CGMP common mistakes
CGMP · Understand the traps and how to avoid them.
When a scenario asks who should approve a batch record or a deviation closure, the candidate simply names the production manager or the most senior person present, without checking whether an independent quality unit signature is required.
The candidate reasons from general workplace hierarchy rather than from the CGMP principle that the quality unit must independently release and approve, and therefore treats QA as optional if production already signed.
What to do instead
Before answering any approval or release question, identify the role of the signer and ask whether it provides independent quality oversight. If the scenario involves release, rejection, deviation closure, or change approval, require a quality unit signature and note that production alone cannot authorize it. Practice sorting common documents into 'quality unit approval required' versus 'operational execution only'.
The candidate treats all training as satisfied once an initial training record exists, and misses that the scenario describes an employee performing a new task, after a procedure revision, or after a long absence.
Training is mentally filed as a one-time onboarding event, so the candidate does not scan the scenario for triggers that require retraining or requalification.
What to do instead
Build a trigger checklist: new hire, new or revised SOP, new equipment, deviation linked to human error, return from extended absence, and change in role. In any personnel scenario, state whether the current training record covers the specific task being performed and whether effectiveness was assessed, not merely attendance.
Faced with a facility or HVAC scenario, the candidate answers only that the room is 'clean' or 'classified', ignoring pressure differentials, airlock sequence, and the direction of airflow between adjacent areas.
Classification grades are the most memorable fact, so they crowd out the physical containment logic that actually protects the product in the scenario.
What to do instead
For every premises question, trace the path of people and materials and the pressure cascade: higher pressure in cleaner areas, airlocks with interlocked doors, and flow from clean to less clean. State the consequence of a reversed differential or a held-open door explicitly, and tie it back to cross-contamination risk rather than reciting grade names alone.
The candidate accepts that equipment was 'calibrated annually' as sufficient, without asking whether the calibration range covers the actual use range, whether the instrument status was current at the time of use, and whether an out-of-tolerance result triggered an impact assessment.
Calibration is reduced to a schedule question, and the candidate does not connect an out-of-tolerance finding to the data generated since the last valid calibration.
What to do instead
Apply a three-part test to every equipment scenario: suitable range and accuracy for the intended use, valid status at the moment of use, and documented impact assessment when a calibration fails. Always extend an OOT calibration backward to the last successful calibration and state that affected batches or results must be investigated.
The candidate accepts a record as compliant because the result is correct, even when the entry was made in pencil, backdated, corrected without a signature and date, or reconstructed from memory after the fact.
The candidate evaluates the scientific outcome rather than the record's contemporaneous and attributable nature, because data integrity principles feel abstract next to a plausible number.
What to do instead
Apply ALCOA+ as a checklist to every documentation scenario: attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, and available. For each anomaly, name which attribute fails and the required correction: single-line strike-through, initial and date, reason for change, and no destruction of the original entry.
In a production scenario the candidate focuses on the finished output and overlooks in-process controls, hold times, and line clearance between batches or products.
The batch record and final test results dominate attention, so intermediate control points and the physical state of the line at changeover are not examined.
What to do instead
Read production scenarios in process order and pause at each boundary: dispensing, line clearance, in-process checks with acceptance criteria, maximum hold times for intermediate product, and reconciliation of labels and components. If any boundary is undocumented, name it as the gap and state the risk of mix-up or microbial proliferation it creates.
The candidate approves a supplier based on a certificate of analysis alone, without addressing supplier qualification, incoming sampling, or the status of quarantined versus released material.
A supplier certificate looks authoritative and complete, so the candidate skips the question of whether the supplier was qualified and whether the material was independently verified on receipt.
What to do instead
For any materials question, establish three things: the supplier's qualification status and basis, the identity testing performed at receipt, and the physical status label controlling use. State that a certificate reduces but does not replace incoming verification, and that quarantine status must be formally released before use.
Asked about an out-of-specification laboratory result, the candidate immediately proposes retesting or resampling until a passing result appears.
The candidate conflates investigation with repetition, and treats a second result as more trustworthy without a documented scientific justification for the first failure.
What to do instead
Separate the phases explicitly: laboratory phase investigation to find assignable cause before any retest, a written and pre-approved retest plan with a defined number of retests, and full investigation with a conclusion for confirmed failures. Never allow informal retesting, and state that the original failing result remains part of the record.
The candidate treats validation as a one-time exercise completed at launch, and does not require revalidation or change control when a process, method, or system is modified.
Validation is associated with project completion, so the ongoing state of control and the obligation to assess changes are not considered.
What to do instead
For every validation scenario, ask what changed and whether a formal change control assessment preceded the change. Require documented risk assessment, defined acceptance criteria before execution, and a conclusion on whether revalidation or partial requalification is needed. Link any unassessed change to loss of validated status.
The candidate writes a CAPA that restates the deviation, such as 'retrain operator' or 'remind staff to follow the SOP', without identifying the root cause or verifying that the action worked.
Human error is accepted as a root cause at face value, and effectiveness checking is forgotten because the corrective action feels complete once assigned.
What to do instead
Structure every CAPA answer in four parts: root cause analysis that goes beyond 'operator error' to the system condition, corrective action addressing that cause, preventive action extending to similar areas, and a defined effectiveness check with a metric and timeframe. If the scenario shows a repeat deviation, state that the prior CAPA failed its effectiveness check.