An inspector's guide to audit and inspection readiness in GxP

They want to see that your quality system runs the same way when no one is watching as it does the day they walk in. The signals come from the speed of your document flow, the calm of your personnel, the alignment between what your standard operating procedures say and what your operators actually do, and the integrity of the data you produce every day.

Across most regulatory bodies, six things sit at the top of the list:

• Control of the quality system. Procedures match practice. Personnel know the standard operating procedures they work under. Deviations are caught, investigated, and closed.
• Data integrity. Audit trails are intact, records are attributable and contemporaneous, and the data tells a coherent story from sensor to report. Data integrity remains a top citation category in FDA warning letters and a consistent enforcement priority across regulators.
• Environmental monitoring completeness. Temperature alone is not enough for products with humidity-sensitive labeling. Warning letter analyses consistently show gaps in differential pressure, CO₂, and humidity monitoring driving citations.
• Documentation flow speed. How quickly the site can produce a record signals how well the system is actually run.
• Personnel knowledge. Whether the people running the operation can speak credibly to the processes they own.
• Constant readiness. Whether the site looks the same on day 47 of an inspection cycle as it does on day 1.

Three shifts are reshaping inspection exposure. FDA warning letters describing GMP deficiencies have climbed year over year, and FY2025 set a 20-year record. A growing share of FDA drug quality inspections target foreign manufacturing sites, and the agency has shifted toward unannounced inspections abroad. Environmental monitoring deficiencies remain a recurring citation theme, with partial monitoring (temperature without humidity, for example) appearing repeatedly in published warning letters.

At the same time, the pipeline has changed. New modalities — biologics, cell and gene therapies, GLP-1s at scale, ADCs — bring tighter environmental tolerances, more multi-parameter monitoring, and faster facility expansion to meet demand. CDMOs absorb much of this complexity, often running multiple clients' products through the same qualified spaces. Each new product, each new client audit, and each new facility build adds inspection surface area.

The signal across regulators is consistent: audit readiness is a daily state, not a pre-inspection sprint. The site that has run a mock inspection in the last six months looks different to an inspector than the site that has not. The site whose records sit in one validated platform looks different than the site running multiple vendors and a paper archive.

Build the inspection team early

A functioning inspection team has clearly defined roles, named in advance and documented in your quality procedures:

• Hosts. Senior staff who sit with inspectors in the inspection room, manage the conversation, and call in subject matter experts.
• Scribes. Trained note-takers who capture every request, every commitment, and every potential observation. Scribes do not speak to the inspectors; they document.
• Runners. Personnel who move documents, samples, and people between the inspection room, the back room, and the floor.
• Back room (war room) staff. The team that pre-reviews every document before it goes into the inspection room, tracks what has been provided, and coordinates the document flow.
• Coaching room staff. The senior coach who briefs subject matter experts before they enter the inspection room helps them anticipate questions and assesses whether they are ready to speak to inspectors at all.
• Subject matter experts. The people who actually answer technical questions on processes, equipment, and systems.

A common mistake is assuming inspectors will only speak with whoever you put in front of them. They can request to speak with anyone in the building, and often do, especially during the facility tour. Every relevant person should be trained on how to handle inspector interactions, not just those in the inspection room.

Run a real gap analysis

Gap analysis means a hard look at where your processes do not work, where your deviation logs show recurring patterns, and where your CAPAs have closed but the underlying issue has not. The goal is to identify what an inspector will notice and either fix it, or prepare a credible response before they arrive.

Areas worth scrutinizing:

• Deviation and CAPA logs for repeat findings the inspector will spot in five minutes.
• Environmental monitoring coverage against product label claims. If a product specifies humidity tolerances, humidity must be monitored. FDA has cited facilities for temperature-only monitoring when the label required humidity as well. Same logic applies to differential pressure for clean areas and CO₂ for incubators.
• Calibration and data flow. Coverage, currency, traceability to a national or international standard. Critically, the path from sensor to compliance report must be validated end-to-end. USB transfers, manual spreadsheet steps, and unvalidated calculation tools are common exposure points.
• Mapping reports. Whether they reflect the current state of the equipment or a configuration that no longer exists.
• Supplier qualification. How recently key suppliers have been audited or requalified.
• Training records. Whether they are current and whether they correspond to the standard operating procedures people actually use.

Run a mock inspection

Mock inspections, ideally run by an external consultant who has audited or inspected before, do three things at once: they surface gaps you would not find in a desk review, they train your subject matter experts under realistic pressure, and they reduce the stress of the real thing because your team has been through a version of it. With unannounced FDA inspections becoming more common, this matters more than it did even two years ago.

How do the inspection room and war room work together?

Two physical spaces define how the inspection runs.

The inspection room is where the inspectors sit. It is staffed by hosts and scribes. The expectation is that any document or person requested can be produced quickly, calmly, and without visible scrambling.

The war room (or back room) is where every document is pre-reviewed before it enters the inspection room, where the team tracks what has been provided and what is outstanding, and where subject matter experts are coached before they go in.

Why pre-review matters

Pre-review will not hide problems. Inspectors find what exists regardless. The goal is to know what is in the document before they read it, so the war room can flag any unresolved deviation, outdated reference, or already-addressed gap, and prepare the subject matter expert who will speak to it.

The decision the war room makes hundreds of times during an inspection is: send this in now, or delay slightly to prepare a proper response? Both options have costs. Delays frustrate inspectors and signal lack of control. Sending in unprepared material creates findings that could have been managed.

Document flow speed signals control

Inspectors form an early read on whether a site is well run based on how quickly documents come back. Fast retrieval raises confidence; slow retrieval reads as weak system control.

This is where the digital infrastructure of your quality system shows up directly in the inspection room. If calibration certificates, deviation records, monitoring data, and mapping reports are scattered across multiple vendors, file shares, and paper archives, retrieval is slow regardless of how prepared the team is. When the records sit in one validated platform with audit-ready exports, retrieval is a few clicks.

The closing meeting is where the inspector presents observations. The site receives these in an exit notice and is then expected to respond with a thorough corrective and preventive action plan.

The daily debrief

Inspections that run more than two days typically include daily debriefs, where the inspector summarizes findings to date, and the site has a final opportunity to address them. Some inspectorates will remove an observation if it is fully addressed before the inspection closes; others keep it on the record regardless. Either way, daily debriefs are the moment to surface and resolve issues before they become formal findings.

What a strong CAPA response looks like

The CAPA response is your formal answer to the inspectorate. It is read carefully, and a weak response can extend the inspection's impact for months. A strong CAPA response includes:

• Root cause analysis that identifies the actual underlying cause, not the surface symptom.
• Immediate corrections that address the specific issue cited.
• Corrective actions that remediate the broader process gap.
• Preventive actions that reduce the chance of recurrence elsewhere in the system.
• Realistic timelines for each commitment, with named accountability.
• Quality risk management principles applied throughout, with reference to ICH Q9 and the relevant standards.

Senior management engagement matters here. CAPA responses written by middle management without leadership involvement read as exactly that, and inspectorates can tell.