I. GMP Audit Regulatory Requirements  1.1 Interpretation of China’s *Regulations on Drug Inspection (Trial)*  ● **Inspection Types**:  - Licensing inspections (corresponding to *Drug Production License* issuance/renewal),  - Routine inspections (conducted based on risk grading and regulatory抽查 plans),  - Cause-based inspections (triggered by complaints, quality test failures, adverse reaction signals, etc.).
  ● **Inspection Organization and Procedures**:  - Conducted by regulatory authorities assigning inspectors and following established procedures, including:    - Pre-inspection preparation (enterprise information review, historical inspection records),    - On-site execution (first meeting, on-site/file verification),  
  - Deficiency notification at the final meeting,    - Enterprise corrective actions and submission of corrective reports.  ● **Corrective Actions and Re-evaluation**:  - Inspection conclusions: "Compliant," "Substantially Compliant" (with corrective deadlines), or "Non-compliant";  - Corrective reports must include evidence, with regulatory re-evaluation ensuring closure.  
● **Enterprise Compliance Key Points**:  - Establish inspection response SOPs, controlled documentation rooms, and evidence checklists;  - Implement accompaniment-response mechanisms to ensure timely corrections and evidence quality.
  1.2 Domestic Regulatory Trends and Risk Highlights  ● **Unannounced Inspections (Unannounced Checks)**:  - Routine, unannounced inspections focusing on data integrity, production compliance, and authenticity;  - Coverage rate has increased annually in recent years.  
● **Extended Inspections**:  - Targeted at contract manufacturers, raw material suppliers, and critical material producers to shift risk assessment upstream.  
● **High-Frequency Deficiencies**:  - Common issues include:    - Data integrity gaps (audit trails missing/permission sharing),    - Delayed handling of deviations/OOS (Out-of-Specification),  
  - Inadequate cleaning validation,    - Non-compliant change control,    - Discrepancies between documentation and on-site practices.  ● **Integrated Regulatory Oversight**:  - Multi-source signals (inspections, sampling, adverse reactions, complaints) may trigger concurrent investigations.  
1.3 U.S. cGMP Inspection Process  ● **FDA Inspection Types**:  - Pre-approval inspections (PAI),  - Routine surveillance inspections (approximately every 2 years),  
- Cause-based inspections.  ● **On-Site Outputs**:  - Inspectors document observations and fill out the FDA 483 Form, requiring enterprise sign-off;  - A 483 Form does not equate to penalties but requires a written corrective action plan within 15 business days.  
● **Escalation Pathways**:  - Severe or unresolved issues may escalate to:    - Warning Letters,    - Import Alerts/66-40,  

  - Consent Decrees (major compliance risks).  ● **Data Integrity Focus**:  - FDA’s 2023 revised *Data Integrity and cGMP Compliance Guidance* clarifies requirements for audit trails, computer system permissions, and retention of original records.

1.4 FDA Data Integrity and Audit Trail Guidelines  ● **ALCOA+ Principles**: Attributable (traceable), Legible (readable), Contemporaneous (recorded at the time), Original (first version), Accurate (correct) with Completeness (no missing data), Consistency (no contradictions), Endurance (permanent storage), and Availability (accessible).  

● **Audit Trail Requirements**: User, timestamp, and before/after values must be logged for electronic data creation, modification, or deletion. Audit trails must be secured against tampering and reviewed periodically.  
● **Computer System Access**: Separation of roles between system administrators and operational users; no shared accounts or passwords; uniqueness and traceability of electronic signatures.  
● **Data Lifecycle**: Full lifecycle management from generation, review, archiving to destruction. Original data (including spectra, integral parameters, reference material records) must remain complete and traceable.  
1.5 EU GMP Inspection Process and Standards  ● **EU GMP Framework**: EudraLex Volume 4 outlines GMP requirements and Annex series. Annex 1 (Sterile Products) underwent major revisions in 2022, imposing stricter demands on aseptic processes and contamination control strategies (CCS).  
● **Inspections and Certifications**: Regulatory authorities (e.g., MHRA, ANSM) conduct inspections per EU GMP guidelines. Compliance results in an EU GMP certificate (or compliance statement without certification) and data sharing via EudraGMDP database.  
● **Audit Focus Areas**: Emphasis on contamination control strategies, data integrity, supplier management, deviations & CAPA, and validation status (process/cleaning/equipment).  
1.6 PIC/S GMP Audit Approach, Remote Inspections, and Defect Categorization  ● **PIC/S Framework**: International organization promoting unified GMP inspection standards and mutual recognition. China has joined and aligned its standards.  
● **Remote Inspections**: Pandemic-driven remote assessment (via real-time video, file sharing, and data review). Requires pre-prepared digital documentation and online presentation capabilities.  
● **Defect Categorization**: PIC/S classifies defects into Critical, Major, and Minor tiers:    - **Critical**: Risks product safety/harms health (e.g., data falsification, aseptic failure, cross-contamination). Immediate action required (stop production/recall).

    - **Major**: Significant GMP deviations affecting quality (e.g., inadequate cleaning validation, unresolved CAPA, training gaps). Closure within 30 days.  

1.7 Forward Tracing and Reverse Tracing Audit Methods  ● Forward Tracing (trace forward): Proceed from the start of processes/records to the end, such as from batch production records → material balance → on-site inventory → finished product release, verifying process continuity and status consistency.  
● Reverse Tracing (trace backward): Trace back from on-site/product to the source, such as from equipment cleaning status → batch records → cleaning SOP → validation report, ensuring evidence closure for each step.  
● Combined Approach: Anchor on defects/abnormalities, cross-verify forward and reverse traces to rapidly identify broken links and root causes.  
**II. Elements and Process of Self-Audit and Audits**  2.1 Annual Self-Audit Plan  ● Plan Elements: Audit basis, scope (full production/testing/storage/utility systems/QM elements), frequency, timeline, auditor qualifications/independence.
  ● Compilation Logic: Prioritize based on regulatory updates, risk levels, historical defects, and product line characteristics. Increase frequency for high-risk elements (data integrity, sterility assurance, change/deviation management).  
| Element               | Frequency Suggestion | Coverage Content             | Responsible Party         |  |------------------------|----------------------|------------------------------|---------------------------|  | Comprehensive Self-Audit | 1x/year              | All GMP elements (EU/PIC/S)  | Quality Manager (lead)     |  | Specialized Self-Audit   | 2x/year              | Data integrity, cleaning validation, sterile process | QA Supervisor |  | Supplier Audit          | 1-2x/year            | Key materials/contract manufacturers | Procurement + QA joint |  
| Mock Regulatory Inspection | Random/1-2x/year    | Simulate regulatory audits   | Internal Audit Team        |  2.2 Self-Audit Process Elements  ● Checklist Design: Develop tickable, evidence-retaining checklists with sampling methods and judgment criteria aligned to regulatory clauses.  ● On-Site Observation & Interviews: Directly observe operations, verify on-site status/labels, and interview staff to confirm consistency between records and reality.  
● Sample Selection: Stratify sampling by batch/shift/time, covering multiple shifts/personnel to avoid single-point verification.  
● Evidence Retention: Combine images/copies/interview records/raw data into an evidence chain to support defect characterization.  
2.3 Defect Compilation & Grading  ● Grading Criteria: Apply Critical/Major/Minor standards (aligned with PIC/S) and assess impact on product quality/compliance.  
● Output: Generate defect list (numbered, description, clause basis, grade, evidence, responsible department) as input for corrective actions.  
2.4 CAPA & Closed-Loop Management  ● CAPA Development: Formulate corrective (eliminate existing issues) and preventive (prevent recurrence) measures based on root causes (5Why, Ishikawa diagram).
  ● Effectiveness Evaluation: Define verifiable metrics (reinspection, data backtracking, trend analysis) to confirm measure implementation effectiveness.  
● Closed-Loop Management: Track CAPA records for expiration/delay approval/closure review, forming "discover → correct → verify → close" loops, and reverse-check similar risks across the facility.

III. Audit Implementation Methods and Techniques  3.1 Checklist Development and Sampling Closed-loop  ● Checklist Development: Dual-column design (clauses + on-site evidence) with a主线 of "sampling—inference—verification," specifying sampling quantities and acceptance criteria for each item.
  ● Closed-loop Logic: Anomalies in sampling are reversed to verify overall compliance, avoiding conclusions based solely on single evidence.  
3.2 On-site Audit Focus Points  ● Workshop Verification: Personnel flow/logistics, cleanliness levels, labeling, in-process status, equipment clearance/verification.  
● Material Balance: Compare batch record inputs/outputs with actual inventory, validate loss rationality.  
● Equipment Cleaning: Verify cleaning status labels, last-use records, and cleaning validation coverage.  
3.3 Batch Records and Deviation Tracing  ● Batch Record Review: Confirm critical process parameters, IPC results, release decisions, and link to deviation/OOS records.  
● Deviation Tracing: Full-chain verification from deviation trigger → investigation → root cause → CAPA → release decision, emphasizing investigation depth and corrective effectiveness.  
3.4 Supplier Site Audit  ● Audit Scope: Material quality, process consistency, data integrity, CAPA, and change notification mechanisms.  
● Grading System: Score based on elements and risk levels, serving as a basis for maintaining qualified supplier lists.  
IV. Data Integrity Special Audit  4.1 Computerized System Verification  ● Access Control: Verify user list, role permissions, separation of administrator/business users, and locked inactive accounts.
  ● Audit Trail Functionality: Check activation, locking, and periodic review of audit trails in analytical instruments (HPLC/GC), LIMS, SCADA, and electronic batch records systems.  
● Original Data: Validate consistency between spectra/integral parameters/sequence, original electronic data, and printed records.  
4.2 Data Integrity Defect Evidence Chain Verification  ● Typical Defect Patterns: Data modification/deletion, selective data selection, unactivated audit trails, permission sharing, missing synchronization records.  
● Verification Methods: Cross-reference electronic logs, manual records, sample registration, and test results to identify contradictions and preserve evidence.