What Our Auditors Are Finding Lately: 7 Trends Across GMP, GLP, GCP, and Device Work (Q2 2026)
A quarter's worth of supplier qualifications, mock inspections, vendor re-quals, and internal audits, read back to back.
Heads up: this one runs long, and your email system may clip it. If it cuts off, hit “View entire message” or open it on Substack.
Every quarter we go back through the audit work our teams closed out and pull the patterns, so paid subscribers can see what's actually turning up in the field and fix it before an investigator does. This issue covers Q2 2026. Fieldwork and final reports landed mostly between April and June, across 27 separate engagements in eight countries. Past issues are here.
If you’re a free subscriber, we’ll be cutting off the findings list and a list of questions every firm should be able to answer with documentary evidence at hand. Graduate to a paid subscription here.
Welcome to our quarterly audit report analysis looking back at our Q2 work. What stood out this quarter, similar to last, wasn’t the severity of any single finding. It was how the same handful of problems kept showing up at completely different kinds of sites, under completely different regulations, on three continents.
A sterile eye-drop plant in India, a biologics drug-substance site in the US, and a contract lab in Germany were all wrestling with versions of the same question: does the paperwork you hand an investigator actually match what your systems hold?
No company or site names are used in the trend descriptions below, and we haven’t added any facts beyond those in the reports. Confidentiality is paramount to us.
Need an audit, a mock inspection, or remediation help? Talk to us.
Talk to us if you need auditing, mock inspection, remediation, or other RA/QA/Clinical support.
What’s in this dataset
The 27 audits break down roughly like this:
Contract-manufacturer and supplier GMP audits made up the bulk of it: sterile injectables and ophthalmics, high-potent oral solids, an API site, a biologics drug-substance operation, a drug-product packaging and repackaging CDMO, and several contract analytical and testing labs.
On top of that, we ran medical device supplier and facility qualifications and one remote mock pre-approval inspection, a set of clinical and GCP audits (a sponsor-level mock BIMO audit, an investigational-device trial site, and oversight audits of clinical-supply and data-management vendors), a couple of GLP archive and nonclinical lab audits, and one internal audit of a medical-information function.
The regulations in play covered most of the map: 21 CFR 210/211, 820, 58, Part 11, and 312/812; EudraLex Volume 4 with its annexes (including the 2023 Annex 1 and Annex 11); ISO 13485:2016; ICH E6(R3) and Q7/Q9; Health Canada’s GUI-0001; USP chapters; and EU MDR.
The numbers at a glance
The dataset:
27 audits, April through June 2026
8 countries: United States, India, Germany, China, Sweden, Malaysia, Canada, Italy
Types: GMP supplier and vendor qualification, biologics and device qualification, GLP archive and nonclinical, GCP and sponsor oversight, one internal audit, one remote mock PAI
Findings, graded on our usual scale (one engagement was a questionnaire-based supplier qualification and isn’t graded here):
Critical: 0
Major: 26
Minor: 64
Recommendations: 50
Total: 140
That works out to 19% major, 46% minor, 36% recommendations, and no criticals anywhere in the set.
Where the findings clustered, by how many audits were affected:
Documentation, data integrity, and inspection readiness: at least 10 of 27
Vendor and supply-chain accountability: 5 of 27
Change control and CAPA governance: 4 of 27
Annual product quality review completeness: 3 of 27 (all sterile sites)
Notifying the customer of changes: 3 of 27 (all the same contract sites)
Environmental control and cleanroom classification: 2 to 3 of 27
Control-sample traceability: 2 of 27
Computerized systems and audit-trail review: 3 of 27
As far as repeat findings, this quarter the story ran the other way from last time. Where we could check prior-cycle observations, they'd generally been closed and verified.
A packaging CDMO in China cleared the two minors from its last audit.
A US clinical CRO closed all three from 2023.
A US packaging site resolved its prior nonconformance outright by commissioning new warehouse space, finalizing a quality agreement, and sorting out its retain-sample arrangement.
The caveat is effectiveness: a device CMO still drew a major on CAPA controls, and a sponsor's own effectiveness check on a vendor issue came back inconclusive. Closing a finding and proving the fix worked are still two different things.
Geographically:
India carried the weight. The four contract sites there (three sterile, one high-potent oral) produced 15 of the 26 major findings, 58% of the total, and they kept hitting the same notes: annual reviews missing water and utility trends, changes not passed to the customer, control samples that couldn’t be traced, environmental-control gaps, and label-vendor agreements with holes in them.
China went quiet with findings, and the contrast with last quarter is sharp. Last quarter two Chinese biologics sites drove most of our major findings. This quarter the two Chinese sites, a packaging CDMO and an oral-solids manufacturer, produced zero majors between them; one was clean, the other drew four minors and a recommendation. Same country, very different picture, and a reminder that the country on the letterhead tells you less than the maturity of the site.
The US was the low-risk end. Eleven US or US-focused engagements, only two majors between all of them (both at one biologics drug-substance site), and two that closed with no findings at all: a remote clinical CRO and a nonclinical tox lab. Established labs and CROs mostly ran clean.
Europe sat in the middle. Germany’s four sites (a clinical-supply vendor, a contract analytical lab, a GLP archive, and a software developer) produced mostly minors and recommendations, plus three majors at the clinical-supply vendor. Sweden’s two (a storage/distribution site and a sponsor-level BIMO audit) each drew a major. Canada’s one site drew one major and one minor. Italy’s API site was clean.
Malaysia’s two device audits, a remote mock PAI and an onsite facility qualification, produced 20 findings between them, the highest per-audit rate in the set, concentrated in change control, CAPA, documentation, and incoming-material controls.
A few patterns to take away:
Sterile and high-potent contract sites under supplier qualification carry the most risk. The India cluster alone accounted for 58% of majors.
Correct data plus a bad export still fails ALCOA+. Several sites had sound systems of record and unusable outputs.
Contamination-control and environmental documentation is still lagging the revised Annex 1 at multiple sites.
The customer often finds out about changes last, or not at all.
Country of origin is a weak predictor. Site maturity is the real signal.
What’s working:
No critical findings anywhere in 27 audits.
Four audits closed with zero findings, plus a fifth qualified cleanly by questionnaire.
Prior-cycle findings were largely closed and verified.
The China results improved sharply against last quarter.
US CROs and analytical labs mostly showed mature, well-run quality systems.
The rest of this is the detail behind those themes, with generalized examples and what to do about each.
1. Documentation, data integrity, and inspection readiness were the biggest gaps (yet again)
This sits at the top every time we run these numbers, and it did again, in some form, in at least 10 of the 27 audits. The pattern is consistent: the system of record is usually fine, and the thing an auditor actually picks up (the printout, the export, the completed record) is where it falls apart.
The specifics varied in these audits.
At one sterile site, the analytical raw data for an identity test carried no time on the weigh slips, the batch record didn’t document verification of equipment cleaning date and time, and a sample pulled at 17:14 for water-content testing had no result or acceptance criteria recorded at all. None of that is really a systems failure. It’s contemporaneous documentation not actually being contemporaneous, and it’s exactly what an investigator will reconstruct a timeline from.
At another, the finished-product specification the QC lab presented and the certificate QA presented carried different version numbers for the same product. At a third, four bottles came out of packaging over the quantity issued from the warehouse and four labels were short on reconciliation, which is the kind of arithmetic that doesn’t survive scrutiny.
At an investigational-device trial site, the findings were all good-documentation-practice minors: version control on IRB-approved documents, gaps in the delegation-of-authority log, and general GDP discipline across the site’s logs and forms.
At a contract analytical lab, the system audit trail was being reviewed once every two years instead of annually, and the reduced frequency had never been justified or risk-assessed anywhere in writing. The lab’s reasoning was that nothing had gone wrong yet, which isn’t a justification, it’s an absence of one!
A few recommendations:
Print every report format your systems can produce and look at it, because a correct database and a truncated PDF are not the same artifact to an inspector.
Don’t hand over raw exports as evidence unless they’ve been reviewed and approved. Reinforce why blank fields matter, not just that they’re not allowed, and require an entry (N/A or otherwise) where something doesn’t apply.
And if any recurring review (audit trails, periodic reviews, sampling) runs at less than the standard frequency, document the risk basis for it before an auditor asks
2. Annual product quality reviews with holes in them
Three sterile sites we audited, all under supplier qualification, had annual product quality reviews that left out data the product type demands. The reviews happened on schedule and signed off. But the templates had gaps that guaranteed certain data never made it in.
The starkest case was an ophthalmic site whose review covered every batch, deviation, and stability result for the period but included no review of Water for Injection, purified water, or pure-steam trends at all. For a sterile aqueous product, water-system performance is about as critical a quality attribute as exists, and its absence is a real blind spot. At the same site the review period ran November 2024 to October 2025 while the utility trends ran January to December 2025, so even the data that was there didn’t line up in time.
At another site, the review was compiled strength by strength, four or five separate documents, so no one ever looked across strengths or markets in a single view.
One more, and it’s a repeat of something we flagged last quarter at a different facility: during steam-sterilizer qualification, pure-steam condensate had not been evaluated against WFI standards, before or after. Pure steam touches critical surfaces directly, so its condensate has to meet WFI pharmacopeial requirements or you can’t claim sterility assurance. It simply wasn’t tested.
Check your review template against a real checklist: water-system trends (WFI, purified water, pure steam), environmental-monitoring trends, control-sample status and withdrawals, and every deviation, OOS, complaint, and CAPA from the period, all covering the same window. Review the product, not each strength in isolation. And make WFI-standard testing of pure-steam condensate part of your standard sterilizer-qualification protocol.
A few recommendations:
Check your review template against a real checklist: water-system trends (WFI, purified water, pure steam), environmental-monitoring trends, control-sample status and withdrawals, and every deviation, OOS, complaint, and CAPA from the period, all covering the same window.
Review the product, not each strength in isolation.
Make WFI-standard testing of pure-steam condensate part of your standard sterilizer-qualification protocol.
3. Environmental control and cleanroom classification
Two of the sterile sites had environmental-control problems serious enough to carry majors, and the details matter here because they look fine on a certificate and fall apart on the floor.
At a high-potent oral-solids facility, the pressure cascade had collapsed against its own design. A zone specified at 32 Pa was running at 24; a process corridor specified at 82 Pa was running at 30. That left roughly 6 Pa between the corridor and the cleanroom, against a 10 to 15 Pa expectation, in a facility handling potent compounds where the cascade is what protects both the operator and the next product. One air handler was feeding that corridor plus airlocks for compression, blending, coating, and granulation, and there was no place in the batch record to note or record corridor pressure during critical operations.
At a sterile blow-fill-seal site, the grade-C classification limits were set loosely, and the non-viable particle counts didn’t behave. At every one of several locations the “at rest” counts came in five to ten times higher than the dynamic counts, which is backwards: dynamic conditions generate more particles, not fewer, so higher counts at rest point to something wrong with the method, the pressure cascade, or the test itself. The prior year’s qualification hadn’t shown the same pattern, and the reported HEPA leakage had swung from around 0.0022% across 41 filters to a flat 0.0000% on the same 41 filters, which reads as a testing anomaly more than an improvement.
At a separate site, macroparticles at 5 µm and above made up more than 10% of the total particle count in an at-rest cleanroom, where they should sit near zero because they’re heavy and settle fast. A ratio like that is a flag for personnel shedding or filter bypass, even when the raw number technically passes.
A few recommendations:
Finish a formal contamination-control strategy that covers every classified area, your cleanroom-design rationale, and your pressure-cascade justification, per Annex 1 Section 4, and don't stop at the aseptic core.
Run environmental requalification under dynamic conditions, not static only, and put a monitoring point on the pressure differentials that matter during production.
When particle data behaves oddly, go back through the prior qualifications and the method before you accept the trend.
4. Telling the customer when you change something
This one is specific. Three of the four contract sites in the India cluster had made a major change and not passed it to the customer, even though the quality agreement in each case required it.
At one, major changes and specification modifications simply weren’t communicated.
At another, the procedure for cleaning and sterilizing a manufacturing vessel had been changed from CIP-plus-SIP to CIP-only, a real change to a real process, without the notification the agreement called for.
At a third, a specification and testing change tied to a newly identified impurity in the API never reached the customer either.
Different sites, different changes, same essential gap.