A common finding when auditing is discovering that the organisation or department that you are auditing is not following their own internal procedure or policy. This is a non-conformity, and should be raised as such. The problem is – what clause of the standard actually states that you should follow your procedures? On investigation this is not as easy to find as you might like to think!
In European Union GMP (EU GMP) the main chapter to look at is Chapter 4 on Documentation (Chapter 4 Documentation OLD). This was updated recently, but the one that has been in place for many years is here. Amazingly despite the fact that the chapter is very detailed on what documents and records a site should have, there is no mention of actually having to follow any of them! This is a problem and auditors needed to look elsewhere in GMP to find a clause that stated “you must follow your procedures”. If you looked in Chapter 5 on Production then clause 5.2 provides the answer “all handling of materials and products, such as receipt and quarantine, sampling, storage, labelling, dispensing, processing, packaging and distribution should be done in accordance with written procedures”. In addition Chapter 2 on Personnel also has clause in relation to the responsibilities of the Head of Production (clause 2.5) which states “to ensure that products are produced and stored according to the appropriate documentation”. This should be the end of this discussion, however a gap remains. What about Quality Control personnel? Do they not have to follow their testing procedures? For this we can look in Chapter 6 on Quality Control where it states at clause 6.2 that “all these operations should be carried out in accordance with written procedures”. So there we have it – it is there, but you just need to hunt around a bit to find it. In order to improve the situation and to cover the need to follow procedures that are not Production and QC related then Chapter 4 was updated in 2011 with a new clause 4.1 which states that “all types of document should be defined and adhered to” so now you don’t have to refer to clauses 5.2 and 6.2 as you can refer to the more obvious clause 4.1 contained within the recently updated chapter on Documentation (Chapter 4 Documentation NEW).
In USA GMP there is also a requirement to follow your procedures and this can be seen at clause 211.100b of 21CFR211 where, for Production, it states “written production and process control procedures shall be followed” and clause 211.160a, for Quality Control, where is states “the requirements in this subpart shall be followed and shall be documented”.
In audits against ISO 9001 then it is very difficult to find a clause that states “you must follow your procedures”. It certainly does not say to do this at clause 4.2.3 that covers Control of Documents. The clause to use for not following procedures in ISO 9001 is clause 4.1f which states that the organisation shall “implement actions necessary to achieve planned results”. Here the key word is “implement” – in other words you must do what you say you are going to do. The word “implement” is also stated in the opening line of clause 4.1 too. So as a strange coincidence the clause for following your procedures in both EU GMP and ISO 9001 is clause 4.1.
I hope this is of interest – feel free to comment or drop me an email info@inspiredpharma.com
Dominic
Annex 1 has finally arrived, 25th Aug 2022 saw the publication of Annex 1. Normally, updates to GMP chapters and Annexes have a 6-month lead time for implementation. In the case of the new Annex 1, the lead time is 12 months, except for clause 8.123 relating to lyophilization which has 24 months lead time.
Annex 1 was first issued in 1971 as the only annex in the first ever UK guide to Good Manufacturing Practice. Since then, there have been several updates but not full revisions. In 2012 there was a proposal to revise Annex 1 with a re-proposal in 2014 by the UK’s MHRA. At the time, a full rewrite was considered unlikely and instead the intention was to provide a document that would confirm regulatory expectation and as such, not place any new requirements or costs on the pharmaceutical industry.
While this principle, is still upheld, it was clear from the first draft for public comment of December 2017, that a rewrite was being undertaken. The first draft created around 6200 comments coming from regulatory organizations, such as the pharmaceutical cooperation scheme, regulatory bodies outside of the EU, support organizations such as the Parenteral Drug Association, the Parenteral and Healthcare Sciences Society, the Pharmaceutical Microbiology Interest group as well as representatives from the manufacturers within the pharmaceutical industry to name just a few. Rarely do updates require a second public consultation but in the case of the annex 1 update a second draft was issued in March 2020 although this was a more targeted review in terms of the sections and clauses that comment was being sought for.
About the author

Andy Martin
Andy started working in the Pharmaceutical industry in 1985 as a lab technician for Smith & Nephew. Following this he had a number of roles culminating when he took over as QA Microbiology Manager. In 2003 he moved into Pharmaceutical Training and then in 2007 he moved back into Microbiology when he took up the position of Microbiology Manager for Catalent Pharma Solutions. Since 2012 he has operated as a consultant specialising in Microbiology and Quality Systems.
Training courses on Annex 1
There are a number of half-day workshops organised to take you through the changes in more detail and to look at how they relate to your organisation.
Our 2-day course is updated for Annex 1 changes
Related Articles
Find out about our course ranges
GMP Training
QMS Training
GDP/RP Training
GMP Compliance
QP Training
GDP Compliance
Free Taster courses
To try a free taster of our online courses to see if they are of interest visit this page.
Thanks a lot!!!, I have been looking to find the exact clause in ISO 9001:2008 to make the NCR for not following their own procedure.
I have one more outstanding problem, what clause in the ISO 9001:2008 talks about or require you to have a process, proper procedure etc regarding the PREVENTIVE MAINTENANCE OF THE MACHINE used for your production? Not procedures to use the machine to produce the product but procedures to maintain the machine?…
Thanks in advance!
Clause 8.5.3 covers Preventive Action (stopping something going wrong) and clauses 6.3 and 6.4 cover suitable infrastructure and work environment. The words preventive maintenance is not specifically mentioned however. Hope this helps. Dominic
Thanks Dominic.. What I understand about Clause 8.5.3 is the Preventive Action to stop your product going wrong, not the machine which produce the product. But yes, by stopping the machine from breaking down, you prevent your product from going wrong.
Yes – and dont forget that ISO is not just about product quality – it’s about processes. A “product” is the output of a process. The “product” may not always be the “finished product”, for example an output of the training process is a trained person, an output of the maintenance process is a maintained piece of equipment. Hope this helps. Dominic
Valuable information ..I am delighted to read this article..thank you for giving us this useful information. Great walk-through. I value this post.
FDA rules and regulations. gmp training