Receiving a critical finding from an MHRA inspection is one of the most high-stakes moments a pharmaceutical organisation can face. The instinct in most companies is to manage it as a communications task: draft a response, confirm you have taken action, and wait. That instinct is wrong, and acting on it is one of the most reliable ways to turn a manageable situation into a licence suspension.
A critical finding does not mark the end of an inspection. It marks the beginning of a regulatory process with defined steps, tight timelines, and consequences that can include immediate suspension or full revocation of your Wholesale Dealer’s Authorisation or Manufacturer’s Licence. Understanding each stage of what comes next, and what the MHRA is actually evaluating at each point, is the difference between closing a finding and being placed under formal regulatory action.
What A Critical Finding Means And How It Differs From Major
The MHRA classifies all inspection deficiencies across three categories. Understanding the distinction between them is not academic; it directly determines your response window, the regulatory pathway you enter, and the severity of the consequences you face.
- A Critical finding is one that has caused, or may cause, a product that poses a direct risk to human health to reach the market. It also covers serious failures in quality systems, including data integrity breaches, fraud, and falsification of records.
- A Major finding is a significant non-compliance that has not yet created an immediate health risk but points to a serious failure in governance or quality oversight.
- Other findings are observations and recommendations that fall outside both higher categories.
What makes a critical finding categorically different is that it triggers an automatic referral to the MHRA’s Inspection Action Group (IAG). Multiple Major findings that, when taken together, point to a systemic failure in how a quality system operates can be accumulated and treated as equivalent to a Critical. A pattern of the same findings appearing across successive inspections, regardless of their individual classification, also significantly increases the likelihood of IAG escalation. As the MHRA’s GMP and GDP guidance on GOV.UK states directly: if an inspector finds critical deficiencies, or finds that agreed action plans from previous inspections remain unresolved, they will contact the IAG. The IAG can refuse or suspend your licence, increase inspection frequency, or request a direct meeting with the licence holder.
Between 2016 and 2023, nearly 40% of all critical and major GMP deficiencies reported by the MHRA related to data integrity. The most consistently cited patterns in deficiency reports include:
- Audit trail functionality that was disabled or had never been actively reviewed
- Analyst notes transcribed without retention of the original records
- Shared login credentials across multiple workstations
- Uncontrolled spreadsheets being used for critical GxP calculations
- CAPAs closed on paper without evidence of effective implementation
These failures are rarely the result of deliberate misconduct. They are almost always the result of systems that depend on individuals behaving correctly rather than structures that make incorrect behaviour visible or impossible to repeat.
The Closing Meeting: Where Your Response Clock Starts
A critical finding is not something you learn about by post. It is communicated at the closing meeting at the end of the inspection, attended by the Responsible Person and senior management. At that meeting, the inspector will provide a verbal summary of all findings, classify them, and, where a critical deficiency or a serious accumulation of majors has been identified, inform the organisation directly that a referral to the IAG is being recommended.
The closing meeting is not a formality. It is the point at which the response window starts. There is no grace period between the closing meeting and the start of your obligations. From that moment, the MHRA is watching whether you act decisively or whether you require further prompting.
Following the meeting, a post-inspection letter will be issued formally setting out each deficiency as written. For critical findings, your response window is typically 7 to 14 days depending on the assessed risk to human health. This is not the 30-day window that applies to major findings. It is a compressed, high-pressure deadline designed to establish whether you understand the seriousness of the situation and whether you have the competence to address it.
Your immediate priorities in the first 48 hours after the closing meeting should be:
- Acknowledge any IAG correspondence formally and without delay. Receipt acknowledgement is tracked, and its absence is noted.
- Read the finding exactly as written. Do not paraphrase, contextualise, or reinterpret it favourably before completing a proper root cause investigation.
- Begin containment immediately. If the finding involves a product that may have been compromised, a recall assessment must begin before the written response is submitted. If it involves a data integrity failure, access controls, system permissions, and raw records must be secured and reviewed as a first step.
- Escalate internally to senior management from day one. A critical finding is not a quality team problem to resolve before briefing leadership. It requires senior decision-making authority from the start.
- Do not begin writing the formal response until root cause work is underway. A response drafted before root cause analysis is complete will reflect that in every answer it gives.
How The Iag Operates And What It Is Evaluating
The MHRA Inspectorate’s overview of its compliance management escalation processes sets out in detail how the IAG functions. It is a non-statutory, multidisciplinary group that advises the MHRA’s Director of Inspection, Enforcement and Standards on recommendations for regulatory action. There are two wings: IAG1 covers GMP, GDP, and Blood Establishment Authorisations, and IAG2 covers GCP and Good Pharmacovigilance Practice. The group meets fortnightly, typically on the first and third Tuesday of the month, with ad hoc meetings convened for urgent cases. Its membership includes pharmaceutical and medical assessors, legal advisors, enforcement representatives, and senior inspectors. In complex cases, specialist clinicians, EMA partners, or the US FDA may also provide input.
Once a case is referred to the IAG, all correspondence moves through the IAG Secretariat rather than directly through the inspector who conducted the visit. The IAG evaluates your response not just for what it contains but for what it reveals about the maturity and credibility of your quality system. A response that restates the deficiency, promises a procedural update, and sets a distant target date tells the IAG that the organisation has not genuinely understood what failed. A response that demonstrates root cause depth, describes containment actions already completed, and provides a realistic, evidence-based CAPA plan tells a very different story.
The MHRA published a specific post in June 2026 on AI-generated inspection responses, stating clearly that responses which demonstrate superficial or generic CAPA without evidence of genuine root cause analysis will be identified as a quality system weakness regardless of how the response was drafted. That signal is important: the MHRA is not evaluating the polish of your response. It is evaluating whether genuine investigative and corrective work has been done.
What The Iag Can Do And What Suspension Actually Means
The range of actions available to the IAG following a critical finding referral includes:
- Suspension of the WDA or Manufacturer’s Licence, typically running from 3 to 12 months based on severity and estimated remediation time
- Revocation of the licence in cases of serious, persistent non-compliance or where the IAG determines the organisation does not have meaningful control of its operations
- Removal of specific licence categories or authorised activities without full suspension
- Increased inspection frequency, including short-notice and unannounced visits
- Issuance of a short-dated GMP/GDP compliance certificate, reducing the period before re-inspection is required
- Referral to the MHRA Criminal Enforcement Unit or, in cases involving controlled drugs, to law enforcement agencies
When a licence is suspended, it is published on the MHRA’s public list of suspended licences. This is visible to trading partners, customers, and other regulators. The practical consequence for a wholesale dealer is that distribution activity must cease for the duration of the suspension unless specific arrangements for medically critical products are agreed separately by the licensing authority.
Crucially, suspension is not permanent. As the MHRA’s re-inspection guidance for sites under regulatory action makes clear, restrictions are lifted when the organisation can demonstrate at re-inspection that corrective actions have been effectively implemented. The initial suspension period is a guide based on estimated remediation time. Sites that carry out the necessary work thoroughly and ahead of schedule can request an earlier re-inspection and, if the evidence demonstrates genuine compliance, have the suspension lifted before the initial period expires.
There is also a Compliance Monitor route, introduced by the MHRA as a pilot in 2022 and now an established supervision pathway. Under this process, an eligible external consultant acts as a Compliance Monitor, working with the company to deliver actions defined in a Compliance Protocol agreed with the MHRA. The Compliance Monitor provides high-level progress updates to the MHRA and, on completion of the protocol, confirms the site is ready for re-inspection. This route reduces the frequency of direct MHRA on-site inspections during the remediation period, which benefits both the company and the MHRA’s broader inspection programme.
Writing A Response That Actually Resolves The Finding
The MHRA’s own guidance on responding to a GMP/GDP post-inspection letter sets out what a well-structured response must contain. Reading it before drafting anything is not optional for an organisation with a critical finding on its hands.
For each deficiency, your response must include:
- The deficiency number and the exact wording of the deficiency as stated in the post-inspection letter
- A genuine root cause analysis, not a description of what went wrong but an investigation into the underlying systemic condition that allowed it to occur and go undetected
- The specific corrective action being taken, described concretely enough that an inspector can assess whether it addresses the root cause rather than the symptom
- A realistic, risk-based implementation timeline. Timelines that appear too short lack credibility. Timelines that are too long may prompt suspension while the work happens.
- Evidence of containment actions already taken at the time of submission, not plans to take them
The most common reason responses fail to close an IAG case is that they address the visible surface of a finding rather than what caused it. Telling the MHRA that a procedure was not followed is not root cause analysis. Demonstrating what governance condition permitted that failure to persist undetected, and what structural change you have made to eliminate that condition, is. Inspectors reviewing responses have read hundreds of them. A superficial CAPA does not go unrecognised. It extends the IAG process and, in some cases, escalates it.
Each deficiency should be documented internally as a deviation, with an associated CAPA and change control where required. If the remediation involves appointing a new Responsible Person, undertaking staff retraining, or engaging external providers, those activities must be identified, qualified, and validated before they are cited as completed corrective actions.
Even when an IAG referral is resolved without suspension, it does not simply close. Organisations should expect:
- A re-inspection, typically within six months but potentially sooner, to verify that corrective actions have been implemented
- Regular IAG progress updates if the case remains open
- Issuance of a short-dated compliance certificate, indicating closer regulatory oversight going forward
- An adjusted risk-based inspection score, meaning future inspections will likely come sooner and carry more scrutiny of the areas that generated the critical finding
How Quality Vigilance Ltd Works With Organisations In This Position
Managing an IAG response while operating a licenced facility with the same team that is already stretched by the inspection itself is not a realistic expectation. The skills required to close a critical finding are specific: structured root cause investigation conducted to a standard the MHRA recognises, CAPA design that addresses what is actually being asked rather than what is easiest to document, and re-inspection readiness verification that confirms corrective actions are implemented in practice, not just on paper.
Quality Vigilance Ltd works directly with organisations that have received critical or major MHRA findings and need experienced regulatory support without delay. Their work in this area covers conducting independent root cause investigations from the ground up, so the response reflects what actually happened and not what was easiest to identify. They draft CAPA plans and post-inspection responses structured to the standard the IAG expects, and they prepare organisations for re-inspection by verifying that every corrective action is evidenced and demonstrable. For wholesale dealers under WDA suspension and manufacturers working through an IAG Compliance Protocol, their involvement reduces the risk of a re-inspection that fails to lift the suspension by ensuring the remediation work is done correctly the first time.
Visit qualityvigilance.com or contact the team directly at [email protected] to discuss your situation in confidence.