GMP · Good manufacturing practice for medicinal products (PIC/S, EU, WHO)
GMP compliance consulting for a plant that is ready for inspection on any working day.
Build a pharmaceutical quality system that holds up in a regulator's inspection, a Qualified Person's audit and a partner's due diligence: risk management, documentation and data integrity, qualification and validation, deviations and CAPA, self-inspection. Sterling's expert and experienced consultants work beside your QA, QC and production teams in 60+ countries, from gap analysis to inspection and beyond. We ensure a successful GMP compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced pharmaceutical GMP consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling prepares the pharmaceutical quality system, the documentation and your inspection readiness; the regulator inspects and decides
8,100+ client engagements in 60+ countries.
GMP client experience
What it is
What is GMP and what is it used for?
Good manufacturing practice (GMP) is the part of pharmaceutical quality management that makes sure every batch of a medicine is made and checked to the quality its intended use and its marketing authorisation demand. Regulators write the requirements, not a standards body: the EU guide in EudraLex Volume 4; the PIC/S GMP Guide, developed in parallel with the EU text and practically identical to it, maintained by a co-operation of 57 regulatory authorities; the WHO GMP texts, which underpin the WHO Certification Scheme and WHO prequalification inspections; and national codes such as the US FDA's 21 CFR Parts 210 and 211 and India's revised Schedule M, notified on 28 December 2023.
The practical test is not whether the SOPs exist. It is whether an inspector, reading your records cold, can follow any batch from starting material to release and see that it was made as authorised, that anything unexpected was investigated, and that someone independent of production decided it was fit to leave the site. A system that passes that test every day is inspection-ready; one assembled the month before is not.
Current texts. The PIC/S GMP Guide is at revision PE 009-18, in force since 24 September 2026, which revised Annex 19 on reference and retention samples; PE 009-17 of 25 August 2023 brought in the revised Annex 1. In the EU, the revised Annex 1, published in August 2022, came into operation on 25 August 2023, with point 8.123 following on 25 August 2024. WHO's main principles are TRS 986, Annex 2; its sterile GMP was revised with the EU and PIC/S as TRS 1044, Annex 2. Revisions to Chapter 1, Chapter 4 and Annex 11 and a new Annex 22 were consulted on in 2025 and are not yet adopted. Which text binds you is set by the regulator that licenses you and by the markets you supply. The 2025 GMP revisions and what they mean for your site
Who it is for
Who needs GMP compliance?
GMP applies to every organisation that manufactures medicines or active substances, or carries out part of that work for one: finished-dose, sterile, biological and API manufacturers, contract manufacturers and packagers, the testing laboratories they rely on, and importers that release batches. The obligations travel with the product: a plant that satisfies its national code can still fail a partner's audit or an importing regulator's inspection. Organisations come to Sterling for GMP from four starting points:
- A licence, a new line or a pre-approval inspection is coming. The regulator inspects before it licenses the site or approves the product, and the system must have run long enough to show records, not intentions.
- You want to export, or a partner wants you to. A marketing authorisation holder's audit, a Qualified Person's audit, an importing country's inspection, a Certificate of Pharmaceutical Product or WHO prequalification all expect the EU, PIC/S or WHO standard, not only the national minimum.
- An inspection or partner audit found gaps. Observations on data integrity, deviations, CAPA, validation or contamination control, each with a response date. The regulator expects a credible plan, then evidence it worked.
- The requirements moved and your system did not. The revised Annex 1 for sterile manufacture, India's revised Schedule M, a move from a national code to PIC/S, or a dosage form or technology your current system was never designed for.
The aim is a plant that could receive an inspector on any working day and show, from its own records, that it is in control. That depends on the system operating, not on a document set.
Business benefits
How GMP compliance supports patient safety and market access
GMP repays the effort in three places: batches you never reject, inspections that close cleanly and markets that open to you. We start where your products are most exposed, usually contamination control, data and the deviation system, and build outwards.
- Inspections without surprisesSelf-inspection and management review find the issues first, and the CAPA closes on evidence.
- Batches released on evidenceA Qualified or authorised person who sees the whole record, materials, deviations, changes and results, before certifying.
- Fewer repeat deviationsInvestigations that reach a proven root cause rather than "human error", so the same deviation does not return next quarter.
- Markets and partners that openA system built to the EU, PIC/S or WHO standard that importing regulators, marketing authorisation holders and WHO prequalification look for.
- Contamination and mix-ups designed outPremises, flows, cleaning and, for sterile products, a contamination control strategy that prevents problems instead of detecting them late.
- Data an inspector can trustComputerised systems validated, audit trails reviewed, and paper and electronic records kept complete, consistent and traceable.
Measure what matters: repeat deviations, CAPA closed on time and shown to work, batch records right first time, and the age of your open observations. A thicker SOP binder is not a GMP result.
Requirements
What are the main GMP requirements?
The EU and PIC/S guides share one structure: Part I, nine chapters for medicinal products; Part II for active pharmaceutical ingredients, on a text developed by ICH; and annexes for particular products and activities. The EU adds Part III for related documents such as ICH Q9(R1) and Q10, and Part IV for advanced therapy medicinal products. WHO GMP and national codes cover the same ground in their own order. The table maps Part I and the four annexes our clients ask about most; your programme is checked against your regulator's text, paragraph by paragraph, during the build.
| Chapter or annex | What it requires of you | What it looks like in practice |
|---|---|---|
| 1 Pharmaceutical quality system | A quality system incorporating GMP and quality risk management, with senior management ultimately responsible for it | Management review, annual product quality reviews, change control, deviations and CAPA, risk assessments sized to the risk |
| 2 Personnel | Enough qualified people; key personnel with defined duties, heads of production and quality control independent of each other; training; hygiene | Job descriptions, training for everyone entering production, storage or laboratories, cleaning and maintenance staff included, hygiene rules |
| 3 Premises and equipment | Premises and equipment that avoid errors and prevent cross-contamination, with dedicated facilities where the risk cannot otherwise be controlled | Flows, HVAC and utilities, calibration, maintenance and cleaning records, a cross-contamination assessment based on toxicological evaluation |
| 4 Documentation | Specifications, formulae, instructions, procedures and records, controlled; batch documentation kept one year after expiry or five years after certification, whichever is longer | Controlled documents, good documentation practice on the shop floor, batch records reviewed before release |
| 5 Production | Operations to defined procedures and the marketing authorisation; cross-contamination controls; qualified suppliers of starting materials; supply constraints reported | Line clearance, in-process controls, supplier qualification and audits, material reconciliation |
| 6 Quality control | Quality control independent of production; sampling and testing; out-of-specification results investigated; an on-going stability programme | Approved specifications and methods, laboratory records, OOS investigations, stability data, retention samples |
| 7 Outsourced activities | A written contract setting each party's duties; the contract acceptor's competence assessed first and its performance monitored | Technical agreements with contract manufacturers and laboratories, audits and performance reviews |
| 8 Complaints and product recall | Investigate complaints and potential quality defects, including possible falsification, to root cause and CAPA; inform competent authorities in time; evaluate recall arrangements periodically | A defect log, investigation reports, regulator notifications, a recall procedure tested, for example by mock recall |
| 9 Self inspection | Examine every area of GMP to a pre-arranged programme, independently, by designated competent people; record findings and actions | A programme covering every chapter, reports with CAPA, follow-up recorded to closure |
| Annex 1 Manufacture of sterile medicinal products | A contamination control strategy, actively reviewed; cleanroom grades A to D; isolators or RABS; aseptic process simulation; environmental and process monitoring | The CCS and its reviews, cleanroom qualification, simulation records, monitoring results acted on |
| Annex 11 Computerised systems | Risk-based validation and control of every GMP computerised system: suppliers, data, audit trails, change, security, e-signatures, archiving | A system inventory, validation packages, audit trail reviews, access and backup controls, periodic evaluations |
| Annex 15 Qualification and validation | Qualification from URS through DQ, IQ, OQ and PQ; process validation with ongoing verification; cleaning validation; change control | A validation master plan, protocols and reports, a requalification schedule, justified cleaning limits |
| Annex 16 Certification by a Qualified Person and batch release | Before certification: manufacture and testing to GMP and the marketing authorisation, supply chain documented, site audits done (PIC/S: authorised person) | Batch certification records, supply-chain maps, an audit schedule, a documented approach to unexpected deviations |
What does useful GMP evidence look like?
Executed batch records reviewed before release; deviation, OOS, change control and CAPA logs; annual product quality reviews; the validation master plan with its qualification, validation and cleaning validation reports; training records; supplier and contract acceptor audits; complaint and recall files; self-inspection reports; audit trail reviews; and the site master file. We identify the records your processes need, without writing procedures nobody follows, and they live in Effivity from the first workshop so an inspector sees a system that runs.
GMP requirements explained, chapter by chapterCompliance process
How do you become GMP compliant?
Nobody can sell you GMP compliance, because it is a finding the regulator makes by inspecting you. The work is to build a quality system that meets the applicable guide, run it until it has produced the records that prove it, then open your doors: to the inspectorate, to partners' auditors and to Qualified Persons. Sterling builds the system and the evidence with you; the regulator inspects and decides.
- 01Define the products, sites and the GMP text that applies.Dosage forms, sterile or not, active substances, lines, sites and markets, and which guide each inspector will use.
- 02Gap analysis: review current operations against the applicable GMP guide.The gap analysis walks the plant, the laboratories and the records, chapter by chapter and annex by annex, retains what works and gives each action an owner and a date.
- 03Build the quality system, qualify and validate.Quality risk management, documentation and data integrity controls, qualification of premises, equipment and utilities, process, cleaning and computerised-system validation, and training.
- 04Self-inspect, review and close the findings.A self-inspection against every chapter and applicable annex, a mock inspection and a management review; we raise findings before any inspector does, and they close on evidence.
- 05Host the inspection and answer the observations.The regulator's licensing, pre-approval or routine inspection, or a partner's audit; observations answered with CAPA inside the deadline, then the regulator's decision.
- 06Stay compliant between inspections.Product quality reviews, change control, requalification, the stability programme, self-inspections and training continue, alongside re-inspection on the regulator's own schedule.
Judge an offer by its credibility, not its price. PIC/S states that it does not inspect or certify companies and that GMP certificates are issued by its Participating Authorities; a "GMP certificate" from a certification body proves nothing to an inspector. Ask any provider which gaps they will close, what validation work is included, who will train your staff and which records you will own. How to choose a credible GMP provider · The compliance buyer's checklist
Cost
How much does GMP compliance cost?
No responsible consultant quotes GMP compliance from a price list. A non-sterile tablet plant lifting its documentation to PIC/S level is a different programme from a sterile injectables site closing Annex 1 gaps or an API plant facing its first export inspection. Our commitment is a proposal that shows every component and fixes the consulting fee.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current maturity, dosage forms and technologies, sterile or non-sterile, number of lines and sites, deliverables and how much of the work your team takes on (Design™ or Drive™) |
| Facilities, qualification and validation | Equipment, utility and facility upgrades the gap analysis calls for, qualification testing, validation batches and laboratory work, identified separately |
| Regulatory fees | Licence, inspection and certificate fees where your regulator charges them, listed separately so programmes compare like for like |
| Internal resources | Time from production, QC, QA and engineering for drafting, review, training and changes on the floor |
| Software and learning | Included in a Sterling engagement: Effivity for the quality system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Self-inspections, product quality reviews, requalification schedules, refresher training and the coming revisions of Chapter 1, Chapter 4 and Annex 11, under Sustain™ |
What moves the price
- Sterile or non-sterile, and the number of dosage forms and technologies
- Sites, lines and the markets whose inspectors you must satisfy
- The state of qualification, validation and data integrity today
- Open observations and their deadlines, and how much your team can carry
- Contract manufacturers, laboratories and API suppliers to qualify
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Capital works, validation testing and regulator fees identified separately
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does GMP compliance take?
A realistic GMP programme takes six to eighteen months before the inspection: longer for a new sterile facility, shorter where the plant is sound and the gaps sit in documentation and data. Qualification and validation set the pace: equipment qualified, processes and cleaning validated on real batches, and enough deviations, changes and reviews generated to show the system works. We plan around the records an inspector will sample, with milestones tracked in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to the plant, laboratories, batch records, validation files and previous inspection reports |
| Build and implementation | The extent of documentation, data integrity and training work, and any facility or equipment changes |
| Qualification, validation and evidence | Qualification schedules, validation batches, cleaning studies and the time the system needs to operate, followed by self-inspection and management review |
| Regulator or customer review | The inspectorate's scheduling of a licensing, pre-approval or routine inspection, partners' and Qualified Persons' audits, and the time needed to answer observations |
If a licence, an export registration or a partner's audit depends on the programme, share the date at the start. We will say plainly what is achievable and which decisions must be made early; nobody should promise an inspection outcome before walking your plant.
Challenges
Common GMP implementation challenges
Five problems account for most stalled GMP programmes, and each can be fixed.
Data integrity observations: records an inspector cannot rely on.
Shared logins, audit trails nobody reviews, results reprocessed until they pass, paper and electronic records that disagree. We map every GMP computerised system, set access and audit trail review to Annex 11 and PIC/S guidance PI 041 on data integrity, and train the people who create the records.
Deviations close, then come back.
"Human error" is recorded as the root cause and retraining as the fix. We rebuild the investigation method so causes are proven, CAPA effectiveness is checked and repeat events show in the trend before an inspector finds them.
The contamination control strategy is a document, not a strategy.
Annex 1 asks for a strategy across facility and process that is actively reviewed and drives improvement. We build it from your own risk assessments and monitoring data, so it steers decisions rather than summarising them.
Validation stopped at the protocol.
Equipment qualified once and never reviewed, cleaning limits nobody can justify, process validation with no ongoing verification. We set up a validation master plan, a requalification schedule and change control that triggers revalidation.
Different markets expect different GMP texts.
EU, PIC/S, WHO and national codes overlap heavily but not completely. We build one quality system to the most demanding text your markets apply and map the national additions, so each inspector finds their requirements in the same system.
Your engagement
What your GMP engagement includes
Your agreed scope brings together everything an inspection-ready system and a prepared workforce need. Many providers hand over an SOP pack and leave the plant to bring it to life; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.
Scope, gap analysis and implementation plan
Products, sites, the applicable GMP text and every gap against it, with responsibilities, dates and decision owners agreed before work starts.
Pharmaceutical quality system and documentation
Quality manual, SOPs, master documents and records on Sterling's own template sets, written with your process owners, with risk management and data integrity built in.
Effivity ISO & GRC software
Your quality system runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your self-inspection team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Self-inspection and management review
A self-inspection against every chapter and applicable annex, conducted or facilitated as agreed, and a management review, with findings closed with evidence before the inspector arrives.
Inspection readiness and support
A mock inspection, your hosts and document room prepared for inspection day, and support with the response to observations until they close.
Inspection outcomes, GMP certificates and licensing decisions remain with the regulator.
How we deliver
How Sterling supports your GMP implementation
Every GMP engagement runs on Sterling OS™, our delivery operating system: five phases with defined deliverables, decision owners and evidence at each stage. Choose the level of support that matches your capacity; the method, the software and the accountability stay the same.
- 01Design™Guided implementation: your team builds the pharmaceutical quality system with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed work, from gap analysis to validation planning and training, with your QA and production owners.
- 03Sustain™After the inspection: self-inspections, product quality review support, requalification schedules, refresher and new-hire training and partner audit support, year after year.
- 04Automate™The quality system running in Effivity: SOPs, training, deviations, CAPA, change control, complaints, audits and management review in one workspace.
- 05Revise™Changes in the guides, such as the coming Chapter 1, Chapter 4 and Annex 11 revisions and Annex 22, and changes in your products, sites or markets.
At kick-off we agree who leads for Sterling, when the weekly working session runs, what gets delivered and who signs off. Progress is tracked against those commitments, so a gap appears on our list long before an inspector's.
How Sterling OS™ worksOften combined with
Standards organisations pair with GMP (PIC/S, EU, WHO)
- 21 CFR Part 11 / EU Annex 1121 CFR Part 11 and Annex 11 compliance for GxP systems: requirements, validation, audit trails and e-signatures, with evidence ready for FDA and EU inspectors.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CAP accreditationCAP accreditation readiness for laboratories: checklist gap analysis, method records, self-inspection and peer inspection support.
- EU IVDR 2017/746EU IVDR compliance consulting for IVD manufacturers: performance evidence, QMS, traceability and post-market follow-up prepared for your notified body.
- EU MDR 2017/745EU MDR compliance consulting for CE marking: QMS, technical documentation, traceability and post-market surveillance prepared for your notified body.
- FDA QMSR (21 CFR 820)FDA QMSR compliance consulting for device makers selling in the US: a quality management system ready for FDA inspection, wherever you manufacture.
Effivity · GMP quality management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the PIC/S GMP Guide (PE 009-18) and EU GMP.
Every Sterling GMP engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the quality workspace within the agreed scope, so SOPs, training records, deviations, CAPA, change control, complaints, supplier audits, calibration and maintenance, self-inspections and management review live in one place and an inspector sees live records rather than binders. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Change control, deviations and CAPA
Changes assessed for quality and regulatory impact before approval, deviations and OOS results investigated to root cause, CAPA tracked to an effectiveness check, and review inputs gathered as the year runs.
Training, qualification and responsibilities
A training matrix by role, GMP and SOP training records with assessments, job descriptions for key personnel, and new starters trained for the areas they work in.
Equipment, calibration and maintenance
Every instrument and item of equipment with its calibration, maintenance, qualification and cleaning status, and overdue items escalated before they become an observation.
SOPs, specifications and master documents
Controlled documents with versions, approvals, linked training and review dates, so the version on the shop floor is the approved one and retention is applied, not remembered.
Starting materials and their suppliers
Suppliers of starting and packaging materials qualified, approved and re-evaluated, with audits and quality agreements linked to each material.
Contract givers and contract acceptors
Written contracts and technical agreements, the competence assessment before outsourcing and the performance reviews after it, for every contract manufacturer and laboratory.
Complaints, quality defects and recalls
Each complaint assessed for a quality defect or possible falsification, investigated to root cause and notified where required, and recall arrangements tested periodically.
Self-inspection programme and findings
A programme covering every chapter at planned intervals, independent inspectors, reports with observations and corrective measures, and follow-up recorded to closure.
What this means at the audit
An inspector asks for the deviation log, open CAPA, recent change controls, the training records of the operators on shift and the last self-inspection report. In Effivity each is a screen, with dates, owners and evidence attached, not files pulled together the night before. Where Effivity holds GMP records it is itself a computerised system under Annex 11, so it joins your inventory and is validated for its intended use like any other. After the inspection, Sustain™ runs in the same workspace.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your SOPs, registers and logs migrated, not retyped
- Admin and user training for your team
- Modules for QMS, EMS, OHSMS and more when you integrate other standards
GMP client experience
Client letters on file, available on request.
Signed client letters for GMP are available on request. The client feedback wall lists every letter by standard.
How a GMP programme runs
One quality system, every inspection.
- 01How an integrated pharmaceutical quality programme runs
Pharmaceutical manufacturing: GMP, ISO 9001 and GDP as one quality system
How a programme of this kind runs: the pharmaceutical quality system required by Chapter 1 is the core; ISO 9001 is mapped onto it for customers and tenders that ask for certification, and good distribution practice extends it to warehousing and transport. Document control, change control, CAPA, supplier qualification, self-inspection and management review run once for all three, so one evidence base answers the inspector, the certification body and the distribution partner.
Sterling Academy · GMP e-learning
Train every employee on GMP, not just the quality unit.
Chapter 2 of the GMP guides expects training for everyone whose duties take them into production, storage or the laboratories, cleaning and maintenance staff included. Sterling Academy delivers e-learning for the whole workforce and for those who run the system: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- GMP awareness for operators, warehouse, laboratory, cleaning and maintenance staff, with the records Chapter 2 expects
- Practitioner courses for QA, QC, production supervisors and document owners
- Internal auditor training for the people who will conduct self-inspections, as applicable to your standard, as part of the engagement
- Learner progress by department and shift, and a training status report for the inspector
- New starters trained as they join, so the records are current at every inspection
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for a GMP programme
The courses your people take, and who takes them.
GMP Awareness
What GMP asks of everyone in production, storage, the laboratories, cleaning and maintenance: hygiene, documentation, deviations, line clearance and why a shortcut becomes a patient risk. The training evidence Chapter 2 expects.
Coming soon: view the courseDocumented Information Management
Good documentation practice for SOPs, specifications, batch records and logbooks: how records are made, corrected, reviewed and retained, and kept complete and traceable, on paper or electronically.
View the courseNonconformity Management
Handling deviations, out-of-specification results and complaints: investigation, root cause beyond "human error", CAPA, and the effectiveness check that shows a fix worked.
View the courseRisk Management
Quality risk management as ICH Q9(R1) and Chapter 1 describe it: identifying, evaluating and controlling risks to product quality, with the effort, formality and documentation matched to the level of risk.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will conduct self-inspections, with practical exercises on your own processes and records and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO 9001, ISO 13485, ISO 14001, ISO 45001 and more, so a site that combines GMP with a certified management system trains one workforce on one platform.
See all coursesSterling consulting clients arrange access through their consultant. Sterling Academy certificates are training certificates for the people who complete the courses; GMP compliance is established by the regulator's inspection, not by any certificate we issue.
Keep exploring
Explore more about GMP (PIC/S, EU, WHO)
Watch a video on how to implement GMP here.
Watch a video on GMP requirements here.
Why Sterling
Want successful GMP compliance? Come to Sterling.
Whether you run one oral solid dose plant or a group of sites supplying several regulated markets, Sterling builds a pharmaceutical quality system your regulator recognises and your operators can live with. We reconcile the differences between EU, PIC/S, WHO and national texts, partners' expectations and the realities of an operating plant, so the system supports growth instead of slowing every batch.
In 60+ countries since 2003
Manufacturers, distributors and laboratories supported across continents, with one engagement team accountable across every site and market you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with capital works, validation testing and regulator fees identified separately. No surprises, ever.
A system your people can run
Fewer, clearer SOPs and maximum effect: documents, training and software connected to the way operators, analysts and supervisors actually work, so the system is followed rather than worked around.
Expert and experienced consultants
Consultants who have advised on quality management systems across sectors and countries since 2003, and who build your pharmaceutical quality system properly the first time, so the inspection confirms what already works.
The Sterling Promise
What our GMP compliance success guarantee means
We stay with you until your agreed GMP compliance outcome is achieved: the quality system built, the evidence in place, and the inspection or partner audit your engagement defines supported until its observations are closed. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than an SOP pack with a revision date.
The engagement identifies the GMP text, scope, outcome and responsibilities. Your organisation supplies accurate information, carries out the agreed facility and validation work and puts the agreed controls into use. The regulator inspects and retains its decisions on GMP certificates and licences. Our commitment concerns the agreed compliance support, not a promise of a particular inspection classification or that no quality defect will ever occur.
After the inspection
What happens after you become GMP compliant?
A clean inspection is a snapshot, and the regulator will return. Between visits the system has to keep working: product quality reviews every year, changes controlled and validated, equipment requalified, the stability programme maintained, self-inspections on schedule and new people trained. The next inspector will ask what changed and how you knew each change was safe.
Under Sterling OS™ Sustain™ we review deviations, CAPA, changes and product quality review data with you alongside planned self-inspections and management reviews, so the system is ready on any working day, not revived when the inspection notice arrives. When the revised Chapter 1, Chapter 4, Annex 11 or the new Annex 22 are adopted, Revise™ turns them into a dated plan.
FAQs
Frequently asked questions about GMP
Is there such a thing as GMP certification?
Not from a certification body. Compliance with pharmaceutical GMP is established by the national medicines regulator through inspection; where it finds compliance it issues a GMP certificate or licence, and in the EU the certificate, or a statement of non-compliance, is entered in EudraGMDP. PIC/S states that it does not inspect or certify companies and that GMP certificates are issued by its Participating Authorities. A "GMP certificate" from a certification body has no regulatory standing.
What is the difference between EU GMP, the PIC/S GMP Guide and WHO GMP?
The EU guide and the PIC/S guide are developed in parallel and are practically identical; the visible differences are mostly vocabulary, such as the PIC/S "authorised person" for the EU's "Qualified Person". WHO GMP, with its main principles in TRS 986, Annex 2, covers the same ground in its own structure and underpins the WHO Certification Scheme and WHO prequalification. Your regulator decides which text it inspects against.
Our regulator is not a PIC/S member. Why should PIC/S matter to us?
Because your partners and importing markets may be. PIC/S brings together 57 regulatory authorities, among them the US FDA, the UK's MHRA, Health Canada, Australia's TGA, Singapore's HSA and, since January 2026, Jordan's JFDA; the UAE's Emirates Drug Establishment has a pre-accession application under review. An importing regulator or a partner may assess your site against that standard, whatever your national code says.
Does the revised Annex 1 apply to us?
It governs sterile manufacture. In the EU it came into operation on 25 August 2023, with point 8.123 from 25 August 2024, and the PIC/S guide carries it from PE 009-17. Its scope notes that some of its principles may support the manufacture of products not intended to be sterile, so non-sterile sites with microbiological risks read it too. Its centre is a contamination control strategy, actively reviewed, across the facility and process.
Can ISO 9001 certification replace GMP?
No. ISO 9001 is a management system standard certified by certification bodies; GMP is a regulatory requirement inspected by medicines regulators. They sit together well: ICH Q10, in the EU's Part III, describes a pharmaceutical quality system model across the product lifecycle, and the two can run as one system. The inspector still looks for GMP, chapter by chapter.
Does Sterling inspect or certify our GMP compliance?
No, and no consultant can. Sterling builds the quality system and the evidence with you, conducts or facilitates self-inspections and a mock inspection as preparation, and supports your response to observations. The regulator inspects and decides; partners' auditors and Qualified Persons reach their own conclusions.
What is a "WHO GMP certificate", and who issues it?
Under the WHO Certification Scheme, the Certificate of Pharmaceutical Product is issued by the competent authority of the exporting country, at the request of a commercially interested party. It attests that the product is authorised there, that the plant is inspected at suitable intervals for conformity with GMP as recommended by WHO, and that the product information is authorised. It is the national authority's certificate, not WHO's, and it should not carry the WHO logo.
What is changing in the GMP guides next?
The EU and PIC/S consulted in 2025 on a revised Chapter 1, reflecting ICH Q9(R1), knowledge management and the prevention of shortages, and on a revised Chapter 4, a revised Annex 11 and a new Annex 22 on artificial intelligence in manufacturing. None had been adopted by September 2026; Chapter 1 dates from 2013, Chapter 4 and Annex 11 from 2011. Separately, a revised Annex 19 applies from 24 September 2026.
What do you need to prepare a GMP proposal?
Your products and dosage forms, sterile or not, the sites and lines, your regulator and export markets, the last inspection or partner audit report, the state of validation, approximate headcount and your deadline. That is enough to scope the work and fix the fee; nothing new needs writing first.
Before the first call
Prepare a useful GMP readiness brief
Nothing needs to be written before the first discussion. A short account of what you make, where and for which markets is the start, framed by seven questions:
- Which products, dosage forms and active substances are in scope, which are sterile, and which markets do you supply or plan to enter?
- Which regulator inspects you today, which GMP text does it apply, and when is the next inspection or licence renewal?
- What did your last inspection or partner audit find, and which observations are still open?
- How are deviations, out-of-specification results, changes and CAPA handled today, and do they close with evidence?
- What is the qualification and validation status of premises, equipment, utilities, processes, cleaning and computerised systems?
- Which activities are outsourced, such as manufacturing, testing or API supply, and are technical agreements and audits in place?
- Who will own decisions and give time to the programme, and is there a licence, export registration or partner audit date to plan around?
With these answers we can scope and price the work accurately. They open a conversation; they are not a scored assessment or a verdict on compliance.
Don’t be fooled by certification scams
If it takes ten days, it is not GMP compliance.
GMP cannot be bought, only built and then inspected, so the market sells substitutes: "GMP certificates" from unaccredited bodies no regulator recognises, "PIC/S certified" and "WHO-GMP certified" seals, and SOP packs with another company's name in the footer. They cost little, until an importing regulator, a Qualified Person or a partner's auditor asks for the inspection behind them.
How to choose a credible GMP provider
- Ask who issued the certificate. Only a medicines regulator issues a regulatory GMP certificate, on the basis of an inspection; PIC/S itself states that it does not inspect or certify companies.
- Check it where the regulator publishes it. EU GMP certificates and non-compliance statements are in the public EudraGMDP database; elsewhere, ask the regulator named on it to confirm.
- Read "WHO GMP" claims carefully. Under the WHO Certification Scheme the exporting country's own regulator issues the certificate; it is not WHO's, and a private body's document is not it.
- Ask what qualification, validation and data integrity work is included. A document pack without them leaves the hardest gaps exactly where they were.
- Ask how your staff will be trained and what training records will exist. Chapter 2 expects training for everyone whose work can affect quality; a framed certificate trains nobody.
- Walk away from "GMP certified in 7 days", "PIC/S certificate included" and one invoice for consulting and certificate. A pharmaceutical quality system has to be built and operated before it can be inspected.
Keep exploring
More on GMP (PIC/S, EU, WHO) and related standards
More in Healthcare, medical devices & life sciences
Talk to a consultant
Plan your GMP compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice