CGMP and the rules behind drug manufacturing quality

In 2022, FDA's enforcement database logged 1,349 drug recall records. In 677 of them, half the total, the stated reason for the recall mentioned current good manufacturing practice, according to GxRadar's analysis of openFDA enforcement data¹. Across every record from June 2012 through October 28, 2026, the figure was 3,994 of 18,076, or about 22 percent.

Current good manufacturing practice, usually shortened to CGMP, is the set of minimum rules for how drugs are made. FDA describes the regulations as minimum requirements for the methods, facilities and controls² used in manufacturing, processing and packing a drug, so that the product is safe to use and has the ingredients and strength it claims.

CGMP applies to every human drug sold in the US, brand or generic, prescription or over the counter, made domestically or abroad. A drug made in a way that does not conform is considered adulterated under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act. That legal status attaches to the process. FDA can act on a CGMP violation without first proving that a particular batch is defective, and CGMP failures turn up often in recall notices.

Where the rules live

For finished medicines, the core regulations are 21 CFR part 210 (general provisions) and part 211³ (CGMP for finished pharmaceuticals). Other parts cover radioactive PET drugs (part 212) and biologics (part 600 and following). Active pharmaceutical ingredients are judged against a separate international standard, ICH Q7, which FDA has adopted as guidance for API plants; GxRadar's piece on where drug ingredients come from covers the plants that make them.

Part 211 is organized into subparts that follow the life of a batch: organization and personnel, buildings and facilities, equipment, control of components and containers, production and process controls, packaging and labeling, holding and distribution, laboratory controls, records and reports, and returned or salvaged products.

"Current" is doing real work in the name. The regulations say what must be done in fairly general terms, and FDA's expectations for how to do it move with technology and with problems the industry has run into. Guidance documents explain the agency's thinking, but they do not bind anyone. FDA's own rule on guidance, 21 CFR 10.115⁵, says such documents "do not establish legally enforceable rights or responsibilities," so inspection findings must tie back to the statute and the regulations.

How inspectors check it

FDA's compliance program for drug manufacturing inspections⁶, last revised in 2022 to add international quality-system principles and nitrosamine control, organizes a plant into six systems. A full inspection covers at least four and an abbreviated one at least two. The quality system is always included.

At the center sits the quality unit. Under 21 CFR 211.22⁴, there "shall be a quality control unit that shall have the responsibility and authority to approve or reject all components, drug product containers, closures, in-process materials, packaging material, labeling, and drug products." Many serious findings trace back to a quality unit that lacked that authority, lacked written procedures or did not follow them. What happens after an inspection, from Form 483 observations to warning letters, is covered in GxRadar's explainer on FDA inspections.

Data integrity

CGMP runs on records. A batch record, a lab result or a cleaning log is the evidence that something was done correctly, so a record that is incomplete or altered undermines everything built on it. FDA treats the reliability of data as part of CGMP, and its review of a drug application includes an assessment of the manufacturing process and the facility, according to the agency's inspections and compliance overview⁷.

Industry shorthand for good records is ALCOA: attributable, legible, contemporaneous, original and accurate. FDA set out its expectations in a December 2018 guidance, Data Integrity and Compliance With Drug CGMP⁸. Problems that show up in inspection findings, covered at more length in our piece on data integrity in drug manufacturing, tend to look like this, described generically:

• test results deleted, overwritten or rerun until a passing result appears, with the failures left uninvestigated;
• audit trails on laboratory instruments switched off or never reviewed;
• shared login credentials that make it impossible to tell who did what;
• records filled in after the fact or backdated;
• unofficial worksheets kept alongside the official record.

What quality failures look like in FDA's data

FDA's fiscal 2025 quality report⁹ listed three inspection citations that most often led the agency to hold up an application: failure to thoroughly investigate discrepancies or batch failures, a quality unit whose responsibilities were not written down or not followed, and inadequate control of microbial contamination in sterile products. Of nearly 10,000 submissions received in fiscal 2024 and 2025 that needed a facility assessment, 28 percent had received a complete response letter by May 2026, and 43 percent of those, or 12 percent of all submissions, were due to facility problems.

Recalls tell a similar story. FDA's fiscal 2024 quality report¹⁰ groups recalled products by defect.

Within the fiscal 2024 contamination recalls, microbial contamination accounted for 31 percent, sterility assurance problems 28 percent, foreign particles 20 percent, product mix-ups or cross-contamination 17 percent and chemical contamination 4 percent. Most failed-specification recalls were found during stability testing, led by impurities above their limits (46 percent) and dissolution failures (36 percent). Ophthalmic products had the highest share of recalls of any drug class.

openFDA's enforcement records, which count recalls by product record and calendar year instead of FDA's fiscal-year product groups, show the same dip. GxRadar's tally of records whose stated reason mentions CGMP or good manufacturing practice:

A recall reason can cite CGMP alongside a more specific defect, so the two sources will not match line for line. GxRadar's recall tracker breaks the records down by class and reason, and our explainer on common reasons for drug recalls covers the other categories.

Testing what goes into the product

Ingredient testing is a recurring theme. After children died in several countries in 2022 and 2023 from cough syrups contaminated with diethylene glycol (DEG) and ethylene glycol (EG), FDA issued guidance in May 2023¹¹ telling manufacturers to test high-risk components such as glycerin and propylene glycol themselves instead of relying on suppliers' certificates. A 2025 FDA survey of more than 160 US cough, cold and allergy products, described in the FY2025 report⁹, found none above the 0.10 percent safety limit. Impurities that form during manufacturing or storage are a separate problem, traced in our piece on nitrosamine impurities.

Beyond the minimum

CGMP is a floor, and most inspected plants clear it. In fiscal 2025, 82 percent of FDA's drug quality inspections were classified No Action Indicated or Voluntary Action Indicated, and 18 percent Official Action Indicated, according to the FY2025 report; our tally of FDA inspections by the numbers has the longer record. FDA's drug center is also building a Quality Management Maturity program¹², with voluntary assessments, to recognize quality practices that go beyond CGMP. FDA traces the idea to a multi-agency federal task force, which reported that a root cause of many drug shortages is "the absence of incentives for manufacturers to strive for more than simply meeting CGMP regulations."