EU GMP (Volume 4) / EU GDP Audit-Readiness Rubric
Sources used (all free, primary):
- EU GMP Vol. 4, Chapter 1 – Pharmaceutical Quality System (rev. 3, in force 31 Jan 2013) — health.ec.europa.eu
- EU GMP Vol. 4, Chapter 7 – Outsourced Activities (rev. 1, in force 31 Jan 2013) — health.ec.europa.eu
- EU GMP Vol. 4, Annex 11 – Computerised Systems (rev. 1, in force 30 Jun 2011) — health.ec.europa.eu
- EU GMP Vol. 4, Annex 15 – Qualification and Validation (rev., in force 1 Oct 2015) — health.ec.europa.eu
- EU GDP Guidelines 2013/C 343/01 (full text, all 11 chapters) — EUR-Lex 52013XC1123(01)
- MHRA GMP Inspection Deficiency Data Trend 2015 (dosage forms; 303 inspections — 224 UK, 79 overseas), gov.uk/MHRA GMDP Inspectorate — PDF, also indexed at mhrainspectorate.blog.gov.uk
- MHRA GDP Inspection Deficiency Data 2016 (Brown, Madigan, Ault; Nov 2017; 10% sample of 1,428 inspections = 148 reviewed) — PDF, assets.publishing.service.gov.uk
- gov.uk guidance hub — Medicines: good manufacturing practice and good distribution practice
Note on Chapters 4/5/6 of EU GMP Vol. 4 (Documentation, Production, Quality Control): MHRA's 2015 deficiency data for these chapters was fully extracted (real, per-chapter counts and verbatim example deficiency text below), confirmed against 2005-vintage chapter text for structural reference. Clean plain text of the current-revision Chapter 4/5/6 clause-by-clause wording was not cleanly extracted this session (the PDFs are image/stream-encoded and resisted extraction the way Chapter 1, Chapter 7, Annex 11 and Annex 15 did). Where a specific clause number is cited below for Ch.4/5/6, it is anchored to the section numbering confirmed by the MHRA deficiency charts (e.g., "Documentation findings ran 4.1–4.32" — confirmed from the source PDF's own axis labels) combined with well-established, publicly-documented GMP subject matter for that clause range. Flagging this explicitly — clause-perfect wording for Ch.4/5/6 needs a cleaner text-layer PDF or OCR pass on the official chapter files (links above) before this goes into production scoring, not a paid Orange Guide.
MHRA Orange Guide was NOT used or consulted for this rubric, per the sourcing decision in [[regscribe-ai-regulatory-landscape]].
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern (real MHRA data)
PART A — EU GMP VOLUME 4
Chapter 1 — Pharmaceutical Quality System
MHRA 2015 data: Quality System is the #1 most-cited deficiency group of all 10 groups tracked — 27 Critical, 293 Major, 555 Other findings, more than any other area including Documentation (9/138/372) or Production (0/161/357).
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 1 | A comprehensive, documented Pharmaceutical Quality System (PQS) — a "Quality Manual or equivalent" — must exist, covering GMP + Quality Risk Management, and senior management must have "leadership and active participation" in it. | EU GMP Vol 4, Ch 1, §1.4, §1.5, §1.7 | Quality Manual; org chart showing QA reporting line to senior management; minutes evidencing senior-management participation in quality reviews | Quality System is the #1 deficiency group (27 Critical / 293 Major / 555 Other in 2015) — more cited than any other chapter |
| 2 | A state of control must be established via effective monitoring/control systems for process performance and product quality, and results fed into batch release, deviation investigation, and preventive action. | EU GMP Vol 4, Ch 1, §1.4(viii)-(ix) | Trend monitoring records; process performance reports linked to batch release decisions | MHRA example: "training of aseptic area operators was significantly out of date for aseptic area validation activities... new technician started unsupervised manufacture but was not formally authorised" |
| 3 | Change control must include prospective evaluation and approval prior to implementation, and a post-implementation evaluation to confirm quality objectives were met with no unintended impact. | EU GMP Vol 4, Ch 1, §1.4(xii)-(xiii) | Change control SOP + change control log with pre-approval date stamps and post-implementation effectiveness reviews | MHRA examples (repeated theme): "change control procedure did not include an appropriate process for effectiveness checks"; "change controls were raised after projects were initiated"; "changes could be closed off before all implementation actions could be completed" |
| 4 | Deviations require appropriate root cause analysis; where human error is cited, the investigator must justify that process/procedural/system causes were not overlooked. Effectiveness of CAPA must be monitored. | EU GMP Vol 4, Ch 1, §1.4(xiv) | Deviation/CAPA SOP; investigation reports showing root-cause methodology (not just "human error"); CAPA effectiveness-check records | MHRA example, verbatim: a deviation "had recorded that personnel had been made aware of the issue to prevent recurrence pending full CAPA, however there was no evidence this had been done and the incident log indicated that a similar issue had occurred 5 days later" |
| 5 | There must be a process for self-inspection and/or quality audit that regularly appraises the effectiveness of the PQS, plus a management review process (periodic, senior-management-involved). | EU GMP Vol 4, Ch 1, §1.4(xvii), §1.6 | Self-inspection schedule + reports; management review minutes with corrective actions tracked to closure | MHRA example: "no formal process on-site to ensure updates to regulatory requirements were considered for impact on the site quality system" |
| 6 | Annual/rolling Product Quality Review (PQR) across ~12 defined elements (starting materials, in-process/finished results, OOS, deviations, changes, stability, complaints/recalls, contractual arrangements per Ch 7). | EU GMP Vol 4, Ch 1, §1.10-1.11 | PQR reports, one per product/product family, evidencing all 12 elements and a documented CAPA/revalidation decision | (Not separately broken out in MHRA top-10, but PQR gaps recur inside "Quality System" and "Complaints and Recall" — the #2 most-cited group at 10 Critical / 25 Major / 94 Other) |
Chapter 4 — Documentation
MHRA 2015 data: #3 most-cited group — 9 Critical, 138 Major, 372 Other, spanning clauses 4.1 through 4.32.
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 7 | Records must be contemporaneous, attributable, legible, and corrections must be traceable (not obscured) — the classic ALCOA data-integrity principles as applied to paper/hybrid records. | EU GMP Vol 4, Ch 4 (§4.1–4.32 range per MHRA deficiency charts) | Signed/dated batch records with visible original entries under any correction; SOP defining correction method (single-line strike-through, initials, date, reason) | MHRA verbatim examples: "Pencil and tippex were present in the facility"; "Overwriting of hand recorded data and lack of adequate explanation for changes"; "Post-it notes, loose note paper and hand-written notes on labels"; "Inappropriate changes made by obscuring data via fixing stickers over entries" |
| 8 | Records, including "prime data," must be retained and protected from destruction for the retention period; retrospective re-issue/completion of records is not acceptable without documented explanation. | EU GMP Vol 4, Ch 4 | Document retention schedule; archive access log; audit trail of any record re-issue with QA sign-off | MHRA example — data-integrity critical finding: "Records were partially burnt or in waste bags awaiting destruction at the rear of the site... Some of the documents had been re-issued and completed retrospectively with the sanction of QA. No explanation or record of the replication of data." |
| 9 | Procedures and forms must reflect actual practice; checks (e.g. incoming material condition) must be documented at the point performed, not implied. | EU GMP Vol 4, Ch 4 | Live SOPs walked against actual floor practice during internal audit; incoming-goods check sheets | MHRA example: "Procedures and forms did not always reflect actual or required practice"; "no documented check for the incoming condition of materials received to the stores" |
| 10 | Uncontrolled/hand-written procedures — including ones containing security-sensitive data (e.g. system passwords) — are a documentation-control failure. | EU GMP Vol 4, Ch 4 | Document control register; version-controlled SOP repository with no "shadow" procedures on the floor | MHRA example: "An uncontrolled, hand-written SOP for label printing was present in the printing area. This also included the system password" |
Chapter 5 — Production
MHRA 2015 data: #6 most-cited group — 0 Critical, 161 Major, 357 Other (findings span 5.2–5.70+).
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 11 | Cross-contamination prevention requires a documented, risk-based assessment (toxicity/potency-driven) covering facility dedication, cleaning, and shared-equipment risk. | EU GMP Vol 4, Ch 5 (§5.18-5.20 range) | Cross-contamination risk assessment referencing toxicological/potency data; cleaning validation reports for shared equipment | MHRA example: "No formal process to define how organisational and technical measures should be developed and implemented to prevent cross contamination between products"; automated tablet counter used across multiple products "had not been considered as part of the cross contamination risk assessment" |
| 12 | Supplier/API qualification must be evidenced (audit or equivalent certificate) and matched by a technical agreement that names the actual materials supplied. | EU GMP Vol 4, Ch 5 (supplier management provisions) | Approved supplier list with audit dates/EDQM CEPs on file; technical agreements naming each active substance | MHRA example: API "supplier had been approved without any evidence of audit of the facility... technical agreement... only cited Active 2 and did not include Active 1" |
| 13 | Cleaning procedures for shared equipment must be validated with a scientific rationale for limits, not just "difficulty of cleaning." | EU GMP Vol 4, Ch 5 (cross-referenced to Annex 15 §10) | Cleaning validation protocol/report with toxicological carryover limits, swab data from worst-case locations | MHRA example: "cleaning risk assessment did not consider the toxicity or potency of the materials being handled and was restricted to the difficulty of cleaning" |
Chapter 6 — Quality Control
MHRA 2015 data: #4 most-cited group — 4 Critical, 26 Major, 136 Other (findings span 6.1–6.41).
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA — direct data-integrity relevance) |
|---|---|---|---|---|
| 14 | Stability/OOT/OOS results must be reviewed for trend and, where atypical, risk-assessed against marketed batches — not just filed. | EU GMP Vol 4, Ch 6 (stability provisions) | Stability trend reports with documented OOT investigation and market-impact risk assessment | MHRA critical-relevant example: "review failed to identify the atypically high Equilibrium Relative Humidity at 36 and 48 month time points. The out of trend event was not reported and investigated... no risk assessment on products available on the market" |
| 15 | Electronic QC data (e.g. IR spectra, chromatography) must actually be reviewed as part of release, not just "ticked" — a blank check-box is not evidence of review. | EU GMP Vol 4, Ch 6 (cross-referenced to Annex 11 §9 audit trail review) | Second-person review sign-off tied to specific electronic data file IDs, not a generic checklist tick | MHRA verbatim: "IR spectra were missing from the data package and it could not be proven that a check of electronic data had taken place; the only recorded check being a tick on the front page" |
| 16 | Test sheets/trend cards must not be pre-completed ("signed and checked as passed") ahead of actual results — a hallmark data-integrity/fraud indicator. | EU GMP Vol 4, Ch 6 | Timestamped LIMS or paper audit trail showing test-sheet completion sequence after result generation | MHRA verbatim: "test sheet for raw material X batch xxxxx was signed and checked as passed although it was still awaiting tests. The trend card... had also been completed ahead of results and checked" |
Chapter 7 — Outsourced Activities
MHRA 2015 data: findings span 7.1–7.17, no Criticals recorded in the 2015 sample but a consistent Major theme around technical agreements.
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 17 | There must be a written Contract between Contract Giver and Contract Acceptor establishing each party's duties; the Giver's QMS must state how its QP exercises release responsibility despite outsourcing. | EU GMP Vol 4, Ch 7, §7.1, Principle | Signed, current technical/quality agreement naming responsibilities, referenced in the QMS | MHRA verbatim: "no proceduralised assessment of the suitability of the Contract Acceptor to carry out the outsourced activities" |
| 18 | The Contract Giver must assess legality/suitability/competence of the Acceptor before outsourcing, and must monitor/review Acceptor performance on an ongoing basis. | EU GMP Vol 4, Ch 7, §7.5, §7.7 | Pre-qualification audit report; periodic performance review record (KPIs, quality metrics) | MHRA verbatim: "Technical Agreements and audits were not in place for a number of suppliers... no inventory of Technical Agreements (TAs) for outsourced activities and no review period" |
| 19 | The Contract Giver must review and assess records/results of outsourced activities — not simply accept the Acceptor's Certificate of Analysis on faith. | EU GMP Vol 4, Ch 7, §7.8 | Evidence of Giver-side review of Acceptor batch records/CoAs prior to release decision | MHRA verbatim: "company had not reviewed or assessed the records and the results related to the outsourced activities to Contract Acceptor A" |
| 20 | The Contract must permit the Contract Giver to audit the Acceptor (and any approved sub-contractors). | EU GMP Vol 4, Ch 7, §7.17 | Audit-right clause in the contract; audit schedule and completed audit reports | Confirms the audit-clause gap pattern above — Technical Agreements found "contradictory in regard to responsibility for assuring API compliance with EU GMP and TSE requirements" |
Annex 11 — Computerised Systems
MHRA 2015 data: Computerised Systems is a smaller but high-severity group (1 Critical, 21 Major, 19 Other) — the only group besides Quality System with a Critical finding relating to systems/data governance. This is the annex with the most direct 1:1 overlap with FDA 21 CFR Part 11 — see the mapping section at the end.
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 21 | Risk management must be applied across the computerised system lifecycle to determine the extent of validation and data integrity controls required — this is explicitly risk-based, not one-size-fits-all. | EU GMP Vol 4, Annex 11, §1 | Documented system risk assessment (GMP criticality, data integrity impact) driving the validation plan | MHRA Critical/Major finding: "Risk management principles not applied throughout the lifecycle of computerised systems to determine the extent the validation and data integrity controls required" |
| 22 | Access control must include individual log-ons, separation of access levels, and restriction of deletion rights; analysts should not have unrestrained data-delete access. | EU GMP Vol 4, Annex 11, §12 | User access matrix showing role-based permissions; evidence no analyst holds admin/delete rights on production systems | MHRA verbatim: "No control of user permissions on HPLC systems, e.g. no individual log-on and no separation of access levels... Analyst had access to delete data" |
| 23 | Audit trails must be enabled for GMP-relevant changes/deletions, with a documented reason, and be reviewed regularly. | EU GMP Vol 4, Annex 11, §9 | Audit-trail configuration screenshots/validation evidence showing it is enabled and cannot be turned off by users; periodic audit-trail review log | MHRA verbatim: "Setting within HPLC software not fully enabled e.g. audit trail" |
| 24 | Manual integration of chromatographic data must be controlled — not permitted routinely without additional review/authorisation — and system clocks must not be end-user-adjustable. | EU GMP Vol 4, Annex 11, §9-10 (change control) | SOP restricting/reviewing manual integration events; evidence system time is centrally controlled/locked | MHRA verbatim: "Manual integration was permitted routinely without additional review or permission... clock used for determining time/date for the HPLC software could be adjusted therefore allowing the option to alter the true time and date" |
| 25 | An up-to-date inventory of all GMP-relevant computerised systems with their GMP functionality must exist. | EU GMP Vol 4, Annex 11, §4.3 | Current system inventory register mapped to GMP criticality/validation status | MHRA verbatim: "list is not a current, accurate list and the GMP functionality of the systems is not included... access control system has been defined as not a GMP system and as a consequence has not been validated" |
| 26 | Electronic signatures must have equivalent legal weight to handwritten signatures within the company, be permanently linked to the record, and carry time/date. | EU GMP Vol 4, Annex 11, §14 | E-signature validation records; binding demonstration between signature and record (cannot be detached/reused) | (No specific MHRA 2015 example captured in the extractable data for this exact clause, but this is the clause with the most direct FDA Part 11 §11.70 parallel — see mapping below) |
Annex 15 — Qualification and Validation
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 27 | A site-wide Validation Master Plan (VMP) must define the qualification/validation policy, org structure/roles, current status of all systems, and change-control/deviation handling for validation. | EU GMP Vol 4, Annex 15, §1.4-1.5 | Current, approved VMP referencing all in-scope systems and their qualification status | MHRA example: not all new equipment qualification included the design phase (DQ/URS); "Qualification documents provided by equipment suppliers were not adopted into the company's Pharmaceutical Quality System to ensure appropriate review" |
| 28 | Retrospective validation is explicitly not acceptable; qualification and validation activities must be planned prospectively across the system lifecycle. | EU GMP Vol 4, Annex 15, General principle | Validation protocols pre-dating first productive use; no evidence of "validation" reports written after the fact | (Structural requirement — directly undermined by the MHRA Chapter 1 finding of retrospectively-completed batch documentation, same root pattern) |
| 29 | Deviations from validation protocols/acceptance criteria must be documented as formal deviations and scientifically justified — informal note-taking is insufficient. | EU GMP Vol 4, Annex 15, §2.7-2.8 | Validation deviation log cross-referenced to the site CAPA/deviation system | MHRA example: "OQ protocol for the HVAC system was supplied by the third party, [but] there was no evidence that the company had confirmed the suitability" against internal procedures prior to approval |
| 30 | Cleaning validation must include swab sampling from worst-case/hard-to-clean locations and a scientifically justified carryover limit — visual clean is not sufficient evidence alone. | EU GMP Vol 4, Annex 15, §10 | Cleaning validation report with swab-location risk rationale and calculated carryover limits | MHRA verbatim: "Permitted limits for carryover of organic molecules have not been set or adequately risk assessed... no swabs have been taken from difficult to clean areas" |
| 31 | Computerised systems used in manufacturing must be validated per Annex 11 as part of the qualification/validation programme — Annex 15 explicitly cross-references Annex 11. | EU GMP Vol 4, Annex 15, Principle | Combined validation package showing CSV (Annex 11) evidence alongside equipment IQ/OQ/PQ | This is the explicit textual link Regscribe should model as one evidence node — see mapping below |
PART B — EU GDP GUIDELINES (2013/C 343/01)
MHRA GDP 2016 data covers a 10% risk-representative sample of 148 inspections (of 1,428 total). Only Major findings were reviewed in detail (Critical excluded as too heterogeneous to categorize; Other excluded as high-volume/lower-impact). Note: the source presents most results as bar charts embedded as images, so exact percentages per sub-clause were not machine-extractable from this PDF — the qualitative findings below are the verbatim written examples the report itself gives for each chapter, which is the actual textual content MHRA published (the numeric chart values were not recoverable as text). This is called out explicitly rather than guessed at.
Chapter 1 — Quality Management
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 32 | A documented quality system with a named Responsible Person (RP) must exist, incorporating quality risk management and a change-control system. | EU GDP Guidelines 2013/C 343/01, Ch 1, §1.1-1.2 | Quality Manual; RP appointment letter with defined authority | MHRA verbatim: "There was little or no evidence of the effective implementation of change control, risk management, deviation capture, CAPA reporting or management review" |
| 33 | Outsourced activities (storage, transport, etc.) must be assessed for supplier suitability, defined by written contract, and monitored/reviewed on an ongoing basis. | EU GDP Guidelines, Ch 1, §1.3 | Outsourcing contract register with review dates | MHRA verbatim: "no formal process for review of the outsourced activities including review of the written contracts. Some of the written contracts with 3rd party service providers for storage and distribution were out of date" |
| 34 | Formal, periodic management review of the quality system must occur, covering complaints, deviations, CAPA, process changes, self-inspection/audit outcomes, and regulatory change. | EU GDP Guidelines, Ch 1, §1.4 | Management review minutes covering the defined agenda items | MHRA verbatim: "scope of Management Reviews did not include deviation analysis and there was no visibility of deviation detail at Management Review level" |
| 35 | Deviations must be closed only after CAPA is actually implemented — not signed off prematurely. | EU GDP Guidelines, Ch 1, §1.2(v)-(vi) | Deviation/CAPA record showing CAPA completion evidence predates closure sign-off | MHRA verbatim: "evidence of deviations being closed prior to CAPA being implemented, e.g. the deviation relating to the breaking down of packs at a third party logistics (3PL) provider had actions outstanding but had been signed off as complete" |
Chapter 4 — Documentation
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 36 | Records must be retained for at least 5 years (or longer per national legislation) and must include date, product name, quantity, and counterparty name/address for every transaction. | EU GDP Guidelines, Ch 4, §4.2 | Retention policy stating ≥5-year minimum; transaction records with all required fields populated | MHRA verbatim, data-integrity critical: "considerable gaps in contemporaneous temperature records. The Responsible Person confirmed he had added fabricated readings to fill gaps" |
| 37 | Documentation should not be hand-written where avoidable, must be free from unapproved corrections, and any alteration must be signed, dated, and still allow reading of the original entry. | EU GDP Guidelines, Ch 4, §4.2 | Document control SOP defining correction method; sample records showing traceable corrections | MHRA verbatim: "some records had been made in pencil, some temperature records were unsigned and there were a number of unapproved corrections" |
| 38 | Historic trading/transaction records must be available and retrievable on request for inspection, including for any unusual or unlicensed transaction. | EU GDP Guidelines, Ch 4, §4.2 | Retrievable archive index; ability to produce records for a named transaction within a defined SLA | MHRA verbatim: "Historic records of trading were not available for inspection... no transaction records were available for review and there were no qualification records available for any suppliers or customers" |
Chapter 5 — Operations (Storage-relevant)
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 39 | Supplies must only be sourced from holders of a valid wholesale distribution or manufacturing authorisation; the receiving distributor must verify this (e.g. via the Union database), and verify broker registration if applicable. | EU GDP Guidelines, Ch 5, §5.2 | Supplier qualification file with authorisation-status verification evidence, dated at time of approval | MHRA verbatim (HMR breach, closely tied): "Medicinal products had been obtained from outside of the licenced supply chain by way of donation from members of the public" |
| 40 | Temperature-controlled storage requires documented temperature mapping to justify probe placement and confirm suitability of the storage area — not just periodic spot checks. | EU GDP Guidelines, Ch 5/Ch 3 (storage conditions cross-reference) | Temperature mapping study report with conclusion on storage-area suitability | MHRA verbatim: "Temperature mapping exercises had not been adequately conducted, to establish the suitability of the storage areas or to determine the placement of the thermometers... No conclusion had been drawn as to the suitability of the storage areas" |
| 41 | Cold-chain temperature deviations must trigger CAPA, not just be logged. | EU GDP Guidelines, Ch 5 (storage) / Ch 1 (deviation handling) | Cold-chain excursion log cross-referenced to CAPA records | MHRA verbatim: "Cold chain temperature deviations had been recorded but not subjected to CAPA reporting" |
Chapter 6 — Complaints, Returns, Falsified Products, and Recalls (Deviations-relevant)
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 42 | Products returned to saleable stock require confirmation of intact packaging, evidence of correct storage during the return journey, examination by trained personnel, and traceable evidence of original supply — all five conditions, not a subset. | EU GDP Guidelines, Ch 6, §6.3(i)-(v) | Returns disposition checklist covering all five criteria per returned batch | MHRA verbatim: "process for handling customer returns was deficient in that there was a lack of evidence supporting the return of damaged stock to the supply chain" |
| 43 | Effectiveness of recall arrangements must be evaluated at least annually; recall records must be readily accessible to the competent authority. | EU GDP Guidelines, Ch 6, §6.5 | Annual mock-recall exercise report with effectiveness metrics (time-to-contact, % traced) | MHRA verbatim: "process for regularly assessing the effectiveness of recall activities lacked sufficient detail so as to permit staff to follow the process consistently" |
| 44 | Suspected falsified products must be reported to the competent authority immediately, physically segregated, and the incident documented. | EU GDP Guidelines, Ch 6, §6.4 | Falsified-product SOP with segregation area defined; incident log with notification timestamps | MHRA verbatim: SOP "repeatedly referred to counterfeit medicines rather than the full scope of the term 'falsified medicines'... did not indicate that all suspected falsified meds must be notified to MHRA" |
Chapter 8 — Self-Inspections
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 45 | A self-inspection programme covering all GDP aspects must run to a defined schedule; findings must be recorded with root cause and CAPA. | EU GDP Guidelines, Ch 8, §8.2 | Self-inspection schedule + completed reports with CAPA tracking | MHRA verbatim: "RPs had failed to conduct a self-inspection since appointment" |
Chapter 7 — Outsourced Activities (GDP)
| # | Requirement | Citation | Evidence | Common failure pattern (MHRA) |
|---|---|---|---|---|
| 46 | An audit of the Contract Acceptor must occur before commencement and after any change to outsourced activities; audit frequency must be risk-based. | EU GDP Guidelines, Ch 7, §7.2 | Audit schedule + reports, timestamped relative to contract start/change dates | MHRA verbatim: "no audit conducted of the contract acceptor by the contract giver and the contract giver had not had sight of or reviewed the written procedures being used by the contract acceptor" |
PART C — WHERE FDA PART 11 AND EU GMP/GDP OVERLAP (data-model implications)
This is the section that matters most for Regscribe's architecture. The clearest, highest-value overlap is:
Annex 11 (Computerised Systems) ↔ 21 CFR Part 11 (Electronic Records/Electronic Signatures)
| Underlying control | Annex 11 clause | Part 11 clause (from the Part 11 rubric) | Recommendation |
|---|---|---|---|
| Audit trail of GMP-relevant changes/deletions, with reason captured | §9 Audit Trails | §11.10(e) — secure, computer-generated, time-stamped audit trails | Single evidence node: "audit-trail configuration + review log." One customer artifact (e.g. a validated audit-trail export + periodic review record) satisfies both frameworks. |
| Role-based access control, restricted deletion rights | §12 Security | §11.10(d) — limiting system access to authorized individuals | Single evidence node: user access matrix / RBAC config. |
| Electronic signature bound to record, time/date-stamped, equivalent legal weight to handwritten | §14 Electronic Signature | §11.50, §11.70 — signature manifestations and record linking | Single evidence node, though flag a framework difference: Part 11 requires the signature to include printed name, date/time, and meaning (§11.50) and mandates unique-to-one-individual credentials with non-reuse/non-reassignment (§11.100/§11.200) — more prescriptive than Annex 11's principle-level "same impact as hand-written." Model as one evidence type with a jurisdiction-specific completeness checklist layered on top. |
| System validation proportional to risk, covering the full lifecycle | §4 Validation, §1 Risk Management | §11.10(a) — validation of systems to ensure accuracy, reliability, consistent performance | Single evidence node: CSV package (URS→IQ/OQ/PQ, or equivalent risk-based lifecycle documentation per Annex 15 §1 cross-reference). |
| Accuracy of manually-entered critical data, checked by second person or validated electronic means | §6 Accuracy Checks | Implicit in §11.10(a)/(f) (operational checks) | Single evidence node: second-check/verification log for manually entered GMP data. |
| Data storage integrity, backup/restore tested | §7 Data Storage | §11.10(c) — protection of records to enable accurate retrieval | Single evidence node: backup/restore validation test record. |
Where they genuinely diverge (do not force into one node):
- Part 11 is a binding US federal regulation with defined legal penalties; Annex 11 is guidance interpreting a directive (2003/94/EC) — the enforceability mechanism differs, which matters for Regscribe's risk-scoring weight, even if the underlying control is identical.
- Part 11 has explicit, granular password/biometric credential rules (§11.200) with more prescriptive detail than Annex 11's principle-level §12.
- Annex 11's §3 (Suppliers and Service Providers) and its explicit tie to Annex 15/Chapter 7 (technical agreements, audit rights over IT vendors) has no direct Part 11 counterpart — this is a GMP-only control that should stay as a distinct evidence node, not be merged.
Chapter 7 (Outsourced Activities, GMP) / Chapter 7 (GDP) ↔ Part 11's vendor/system-provider implications
Not a direct Part 11 mapping (Part 11 doesn't address outsourcing per se), but both EU GMP Ch.7 and GDP Ch.7 require a written contract + audit rights over any contracted computer system provider — which is the enforcement mechanism for a company relying on a cloud/SaaS QMS or LIMS to be Part-11-and-Annex-11-compliant simultaneously. Recommend Regscribe model "vendor contract + audit-right evidence" as a shared node feeding into both the outsourcing score and the computerised-systems score.
Chapter 1 (GMP)/Chapter 1 (GDP) — CAPA and root-cause analysis
Both EU GMP Ch.1 §1.4(xiv) and EU GDP Ch.1 §1.2(vi) require CAPA with effectiveness monitoring, and this is functionally the same underlying company practice as what Part 11-adjacent Part 211/210 CAPA requirements expect (though Part 11 itself is narrower — electronic records/signatures only, not general CAPA). Recommendation: keep CAPA as one company-wide evidence type (CAPA SOP + CAPA log with effectiveness-check field) referenced by GMP, GDP, and wherever the Part 11 rubric touches deviation-driven electronic record changes.
Recommended data-model shape
Rather than three parallel silos (FDA / MHRA-GMP / MHRA-GDP), suggest an "Evidence Type" layer sitting under all three rubrics:
audit_trail_configaccess_control_matrixe_signature_bindingcsv_lifecycle_packagecapa_logchange_control_logvendor_contract_with_audit_rightsbackup_restore_test
Each rubric requirement (FDA, GMP, GDP) references one or more Evidence Types; a single customer-uploaded document can satisfy multiple requirements across multiple rubrics simultaneously, and the audit-readiness score should credit that overlap rather than asking the customer to prove the same control three times.
Gaps / follow-ups
- Post-2016 MHRA deficiency data: references found to a 2023 GDP Symposium presentation (Feb 2023, covering roughly Oct 2021–Nov 2022 inspection data) and industry commentary that "EPiC's audit findings from 2024–2025 closely mirror the MHRA's last published GMP data from 2019" — implying MHRA may have published a 2019 update that was not independently retrieved/verified this session. No official GMP or GDP deficiency PDF newer than 2016 (GDP) / a possible unconfirmed 2019 (GMP) was confirmed as freely downloadable. Recommend a follow-up pass specifically on mhrainspectorate.blog.gov.uk archives (2018–2020 posts) before treating this rubric's deficiency data as current — the 2015/2016 data cited above is real, but is now 9-10 years old.
- EU GMP Chapter 4/5/6 canonical clause text: not cleanly extracted this session (PDF text-layer issue, not a paywall issue) — flagged above, links provided for a follow-up OCR/extraction pass.
- GDP 2016 percentages: the source report presents its headline comparative data as bar charts (images), not text — no numbers were fabricated for these; only the verbatim written deficiency examples (which are text) are quoted above.