What Good Manufacturing Practice Actually Requires

Answer first: the rules are a floor, and breaking them is itself the violation

Current good manufacturing practice is a set of regulations in Title 21 of the Code of Federal Regulations. Part 210 states what they are; part 211 states what they require of anyone making a finished drug product. Part 210 describes itself as containing "the minimum current good manufacturing practice" for the methods, facilities and controls used in the manufacture, processing, packing or holding of a drug, so that the drug "meets the requirements of the act as to safety, and has the identity and strength and meets the quality and purity characteristics that it purports or is represented to possess."

The enforcement mechanism is the part worth understanding. Part 210 goes on to say that failure to comply with any of these regulations "shall render such drug to be adulterated under section 501(a)(2)(B) of the act and such drug, as well as the person who is responsible for the failure to comply, shall be subject to regulatory action." The statute behind that citation, 21 U.S.C. 351, says a drug is deemed adulterated if the methods, facilities or controls used for its manufacture "do not conform to or are not operated or administered in conformity with current good manufacturing practice."

Read those two sentences together and the structure is clear. Nobody has to prove that a particular vial is contaminated. If the process departed from the rules, the product is adulterated as a matter of law. That is why inspection findings about paperwork and procedure can carry consequences that seem out of proportion to the paperwork: under this statute, the process is the standard.

There has to be an office with the power to say no

The first structural requirement in part 211 is a quality control unit. The regulation gives it "the responsibility and authority to approve or reject all components, drug product containers, closures, in-process materials, packaging material, labeling, and drug products, and the authority to review production records to assure that no errors have occurred or, if errors have occurred, that they have been fully investigated."

Two clauses in that sentence do most of the work. Authority to reject means the unit is not advisory. And the list runs from raw components all the way to labeling, so a labeling error sits inside the same approval gate as a chemistry error. The regulation adds that the quality control unit is "responsible for approving or rejecting drug products manufactured, processed, packed, or held under contract by another company" — outsourcing a step does not outsource the decision.

The unit also has to have somewhere to work: the regulation requires that adequate laboratory facilities for testing and approval or rejection "be available to the quality control unit." And its own responsibilities and procedures "shall be in writing; such written procedures shall be followed." That last clause, written and then followed, recurs throughout the part and is the sentence most often at issue when a facility is found out of compliance.

Written procedures, recorded deviations, investigated discrepancies

Part 211 requires written procedures for production and process control "designed to assure that the drug products have the identity, strength, quality, and purity they purport or are represented to possess," drafted and approved by the appropriate organizational units and approved by the quality control unit. It then adds the rule that gives the requirement teeth: those procedures "shall be followed in the execution of the various production and process control functions and shall be documented at the time of performance. Any deviation from the written procedures shall be recorded and justified."

Documented at the time of performance rules out reconstructing a record afterwards. Recorded and justified means a deviation is not automatically a violation — but an unrecorded one is.

Before a batch leaves, the production and control records, "including those for packaging and labeling," have to be reviewed and approved by the quality control unit. If there is any unexplained discrepancy, or a batch or any component fails to meet a specification, the regulation requires that it "shall be thoroughly investigated, whether or not the batch has already been distributed," and that the investigation "shall extend to other batches of the same drug product and other drug products that may have been associated with the specific failure or discrepancy." A written record of the investigation, including conclusions and followup, is required.

That sentence — whether or not the batch has already been distributed — is the reason a manufacturing problem discovered late still triggers work rather than a shrug.

Complaints, returns, and the products that may not come back

Complaints are not informal under this part. A manufacturer must have written procedures describing the handling of "all written and oral complaints regarding a drug product," including review by the quality control unit of any complaint involving a possible failure to meet a specification, and a determination of whether an investigation is needed. The procedures also have to include review of whether the complaint "represents a serious and unexpected adverse drug experience" that must be reported to FDA under the postmarketing reporting rules.

Each complaint gets a written record naming, where known, the product and strength, lot number, complainant, nature of the complaint and reply. Where no investigation was conducted, the record must state "the reason that an investigation was found not to be necessary and the name of the responsible person making such a determination." A decision not to investigate is itself a documented decision with a name attached to it.

Returns are handled by a separate subpart. Returned drug products "shall be identified as such and held." If the conditions of storage or shipping, or the condition of the product, container, carton or labeling, cast doubt on safety, identity, strength, quality or purity, the returned product "shall be destroyed unless examination, testing, or other investigations prove" it meets appropriate standards. If the reason for a return implicates other batches, the same investigation duty applies.

Salvage is narrower still. Products subjected to improper storage conditions — the regulation lists extremes of temperature, humidity, smoke, fumes, pressure, age or radiation arising from natural disasters, fires, accidents or equipment failures — "shall not be salvaged and returned to the marketplace." Where there is a question, salvaging may proceed only on laboratory evidence that the products meet all applicable standards and inspection evidence that they were not subjected to improper conditions. Sensory examination is "acceptable only as supplemental evidence."

Where the rulebook stops, and the compounding split written into the statute

Part 211 states its own scope: it contains the minimum practice "for preparation of drug products (excluding positron emission tomography drugs and medical gases...) for administration to humans or animals." Part 210 carves out one more case — an investigational drug used in a phase 1 study is subject to the statutory requirement in 21 U.S.C. 351(a)(2)(B) but exempt from part 211, an exemption that ends once the drug is used in a phase 2 or 3 study or is lawfully marketed.

The sharpest boundary is in the compounding statutes, and it is worth reading the two side by side because they are not the same list. Section 353a, which covers traditional pharmacy compounding, opens: "Sections 351(a)(2)(B), 352(f)(1), and 355 of this title shall not apply to a drug product if the drug product is compounded for an identified individual patient based on the receipt of a valid prescription order..." The first item on that list is the CGMP provision.

Section 353b, which covers outsourcing facilities, opens with a shorter list: "Sections 352(f)(1), 355, and 360eee-1 of this title shall not apply to a drug compounded by or under the direct supervision of a licensed pharmacist in a facility that elects to register as an outsourcing facility if each of the following conditions is met." The CGMP provision is absent from that list.

So the statute treats the two categories differently on exactly this point, and the difference is visible in the text rather than inferred from commentary. Neither section is a statement about the quality of any particular preparation, and nothing here says what any specific facility does.

What a reader can and cannot get from this

None of this is visible on a box. A carton does not report whether a deviation was recorded, whether a discrepancy was investigated, or whether a returned unit was destroyed rather than resold. Those records exist inside a facility and are seen by inspectors.

What the rulebook does give a reader is a vocabulary for reading public enforcement documents. When an inspection report or a warning letter refers to a quality control unit, to written procedures not being followed, to an inadequate investigation of a discrepancy, or to salvaged product, each of those phrases points at a specific numbered requirement rather than a general complaint about tidiness.

It also explains a mismatch people find strange. A facility can be cited without any patient being harmed and without any product testing badly, because the standard is conformity with the practice, and the statute deems nonconformity to be adulteration on its own. The absence of a reported injury is not evidence of compliance, and a citation is not evidence of injury. They are answers to different questions.