cGMP (Current Good Manufacturing Practice)

cGMP means current good manufacturing practice, a framework of manufacturing methods, facilities and controls intended to maintain consistent product quality. This is an explanatory definition: the general term is not a universal legal checklist. Applicable requirements depend on the product, activity and jurisdiction.

“Current good manufacturing practice,” “CGMP regulations” and “current GMP” are related expressions, not separate standards. “CGMP regulations” specifically points to the applicable legal rules rather than manufacturing practice in general. This entry focuses on manufacturing; the broader family of good-practice disciplines is covered in the GxP glossary.

Operationally, “current” prompts a concrete question: do the controls still fit the product, process, known risks and available process knowledge? A procedure’s age does not answer that question. An established method may remain effective, while a recently revised instruction may overlook a changed operating condition. Likewise, a new software platform does not, by itself, demonstrate effective control.

For example, suppose a mixing process moves to a different vessel size. A practical review asks whether existing mixing instructions and checks still support consistent results under the changed conditions, drawing on relevant process validation knowledge. Neither retaining the old procedure nor replacing it with a digital workflow settles the question. This interpretation of “current” is a control-review principle, not a prescription to buy the newest equipment or software: assess effectiveness against what is now known about the process.

Read cGMP expectations through four categories. Keep the source of an obligation separate from the method chosen to implement it.

1. Binding US regulatory provisions. 21 CFR 210.1(a) identifies Parts 210, 211, 213, 225 and 226 as containing minimum current good manufacturing practice for drug manufacturing methods, facilities and controls. Do not treat Parts 210 and 211 as an exhaustive map of every drug-related manufacturing situation.
2. Official explanatory material and EU GMP guidelines in their respective contexts. The FDA QMSR overview explains the amendment of device CGMP requirements in Part 820; the overview is not the binding regulation itself. Read EU GMP guidelines within their EU context, rather than treating them as US provisions.
3. Recognised operating practice. Practical recommendations describe ways to organise control and evidence, not additional legal requirements. Evaluate them against the applicable rules and the process concerned; GAMP 5 is a related reference for computerised-system practice.
4. Software support. Software may help organise records, permissions and review workflows. Design implementation around responsibilities, evidence access and exception handling—not an assumption that a workflow establishes compliance. Approval and release decisions remain with authorised people.

Start with the product, intended use, jurisdiction and manufacturing activity—not a site-wide “cGMP” label. The map below identifies regulatory routes and scope questions. Its operational consequences are practical scoping recommendations, not additional legal requirements or a universal checklist.

For a mixed portfolio, a useful practice is to maintain one applicability record per product route, with the rationale, responsible reviewer and unresolved questions. For example, a material sold for two different intended uses should trigger two scope assessments, not an assumption that its shared chemical identity settles the issue. Shared equipment or procedures can then be evaluated against each relevant route without making every rule apply to every operation.

For drug manufacturing, quality control is a decision-making authority, not merely a testing function. Under 21 CFR 211.22(a), the quality control unit has responsibility and authority to approve or reject all components, drug product containers, closures, in-process materials, packaging material, labeling and drug products. It also has authority to review production records to assure that errors have not occurred or, where they have, that they have been fully investigated. These drug quality-control responsibilities should not be treated as a universal organisational rule for every product sector.

That authority also reaches the instructions governing production. 21 CFR 211.22(c) assigns the unit responsibility for approving or rejecting procedures and specifications affecting drug identity, strength, quality and purity. Under 21 CFR 211.22(d), its responsibilities and procedures must be written, and those procedures must be followed.

An illustrative operating sequence

Establish applicable controls → authorise instructions → assess incoming materials → execute operations → evaluate results and exceptions → record disposition → review performance.

This is an operating model, not a statutory sequence for every product. At each handoff, identify the evidence needed and the person authorised to decide. During execution, electronic batch records can provide a structure for connecting quantities, observations and exceptions to the operation concerned. At disposition, the reviewer needs the results and the reasoning that resolves—or leaves open—each relevant exception.

Worked case: a packaging reconciliation gap

Assume a drug packaging operation receives 100,000 tablets. Its records show 98,600 tablets packed, 900 rejected and 300 sampled, with no other recorded dispositions. Assume these categories do not overlap.

• Accounted quantity: 98,600 + 900 + 300 = 99,800 tablets.
• Unexplained difference: 100,000 − 99,800 = 200 tablets.
• Difference as a percentage issued: 200 ÷ 100,000 × 100 = 0.2%.

The calculation identifies an investigation question: what happened to the remaining 200 tablets? Review could examine transfer counts, reject records, sampling entries and unrecorded losses. Neither the small percentage nor the discrepancy alone proves acceptability or requires rejection. Any acceptance criterion belongs to the stated local process; 0.2% is not a regulatory allowance.

For batch release, the authorised human decision should connect the reconciliation, investigation findings and applicable criteria to the recorded disposition—not substitute arithmetic for quality judgement.

A practical equipment review starts with four risks, not a generic list of technical limits:

• Identity: can operators match the equipment identifier and installed configuration to the intended operation?
• Contamination: do product-contact surfaces, utilities and cleaning access suit the process, and is cleaning status clear?
• Mix-up: does material segregation distinguish pending, accepted and rejected stock through storage and movement?
• Measurement: are instruments suitable for the range and accuracy needed, with maintenance and calibration status understood? For balances, consider relevant eccentricity and linearity checks.

Worked case: replacement mixer impeller

Assume a mixer receives an impeller with different geometry while its cleaning instruction remains unchanged. No acceptance conclusion has been established. Route the modification through change control: compare product-contact surfaces, inspect access beneath blades and around the hub, and identify newly sheltered residue locations.

Review drawings, surface details, cleaning observations and relevant residue-test results. Decide whether existing cleaning validation evidence covers the configuration or whether revised instructions and further assessment are needed. An authorised reviewer records whether the revised process is accepted, needs further work or cannot proceed.

Make the control demonstrable by linking equipment identity, configuration, applicable instruction version, assessment results, unresolved concerns and the recorded decision. These are illustrative review practices; technical criteria depend on the product, equipment and process.

A useful manufacturing record explains what happened and why a decision followed. Approved instructions describe intended work; execution records document work performed. Observations are not calculated results: retain measured inputs separately from derived values and identify the calculation used. An exception records a departure; its investigation records the evaluation. Review completion is not itself a recorded disposition decision.

Build an evidence chain, not just a batch label

Connect product and lot identity to the instruction version used, material genealogy, observed values and units, source records, timestamps, actors, exceptions and decision rationale. A batch identifier groups records but cannot explain which material entered a step or which specification governed a result. For material traceability, a backward genealogy trace should lead from the output lot to its actual inputs.

Illustrative five-entity data-model diagram: Lot ↔ Instruction version ↔ Evidence record ↔ Exception/investigation ↔ Disposition decision. These are connected record types, not a mandatory sequence; evidence and decisions also link directly to the lot.

Give each entity a stable primary identifier—its unique reference. Version references point to the exact instruction or limit used, rather than whichever revision is current today. Evidence relationships identify supporting observations, calculations and investigation findings. Within the exception/investigation entity, distinguish the reported event from subsequent assessment. A source-record identifier names the underlying observation or document; an interface-message identifier names its transmission. They are not interchangeable.

Preserve meaning when records change

For data integrity in electronic batch records, preserve the original observation, attribute corrections to the person making them and record the reason. Distinguish observation time from later entry time. Retain the relationship between an original record and a superseding record so replacement does not erase history. An audit trail review workflow helps reviewers examine those changes in context.

These are practical data-integrity controls and an illustrative implementation pattern, not a mandated database schema or a summary of electronic-record regulations.

As operating practice, treat competence as demonstrated ability to perform an assigned task—not attendance alone. Training management should connect instruction to observed execution, recognition of abnormal conditions and appropriate escalation. Reassess readiness after relevant changes to tasks or procedures. A role map should distinguish who executes work, provides technical assessment, leads investigations, approves procedures and makes material or product disposition decisions. Name deputies and identify where authority stops.

Practical supplier qualification connects supplier selection to the material actually received: its identity, agreed specifications, incoming evidence and any supplier changes affecting suitability. Define who evaluates that evidence and where discrepancies escalate. For example, a supplier certificate referring to an obsolete specification should prompt assessment rather than acceptance merely because a certificate exists.

For outsourced work, use quality agreements within supplier risk management to assign record creation, retrieval access and exception assessment. Specify the records each party produces, who can obtain them, how changes are communicated and who resolves disputed results. Test those arrangements with a realistic exception: can the responsible reviewer obtain the underlying record, not just a contractor’s summary? These are risk-based operating recommendations, not a universal legal template.

For drug products, 21 CFR 211.22(a) specifically makes the quality control unit responsible for approving or rejecting products manufactured, processed, packed or held under contract by another company. Do not extend that exact legal arrangement to food, supplements or devices; determine responsibilities under the applicable product-specific framework.

Use these diagnostic examples to test whether controls resolve a specific uncertainty. They are recognised quality-system practice, not a ranking of FDA observations or automatic findings of noncompliance. Any regulatory consequence depends on the applicable product provisions and the facts of the event.

A completed form establishes that someone entered information; it does not, by itself, demonstrate that the control operated. A checked “status confirmed” box is weaker than a trace showing the status consulted, its timing and the material actually used. Review the connection, not merely the presence of signatures.

Sample a transaction backwards: start with its disposition, identify the criterion applied, then trace the result to the underlying observation. Sample forwards from an exception: follow its impact assessment, assigned action and recorded resolution. Use deviation management to frame the event, root cause analysis within the quality system to test explanations, and corrective and preventive action workflows to connect actions with follow-up. Where a link breaks, record the unresolved uncertainty rather than treating administrative closure as proof of control.

These terms describe different levels of quality control and governance, not interchangeable labels. The comparison below is a practical terminology guide; the product and jurisdiction boundaries remain those in the regulatory map above.

In the EU guideline context, EudraLex Volume 4 Part I Chapter 1, paragraph 1.8 describes GMP as part of quality management concerned with consistent production and control to appropriate quality standards. This places manufacturing controls within a wider management structure rather than treating quality as final testing alone.

The useful practical comparison with US cGMP is the focus on controlled production and supported quality decisions. That shared focus does not establish identical US and EU legal requirements, mutual recognition or interchangeable release arrangements. Keep the EU guideline context separate from the US regulatory provisions discussed earlier.

For deeper reading, use the drug GMP reference for the manufacturing-rule context and quality management systems for the organisational framework. In a procedure or review, identify which level a statement addresses before deciding what evidence or approval it needs.

As implementation examples, ERP–manufacturing interfaces may exchange orders and material identifiers; manufacturing execution systems (MES) may return consumption and production records; laboratory interfaces (LIMS) may transmit results; quality systems may communicate approved dispositions. Define shared identifiers, units, versions and material-status meanings at each boundary. Assign ownership of the authoritative record for each record type and specify who may resolve disagreements. These are integration practices, not a universal regulatory architecture.

Worked case 3: assume a laboratory sends 120 unique result events and retries five events after missing acknowledgements. The receiver sees 120 + 5 = 125 messages representing 120 distinct events; five messages are duplicates. Successful deduplication prevents repeated processing. It does not prove completeness: compare received event identifiers against the expected result set for the relevant samples and tests.

Check repeated identifiers against their payloads. Route a conflicting result to an authorised exception process rather than silently replacing the earlier value. For out-of-order messages, check versions and dependencies before applying updates. For missing acknowledgements, check durable receipt and processing status before retrying; silence does not establish failure.

During an outage, follow a locally approved continuity process using identifiable temporary records. Preserve actual observation times separately from later entry times. Use the evidence model described above to reconcile temporary records, queued messages and unresolved exceptions before normal processing resumes, with authorised people approving recovery decisions.

For pharmaceutical quality systems, EudraLex Volume 4 Part I Chapter 1, paragraph 1.6 recommends periodic management review involving senior management to identify improvement opportunities. It does not specify a fixed calendar frequency.

Use this practical checklist as a review aid, not a certification assessment. Assign named owners locally.

For every row, ask whether a recent change or exception invalidates the control’s assumptions. Record unresolved decisions, responsible people, target dates and evidence needed for closure.