25.12 — GMP and the Factory Floor

A batch of tablets has been made. It sits in quarantine. Every physical thing about it is finished — the powder was blended, the tablets were pressed and coated, they are in drums with labels on them.

Nobody may sell a single tablet until a named person reads the paperwork and signs. If a signature is missing from step 14, the batch cannot be released. If a balance used to weigh an ingredient was outside its calibration date, the batch cannot be released. If a laboratory result came out at the edge of specification and the investigation into why is still open, the batch cannot be released.

That is Good Manufacturing Practice in one paragraph: the product is not the tablets, it is the tablets plus the proof. Once you accept that sentence, every rule in this chapter becomes obvious rather than arbitrary, and so does every system requirement your clients will hand you.

What GMP actually requires

In the United States, GMP for medicines lives in 21 CFR Parts 210 and 211. Europe has its own GMP guide with a set of annexes for special topics. The World Health Organization publishes a version used widely in other countries. They differ in detail and agree on the substance.

The substance is this. There must be enough qualified people, and their training must be documented. Buildings and equipment must be suitable for what they are used for, and cleanable. Every material coming in must be tested or verified before use. Every process must follow a written, approved procedure. Everything done must be recorded as it is done. Quality control must be independent of production. And there must be a system for finding, investigating and fixing problems.

Two structural points are worth pulling out because they shape organisations.

Quality is independent, always. The quality unit does not report to the head of manufacturing, because the two have opposing pressures — one is measured on output, the other on whether the output was correct. In Europe this is embodied in a named individual, the Qualified Person, who personally certifies each batch and is personally accountable for it.

And the person doing the work records it, at the time. Not the supervisor afterwards, not at the end of the shift from memory. Chapter 25.20 turns this into the formal rule with a name — contemporaneous recording — and it is the requirement most often broken and most often cited by inspectors.

The batch record: the spine of everything

Every batch is made against a document that starts as a blank template and ends as the legal history of that batch.

The master batch record is the approved template: the formula, every step in order, every parameter with its limits, every check, and every place a signature is needed. The batch record for a specific batch is a copy of that template filled in as the batch is made.

What ends up inside it: the identity and lot number of every raw material used; the actual weights; the equipment used and its cleaning and calibration status; the actual value of every parameter — mixing time, temperature, compression force; every in-process test result; the yield at each stage compared with the expected range; every deviation and its investigation; the labelling and packaging records; and signatures for who performed and who checked each step.

The paper version of this can run to several hundred pages per batch, and someone has to review every page before release. This is why electronic batch records exist, and why the manufacturing execution system of Chapter 25.11 is a serious investment rather than a convenience: it enforces the order of steps, blocks out-of-range entries at the moment of entry, records identity automatically, and makes review by exception possible — a reviewer looks at what went wrong instead of reading three hundred pages of things that went right.

A yield outside its expected range is a required investigation, not a curiosity. If you expected 98,000 tablets and got 91,000, the missing tablets are either a real loss with a real cause or a counting error — and either way, unexplained missing product is exactly what a diverted batch looks like.

The quality control laboratory

**Testing happens on incoming materials, during the process, and on the finished product. The finished-product tests for a tablet typically include identity, assay — how much active ingredient — content uniformity across individual tablets, dissolution rate, impurities and degradation products, water content, and microbiological limits. An injectable adds sterility and bacterial endotoxin testing, endotoxins being fragments of bacterial cell walls that cause fever even when the bacteria themselves are dead.

Every one of these methods must itself be validated: shown to be specific, accurate, precise, linear across the relevant range, and robust to small variations in how it is run. A result is only as trustworthy as the method that produced it, and "the method was never validated for this product" is a complete demolition of a data set.

Then there is the situation that produces more regulatory drama than any other in a QC laboratory: the out-of-specification result.

A sample fails. The obvious human reaction is that the test went wrong, so test it again until it passes. That practice — testing into compliance — was the subject of a landmark 1993 American court judgement involving the manufacturer Barr Laboratories, and the rules that came out of it still govern.

The rule is that you may not discard a failing result without evidence. The investigation runs in two phases. First, a laboratory investigation: was there an identifiable analytical error — wrong dilution, faulty instrument, expired reagent? Only a documented, specific error justifies invalidating the result. Second, if no laboratory cause is found, the failure is treated as real and the investigation moves to manufacturing: was the batch itself defective? Retesting is allowed only under a pre-approved plan with a pre-defined number of tests and a pre-defined decision rule, never by repeating until the answer is convenient.

This one topic generates a large amount of workflow software, and the reason is that the sequence, the timing and the approvals all have to be provable.

Qualification and validation, in the order they happen

Before a process can be validated, the things it runs on must be qualified. The vocabulary is used constantly and is easy to keep straight once you see the sequence.

Design qualification — the design of the equipment or facility is appropriate for its purpose, documented before it is bought or built.

Installation qualification, IQ — it was installed correctly: right model, right utilities connected, right documentation and spare parts, calibration certificates present.

Operational qualification, OQ — it works across its whole operating range, including its alarms and its limits, tested deliberately at the edges.

Performance qualification, PQ — it works for your specific product, under real production conditions, reproducibly.

Then the process validation of Chapter 25.11 sits on top of qualified equipment in a qualified facility.

Two further validations exist independently and neither is optional.

Cleaning validation proves that the cleaning procedure between products removes residue to below a level justified by toxicology. In a multi-product facility this is what stands between one patient's medicine and traces of somebody else's, and it is why dedicated equipment is required for a few especially hazardous product classes.

Utility qualification covers the things everyone forgets: the purified water and water-for-injection systems, the clean steam, and the heating and ventilation systems that create the air quality grades in cleanrooms. Water systems are a favourite inspection target, because a biofilm in a water loop can contaminate everything made with it.

Keeping watch while production runs

A GMP facility runs continuous monitoring programmes, and each generates data somebody must review, trend and act on.

Environmental monitoring samples air, surfaces and personnel for microbial contamination on a defined schedule at defined locations, with alert levels and action levels — the alert level meaning "something is drifting", the action level meaning "stop and investigate".

Utility monitoring tracks water quality, air pressure differences between rooms, temperature and humidity.

And the annual product review, called the product quality review in Europe, pulls a year of data for each product together — batches made, deviations, out-of-specification results, complaints, returns, stability results, changes — and asks whether the process is still in control and whether specifications remain appropriate. It is a genuinely useful exercise disguised as a compliance obligation, and it is an obvious target for automation, since almost all of the inputs already exist in systems.

Stability: proving it lasts

Stability testing determines shelf life, and it is covered mechanically in Chapter 24.9, so only the industrial machinery is needed here.

Batches are placed in chambers held at defined temperature and humidity, and tested at intervals across several years, under conditions defined by the ICH stability guideline. Three kinds of study run in parallel and are easy to confuse. Registration stability supports the shelf life claimed in the application. Ongoing stability puts at least one commercial batch per product per year into the chambers to confirm nothing has drifted. And study-specific stability supports the material used in clinical trials, where the expiry date on a trial kit may be extended as new data arrives — which is a systems problem, because kits already at sites carry printed dates that must be reconciled with the current approved shelf life.

From the loading dock to the pharmacy

A finished, released batch still has to reach patients without being damaged, stolen, or replaced with something counterfeit.

Good Distribution Practice governs storage and transport: temperature control, security, qualification of the vehicles and the shipping containers, and what to do when a shipment records a temperature excursion. The answer to an excursion is not automatic rejection — it is an assessment against the stability data, which is precisely why that data exists.

Cold chain products make this hard. Many biologics require 2 to 8 degrees Celsius throughout; some cell and gene therapies require deep frozen conditions in liquid nitrogen vapour. Each shipment carries data loggers, and every excursion must be evaluated before the product may be used.

And counterfeiting is the reason the supply chain is now serialised. In the United States, the Drug Supply Chain Security Act requires unit-level traceability, with each saleable package carrying a unique serial number and trading partners exchanging electronic transaction records. The phased enforcement completed recently: manufacturers and repackagers from 27 May 2025, wholesale distributors from 27 August 2025, and large dispensers from 27 November 2025, with the smallest dispensers — those with 25 or fewer full-time staff — required to comply by 27 November 2026. The exchange format in practice is EPCIS, an electronic standard for product event data, and paper or PDF handoffs are no longer acceptable.

This is one of the largest ongoing integration programmes in the industry, and it is exactly the kind of work a services company is hired for: high volume, standards-driven, with a regulator's deadline attached.

When something goes wrong after release

Two mechanisms matter and they are frequently confused.

A recall removes product already distributed. The American classification is by the harm the defect could cause: Class I where there is a reasonable probability of serious harm or death, Class II where harm is temporary or reversible, Class III where the defect is unlikely to cause harm — a labelling error that does not affect safety, for example. Recalls are usually initiated by the company rather than ordered by the agency, and doing so promptly and completely is heavily weighted when regulators judge a firm's behaviour afterwards.

A market withdrawal or a supply interruption is not a recall. A shortage is often the direct result of a quality problem at a single plant, because for many older, cheap, injectable medicines there are only one or two manufacturers in the world. This is one of the genuinely unsolved structural problems of the industry, and it is worth understanding: the medicines most likely to run out are not the expensive new ones but the essential old ones nobody makes much money from.

The systems, and what makes them different

A manufacturing site's software estate is layered, and each layer has a different regulatory weight.

Layer	Typical system	Why it is regulated
Equipment control	Automation, sensors	Sets the process parameters
Execution	MES, batch records	Is the batch record
Laboratory	LIMS, instrument data	Produces release results
Quality	Deviations, CAPA, change	Holds the investigations
Planning	ERP, warehouse	Controls lots and status
Serialisation	Track and trace	Legal supply chain record

The one thing that distinguishes all of these from ordinary industrial software is the requirement to reconstruct. Years later, someone must be able to ask: who made batch X, on which equipment, with which materials, at what parameters, who reviewed it, what went wrong, what was decided, and who released it — and get a complete, attributable, unaltered answer. Build that requirement in at the start and the validation of Chapter 25.21 is straightforward. Bolt it on afterwards and it is a rewrite.

Next: Chapter 25.13, the FDA — where it came from, how it is organised, and what actually happens inside an approval decision.