Good Manufacturing Practices (GMP) and Quality Assurance (QA)

Overview of GMP and Quality Assurance

QA (Quality Assurance) is a wide range concept that covers all the matters that individually or collectively influence the quality of the products.

GMP is also known as CGMP which means current good manufacturing practice. It is one of the parts of QA, which refers to a set of guidelines to control every aspect of pharmaceutical production. Pharmaceutical GMP guidelines are enforced by the regulatory body which ensures drug products are fit for their intended use, comply with the requirements of the marketing authorization and do not place any harm to the end user. The first WHO draft text on GMP was prepared in 1967 by a group of consultants at the request of the twentieth World Health Assembly. GMP includes hygiene, validation, self-inspection, personnel, premises, equipment, materials and documentation.

The Relationship between QA, GMP, and QC

QA, GMP and QC work hand in hand to maintain the quality of the pharmaceutical products as per mentioned by the regulatory bodies. Quality management in pharmaceuticals is the responsibility of all personnel. The basic elements of quality management are an appropriate infrastructure or quality system encompassing the organizational structure, procedures, process, resources and the systematic actions that are necessary to ensure that a product will satisfy given requirements for quality. The totality of these actions is termed as Quality Assurance.

The hierarchical graph of Quality management is as follows:

The relation between QA and QC is crucial for maintaining product quality. QA establishes the standards, procedures, protocols and specification during manufacturing, testing, and quality control activities whereas QC verifies the compliance of the products following the specifications and standards. QA provides guidance, instructions and protocols to every department of the pharmaceutical industry. The regular feedback and information exchanges between the departments help to identify the areas of improvements, quality issues and effectiveness. The importances of QA and QC personnel for the implementation of GMP are:

• Trained and Qualified personnel

QA and QC and production personnel who are involved in the process should receive training and education on GMP principles, quality control and documentation practices. The topics such as SOPs, risk assessment, change control and validation protocols should be covered. Ongoing training programs help to ensure product quality. Trained and qualified personnel help in maintenance of GMP.

• Implementation of documented procedures and standard operating practices

QA, QC and Production activities should be well documented. The documented record should be reviewed regularly, reproduced and communicated to minimize errors and deviations.

• Following testing and sampling Protocols

QC personnel should perform sampling and testing as per specification and protocols that are documented by QA. These protocols should be based on recognized standards and validated methods to ensure accurate and reliable results.

• Risk Assessment and Management

Both QA and QC should incorporate risk assessment and management strategies to identify and minimize potential risk throughout the industrial process.

• Ensuring Product Safety and Efficacy

Both QA and QC processes are important for ensuring product safety, potency and efficacy. By conducting testing, inspection and documentation the quality standard of the product and determine if it is safe for use and protects the patient’s health and well-being. It prevents the potential harm and adverse effects related to the products.

• Building Customer Trust and Satisfaction

Consistency in product is maintained by both QA and QC and provides confidence in the reliability of the product and leads to increased trust and loyalty.

• Minimizing Risks and Costly Recalls

Effective QA and QC processes help to minimize the risks of product defects, recalls and potential errors. By implementing the preventive measures, conducting testing and inspections before the quality issues escalate.

• Promoting Continuous Improvement and Innovation

Through various activities of QA and QC, the areas of improvements, optimum manufacturing processes and enhancement of quality can be identified. The culture of communication between the departments of the pharmaceutical industry can improve and innovate production, helping it to be a part of a competitive and evolving industry.

Global Regulatory Standards (FDA, EMA, TGA, Health Canada)

There are different regulatory bodies for different countries that enforce GMP regulations and some of them are:

FDA

The Food and Drug Administration (FDA) focuses on safety and quality of pharmaceuticals, dietary supplements and certain food products. FDA regulates documentation of manufacturing processes, rigorous quality control and testing procedures, validation of equipment and processes, adherence to hygiene and cleanliness standards.

European Medicines Agency (EMA)

They enforce the European Union GMP practices. These regulations are based on the principle of a comprehensive quality management system, risk-based approaches to pharmaceutical quality, validation of computerized systems and a focus on minimizing cross-contamination in manufacturing.

Therapeutic Goods Administration (TGA)

TGA is the regulatory body of the Australian government that is authorized for medical products, including biologics. Australian TGA regulates GMP compliance for pharmaceuticals, medical devices, and therapeutic goods. TGA GMP includes a risk-based approach to manufacturing controls, compliance with international standards, emphasis on process validation and stability testing and continuous improvement through post-market monitoring.

Health Canada

They are responsible for the regulation of drugs and medical devices in Canada and are based on FDA regulations. Health Canada’s regulations for drugs and medical devices are among the strictest in the world that protects Canadians from unsafe and ineffective products. They apply the stringent product testing, maintenance of detailed record, a strong emphasis on quality assurance and regular inspections of manufacturing facilities.

The 10 Golden Rules of GMP

The golden rules of GMP includes the process from the beginning of industrial development to regular internal and external quality check of products by sticking with regulatory compliances for the maintenance of quality in the product. The ten rules are:

• Get the facility design right from the start: A well designed facility prevents contamination, mix-ups and errors.
• Validate Processes: The documented evidence that the process, procedure produces the same results consistently.
• Write good procedures and follow them: GMP documentation makes procedures easy to follow.
• Identify who does what: Making organograms, job descriptions and responsibilities with the team members will clear reporting structures and drops confusion.
• Keep good records: Good documentation practice must be followed to achieve a pharmaceutical quality system. When everything is documented properly, it will be easy to trace what happened and where.
• Train and develop staff: Updating staffs on regular basis leads to fewer defects and lead to an increase in job satisfaction.
• Practice good hygiene: Personnel hygiene and cleanliness of facilities are critical to product quality, safety and efficacy.
• Maintain facilities and equipment: Regular maintenance ensures consistent performance and avoid contamination.
• Build quality into the whole product lifecycle: Quality in the entire product lifecycle can prevent from future potential problems.
• Perform regular audits: Checking regularly by performing internal GMP audits at intervals can significantly improve the GMP compliance level by detecting the place of improvement.

Documentation and Data Integrity (ALCOA+)

Documentation is the systematic process of preparing, reviewing, approving, issuing and storing records that ensures regulatory compliance of Good Manufacturing Practice and Good Documentation Practice. Documentation is the physical proof that acts as a backbone of manufacturing, quality control, and consistency in product, traceability of errors and evidence of action taken to eliminate errors. The purposes of documentation are:

• To define the specifications and procedures for all materials and methods of manufacture and control.
• To ensure that all personnel concerned with manufacture know what to do and when to do.
• To ensure that authorized persons have all the information necessary to decide whether or not to release a batch of a medicine for sale.
• To ensure the existence of documented evidence, traceability, and to provide records and an audit trial that will permit investigation.
• To ensure the availability of the data needed for validation, review and statistical analysis.

The documents should have unambiguous contents: title, nature and purpose should be clearly stated. The general principles of documentation are:

• Control of Document: Documents should be regularly reviewed and kept up to date. The superseded document of revised document should be retained for a specific period of time but the use of superseded version should be prevented.
• Data Entry: The entry of data should be clear, legible and indelible. All the entries should be dated on the date of entry and signed or initiated by the person entering the data.
• Data Alteration: The alteration should be signed and dated and done in such a way as to permit the reading of the original information. The reason for alteration should be recorded and mentioned.
• Records: Record of manufacturing batch from the starting to the final stage should be documented. The records should be retained for at least one year after the expiry date of the finished product.

The different documentation are Labels to the different stages of product, Specifications, Master Formula,  Batch Processing Records, Batch Packaging Records, Standard Operating Procedure, Site Master File, Distribution Records, etc.

Data Integrity refers to maintaining the accuracy, completeness, and consistency of information throughout the lifecycle. It helps to assure quality, safety and efficacy of the product to the patient. Additionally, data integrity ensures accurate evaluation of how well a product works, helps prevent adverse drug reactions and provides authentic information. The principle of data integrity is ACLOA, but it was extended to ACLOA +.

• Attributable

Attributability is measured by checking how much of the data is correctly linked to the person who and when it is collected. 

• Legible

Legible means that records that are documented must be clear and readable. The buzzwords or informal terms that may change over time and create confusion should be avoided.

• Contemporaneous

Data must be recorded at the same time the activity occurs. Any data collection should have a time and date of record or amendment. Delay documentation can lead to errors, inaccuracies, and compromised data quality.

• Original

Original data is the primary data or the first record of data. It must be preserved to authenticate the copies.

• Accurate

Data accuracy is assessed through range checks and outlier detection. The data should be within limit and must be correct, error-free and maintain the quality of the data.

• Complete

A data which is complete means all the data related to an activity are recorded, including any repeat tests, errors, corrections, and deviations. It prevents data manipulation.

• Consistent

The data should be chronologically arranged and follow standardized procedures and formats. Consistency is marked by checking the start dates and the end dates. Consistency is maintained by regular audits. It maintains process clarity, accuracy and reliability.

• Enduring

Data is preserved for future use so the material used to record the data should be permanent, durable, and preserved for the required retention time. It ensures long-term reliability.

• Available

Data should be easily accessible for review, verification, and regulatory inspection whenever required. Data backup is the good way to make the data available. It supports audits and inspections.

Personnel Hygiene

Personnel hygiene is said to be maintained in every stage of pharmaceutical processing. All personnel, prior to and during employment should undergo health examinations such as eye examination, health checkups and daily sanitization. A high level of personal hygiene should be observed by all those concerned with the manufacturing process. 

• Washing hands and using sanitizer should be done before entering production areas and any sensitive area and after exiting the same areas.
• Wearing clean body coverings and hair covering appropriate to their duties.
• Do not touch the products/ objects that may come in contact with the product with unprotected hands. Wear gloves when working on open products.
• Keep hands groomed with short and clean nails. Hands must be free from lesions, wounds, cuts, boils, or any other sources of infections.
• Prohibition to use rings, earrings, makeups etc.
• Follow of Standard operation procedure.

Training

Training should be provided in accordance with a written, approved program for all personnel whose duties take them into production areas or control laboratories or other activities that can affect the quality of the product including technical, maintenance and cleaning personnel. Basic GMP related training on the concept of QA shall be provided. Newly recruited personnel shall receive training appropriate to the duties they are assigned. Continuous training related to practical effectiveness shall be given and the training record shall be kept. Personnel working in areas where contamination is a hazard shall be given special training.

Premises, Equipment, and Utilities

The premises mean all the buildings where manufacture of the products will take place. Premises must be located, designed, constructed, adapted and maintained to suit the operations to be carried out. The layout and design of premises should aim to avoid any adverse effect on the quality of products, cross-contamination, minimize the risk of errors, permit effective cleaning and maintenance. Premises should separate out the materials and people flow. Premises are divided into five different specific areas:

• Ancillary Areas

They are the black area which is also known as rest and refreshment rooms which are separated from production and quality control areas. Ancillary areas include toilet, change room, cloth storage and washing area. These areas have separate air handling and entrance and air locks. 

• Storage Areas

Storage areas are designed to ensure good storage conditions according to the need of the product. Separate storage areas are for separate materials such as starting materials, packaging materials, intermediate, bulk, finished, quarantined, released, rejected, returned and recalled products and materials and those areas and materials stored in those areas are labeled properly. The storage area can be accessed only by authorized personnel. The receiving and dispatch area is also separated from other areas using the insect catcher, air flow and separate compartment.

• Weighing Areas

Weighing area is also known as dispensing area. These areas should be smooth, impervious, durable, and easy to clean. All the record and cleaning procedures should be documented as per SOP in logs and records. Weighing is done inside the dispensing booth of class 100.

• Production Areas

Different production areas and separate facilities for different products such as antibiotics, penicillin and non-penicillin, hormones, cytotoxic substances, injections, solid, liquid and semisolid dosage forms are used. Design of pipework, light fittings, ventilation points and other services shall have access to clean. Premises for the packaging of pharmaceutical products should be specifically designed and laid out so as to avoid mix ups, contamination or cross-contamination.

• Quality Control Areas

QC laboratories should be separate from production areas as well as the microbiology section of QC with separate air handling units. Suitable design with sufficient space to avoid mix-ups and cross-contamination should be there. 

Equipment that is used in the pharmaceutical industry must be located, designed, constructed, adapted and maintained to suit the operations to be carried out. The layout and design of the equipment must aim to minimize the risk of errors and permit effective cleaning and maintenance in order to avoid cross-contamination, build-up of dust or dirt and any adverse effect of the quality of products.  Balances, other measuring equipment and machineries used should be verified and calibrated on a scheduled basis. In production the equipment that has been used should be cleaned properly and cleaning efficacy is checked before use for another cycle. Washing, cleaning and drying equipment should be chosen and used to prevent contamination. Defective equipment should be removed immediately to prevent errors. Equipment that are used in product contact must be made up of stainless-steel grade 316 or 316L and SS grade 304 in non-contact. They should be non-reactive, non-additive and non-absorptive. Equipment used must be calibrated according to a fixed schedule and recorded. All the equipment installed should be clearly labeled and contents and direction of flow must be indicated. For example, water lines, air handling systems, etc. Utilities such as HVAC, RO water pipes and compressed air should also be validated every year to maintain its efficacy.

Validation and Qualification

WHO defines validation as “an action of proving and documenting that any process, procedure or method actually and consistently leads to the expected results”. Whereas WHO defines qualification as “an action of proving and documenting that any premises, systems and equipment are properly installed, and/or work correctly and lead to the expected results”. Qualification should be completed before processing validation, in the sense qualification is the initial stage of validation. The process of qualification is a logical, systematic process which starts from the design phase of the premises, equipment, utilities and equipment used in production and quality control. All the systems used in pharmaceutical quality control and assurance should be qualified first before qualification of equipment. Systems such as water purification, air- handling, compressed air, etc. are qualified.

Stages of Qualifications are:

Installation Qualification (IQ)

Design qualification is the documented evidence to prove that premises, supporting utilities and equipment have been designed in accordance with the GMP and will satisfy all the requirements that are defined and detailed in the User Requirements Specification (URS).

Installation Qualification (IQ)

Installation qualification is the documented evidence to prove that the installation (such as machines, premises, supporting utilities used in the manufacturing process have been built and installed in accordance with their design specification. All the purchase specifications, drawing, manuals, spare parts lists and vendor details should be verified during this process.\

Operational Qualification (OQ)

It is the documented verification to prove that the system or subsystem such as utilities, systems or equipment performs as intended over all anticipated operating ranges in accordance with operational specifications.

Performance Qualification (PQ)

It is the documented evidence to prove that the utilities, system or equipment operates consistently and gives reproducibility within defined specifications and parameters for prolonged periods. Data over a period of time is documented to prove the consistency of desired results.

Quality Risk Management (ICH Q9)

Quality risks are the main concern of development of quality products. To alleviate the quality, safety and effectiveness of products quality risk management should be implemented. Quality risk management is a systematic process for assessment, control, communication, and review of risks to the quality of the drug product across the product life cycle. It should be linked to protect the patient’s health by providing high quality medicinal products, provide regulators with greater assurance of the company’s ability to deal with potential risks and can beneficially affect the extent and level of direct regulatory oversight.

• Risk assessment

The risk is identified in this step. A quantitative potential harm associated with the risks is calculated using a “risk score” or “risk product number (RPN)”.

 RPN= Severity x Probability x Detectability

Where, Severity measures possible consequences of hazard.

Probability measures frequency or likelihood of occurrence of the hazard.

 Detectability measures ability to discover or determine the presence or fact of the hazard. 

It gives the answers of the following questions

• What might go wrong?
• What is the probability it will go wrong?
• What are the consequences (severity)?

Risk identification

Information to identify hazards is used in a systematic way referring to the risk question or problem description. It addresses “What might go wrong?” question, identifying the possible consequences.

Risk Analysis

Risk Analysis is qualitative or quantitative process of linking the likelihood of occurrence and severity of harms. In some risk management tools, the ability to detect the harm (detectability) also factors in the estimation of risk.

Risk evaluation

Identified risks are compared and analyzed against given risk criteria. After the risk area is identified, the subject matter expert evaluates each risk area and lists corresponding failure modes and associated failure effects for each risk area. The score for probability, severity and detectability were assigned using scoring criteria. They are then ranked either as low, medium or high risk using the RPN value.

• Risk control

The purpose of this step is to reduce the risk to an acceptable level. It focuses on questions related to risk acceptance and reduction significance in outcome. 

Risk reduction

If the risk factor exceeds a specified level then the QRM focuses on mitigation of quality risk. The outcome of elimination of risk is checked; either it arouses new risk or increases the significance of other existing risks. The significance of risk is reassessed. 

Risk acceptance

If the risk is under acceptable level then QRM practices might not be entirely eliminated. 

In many cases, mitigating larger RPN issues also results in a decrease in the calculated RPN for areas with lower identified risks. For the implementation of mitigation the RPN values should be re-calculated to ensure reduction of projected risks.

• Risk communication

Communication between the decision makers and other stakeholders about the risk is important and the well documentation of the plan should be done.

• Risk Review

The outcome/ results of the risk management process should be reviewed to take into account new knowledge and experience. It might include reconsideration in risk acceptance or risk reduction based upon the frequency of level of risk.

Handling Deviations and CAPA

Deviation is defined as a deflection of results from approved procedures, process or specifications that impacts on product quality, safety and efficacy. Deviation occurs in any stage of pharmaceutical product development such as manufacturing, packaging, labeling, testing, storage or any part of the product lifecycle. Deviations are categorized into two types:

• Planned Deviation

These are the deviations which are pre-approved and documented before it is executed. These are the temporary changes for the fulfillment of temporary requirements. For example batch size modification for a period of time due to equipment constraint or raw material limitation. 

• Unplanned Deviation

These deviations occur unexpectedly and are not approved in advance. These deviations require immediate investigation to prevent the product quality deterioration. For example malfunction of a tablet compression machine.

Deviation might be minor or major. According to the deviation frequency, deviation handling procedures must be implemented. Deviation management is important to maintain product quality and consistently, achieve improvement, prevent recurrence of issues and to stick in compliance with regulatory bodies.

The steps that are followed to handle deviation are:

• Deviation Reporting

Deviation must be reported immediately by the employee to track deviation and its severity. Training must be given to all employees to report deviation.

• Impact Assessment

All the main bodies of the pharmaceutical industry such as QA, Production, QC and engineering department must evaluate the impact of deviation on product quality, integrity and regulatory compliance.

• Root cause Analysis

The root cause of deviation is essential to determine. Thoroughly investigation for the cause of deviation is needed. There are different ways of analysis for the root cause and they are fishbone diagram, fault tree analysis and pareto chart analysis.

• Implementation

On the basis of root cause analysis, corrective and preventive actions (CAPA) are implemented to correct and prevent the current issue and its recurrence.

• Effectiveness Check

After the implementation of CAPA, a follow up should be taken to confirm the effectiveness of action taken. 

• Documentation

Documentation is an important step in pharmaceutical deviation to address whenever required. Each deviation report should include deviation reference number, detailed event description, impact analysis, root cause analysis summary, CAPA plan, approval and closure date. 

For any major or critical deviation, handling root cause investigation is a major process. Investigation of root cause provides evidence to implement correct and possible preventive action. CAPA are the corrective and preventive action done for the confirmed complaints/ non confirmative, internal or quality audits, out-of-specification and management reviews approved by QA and are documented actions that confirm the deviation closure. Corrective action is an action taken to eliminate the cause of the deviation, based on investigation. Corrective actions should prevent recurrence of the deviation and preventive action is an action to eliminate the cause of a potential nonconformity. CAPA are for regulatory compliances, continuous improvement, accountability and engagement, customer satisfaction, for strong business practice and rectification.

Conclusion

Quality is achieved by maintaining high intentions, efforts, execution and sustain direction. The product is said to be quality, safe and efficacious drugs when effective implementation of QA (QRM, PQR), QC AND GMP norms are done. QA ensures that the guidelines and protocol of GMP, GDP and GLP are properly implemented and maintained together with QC and production. 

The comprehensive quality management system helps to ensure pharmaceutical products meet regulatory standards and protect patient safety. Regulatory authorities such as the FDA, EMA, TGA, and Health Canada enforce GMP compliance through proper documentation, personnel training, validation processes and risk management strategies. Besides these regulatory bodies ISO, WHO and ICH employ the Principle of quality management.

In pharmaceuticals ACLOA+ principles are critical for maintaining GMP compliance and ensuring drug quality and safety. It helps regulatory authorities to confirm that pharmaceutical products are manufactured and tested for the quality standards. By employing all the aspects of quality management pharmaceutical industry will be able to satisfy customers and regulatory bodies.

References

1. Choudhary, A. (2024, May 2). ALCOA to ALCOA Plus for Data Integrity: Pharmaceutical Guidelines. Www.pharmaguideline.com.
2. Compliance Quest. (2023, November 24). QA and QC in Pharmaceutical Industry. ComplianceQuest QHSE Solutions. https://www.compliancequest.com/bloglet/quality-assurance-in-pharmaceutical-industry/
3. Deviation Control in Pharmaceuticals. Pharmaguideline.com. https://www.pharmaguideline.com/2011/01/deviation-control.html#gsc.tab=0
4. Deviation Handling and Quality Risk Management A note for guidance for the manufacture of prequalified vaccines for supply to United Nations agencies. (2013). https://dcvmn.org/wp-content/uploads/2016/03/who_guidance_deviation_and_risk_mgt_2013.pdf https://www.pharmaguideline.com/2018/12/alcoa-to-alcoa-plus-for-data-integrity.html
5. Laurent, A. (n.d.). Good Manufacturing Practice (GMP): Pharma Quality Assurance Guide. Retrieved March 13, 2026, from https://intuitionlabs.ai/pdfs/good-manufacturing-practice-gmp-pharma-quality-assurance-guide.pdf
6. Patel, K. T., & Chotai, N. P. (2011). Documentation and Records: Harmonized GMP Requirements. Journal of Young Pharmacists, 3(2), 138–150. https://doi.org/10.4103/0975-1483.80303
7. Vinod. (2023, September 24). GMP Regulations in Different Countries | Comprehensive Overview. GxP Cellators Consultants Ltd. https://www.gxpcellators.com/gmp-regulations-in-different-countries-comprehensive-overview/
8. Welcome To Zscaler Directory Authentication. (2025). Gmpsop.com. https://www.gmpsop.com/validation-guideline-for-facility-and-utility/
9. WHO. (2013). Annex 2 WHO guidelines on quality risk management. https://www.who.int/docs/default-source/medicines/norms-and-standards/guidelines/production/trs981-annex2-who-quality-risk-management.pdf
10. WHO. (2014). Annex 3 good manufacturing practices: Guidelines on validation background. https://www.who.int/docs/default-source/medicines/norms-and-standards/guidelines/production/trs1019-annex3-gmp-validation.pdf