Revised Schedule M: The Inspection Can Come Any Day. Is Your Site Ready?

The revised Schedule M was notified on 28 December 2023 as G.S.R. 922(E). Whatever timetable your unit was given for civil work, the Schedule itself is now the text an inspector arrives with. It is the standard your next inspection will be run against, and that inspection is not scheduled around your readiness.

Most sites know this. What they usually do not have is a clear answer to four questions an inspector settles within the first hour: which Parts apply here, what has been built once for the whole site, what is still blocked behind something else, and whether the quality system produces its own evidence.

Six Parts became thirteen#

The 2001 Schedule was, in substance, a specification for a building and a set of records. The revised Schedule is a specification for a management system that happens to operate inside a building.

Five product categories that had no GMP text of their own now have one: hormones, steroids and cytotoxics (Part III), biological products (Part IV), radiopharmaceuticals (Part V), phytopharmaceuticals (Part VI), and investigational products for clinical trials (Part VII). The API text grew from a handful of premises clauses into a complete code of eighteen chapters in Part XII.

The rule that governs all of it is easy to state and often missed in practice: the specific Parts are additive, not alternative. Each one opens by requiring the main principles of Part I to be complied with, mutatis mutandis. Where two specific Parts apply, both apply, and the more demanding requirement governs.

First, which Parts apply to you#

This is where a surprising number of implementation programmes start wrong, and every later decision inherits the error.

A small volume injectable containing a hormone is not covered by Part II alone. It sits under Part I, Part II for sterile manufacture, Part III for the hazardous active, and Part XIII for plant and equipment — and where Part II and Part III disagree, the stricter clause wins. A syrup needs Part I, Part IX, and the plant clauses of Part XIII; its fate usually turns on one requirement, the testing of every container of every glycol consignment for diethylene and ethylene glycol by a validated method.

Two traps are worth naming because they are expensive.

Beta-lactams. Para 18.11 requires a dedicated, self-contained facility for penicillins and cephalosporins. That is not a shared-facility option to be argued away with cleaning validation. If your plan involves a cleaning regime and a campaign schedule rather than a separate building and a separate air system, the plan does not meet the Schedule.

Implants. Schedule M has no implant Part. A sterile drug implant is a drug and sits under Parts I, II and XIII. An implantable device is governed by the Medical Devices Rules 2017 and Schedule M does not apply to it at all. Sites that get this classification wrong run a GMP programme on a product that needed design controls, risk management to ISO 14971 and post-market surveillance — and the finding, when it comes, is not a paragraph, it is the whole quality system.

And if your product has no Part of its own — transdermal patches, oral films, lozenges, nasal and rectal preparations — you apply Part I in full, then reason your way to the Part whose contamination and process risks come closest, and you record that reasoning. That applicability determination is itself an inspectable record under the quality risk management requirement. Ignoring the question is a finding. So is over-applying a sterile package to a product that never needed one.

Roughly sixty per cent of the work is the same whatever you make#

The mistake that wastes the most money is running a separate compliance project per product category.

Four layers are built once for the site:

1. Quality governance — the quality system, risk management, change control, deviation and CAPA, self-inspection, management review, and the framework for the Product Quality Review.
2. The infrastructure of records — document control, good documentation practice, computerised systems, access control, audit trail review, backup and restoration.
3. Common operations — materials and supply chain, supplier qualification, training, warehouse conditions, calibration, maintenance, waste, complaints and recall, the Site Master File.
4. Shared utilities — purified water, HVAC, compressed air and steam, qualified once to the acceptance criteria of the most demanding category they serve.

Only the fifth layer multiplies: the category-specific work, which is also where the capital and the specialists sit.

A site making tablets, syrups and creams needs one quality system, one change control procedure, one supplier qualification programme and one purified water system. It needs three contamination control strategies and three sets of category validation. Planned that way it is one programme with three workstreams. Planned per category it is three programmes that each rebuild the same core, at three times the cost, and with three versions of the truth for an inspector to find.

The book order is the wrong work order#

Schedule M is organised by subject — personnel, premises, equipment, materials — because that is how a reference text has to be organised. It is a poor order to work in, because the requirements depend on each other and the dependencies cross departmental boundaries.

Three chains run at their own pace and converge on one thing, batch release:

• Water. Capital approval, tender, installation, phase 1 and 2 qualification, then a phase 3 that runs a full year and cannot be compressed, and only then process validation on that water.
• Air. Capital approval, AHU and clean room order, civil and finishing work, installation and balancing, classification and qualification, environmental monitoring baseline, media fill.
• Systems. Quality system and change control, data integrity remediation, computerised system validation, credible electronic raw data, a Product Quality Review that can actually be trended.

The commonest planning error is treating documentation as phase one and construction as phase two. In elapsed time the reverse is true. Documentation is bounded by author capacity, which you can increase by hiring. Construction is bounded by procurement, shutdown windows and qualification periods that no amount of effort shortens. Order long-lead items on the strength of the gap assessment, not of finished documentation.

The same logic explains why some work cannot be pulled forward. An unqualified gowning operator cannot enter Grade B, so aseptic operations wait on a training record that HR holds, QA approves, microbiology tests and production executes. Cleaning validation waits on the pressure cascade. The Product Quality Review waits on data being retrievable at all.

The Product Quality Review is the fastest way to judge a site#

The Product Quality Review (Part I, para 2.3) is new, mandatory, annual, and required for every product — including products made only for export. Inspectors read it early for a reason: it is the quickest honest signal of whether a quality system is real or ceremonial.

Its twelve mandatory elements draw data from six functions: materials and supply-chain traceability from procurement, in-process and finished results and stability from QC, deviations and changes and complaints from QA, dossier variations and post-marketing commitments from regulatory affairs, equipment and utility qualification status from engineering, and the currency of technical agreements from legal. No single function can produce it. A review assembled by QA alone, from whatever data it could find, reads exactly like what it is.

Para 2.3.3 closes the loop, and this is the half most often missed: the results must be evaluated, an assessment made of whether corrective action or revalidation is required, the actions completed in a timely and effective manner, and their effectiveness verified during self-inspection. A review that ends at observation — no action, no later verification — does not meet the requirement, however thick it is.

What the first four hours look like#

Risk-based inspection follows a fairly predictable path. Prepare for that path specifically.

Test yourself against the last column rather than the first. A document that takes two hours to find is, for inspection purposes, a document that does not exist.

Failure modes that keep recurring#

• The Product Quality Review covers domestic products only. The duty to include export-only products is easy to miss in para 2.3.1, and easy for an inspector to check.
• Investigations that conclude “operator error”. Root cause analysis treated as a form to complete rather than an inquiry. What is wanted is a named root cause supported by evidence, a corrective action addressing the system rather than the person, and documented effectiveness verification.
• Analysts holding administrator rights on chromatography systems. Configured by the vendor for convenience years ago and never reviewed. Para 20.4 requires a record of every data change showing the previous entry, who made it and when — which means nothing if the person generating the data can also configure the system.
• Cleaning limits from a legacy rule. The 1/1000th-dose and 10 ppm conventions are widely copied and rarely justified. Health-based limits derived from toxicological data, with the derivation documented and the method validated including recovery, is what the requirement now expects.
• Media fills that omit the worst-case interventions. Simulating the difficult interventions risks a failure, so they quietly drop out of the protocol. The intervention list should come from actual batch records, and any exclusion should be justified in writing.
• A supplier certificate accepted in place of qualifying the manufacturer. Paras 10.6 and 10.7 moved the obligation from reading a certificate of analysis to qualifying the actual producer — which conflicts directly with buying through traders on price.
• A validation report with no protocol and no raw data. The package was purchased rather than executed, and it shows.

If the capital is not approved yet#

Some of the heaviest requirements cost time rather than money, and starting them is also what demonstrates good faith if an inspection arrives before the civil work is finished.

Sign the quality manual and quality policy at senior management level — the obligation in para 1.2 sits on management, and its absence is a finding that costs nothing to close. Put a risk management framework and the first risk assessments in place, because they become the documented justification for nearly every later decision, including which gaps you defer and why. Get change control, deviation, CAPA and OOS into live use now: by inspection you want a twelve-month record trail, and that cannot be retrofitted. Turn audit trails on, give every user a unique ID, take administrator rights off analysts and test a restoration. Audit the actual manufacturers of your actives — that costs travel, not capital. Write the on-going stability protocol and start enrolling into whatever chamber capacity you already have, because stability data accrues in real time and every month of delay is a month you cannot recover. Then produce the first Product Quality Review even with imperfect data, documenting honestly what could not be reviewed and why. A review that identifies its own data gaps is far stronger evidence of a working system than no review at all.

The question some sites need to answer honestly#

For some micro and small units, the compliance economics of a particular category no longer work. A small volume of sterile ophthalmics alongside oral solids can cost more in clean room, environmental monitoring and media fills than the category earns in a year.

There are three legitimate responses: invest and stay; exit that category and concentrate on the forms whose economics work; or convert to contract manufacture at a compliant site while keeping the marketing licence. Any of the three can be defended. Decide early, and record it as a management decision with the reasoning behind it.

The one response that cannot be defended is continuing to manufacture a category the site cannot support, and hoping the inspection lands somewhere else first. That is the situation that produces the most serious enforcement outcomes, and it is the one the revised Schedule was written to end.

---

Work out your own position: the Revised Schedule M tool takes your licence scope and shows the Parts that apply, what decides whether implementation succeeds in your category, what is shared across the site, which workstreams block which, and the twelve elements of the Product Quality Review. For background on the deadline debate and the inspection capacity behind it, see Deadline Dilemma: the case for extending revised Schedule M to December 2026.

This article is a working aid prepared from the gazette text, not legal advice. Where anything here differs from the gazette, the gazette governs. Confirm the current text and any later amendment with CDSCO or your state licensing authority.