A Form 483 arrives with seven observations, three of these are related to the same batch-record review gap your QA team flagged six months ago. The CAPA was approved and closed, yet an FDA investigator found the issue your internal audit missed.

In Indian pharma manufacturing, this kind of scenario is fairly common. Regulators often uncover known weaknesses that audits failed to capture, escalate, or remediate.

This pharma manufacturer process audit framework helps close this exact gap: the difference between an audit that checks whether documents exist and one that checks whether they would hold up under the kind of scrutiny a regulator actually applies.

Why Pharma Needs a Sector-Specific Framework

A regular manufacturing process audit tests whether documented procedures are being followed. A pharma process audit needs to go further: it must assess whether the controls protecting product quality, patient safety, and data integrity are properly designed, operating effectively, and capable of detecting their own failures.

This is because pharmaceutical manufacturing has a risk profile that generic manufacturing audit checklists cannot fully address. 

A cleaning procedure change can create cross-contamination risk across batches. An outdated vendor qualification file can allow an unsuitable API source into the supply chain. These can affect batch quality, regulatory compliance, and ultimately patient safety.

Generic process audits usually examine whether SOPs exist, approvals are documented, inventory is controlled, and segregation of duties is reasonable. Those controls continue to be important, but they do not answer pharma-specific questions: 

• Was the process or system validated before it was relied upon? 
• Can the complete history of a batch be reconstructed? 
• Are deviations investigated to an appropriate root cause? 
• Are electronic audit trails reviewed and retained? 
• Are changes assessed for their potential impact on product quality?

This is why a pharma-specific process audit framework needs to be built around validation, batch-level traceability, and data integrity. 

The revised Schedule M has raised the baseline further. Its implementation has brought Indian GMP requirements closer to WHO and PIC/S expectations and places greater emphasis on areas such as the pharmaceutical quality system, quality risk management, product quality review, and validation. An audit framework designed before these requirements were introduced may therefore leave material gaps.

There is also a consistency issue. A manufacturer operating multiple product lines or sites needs every location assessed against a common standard. Otherwise, findings from one plant cannot be reliably compared with another, and a control improvement implemented at one site may not be replicated elsewhere.

A documented pharma audit framework reduces this dependence on individual auditor judgment. It prepares your organisation to answer the question a regulator may ultimately ask: Can you demonstrate, with reliable evidence, exactly what happened to a product, process, or batch and why you know the controls worked?

Regulatory Pressures: Schedule M, USFDA, WHO-GMP

Three regulatory pressures are shaping pharma process audit requirements in India: revised Schedule M, USFDA expectations, and WHO-GMP principles. 

Each creates a different layer of scrutiny, but all point towards the same requirement: manufacturers must be able to demonstrate that their quality systems work in practice.

Schedule M

The revised Schedule M, notified through G.S.R. 922(E) in December 2023, strengthened India’s GMP framework and brought it closer to international expectations. The revised requirements emphasise on the Pharmaceutical Quality System, Quality Risk Management, product quality review, qualification and validation, documentation, and recall systems. 

The implementation deadlines were phased according to manufacturer size. A process audit framework therefore needs to test these requirements as connected controls not as isolated compliance checkpoints.

USFDA

For manufacturers supplying the US market, Schedule M is only one part of the regulatory baseline. USFDA inspections can examine whether processes, records, computerised systems, investigations, and data can withstand detailed scrutiny. 

This is where data integrity becomes particularly important. WHO guidance similarly emphasises that GMP records should allow activities to be reconstructed and that data should remain attributable, accurate, complete, consistent, and reliable throughout its lifecycle.

A generic audit might confirm that an equipment maintenance SOP exists. A pharma-focused audit needs to ask whether maintenance failures are documented, investigated, assessed for product impact, and linked to appropriate corrective action. Likewise, it should test whether OOS investigations establish an appropriate root cause, whether audit trails are reviewed where required, and whether validated systems remain in a controlled state.

WHO-GMP

WHO-GMP adds another important dimension. GMP is not limited to production procedures. It comprises the quality management systems, validation, documentation, personnel, equipment, materials, and controls needed to consistently produce medicines to the required quality standard.

The common thread across these frameworks is self-detection and self-correction. Regulators want to see that an organisation can identify failures, investigate them, assess their impact, take effective CAPA, and maintain reliable evidence.

Therefore, a pharma audit framework should focus on regulatory risk, not just a generic checklist. The goal is to find and fix gaps internally before regulators find them during an inspection.

The Pharma Process Audit Framework

A pharma-specific process audit framework must be built around the product lifecycle, not around departmental boundaries. At PKC, we structure our pharma process audits across five stages, each designed to test a different layer of control. 

Each stage tests a different layer of control, from validation documentation to vendor and CMO oversight. Data integrity is assessed throughout rather than treated as a separate IT issue.

These stages should not operate as separate checklists. A validation gap can become a production failure, while weak data integrity can conceal or complicate both. 

A well-designed audit framework connects these findings so that the underlying root cause is identified, rather than reporting related issues as isolated observations.

Stage 1: Master Validation Documentation

The first stage tests whether validation documentation is complete, current, and linked to the processes and equipment it is intended to control. The audit should cover Validation Master Plan (VMP), equipment qualification records (DQ/IQ/OQ/PQ), process validation, cleaning validation, analytical method validation and computerised system validation

The key question is: 

• “Does the VMP cover all GMP-critical systems, including recently installed equipment? 
• Do cleaning validation studies consider scientifically justified worst-case products and sampling locations? 
• Do process validation records support the batches used to demonstrate that the process performs consistently? 
• Are qualification and validation reports approved by the appropriate personnel and properly traceable?

A common finding at this stage is that validation documentation exists but does not connect to the production process.

For example, a tablet press may have undergone a speed change or tooling modification after qualification, without an assessment of whether the validated state was affected.  The audit framework must test this connection.

Computerised systems also need specific attention. Systems such as LIMS, chromatography data systems, and environmental monitoring systems used for GxP activities should have documented validation evidence showing they work as intended.

When changes are made to a validated system, the audit should check that change control includes an impact assessment and, where needed, revalidation.

Stage 2: Production Process Controls

The second stage tests whether production processes are being operated within the parameters established during validation. 

The audit reviews batch manufacturing and packaging records, in-process controls, yield reconciliation, equipment logbooks, environmental monitoring where applicable, and line clearance procedures.

The focus is on what actually happened on the shop floor: 

• Are critical process parameters recorded contemporaneously? 
• Are in-process checks performed at the required frequency? 
• Are results within specification, and do out-of-range results trigger a documented deviation rather than a repeated test without investigation?
• Are equipment logbooks complete, legible, and free from unexplained gaps or overwritten entries?
•  Does line clearance follow the approved procedure and have the required approvals?

Deviation management is a particularly important test at this stage. A company may have a compliant deviation SOP but still have weak controls if investigations repeatedly close with generic explanations such as “operator error” without establishing why the error occurred or how recurrence will be prevented. 

The audit should sample recent deviations and assess whether the investigation established a credible root cause, evaluated potential product impact, and resulted in effective corrective and preventive action.

The audit should also examine whether QA review happens early enough to identify problems while corrective action is still possible. If significant deviations are consistently identified only during end-of-batch review, the process may be detecting failures too late.

Confirm that production controls operate in real time, within validated parameters, and with effective escalation when those parameters are not met.

Stage 3: Quality Assurance Integration

This stage tests whether QA functions as an effective and independent quality control within production, rather than simply acting as an approval layer after decisions have already been made. 

The audit covers deviation management, change control, CAPA, Quality Risk Management, market complaints, and Product Quality Review (PQR).

The key question is whether these systems influence actual decisions:

• Do deviation investigations identify a specific and credible root cause, or do repeated issues continue to be attributed to “operator error” followed by retraining? 
• Does Quality Risk Management influence the assessment and prioritisation of risks, or is it treated as separate paperwork? 
• Does QA have the authority to place a batch on hold when evidence indicates a quality concern?

Change control should also be reviewed across products and sites. For multiple facilities, the audit should check whether major changes are assessed consistently and whether lessons from one site are shared with others.

Similarly, PQR should do more than collect batch data. It should identify trends in deviations, complaints, yields, stability, and other quality indicators that may not be obvious from a single batch.

CAPA effectiveness is also critical. Closing a CAPA on time does not mean the problem is solved. The audit should review CAPAs closed months earlier and check for evidence that the action prevented the problem from happening again.

If the same issue appears later in another deviation or complaint, it may indicate that the original CAPA was not effective.

Stage 4: Data Integrity and Audit Trail

Here we test whether data supporting GMP decisions is reliable, traceable, and protected from inappropriate alteration. 

The audit applies the ALCOA+ principles: data should be Attributable, Legible, Contemporaneous, Original, and Accurate, as well as Complete, Consistent, Enduring, and Available.

The focus is on actual records and system activity, not simply whether a data integrity policy exists. Auditors should review GMP-critical systems such as HPLC and chromatography software, LIMS, balances, and other systems used to generate or store quality data. 

• Are individual users identified, or are shared logins still being used? Are audit trails enabled and reviewed where required? 
• Do electronic records match corresponding paper records in hybrid systems? Are electronic signatures appropriately controlled? 
• Are backup, retention, and archive procedures defined and periodically tested?

Check whether audit trails are actually reviewed, rather than simply enabled. The audit should select samples of electronic records, examine the underlying audit trail, and compare what the system shows with what the batch record or other controlled documentation says happened. 

Unexplained changes, deleted or invalidated results, unusual timestamps, or activity outside normal working patterns should be investigated.

Data integrity also depends on people. Employees must understand the importance of timely recording and traceable corrections. Undocumented changes can undermine even strong systems.

Ensure records reliably show who did what, when, and what information was available, while remaining complete and trustworthy throughout the retention period.

Stage 5: Vendor and CMO Oversight

This extends the audit framework beyond the manufacturer’s own facilities to the external parties that can directly affect product quality and compliance. 

This includes API and excipient suppliers, Contract Manufacturing Organisations (CMOs), and Contract Testing Laboratories (CTLs).

The audit tests whether third-party oversight is risk-based and ongoing. 

• Does the Approved Vendor List reflect current qualification evidence, or has it simply been carried forward from the original onboarding? 
• Are vendor audits conducted at a frequency appropriate to risk, with findings tracked through effective closure? 
• Do Quality Agreements clearly define GMP responsibilities between the manufacturer and its CMO or testing laboratory? 
• Are vendor change notifications assessed for their potential impact on the product, process, or validated state?

The audit should verify whether the sponsor’s QA team reviews relevant batch documentation before release rather than relying solely on a Certificate of Analysis. For contract laboratories, the review should extend to method qualification, data integrity controls, audit trails where applicable, and the reliability of the results used in quality decisions.

Select one active API or critical excipient and trace it through the complete qualification chain. Review the supplier’s current approval status, most recent risk assessment and audit, applicable Quality Agreement, change notifications, and the Certificate of Analysis for a batch currently in use. For a CMO, perform a similar trace from the manufactured batch through the relevant records and QA release review.

Identify gaps that can remain hidden because a supplier or service provider has performed reliably for years. External responsibility does not remove internal accountability. If a vendor’s failure can affect a product released by the manufacturer, the manufacturer’s audit framework must be capable of detecting that risk.

Common Audit Findings in Indian Pharma

Across PKC’s pharma audits, the recurring findings that often appear come from gaps in how processes are documented, monitored, investigated, and controlled. 

These include

Batch record review is retrospective 

QA review happens after batch completion which means deviations may be identified only after the manufacturing opportunity to correct them has passed. 

The underlying issue is often that production and QA schedules are not aligned and batch records are treated as post-production documentation rather than a real-time control.

Deviation investigations do not reach the true root cause

“Retraining of personnel” is repeatedly used as a CAPA for recurring problems. This can indicate that the investigation stopped at operator error without asking why the process, equipment, instructions, or controls allowed the error to occur. 

Effective investigation should address the system that permitted the failure, not simply the individual involved.

Data integrity controls exists only on paper

Audit trails may be enabled but rarely reviewed, while shared logins may remain in use despite being prohibited by SOPs. 

This creates a gap between documented controls and actual system capability, particularly where electronic records support batch release or quality decisions.

Change control remains site-specific

Individual plants maintain separate change logs with limited group-level visibility. 

A change affecting a validated process or product at one location may therefore fail to trigger an appropriate assessment at another site using the same process or equipment.

Vendor oversight is transactional 

Critical API suppliers, packaging vendors, CMOs, and testing laboratories may receive similar audit treatment despite having very different risk profiles.

Findings may also be closed when a response letter is received, without verifying whether the corrective action was actually implemented and effective.

How PKC Approaches Pharma Audits

PKC’s pharma process audit engagements are scoped around the five stages described above, but the starting point is not the framework, it’s the risk assessment. 

Risk-Based Scoping

Before designing the audit programme, PKC works with QA and regulatory teams to identify the highest-risk processes, products with the greatest regulatory exposure, and sites or functions where previous findings have not been effectively closed.

Each engagement begins with a 2-3 week scoping phase, covering recent regulatory inspection outcomes, internal audit reports, deviation and CAPA logs, and change control records. The output is a prioritised audit plan focused on the controls most likely to fail under regulatory scrutiny.

Pharma-Specific Audit Execution

The execution phase combines document review, process walkthroughs, control testing, and personnel interviews. PKC’s audit teams bring pharmaceutical quality and regulatory experience, not just general audit skills.

This is especially important for specialised areas such as data integrity, where effective assessment requires an understanding of chromatography data systems, audit trail review requirements, and the practical constraints of hybrid paper-electronic environments.

Actionable Reporting

PKC provides a consolidated audit report that maps findings to the relevant regulatory requirement, whether a specific Schedule M clause, USFDA 21 CFR provision, or WHO-GMP guideline. Each finding is risk-rated and includes a clear remediation pathway and defined verification method.

The report is also structured to support evidence of self-assessment during regulatory inspections or client audits.

Flexible Engagement Model

PKC can adapt its role to the organisation’s internal audit capability. Where an internal team is in place, PKC can provide the framework, training, and quality review while the team executes the audit. Where internal capacity is limited, PKC can execute the full audit programme.

The objective is to build internal capability over time, not create dependency.

Prepare for regulatory inspections, Schedule M requirements, or client audits with a structured pharma process audit. Identify and close quality gaps before regulators do.

Request a Pharma Process Audit to discuss your site’s requirements.

FAQs

What exactly changed under the revised Schedule M that affects internal audits?

The 2023 revision added explicit requirements for a documented Pharmaceutical Quality System, formal Quality Risk Management, and expanded qualification and validation obligations, which means an internal audit now needs to test for these specifically rather than relying on older, less detailed Schedule M checklists.

Is a Schedule M-compliant facility automatically ready for a USFDA inspection?

No. Schedule M compliance is the regulatory floor in India, but USFDA inspections weigh data integrity, audit trail review, and investigation quality far more heavily than Schedule M historically required, which is why manufacturers that pass domestic audits still receive Form 483 observations on inspection.

What’s the real difference between a Form 483 and a warning letter?

A Form 483 lists observations from a specific inspection that the facility is expected to respond to in writing, typically within fifteen business days, while a warning letter follows when the agency concludes the company’s response or ongoing practices remain inadequate, and it carries more serious regulatory and commercial consequences.

Can a pharma company conduct this type of audit internally?

Yes, if the internal team has the right mix of skills. A process audit that tests data integrity, validation lifecycle management, and vendor oversight requires auditors who understand pharma-specific systems and regulatory expectations. Many mid-sized pharma companies have QA teams with this knowledge but not the audit methodology or the independence to challenge their own colleagues. An external audit framework can provide both the structure and the objectivity.

How does PKC handle multi-site pharma groups?

PKC scopes the engagement at the group level, identifying common processes, shared systems, and group-level controls that apply across sites. The audit is then executed at each site with a common methodology but site-specific risk focus. Findings are consolidated at the group level to identify systemic issues that a site-by-site approach would miss.