20 Questions Your Quality Team Should Be Asking Right Now (Part 2/2)
The second follow-up to our recent H2 audit trends report that operationalizes that data into practical questions for self-assessment.
Last week, we published a report surfacing the trends we found after analyzing over 30 GxP audits we conducted in the second half of 2025.
Clear patterns emerged. While firms have largely mastered the basics of GMP documentation, the findings reveal something more concerning: systemic blind spots that cut across organizations of all sizes.
As a companion piece to that (very popular) trends piece, we wanted to make that data even more practical. So, we’ve distilled them into 20 specific questions your quality team should be asking today.
We recently covered the first 10 here in Part 1. Read it here if you missed it:
Here’s Part 2 with the other 10 questions. Talk to us if you can’t answer—or don’t like your answers—to any of these questions.
11. When deviations occur, are you documenting robust CAPAs or just describing what happened?
The CAPA systems at the sites we audited tended to show a troubling pattern: very detailed documentation of deviations, but little documentation of actual corrective and preventive actions. One deviation record contained three and a half pages of detailed deviation documentation but only half a page addressing CAPA. Risk assessments were being used to justify "CAPA not required" decisions, even for significant events.
We see this a lot. The purpose of investigating deviations isn't just to document what happened. It's to actually prevent recurrence. When CAPA documentation is minimal, auditors (and investigators) question whether true corrective and preventive thinking occurred, and start digging.
What to do: Pull five to ten recent deviation files. Compare the length and depth of the deviation description to the CAPA section. If there’s a significant imbalance, your investigations may be descriptive rather than corrective.
12. When your Quality Unit makes an error, does it trigger a CAPA?
Seems like a no-brainer, but we saw this quite frequently. In one case, an NCR was processed using an incorrect form and approved by Quality Assurance. The error was later identified during reconciliation and corrected. However, no CAPA was initiated to address the Quality Unit oversight that allowed the initial error to occur in the first place.
Quality Unit errors are particularly concerning because QA is supposed to be the final check. When QA makes mistakes, the system has failed at its last line of defense. These events warrant formal CAPA, not just correction!
What to do: Review the deviation and NCR records where QA was involved in the error (approved something incorrectly, missed a deficiency, etc.). Verify each triggered appropriate CAPA.
13. Are your repeat findings receiving systemic CAPA or just repeated corrections?
This is another recurring issue we see in CAPA programs. At one site, a complaint handling timeliness finding repeated from the previous audit year. The site had an open CAPA addressing overdue reviews, but the backlog continued to grow. We saw a 20% repeat finding rate across our H2 2025 audits. Repeat findings indicate that previous CAPAs were ineffective. Each repeat should trigger root cause analysis of why the original CAPA failed.
What to do: List the findings from your last three audits. Identify repeats. For each repeat, document why the original CAPA was ineffective and what additional actions are needed.
14. When you revise an SOP, do you verify that all training references within that SOP remain valid?
The training-related findings in our recent audits weren't about missing training records. They were about training systems that didn't maintain their own integrity.
During one SOP revision we reviewed, high-risk area competency procedures were inadvertently removed. The training curriculum referenced elements that were no longer in the SOP. Procedure revisions can accidentally remove critical requirements. Without verification, training programs can become disconnected from actual procedural requirements.
What to do: Look at your last five SOP revisions for production or laboratory procedures. Verify that all training elements referenced before revision are either retained or deliberately removed with justification.
15. Do you have training records for all contractors who perform GMP activities at your site?
This one commonly slips under the radar. We found sprinkler maintenance contractors working in GMP areas without gowning and without documented training. The site had no system for documenting subcontractor or contingent contractor training.
Anyone performing activities in GMP areas—including contractors—must be appropriately trained and documented. "They're the vendor's responsibility" doesn't satisfy the requirement when they're working in your facility. You can’t outsource responsibility.
What to do: List all the contractors who entered GMP areas in the past few months. Verify training documentation exists for each. If not, establish the system!
