Welcome to the 10 Golden Rules of GMP
This interactive eLearning course provides a straightforward, high-level introduction to Good Manufacturing Practice (GMP) compliance requirements — distilled into 10 clear, actionable rules applicable across pharmaceutical, veterinary medicines, and medical device manufacturing.
What Are the 10 Golden Rules?
GMP regulations governing pharmaceutical and medical device manufacturing can seem overwhelming. To simplify orientation for personnel, contractors, and new suppliers, this course covers the ten most fundamental principles — the "Golden Rules" — that underpin every effective GMP compliance program.
Who Should Take This Course?
Regardless of your specific role or job title, everyone working in or supplying to GMP-regulated industries must understand and comply with GMP requirements. This course is suitable for:
- New employees requiring induction/orientation GMP training
- Existing employees requiring annual GMP refresher training
- Contractors, suppliers, and managers in regulated industries
- Personnel in warehousing, shipping, supply chain, and logistics
- New graduates and job applicants entering the pharmaceutical sector
- Individuals re-entering the GMP industry after a career gap
- Personnel in cosmetic manufacturing also governed by GMP guidelines
Applicable Regulatory Frameworks
This course is designed to enhance compliance with GMP guidelines published by multiple regulatory authorities, including:
🇺🇸 US FDA
21 CFR Parts 210/211 (pharmaceutical), 820 (medical devices), and related guidance documents covering manufacturing quality systems.
🇪🇺 EU EMA / PIC/S
EU GMP Guidelines (EudraLex Vol. 4) and Pharmaceutical Inspection Co-operation Scheme (PIC/S) guides adopted by 55+ member authorities globally.
🇦🇺 Australian TGA
Therapeutic Goods Administration GMP requirements for medicines, biologicals, and medical devices supplied in Australia.
🇬🇧 UK MHRA
Medicines and Healthcare products Regulatory Agency GMP standards applicable to UK manufacturing post-Brexit.
Course Structure & Requirements
The course contains 10 content modules — one per Golden Rule — each with a knowledge check quiz. Score 70% or higher on each quiz to mark it complete. A 15-question final assessment requires 80% to earn your Certificate of Completion.
This eLearning course does not replace onsite, product-specific GMP training. Adequate supervision and role-specific mentoring remain essential components of any GMP compliance program. Use this course as foundational or supplemental training only.
Your Certificate of Completion
After passing the final assessment, you will receive a downloadable Certificate of Completion. This certificate can be attached to your resume, included in job applications, and submitted to your Human Resources or Quality Management Department for your personnel training file. It is valid as documentation of completion of this specific eLearning module.
Get the Facility Design Right from the Start
The physical design of a GMP-regulated facility is not merely a construction matter — it is a foundational quality and compliance decision. Mistakes made at the design stage are costly, difficult to correct, and can compromise product safety for the life of the facility.
Why Facility Design Matters
GMP-compliant facility design ensures that the physical environment supports — rather than undermines — the production of safe, effective, and high-quality products. Regulatory authorities expect manufacturers to design out risk wherever possible rather than relying solely on procedural controls.
Core Design Principles
- Unidirectional flow: People, materials, and waste should flow in one direction — from clean to less clean — to prevent cross-contamination
- Segregation: Separate areas for raw materials, production, packaging, quarantine, and rejected goods
- Cleanability: Smooth, impermeable surfaces; coved junctions; minimal ledges; easily accessible equipment
- Controlled access: Restrict access to production areas to authorized personnel only
- Airflow and pressure differentials: Positive pressure in clean areas relative to surrounding areas to prevent ingress of contamination
Buildings and facilities used in the manufacture, processing, packing, or holding of drug products shall be of suitable size, construction, and location to facilitate cleaning, maintenance, and proper operations. (Ref: 21 CFR 211.42)
Key Facility Zones in Pharmaceutical Manufacturing
🟢 Controlled Areas
Areas where environmental conditions (temperature, humidity, air quality) are monitored and controlled. Access is restricted and gowning requirements apply.
🔵 Clean Rooms
Classified areas (ISO 5–8 / EU Grade A–D) with defined particulate and microbial limits. Required for sterile product manufacturing.
🟡 Quarantine Zones
Designated areas for materials pending release or rejection. Must be physically segregated or clearly marked to prevent inadvertent use.
🔴 Reject & Waste Areas
Separate, labeled areas for rejected materials and waste. Must be secured and managed to prevent mixing with conforming product.
Involve QA, regulatory, and operations teams in facility design from day one. Retrofitting GMP-compliant design features into an existing facility is far more expensive than building them in from the start. Commissioning and qualification (C&Q) activities must be planned alongside construction.
Utilities and Services
GMP facilities require dedicated, qualified utilities including purified water systems, water for injection (WFI) where required, HVAC systems with appropriate filtration, compressed gases, and steam. All critical utilities must be qualified and routinely monitored to ensure they perform consistently within defined parameters.
Validate Processes
Process validation is the documented evidence that a process consistently produces a product meeting its predetermined specifications. In GMP-regulated industries, validation is not optional — it is a regulatory requirement and the cornerstone of product quality assurance.
What is Process Validation?
Process validation provides documented evidence that a process, operated within established parameters, can perform effectively and reproducibly to produce a medicinal product meeting its predetermined specifications and quality attributes.
Process validation is defined as the collection and evaluation of data, from the process design stage through commercial production, which establishes scientific evidence that a process is capable of consistently delivering quality product.
The Three Stages of Process Validation (FDA Model)
- Stage 1 — Process Design: The commercial manufacturing process is defined based on knowledge gained through development and scale-up activities
- Stage 2 — Process Qualification: The process design is evaluated to determine if it is capable of reproducible commercial manufacturing
- Stage 3 — Continued Process Verification: Ongoing assurance during routine production that the process remains in a state of control
What Else Must Be Validated?
Beyond manufacturing processes, GMP regulations require validation/qualification of many critical systems:
🧪 Analytical Methods
Test methods used for product release must be validated to demonstrate specificity, accuracy, precision, and linearity (ICH Q2).
🖥 Computer Systems
Computer systems used in GMP activities must be validated (CSV/CSA). Data integrity must be assured throughout the system's lifecycle.
🧹 Cleaning Processes
Cleaning procedures must be validated to demonstrate removal of product residues, cleaning agents, and microbial contamination to acceptable levels.
🌡 Equipment Qualification
Critical equipment must be qualified through IQ (Installation Qualification), OQ (Operational Qualification), and PQ (Performance Qualification).
Any change to a validated process, equipment, facility, or system must go through a formal change control process. Changes may require revalidation. Never implement changes to validated processes without documented authorization from QA.
Write Good Procedures and Follow Them
Standard Operating Procedures (SOPs) are the backbone of GMP compliance. They define how critical activities must be performed — consistently, correctly, and completely — every time. An SOP that is written but not followed is worse than useless: it creates a documented deviation.
What Makes a Good SOP?
A good Standard Operating Procedure is written for the person who will actually use it — not for the auditor who will review it. It must be clear, accurate, and achievable under real operating conditions.
Characteristics of an Effective SOP
- Written at the right level: Uses language the target audience understands
- Step-by-step: Provides clear, sequential instructions with no ambiguity
- Accurate: Reflects how the process is actually performed (not an idealized version)
- Reviewed and approved: Signed off by appropriate SME, QA, and management
- Version controlled: Current version clearly identified; superseded versions withdrawn
- Accessible: Available to the people who need them, at the point of use
- Reviewed periodically: Scheduled review cycle (typically annually or after changes)
Written procedures and instructions shall be in clear and unambiguous language specifically applicable to the facilities provided. They shall be drafted, reviewed, and approved by appropriate authorized persons. (Ref: EU GMP Annex 11 / PIC/S GMP Guide)
The Document Control System
All GMP documents must be managed within a formal document control system that ensures only current, approved versions are in use, that changes are tracked, and that obsolete documents are promptly removed from circulation.
📝 Document Hierarchy
Policies → SOPs → Work Instructions → Forms/Records. Each level provides progressively more detailed guidance, with records providing evidence of compliance.
🔄 Version Control
Each document must have a unique identifier, version number, and effective date. Previous versions must be archived but clearly superseded to prevent accidental use.
✍️ Review & Approval
SOPs require review by subject matter experts and approval by QA before implementation. The review and approval signatures with dates must be documented.
⚠️ Deviations
Any departure from an approved SOP must be documented as a deviation and investigated. "We always do it differently" is not acceptable — update the SOP instead.
Following SOPs is not optional. If an SOP describes a step that is consistently skipped in practice, the SOP must be formally revised through the document control process — not informally bypassed. Regulatory inspectors routinely compare documented procedures against actual practice and flag discrepancies as critical findings.
Identify Who Does What
Clarity of roles, responsibilities, and authorities is fundamental to GMP compliance. When everyone knows exactly what they are responsible for — and what they are not — accountability improves, gaps are eliminated, and compliance becomes systematic rather than accidental.
Job Descriptions and Organizational Charts
GMP regulations require that the responsibilities of all personnel engaged in the manufacture of pharmaceutical products be defined in written job descriptions. An organizational chart must also be available to show the hierarchical relationships between key roles.
There shall be an adequate number of personnel with the necessary qualifications and practical experience for the manufacture of pharmaceutical products. The responsibilities placed on any one individual shall not be so extensive as to present any risk to quality. (Ref: EU GMP Guide Chapter 2)
Key GMP Roles and Their Responsibilities
🔬 Qualified Person (QP)
In EU/PIC/S regulated jurisdictions, the QP is legally responsible for certifying that each batch meets all applicable requirements before release for sale. Must be named and qualified under EU law.
🛡 Quality Assurance (QA)
Responsible for the overall Quality Management System. Approves SOPs, investigates deviations, manages CAPA, and has final authority on product release decisions.
🏭 Production
Responsible for manufacturing products in accordance with approved batch records and SOPs. Production management must ensure operations are carried out correctly and in compliance.
🧪 Quality Control (QC)
Responsible for sampling, testing, and releasing or rejecting raw materials, intermediates, and finished products based on defined specifications.
Independence of QA from Production
A fundamental GMP principle is that the Quality unit must be independent from production. This independence is essential to prevent production pressure from influencing quality decisions. QA must have the authority to reject product even when it causes significant commercial or scheduling consequences.
GMP regulations generally prohibit the same individual from having authority over both production decisions and quality release decisions. Where organizational size makes full separation impractical, sufficient controls must be in place to manage the conflict of interest.
Delegation and Backups
For every critical GMP role, there must be an identified and qualified backup. Documented delegation of authority ensures that critical activities are never delayed or compromised due to personnel absence. Delegation must be documented and limited to appropriately qualified individuals.
Keep Good Records
In GMP, documentation is not a bureaucratic burden — it is the means by which a manufacturer demonstrates that every step in producing a medicine or medical device was performed correctly. Without good records, there is no traceability, no accountability, and no compliance.
Data Integrity — ALCOA+ Principles
Regulatory authorities globally require that all GMP data meets the ALCOA+ standard. Data integrity failures are consistently among the most serious findings in FDA warning letters and regulatory actions.
A — Attributable
It must be clear who recorded the data and when. Every entry must be identifiable to the person who made it.
L — Legible
Records must be readable permanently. Pencil is not acceptable. Crossed-out text must remain readable with a single line and the correction initialed and dated.
C — Contemporaneous
Data must be recorded at the time the activity occurs — not reconstructed afterward from memory or rough notes.
O — Original
The first recording of data is the original. Transcriptions must be traceable to originals. Copies must be verified.
A — Accurate
Data must reflect what was actually observed or measured, without rounding, estimation, or manipulation.
+ Complete, Consistent, Enduring, Available
Records must be complete (no blank fields), consistent with other records, stored to remain readable for the required retention period, and accessible to authorized parties.
Data integrity violations — including backdating records, falsifying entries, selectively reporting results, or deleting data — are among the most serious GMP violations. They can result in product recalls, consent decrees, facility shutdowns, and criminal prosecution of individuals. There is no legitimate reason to manipulate GMP records.
Record Retention
GMP records must be retained for specified minimum periods defined in regulations. For pharmaceutical products, batch records must typically be retained for at least one year after the expiry date of the batch or three years after certification (whichever is longer). Specific requirements vary by jurisdiction and product type.
Electronic records in GMP systems must meet the same ALCOA+ standards as paper records, with additional requirements for audit trails, access controls, and backup/recovery. Refer to FDA 21 CFR Part 11 and EU GMP Annex 11 for electronic records and signatures requirements.
Train and Develop Staff
Every GMP-regulated manufacturer is ultimately dependent on the competence and commitment of its people. Regulations require that all personnel involved in manufacturing operations receive training appropriate to their duties — and that this training is documented and its effectiveness verified.
GMP Training Requirements
All personnel whose duties bring them into contact with manufacturing areas, or whose activities may affect the quality of the product, must receive training on GMP principles and on the specific procedures relevant to their job function.
All personnel should receive initial and continuing training, the extent of which should be determined by their tasks and the objectives of the GMP, and should include hygiene instructions relevant to their duties. Training records shall be maintained. (Ref: EU GMP Guide Chapter 2 / PIC/S)
Components of an Effective GMP Training Program
- Induction training: General GMP principles, site rules, hygiene, safety, and role expectations for all new starters
- Role-specific training: SOPs, work instructions, and skills specific to the individual's job function
- On-the-job training: Supervised practice under qualified personnel until competence is demonstrated
- Refresher training: Periodic retraining to maintain standards and respond to procedure updates
- Change-driven training: Mandatory training whenever SOPs, equipment, or processes change
- Training effectiveness assessment: Tests, observation, or competency demonstration to verify learning
📁 Training Records
Records must capture: employee name, date of training, topic/SOP trained on, trainer name, and assessment result. Records must be retained and be accessible for regulatory inspection.
🔄 Training Matrix
A training matrix maps each role/person to the SOPs and training modules required for their job. It provides a systematic way to identify training gaps and track completion status.
📊 Training Effectiveness
Training must be evaluated for effectiveness — not just attendance. Knowledge checks, skills assessments, and post-training performance observation all contribute to demonstrating that training has achieved its objective.
🎯 Qualified Trainers
Trainers must themselves be competent in the subject matter. Where possible, train-the-trainer programs ensure that internal training is delivered consistently and accurately.
Completing an orientation course on day one does not make an employee GMP-competent for the duration of their career. Training must be ongoing, responsive to changes, and regularly refreshed. Regulatory inspectors specifically look for evidence of continuing training programs — not just initial induction records.
Practice Good Hygiene
Personnel are one of the primary sources of contamination in pharmaceutical and medical device manufacturing. Every person entering a GMP area carries the potential to introduce microbial, chemical, or particulate contamination. Good hygiene practices are the first line of defense.
Personal Hygiene Requirements
All personnel must maintain a high degree of personal cleanliness. This is a non-negotiable requirement in GMP manufacturing environments — it applies equally to full-time employees, contractors, and visitors.
- Shower or bathe regularly; report to work clean
- Keep fingernails short and clean; no nail varnish or false nails
- No perfumes, strong aftershave, or scented products in manufacturing areas
- No personal medications or jewelry (other than a plain wedding band in some cases) in manufacturing areas
- Report illness, skin conditions, or infections immediately to supervisor
Gowning Requirements
Appropriate protective clothing must be worn in GMP manufacturing areas. Gowning requirements vary by cleanliness class of the area:
🟢 General Manufacturing
Site uniform/lab coat, hair covering, beard covering (if applicable), dedicated footwear or shoe covers. Gloves required for product contact.
🔵 Controlled Areas
Full body suit (coverall), head cover, face mask, gloves, dedicated footwear. No exposed skin. Gowning procedure must be followed in sequence.
⚪ Sterile Areas (Grade A/B)
Sterile gown, hood, face mask, two pairs of sterile gloves, overshoes. Extensive aseptic gowning qualification required. Strict behavior code in cleanroom.
🔄 Gown Management
Gowns must be laundered, inspected, and — for higher-grade areas — sterilized at defined frequencies. Damaged or contaminated gowns must be removed from service.
Health and Illness Controls
Personnel who have or are suspected to have conditions that could adversely affect product quality must be excluded from direct contact with starting materials, primary packaging, and in-process or finished products.
Employees must be trained — and feel empowered — to report symptoms of illness without fear of penalty. A culture where employees come to work sick because they fear consequences is a GMP failure. Clear, written procedures for health reporting and exclusion criteria must exist and be communicated to all personnel.
Visitors and contractors are not exempt from GMP hygiene rules. All persons entering GMP areas must receive a hygiene briefing and comply with all applicable gowning and behavior requirements. Escort by trained personnel is required for visitors who have not undergone site-specific GMP induction.
Maintain Facilities and Equipment
Poorly maintained facilities and equipment are a major source of product contamination and process failure in GMP manufacturing. A proactive, documented preventive maintenance program is a regulatory requirement — not simply good operational practice.
Preventive Maintenance Programs
GMP facilities must have a written preventive maintenance (PM) program covering all critical equipment and facilities. The program defines what maintenance activities are required, how frequently, who performs them, and how they are documented.
Elements of a GMP Preventive Maintenance Program
- Comprehensive equipment register (all GMP-critical equipment listed)
- Scheduled maintenance tasks with defined frequencies
- Written maintenance procedures for each task
- Qualified personnel to perform and/or verify maintenance work
- Documentation of all maintenance activities with date, technician, and outcome
- Spare parts inventory for critical components
- Process for assessing GMP impact of maintenance activities
Buildings and equipment shall be maintained in a good state of repair. Maintenance operations shall not present any hazard to the quality of products. (Ref: EU GMP Guide Chapter 3 & 5 / PIC/S)
Equipment Calibration
All measuring, weighing, recording, and control equipment must be calibrated at defined intervals against traceable standards. Out-of-calibration instruments can produce inaccurate measurements that affect product quality and safety without any visible indication that something is wrong.
📅 Calibration Schedule
Each instrument must have a defined calibration interval based on usage, criticality, and manufacturer recommendations. Instruments past their calibration due date must be taken out of service immediately.
🔗 Traceable Standards
Calibration must be traceable to national or international measurement standards. Calibration certificates must identify the reference standards used and their own calibration status.
📊 Out-of-Tolerance Findings
When a calibration reveals the instrument was out of tolerance, a retrospective impact assessment must be performed on any measurements made with that instrument since the last in-tolerance calibration.
🏷 Calibration Labels
Calibrated instruments must display a label showing the calibration date, due date, and calibration status. Instruments without current calibration labels must not be used in GMP activities.
Maintenance activities near active production lines introduce specific risks including metal shavings, lubricants, tools, and parts being left in equipment. After any maintenance in a GMP area, a formal pre-startup inspection and cleaning must be completed and documented before production resumes.
Build Quality Into the Whole Product Lifecycle
Quality cannot be tested into a product after manufacture. It must be designed and built in from the earliest stages of development through to discontinuation. This Quality by Design (QbD) philosophy is the foundation of modern pharmaceutical quality systems.
Quality by Design (QbD)
Quality by Design means systematically understanding how product and process variables affect quality outcomes, and designing processes that are inherently robust. Rather than defining quality by meeting a specification after the fact, QbD defines quality in terms of the patient outcome from the outset.
The goal of the Pharmaceutical Quality System is to ensure that products are designed and developed to facilitate manufacturing operations, controls are developed that reflect the product and process understanding, and the QMS facilitates innovation and continual improvement. (Ref: ICH Q10)
The Product Lifecycle in GMP
🔬 Development
Define the target product profile. Conduct risk assessments. Identify critical quality attributes (CQAs) and critical process parameters (CPPs) that affect product safety and efficacy.
🏭 Technology Transfer
Transfer the process from development to manufacturing with documented protocols. Verify that the manufacturing scale process performs equivalently to the development process.
⚙️ Commercial Manufacturing
Manufacture consistently within validated parameters. Monitor product and process performance through continued process verification. Detect and investigate trends before they become failures.
🔚 Product Discontinuation
Manage the withdrawal of a product from the market in a controlled manner. Ensure appropriate retention of records, reserve samples, and documentation for the required period.
Corrective and Preventive Action (CAPA)
CAPA is the engine of continual improvement in a GMP quality system. When a deviation, out-of-specification result, complaint, or audit finding occurs, CAPA drives root cause investigation and systematic corrective action to prevent recurrence.
- Corrective Action: Addresses the immediate problem and its root cause to prevent recurrence
- Preventive Action: Addresses potential problems identified through trending and risk assessment before they cause actual failures
Building quality into the lifecycle requires a quality culture — an environment where every employee takes personal responsibility for quality, feels safe to raise concerns, and understands how their individual role affects product safety and patient outcomes. No quality system succeeds without this cultural foundation.
Perform Regular Audits
Audits are the GMP system's self-checking mechanism. Regular internal and external audits provide independent verification that the quality management system is functioning as intended, detect gaps before regulators do, and drive continual improvement.
Types of GMP Audits
🔵 Internal (First-Party) Audits
Self-inspections conducted by trained internal auditors. Required by GMP regulations. Must cover all aspects of the QMS on a defined schedule. Findings must be documented and CAPA initiated.
🟢 Supplier / Customer (Second-Party) Audits
Audits of suppliers, contract manufacturers, and laboratories to verify their GMP compliance. Required as part of supplier qualification and ongoing supplier management.
🔴 Regulatory (Third-Party) Audits
Inspections by regulatory authorities (FDA, TGA, EMA, MHRA, etc.). Unannounced or announced. Findings are classified by severity. Serious findings may result in warning letters or import alerts.
📋 Mock Regulatory Audits
Simulated regulatory inspections conducted by qualified internal or external auditors. Identify gaps and train personnel on inspection readiness before an actual regulatory inspection.
Self-inspections shall be conducted in order to monitor the implementation and compliance with GMP principles and to propose necessary corrective measures. Personnel matters, premises, equipment, documentation, production, quality control, distribution of the medicinal products, arrangements for dealing with complaints and recalls, and self-inspection shall be examined at intervals following a pre-arranged programme. (Ref: EU GMP Chapter 9 / PIC/S)
The Audit Cycle
- Plan: Define scope, schedule, and criteria. Assign trained, independent auditors
- Prepare: Review previous findings, SOPs, and relevant data. Develop audit checklist
- Conduct: Interview staff, observe operations, review records, test systems
- Report: Document findings with objective evidence. Classify by severity. Distribute to management
- CAPA: Initiate corrective and preventive actions for all findings. Set timelines and owners
- Verify: Follow up to confirm CAPA effectiveness. Close findings when verified
Regulatory Inspection Readiness
GMP-regulated facilities should be inspection-ready at all times — not just when an inspection is scheduled. This means maintaining complete, current records, having personnel trained and available to respond to inspectors, and ensuring that the facility and systems are always in compliance.
Treat audit findings — including those from regulatory inspections — as opportunities to improve, not as attacks to defend against. Organizations that respond to findings with genuine CAPA rather than superficial fixes demonstrate the quality culture that regulators are looking for. Regulators can tell the difference.
Auditors must be independent of the area they are auditing. Self-inspection of one's own work lacks the objectivity required for effective audit. Internal auditors must be trained and qualified, and their independence must be demonstrated and documented.
Final Assessment
Congratulations on completing all 10 modules. This final assessment covers all 10 Golden Rules. You must score 80% or higher (12 of 15 correct) to receive your Certificate of Completion.
Course Complete!
You have successfully completed the 10 Golden Rules of GMP training. Your Certificate of Completion is ready — it can be attached to your résumé, job application, and submitted to your HR or Quality Management Department.
medical device manufacturing, and related GMP-regulated industries.
eLearning does not replace onsite, product-specific GMP training.