Skip to content
Sinfony

GMP · Pharmaceutical

"We cannot touch that. It's GMP."

That sentence freezes entire quality systems. It is nonetheless false, and the guide says the exact opposite: it asks for an effective pharmaceutical quality system, subject to review and continual improvement. What remains is to know where the line runs between simplifying and deviating.

Q9 and Q10

Quality risk management and the pharmaceutical quality system are part of the European GMP guide. Both ask that the control effort be proportionate to risk, and that the system improve.

ICH Q9 asks for effort commensurate with risk, where many systems apply uniform effort.Uniform effortCommensurate effort (ICH Q9)Level of riskEffort
ICH guidelines Q9 and Q10, taken up in part III of the European Union GMP guide.

This is the point a defensive reading of GMP systematically misses. The guide does not ask for a frozen system, it asks for a controlled one. A control kept without justification, a procedure never challenged, a record nobody uses: none of that is required — and all of it consumes the resource you will lack elsewhere.

The belief that costs you

"What was once validated is not up for discussion."

Behind that caution lies a confusion between two very different things: the regulatory requirement, which binds you, and the solution your site chose in order to meet it, which does not. Ten years later the process has changed, so has the equipment, but the solution has stayed — and nobody remembers which requirement it served. That is the heart of the matter: it is not the regulation that thickened your system, it is your successive answers to forgotten questions.

What the guide actually says

The line, in three points.

Document with care

The documentation chapter asks for documents designed, prepared, reviewed and distributed with care, written in a clear and unambiguous style. An unreadable document is not a compliant document you could improve later: it is already outside the requirement.

Scale to risk

ICH Q9 sets two principles: risk evaluation is based on scientific knowledge and links to protection of the patient; and the level of effort and formality should be commensurate with the level of risk. That second principle is an explicit permission to cut back where risk is low.

Control the change

Here is where the line runs. Simplifying through change control, with impact assessment and justification, is an ordinary operation of the quality system. Simplifying silently is an undeclared deviation. The difference is not in what you do, but in the trail you leave.

Our conviction

QA that slows the business down is not rigorous QA. It is badly designed QA.

Slowness is not proof of seriousness, and the guide never asked for it. It asks for control. A three-week release loop does not protect the patient better than a three-day one if the three days rest on the same verifications, performed in the right places. It merely costs more, in working capital and in attention.

What you gain

The same level of control, for less.

Release

The delay between end of production and availability can nearly always be reduced without touching a single critical verification. What goes is the waiting between verifications.

Attention

Removing redundant controls makes the remaining ones more reliable. An operator ticking twenty boxes does not look twenty times; they tick. That is a known result, and it is a quality risk.

Inspection

A simplification file argued by risk and traced through change control is an excellent interview topic. It demonstrates a system that is steered, which is what an inspector looks for first.

So the right question to put in review is not "are we allowed?" but "which requirement does this control serve, and how do we know?". When nobody can answer, you are not holding a requirement: you are holding a habit.

Frequently asked

Simplifying under GMP, plainly.

Which requirement do your controls serve?

Two days is enough to map what is required, what was added out of caution, and what nobody can justify any more.