cGMP: what it is, who needs to comply, and how FDA inspection works

What is cGMP?

Current good manufacturing practice is the FDA's minimum standard for the methods, facilities and controls used to make, process, pack and hold a drug. Part 210 sets the scope and definitions and Part 211 holds the requirements for finished pharmaceuticals. A drug made outside them is adulterated in law, and compliance is shown to an FDA investigator at inspection.

The current regulations date from 1978 and are amended as practice moves. The "c" means current: the FDA expects the controls of today, read with its current guidance. There is no cGMP certificate and no certification body.

Who needs to comply with cGMP?

Every manufacturer of a finished drug product for the US market, brand or generic, whether the site is in the United States or abroad

Contract manufacturers, packagers and testing laboratories that perform any step on a drug someone else markets, since each is responsible for the cGMP of the operations it performs

Clinical-stage companies from phase 2 onward, when Part 211 applies in full to the investigational product, and phase 1 sponsors who still have to meet the statutory cGMP requirement

The rule becomes urgent when the pre-approval inspection is scheduled, when a CDMO sends over a quality agreement that says which procedures are yours, or when a deviation on a commercial batch has to be closed before the lot can ship.

What cGMP requires, subpart by subpart

Subpart A of Part 211 is scope and definitions. The requirements an investigator inspects against are subparts B to K, and the quality control unit in subpart B has authority over every one of them.

Subpart B, organisation and personnel

A quality control unit with the authority to approve or reject every component, procedure and batch, and people with the education, training and experience for the job they do (211.22 to 211.34)

Subpart C, buildings and facilities

Space and flow that prevent mix-ups and contamination, with lighting, ventilation, water, sanitation and maintenance under written procedures (211.42 to 211.58)

Subpart D, equipment

Equipment fit for its use, cleaned and maintained on a schedule, with calibration and controls on automated, mechanical and electronic systems (211.63 to 211.72)

Subpart E, control of components and drug product containers and closures

Receipt, quarantine, sampling and testing of every incoming material before use, with approved and rejected material kept apart and supplier results relied on only once they are validated (211.80 to 211.94)

Subpart F, production and process controls

Written procedures for every operation, yield reconciliation, in-process sampling and testing, time limits, microbiological controls and reprocessing (211.100 to 211.115)

Subpart G, packaging and labelling control

Label issuance and reconciliation, line clearance, tamper-evident packaging and expiration dating (211.122 to 211.137)

Subpart H, holding and distribution

Warehousing under conditions that protect the drug, and distribution procedures that let a lot be recalled (211.142 and 211.150)

Subpart I, laboratory controls

Specifications, sampling plans and test methods, release testing of every batch, a stability programme and reserve samples (211.160 to 211.176)

Subpart J, records and reports

Master and batch records, equipment logs, component records, laboratory records, distribution records and complaint files, kept past the expiry date and reviewed by the quality unit before each batch is released (211.180 to 211.198)

Subpart K, returned and salvaged drug products

Returned product identified, held and destroyed or reprocessed on the record, and salvaging only with evidence the drug still meets its standards (211.204 and 211.208)

How cGMP compliance works

1. Assess the operation against Part 211 subpart by subpart

Read every procedure, batch record and laboratory record against the section it answers, and list what is unwritten, not followed or not recorded.

2. Run the system and keep the records

Each batch produces its record, each deviation and out-of-specification result an investigation, and the quality unit reviews them before release.

3. The inspection

A pre-approval inspection before the application is approved, then surveillance inspections on a risk-based schedule. The investigator works through the quality, facilities, materials, production, packaging and laboratory systems and asks for records by section, and the answer has to be the record, its approval and the procedure it followed.

4. Respond and keep it current

Observations on a Form 483 should be answered in writing within 15 business days if the FDA is to weigh the response before it decides on a warning letter, and the "c" means the system has to move with current practice and guidance between inspections.

cGMP IN QUALIO

Qualio maps every procedure and record to its section of Part 211, so the investigator finds each one where the regulation expects it

Qualio breaks Part 211 down section by section and maps your procedures, training records, deviations, OOS investigations, change controls and supplier files to the ones they answer. When a record changes, it reassesses the sections that record touches and recommends a fix for each gap. Copilot drafts the deviation write-up or the CAPA from it, and your team approves it. When the investigator asks, you export the evidence by section.

Deviations and OOS results logged against the batch, the procedure and the supplier they concern, for subparts F and I, each traceable to the investigation and the CAPA that closed it

A process or specification change routed to the approvers your procedure names, effective on the date you set, with the retraining out that day to everyone who follows the procedure, for subpart B

Supplier qualification once, an audit schedule set by risk and every deviation linked to the supplier behind it, for subpart E

Standards that apply alongside cGMP

Pharma manufacturingICH Q7: The GMP guideline for the active pharmaceutical ingredient, which Part 211 does not cover, from the point the API starting material enters the process
Pharma manufacturingICH Q10: The pharmaceutical quality system model the FDA reads cGMP through, adding management review, knowledge management and a product lifecycle the regulation does not ask for by name
Pharma manufacturingEU GMP, Eudralex Volume 4: The European Commission's equivalent, inspected by the national competent authorities, with Annex 11 for computerised systems
Electronic records21 CFR Part 11: The FDA's rule for the electronic records and signatures the batch records and laboratory records of subpart J will be kept in
Pharma manufacturingICH Q9: Quality risk management, which decides how much control each step in the process gets and which the FDA expects to see behind the decisions

Vector Biomed

QA Specialist Bennett Klusas had just 3 months to upgrade his company's paper QMS to a fully digital, modern system. With Qualio, he hit his deadlines.

Read the Vector Biomed story

“Document control took anywhere from 5 hours to 3 days. Now things get done in hours, even minutes. I can send training out in seconds now. Qualio has made my life 100% better!”

Angela PinkstonQA Manager, Akadeum Life Sciences

Guides and checklists for cGMP

Toolkit

GxP toolkit

Guide

How to respond to an FDA 483

Guide

Complete guide to the FDA Quality Management Maturity program

Questions about cGMP

What is cGMP?

Current good manufacturing practice is the FDA's standard for the methods, facilities and controls used to make, process, pack and hold a drug, set out in 21 CFR Parts 210 and 211. A drug made outside it is adulterated whatever its test results say. The FDA inspects for it and does not certify.

What is the difference between 21 CFR Part 210 and Part 211?

Part 210 is short. It states that the regulations are the minimum cGMP for a drug, says which products and operations they apply to and defines the terms. Part 211 holds the requirements themselves, in subparts B to K, for finished pharmaceuticals. Biologics add Parts 600 to 680, and active ingredients have their own guideline in ICH Q7.

What does the "c" in cGMP stand for?

Current. The FDA expects the systems and controls of today, so a practice that met the rule when it was written can be out of date now, and the regulation is read with the FDA's current guidance beside it.

Is there a cGMP certificate?

No. The FDA does not certify cGMP compliance and no certification body does. Compliance is shown to an FDA investigator at inspection, on the records the operation produces, and an inspection with no observations is the nearest thing to a pass. European agencies issue GMP certificates after their own inspections under EU GMP, which is a separate regime.

What happens if an FDA inspection finds cGMP violations?

If the investigator finds objectionable conditions, the inspection ends with a Form 483 listing them. The FDA weighs a written response received within 15 business days before it decides on a warning letter. If the response does not satisfy it, the letter follows, and from there import alerts, seizure, injunction or a consent decree. Each step is public.

Does cGMP apply to clinical trial material?

Yes, in stages. Phase 1 investigational drugs are exempt from Part 211 under 210.2(c) and still have to meet the statutory cGMP requirement, with the FDA's phase 1 guidance setting the expectation. From phase 2 onward Part 211 applies in full, so the procedures the trial supply is made under are the ones the pre-approval inspection reads.

Can we add cGMP to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every section of Part 211, beside ICH Q10 or EU GMP if you run those too. Sections the frameworks share count once, and the first assessment lists what is covered and what is new.

Is the deviation log still a spreadsheet?

Bring it, with your current procedures. We will show you Part 211 assessed against them section by section, with the gaps listed and the evidence exported the way an investigator asks.

Book a demo Get the GxP toolkit

Less time on audit prep. More time on quality.