MHRA Inspection Findings: Top 15 Deficiencies Reported in 2025-2026

Subscribe Now

Regulatory inspections by the Medicines and Healthcare products Regulatory Agency are among the most consequential events in the compliance calendar of any UK pharmaceutical manufacturer, marketing authorisation holder, medical device company, or pharmaceutical wholesaler. The findings generated during these inspections, and the patterns that emerge across multiple inspections over time, provide the most reliable available intelligence about where compliance programmes are failing and where regulatory scrutiny is most intensely focused.

The MHRA publishes inspection outcome data, deficiency reports, and enforcement notices that, when analysed alongside the inspection finding trends reported by PIC/S member authorities and aligned regulators such as the EMA and FDA, reveal a consistent picture of the compliance areas where pharmaceutical organisations most frequently fall short. The 2025 to 2026 inspection cycle has been particularly informative in this regard, reflecting both the sustained enforcement priorities that have characterised MHRA inspection activity for several years and the new focus areas introduced by recent regulatory developments including the revised Annex 1, new clinical trials regulations, and the MHRA’s expanded unannounced inspection programme.

This guide presents the top 15 deficiency categories identified in MHRA inspections during 2025 and 2026, explains what inspectors are finding in each area, and provides practical guidance for pharmaceutical organisations on how to address each deficiency type before an inspector identifies it at their site.

Understanding these findings is not simply an academic exercise. Each deficiency category described below represents a real compliance gap at real pharmaceutical sites that resulted in a formal regulatory finding, a written response obligation, and in some cases escalating enforcement action. The organisations that study these patterns and use them to drive proactive improvement in their own quality systems are the ones that consistently perform better in their own inspections.

Deficiency 1: Data Integrity Failures Across Electronic and Paper-Based Systems

Data integrity remains the single most prevalent deficiency category in MHRA GMP inspections across the 2025 to 2026 inspection cycle, continuing a trend that has dominated inspection findings for the better part of a decade. The MHRA has been explicit in its public statements and guidance documents that data integrity is not a peripheral compliance issue but a fundamental indicator of quality culture, and its inspection programme reflects this position.

The data integrity findings identified in recent MHRA inspections span a wide range of specific failures:

Shared login credentials in laboratory computerised systems, particularly chromatography data systems, LIMS platforms, and environmental monitoring databases
Audit trails that are technically present in computerised systems but are disabled for routine use, not configured to capture all required data fields, or not reviewed as part of the quality oversight programme
Paper batch records completed in pencil, with correction fluid, or with entries that show evidence of having been completed retrospectively rather than at the time of the activity
Raw electronic data files overwritten, deleted, or not retained alongside printed outputs used as working records
System clocks on analytical instruments that have not been verified against a controlled time source and that show discrepancies with other site records
Selective retention of favourable analytical results with inadequate documentation of the basis for excluding unfavourable results
Informal notebooks and rough notes used during laboratory activities that are not retained as part of the original data set

What distinguishes the MHRA’s approach to data integrity from a purely procedural compliance check is that inspectors are trained to look for systemic data integrity vulnerabilities rather than just specific documented failures. A site that has no confirmed instances of data falsification but whose systems and practices create conditions where data manipulation would be possible without detection is considered to have a data integrity problem regardless of whether manipulation has actually occurred.

Deficiency 2: Inadequate Contamination Control Strategy Implementation

The revised EU GMP Annex 1 came into force in August 2023 and MHRA inspectors have been examining Contamination Control Strategy implementation intensively across the 2025 to 2026 inspection cycle. The pattern of findings is consistent: many sterile manufacturers produced a CCS document in 2023 but have not operationally embedded it in the way the revised Annex 1 requires.

The specific CCS findings most frequently identified include:

A CCS document that exists but has not been connected to the environmental monitoring programme, cleaning validation data, personnel training records, or barrier technology qualification that constitute the operational evidence of contamination control
Risk assessments within the CCS that are generic rather than site-specific, failing to assess the particular contamination risks associated with the specific products, processes, and facility design of the site
A CCS that has not been updated to reflect operational changes that occurred after the initial document was approved
Missing contamination types within the CCS, most commonly pyrogen and endotoxin risk assessment or chemical contamination risk assessment, which the revised Annex 1 requires alongside microbiological and particulate contamination
Absence of a defined process for using the CCS in the investigation of environmental monitoring excursions and sterility failures

Deficiency 3: CAPA Effectiveness Not Demonstrated

CAPA programme effectiveness has been a consistent MHRA inspection finding theme and one that has become more prominent in the 2025 to 2026 cycle as inspectors apply the lessons learned from reviewing CAPA responses to previous inspection findings. The finding is not simply that CAPA actions are not completed. It is that completed CAPA actions cannot be demonstrated to have worked.

The specific CAPA effectiveness findings identified include:

CAPA records that are closed as complete based on evidence that the defined action was performed, without any assessment of whether the action achieved the intended outcome
Recurrence of the same deviation or finding type within 12 months of a CAPA being closed, demonstrating that the root cause was not correctly identified or the corrective action did not address it
Effectiveness check definitions that are vague or unmeasurable, making it impossible to determine objectively whether the CAPA has been effective
CAPA programmes that track action completion as the primary quality metric without any systematic review of recurrence rates or post-CAPA performance data
Root cause analysis conclusions that attribute findings to operator error or training gaps without any deeper systemic analysis, leading to retraining CAPAs that do not change the underlying conditions that produced the original finding

Deficiency 4: Environmental Monitoring Programme Deficiencies

Environmental monitoring programme deficiencies in sterile manufacturing facilities represent one of the most detailed and operationally complex deficiency categories in the 2025 to 2026 MHRA inspection finding data. The revised Annex 1 raised expectations significantly in this area and inspectors are finding that many sites have not updated their environmental monitoring programmes to reflect the new requirements.

Findings in this area include:

Environmental monitoring locations and frequencies that were established historically without a formal risk assessment and have not been reviewed against the contamination risk profile required by the revised Annex 1
Alert and action limits set at the Annex 1 grade limits rather than at site-specific limits established from trend data, which the revised Annex 1 explicitly requires
Viable and non-viable particle monitoring data reviewed in separate programmes without the integrated trend analysis the revised Annex 1 expects
Absence of a defined trend analysis methodology and escalation process for environmental monitoring data trends that indicate deteriorating control before limits are breached
Personnel monitoring that does not cover all personnel entering Grade A environments during aseptic processing or that is not conducted at the end of aseptic operations as the revised Annex 1 requires
Environmental monitoring during media fills that is not representative of the monitoring conducted during routine production

Deficiency 5: Supplier and Vendor Qualification Gaps

Supplier qualification programme deficiencies feature prominently in MHRA inspection findings across both GMP and GDP inspection programmes. Following the updated EU GMP Annex 8 requirements and the MHRA’s own signal activity around contaminated excipients, supplier qualification is receiving more intensive scrutiny than at any point in recent years.

The supplier qualification findings most frequently identified include:

Critical suppliers including API manufacturers and contract testing laboratories that have not been audited within the required frequency defined in the site’s supplier management SOP
Supplier qualification files that contain questionnaire responses and GMP certificates but no on-site audit report for suppliers classified as critical
GMP certificates and quality certifications held in supplier qualification files that have expired without renewal assessment
Absence of a supply chain mapping exercise for critical API and excipient suppliers, meaning the manufacturer has no documented knowledge of the full upstream supply chain beyond the immediate supplier relationship
Contract testing laboratory qualification files that do not include an assessment of the laboratory’s data integrity programme, access controls, or audit trail management
No formal change notification assessment process, meaning changes made by suppliers to their processes, facilities, or regulatory status are not systematically identified, assessed, and dispositioned

Deficiency 6: Disinfection Programme Inadequacies in Sterile Facilities

Disinfection programme deficiencies in sterile manufacturing facilities have become a prominent finding category in the post-revision Annex 1 inspection cycle. The revised Annex 1 introduced specific requirements around sporicidal agents and site-specific efficacy testing that many sites have not yet fully implemented.

The disinfection findings most frequently identified include:

Absence of a validated sporicidal agent in the disinfection programme for Grade A and B environments, which the revised Annex 1 requires at defined intervals
Disinfectant efficacy data based entirely on supplier-provided generic testing rather than site-specific efficacy testing conducted under conditions representative of actual use in the facility
No defined disinfectant rotation programme, with sites using the same disinfectant or disinfectant type without periodic rotation between agents with different mechanisms of action
Disinfectant preparation procedures that are informal or undocumented, without defined preparation parameters, labelling requirements, or shelf-life controls
Cleaning and disinfection validation that covers equipment surfaces but does not extend to facility surfaces including walls, floors, and ceilings in critical manufacturing areas

Deficiency 7: Pharmacovigilance System Master File Not Current

PSMF deficiencies feature consistently in MHRA GvP inspection findings and the 2025 to 2026 inspection cycle has generated a significant number of findings in this area, particularly at sites that have undergone business changes including product transfers, licence variations, and MAH restructuring without updating their PSMF to reflect these changes.

The PSMF deficiency findings most frequently identified include:

Product annex entries that do not reflect the current authorised product portfolio, including products added through licence variations, products transferred to or from the MAH, and products that have had their marketing authorisation withdrawn or suspended
PSMF descriptions of the pharmacovigilance system that do not reflect the current organisational structure, including changes to the QPPV, changes to outsourced PV service providers, and changes to the safety database
Pharmacovigilance agreements referenced in the PSMF that have not been updated to reflect changes in the scope of outsourced activities or changes in the identity of the service provider
SOP references in the PSMF pointing to superseded document versions rather than current approved procedures
Absence of an audit history section or an audit history that does not reflect audits conducted in the period since the PSMF was last formally reviewed

Deficiency 8: Change Control Programme Weaknesses

Change control programme deficiencies represent a finding category that appears across both GMP and GDP inspection programmes and reflects a systemic weakness in how many pharmaceutical organisations manage the relationship between operational change and quality system oversight.

The change control findings most frequently identified include:

Changes implemented in manufacturing, laboratory, or facility operations without a change control record being raised, demonstrating that the change control system is not embedded in the operational culture of the site
Change control records that assess the direct impact of the proposed change but do not evaluate the potential impact on validated systems, qualified equipment, approved regulatory submissions, or existing CAPA commitments
Changes to computerised systems including software updates, configuration changes, and user access modifications that are implemented outside the validated change control framework
Post-implementation review requirements defined in change control records that are not completed within the defined timeframe or are not completed at all
No formal process for identifying and retrospectively assessing changes that were implemented without going through the change control system

Deficiency 9: Out-of-Specification Investigation Quality

Out-of-specification investigation quality has been a consistent MHRA finding category and one where the depth of investigation expected by inspectors frequently exceeds the depth that sites deliver. OOS investigations are one of the first areas an inspector examines during a GMP inspection because they reveal how the quality system responds under pressure.

The OOS investigation findings most frequently identified include:

Phase one laboratory investigations that conclude with an assignable laboratory cause without the level of documented evidence needed to scientifically support the conclusion, including evidence that the calculation, sample preparation, and testing steps have been reviewed and found to be correct
OOS results invalidated on the basis of a phase one laboratory investigation conclusion without the second analyst testing or alternative testing required to confirm the laboratory error hypothesis
OOS investigations that identify an assignable cause for the specific result under investigation without extending the investigation to assess whether other batches produced under similar conditions may be affected
Investigation timelines that extend well beyond the expectations of the MHRA without documented justification for the extended duration
OOS investigation records that are formally closed but where the root cause conclusion is scientifically inconsistent with the evidence presented in the investigation record

Deficiency 10: GDP Compliance Failures in Pharmaceutical Wholesalers

GDP inspection findings from the MHRA’s pharmaceutical wholesaler inspection programme represent a distinct finding category that reflects both the unique compliance requirements of the GDP framework and the MHRA’s sustained focus on wholesale distribution compliance in the 2025 to 2026 inspection cycle.

The GDP deficiency findings most frequently identified include:

Temperature excursion management procedures that are inadequately defined, inconsistently applied, or do not require a documented quality risk assessment before distribution decisions are made following a temperature excursion
Responsible person oversight that is insufficient in scope or frequency relative to the volume and complexity of the wholesale operation, including evidence that the responsible person is not exercising genuine oversight of quality decisions
Returns handling procedures that do not meet the GDP requirement to assess the quality and integrity of returned medicines before they are returned to saleable stock
Supplier qualification for transport and storage service providers that does not meet the GDP requirement to qualify all parties in the supply chain who handle medicinal products
Falsified medicines controls including Falsified Medicines Directive verification system obligations that have not been fully implemented or are not consistently applied across all incoming product receipts

Deficiency 11: Gowning and Personnel Behaviour in Aseptic Environments

Personnel behaviour and gowning deficiencies in aseptic manufacturing environments have become a more prominent finding category in the post-revision Annex 1 inspection cycle, reflecting the revised Annex 1’s increased emphasis on the human factor in contamination control.

The personnel and gowning findings most frequently identified include:

Gowning qualification programmes that document training completion without including a formal observed assessment of gowning competence and a defined requalification frequency
Personnel monitoring that is conducted at the beginning of aseptic operations but not at the end, contrary to the revised Annex 1 expectation that end-of-operation monitoring is performed
No systematic documentation of the number of personnel present during aseptic processing, the activities performed by each person, or the interventions made during the aseptic process
Health status monitoring policies that lack specificity about the conditions requiring exclusion from Grade A and B environments or the process for return to work assessment following illness
Training records that show completion of aseptic technique training without evidence of competence assessment through observed practice evaluation or media fill participation tracking

Deficiency 12: Computerised System Validation Gaps

Computerised system validation deficiencies appear consistently across MHRA GMP and GvP inspections and reflect the ongoing challenge of maintaining validated system status in an environment of continuous software updates, organisational changes, and evolving regulatory expectations.

The computerised system validation findings most frequently identified include:

GMP-relevant computerised systems in routine use that have never been formally validated or had a validation assessment conducted to determine whether formal validation is required
Validation documentation that accurately described the system at the time of initial validation but does not reflect subsequent configuration changes, software updates, or changes in the GMP context in which the system is used
User access rights that have accumulated over time without periodic review and now grant individuals access beyond the scope required for their current role
Backup and disaster recovery procedures for GMP-relevant electronic systems that have not been validated or have not been tested within the required frequency
Computerised systems used for GMP-relevant data storage where the data cannot be restored in a complete and readable format following a simulated recovery exercise

Deficiency 13: Quality Risk Management Not Embedded in Quality Decisions

Quality risk management deficiencies reflect a finding category that has grown in prominence as MHRA inspectors examine whether ICH Q9 principles are genuinely embedded in quality decision-making rather than referenced in procedures without operational implementation.

The quality risk management findings most frequently identified include:

Quality decisions made without a documented risk assessment, including decisions about deviation disposition, change control approval, supplier qualification scope, and validation extent
Risk assessments that are produced as documents to satisfy a procedural requirement but whose conclusions are not visibly connected to the operational controls or monitoring activities they are intended to justify
Risk assessment methodologies that are applied inconsistently across different quality decisions, with the depth and rigour of the risk assessment not calibrated to the magnitude of the decision being made
No formal programme for periodic review of existing risk assessments to confirm that the risk profile they assessed remains current and that the controls identified remain effective
Product quality reviews that do not include a risk assessment of the quality trends identified and their implications for product quality, patient safety, or regulatory compliance

Deficiency 14: Clinical Trial Manufacturing Compliance

Clinical trial manufacturing compliance has become a more prominent MHRA finding category following the introduction of the new UK Clinical Trials Regulations in April 2026, which updated GMP expectations for investigational medicinal product manufacture and introduced new requirements that many clinical trial manufacturing sites have not yet fully implemented.

The clinical trial manufacturing findings most frequently identified include:

Investigational medicinal product dossiers that are incomplete, not current, or do not reflect the actual manufacturing process and controls used in production of the clinical trial material
Qualified person certification for clinical trial materials that is not supported by adequate batch documentation, including batch records that do not capture all required manufacturing steps and quality checks
Reference standard qualification for clinical trial materials that does not meet the standard required for the analytical methods used in clinical trial material release testing
Blinding and randomisation procedures for blinded clinical trial materials that are not sufficiently controlled to prevent unintended unblinding during manufacturing, packaging, or labelling operations
Archiving of clinical trial documentation that does not meet the retention requirements applicable to the specific phase and type of clinical trial

Deficiency 15: Management Review and Quality Culture

Management review and quality culture deficiencies represent the finding category that is most difficult to remediate quickly because it reflects the overall maturity and commitment of an organisation’s leadership to quality management rather than a specific procedural gap that can be closed by updating a document or conducting a training programme.

The management review and quality culture findings most frequently identified include:

Management review meetings that are conducted at the required frequency but do not result in documented decisions, resource commitments, or action plans that demonstrate active engagement by senior management with the quality performance data presented
Quality metrics presented at management review that show trends or patterns requiring management attention without any documented discussion, root cause analysis, or management decision about the appropriate response
Senior management who, when interviewed by inspectors, cannot demonstrate familiarity with the quality performance of their site including recent inspection findings, open CAPA actions, and significant deviations
Resource allocation decisions that consistently deprioritise quality system improvement activities relative to production and commercial objectives, resulting in a quality function that lacks the capacity to maintain the quality system in an inspection-ready state
A quality culture where personnel at all levels regard quality activities as a compliance obligation rather than a genuine contribution to product quality and patient safety, evidenced by the nature of responses to inspector questions and the quality of quality system records generated in routine operations

Using This Intelligence to Drive Proactive Compliance Improvement

The 15 deficiency categories described above are not simply a list of things that other organisations have got wrong. They are a predictive map of where MHRA inspectors are likely to focus their attention at any pharmaceutical site in the current inspection cycle. Every site should work through this list and honestly assess its own position against each category.

The most effective way to use this intelligence is to structure an internal gap assessment or mock inspection programme around these 15 categories, with each category examined not just at the level of whether a procedure or document exists but at the level of whether the system, practice, or behaviour the procedure describes is genuinely and consistently implemented in daily operations. The gap between what a quality system document says and what actually happens in a facility is exactly the gap that MHRA inspectors are trained to identify and it is exactly the gap that a well-designed internal assessment programme should find first.

Organisations that take a proactive approach to these findings, building compliance improvement programmes around the intelligence available from MHRA and global inspection data rather than waiting for their own inspection to identify the gaps, consistently perform better in regulatory inspections and recover more quickly from any findings that do occur.

How Quality and Vigilance Supports MHRA Inspection Readiness

At Quality and Vigilance we support pharmaceutical manufacturers, MAHs, medical device companies, and pharmaceutical wholesalers with comprehensive MHRA inspection readiness programmes built around the actual findings and focus areas of the current inspection cycle. Our team brings direct regulatory inspection experience across MHRA, EMA, FDA, TGA, and PIC/S frameworks and understands how to translate inspection intelligence into practical compliance improvement.

Our MHRA inspection readiness services include:

Mock inspections structured around current MHRA inspection focus areas and finding patterns
Gap assessments against the 15 deficiency categories identified in this guide
Data integrity programme assessments and remediation support
Contamination control strategy development and review for sterile manufacturers
CAPA programme effectiveness assessments
Supplier qualification programme gap assessment and audit support
GDP compliance reviews for pharmaceutical wholesalers and distributors
Management review facilitation and quality culture assessment

Contact Quality and Vigilance today to assess your inspection readiness against the MHRA’s current finding priorities and ensure your organisation is prepared before the inspector arrives.