:
- Line clearance before every batch start and every changeover, verified by a second person and, where required, by QA.
- In-process controls (IPCs). Weight variation, hardness, friability, disintegration, fill volume, pH, bioburden and similar checks, with defined limits and documented actions when results drift.
- Yield reconciliation. Unexpected yield deviations are early warning signals of loss, mix-up or process problems.
- Prevention of cross-contamination. Through campaign planning, cleaning, closed processing, dust extraction and appropriate segregation.
- Deviation reporting. Any departure from procedure must be reported, assessed and investigated proportionately. A culture that hides deviations is far more dangerous than one that reports many.
Process Validation
Process validation, per the FDA’s lifecycle approach and EU Annex 15, is not a one-time exercise of three batches. It has three stages:
- Process Design: building process knowledge, identifying critical quality attributes (CQAs) and critical process parameters (CPPs) using ICH Q8 principles.
- Process Qualification: demonstrating that the commercial process is capable of reproducible performance.
- Continued Process Verification (CPV): ongoing monitoring during routine production, using statistical trending to detect drift before it becomes failure.
Stage 3 is where many organizations are weakest. A validated process that is never monitored statistically will eventually surprise you.
10. Cleaning and Cleaning Validation
Poor cleaning is a direct path to cross-contamination. Cleaning validation demonstrates that residues of the previous product, cleaning agents and microbial contamination are reduced to acceptable levels.
Modern practice relies on health-based exposure limits, such as the Permitted Daily Exposure (PDE), rather than the older arbitrary limits alone (for example, 10 ppm or 1/1000th of a therapeutic dose). Key considerations include:
- Worst-case product selection (based on solubility, toxicity, cleanability)
- Sampling method recovery studies for swabs and rinses
- Validated analytical methods with adequate sensitivity
- Defined “dirty hold” and “clean hold” times
- Visual cleanliness as a baseline criterion
Cleaning should be treated as a process with its own lifecycle, not an isolated exercise for the validation team.
11. Sterile Manufacturing: A Higher Standard
For sterile products, the stakes rise dramatically. The EU GMP Annex 1 revision (2022) reinforced a science- and risk-based approach centered on the Contamination Control Strategy (CCS), a living document that captures all controls across the facility, process, personnel, utilities, materials and monitoring.
Key elements include:
- Grade A/B/C/D cleanroom classification and continuous monitoring
- Aseptic process simulation (media fills) that represents the worst-case process
- Preference for barrier technologies such as RABS and isolators, which reduce direct human intervention
- Sterilization validation (moist heat, dry heat, filtration, radiation)
- Container closure integrity assurance
- Robust environmental monitoring with trend analysis
Human intervention is the largest contamination risk in aseptic operations. The best sterile facilities design to minimize interventions, not just to manage them.
12. Quality Control Laboratory Practices
The QC laboratory generates the data that supports batch release, stability claims and process decisions. Its cGMP requirements include:
- Validated or verified analytical methods (ICH Q2), suited to their intended purpose
- Qualified instruments and calibrated equipment, with system suitability checks
- Controlled reference standards and reagents, with proper expiry and storage management
- Structured OOS and OOT (out-of-trend) investigations. An OOS result cannot be simply retested until it passes. Phase I laboratory investigations must be objective and documented before any retest decision.
- Stability programs under ICH Q1A conditions, with defined pull points, and trending of results.
Bangladesh and other warm, humid climates fall into ICH Climatic Zone IVb (30 °C / 75% RH), so stability protocols for products marketed there need to reflect these conditions.
13. Packaging and Labeling Operations
Packaging seems straightforward, yet mix-ups here lead to some of the most frequent recalls. Strong controls include:
- Line clearance and verification of all previous-batch materials removed
- Reconciliation of printed materials, with investigation of discrepancies
- In-line vision systems or inspection to verify codes, batch numbers and expiry dates
- Physical or electronic segregation of similar-looking products
- Serialization and traceability, where required by the market
14. Batch Release, Complaints and Recalls
Batch release is the final formal decision point. The Qualified Person (in the EU) or the authorized QA representative reviews the complete batch documentation: executed records, IPC results, deviations, analytical results, environmental data and change control status, before certifying release. A “pass” on testing alone is not sufficient.
Complaint handling should be treated as a source of real-world quality intelligence. Every complaint should be logged, assessed for potential impact on other batches and investigated for root cause.
Recall procedures must be documented, tested through mock recalls and capable of tracing a batch from raw material to distribution within hours, not days.
15. Self-Inspection, Audits and Regulatory Readiness
Internal audits (self-inspections) should be planned, risk-based and honest. An audit program that only finds trivial issues is a warning sign in itself.
Being “inspection ready” is not a special event. It is a daily state. Some habits that support it:
- Document as you go, not afterwards
- Keep SOPs practical and reflective of actual practice
- Encourage open communication with auditors, and never guess or improvise answers
- Close CAPAs on time with verified effectiveness
16. Common Findings and How to Avoid Them
Across FDA 483 observations, EU non-compliance reports and WHO inspection findings, the same themes recur:
- Inadequate investigation of deviations and OOS results
- Data integrity weaknesses
- Insufficient cleaning validation and cross-contamination controls
- Inadequate change control
- Poorly maintained equipment and facilities
- Weak supplier qualification
- Ineffective CAPA and lack of management oversight
The remedy is rarely a new SOP. It is a change in how the organization thinks about quality: proactive, transparent and owned by everyone.
Building a Quality Culture
Technology, facilities and documents matter, but they cannot compensate for a weak quality culture. The strongest organizations share a few traits:
- Leaders visibly prioritize quality over short-term output.
- Employees can raise concerns without retaliation.
- Errors are treated as learning opportunities.
- Quality metrics are reviewed at management level, regularly.
At the end of every batch record is a patient who will trust that what is on the label is what is in the pack. cGMP is how we honor that trust, consistently, batch after batch.
Conclusion
cGMP is not a single regulation but an integrated system: a strong quality system, controlled people, premises, equipment and materials, validated processes, reliable data and a culture that values honesty over convenience. Manufacturers that treat it as a lifecycle discipline, rather than a periodic inspection exercise, are the ones that deliver safe, effective products with fewer failures, fewer recalls and stronger regulatory standing.
Ask yourself one question this week: if an inspector walked in tomorrow, would our daily practice match what our SOPs say? The honest answer to that question is your real compliance status.
đź“š Guideline References
- U.S. FDA. Current Good Manufacturing Practice regulations: 21 CFR Part 210 (General) and Part 211 (Finished Pharmaceuticals).
- U.S. FDA. Guidance for Industry: Process Validation: General Principles and Practices (2011).
- U.S. FDA. Guidance for Industry: Data Integrity and Compliance With Drug CGMP: Questions and Answers (2018).
- U.S. FDA. Guidance for Industry: Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production (2006).
- European Commission. EudraLex Volume 4: EU Guidelines for Good Manufacturing Practice, Part I (Basic Requirements for Medicinal Products), Part II (Active Substances), and Annexes, especially Annex 1 (Manufacture of Sterile Medicinal Products, 2022), Annex 11 (Computerised Systems) and Annex 15 (Qualification and Validation).
- WHO. Good Manufacturing Practices for Pharmaceutical Products: Main Principles, WHO Technical Report Series, No. 986, Annex 2 (2014).
- WHO. Guidance on Good Data and Record Management Practices, WHO Technical Report Series, No. 996, Annex 5 (2016).
- ICH Q7. Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients.
- ICH Q8(R2). Pharmaceutical Development.
- ICH Q9(R1). Quality Risk Management (2023).
- ICH Q10. Pharmaceutical Quality System.
- ICH Q2(R2). Validation of Analytical Procedures.
- ICH Q1A(R2). Stability Testing of New Drug Substances and Products.
- PIC/S. Guide to Good Manufacturing Practice for Medicinal Products, PE 009 (current version), and PIC/S PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments.
- EMA. Guideline on setting health-based exposure limits for use in risk identification in the manufacture of different medicinal products in shared facilities (2014).
- ISPE. Baseline Guides and GAMP 5 (Second Edition): A Risk-Based Approach to Compliant GxP Computerized Systems.
- Directorate General of Drug Administration (DGDA), Bangladesh. National GMP requirements and applicable drug regulations. Please verify the current version on the DGDA website before citing.