GMP due diligence
A technical risk-screening framework for looking at somebody else's quality system — before an acquisition, a contract manufacturing agreement, or taking on a site. Seven areas, what to examine in each, and the signals that usually indicate something larger underneath.
GMP, quality and regulatory risk only. This is deliberately not commercial, financial or legal due diligence, and it does not substitute for either.
Screening, then depth where it matters
The purpose of a screen is to decide where to spend limited access. Work the seven areas in order, note which produce red flags, then go deep on those rather than sampling evenly across everything. In practice, remediation exposure and regulatory standing are where a technical review most often changes a commercial view.
Quality system
Establish whether the quality system functions as a connected system or as a set of separate procedures.
- Deviation and CAPA volumes, ageing and recurrence rates over at least twenty-four months
- Change control throughput and whether temporary changes have expiry
- Complaint trending and whether it feeds the product quality review
- Self-inspection plan against actual execution
- Management review records: decisions taken, funded and tracked
- Retraining appearing repeatedly as the corrective action for similar events
- Known gaps recorded in successive management reviews without being resourced
- Self-inspection consistently behind schedule
- Effectiveness checks written at closure rather than defined before implementation
- Deviation, CAPA and change registers with dates and status
- Two years of self-inspection plan and reports
- Management review minutes and action tracking
Regulatory standing
Establish the target's inspection history and whether any commitments remain open.
- Inspection history, dates, authorities and outcomes
- Observations received, their classification and closure evidence
- Open commitments from any inspection or client audit
- Manufacturing and importation authorisations, and their scope
- Entries in public registers such as EudraGMDP
- Repeat findings across consecutive inspections
- Commitments closed on paper without evidence attached
- A long interval since the last inspection combined with significant site change
- Authorisation scope that does not match what the site actually does
- Inspection reports and responses
- Current authorisations and GMP certificates
- Commitment tracker with closure evidence
Manufacturing and validation
Establish whether the validated position matches the site as it exists today.
- Validation master plan reconciled against the installed equipment list
- Qualification status of critical equipment and utilities
- Process validation approach and whether batch numbers were justified
- Continued process verification data and evidence it is interpreted
- Cleaning validation limits and whether they rest on health-based exposure limits
- Contamination control strategy where sterile operations are in scope
- A validation master plan listing equipment the site no longer has
- Cleaning limits carried forward from legacy convention with no HBEL rationale
- CPV data collected but never producing an action
- A contamination control strategy that is an index of existing SOPs
- Validation master plan and equipment list
- Qualification packages for critical systems
- Cleaning validation rationale and HBEL assessments
Data integrity
Establish whether the records supporting every other conclusion can be relied upon.
- Completeness of the computerised system inventory, including spreadsheets
- Audit trail configuration and evidence of review
- Access control, individual accounts and leaver removal
- Hybrid paper and electronic arrangements and which record is definitive
- Any historical data integrity investigation and its scope
- Shared or generic logins for GMP-relevant actions
- Audit trails enabled with no named reviewer or review record
- Unvalidated spreadsheets performing GMP calculations
- A previous data integrity issue closed with a narrow scope
- System inventory and validation status
- Audit trail review records
- User access lists and privilege matrices
Supplier and CMO quality
Establish dependencies that survive the transaction and the qualification position behind them.
- Critical supplier and CMO list, with tiering rationale
- Qualification currency and re-qualification schedule
- Quality agreements, including change-notification clauses
- Supplier audit history and finding closure
- Single-source dependencies and whether alternatives are qualified
- Re-qualification dates passed with no owner
- Quality agreements missing change-notification obligations
- Critical materials from a single unaudited source
- Questionnaires on file with no recorded assessment
- Supplier list with qualification status and dates
- Quality agreements for critical suppliers
- Supplier audit reports and CAPA closure
Quality organisation and capability
Establish whether the capability to run the quality system survives the transaction.
- QA and QC headcount against the workload the system generates
- Qualified Person arrangements, including deputies
- Where specialist capability is concentrated in individuals
- Training programme and whether it evidences competence or attendance
- Retention risk in quality-critical roles
- A single QP with no trained deputy
- One person holding validation, data integrity and audit capability
- Quality reporting into a function whose objectives conflict with it
- Training records evidencing attendance only
- Organisation charts and job descriptions
- QP arrangements and delegation
- Training matrix and records
Remediation exposure
Establish what the acquirer would have to fund, and on whose timetable.
- Open CAPA backlog by age and exposure
- Validation and qualification backlog
- Outstanding inspection commitments and their deadlines
- Known quality-system weaknesses recorded but unresourced
- Capital deferred on GMP-critical equipment or facilities
- A backlog worked by ease rather than by exposure
- Remediation commitments with external deadlines inside the transaction window
- Deferred capital on equipment whose qualification status has drifted
- Open action registers with ageing
- Remediation plans and their funding status
- Capital plan for GMP-critical assets
What a screen should produce
The useful output is a short ranked list of areas with the reasoning attached: which carry material exposure, which are manageable, and which could not be assessed with the access available. Naming what you could not examine matters as much as what you did — an area marked unassessed is honest, whereas one marked low risk on thin evidence is not.
Ranked areas
By exposure, with the evidence that drove the ranking.
Remediation estimate
What closing the gaps would take, in scope and sequence.
Unassessed areas
Named explicitly, with what access would be needed.
What this framework is not
This is a GMP and quality risk-screening framework, intended to structure a technical review. It is not legal, financial, tax or investment advice, it is not a valuation input on its own, and it does not substitute for qualified professional advice or for a formal audit conducted under appropriate access and confidentiality arrangements.
Screen your own site the same way
The same areas apply internally. The GMP Health Index scores seven quality-system domains and names your priority areas, which is a reasonable starting position before anyone looks at you.