Inspection readiness for MHRA GMP inspections and notified body audits
What to have ready before an MHRA GMP inspection or notified body audit, how to run a mock inspection and a back room, how findings are graded and how to answer them.
The letter from the MHRA inspectorate, or the audit plan from your notified body, usually lands when the quality team is already at full stretch. The temptation is to spend the weeks before the visit tidying: chasing signatures and closing whatever CAPAs can be closed quickly. An experienced inspector recognises that for what it is. Inspection readiness is a state the quality system is either in or not, and the run-up is for confirming it and fixing the gaps you find. This article covers what to have ready, how to run a mock inspection that tells you something, how to set up a front room and back room, how to handle requests on the day, how MHRA grades findings, and what the response timelines look like afterwards.
What an MHRA GMP inspection and a notified body audit look at
The two visits come from different legal bases but test the same thing: whether the system you describe on paper is the system people actually run.
For medicines, the MHRA sets out its approach in its GMP and GDP inspection guidance. Every manufacturer and wholesaler has a risk rating, and inspections are prioritised for the highest ratings. Routine inspections are announced in advance, although the short-notice programme may give little or no warning, and triggered inspections, prompted for example by a whistleblower or another regulator, may give none at all. Before a routine inspection you complete a GMP pre-inspection compliance report and send it to the inspector. On site, the team interviews people, reviews documents and walks the facility, and may change focus if they suspect serious non-compliance, so a narrow agenda is no guarantee of a narrow visit.
For medical devices under EU MDR 2017/745, Annex IX section 3.3 requires the notified body to carry out surveillance audits and assessments at least once every 12 months, and section 3.4 requires unannounced audits at least once every five years, on your site and where appropriate at suppliers and subcontractors. The unannounced audit plan is not disclosed to you, which settles whether readiness can be a seasonal activity. If you also supply Great Britain, your UK approved body audits under the UK Medical Devices Regulations 2002 on its own programme.
The inspection readiness document set
An inspector forms a view of your site within the first hour from a small set of documents. Have these current, consistent with each other and quickly retrievable.
| Document | What the inspector is checking | Where it usually goes wrong |
|---|---|---|
| Site master file (medicines) | Activities, products, premises, key people and outsourced work match reality | Organisation chart two reorganisations old; contract labs missing |
| Quality manual (ISO 13485 4.2.2) | Scope, exclusions and justifications, process interactions | Exclusions that no longer hold after a product change |
| Open deviations and CAPA | Age, risk rating, trend, whether actions match root causes | A long tail of overdue items with extensions and no rationale |
| Training records | People doing the work are trained on the current SOP version | Training lagging behind the last SOP revision by weeks |
| Data integrity controls | Access, audit trails, review of electronic data | Shared logins on lab instruments; audit trails never reviewed |
The site master file guidance sits in Part III of EudraLex Volume 4, and it expects the file to carry an edition number, an effective date and a review date. If yours was last reviewed before the most recent change in QP or a new contract laboratory, fix it first; it is one of the documents inspectors use to plan.
Open deviations and CAPA deserve the most preparation, because they show how the quality system behaves under load. For every item over its target date, the file should show why, who approved the extension and what interim control is protecting product. A deviation open for five months with no interim action and a vague root cause is a common source of a major finding.
For training, pick a sample of SOPs revised in the last six months and check that every person who performs the task was trained on the new version before they did the work. That single test catches most matrix problems; our article on the GMP training matrix covers how to structure the matrix so it passes.
For data integrity, the MHRA's GXP data integrity guidance expects routine data review to include a documented audit trail review where a risk assessment says it is needed. Walk one GxP computerised system, such as an HPLC data system, end to end: who has which access, whether accounts are individual, when the audit trail was last reviewed and by whom, and what that review found.
Running a mock inspection that tells you something
A mock inspection is worth doing only if someone is willing to find things. Use an auditor who did not build the processes being examined, such as an external consultant or a colleague from a sister site. Give them what a real inspector would have, including your last inspection report and your deviation, complaint and CAPA lists, and let them choose where to go.
Run it over one or two full days with the real front room and back room in place, so the logistics get tested along with the content. Ask the mock inspector to do three things an MHRA inspector often does. Follow one batch, or one device lot, from goods receipt to release and pull every record on the way. Pick a recent change control and trace it through to updated SOPs and training. Interview operators at their workstation about what they would do if something went wrong.
Grade the mock findings with the same critical, major and other scale the MHRA uses, log them as you would a real finding, and put each one through CAPA. If your internal audit programme already includes a periodic inspection-style audit, the mock can be that audit with a harder brief.
Setting up the front room and the back room
The front room is where the inspector works. Keep it simple: a table, a screen if records are electronic, a named host who stays throughout, and a scribe who records every question, every document shown and every comment made. Subject matter experts come in when needed and leave when they are done.
The back room is where requests are fulfilled. It needs a coordinator, a request log, people who know where records live, and a reviewer who reads every document before it goes to the front room. The reviewer checks that it is the document asked for, that it is the current version, that it is complete and legible, and that the team knows what it says before the inspector reads it.
The request log is the most useful tool you have during the inspection. Each line holds the time of the request, the exact wording, who is fetching it, when it went in, and any follow-up. At the end of each day, the host and coordinator go through the log and the scribe's notes to spot themes. Three requests about the same cleaning validation usually means a finding is forming, and the back room can prepare the full picture before day two.
Answering requests on the day
Answer the question asked. If you do not know, say so and say who does, then get that person. Do not speculate about what a procedure probably says; fetch it. When a record is wrong, say it is wrong and show the deviation or CAPA that deals with it. Inspectors give credit for a system that found its own problem.
Brief the people likely to be interviewed to describe their own work in their own words and show where they record things. An operator who says "I check the label against the batch record and stop the line if it does not match" is far more convincing than one quoting section numbers.
If the inspector raises a point you think is wrong, say so politely, with evidence, before the closing meeting. At the closing meeting the inspector discusses deficiencies and agrees timelines for corrective actions; correct factual misunderstandings then, while the finding can still change.
How MHRA grades inspection findings
MHRA grades deficiencies at three levels. A critical deficiency has produced, or significantly risks producing, a product harmful to patients. A major deficiency is non-critical but indicates a major deviation from GMP or the licence, may produce product that does not comply with its marketing authorisation, or indicates a failure in batch release or in the QP's legal duties. A combination of several "other" deficiencies can be graded as a major. Anything that cannot be classed as critical or major, but still departs from GMP, is "other".
If the inspector finds critical deficiencies, or finds that previously agreed actions have not been resolved, the case goes to the Inspection Action Group, which can refuse or suspend a licence, increase inspection frequency or call a meeting with the licence holder. Poor compliance short of that threshold may go into the compliance escalation process instead.
Notified bodies grade audit findings using their own scheme, usually as major and minor nonconformities. The definitions and the deadlines for your response are set in the notified body's certification rules and your contract with them, so read them well before the audit starts.
The response timeline after an inspection
After the closing meeting the MHRA sends a post-inspection letter listing the deficiencies. The letter asks for a reply within 28 days, giving your proposed corrective actions and a timetable for implementing them. The MHRA's guidance on responding to a post-inspection letter is short. Answer each deficiency directly underneath it in the Word document provided. Say what you will do and by what date. Think about the systemic issue and other sites, beyond the single example cited. Add interim actions where the long-term fix takes time, and do not send evidence unless asked. If you are going to miss a committed date, tell the inspector before it passes.
If the inspector accepts the response, the GMP certificate follows with the inspection report. An unacceptable response may lead to compliance escalation if further requests are also unsatisfactory.
Treat each finding as a CAPA with a root cause investigation, and plan from the start how you will show the fix worked. Our piece on checking CAPA effectiveness covers that step, which is the one the next inspector will look at first.
An audit readiness checklist for the month before
Assuming the system itself is in order:
- Reissue the site master file or quality manual if anything has changed.
- Document the rationale for every overdue deviation and CAPA.
- Sample recent SOP revisions against training completion.
- Walk one computerised system through access and audit trail review.
- Gather the evidence that the previous inspection's actions are closed.
- Name the host, scribe, back room coordinator and reviewer, and rehearse a request.
- Brief the people likely to be interviewed.
Inspection readiness is decided long before the letter arrives. The last month confirms a system that already works, and the mock inspection is where you find out whether it does. If your audit programme, findings and CAPA follow-up currently live in spreadsheets, InnoQualis Internal Audits keeps the programme, checklists, findings and closure in one place with an append-only audit trail.
