Analysis of publicly available pharmaceutical inspection reports identifying the ten most frequently cited GMP deficiencies in cannabis and herbal medicinal product manufacturing — with guidance on prevention.
GMP inspection findings are among the most useful learning resources available to pharmaceutical manufacturers. Publicly available inspection reports — from FDA, EMA, national competent authorities and PIC/S member agencies — reveal the most common compliance gaps across the industry. This analysis identifies the ten deficiencies most frequently cited in pharmaceutical cannabis and herbal medicinal product inspection reports, with practical guidance on how to prevent each one.
This analysis is based on publicly available inspection reports, FDA warning letters, EMA inspection findings and published national competent authority enforcement actions. All findings cited are from public regulatory records. Where specific facilities are referenced, they are identified only by regulatory document reference number.
Frequency: Very high in post-2022 inspections of cannabis facilities.
Finding text (typical): "The facility has not produced a formal Contamination Control Strategy as required by EU GMP Annex 1 (2022) Clause 4.4. The existing documentation does not constitute a risk-based contamination control strategy."
Root cause: The CCS requirement was introduced in the 2022 Annex 1 revision. Many facilities have not updated their quality systems to reflect the new requirement.
Prevention: Produce a formal CCS document that maps contamination sources to routes to controls. For cannabis facilities, this must include cannabis-specific contamination pathways — microbiological risk from plant material, THC/CBD cross-contamination, solvent residues, mycotoxin risk and cannabinoid degradation. The CCS must be risk-based — FMEA or equivalent — not a summary of existing procedures.
Frequency: High.
Finding text (typical): "Environmental monitoring alert and action limits are set by reference to EU GMP Annex 1 grade limits. There is no evidence that limits have been derived from facility-specific baseline data as required."
Root cause: Setting limits from grade tables is simpler than conducting EMPQ. Many facilities establish the EM programme before fully understanding the EMPQ requirement.
Prevention: Conduct EMPQ before routine production begins. Collect a baseline dataset of EM results under normal operating conditions, calculate facility-specific limits from this data, and document the derivation methodology in the EMPQ report.
Frequency: High in cannabis facilities with shared equipment.
Finding text (typical): "Cleaning validation acceptance limits of 10 ppm for active residues have been applied without toxicological justification. PDE-based limits are required."
Root cause: The 10 ppm limit was an industry convention that predates the EMA guideline on health-based exposure limits. It is no longer acceptable.
Prevention: Calculate PDE-based acceptance limits for all actives processed on shared equipment. For cannabis products, this requires specific consideration of the pharmacological activity of THC when setting the THC-in-CBD cleaning limit.
Frequency: High in cannabis facilities sourcing from external GACP suppliers.
Finding text (typical): "The facility has not conducted a qualification audit of its cannabis starting material supplier. No quality agreement is in place. Incoming material testing is not sufficient to confirm material identity, quality and freedom from contamination."
Root cause: GACP supplier qualification is often treated as a procurement activity rather than a QA activity. The depth of qualification required is underestimated.
Prevention: Qualify GACP suppliers formally — documented assessment, quality agreement, qualification audit, incoming testing programme covering cannabinoid profile, pesticides, heavy metals, microbiological quality and moisture. Review qualification at defined intervals.
Frequency: High in facilities using electronic laboratory systems.
Finding text (typical): "The computerised laboratory system has an audit trail function. There is no evidence that audit trails are reviewed as part of the batch release process or at any defined interval."
Root cause: Audit trail functionality is enabled (often by default) but no procedure exists for review, and no personnel are trained in what to look for.
Prevention: Establish a documented audit trail review procedure that specifies frequency, scope, reviewer qualification and the criteria for raising a deviation. Conduct periodic retrospective audit trail review and document the outcome.
Frequency: Very high.
Finding text (typical): "Process parameters were found to have been exceeded on [date] without a deviation being raised. Personnel interviewed confirmed awareness of the excursion but stated it was considered minor."
Root cause: Personnel either do not understand what constitutes a deviation requiring documentation, or the deviation system is perceived as burdensome and deviations are avoided rather than reported.
Prevention: Train all personnel with GMP responsibilities on the deviation system and the specific threshold for raising a deviation. Make the deviation system easy to use. Establish a culture where raising deviations is encouraged and not associated with blame.
Frequency: High.
Finding text (typical): "The HVAC system was modified [date] to address a pressure differential issue. There is no change control record for this modification. The impact on the validated state of the classified areas was not assessed."
Root cause: Change control procedures exist but are not applied to all categories of change. Engineering and facilities changes in particular are frequently made without quality involvement.
Prevention: Define the scope of the change control system clearly — it must apply to all changes to facilities, equipment, processes, materials, software and procedures that could affect product quality or the validated state.
Frequency: High.
Finding text (typical): "Training records for [personnel name] do not include evidence of training on [SOP reference]. This SOP was in scope at the date [personnel name] commenced operations in the classified area."
Root cause: Training tracking systems are not kept current. Personnel commence new activities before training records are updated.
Prevention: Implement a training management system that links personnel access and activities to training requirements. No individual should conduct a GMP activity without a current training record covering the relevant procedures.
Frequency: Moderate to high.
Finding text (typical): "The Site Master File describes the facility as having [X] production suites. The facility currently operates [Y] production suites. The SMF has not been updated to reflect this change."
Root cause: The SMF is prepared for initial GMP application and then not maintained.
Prevention: Include the SMF in the change control system. Any change to the facility, product portfolio or quality system described in the SMF must trigger an SMF update.
Frequency: Moderate.
Finding text (typical): "A self-inspection programme is in place. Self-inspection reports reviewed show no critical or major findings in the past 18 months. GMP inspection of the same areas during this inspection identified [X] major findings. The self-inspection programme does not appear to be identifying GMP deficiencies effectively."
Root cause: Self-inspections conducted by personnel who are too close to the operations being audited, or who lack the auditing skills to identify deficiencies.
Prevention: Self-inspections should be conducted by trained auditors who are independent of the areas being audited. External auditors or cross-departmental auditing can provide the objectivity that internal auditors may lack. Findings should be critical and honest — a self-inspection that finds nothing is a red flag, not a good result.
Subscribe for new publications monthly.