Sterile Manufacturing: 10 Controls Auditors Expect to See

Most sterile manufacturing audits are not decided by an exotic finding. They are decided by whether a set of well known controls are designed correctly, followed consistently and evidenced clearly. Auditors and inspectors arrive at a sterile manufacturing site expecting to see the same core controls every time, because those controls are what stand between the process and a contaminated product. When one of them is weak, the finding usually is not the control itself. It is that the site could not show the control was working. The following ten controls are the ones auditors expect to see, and the ones where preparation makes the clearest difference.

Read this as a readiness checklist rather than a ranking. Each control below is an area where the design, the routine practice and the documentation all need to agree. Where they diverge is where audits find their observations.

1. Contamination control strategy

A current, site-specific contamination control strategy is now the anchor auditors look for first. It should connect facility design, utilities, process, personnel and monitoring into one rationale for how contamination is prevented and detected. A strategy that is generic, out of date or disconnected from what the floor actually does is a common early observation. The document is expected to be live, reviewed and owned, not written once and shelved.

2. Cleanroom and air classification control

Auditors expect clear qualification of cleanroom grades, with air classification, recovery, differential pressures and airflow visualisation supporting the intended protection of the critical zone. The expectation is that the data proves the room performs as designed at rest and in operation, and that alarms and pressure regimes are monitored and acted on. Undocumented drift in pressures or unresolved smoke study questions attract attention quickly.

3. Barrier technology and the critical zone

Where the product is exposed, the protection of the critical zone is scrutinised most closely. Auditors expect the right barrier approach for the risk, whether that is a restricted access barrier system or an isolator, with its integrity, glove management and transfer controls evidenced. The design intent of barrier technology is to separate people from the product, and the audit tests whether that separation actually holds in routine use.

4. Aseptic process simulation and media fills

Media fills are the direct evidence that the aseptic process can be run without contaminating product. Auditors expect the simulations to represent worst case conditions, interventions and durations, with sound acceptance criteria and thorough investigation of any positive. A media fill programme that avoids the difficult interventions or does not reflect real production is a weakness auditors are experienced at spotting.

5. Personnel gowning and aseptic behaviour

People are the largest source of contamination in aseptic processing, so gowning qualification, ongoing personnel monitoring and observed aseptic technique are always in scope. Auditors expect a documented gowning qualification programme, routine monitoring with trending, and evidence that behaviour on the floor matches procedure. Good technique that is not evidenced, and evidenced technique that does not match what is seen, both create findings.

6. Environmental and personnel monitoring, with trending

A monitoring programme is expected to be risk based in its locations and frequencies, and to be trended over time rather than only checked against limits. Auditors look for defined baselines, periodic trend review and a link from monitoring signals into action. Strong monitoring that is never trended is one of the more frequent gaps, because the data exists but the learning does not.

7. Sterilisation and depyrogenation validation

For every sterilised component, product contact part and, where relevant, the product itself, auditors expect validated sterilisation and, where needed, depyrogenation, with routine load monitoring. The expectation is that cycles are validated for the actual loads used, that biological and physical evidence support them, and that routine records show each cycle met its parameters. Gaps between validated and routine loads are a classic observation.

8. Water and clean utilities control

Water systems, clean steam, and process gases that contact product or surfaces are expected to be qualified, monitored and trended for chemical and microbial quality, including endotoxin where relevant. Auditors expect alert and action responses to be defined and followed, and the utility to be tied into the contamination control strategy. Utilities are a common ingress route, so weak utility control undermines otherwise strong aseptic practice.

9. Sterility assurance and batch release controls

Auditors expect the release of a sterile batch to rest on more than the sterility test. Container closure integrity, review of the full aseptic processing record, monitoring results, interventions and any excursions all feed the release decision. A robust process treats the sterility test as one input among several, and the audit expects the release rationale to reflect that.

10. Investigations, CAPA and data integrity

The final control is how the site responds when something goes wrong. Auditors expect contamination events, excursions and deviations to be investigated to a genuine root cause, with corrective actions that prevent recurrence and records that are attributable, legible, contemporaneous, original and accurate. Weak investigations and shallow corrective actions are among the most common findings across sterile manufacturing, because they signal that the quality system will not catch the next problem either.

Turning the sterile manufacturing checklist into readiness

The pattern across all ten controls is the same. Auditors are not testing whether you know the controls exist. They are testing whether design, routine practice and documentation line up, and whether your site can demonstrate that on the day. Preparing for a sterile manufacturing audit is largely the work of closing the gaps between those three, before an inspector finds them for you. A structured readiness review against these controls, supported by Contamination Control by Design and a clear view of your contamination control posture, turns a checklist into defensible, inspection-ready practice.

Frequently asked questions

What controls do auditors focus on in sterile manufacturing?

Auditors focus on the controls that stand between the process and a contaminated product: the contamination control strategy, cleanroom and air classification, barrier technology and the critical zone, media fills, personnel gowning and behaviour, environmental and personnel monitoring with trending, sterilisation validation, water and clean utilities, sterility assurance at release, and investigations with data integrity.

What is the most common finding in sterile manufacturing audits?

Findings cluster around evidence rather than absence of controls. Weak investigations and corrective actions that do not prevent recurrence, monitoring data that is collected but not trended, and gaps between validated and routine conditions are all frequently observed, because each shows a control that is present but not demonstrably working.

How is Annex 1 changing sterile manufacturing expectations?

The revised EU GMP Annex 1 places the contamination control strategy at the centre and expects a holistic, risk based view linking facility, utilities, process, people and monitoring. In practice this raises the expectation that the ten controls above are connected in one rationale rather than managed as separate activities.

How can a site prepare for a sterile manufacturing audit?

The most effective preparation is a structured readiness review that checks, for each core control, that the design intent, the routine practice and the documentation all agree, and that any gaps are remediated before the audit. This is more valuable than rehearsing answers, because auditors test whether controls are evidenced in day to day records.

Kieran Falvey is Founder and Managing Director of Pharmalliance Consulting Ltd and the creator of Contamination Control by Design (CCbD). He has more than 20 years designing, building and running pharmaceutical facilities worldwide, across FDA, EMA, TGA, PIC/S and Indian FDA (CDSCO) jurisdictions. Global expert in cGMP Compliance, Remediation and Contamination Control, helping Sterile, Non-Sterile, ATMP and Cosmetic companies navigate cGMP compliance issues.

Pharmalliance Consulting is a GMP compliance consultancy serving pharmaceutical, sterile, non-sterile, OSD, ATMP and cosmetic manufacturers in Ireland, the UK, the EU and the US. It helps sites identify and remediate GMP risks across facilities, quality systems and contamination control, aligned with HPRA, MHRA, EMA and FDA expectations, turning findings into defensible, inspection-ready practice.

If you want confidence that these ten controls will hold up on audit day, Pharmalliance can run a readiness review of your sterile manufacturing operation. Explore GMP Audit Ready and Contamination Control by Design, or talk to us.