WHO GMP TRS 1044 (2022)

WHO Technical Report Series (TRS) 1044, Annex 2 (2022) replaces TRS 986, Annex 2 (2014) as the World Health Organization’s main-principles Good Manufacturing Practices (GMP) for pharmaceutical products. The update harmonizes WHO’s baseline with contemporary international practice, drawing on ICH Q7, Q9(R1), and Q10 and reflecting long-standing PIC/S and EU GMP structures.

Practically, TRS 1044 is the reference document used by WHO Prequalification assessors and many health authorities that rely on WHO norms when inspecting finished product manufacturers, contract sites, and testing laboratories that support supply into low- and middle-income countries. It is also a comparative benchmark for manufacturers already operating under PIC/S PE 009 or EU GMP who seek global supply.

The document centers on a lifecycle Pharmaceutical Quality System, integrally embedding quality risk management, change control, deviation/CAPA, and management responsibilities. It emphasizes robust premises and equipment controls, validated processes, data integrity, and fit-for-purpose documentation and record management across production and quality control.

For organizations with heterogenous portfolios and networks, TRS 1044 offers a common language and structure to demonstrate control across in-house operations and outsourced activities. It is written to be outcome-focused and risk-based, enabling proportionate application while maintaining the essential safeguards of identity, purity, strength, and quality.

TRS 1044 Annex 2 defines general GMP expectations for manufacturers of finished pharmaceutical products for human use. It applies to in-house operations and to activities performed on behalf of the manufacturer, including contract manufacturing and contract testing. It also informs oversight of starting materials and packaging components, recognizing that robust supplier qualification and incoming controls are essential to finished product quality.

While TRS 1044 describes the main GMP principles for finished products, active pharmaceutical ingredient manufacturing is expected to conform to ICH Q7. Many authorities explicitly recognize Q7 for APIs, with the finished-product manufacturer responsible for qualifying API suppliers, maintaining technical agreements, and assuring that the API quality system outputs are compatible with the product’s control strategy.

WHO Prequalification uses TRS 1044 as its baseline for GMP inspections of finished dosage form sites. Several national regulatory authorities rely on WHO guidance when shaping or interpreting domestic GMP codes, and procurement bodies treat conformance as a prerequisite for tender participation. Where local law is more stringent, the legal requirements of the jurisdiction prevail, and manufacturers should map and reconcile any differences during site readiness planning.

The guidance spans the full product lifecycle, from technology transfer and process validation through commercial manufacture, ongoing process performance verification, complaint handling, and product quality reviews. It is applicable to a wide variety of dosage forms, with specialized sterile manufacturing expectations to be read alongside contemporary sterile standards, such as the updated EU GMP Annex 1 and PIC/S interpretations.

TRS 1044 organizes expectations around a Pharmaceutical Quality System (PQS) that mirrors the structure and intent of ICH Q10. Executive management is accountable for ensuring adequate resources, a culture of quality, and effective governance of the PQS. The system integrates change management, deviation and CAPA, management review, and continuous improvement grounded in science and risk.

Quality risk management per ICH Q9 is not a separate activity; it informs PQS processes and operational controls. Data from production, in-process controls, laboratory testing, and complaints feed management review and product quality review to confirm ongoing state of control. The PQS spans the organization and its outsourced operations, with documented responsibilities and communication pathways.

Documentation hierarchy supports the PQS: quality policy, standards, SOPs, master batch records, specifications, validation protocols and reports, and records. These must be current, controlled, and retained for defined periods. Computerized systems supporting the PQS should be validated commensurate with risk, and electronic records safeguarded to ensure integrity, traceability, and availability.

TRS 1044 emphasizes knowledge management across the lifecycle. Technology transfer packages, process understanding, material variability, and equipment capability data are expected to inform control strategies, sampling plans, and alarm limits. PQS maturity is evidenced by proactive trend analysis, timely CAPA effectiveness checks, and robust change impact assessments.

• Integrate ICH Q10 concepts: management responsibility, continual improvement, and lifecycle oversight.
• Embed ICH Q9 risk management into changes, deviations, sampling, and validation acceptance criteria.
• Ensure technical agreements extend PQS controls to outsourced manufacturing and testing.
• Use periodic management review and product quality review to verify the ongoing state of control and drive improvement.

TRS 1044 consolidates the classic GMP building blocks. Facilities and utilities must be designed and maintained to prevent contamination and mix-ups, with environmental controls and cleaning validated where appropriate. Equipment must be qualified, calibrated, and maintained under change control. Materials management requires approved suppliers, identity testing, segregation by status, and reconciliation to prevent shortages and overages.

Production controls include approved master instructions, line clearance, in-process controls, and documented batch execution by trained personnel. Any deviation is investigated to root cause with proportionate, documented CAPA. Laboratory controls demand validated methods, qualified instruments, data integrity safeguards, and independent quality unit release. Retained samples and stability commitments must be honored to support continued verification of product quality.

Qualification and validation expectations encompass facility, utility, and equipment qualification, process validation, cleaning validation, computerized system validation, and ongoing verification. The rigor is commensurate with risk and product criticality. Self-inspection programs verify sustained GMP compliance, while complaint handling and recall readiness demonstrate responsiveness to post-market signals.

Documentation and records are central evidence of control. The manufacturer should maintain a coherent document hierarchy, enforce contemporaneous recording, and secure data integrity. Any corrections must be attributable and justified without obscuring the original entry. Batch records should clearly link to materials, equipment, personnel, and test results, supporting traceability and decision-making for release or rejection.

• Premises, equipment, and utilities designed for segregation, cleaning, and maintenance under change control.
• Approved suppliers, incoming testing, and status control, aligned with ICH Q7 for APIs.
• Validated processes and methods, with lifecycle verification consistent with annexed validation principles and annex-15.
• Independent quality unit oversight of production and quality control, including release and stability commitments.

TRS 1044 embeds risk thinking throughout the PQS, aligning with ICH Q9(R1). Manufacturers are expected to use structured, documented methods to identify hazards, analyze and evaluate risks to product quality, and implement controls proportionate to risk. This includes defining acceptance criteria, sampling strategies, alarm levels, and decision thresholds informed by process knowledge and performance data.

Risk assessments should be living documents, revisited when process understanding evolves, materials change, equipment is modified, or trends indicate drift. The goal is not extensive paperwork but transparent, science-based justification for how controls ensure identity, strength, purity, and quality. The revision to Q9 clarifies subjectivity management, formality, risk-based decision-making, and addresses human factors and knowledge gaps.

Cross-contamination control remains a focal area. Where multi-product facilities operate, risk-based segregation, validated cleaning, closed transfers, and campaign strategies must be demonstrably effective. For sterile products, contamination control strategies should integrate facility design, environmental monitoring, personnel qualification, and aseptic process simulation, harmonized with current sterile manufacturing expectations.

CAPA and change control are extensions of risk management. Impact assessments should identify affected products, documents, training, and validation elements. Implementation plans include effectiveness checks with criteria tailored to the risk statement. Product quality reviews and management review then evaluate whether risk controls remain adequate over time.

• Apply ICH Q9(R1) principles to scale the formality and documentation of risk assessments.
• Align contamination control strategies with sterile guidance such as EU GMP Annex 1 (2022).
• Use data from deviations, trends, and complaints to refine risk registers and control strategies.
• Integrate periodic knowledge updates from ICH Q7 and ICH Q10 into risk reviews.

TRS 1044 reinforces that documentation must be accurate, complete, legible, contemporaneous, and enduring. Records should be attributable to the person and system that generated them, with any changes traceable without obscuring the original entry. The quality unit is responsible for ensuring documentation systems remain under control and that records support objective, reproducible decision-making for release and investigations.

Computerized systems that create, process, or store GMP data require validation commensurate with risk. Access control, audit trails, backup and restore, time synchronization, and data security must be designed and verified to protect data integrity. Where hybrid systems exist, controls must prevent transcription errors and ensure the authoritative record is defined and maintained.

Electronic signatures and records must meet applicable jurisdictional rules, and their reliability should be demonstrated through system validation, procedural controls, and training. Data review should include evaluation of audit trails for critical records. For laboratories, instrument qualification, method validation, and secure raw data retention are foundational to reliable quality control decisions.

Manufacturers can leverage structured digital records to strengthen traceability from materials through batch execution to release and distribution. Clear document hierarchies, version control, and periodic document review cycles prevent outdated procedures from persisting in operations. Effective governance reduces the risk of incomplete records, backdating, or unapproved templates.

• Align electronic record controls with 21 CFR Part 11 where applicable, and validate systems proportionately.
• Use a controlled QMS and document control to manage SOPs, batch records, and templates.
• Adopt EBMR/eDHR and electronic dispensing records to improve traceability and contemporaneous capture.
• Standardize structured deviations to unify root cause, CAPA, and effectiveness checks.

TRS 1044 requires that the marketing authorization holder or responsible manufacturer maintain full oversight of outsourced activities. This includes manufacturing steps, testing, storage, and distribution performed by third parties. Before engaging a contractor, the manufacturer must qualify the organization’s GMP capability, confirm the suitability of facilities and methods, and ensure product-specific requirements are understood.

Technical agreements should unambiguously define responsibilities, documents to be used, deviation and change notification pathways, material traceability, data ownership, and record retention. Where multiple parties share responsibilities, the agreements must ensure no gaps in GMP coverage and provide for timely communication of atypical events and out-of-specification results.

Supplier qualification for APIs, excipients, and packaging components requires risk-based audits, material specifications, verification of regulatory conformance, and ongoing performance monitoring. Incoming material control should include identity testing at a minimum, with reduced testing justified by a robust supplier history and technical data. Periodic requalification and complaint trend reviews are expected.

Contract laboratories fall under the same expectations. Method transfer, data integrity controls, and review and approval workflows must be defined. The sponsor remains responsible for assessing the laboratory’s performance and for ensuring that test results are attributable, complete, and fit for their intended use in release or stability programs.

• Maintain an approved supplier list with risk scoring and requalification schedules.
• Use a supplier portal to exchange specifications, certificates, and change notifications.
• Automate audit workflows and CAPA routing to close gaps quickly.
• Prepare for customer and agency visits with inspection readiness evidence bundles.

TRS 1044’s architecture and expectations are consistent with the PIC/S GMP Guide (PE 009) and EU GMP. Manufacturers already operating under those codes will recognize the same pillars: a lifecycle Pharmaceutical Quality System, risk-based qualification and validation, robust documentation, and independent quality unit oversight.

For sterile product manufacture, contamination control strategies, facility design, and aseptic operations are guided by the 2022 revision of EU GMP Annex 1 and the corresponding PIC/S alignment. WHO TRS 1044 points to the need for risk-based controls, but the sterile annexes provide the detailed expectations for cleanroom classification, environmental monitoring, and aseptic process simulation.

API controls should be read with ICH Q7. Risk management follows ICH Q9(R1), and the Pharmaceutical Quality System reflects ICH Q10. Validation and qualification expectations are consistent with annexed principles seen globally. This crosswalk helps global companies apply a unified model while satisfying local jurisdictional nuances through addenda to procedures and technical agreements.

The table below highlights where to anchor detailed expectations when implementing or benchmarking a site against TRS 1044. Use it to plan gap assessments, author site master files, and organize training curricula for operations and quality personnel.

A pragmatic implementation starts with a gap assessment against TRS 1044 anchored to ICH Q10 system elements and the site’s product portfolio risks. Prioritize remediations that close cross-cutting risks, such as data integrity vulnerabilities, cleaning validation weaknesses, and ambiguous technical agreements. Build a training plan that links each role to the procedures, records, and controls they execute.

WHO Prequalification and inspectorates aligned with PIC/S will scrutinize management commitment, the completeness and contemporaneity of batch and laboratory records, data governance, and how risk assessments actually influence controls and decisions. They will also test the robustness of change control, CAPA effectiveness checks, and the integrity of technical agreements for outsourced steps.

Routine self-inspections and product quality reviews provide early warning. Trending of deviations, environmental monitoring, yield variances, and complaint data should feed risk registers and action plans. Where controls are being modernized, document interim risk mitigations and justify timelines with science-based rationales and senior management endorsement.

Sustained compliance hinges on governance. Management review should include quality metrics, resource adequacy, audit outcomes, and effectiveness of improvement initiatives. Transparent tracking of commitments, coupled with realistic closure targets and periodic verification, prevents accumulation of recurrent issues that can erode the state of control.

• Overreliance on procedural controls without validated technical controls for high-risk steps.
• Incomplete data integrity design, such as weak access control or unreviewed audit trails.
• Technical agreements that omit change notification, deviation handling, or data ownership.
• Validation packages that lack rationale for sampling, acceptance criteria, or lifecycle monitoring.
• Risk assessments that are static documents rather than drivers of control strategy updates.

V5 Ultimate operationalizes TRS 1044 by unifying the Pharmaceutical Quality System, batch execution, and data integrity controls in a validated platform. Role-based workflows connect change management, deviations, CAPA, and management review, producing the traceable evidence inspectors expect. Configurable hierarchies mirror your document structure, from policy to SOP to master records.

Digital production and laboratory records eliminate transcription gaps and strengthen contemporaneous data capture. Weighing and dispensing controls, barcode verification, and step-sequence enforcement prevent mix-ups and wrong-material errors. Embedded quality checkpoints and electronic signatures ensure independent review and release while preserving complete audit trails.

Supplier and contractor oversight is streamlined through approved supplier lists, structured audits, and secure collaboration portals. Technical agreements, specifications, and certificates are version-controlled and linked directly to materials and batches. Inspection-readiness views compile change histories, deviation trends, and validation status to prove an ongoing state of control.

Lifecycle validation and continuous verification are supported with calibration and maintenance scheduling, automated reminders, and linkage of instruments and equipment to specific tests and batches. Analytics highlight process capability and trigger risk-based reviews, ensuring the PQS remains responsive and effective over time.