Whether it is a regulatory inspection, a customer audit or an internal self-inspection, an audit of technical systems is rarely decided by a single question. It is decided by whether the documents add up to a coherent overall picture. A cleanroom, an HVAC system or a compressed air system can be technically flawless and still lead to findings if the evidence is incomplete, contradictory or hard to find quickly. This article describes how to prepare technical GMP projects for an audit in a structured way.
The document map
The first step is an overview of which documents exist for a system, where they are kept and what status they have. This document map is not an end in itself. It shows gaps before an auditor finds them, and it lets you produce the right document quickly during the audit.
For each system relevant to the audit, the map should contain at least:
- Requirements: URS and, where applicable, user requirements (German “Lastenheft”) and supplier specification (German “Pflichtenheft”)
- Risk assessments and their revision status
- Qualification plans and reports (DQ, IQ, OQ, PQ), including attachments
- Drawings, flow diagrams and equipment documentation in the approved version
- SOPs for operation, cleaning, maintenance and monitoring
- Calibration and maintenance records
- Deviations, CAPA and change control records related to the system
- Evidence of requalification or periodic review
The storage location matters: is the original in the document management system, in a paper file or with the supplier? With supplier documentation in particular, it is often unclear which version is binding.
A final quality report for each project has proven useful. It refers to the sub-plans, traceability matrices, approval checklists and deviations, gives auditors a starting point and leads them directly to the individual records.
Consistency from the URS to qualification
Auditors like to check the chain from requirement to evidence. They pick a requirement from the URS and ask where it was assessed in the risk assessment and in which test it was verified. If this chain breaks, it quickly looks as though the qualification is not based on the actual requirements.
So check a sample of critical requirements in both directions beforehand: from the URS to the test, and from the test back to the requirement. A maintained traceability matrix makes this check much easier. Also look out for contradictions between documents, such as different setpoints in the URS, the qualification plan and the SOP. You will find advice on common weak points in the article Common errors in GMP documentation.
Deviations, CAPA and change control
Hardly any qualification project runs without deviations. That is not a problem as long as they are handled properly. It becomes critical when deviations are open, have been closed without an assessment, or when the resulting actions are not followed up.
Before an audit, you should clarify:
- Have all deviations from qualification and operation been assessed and closed, or are they open with a traceable justification?
- Has the impact of each deviation on product quality and qualification status been assessed?
- Have CAPA actions been implemented and their effectiveness checked?
- Have technical changes since qualification been managed through change control, and has the need for requalification been assessed?
A common finding is changes that were implemented properly from a technical point of view but were not recorded in the change control system, such as a replaced sensor or adjusted control parameters.
For medical devices, it is also worth checking whether qualification records feed into the technical documentation and whether a change is significant enough that the notified body has to be informed.
Calibration status
Under Chapter 3 of the EU GMP Guide (3.41), measuring, weighing, recording and control equipment should be calibrated and checked at defined intervals by appropriate methods. Traceability to national or international measurement standards is state of the art, and the GDP guidelines (3.3) explicitly require it. In an audit, a measuring point on site is often selected and the corresponding calibration record requested. Make sure that:
- all GMP-relevant measuring points are recorded in a list of measuring instruments and classified by criticality,
- calibration intervals are defined and adhered to,
- calibration certificates are available and traceability is evident,
- out-of-tolerance results have been assessed, including the question of which measured values since the last valid calibration could be affected.
This also includes the test equipment used during qualification. An OQ report loses its significance if the measuring instrument used was not calibrated at the time of testing.
Maintenance and requalification records
Qualification is not a one-off event. Auditors ask how the qualified state is maintained over time. Relevant points include maintenance plans and their execution, filter changes, leak tests, periodic reviews and requalifications at defined intervals or after defined events. Records should be complete, signed and clearly assigned to the respective equipment. Where external contractors carry out maintenance, the contract giver reviews and assesses their reports (EU GMP Guide, Chapter 7, 7.8). In practice, quality agreements with critical service providers also belong here, defining scope, documentation and reporting lines.
The interface between QA and engineering
Many findings arise at the interface between quality assurance and engineering. Engineering knows the equipment, QA knows the quality system, and in an audit the two must fit together. Clarify in advance who answers technical questions, who approves documents and how information flows between the two functions. Clearly defined responsibilities, for example in a RACI chart, prevent contradictory statements.
Mock audit and walkthrough
An internal mock audit with a walkthrough of the facility is one of the most effective preparation measures. Ideally, it is carried out by someone who was not involved in the qualification. Take the route an auditor would take: through the airlocks, into the plant room, to the measuring points. Look out for labelling, status tags, handwritten notes on equipment, order in the plant room, and whether the facility matches its documented state.
Preparing the people who answer questions
The people who answer questions in the audit should know what to expect. That does not mean learning answers by heart. It means being able to explain their own equipment and documentation with confidence. A few simple rules have proven useful: answer the question that was asked; do not speculate; if unsure, check or bring in the responsible person; back up statements with documents.
Raw data at hand
Auditors often want to see the raw data as well as the report: measurement records, particle counter printouts, data exports from monitoring systems, video recordings of airflow visualisation studies. This data must be easy to find, readable and clearly assignable to the report. For electronic data, data integrity aspects such as the audit trail and access rights also play a role.
Audit preparation checklist
| Area | Check question | Done |
|---|---|---|
| Document map | Are all relevant documents recorded and retrievable for each system? | ☐ |
| Consistency | Is the chain URS – risk assessment – test complete for critical requirements? | ☐ |
| Deviations | Have all deviations been assessed and closed, or are they open with a justification? | ☐ |
| CAPA | Have actions been implemented and checked for effectiveness? | ☐ |
| Change control | Have all changes since qualification been recorded and assessed? | ☐ |
| Calibration | Are GMP-relevant measuring instruments calibrated and traceable? | ☐ |
| Maintenance | Are maintenance and requalification records complete? | ☐ |
| Interfaces | Have responsibilities between QA and engineering been clarified? | ☐ |
| Walkthrough | Does the facility on site match its documented state? | ☐ |
| People answering questions | Have contacts been named and prepared? | ☐ |
| Raw data | Can raw data for all reports be found and assigned? | ☐ |
Conclusion
Good audit preparation does not start two weeks before the date. It starts with documentation that is consistent and traceable from the outset. If you have the chain from requirement to evidence under control, know your open items and keep the facility on site in its documented state, you can answer questions in the audit calmly and with evidence. If you need support preparing your documents, you will find information under GMP documentation.