FDA GxP Inspection Checklist: How to Prepare for GMP, GLP, and GCP Audits

When an FDA investigator walks through your door, the outcome of that inspection is rarely determined in the moment. It’s determined by everything your team did  or didn’t do  in the months and years before that visit.

GxP inspections are not surprise evaluations of your intent. They are systematic reviews of your documentation, your systems, your processes, and your people. Companies that pass inspections cleanly are not necessarily doing more than everyone else. They are doing the right things consistently  and they can prove it.

At GxPReady, we work with pharmaceutical, biotech, and medical device companies navigating exactly this challenge. This checklist is designed to help quality, validation, and operations leaders understand what inspectors are looking for across GMP, GLP, and GCP environments  and where gaps are most commonly found.

Why GxP Inspection Readiness Is an Ongoing Process, Not a Sprint

One of the most damaging misconceptions in regulated industries is that inspection preparation begins when an audit is scheduled. By that point, the most important work is already done  or already missed.

FDA investigators are trained to distinguish between companies that maintain compliance as a culture and companies that stage compliance for audits. The difference shows up in record timestamps, employee responses, equipment logs, and the consistency of your documentation over time.

GxP inspection readiness is not a project. It is a system  and that system needs to be running every day.

What FDA Inspectors Are Actually Looking For

Before walking through a checklist, it helps to understand the inspector’s lens. FDA investigators are evaluating three things above all others:

Control  Do you have documented systems that govern how regulated activities are performed?

Consistency  Are those systems being followed consistently, not just when convenient?

Evidence  Can you retrieve proof of compliance quickly and completely, without manual searching or reconstruction?

Gaps in any of these three areas  even in an otherwise well-run facility  are what generate observations, warning letters, and import alerts.

GMP Inspection Checklist (Good Manufacturing Practice)

GMP inspections are the most common FDA audit type for pharmaceutical and medical device manufacturers. Investigators will typically focus on the following areas:

Equipment and Facility

• All manufacturing and laboratory equipment is identified, inventoried, and maintained on a documented schedule
• Calibration records are current, retrievable, and traceable to standards
• Preventive maintenance has been performed on schedule with no overdue items
• Facility cleaning logs are complete and signed by qualified personnel
• Environmental monitoring data is documented and within specification

Teams using a validated CMMS can retrieve equipment records, calibration histories, and maintenance schedules in seconds  which is exactly what inspectors expect.

Documentation and Records

• SOPs are current, version-controlled, and accessible at point of use
• Batch records are complete, legible, and free of unauthorized corrections
• All corrections follow the “single line through, initial, and date” standard
• Electronic records comply with 21 CFR Part 11 requirements where applicable
• No blank fields exist in controlled documents  “N/A” is documented where appropriate

Change Control

• All changes to equipment, processes, materials, or systems are captured in a formal change control system
• Changes have been assessed for impact on product quality and regulatory compliance
• Validation or revalidation requirements triggered by changes have been addressed

Training

• All personnel working in regulated roles have documented, current training records
• Training is tied to specific SOPs and job functions  not generic attendance logs
• Retraining triggered by deviations or procedure updates is documented

Deviations and CAPA

• Deviations are captured at the time of occurrence, not retroactively
• Root cause investigations are documented and substantive
• CAPA effectiveness checks are completed and on record

GLP Inspection Checklist (Good Laboratory Practice)

GLP regulations govern nonclinical laboratory studies submitted to FDA in support of safety evaluations. GLP inspections tend to focus heavily on study integrity and personnel accountability.

Study Documentation

• Study protocols are finalized and approved before work begins
• All amendments to protocols are documented with justification and approval
• Raw data is attributable  it is clear who generated it, when, and under what conditions
• Final study reports accurately reflect the raw data with no unexplained discrepancies

Personnel and Responsibilities

• A qualified Study Director is assigned to each regulated study
• Personnel qualifications and training records are on file for all individuals who contributed to the study
• The Quality Assurance Unit (QAU) has conducted and documented required inspections

Test and Reference Substances

• Receipt, identity, purity, stability, and storage conditions for all test and reference substances are documented
• Chain of custody is traceable throughout the study

Equipment and Calibration

• Laboratory equipment used in regulated studies is calibrated and maintained on a documented schedule
• Calibration is traceable to national or international standards
• Equipment failures and corrective actions are documented

Consistent GxP calibration software that automates scheduling and documents calibration history removes one of the most common GLP inspection findings: overdue or undocumented calibration.

Archive Management

• Raw data, final reports, and supporting documentation are stored in a secure, controlled archive
• Access to archives is restricted and logged
• Retention periods are defined and enforced

GCP Inspection Checklist (Good Clinical Practice)

GCP inspections cover clinical trials submitted to FDA in support of drug, biologic, or device approvals. Inspectors may audit the sponsor, the clinical investigator, or the IRB. The focus is on protecting research participants and ensuring data integrity.

Sponsor Obligations

• Trial Master File (TMF) is complete, current, and organized
• Investigational product accountability records are accurate and complete
• Monitoring visit reports are on file and document site oversight
• Protocol deviations are captured, assessed, and reported appropriately
• Serious adverse events are reported within required timeframes

Clinical Investigator Site

• Informed consent was obtained before any study procedures were performed
• IRB approval was in place before enrollment began
• Subject eligibility was verified and documented against protocol inclusion/exclusion criteria
• Case report forms accurately reflect source documents  no transcription errors without correction notes
• Investigational product is stored under specified conditions with complete accountability logs

Data Integrity

• Source data is original, attributable, contemporaneous, legible, and enduring (ALCOA principles)
• Electronic data systems used at the site are validated or qualified as appropriate
• There is no evidence of data backdating, reconstruction, or selective recording

Cross-Cutting Requirements: What Applies to GMP, GLP, and GCP

Several compliance requirements cut across all three GxP frameworks. These are areas where inspection findings are particularly common because they apply broadly and are expected universally.

Electronic Records and Audit Trails

Any system that creates, modifies, maintains, archives, retrieves, or transmits regulated electronic records must comply with 21 CFR Part 11. This includes audit trail functionality, access controls, and electronic signature requirements. A gap here can call the integrity of your entire record set into question.

Companies managing calibration or maintenance records electronically should ensure those systems meet 21 CFR Part 11 maintenance software requirements  including complete, tamper-evident audit trails.

Validation of Computerized Systems

Any computerized system used in a regulated activity must be validated. This means documented evidence that the system does what it is intended to do, consistently, and under controlled conditions. Inspectors will ask for your validation documentation. If it does not exist or is incomplete, that is an observation regardless of how well the system actually works.

Validation tracking software allows teams to manage validation status, track revalidation triggers, and retrieve qualification documentation immediately during an inspection.

Supplier and Vendor Controls

Regulated companies are responsible for the quality of their suppliers and vendors. This means approved supplier lists, qualification records, and ongoing monitoring must be maintained. Inspectors will ask who supplies your critical materials or services  and whether you have evidence those suppliers are qualified.

The Most Common Inspection Findings  And What They Signal

Understanding what generates observations helps you prioritize where to focus your readiness efforts. The following finding types appear repeatedly across FDA Warning Letters and inspection databases:

Each of these findings is preventable. Each of them is also visible in a well-run compliance system before an investigator ever arrives.

How to Build Inspection Readiness Into Daily Operations

The companies that consistently perform well in FDA inspections share a common characteristic: they do not treat compliance as a separate activity from operations. They treat it as the same activity.

Practically, this means:

Automate reminders for critical dates. Calibration due dates, maintenance schedules, and validation review cycles should not depend on someone remembering. Automated notifications ensure nothing falls through. Teams using maintenance management software with built-in scheduling eliminate one of the most common inspection vulnerabilities.

Conduct internal mock audits. At least annually  and ideally quarterly  walk through your own facility the way an inspector would. Review records. Pull calibration histories. Ask your team to retrieve documents on demand. The gaps you find internally are gaps you can close before they become observations.

Ensure your records are instantly retrievable. Inspectors do not wait. If your team has to spend 20 minutes searching for a calibration record or a maintenance log, that itself communicates something about your systems. Records should be retrievable in seconds.

Keep your documentation current. An SOP that hasn’t been reviewed in four years is a red flag. A training record that trails current procedures is a gap. Build document review cycles into your calendar and stick to them.

Involve operations in compliance. Quality teams cannot maintain compliance alone. When equipment operators, laboratory technicians, and maintenance staff understand why documentation matters  not just that it’s required  they participate in maintaining it.

Questions to Ask Before Your Next Inspection

Use these questions to evaluate your current inspection readiness across GMP, GLP, and GCP environments:

• Can we retrieve any calibration or maintenance record within 60 seconds of a request?
• Are all equipment items on a scheduled calibration or maintenance program with no overdue items?
• Do our electronic systems have complete, tamper-evident audit trails?
• Is our validation documentation current for every computerized system used in regulated activities?
• Have we reviewed all SOPs within their required review cycle?
• Are training records current for every employee working in a regulated role?
• Have all deviations, OOS results, and CAPA items been documented and resolved on schedule?
• Could a new team member retrieve inspection-critical records without assistance?

If the answer to any of these is uncertain, that uncertainty is worth addressing before an investigator raises it.

How GxPReady Supports Inspection Readiness

GxPReady is purpose-built for the compliance demands of growing FDA- and EMA-regulated companies. The platform is designed so that inspection readiness is a byproduct of normal daily use  not a scramble at the end.

Specifically, GxPReady supports:

Calibration Management: Automated scheduling, reminders, and documentation of all calibration activities  retrievable in seconds during any inspection.

Maintenance Tracking: Preventive maintenance programs with scheduled reminders and complete maintenance history per equipment item.

Validation Documentation: IQ/OQ materials included at deployment, with validation tracking built into the platform so qualification status is always current.

21 CFR Part 11 Audit Trail: Every creation, modification, and access event is logged in a tamper-evident audit trail  ready for immediate retrieval.

Independent Database Per Customer: Your records are not shared with other customers. Your data environment is your own.

The platform is deployed through a Flash Validation™ process that qualifies the system within days  not months  so you’re not waiting on your compliance infrastructure while your operations move forward.

Ready to Strengthen Your Inspection Readiness?

FDA inspections are not events to survive. They are evaluations of how your organization actually operates. The best preparation is a system that keeps your records current, your schedules on track, and your documentation immediately accessible  every day, not just when an audit is scheduled.

If you’re evaluating how to improve your inspection readiness, explore the GxPReady platform or visit our frequently asked questions to understand how validated CMMS software supports compliance in FDA-regulated environments.

Ready to see it in your own environment? Contact our team for a confidential conversation about your compliance needs and how GxPReady can support them.

FAQs

Q1. What is the difference between GMP, GLP, and GCP inspections?

GMP (Good Manufacturing Practice) inspections focus on the manufacturing of drugs, biologics, and medical devices. GLP (Good Laboratory Practice) inspections cover nonclinical laboratory studies submitted in support of product safety evaluations. 

Q2. How much notice does the FDA give?
Often none. Many inspections are unannounced, so companies must always be ready.

Q3. What happens if the FDA finds issues?
Findings go on a Form 483. Companies must respond quickly with corrective actions. Serious issues can lead to Warning Letters or enforcement actions.

Q4. Does CMMS software need validation?
Yes. Any system handling regulated maintenance or calibration records must be validated.

Q5. How often are internal mock audits done?
Usually at least yearly, but can be quarterly if risk is higher or before inspections.

Q6. Can automated reminders help inspection readiness?
Yes. They reduce missed calibrations and maintenance, improving compliance and readiness.