GMP Audit Checklist: The Complete Facility Audit Framework

TL;DR: A GMP audit checklist is the structured set of questions a procurement, quality, or supplier-quality team works through when assessing whether a manufacturing or testing facility actually operates to Good Manufacturing Practice — not just whether it holds a GMP certificate. It follows the same domain structure GMP regulations themselves use: quality management, personnel, facilities and equipment, materials, production, laboratory controls, documentation, and self-inspection. This guide gives you that checklist section by section, explains how it differs from a general vendor-qualification checklist, and covers how to structure the audit itself.

What a GMP audit checklist is (and isn’t)

A GMP audit checklist is a facility-level assessment tool used to verify that a manufacturer, contract manufacturing organization (CMO), active pharmaceutical ingredient (API) supplier, or testing laboratory has a functioning quality system that meets Good Manufacturing Practice requirements — not a paperwork exercise confirming a certificate exists. It is typically used by:

• Procurement and supplier-quality teams qualifying a new manufacturing or testing supplier before it enters the approved-vendor pool.
• Quality assurance staff conducting periodic (requalification) audits of an existing GMP supplier.
• Internal quality units running a self-inspection — the same checklist structure applied to the auditor’s own facility rather than a supplier’s.
• Sponsors or contract-giver organizations auditing a CMO or contract testing laboratory before or during a manufacturing agreement.

This is distinct from a general vendor qualification checklist, which covers a broader set of vendor types (reagent suppliers, service providers, equipment vendors) and includes non-GMP-specific items like financial stability and delivery performance. A GMP audit checklist is narrower and deeper: it exists specifically to test compliance against the regulatory and guideline structure GMP itself is built on — 21 CFR Parts 210/211 in the US, ICH Q7 for APIs, and EU GMP (EudraLex Volume 4) or the PIC/S GMP Guide internationally.

Regulatory basis for the checklist

The checklist sections below map directly onto how the major GMP frameworks are structured, which is why auditors organize checklists this way rather than inventing an ad hoc list:

• US finished-drug cGMP — 21 CFR Part 211, organized into subparts covering Organization and Personnel, Buildings and Facilities, Equipment, Control of Components and Containers/Closures, Production and Process Controls, Packaging and Labeling Control, Holding and Distribution, Laboratory Controls, Records and Reports, and Returned/Salvaged Drug Products.
• ICH Q7 — the harmonized GMP guideline specifically for active pharmaceutical ingredients, structured around quality management, personnel, buildings/facilities, process equipment, documentation, materials management, production, packaging, storage/distribution, laboratory controls, validation, change control, and complaints/recalls. ICH Q7 underlies EU GMP Part II.
• EU GMP — EudraLex Volume 4, Part I (finished medicinal products) and Part II (APIs, aligned to ICH Q7), plus product- and process-specific Annexes. Chapter 9 covers self-inspection specifically.
• PIC/S GMP Guide (PE 009) — the internationally harmonized guide used by Pharmaceutical Inspection Co-operation Scheme member authorities, closely aligned with EU GMP.

See CASRAI’s Good Manufacturing Practice (GMP) guide for what these requirements mean overall, and the GxP compliance guide for how GMP differs in scope from GLP and GCP.

The GMP audit checklist, section by section

1. Quality management system and quality unit

• Is there an independent quality unit (quality assurance and, where separated, quality control) with authority to approve or reject materials, in-process product, and finished product?
• Does the quality unit have real authority to halt a batch release, independent of production/operations management?
• Is there a documented quality manual or equivalent describing the site’s quality management system?
• Are quality risk management principles (e.g., ICH Q9-aligned) applied to decisions such as supplier approval, deviation classification, and change control?
• Is there a documented management review process that feeds quality metrics back to site leadership?

2. Personnel and training

• Are job descriptions, qualifications, and reporting lines documented for staff in production, quality, and maintenance roles?
• Is there a documented, GMP-specific training program, including initial and periodic refresher training?
• Are training records maintained per employee and verifiable against the tasks they actually perform (e.g., aseptic technique, equipment operation, documentation practices)?
• Is there evidence of training effectiveness checks, not just attendance records?

3. Facilities and equipment

• Do facility design and cleanliness classifications match the product type (see CASRAI’s cleanroom classifications guide for ISO 14644-1 grades where sterile/aseptic manufacturing applies)?
• Are there documented procedures for facility and equipment cleaning, with defined cleaning validation or verification for product-contact equipment?
• Is major equipment qualified (installation, operational, and performance qualification) and is that qualification documentation available?
• Is equipment on a documented preventive-maintenance and calibration schedule, with calibration traceable to a recognized standard?
• Are utilities that affect product quality — purified water, compressed air, HVAC — monitored and periodically requalified?

4. Materials management and incoming supplier control

• Is there a documented approved-supplier program for raw materials, components, and packaging, with its own qualification and periodic requalification process?
• Are incoming materials sampled, tested or verified, and quarantined until released by the quality unit?
• Does the facility verify a Certificate of Analysis (COA) against its own specifications rather than accepting it on face value alone? (See CASRAI’s Certificate of Analysis guide for what a COA should contain and when it isn’t sufficient by itself.)
• Are materials labeled, stored, and rotated (e.g., first-expired-first-out) to prevent mix-ups and use of expired or unreleased material?

5. Production and process controls

• Are manufacturing processes run against approved, version-controlled master batch records?
• Are critical process parameters and in-process controls defined, monitored, and documented for each batch?
• Is there a documented line-clearance procedure preventing cross-contamination or mix-ups between batches or products?
• Are process validation studies (or, for legacy processes, ongoing process verification) documented and current?

6. Laboratory controls and quality control testing

• Are test methods validated or verified for their intended use, with documented method validation or transfer records?
• Are reference standards and reagents traceable, labeled, and within expiry?
• Is there a documented out-of-specification (OOS) and out-of-trend investigation procedure?
• Are laboratory instruments qualified and calibrated on the same rigor as production equipment? (See CASRAI’s ISO/IEC 17025 guide if the site’s testing laboratory is separately accredited.)

7. Packaging, labeling, storage, and distribution

• Is there a documented labeling control procedure preventing label mix-ups (reconciliation counts, label issuance logs)?
• Are storage conditions (temperature, humidity, light) controlled, monitored, and mapped for the areas where product and materials are held?
• For temperature-sensitive product, is there a documented cold-chain or Good Distribution Practice (GDP) program? (See CASRAI’s pharma cold chain logistics guide for what a GDP-aligned program covers.)
• Are distribution records sufficient to support a rapid, complete recall if one becomes necessary?

8. Documentation practices and data integrity

• Are SOPs current, version-controlled, and periodically reviewed? (See CASRAI’s guide to writing a lab SOP for what a well-structured procedure looks like.)
• Are batch records — paper or electronic — complete, contemporaneous, and reviewed/approved before release? (See CASRAI’s Electronic Batch Record (EBR) entry.)
• Does the facility’s approach to data integrity reflect ALCOA+ principles — attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available? (See CASRAI’s ALCOA+ data integrity entry.)
• For computerized systems (LIMS, MES, EBR platforms), is there evidence of audit-trail review and restricted, role-based access?
• Are records retained for the period required by the applicable regulation or contract, and retrievable within a reasonable timeframe during inspection?

9. Deviations, complaints, recalls, and CAPA

• Is there a documented deviation-management procedure with defined severity classification?
• Is there a documented Corrective and Preventive Action (CAPA) system, and can the facility show CAPAs actually closed with effectiveness checks, not just opened? (See CASRAI’s CAPA entry.)
• Is there a documented complaint-handling and product-recall procedure, including mock recall exercises?
• How are nonconformances classified and dispositioned — does the facility distinguish major from minor findings consistently? (See CASRAI’s nonconformity guide for the NCR/NCAR process this typically runs through.)

10. Change control

• Is there a formal change-control procedure covering process, equipment, facility, and documentation changes?
• Are changes risk-assessed and, where warranted, revalidated before implementation?
• Is there evidence changes are communicated to affected functions (quality, regulatory, production) before going live?

11. Contract manufacturing and outsourced activities

• If the facility itself subcontracts any GMP-relevant activity (testing, packaging, storage), is there a documented quality or technical agreement defining each party’s responsibilities?
• Does the facility audit its own subcontractors on a documented schedule?

12. Self-inspection program

• Does the facility run its own internal GMP self-inspection program, covering all the sections above, on a defined schedule (EU GMP Chapter 9 and ICH Q7 both require this)?
• Are self-inspection findings documented, tracked to closure, and available for review during a supplier audit?
• Is there evidence self-inspection findings actually drive corrective action rather than being logged and left open?

GMP internal audit checklist vs. supplier audit checklist

The sections above apply whether the audit is external (a customer or sponsor auditing a supplier) or internal (a facility auditing itself). The difference is scope and framing, not content:

• A supplier/external GMP audit is scoped to what the auditing organization is actually purchasing or contracting for — a customer buying an API doesn’t need to audit the supplier’s unrelated product lines, but does need full visibility into the quality system governing the material or service in scope.
• A GMP internal audit (self-inspection) covers the facility’s own full quality system on a recurring schedule, independent of any single customer relationship, and is itself a GMP requirement rather than a customer-driven activity.

Both use the same checklist structure; an internal audit typically goes deeper into areas an external auditor wouldn’t have time or standing to review in a single visit (e.g., full document-control system architecture, IT/computerized-system validation records across every system, not just the ones touching the audited product).

How to structure the audit itself

1. Pre-audit preparation. Request the facility’s site master file, prior audit/inspection history (including any FDA Form 483 observations or equivalent), organizational chart, and a list of products or services in scope. Tier the audit’s depth to the supplier’s risk level — see CASRAI’s vendor qualification process guide for a risk-tiering framework that also determines audit frequency.
2. Opening meeting. Confirm scope, schedule, escorts, and any documentation the facility hasn’t yet provided.
3. Document review. Work through SOPs, batch records, training records, calibration/maintenance logs, deviation and CAPA logs, and self-inspection reports against the checklist sections above.
4. Facility walkthrough. Observe actual practice against the documented procedure — a common and material finding is a written SOP that isn’t what staff actually do on the floor.
5. Closing meeting. Present findings, classified by severity (critical/major/minor, or the facility’s equivalent scheme), and confirm the timeline for a written response.
6. Audit report and CAPA follow-up. Issue a written report; require the audited facility to respond with root cause and corrective/preventive actions for each finding, with a defined closure deadline. Track open findings through to verified closure rather than treating the report itself as the end of the process.

Building your own checklist template

There is no single official “GMP audit checklist PDF” issued by FDA, EMA, or ICH — auditors build their own working template from the regulatory structure above, scaled to the type of facility being audited (finished-drug manufacturer, API manufacturer, contract testing lab, packaging site). A practical way to build one:

• Use the twelve sections above as your template’s tabs or major headings.
• Convert each bullet into a yes/no/N/A question with a column for evidence reviewed and a column for findings.
• Add a severity/classification column so findings can be triaged consistently across audits and auditors.
• Keep a master version under change control, the same way you would any other controlled quality document — a checklist that drifts between audits makes year-over-year comparison unreliable.

Frequently asked questions

What is a GMP audit checklist used for?

It’s used to systematically assess whether a manufacturing, testing, or packaging facility has a functioning quality system that meets Good Manufacturing Practice requirements — typically before qualifying a new supplier, during periodic requalification of an existing one, or as part of a facility’s own internal self-inspection program.

Is there a standard GMP audit checklist template or PDF?

No single official template exists — FDA, EMA, and ICH publish the underlying requirements (21 CFR Part 211, ICH Q7, EU GMP), not a fill-in-the-blank checklist. Organizations build their own template from that regulatory structure, typically organized into the same sections used in this guide: quality management, personnel, facilities/equipment, materials, production, laboratory controls, documentation/data integrity, deviations/CAPA, change control, and self-inspection.

How is a GMP internal audit checklist different from a supplier audit checklist?

The content is the same; the scope differs. An internal audit (self-inspection) covers a facility’s full quality system on a recurring schedule and is itself a GMP requirement. A supplier audit is scoped to the specific product or service the auditing organization is purchasing, though it still needs full visibility into the quality system governing that scope.

How often should a GMP supplier be re-audited?

Frequency should be risk-based rather than fixed — higher-risk suppliers (e.g., sterile injectable manufacturers, sole-source critical-material suppliers) typically warrant more frequent on-site audits than lower-risk ones, where a documentation-only review between on-site visits may be appropriate. See CASRAI’s vendor qualification process guide for a risk-tiering approach that determines both audit depth and frequency.

What’s the difference between a GMP audit and a GMP inspection?

An audit is conducted by a customer, sponsor, or the facility itself (self-inspection); an inspection is conducted by a regulatory authority (FDA, an EU national competent authority, or another PIC/S member authority) with legal enforcement power, up to and including a Form 483, warning letter, or import alert in the US context.