Inspections take several forms. Routine inspections run on a risk-based cycle. Pre-authorisation inspections support a marketing authorisation application. For-cause inspections follow a specific trigger such as a recall, a complaint pattern or a whistleblower report. Any of them may be unannounced, which removes the preparation window entirely and leaves readiness as whatever state you were already in.
The structure is broadly predictable: an opening meeting, a facility tour, document review, interviews with the people who actually perform the work, and a closing meeting where deficiencies are presented. What varies is depth, and depth is driven by what the inspector finds early. An inspector who doubts your document control will look harder at everything downstream of it.
Deficiencies are classified as critical, major or other. The grading tracks patient risk and systemic weakness rather than word count. A single critical finding can suspend supply. A cluster of 'other' findings that together show the quality system cannot detect its own problems will often be escalated to a major on QMS effectiveness — which is why the pattern matters more than the individual items.
Most sites do not fail on compliance. They fail on demonstration: retrieval speed, inconsistent accounts of the same process across departments, and subject-matter experts who answer questions nobody asked. The underlying control is often sound and the site simply cannot show it at inspection pace.