Hosting a GMP Audit: Three Places We See Preparation Gaps (and How to Close Them)
We asked a few of our auditors where they see teams fall down the most on audit logistics.
Sometimes, the most fraught and frustrating audits our team conducts have less to do with the quality system and much more to do with the orchestration of the audit itself.
A quality system might be in great shape, but the auditor requests a batch record and waits 45 minutes. Or the person who can answer questions about the water system is in a meeting no one thought to reschedule. Or the audit room is a corner of the break room with no printer and unreliable Wi-Fi.
We talk a lot here about compliance failures, but we want to focus on hosting stumbles, too. Sometimes these are far more common and insidious than most quality leaders realize.
To state the obvious, when an audit runs smoothly from a logistics standpoint, the auditor can focus on the substance of your quality system, complete their review in the allotted time, and leave with a clear picture of your compliance posture.
When it doesn’t, the auditor spends half their time waiting, repeating requests, and navigating confusion, which eats into their schedule, compresses the review into a shorter window, and creates a general atmosphere of disorganization that colors how they interpret everything else they see.
Having conducted thousands of GMP audits across pharma, biologic, and device companies of all sizes, our auditors tend to identify the same three operational breakdowns over and over during debriefs. None of them requires months of preparation to fix. All of them require someone to actually own the logistics of hosting an audit as a distinct workstream.
Let’s run through them, so if anything sounds familiar, you can address it.
If you need audit, mock inspection, or remediation support, let’s talk.
1. Document retrieval (the 30-minute batch record problem)
This is one of the biggest time-killers in GMP (and other) audits, and it happens at 20-person biotechs and at global pharma sites with sophisticated electronic QMS platforms.
The scenario tends to play out like this:
The auditor asks to see a specific batch record.
The person coordinating the audit relays the request to the back room.
Someone then has to figure out where the record lives. Is it in the eQMS? A shared drive? A physical filing cabinet in the QA office? A binder in the warehouse? Is it still with the reviewer? Has it been archived?
The person who knows is on the production floor and sometimes can’t be reached immediately.
Fifteen minutes pass. Then twenty.
The auditor sits at an empty table.
Now multiply that by additional document requests during a two- or three-day audit as the auditor asks for batch records, training files, calibration logs, deviation investigation reports, supplier qualification packages, equipment maintenance records, stability data, and more. Each one is a small delay that doesn’t usually call attention to itself. But each delay compounds into a larger problem until the auditor is suddenly behind schedule and everyone’s mood starts to sour.
Now we’re exactly where no one wants to be: forced to rush through systems that ought ot be examined carefully, extending the audit timeline (which creates its own disruptions), or making judgments based on incomplete review.
If we were running a CAPA on this, the deeper issue is typically a poor document retrieval capability, and/or one that hasn’t actually been tested under audit conditions. Teams usually know where things are filed and know the system more broadly. But sometimes, auditors are the ones to confront them with the fact that they’ve never simulated the experience of receiving rapid, sequential, sometimes unexpected requests for specific records and measured how long it actually takes to get each one into the auditor’s hands. Until you’ve done that exercise, you don’t know whether your system works under pressure.
What good looks like
The best-prepared sites we audit usually do something simple: they pre-stage documents.
Before the auditor arrives, the audit coordinator reviews the audit scope, anticipates the categories of documents the auditor is likely to request, and pre-pulls files from each category into the audit room (or something similar).
This doesn’t mean guessing which specific batch record the auditor will want.
It’s having a batch record index ready, so retrieval is a lookup, not a search.
It means having the training matrix printed or loaded on a screen.
It means having the CAPA log, the deviation log, the complaint log, and the approved supplier list immediately at hand, because auditors ask for those in virtually every GMP audit.
Beyond pre-staging, the best-prepped sites also designate a dedicated document retrieval person in the back room whose only job during the audit is to find and deliver documents. This isn’t a QA manager, since they need to be available for interviews. It’s a dedicated retrieval person who knows the filing systems, both electronic and physical, and who can get a specific document into the auditor’s hands in no longer than a few minutes. If retrieval time is taking longer than that, there’s work to do.
A small fix that makes a big difference: Before your next audit, run a quick “retrieval drill.” Have someone outside your department generate a list of fifteen documents an auditor would commonly request (say, three batch records, two deviation reports, a CAPA file, a calibration record, a training file, a supplier audit report, an SOP, a validation protocol, the annual product review, a complaint file, and a change control record). Hand the list to your designated retrieval person and time each one. Where you find delays, diagnose the cause:
Is the filing system unclear?
Is the document still in someone's queue for review?
Is the archive disorganized? Is the electronic system difficult to navigate under time pressure?
Each cause has a different fix, but (of course) you can't fix what you haven't measured.
2. The wrong people in the room (or missing entirely)
Another common hosting issue is personnel availability. It usually looks something like this:
The auditor finishes reviewing one area and wants to move to, for example, the water system.
The facilities engineer who manages the water system is on PTO, in a production meeting, or at another facility. No one told them the audit was happening this week, or if they were told, no one asked them to actually block their calendar.
The QA manager tries to answer the auditor’s questions instead, gets two answers deep before hitting the limits of their knowledge, and now the auditor has to note that the responsible person was unavailable, which, at minimum, extends the audit and, at worst, becomes a soft finding about organizational readiness.
Or it’s the inverse of that:
The auditor asks to speak with a production operator, and the site brings in the Production Director, a well-spoken, senior person who can give polished answers but hasn’t personally operated the equipment in years.
The auditor doesn’t want the director. They want the person whose hands are on the equipment at 2 p.m. on a Tuesday.
They want to assess whether frontline personnel understand what they’re doing and why. Sending in a senior proxy doesn’t satisfy that need; it raises questions about whether the organization is trying to manage the auditor’s access.
The underlying problem here is that some audit preparation efforts focus only on the quality system (reviewing documents, closing CAPAs, walking the facility) and ignore the logistics of running an audit. Or this planning amounts to a last-minute coordination task: “Send an email to department heads letting them know the audit is happening.” That’s really not preparation, it’s notification.
What good looks like
Good personnel prep means identifying every SME the auditor might want to speak with based on the audit scope, confirming their availability for the specific audit dates, blocking their calendars, briefing them on what to expect, and establishing a communication protocol so they can be reached quickly if the auditor’s questions go in an unexpected direction.
The teams we’ve seen really nail this build a simple SME availability sheet maybe two weeks or so before the audit.
For each system or area in scope (production, QC lab, facilities/utilities, warehouse/materials management, document control, training, IT/computer systems, regulatory affairs), identify the primary SME and a backup.
Confirm both are available for the audit dates.
Brief both on the audit scope and the kinds of questions they might face.
Give each person a 30-minute window to review the key documents in their area so they’re not encountering their own records for the first time while sitting across from the auditor.
Equally important is making sure the person coordinating the audit has a fast communication channel to every SME. A group text thread, a Teams channel, a walkie-talkie system, however people talk to each other at your site. The auditor should never have to wait more than a few minutes for the relevant person to appear.
The perception of responsiveness matters here because it matters during real inspections. An auditor who sees a well-coordinated team that can produce documents and people quickly naturally develops confidence in the organization’s operational control. An auditor (or investigator) who keeps hearing “Let me find out who can answer that” develops the opposite impression.
To linger on this just a bit longer, it’s worth noting that many of our auditors notice that floor-level and lab-level staff are the ones least often briefed for audits, especially at smaller companies. When they’re called up by surprise, they sometimes freeze. Then they over-explain. Or they volunteer information about a deviation from last month that wasn’t on the auditor’s radar. Not because they did anything wrong, but because no one told them what to expect, how to interact with an auditor, or that it’s perfectly fine to say “I’m not sure, let me get my supervisor.”
A fifteen-minute all-hands briefing the day before the audit, covering who the auditor is, what they’re looking at, how the team should interact with them, and the principle that honesty and calm are more valuable than perfect answers, can prevent the single most avoidable category of audit complications.
3. No one is actually running the audit
The third operational breakdown we want to cover is the most systemic, and it’s the one that creates the conditions for the other two: no one has been designated to run the audit as a coordinated event that needs to be orchestrated.
At many companies, the Quality Leader or QA Director is the default point of contact for the auditor. That makes sense, as they own the quality system, understand the regulatory framework, and have the authority to decide what information to provide.