You’ve framed the certificate and the team have had their celebratory biscuits. Then Tuesday hits: a cleaning log is half-complete, your biggest supplier tweaks a spec without warning, and a line operator asks whether the new sieve needs revalidation. That’s life after the first audit. The good news: staying compliant is perfectly manageable if you set a steady rhythm and keep the basics tight.
If you’re still exploring GMP certification, the maintenance steps below will give you a realistic picture of day-to-day discipline. If you’ve already passed, think of this as a practical tune-up rather than a grand overhaul.
The audit is done – now your calendar matters
Your first certificate isn’t a one-and-done. You’ll have surveillance assessments at set intervals and a re-certification at the end of the cycle. Treat these like routine health checks. You don’t cram for them; you build habits so the system hums along.
Agree a simple year plan with your quality team. Spread the load instead of peaking just before visits. A typical pattern we see working well is monthly mini-reviews and quarterly deeper dives.
- Log surveillance dates the moment you receive them and backfill milestones.
- Schedule internal audits across the year, aligned to risk and change.
- Book your management reviews early so findings can drive actions, not panic.
- Plan training refreshers to precede seasonal peaks or product launches.
Most lapses aren’t technical; they’re calendar problems. Someone respectable but busy forgets to check thermometers after a maintenance shutdown. A simple plan and reminders prevent those slips.
Keep the system alive: people, training and daily discipline
GMP lives or dies on the shop floor. Policies are important, but behaviour makes the difference. After certification, fatigue can set in. Keep the energy up with small, steady inputs rather than occasional lectures.
- Use short 10-minute refreshers at shift start to revisit one GMP point.
- Rotate micro-assessments (one observation, one question) instead of long quizzes.
- Pair new starters with a competent buddy for the first week and record sign-offs.
- Keep a training matrix current, including agency and temporary staff.
- Check understanding by observing tasks; don’t rely on “read and understood” alone.
An example we see often: handwashing. The poster is there, the sink is clean, but mid-shift you catch shortcuts. A discreet correction and a quick huddle have more impact than a stern email. Document the observation, note the action, move on. That’s culture change in action.
Control change, complaints and CAPA without drowning
Change control
Nearly every serious nonconformity we encounter after certification involves uncontrolled change. A supplier tweaks a lubricant. Engineering swaps a like-for-like bearing. Purchasing finds a new carton because the old one is out of stock. If you don’t capture and assess those changes, your validation and risk assessments become fiction.
- Maintain a simple change log and route entries to QA for triage.
- Assess impact on product safety, quality and validation before implementation.
- Record trials, approvals and any temporary concessions with expiry dates.
- Update affected SOPs, training and specs immediately, not “later”.
Make it easy to do the right thing: one-page form, clear criteria, quick turnarounds. If it’s painful, people will work around it.
Complaints and CAPA
A complaint isn’t a failure; it’s free information. The failure is a weak CAPA that patches symptoms. Keep CAPA numbers manageable and close them decisively.
- Use structured root cause analysis (5-Whys, fishbone) on significant issues.
- Agree specific actions with owners and deadlines; avoid vague "raise awareness" tasks.
- Verify effectiveness after a period; don’t just close when a box is ticked.
- Trend recurring issues and escalate to management review if patterns persist.
One client swapped a mixing paddle and saw micro counts creep up. The fix wasn’t more sanitiser; it was a revised cleaning sequence and a training tweak. A small change, properly documented, stopped a costly drift.
Suppliers and materials: where GMP often unravels
Most GMP systems are only as strong as their incoming materials. Even well-run sites stumble when supplier oversight fades after certification.
- Keep an approved supplier list with risk-based re-approval cycles.
- Review Certificates of Analysis against current specs every batch, not just first deliveries.
- Build a simple incoming inspection plan that focuses on critical characteristics.
- Document supplier changes (site, process, formulation) and assess their impact.
- Escalate recurring defects to supplier CAPA and track closure.
Be pragmatic. You don’t need to audit every supplier every year. Focus on high-risk materials and those with change histories. Where audits aren’t practical, strengthen your incoming verification and ask better questions. Put agreements in writing, keep them accessible, and align them with your own specifications.
Measure what matters and make records easy to keep
Data keeps you honest. Pick a small set of GMP KPIs and stick with them. More charts don’t equal more control.
- Track key hygiene and environmental monitoring results and responses.
- Trend nonconformities by type and area to spot repeat offenders.
- Monitor training completion vs plan and overdue actions.
- Watch calibration and maintenance compliance, especially post-shutdown.
Records are the backbone. Make them simple, legible and available. Overcomplicated forms breed gaps that show up in surveillance.
- Design lean forms with clear fields and only essential signatures.
- Use version-controlled templates and remove old copies from circulation.
- Where digital systems are used, validate them and lock down permissions.
- Build spot checks into supervisor routines to catch small slips early.
I’m a fan of “make it easy to do right”: pens at every station, pre-labelled sample pots, and checklists sized to clipboards. The fewer obstacles, the fewer excuses.
Preparing for surveillance and the next cycle
You don’t need a war room. A steady monthly routine keeps you ready without weekend heroics before an auditor arrives.
- Run a short monthly QA huddle to review KPIs, changes and CAPA status.
- Sample a handful of records from each critical process and check for completeness.
- Walk one area with fresh eyes for housekeeping and flow, and note quick wins.
- Spot-check a supplier file and an equipment file for currency and approvals.
- Close or escalate overdue actions and update the risk register.
- Brief managers on upcoming changes, visits and resource pinch points.
Two or three months before a surveillance visit, plan a focused internal audit on the areas with most change or drift. Don’t just re-check what you’re already good at. Invite a manager from another function to observe; a different perspective reveals blind spots.
And because we’re asked this often, here are the common pitfalls we see during post-certification visits:
- Training matrices go out of date when temps arrive or roles shift.
- Supplier re-approvals slip because “we’ve used them for years”.
- Change control is bypassed for “like-for-like” swaps that weren’t like-for-like.
- Calibrations go overdue after maintenance shutdowns or equipment moves.
- Cleaning validations aren’t updated after chemicals, tools or frequencies change.
- Uncontrolled spreadsheets creep in to track actions or test results.
None of these require heroics to fix. They require ownership, visibility and routine. Be candid about trade-offs. If resource is tight, prioritise risks that affect product safety and compliance first, and defer nice-to-have projects until you’ve stabilised the essentials.
If you’d like a sounding board for your plan, or a calm pair of eyes before surveillance, the team at UKCTL are here to help. We’re happy to talk through what’s practical for your site and your budget, and to keep you confident between visits.