Self-Inspection SOP for Pharmaceutical GMP

In short: This illustrative SOP describes how a pharmaceutical site can plan internal GMP self-inspections, record evidence and findings, and track corrective action to closure. Set the scope, interval, roles and follow-up in the approved quality system and the rules that apply to the site.

Objective and scope

Use a planned internal review programme to assess whether the site’s GMP systems are implemented and identify needed corrective measures. Adapt this example to the site’s products, operations, quality system and applicable jurisdiction. It does not set a universal frequency, finding classification or response deadline.

For EU GMP applicable to human medicinal products, EudraLex Volume 4, Part I, Chapter 9, §§9.1–9.3 describes a planned self-inspection programme, competent designated auditors, records of inspections and follow-up actions. Its scope includes personnel, premises, equipment, documentation, production, quality control, distribution, complaints, recalls and the inspection process itself. The European Commission currently lists Chapter 9 in Volume 4; confirm the applicable local legal basis and product scope before use. EudraLex Volume 4, Part I, Chapter 9; current European Commission Volume 4 listing.

Other frameworks address the same activity differently. WHO GMP (TRS 986, Annex 2, section 8) describes self-inspection as a documented, routinely performed programme with an effective follow-up programme (§8.1), and ICH Q10 expects audits and self-assessment results to feed management review of the pharmaceutical quality system (§3.2.4 and §4.1). In the United States, 21 CFR Part 211 contains no clause headed “self-inspection”; 21 CFR 211.22 requires a quality control unit with written, followed responsibilities and procedures, and 211.180(e) requires an at least annual evaluation of the quality standards of each drug product, which is a product record review rather than a self-inspection. India’s revised Schedule M was notified by G.S.R. 922(E) dated 28 December 2023; check its current text for the self-inspection and quality-audit requirements that apply to the site. For the UK, check current MHRA GMP guidance on gov.uk. Do not describe self-inspection as mandatory under a given jurisdiction unless the current official text supports it. WHO TRS 986 Annex 2; ICH Q10; 21 CFR 211.22; 21 CFR 211.180(e).

Responsibilities

• Quality Assurance or programme owner: Maintain the approved self-inspection programme, coordinate the schedule, control the procedure and track reports and follow-up.
• Self-inspection team: Prepare for and conduct the assigned review using current procedures and objective evidence; record observations and any proposed actions.
• Audited department: Provide relevant records and personnel, assess findings, and propose corrective actions through the approved process.
• Site management or quality unit: Provide oversight and resources, resolve escalated issues, and confirm closure authority under the quality system.

Auditors should be competent for the areas they examine and sufficiently independent to perform a detailed review. Define any additional independence or training rules in the approved programme. EudraLex Volume 4, Part I, Chapter 9, §9.2 describes independent and detailed inspections by designated competent personnel. EudraLex Chapter 9, §9.2.

WHO TRS 986 Annex 2, §§8.1 and 8.3 say the team should be able to evaluate GMP implementation objectively and should be appointed by management from experts familiar with GMP, who may come from inside or outside the company. EU GMP Chapter 9 §9.2 asks for competent designated personnel. Neither text fixes a staffing formula, so the following is an example only.

Example in-house criterion (not a regulatory requirement): A cross-functional team with at least one QA member, auditors not inspecting their own department, QA leading the inspection, and training for new auditors or when the procedure changes. Define the actual rules in the controlled procedure.

Procedure

Planning and preparation

1. Maintain a pre-arranged programme that identifies the areas and systems to be reviewed, the planned intervals, responsible people and records of completion.
2. Define each inspection’s objective, scope, criteria and schedule. Select current controlled procedures, product or process records and prior findings relevant to that scope.
3. Assign a competent team with no unresolved conflict of interest for the area. Tell the audited area the schedule, scope, requested records and meeting arrangements under the site’s approved process.
4. Prepare an area-specific checklist as an aid. The checklist should direct auditors to current requirements and evidence; it should not replace the governing procedure or specification.
5. Hold an opening discussion to confirm the scope, approach, contacts and practical arrangements.

For EU GMP, Chapter 9, §9.1 calls for the listed subjects to be examined at intervals under a pre-arranged programme. It does not prescribe a twice-yearly schedule. EudraLex Chapter 9, §9.1.

WHO TRS 986 Annex 2, §8.4 says the frequency may depend on company requirements but should preferably be at least once a year and should be stated in the procedure; §8.1 also allows additional self-inspections on special occasions such as recalls, repeated rejections or an announced health-authority inspection. WHO TRS 986 Annex 2.

Example in-house criterion (not a regulatory requirement): Quality Assurance prepares a yearly department schedule and self-inspections take place twice each year. This frequency is not set by EU GMP or WHO; justify the site interval through its risk assessment and quality system.

Conducting an inspection

1. Explain the purpose, scope and process at the opening discussion.
2. Review records and observe activities against the current procedure, applicable GMP requirement, approved specification or other stated audit criterion.
3. Record objective evidence, including the relevant record or process, location, date and people involved as appropriate. Separate evidence from the auditor’s interpretation.
4. Discuss factual issues with the area during the inspection and escalate urgent product-quality or patient-safety concerns through the site’s quality system.
5. Hold a closing discussion to confirm observations and the report timeline. The audited area may clarify facts; the inspection team retains responsibility for its findings.

Findings and corrective action

Describe each observation clearly enough for the responsible department to investigate it. Link the finding to the audit criterion and supporting evidence. Use the approved quality-system procedure to assess impact, determine cause, agree corrections and corrective or preventive actions where applicable, assign an owner and due date, and evaluate completion and effectiveness.

Example in-house criterion (not a regulatory requirement): Findings classified as minor (no significant product-quality or safety impact), major (significant impact) and critical (significant impact expected to seriously harm a patient), with action timelines set by the self-inspection procedure. EU GMP Chapter 9 and WHO TRS 986 Annex 2 §§8.5-8.6 require a report with results, evaluation and recommended corrective actions and an effective follow-up programme, but do not define these classes or deadlines. Use the site’s approved definitions, escalation thresholds and CAPA deadlines, consistent with its quality-risk and deviation procedures.

Reports, closure and external access

Issue a controlled report containing the inspection scope, date, team, areas reviewed, observations, supporting evidence and proposed corrective measures where appropriate. Track the department’s response, actions subsequently taken and closure decision. Record the basis for closure and any later effectiveness check under the approved CAPA procedure.

For EU GMP, Chapter 9, §9.3 says inspections should be recorded, reports should include observations and any proposed corrective measures, and subsequent actions should also be recorded. It does not establish a universal rule that internal reports can be withheld from customers or regulators. EudraLex Chapter 9, §9.3.

Good practice: keep self-inspection reports under the site’s document-control and access procedure, and share them with customers or other parties only as that procedure, contracts and applicable law allow. This is a site policy, not a rule that lets a site withhold records from an authorised regulator.

United States context: FDA Compliance Policy Guide Sec. 130.300 (issued 2 June 2007) says that in routine inspections FDA will not review or copy reports and records resulting from audits and inspections of a written quality assurance program. The policy lists exceptions (for example directed or for-cause inspections of a clinical investigation sponsor or monitor, litigation, inspections under a statutory inspection warrant, and execution of a judicial search warrant), and CPGs are not legally binding. It is a US FDA enforcement policy, not a global rule. FDA CPG Sec. 130.300.

Records and retention

Maintain the approved programme, plans, checklists, evidence, reports, department responses, action records, closure decisions and effectiveness checks. Define document owners, access, retention and retrieval in the quality system.

Retain batch-associated GMP records for at least 1 year after the expiry date of the respective product batch. Under EU GMP Chapter 4, batch documentation is retained for at least 5 years after Qualified Person certification if that period is longer. Follow any longer period required by local law, the marketing authorisation or the approved schedule. 21 CFR 211.180(a) states the U.S. batch-record period; EudraLex Volume 4, Part I, Chapter 4, Revision 1 (2011), §4.11 states the EU period. Chapter 4, §4.12 says retention for other documentation depends on the business activity it supports, with certain critical documentation retained while the marketing authorisation remains in force. 21 CFR 211.180(a), current eCFR; EudraLex Chapter 4, §§4.11–4.12.

Frequently asked questions

How often should a self-inspection be conducted?

Use the interval in the applicable rule and approved site programme. EU GMP Chapter 9 calls for a pre-arranged programme with inspections at intervals but does not prescribe twice yearly; WHO TRS 986 Annex 2 §8.4 says preferably at least once a year.

Must the audit team include a QA auditor who audits only other departments?

That is one possible site rule, not a universal formula in EU GMP Chapter 9. Define the team’s competence and independence in the approved programme and applicable requirements.

Can a company refuse to share an internal self-inspection report?

Do not assume so. Apply relevant legal, regulatory, contractual and inspection-access rules and the approved document-control procedure.

See also

• Quality risk management in the pharmaceutical industry
• SOP for failure investigation
• Handling of incidents and deviations

References

• WHO, Technical Report Series No. 986 (2014), Annex 2, section 8 (§§8.1-8.9): WHO page.
• ICH Q10, Pharmaceutical Quality System, Step 4 version dated 4 June 2008, §3.2.4 and §4.1: ICH.
• United States, 21 CFR 211.22 and 211.180(e), current eCFR: 211.22; 211.180.
• FDA, CPG Sec. 130.300, issued 2 June 2007: FDA.
• CDSCO, revised Schedule M, G.S.R. 922(E) dated 28 December 2023 (self-inspection clauses not independently confirmed; check the current gazette text).
• European Commission, EudraLex Volume 4, Part I, Chapter 9, “Self Inspection,” §§9.1–9.3 (current chapter listed on the Commission’s Volume 4 page; accessed 16 October 2026; chapter PDF does not state a revision date): official chapter; current Volume 4 listing.
• European Commission, EudraLex Volume 4, Part I, Chapter 4, “Documentation,” Revision 1 (2011; effective 30 June 2011), §§4.11–4.12: official PDF.
• United States, 21 CFR 211.180(a), “General requirements,” current eCFR version up to date as of 14 October 2026: official regulation.