A GMP audit checks that a manufacturing site is actually operating the way its own procedures say it does: hygiene and gowning, cleaning and sanitation, the facility itself, equipment and calibration, incoming materials, storage, in-process controls, quality management, packaging and labelling, traceability, and training. This one covers all of it, and you can fill it in here and download a finished PDF without creating an account.
Half of this is records and half of it is the floor
Be honest about which half you are doing. Training records, SOPs, CAPA logs and supplier certificates are a desk exercise — you can do them sitting down with the folders, and doing them any other way is slower.
Gowning, cleaning, segregation, storage conditions, line clearance and what is actually on the production floor are not. They fail in ways paperwork never shows: the de-gowning area used as a storeroom, the cleaning log signed in one handwriting for a fortnight, the allergen pallet on the wrong rack.
Do the floor half while walking and the records half afterwards. Trying to do both from the office is how a site passes its own audit and fails somebody else's.
Why some items are weighted
Not every failure here is the same size. A light fitting needing a clean and a cold store running out of specification are both one tick, and treating them equally produces a score that flatters a site with a real problem.
The items weighted three times are the ones that stop a batch shipping or force a recall: supplier approval, quarantine, allergen segregation, traceability, line clearance, batch record accuracy, calibration. A site can score 90% and still have one of those failed, which is why the failures are the deliverable.
What an auditor actually looks at first
Three things, in this order, and they are all cross-checks rather than questions:
- A cleaning log filled in ahead of time, or entirely in one hand. It takes ten seconds and it tells you how the rest of the records were produced.
- Whether a deviation raised three months ago has a closed CAPA against it. An open loop is worth more than any answer you will be given.
- The de-gowning area. It is the space nobody designs and everybody uses for something else.
Photograph the condition, not the document
Photographs of a folder prove nothing. Photographs of a gowning area, a storage rack, a piece of equipment mid-changeover or a label reconciliation in progress prove exactly the thing you are claiming.
Speak while you walk, and the document the law or the client wants writes itself. Say the finding as you stand in front of it and the note lands against the right check with the photograph already attached.
Common questions
What does GMP stand for?
Good Manufacturing Practice — the set of requirements ensuring products are consistently produced and controlled to quality standards appropriate for their use. In the US the pharmaceutical version sits in 21 CFR Parts 210 and 211; in the EU it is EudraLex Volume 4. Food manufacture has its own equivalents alongside HACCP.
How often should a GMP audit be done?
Internal audits are typically quarterly to annually depending on risk and regulatory expectation, with the full scope covered at least once a year. Many sites run a short floor walk more often and reserve the full records review for the annual pass.
What is the difference between GMP and HACCP?
GMP is the baseline — the conditions and practices that make safe production possible at all. HACCP sits on top of it and identifies the specific points in your process where a hazard is actually controlled, with limits and monitoring at each one. GMP is the foundation; HACCP is the control plan built on it.
Who should carry out a GMP audit?
Someone trained in GMP who is independent of the area being audited. Independence matters more than seniority — a production manager auditing their own line is being asked to examine their own decisions, and the findings reflect that.
What is the most common GMP audit finding?
Documentation that does not match practice. Not missing documentation — documentation that exists, is complete, and describes something other than what people actually do. That is why the floor half of this audit cannot be skipped.