What is a GMP gap assessment?

Short answer: A GMP gap assessment is a structured comparison of current practice and evidence against defined Good Manufacturing Practice requirements. It identifies where controls are missing, weak or not working as intended, assesses the associated risk and provides a prioritised basis for remediation.

A useful assessment goes beyond reading procedures. It tests whether approved requirements, actual behaviour and contemporaneous records agree during routine operation, after change and when a deviation places the system under pressure.

What should a GMP gap assessment cover?

The scope should reflect the site, products, processes and reason for the review. Depending on the objective, it may examine:

Pharmaceutical Quality System governance, Quality oversight and management review.

Personnel responsibilities, training, competence and resourcing.

Premises, utilities, equipment, maintenance and calibration.

Documentation, records, data integrity and computerised systems.

Materials, suppliers, outsourced activities and technical agreements.

Production, laboratory controls, validation and continued process control.

Deviation, investigation, CAPA, change control, complaints and recall readiness.

For sterile operations, contamination control, environmental monitoring, aseptic practice and maintenance of the validated state.

How should the scope and criteria be defined?

Start with a written objective. A broad site review, a focused sterile-manufacturing review and a pre-inspection readiness assessment are different exercises. Define the processes, systems, products, locations and time period included, together with exclusions and their rationale.

The assessment criteria should be traceable to current applicable requirements and the organisation’s own approved commitments. These can include EU GMP, relevant annexes and guidance, licence conditions, marketing-authorisation commitments, approved procedures, validation strategies, quality agreements and risk controls. Clause-by-clause checklists can support coverage, but they do not replace professional judgement or evidence testing.

How is evidence tested?

Assessors should triangulate evidence rather than accept one source in isolation. Review controlled documents and completed records, interview process owners and operators, observe work where possible, and sample deviations, changes, training files, audit trails, maintenance records and management information.

The central test is whether the control is designed appropriately, implemented consistently and demonstrably effective. A procedure may appear compliant while the records show repeated workarounds, late entries, weak review or actions that do not prevent recurrence.

How should gaps be prioritised?

Each gap should describe the requirement or expected control, the objective evidence seen, the actual weakness and its potential impact. Prioritisation should consider patient and product risk, contamination-control impact, data reliability, regulatory exposure, recurrence, detectability and the extent of the affected system.

Labels such as critical, major and minor must be defined within the assessment method; they are not a substitute for a documented rationale. Immediate containment may be necessary before the full remediation plan is agreed.

What should the output include?

A clear scope, criteria, methodology and assessment team.

Evidence-based findings linked to the relevant system or requirement.

A transparent risk or priority rationale and any urgent containment.

Named owners, realistic target dates and dependencies.

Recommended corrective, preventive or improvement actions.

A route into CAPA, change control, validation and governance as applicable.

Defined effectiveness checks and a method for reporting residual risk.

Is a gap assessment the same as an audit or self-inspection?

Not exactly. All three may use interviews, observation and record review. A self-inspection is a formal GMP mechanism for monitoring implementation and compliance and recording corrective measures. An audit commonly evaluates conformance against agreed criteria and may include suppliers or contractors. A gap assessment is often commissioned to establish the distance between the current and desired state and to support a change or remediation programme.

The labels matter less than clear independence, competence, scope, evidence, reporting and follow-through. If the exercise fulfils a formal self-inspection or audit obligation, the organisation should manage it through the applicable approved process.

Common weaknesses

The scope is too broad to test deeply or omits high-risk interfaces.

The review relies on SOPs without sampling records or observing practice.

Findings state opinions but do not record objective evidence.

Priorities reflect ease or cost rather than patient and product risk.

Actions are vague, have no accountable owner or are closed on completion alone.

Repeat themes are treated separately instead of as a systemic weakness.

The final report is not connected to CAPA, change control or management oversight.

Questions to ask internally

What decision will this assessment support, and is the scope precise enough?

Are the criteria current, applicable and traceable?

Have we tested actual execution as well as written requirements?

Could another competent reviewer reproduce the conclusion from the evidence?

Are urgent risks contained and product impact assessed?

How will actions be governed, funded and checked for effectiveness?

What residual risk remains after the plan is completed?

Official reference points

EU GMP Chapter 9 describes self-inspection as a means of monitoring GMP implementation and proposing corrective measures. The European Commission’s EudraLex Volume 4 provides the wider GMP framework against which assessments should be tailored.

How W2 can help

W2 Cleanroom Consulting can provide an independent, evidence-led gap assessment of cleanroom, sterile, validation and operational GMP systems. We can help define a proportionate scope, challenge weak assumptions, test whether controls work in practice and translate findings into a prioritised remediation plan.

W2 provides independent consultancy support. The client remains responsible for licence obligations, Quality approval, QP or RP decisions, local Pharmaceutical Quality System control and regulatory correspondence.

Operational GMP Compliance Support UK

GMP inspections

GMP inspection remediation support

Pharmaceutical Quality System support

What is GMP remediation?

Need help with a live GMP, cleanroom or aseptic operation? Contact W2 Cleanroom Consulting at info@w2cleanrooms.com for independent compliance review, inspection readiness or remediation support.

Prepared and reviewed by: W2 Cleanroom Consulting GMP team. Last reviewed: 24 July 2026.