CGMP cheat sheet

A cGMP quality system rests on ICH Q10 elements: management review, quality audit, CAPA, change control, and supplier oversight; the annual product quality review (APQR) is a distinct required review of batch records, deviations, complaints, and trends.

Management review must occur at defined intervals and cover quality metrics, regulatory actions, audit findings, and resource adequacy; outputs are documented decisions and actions with assigned owners and due dates.

The quality unit holds authority independent of production to approve or reject materials, batches, and specifications; this independence is a structural requirement, not a reporting-line preference.

Deviation classification rule: any event affecting identity, strength, quality, purity, or safety of product is a major or critical deviation; documentation-only errors with no product impact may be minor.

Quality oversight of contracted activities requires a written quality agreement defining responsibilities for testing, release, and deviation handling; the contract giver retains final release responsibility unless transferred in writing.

Trend analysis should track deviations, complaints, OOS results, environmental monitoring, and CAPA effectiveness; a rising trend is actionable even when each individual event was within limits.

A CAPA is closed only after effectiveness verification; closure based solely on completion of the corrective action is a common inspection finding.

Product quality complaints and adverse events feed the same quality system as deviations; recurrence of the same complaint root cause indicates failed CAPA, not a complaint-handling problem.

Personnel must have education, training, and experience for assigned tasks; training records are retained and training is completed before unsupervised execution of GMP activities.

Training effectiveness must be assessed, not just attendance recorded; assessment methods include direct observation, written testing, and performance qualification on the task.

Personnel with responsibility for entering or approving GMP records need role-specific training on data integrity expectations in addition to procedure training.

Hygiene requirements: clean garments appropriate to the operation, no exposed jewelry or cosmetics in production areas, and defined gowning procedures for each cleanliness grade.

Personnel with open lesions, illness, or known communicable conditions that could affect product quality must be excluded from direct contact with product until cleared.

Gowning qualification is periodic and grade-specific; requalification frequency is defined in the site program and applies to personnel entering Grade A/B areas.

Consultants advising on cGMP production, testing, or release must have documented qualifications and a written agreement; they do not relieve the manufacturer of compliance responsibility.

Job descriptions and organization charts must reflect actual reporting lines, including the separation of quality unit authority from production management.

Cleanroom classification follows ISO 14644 for nonviable particle counts, while the EU GMP A/B/C/D grades map to at-rest and in-operation limits; at-rest limits apply when no equipment is running and no personnel are present.

Grade A in-operation limits are 3,520 particles/m³ at ≥0.5 µm and 20 particles/m³ at ≥5 µm; Grade B in-operation is 352,000 and 2,900 particles/m³ respectively.

Viable monitoring limits are site-defined but typical: Grade A <1 CFU/4 hours, Grade B 5 CFU, Grade C 50 CFU, Grade D 100 CFU per 4-hour active air sample in operation.

Pressure differentials between adjacent areas of different classification are typically ≥10 Pa, with airflow from higher to lower cleanliness; alarms and monitoring records are required.

HVAC, purified water, and clean steam systems are qualified and monitored; water systems are sampled on a defined frequency with alert and action limits, and results trended.

Dedicated facilities are required for certain high-hazard products such as penicillins, live vaccines, and cytotoxics; cross-contamination risk must be controlled by design and validated procedures.

Facility maintenance and repairs inside classified areas require a documented change or work permit, risk assessment, and post-work cleaning and requalification as needed.

Environmental monitoring data must be reviewed before batch disposition; excursions require investigation and impact assessment on the affected batches.

Equipment follows the lifecycle: URS, design qualification (DQ), installation qualification (IQ), operational qualification (OQ), performance qualification (PQ), then ongoing periodic review.

Calibration must be traceable to a national or international standard; calibration intervals are justified by history and criticality, and out-of-tolerance results trigger an impact assessment on data generated since the last valid calibration.

Equipment logs record use, cleaning, maintenance, and calibration; entries are contemporaneous, attributable, and traceable to the operator.

Preventive maintenance is scheduled according to manufacturer recommendations and site experience; maintenance activities that could affect product quality require re-qualification or verification.

The calibration tolerance must be tighter than or equal to the process tolerance; a gauge whose tolerance equals the process tolerance cannot reliably demonstrate compliance.

Computerized systems used in GMP require validation, access controls, audit trails, and backup; the audit trail must be reviewable and cannot be disabled by users.

Equipment used for critical measurements (temperature, humidity, pressure, weight) is classified by criticality to set calibration and requalification rigor.

Out-of-calibration events must be documented as deviations, and affected batches evaluated for release impact before disposition.

ALCOA+ attributes for data: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available.

Records must be made contemporaneously in indelible ink; corrections are made with a single line, the correction, the date, initials, and where required a reason.

Batch records are approved and issued before use; issued copies are controlled, and reconciliation of issued versus returned records is part of batch record review.

Electronic records subject to 21 CFR Part 11 need secure access, audit trails, operational checks, and either electronic signatures or documented controls meeting the rule's requirements.

Data integrity risk assessment should cover shared logins, uncontrolled spreadsheets, audit trail review gaps, and manual integration of chromatographic data.

Retention periods are defined by regulation and site policy; records must remain retrievable and legible throughout the retention period, including after system retirement.

Master documents (specifications, methods, SOPs) are version-controlled; obsolete versions are removed from use and archived with clear status marking.

Audit trail review is a routine quality activity, not only an investigation tool; frequency is risk-based and documented in the site data governance program.

Each batch is produced under an approved master batch record; in-process controls are performed at defined steps with acceptance criteria and recorded before proceeding.

Yield reconciliation must be performed for each batch; unexplained yield variance beyond established limits requires investigation before release.

Theoretical yield and actual yield are compared; the acceptable range is established during process validation and justified by process capability.

In-process controls typically include weight variation, hardness, disintegration, pH, conductivity, and bioburden, selected by their ability to detect process drift.

Changeover and line clearance procedures prevent mix-ups and cross-contamination; line clearance is documented before each batch or campaign start.

Process parameters designated as critical process parameters (CPPs) are monitored and controlled within proven acceptable ranges established during validation.

Reprocessing and reworking require documented procedures, investigation of the root cause, and quality unit approval; reprocessing is not a substitute for process control.

Hold times for intermediates and bulk product are validated and must not be exceeded without assessment and quality approval.

Materials are quarantined on receipt until sampled, tested, and released by the quality unit; status labels and physical segregation prevent inadvertent use.

Supplier qualification includes a documented evaluation, quality agreement, and audit or questionnaire; approved supplier status is reviewed periodically and on any quality event.

Receipt sampling follows a statistically justified plan; identity testing is performed on every container of a lot for certain materials, and reduced testing requires justification.

Storage conditions (temperature, humidity, light) are monitored and mapped; temperature mapping demonstrates uniformity across the storage area, not just at one probe.

FEFO (first expired, first out) or FIFO controls material rotation; expired materials are segregated and dispositioned, never returned to stock without formal approval.

Retest and expiry dates are assigned based on stability data and material characteristics; retesting does not extend an expiry date, only a retest date.

Traceability through the supply chain supports recall; lot genealogy links incoming materials to finished batches and distribution records.

Returned goods and rejected materials are quarantined, evaluated, and dispositioned under documented procedures; returned product cannot be resold without quality assessment.

OOS results follow a phased investigation: laboratory phase first (assignable cause), then full-scale manufacturing investigation; the original result is never invalidated without documented justification.

Retesting is permitted only under an approved plan after the laboratory investigation; averaging results to obtain a passing value is not acceptable.

Sampling plans must be statistically valid and documented; sampling equipment is cleaned, and samples are labeled with identity, lot, date, and sampler.

Reference standards are qualified, stored per label, and periodically requalified; working standards are traceable to a primary reference standard.

Analytical methods are validated for specificity, linearity, accuracy, precision, range, detection limit, quantitation limit, and robustness as applicable.

Stability studies support shelf life and storage conditions; ongoing stability programs include at least one batch per year per product per strength where required.

Laboratory controls include system suitability checks, control samples, and instrument calibration records reviewed with the analytical data.

Microbiological testing includes bioburden, endotoxin, and sterility where applicable; negative controls and media growth promotion are documented.

Validation lifecycle: stage 1 process design, stage 2 process qualification (PPQ), stage 3 continued process verification; PPQ requires a minimum of three consecutive successful batches for a conventional approach.

A validation master plan defines scope, approach, responsibilities, and acceptance criteria; it is a living document updated as the program evolves.

Cleaning validation demonstrates removal of product residues, cleaning agents, and microbial contamination; acceptance limits are based on health-based exposure or a documented safety factor.

Change control assesses impact on product quality, validation status, regulatory filings, and documentation before implementation; approval is required before the change takes effect.

Changes are classified (minor, major, critical) and the classification drives the required testing, revalidation, and regulatory notification.

Revalidation is triggered by changes to process, equipment, formulation, or scale that could affect product quality; a documented rationale determines whether revalidation is needed.

Method validation and process validation share the requirement for predefined acceptance criteria and documented protocols approved before execution.

Continued process verification uses statistical process control and trending to detect drift; out-of-trend signals trigger investigation.

Complaints are logged, assessed for severity and reportability, investigated, and closed with a response to the complainant where required; the complaint record links to batch and distribution data.

Recall classification: Class I involves reasonable probability of serious adverse health consequences or death; Class II may cause temporary or medically reversible harm; Class III is unlikely to cause harm.

Recall effectiveness checks verify that consignees received and acted on the recall notice; a recall is closed only when the effectiveness check meets its target.

Deviation handling: contain and assess impact, determine root cause, define corrective and preventive actions, and verify effectiveness; the batch disposition decision is documented separately.

Root cause analysis tools include 5 Whys, fishbone (Ishikawa), and fault tree analysis; selecting a tool is less important than documenting the reasoning and evidence.

CAPA effectiveness checks are planned at the time of CAPA approval with a defined metric and timeframe; repeating the same deviation indicates ineffective CAPA.

Health hazard evaluation for a complaint or recall considers product, population, dose, and extent of distribution; the conclusion is documented and approved by the quality unit.

Field alerts and regulatory notifications follow defined timelines; internal escalation to the quality unit and management occurs before external communication.