Large pharmaceutical manufacturers get GMP findings too. The difference is stark when you look at what happens next. A company with 300 staff and a dedicated regulatory affairs team receives a Major finding and activates:
- A structured CAPA response process with a named lead
- A quality director who has managed IAG referrals before
- Enough operational depth to keep the facility running while remediation happens
- Legal and regulatory advisory support already on retainer
When a smaller pharmaceutical company receives the same finding, the person writing the CAPA response is often the same person running day-to-day quality, managing supplier relationships, covering production oversight, and answering the phone. The finding is identical. The capacity to respond to it is not.
This is the core reason smaller pharma companies get hit harder by GMP findings than their size should suggest. It is not that they care less about compliance or that their products are inherently lower quality. It is that the structural conditions inside a smaller organisation mean the same gap a large company contains and closes quietly becomes a self-amplifying problem when there is no resource depth to absorb it.
The Regulatory Standard Is The Same Regardless Of Size
The MHRA, EMA, and FDA apply the same GMP framework to a 20-person specialist manufacturer as they do to a 2,000-person multinational site. The MHRA’s GMP and GDP guidance on GOV.UK contains no small business exemption. The EU GMP Guidelines (EudraLex Volume 4) do not scale their requirements to headcount or turnover. A Pharmaceutical Quality System must be:
- Implemented across all relevant functions and activities
- Maintained through documented review cycles and self-inspections
- Demonstrably effective through records, CAPA outputs, and management review evidence
- Capable of withstanding regulatory scrutiny at any point during the licence period
A critical finding on data integrity at a site with two quality staff carries the same regulatory consequences as the same finding at a site with a dedicated data integrity team. The IAG process, licence suspension timelines, and CAPA response windows do not adjust for organisational scale. What adjusts is the capacity to manage the response, and that is where smaller companies consistently find themselves exposed.
Why The Gaps Appear Where They Do
The most consistently cited GMP deficiency categories across MHRA, FDA, and EMA inspection data include:
- Data integrity failures across GxP records and electronic systems
- CAPA plans that lack genuine root cause analysis
- Deviation investigations that identify what went wrong but not why
- Qualification and validation documentation that has not been maintained through the product lifecycle
- Management review records that are absent, incomplete, or lack trend data
- Training programmes that do not demonstrate actual competence against defined role requirements
These are not advanced technical disciplines requiring specialist equipment. They are quality system functions that require time, structure, and consistent oversight to maintain. That is precisely what smaller organisations struggle to sustain. The specific structural conditions that generate these gaps include the following.
Dual And Triple Role Overload
In a small pharmaceutical company, the Quality Manager is frequently also the Qualified Person, the CAPA owner, the training coordinator, the SOP author, the supplier auditor, and the inspection host. When one person holds all of these responsibilities simultaneously, the quality system maintenance that does not trigger an immediate alarm gets deferred:
- Self-inspection schedules slip because there is no capacity to conduct them between operational demands
- SOP review cycles are overdue because drafting and reviewing takes blocked time that never materialises
- CAPA effectiveness checks are not completed because the original CAPA was closed under time pressure and the follow-up was never formally scheduled
- Management review is informal because preparing the data pack would require several days of analysis that cannot be prioritised
By the time an MHRA inspector arrives, this deferral has accumulated into a pattern that reads as a systemic quality culture failure rather than a resourcing issue. The inspector is not in a position to distinguish between the two, and the deficiency report will not reflect the distinction either.
No Meaningful Management Review
EU GMP Chapter 1 and ICH Q10 both require management review of quality system performance at defined intervals, with structured agendas, trend data, and documented outputs. In smaller organisations, management review findings consistently include:
- No formal management review conducted within the required period
- Review meetings held but not documented with the required quality metrics
- Trend data on deviations, CAPA status, complaints, and audit outcomes not presented or analysed
- Actions arising from review not formally tracked or assigned with owners and deadlines
- Senior management not demonstrably engaged with quality system performance data
When an inspector asks to see management review records and finds either nothing or a short informal meeting note without data analysis, this is cited as a Major finding. The company may have been discussing quality performance in daily operations, but informal conversations are not documented, and documented evidence is what the inspector evaluates.
Training Records That Do Not Reflect Actual Competence
Training in smaller companies is frequently conducted informally, on the job, by whoever is available. The problems this creates at inspection are consistent and predictable:
- Training records are incomplete or not linked to role-specific competency frameworks
- Records are not updated when SOPs are revised, leaving staff formally trained against superseded versions
- No evidence that training effectiveness was assessed, only that it was delivered
- Critical operations are performed by staff with no documented training record for the relevant procedure, regardless of their practical experience
Between 2019 and 2023, inadequate training programmes appeared consistently in the top deficiency categories cited in MHRA GMP inspection data. An inspector who finds that a member of staff performed a critical operation without a documented training record against the current procedure will raise that as a finding regardless of how experienced the individual actually is.
Capa Plans That Address Symptoms Rather Than Causes
When a deviation occurs in a smaller company, the pressure is to resolve it quickly and return to normal operations. Root cause analysis takes time the team does not have. The result is a CAPA that:
- Documents what went wrong and what was immediately fixed
- Does not identify the underlying systemic condition that allowed the deviation to occur
- Sets a completion date that has already passed by the time the inspector reviews it
- Shows no effectiveness check confirming the corrective action actually worked
- Treats the same type of deviation appearing multiple times as separate isolated events rather than a recurring pattern
Across FDA and EMA-aligned inspection data, weak CAPA effectiveness consistently accounts for 40 to 50% of quality system observations. The MHRA’s own guidance on responding to post-inspection letters is explicit that responses must demonstrate genuine root cause investigation, not a restatement of the finding with a corrective action attached.
Data Integrity Gaps That Appear Worse Than They Are
Between 2016 and 2023, data integrity lapses accounted for nearly 40% of all critical and major GMP deficiencies reported by the MHRA. In smaller organisations, these problems typically stem from:
- Unvalidated spreadsheets used for critical GxP calculations without access controls or audit trail functionality
- Shared login credentials across laboratory systems and electronic quality records
- Audit trail settings on instruments and software that were never correctly configured at installation
- Paper records completed retrospectively or corrected without a formal line-through and signature
- No systematic programme for reviewing audit trail data as part of routine quality oversight
These are implementation failures, not deliberate falsification. But they are classified and investigated by inspectors using the same criteria regardless of intent. The MHRA’s data integrity guidance requires all GxP records to meet ALCOA+ standards: Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, and Available. An organisation that cannot demonstrate this across its records will receive findings that carry significant regulatory weight, irrespective of whether any product was actually affected.
Qualification And Validation Backlogs
Over 35% of critical GMP deficiencies in pharmaceutical manufacturing are linked to qualification and validation breakdowns. In smaller companies, the validation programme is typically built during the initial licence application and then not maintained as circumstances change. Common gaps include:
- Equipment requalification not conducted following repairs, modifications, or relocation
- Cleaning validation not updated when new products are introduced or manufacturing processes change
- Process validation performed at initial product launch but continued process verification not implemented for commercial batches
- Computerised systems in use without a formal validation status, particularly legacy systems introduced before current GAMP expectations were in place
- Annex 15 lifecycle documentation incomplete or not maintained beyond the initial qualification report
The Compound Effect: How Minor Gaps Become Major Findings
One of the most damaging dynamics for smaller companies is that individually minor compliance gaps compound into a pattern that carries the weight of a Major or Critical finding when viewed together. Consider the typical compounding sequence:
- A single overdue CAPA is an observation
- Three overdue CAPAs across different quality system areas becomes evidence of systemic control failure
- Management review records that do not reference those open CAPAs shows that senior management is not engaged with quality performance
- Training records showing the CAPA owners were not formally trained in the relevant procedures adds a further layer
- A deviation investigation on a related topic that contains no root cause analysis completes the picture
The inspector is not citing five separate minor issues. They are citing evidence that the quality system is not genuinely in control. This is the inspection outcome smaller companies consistently face, not because any single gap was catastrophic, but because the compound of resourcing constraints, dual roles, and deferred maintenance has produced a quality system that functions day to day but cannot withstand structured regulatory scrutiny.
How Quality Vigilance Ltd Works With Smaller Pharmaceutical Companies
Quality Vigilance Ltd works specifically with smaller pharmaceutical manufacturers, importers, and specialist operators navigating GMP compliance without the internal resource depth that larger sites take for granted. Their support covers:
- Conducting full Pharmaceutical Quality System gap assessments against current MHRA inspection expectations, identifying the highest-risk areas and prioritising remediation in a practical sequence
- Writing and reviewing SOPs, deviation procedures, CAPA frameworks, qualification protocols, and management review processes to the standard an inspector will expect, not just what is internally acceptable
- Building training matrices and competency frameworks that link role responsibilities to documented training records, ensuring the evidence trail holds up at inspection
- Performing mock MHRA inspections that test documentation, staff responses, and QMS evidence trails in the same way an inspector would, producing a findings report that drives genuine preparation
- Supporting live inspection responses and post-inspection CAPA writing, ensuring root cause investigations reach the depth the MHRA requires and that corrective actions address systemic causes rather than surface symptoms
- Delivering data integrity remediation programmes for organisations that have received, or are at risk of receiving, findings related to audit trail management, electronic record controls, or ALCOA+ compliance
- Addressing qualification and validation backlogs through structured programmes that prioritise risk and produce the lifecycle documentation an inspector will look for
- Providing QP support, interim quality resource, and Responsible Person services for companies managing personnel gaps that have left key compliance roles exposed
Visit qualityvigilance.com or contact the team directly at [email protected] to discuss your current GMP compliance position and where structured external support would make the most practical difference.