⚙️ Module 14 of 17 — Operations

GMP &
Quality Systems

Good Manufacturing Practice is the legal minimum quality standard for every FDA-regulated manufacturing operation. The specific regulations differ by product category, but the core philosophy is identical across all of them: write it down, follow what you wrote, prove you did it. This module consolidates GMP requirements across food, drugs, supplements, devices, cosmetics, and veterinary products — covering ALCOA+ data integrity, the key quality documents, common GMP failures, and how consultants add value in the quality space.

📖 ~3,200 words · 13 min read

📅 Updated March 2026

⚖️ Covers 21 CFR Parts 110–820

🎯 Level: Practical Operations

The Universal GMP Philosophy

Across every FDA-regulated product category — food, drugs, devices, supplements, cosmetics — GMP regulations share a common underlying philosophy that can be stated in three sentences:

// The GMP Philosophy

Write It. Do It. Prove It.

Write it: Document everything — procedures, specifications, methods, limits, personnel responsibilities. If it isn't written, it doesn't exist as a controlled process.

Do it: Follow the written procedures exactly. Deviations must be documented, investigated, and approved — not just silently corrected.

Prove it: Maintain contemporaneous records that demonstrate what was done. Records must be attributable, legible, contemporaneous, original, and accurate (ALCOA). If records cannot prove a step was performed correctly, FDA assumes it wasn't.

GMP Regulations by Product Category

21 CFR Part 117

Food cGMP + FSMA Preventive Controls

Human Food — CFSAN

Written Food Safety Plan with hazard analysis, preventive controls, monitoring, corrective actions, verification
PCQI (Preventive Controls Qualified Individual) must develop and sign the Food Safety Plan
Personnel hygiene: illness policy, handwashing, protective clothing
Plant and grounds maintenance; pest control
Sanitation controls: cleaning and sanitizing schedules for all food-contact surfaces
Water quality: potable water standards for all food-contact water
Record retention: 2 years minimum for most food safety plan records

21 CFR Parts 210–211

Drug cGMP — Finished Pharmaceuticals

Human Drugs — CDER

Independent Quality Control unit with batch release authority
Written procedures (SOPs) for all production and process control activities
Complete batch production records for every lot
In-process and finished product testing against approved specifications
Stability program demonstrating product shelf life
Validated manufacturing processes and analytical methods
ALCOA+ data integrity for all records — electronic and paper
Laboratory equipment calibration and maintenance

21 CFR Part 111

Supplement cGMP

Dietary Supplements — CFSAN

Identity testing of every incoming component (ingredient) before use — cannot rely solely on supplier CoA
Written component specifications for identity, purity, strength, composition
Master Manufacturing Records (MMR) for each product formulation
Batch Production Records documenting every production step
In-process and finished product testing
Independent QC function with batch release authority
Consumer complaint records — serious AEs reported within 15 days

21 CFR Part 820

Quality System Regulation (QSR)

Medical Devices — CDRH

Design Controls — Design History File (DHF) for all device types subject to 820.30
Device Master Record (DMR): all device specifications, drawings, manufacturing procedures
Device History Record (DHR): evidence each device was manufactured per DMR
CAPA system — formal root cause investigation, corrective action, effectiveness verification
Supplier controls — approved supplier list, supplier qualification program
Distribution records enabling targeted recalls by UDI/lot
MDR procedures: 30-day (serious injury/malfunction) and 5-day (imminent hazard) reporting

ISO 22716 (pending FDA rule)

Cosmetics GMP

Cosmetics — CFSAN / MoCRA

MoCRA (2022) authorized FDA to establish cosmetics GMP — formal rule expected 2025–2026
Current best practice: ISO 22716:2007 (International Standard for Cosmetics GMP)
ISO 22716 covers: personnel, premises, equipment, raw materials, production, finished products, quality control, waste, subcontracted activities, complaints/recalls, audits
Safety substantiation records required under MoCRA — distinct from but related to GMP compliance

21 CFR Parts 226–229

Veterinary Drug GMP

Veterinary Drugs — CVM

Part 226: Type A medicated articles (concentrated premixes for animal feed) — cross-contamination prevention especially critical
Part 229: Veterinary finished dosage forms — largely parallels human drug GMP in 21 CFR 211
Part 225: Medicated animal feeds made from Type A articles — batch records, uniformity testing
Dedicated equipment required for certain drug classes (penicillins, steroid hormones) to prevent cross-contamination

ALCOA+ — The Data Integrity Standard

ALCOA+ is the universal data integrity framework applied across all FDA-regulated manufacturing. It originated in FDA guidance for pharmaceutical records but is now applied in food, device, supplement, and cosmetics inspections as well. Data integrity failures are the most serious GMP finding — FDA treats them as potential fraud, not just quality deficiencies.

Attributable

Every entry signed/initialed with date and time by the person who performed the activity

Legible

Readable permanently. Corrections: single line through error, initialed, dated, reason noted

Contemporaneous

Recorded at the time of the activity — not reconstructed from memory hours or days later

Original

The first record of the data — not a transcription, copy, or reconstruction of the original

Accurate

True, correct, free from errors — no deleted audit trails, overwritten data, or backdated entries

The "+" in ALCOA+ adds: Complete (all data captured, including out-of-specification results), Consistent (chronological order, no gaps in sequences), Enduring (on a durable medium that will remain legible for the required retention period), and Available (accessible for FDA review within the required timeframe upon request).

🚫

The Most Common Data Integrity Violations: Analysts recording "passing" results before the test is complete; supervisors backdating batch records to cover scheduling gaps; deleted or overwritten HPLC raw data files; shared login credentials for electronic systems (making attribution impossible); "test, fail, discard, retest until pass" without documenting the failing results. All of these are data integrity violations — FDA has pursued criminal prosecution for egregious cases.

The Key GMP Documents — Across All Categories

Despite the different regulatory frameworks across product categories, the same types of quality documents appear in every GMP system. Understanding these document types is the foundation of quality system literacy.

SOP

Standard Operating Procedure

Written step-by-step instructions for performing a specific task. Must be followed exactly — deviations require documentation. SOPs must be current, controlled (version-managed), and accessible to the people who need them. Outdated SOPs still in circulation = GMP violation. SOPs cover everything from cleaning equipment to performing analytical tests to releasing batches.

MMR / BMR

Master Manufacturing Record / Batch Manufacturing Record

The MMR is the master recipe/formula document for a specific product — ingredients, quantities, processing steps, in-process tests, specifications. The BMR (also called Batch Production Record or BPR) is the executed record for each individual batch — documenting actual quantities used, actual test results, operator signatures, and deviations. The MMR defines; the BMR proves.

DHF / DMR / DHR

Design History / Master / History Records (Devices)

Device-specific documents. DHF: the development history file — all records from design and development showing how the device design evolved. DMR: the master record — current approved specifications, drawings, manufacturing procedures for the device. DHR: the production record for each individual device — proof each unit was made according to the DMR.

CAPA

Corrective and Preventive Action

Formal system for identifying, investigating, and eliminating quality problems. Corrective action addresses existing problems (fixing what went wrong). Preventive action addresses potential problems (fixing what could go wrong). CAPA records must document: problem identification, root cause analysis, action plan, implementation, and effectiveness check. FDA inspectors almost always review CAPA records first.

CoA

Certificate of Analysis

Document provided by a supplier or testing laboratory confirming that a specific lot of material meets its specifications. For ingredients in supplements and drugs, the CoA shows test results for identity, purity, potency, and other parameters. Important: for supplements (21 CFR 111), a supplier's CoA alone does not satisfy the identity testing requirement — independent confirmation testing must still be performed.

OOS / OOT

Out-of-Specification / Out-of-Trend Result

OOS: a test result that falls outside established acceptance criteria. OOS results cannot be ignored or averaged away — they require formal investigation following a defined procedure. OOT: a result within specification but trending toward the limit over time — may indicate an impending failure. Both require documentation and investigation; OOS results may require batch rejection.

Change Control

Change Control Record

Formal record documenting any change to a controlled process, equipment, material, or procedure. Must include: description of the change, justification, risk assessment, approval, implementation, and verification that the change had the intended effect. For drugs with approved NDAs: changes above a threshold must be reported to FDA (CBE-30 or Prior Approval Supplement) — not just internally documented.

Deviation / NCI

Deviation Report / Non-Conformance Incident

Documents when something happened differently than specified — a processing parameter went out of range, an equipment failure occurred, a procedure was not followed exactly. All deviations must be investigated for potential product impact, classified by severity, and resolved with documented disposition (use as is, rework, retest, reject). Uninvestigated deviations = GMP violation.

Validation and Qualification — Process and Method Assurance

Validation is the documented evidence that a process, equipment, or method consistently produces a result meeting predetermined specifications. It is one of the cornerstones of GMP across all categories.

Validation Type	What It Demonstrates	When Required	Example
Process Validation	A manufacturing process consistently produces a product meeting its specifications and quality attributes	Before commercial production of any new drug product or device; after significant process changes	Tablet compression process validation: same hardness, dissolution, content uniformity across 3 consecutive commercial-scale batches
Analytical Method Validation	A test method consistently and accurately measures what it claims to measure, with known precision, accuracy, specificity, and linearity	Before using any analytical method for batch release or specification testing	HPLC method validation: demonstrating the method accurately quantifies the active ingredient in the presence of degradation products
Equipment Qualification	Equipment is installed correctly (IQ), operates as specified (OQ), and performs as required in the actual process (PQ)	Before using any new manufacturing equipment in GMP production	Autoclave qualification: IQ (installed per specifications), OQ (reaches required temperature), PQ (sterilizes actual production loads)
Computer System Validation (CSV)	A computerized system controlling or recording GMP processes performs its intended functions accurately, consistently, and securely with full audit trail	Any computer system used in GMP activities — LIMS, manufacturing execution systems, electronic batch records	Electronic batch record system: validated to ensure it captures all required data, cannot be altered without audit trail, and restricts access by role
Cleaning Validation	Cleaning procedures effectively remove product residue, cleaning agents, and microbial contamination from equipment to below established limits	For shared manufacturing equipment producing different products; multi-product facilities	Swab sampling after cleaning confirms API residue is below the calculated acceptable carryover limit into the next product

Quality Metrics — What FDA Watches

FDA's pharmaceutical quality initiative uses quality metrics — quantitative measures of manufacturing quality performance — to risk-stratify facilities and direct inspection resources. Understanding what metrics FDA tracks helps quality consultants advise clients on where to focus improvement efforts.

Lot Acceptance Rate

The percentage of batches that pass initial release testing. A declining lot acceptance rate signals a deteriorating manufacturing process. FDA benchmarks lot acceptance rates across facility types — facilities significantly below industry norms attract more frequent inspections.

Product Quality Complaints

Rate of consumer complaints per batch or per unit distributed. High complaint rates signal quality control failures that may not be captured by internal testing. FDA tracks complaint rates from MedWatch voluntary reports and from mandatory adverse event reporting.

Invalidated OOS Rate

The percentage of OOS results that are invalidated through a laboratory investigation finding assignable cause. A very high invalidated OOS rate can signal that the facility is improperly invalidating test failures — a data integrity concern that FDA scrutinizes closely during inspections.

Recall Rate

Number and class of recalls per facility. Recalls signal post-market quality failures. Class I recalls (most serious) and repeated recalls of the same product type strongly indicate systemic quality system deficiencies. FDA prioritizes inspection of facilities with recent Class I recalls.

The GMP Gap Assessment — How Consultants Add Value

The most valuable GMP consulting service — before an FDA inspection, before an import, or before a new client relationship — is a GMP gap assessment. This is a systematic evaluation of a facility's quality system against the applicable GMP regulations, identifying specific deficiencies before FDA does.

GMP Gap Assessment Framework // Use the applicable regulation as your checklist framework Phase 1 — Document Review (Off-site) □ Organization chart and quality unit independence □ SOP list — are all required SOPs present and current? □ Batch record templates — do they capture all required data? □ Specification documents — are all required specs established? □ CAPA records — are investigations complete and effective? □ Change control log — are all changes documented and approved? □ Validation master plan — are critical processes validated? □ Training records — are personnel trained on current SOPs? Phase 2 — Facility Walk-Through (On-site) □ Personnel hygiene practices observed (actual behavior vs. SOP) □ Equipment cleanliness, status labels, calibration stickers current □ Storage conditions: temperature, humidity, light — monitored and recorded? □ Pest control evidence: traps, logs, no evidence of infestation □ Raw material area: labeled, dated, separated (approved/quarantine/rejected) □ Laboratory: instruments calibrated, reagents dated, raw data available Phase 3 — Record Inspection (Data Integrity Audit) □ Review completed batch records for missing entries, corrections, signatures □ Check electronic system audit trails for deleted or modified entries □ Verify test dates match production dates (contemporaneous recording) □ Check for OOS results and confirm they were properly investigated □ Review training records vs. actual tasks performed by personnel Deliverable: Written Gap Assessment Report → Each gap: citation (regulation section), observation, risk level (critical/major/minor), recommended action → Priority ranking: address critical gaps before FDA inspection or first U.S. shipment → Action plan template: gap → corrective action → responsible person → target date → completion evidence

✅

The Pre-Inspection GMP Audit as a Consulting Service: One of the most consistent, repeatable, and high-value services a regulatory consultant can offer is a mock FDA GMP inspection — also called a "pre-inspection readiness audit." You follow the same procedures an FDA investigator would follow, review the same records, ask the same questions. The facility gets to find and fix their gaps before FDA does. For manufacturers exporting to the U.S. who have never been FDA-inspected, this service is genuinely transformative — and can prevent the catastrophic consequences of a failed pre-approval inspection.

✦ Module 14 — Key Takeaways

All FDA GMP systems share one philosophy: Write it (document procedures), Do it (follow them exactly), Prove it (maintain contemporaneous, attributable records). If it isn't written down and provably done, FDA assumes it didn't happen.
ALCOA+ is the data integrity framework: Attributable, Legible, Contemporaneous, Original, Accurate — plus Complete, Consistent, Enduring, Available. Data integrity failures are treated as potential fraud. Deleted audit trails, backdated records, and invalidated OOS results without adequate investigation are among the most serious GMP findings across all categories.
GMP regulations vary by category: 21 CFR Part 117 (food/FSMA), Parts 210–211 (drugs), Part 111 (supplements), Part 820 (devices/QSR), ISO 22716 (cosmetics), Parts 226–229 (veterinary). The specific requirements differ but the document types are universal: SOPs, batch records, CAPA, deviation reports, CoAs, change control, OOS investigations.
Identity testing of every incoming ingredient before use is the most commonly violated GMP requirement for dietary supplement manufacturers (21 CFR § 111.75). A Certificate of Analysis from the supplier is not sufficient — independent testing must be performed on each lot of each component before use in production.
Validation is documented evidence that a process, method, or system consistently performs as intended. Process validation, analytical method validation, equipment qualification, and cleaning validation are all required elements of comprehensive GMP compliance for drug and device manufacturers.
A GMP gap assessment — systematic evaluation of a facility's quality system against applicable regulations before an FDA inspection — is one of the most valuable consulting services available. It identifies critical gaps, allows remediation before FDA finds them, and protects clients from the devastating consequences of failed pre-approval inspections and import alerts.

Need a GMP gap assessment before your FDA inspection?

Regovant provides mock FDA inspections, GMP gap assessments, data integrity audits, and quality system remediation support for manufacturers in all FDA-regulated categories.

Request a GMP Assessment →

← Previous Module

Import Process A–Z

Next Module →

FDA Inspections — Before, During, and After

GMP &Quality Systems