Audit Finding Classification: Critical, Major, Minor and the Evidence Behind Each

A finding is only as good as its classification and its evidence. Two auditors can walk the same room, see the same gap, and write it up very differently. One writes “documentation issues observed.” The other writes a major finding citing a specific batch record, a specific requirement, and a specific consequence. The second auditor is the one whose report drives action, survives challenge, and holds up when a regulator later reads the same file.

Classifying a finding is a judgment call with a defensible structure behind it. Get the structure right and the judgment becomes consistent across auditors, defensible to the auditee, and useful to the people who have to fix the problem. Get it wrong and you either inflate trivial observations into firefights or, worse, you bury a critical risk inside a list of minor housekeeping items where nobody acts on it.

This page covers what critical, major and minor mean, where those categories come from in the regulatory framework, how to substantiate each one with objective evidence, and how to write the finding so the classification is obvious from the words on the page.

Why finding classification exists at all

Classification serves three purposes, and keeping them straight tells you why the rules are written the way they are.

First, prioritization of action. A site cannot fix everything at once. Grading tells the auditee, and its management, which gaps threaten product quality, patient safety, or data reliability now, versus which are improvements that can wait. A critical finding stops shipment or stops a study. A minor finding goes into the next revision cycle.

Second, risk communication. The grade is a one word risk signal to people who will never read the full finding text: the quality council, the receiving company in a supplier audit, the qualified person deciding on batch release, a regulator reading an audit file during an inspection. The grade has to mean the same thing to all of them.

Third, decision triggers. Many quality systems tie automatic consequences to the grade. A critical supplier finding can trigger a hold on incoming material or disqualification. A critical internal finding can require senior management notification within a defined number of hours and a CAPA before the affected product is released. The grade is not cosmetic. It pulls levers.

Because the grade pulls levers, the definitions have to be tight and the evidence has to be objective. A finding graded on opinion instead of evidence falls apart the moment the auditee pushes back, and auditees push back hardest on the gradings that cost them the most.

The regulatory and standards basis

There is no single global regulation that says “a critical finding is X.” Instead, a consistent three tier model appears across the major frameworks, and you should be able to cite the ones that apply to your audit type.

PIC/S and the GMP inspection model

The most widely used definitions come from the PIC/S Guide to Good Manufacturing Practice and its companion inspection documents, in particular PI 040 (PIC/S Guidance on Classification of GMP Deficiencies) and the deficiency classification approach shared across PIC/S participating authorities. (The inspection report format is a separate document, PI 013.) The model is the one most quality professionals carry in their heads:

Described in original wording rather than quoted from the copyrighted guidance, the three tiers work like this. A critical deficiency is the top tier: it is reserved for a shortfall that has already produced, or realistically could produce, product capable of injuring the patient who receives it, and it also sweeps in anything involving deception, misrepresentation, or falsified product or records, because a falsified record poisons every decision built on it. A major deficiency is the middle tier: it captures a shortfall that, while it has not reached the critical bar, could let product leave the site in a state that does not match its authorized, registered description, or that reflects a broad breakdown in good-manufacturing discipline, or that shows the checks meant to gate release were not actually performed as intended; just as important, it also captures a collection of individually smaller shortfalls that only when added together reveal a process out of control. A minor deficiency is the residual tier: a real, evidenced departure from the rules that does not climb into either higher category.

Three things to notice in those definitions. Critical is anchored to patient harm or data falsification. Major is anchored to the marketing authorization (the registered, approved way of making the product) and to systemic GMP failure. Minor is the residual category, a real departure from GMP that does not rise to the other two. And the major definition explicitly allows aggregation: several minor findings of the same kind become a major one.

The same model underpins the EU GMP inspection regime. EU GMP inspectorates classify deficiencies as critical, major or other (minor) using criteria aligned with PIC/S, and the EMA’s compilation of Union procedures for GMP inspections uses these categories.

ICH Q9 and risk based grading

ICH Q9(R1), Quality Risk Management does not define finding categories directly, but it gives you the risk vocabulary that every defensible grading rests on: severity, probability of occurrence, and detectability. When you argue a grade, you are really arguing severity (how bad is the consequence) and likelihood (is this a one off or a pattern). Q9 is the reference you cite when an auditee asks you to justify why you scored severity high.

GAMP 5 for computerized systems and CSV audits

For computerized system and data integrity audits, ISPE GAMP 5 (Second Edition, 2022) frames findings against intended use and risk to patient safety, product quality and data integrity. The same three way severity logic applies, with data integrity findings weighted heavily because an unreliable record undermines every quality decision built on top of it.

Clinical (GCP) audits and inspections

For GCP audits and sponsor inspections, ICH E6(R2)/E6(R3) Good Clinical Practice is the standard, and regulators apply their own grading. The EMA’s GCP inspection procedures and national authorities use critical, major and minor with definitions tuned to subject safety and data credibility rather than product quality:

A critical GCP finding is a condition, practice, or process that harms the rights, safety, or well-being of trial subjects, or that compromises the quality and reliability of the data, or both.

The structure is identical to GMP; only the protected interest changes from product quality to subject safety and data integrity.

ISO 19011 and ISO 17025/9001 audit terminology

For management system and laboratory audits under ISO 19011 (Guidelines for auditing management systems; the current edition is ISO 19011:2026, published May 2026, superseding the withdrawn 2018 edition) and ISO/IEC 17025 (the fourth edition, ISO/IEC 17025:2025, superseded the 2017 third edition on 27 September 2025, with a 3-year transition running to 30 September 2028), the common terms are major nonconformity and minor nonconformity, plus observation or opportunity for improvement (OFI). A major nonconformity is the absence or total breakdown of a required system element, or a situation that would on the available evidence raise significant doubt about conformity. A minor nonconformity is a single lapse against a requirement. The two tier model maps onto the three tier model: ISO “major” sits roughly where GMP “major plus critical” sit, and ISO “minor” matches GMP “minor.”

Internal company procedures

Whatever the external frameworks say, your own audit SOP defines how your organization grades and what each grade triggers. The cardinal rule: your internal definitions must be consistent with, and no looser than, the regulatory definitions for the audit type. An inspector who finds your SOP grading a data falsification as “minor” has just found a quality system finding of its own.

The frameworks side by side

The same three-tier logic wears different labels depending on the audit type. Knowing which word maps to which tier keeps you consistent when you audit across domains and stops you from arguing terminology when you mean severity. The protected interest is what actually differs; the structure does not.

Two cautions when you translate across the row. ISO uses a two-tier nonconformity model, so its “major” absorbs both the GMP critical and GMP major, and you should not assume an ISO “minor” equals a GMP “minor” in consequence. And the FDA column is an inspection-outcome scale, not a per-finding grade: OAI, VAI, and NAI describe the whole inspection’s disposition, while individual 483 observations are not themselves formally graded, which is why a company’s own internal grading has to do the risk triage the 483 leaves implicit.

The three categories, defined for working use

Here are the categories restated in the way you actually apply them in the room, with the test you run in your head.

Critical

Test: Could this directly harm a patient or trial subject, or does it involve falsification, fraud, or fabrication of data or product?

Critical findings are about consequence, not volume. A single instance is enough. The two doors into “critical” are:

1. Direct patient/subject risk. A sterility assurance breach on a parenteral product. Release of a batch that failed a specification without a justified investigation. A computerized system that controls a critical process parameter with no access control, so anyone can change the setpoint. A clinical site dosing subjects against the protocol’s safety stopping rules.
2. Data integrity failure of the falsification class. Backdated records. A shared admin login used to delete audit trail entries. Recording results before the test was run. An analyst aborting failing injections and reporting only the passing ones. These are critical regardless of whether a single bad batch can be traced, because they destroy trust in the entire record.

Major

Test: Does this represent a systemic failure of a required process, or a departure that could produce product not meeting its registered requirements, even if no immediate patient harm is shown?

Major is the workhorse category. It captures:

• A required process that exists on paper but is not followed in practice (the system has broken down).
• A deviation from the marketing authorization, validated process, or approved method that is not yet shown to harm a patient.
• A failure of release controls (a batch released without all required testing complete).
• Aggregation: a cluster of related minor findings that, together, show the underlying process is not in control.

The aggregation rule is the most underused tool in finding classification. Five separate “training record not signed” minors across five departments is not five minors; it is one major finding that the training system is not functioning.

Minor

Test: Is this a genuine, evidenced departure from a requirement that is isolated, low risk, and does not indicate a broken system?

Minor findings are real nonconformities, not nitpicks. A single SOP that references a superseded form number. One logbook entry missing a second-person verification where the rest of the book is complete. A calibration sticker that is legible but faded. The defining features are isolated and low consequence. If you find yourself writing the same minor over and over, stop and re-grade it as a major via aggregation.

Observation / Opportunity for improvement

Below minor, some audit programs record observations or OFIs: things that are compliant but could be better, or risks that are not yet nonconformities. These do not require a CAPA. The discipline here is to not let an OFI do the work of a finding. If it is a requirement gap, it is a finding. If it is genuinely “you meet the requirement but here is a better way,” it is an OFI. Auditees, and regulators, lose respect for an audit program that dresses up advice as findings or hides findings as advice.

Worked grading examples

The same underlying issue can land in different categories depending on consequence and spread. Here is a single theme, audit trail review, graded three ways.

Now the inverse: how spread changes the grade.

The lesson: count and consequence both move the needle. A trivial-looking gap becomes major by repetition and critical by who or what it touches.

How many samples make a pattern

This is the question auditors argue about most and write down least. There is no regulatory number for it, and that absence is the point: PIC/S and EU GMP never print a percentage threshold for “systemic,” and under ICH Q9 spread is one input into a judgment call, not the output of a formula. A fixed rule like “20% of the population and it’s automatically major” looks rigorous in a training deck and falls apart the first time someone applies it to a population of four.

What holds up instead is population-relative thinking, done while you still have access to pull more records.

The last row matters as much as the first three. Spread is not just “how many records,” it is spread across what: across time, across shifts, across systems, or across people. A gap concentrated on one person’s output usually means retrain that person and check whether they were qualified to do the work at all, not that the whole review system has broken down.

The common mistake here is pulling one extra sample, finding it clean, and stopping because the story the extra sample told was the one you wanted. If the honest answer after two or three additional pulls is “still unclear,” say that in the working paper and pull more, or state explicitly that the sample was limited and the finding may understate spread. An auditee reading “assessed on a limited sample, spread not fully characterized” respects that more than a grade that turns out to have been guessed.

Anatomy of a defensible finding

A grade is only as strong as the finding behind it. A finding has four required parts. Auditors remember them as condition, criteria, cause (or evidence of), and consequence. Some programs add a fifth, the requirement reference, as its own element.

1. The requirement (criteria)

The exact rule the auditee failed to meet. Cite it specifically: the regulation clause, the standard section, or the auditee’s own SOP number and step. “Good documentation practices” is not a requirement. “21 CFR 211.194(a), which requires complete records of all tests performed” is. For data integrity, anchor to ALCOA+ attributes (attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, available) and to 21 CFR Part 11 or EU GMP Annex 11 for electronic records.

Citing the auditee’s own SOP is often stronger than citing the regulation, because the auditee cannot argue with their own written standard.

2. The condition (what was found)

The factual, observed state. Specific. Identifiable. “Batch record 2026-0417 for product lot ABC, page 12, shows the pH result recorded as 7.2 with no analyst initials or date.” Not “records are sometimes incomplete.” The condition must be something a second person could go and verify.

3. The objective evidence

The artifacts that prove the condition. Record the identifiers, not your impression. Document number and version, batch or lot number, page or line, timestamp, equipment ID, screenshot reference, the name of the person who showed it to you and when. If the evidence is verbal (an operator told you they routinely skip a step), record who said it and corroborate it against a record before you grade it major.

4. The consequence / risk (why it matters)

The link between the condition and the protected interest: patient safety, product quality, or data reliability. This is the part that justifies the grade. “Because the analyst initials are missing, the result is not attributable and a reviewer cannot confirm who performed the test or whether they were qualified.” The consequence statement is what an auditee, a CAPA owner, and a regulator all read to understand why you graded it the way you did.

Worked finding (filled in)

Finding 2026-019. Grade: Major.

Requirement: EU GMP Annex 11 paragraph 9 and the site’s Audit Trail Review SOP-QC-114 v4 step 6.2 require that audit trails for GMP-relevant data be reviewed prior to batch disposition.

Condition: Across the four finished-product batch records sampled (lots A231, A234, A239, A241), the laboratory CDS audit trail review was documented as performed on a date later than the disposition decision in three of the four records (A231, A239, A241).

Objective evidence: Disposition signatures dated 2026-03-02, 2026-03-09 and 2026-03-15 respectively; corresponding audit trail review checklists (forms FRM-114-01) dated 2026-03-04, 2026-03-11 and 2026-03-18; confirmed on screen in the CDS audit trail by QC reviewer at the audit and recorded in audit note AN-07.

Consequence / risk: A required release control is being performed after the release decision it is meant to inform. Disposition decisions for three of four sampled lots were made without the audit trail review that could surface unreported reprocessing, deletions, or aborted runs. The control is documented but not operating in sequence, indicating the release-control process is not functioning as designed.

That finding is hard to argue with because every word points at a verifiable artifact, and the grade follows directly from the consequence statement. The auditee can fix it; they cannot wave it away.

Language that holds up versus language that gets challenged

The four parts can all be present and the finding can still fail under challenge, because of how it is worded. Hedge words (appears, may have, seems, sometimes, generally, occasionally) usually mean one of two things: the auditor has not yet pinned the observation to a specific instance, or the auditor is uncomfortable with how strong their own evidence actually is. Either way, the fix is the same. Find the instance, or do not write the sentence yet.

Notice the pattern: every fix replaces an adjective describing the auditor’s impression with a fact describing the world. That is the whole discipline. An auditee can dispute an impression forever. They cannot dispute a timestamp that exists.

Classifying a finding built on remote evidence

Remote audits are no longer an exception you note and move past. FDA’s authority to request records and run remote examinations is now written into statute: sections 3611 through 3613 of the Food and Drug Omnibus Reform Act of 2022 (FDORA) expanded the mandatory records-request authority under Section 704(a)(4) of the FD&C Act, and FDA’s final guidance, “Conducting Remote Regulatory Assessments: Questions and Answers” (finalized June 2025), describes how the agency runs an RRA. PIC/S published a parallel pair for its member inspectorates, “Guidance on Remote Assessments” (PI 056-1) and the companion “Aide-Memoire on Remote Assessments” (PI 057-1), both in force from 1 January 2025, covering fully interactive, partially interactive, desktop, and hybrid formats. None of that changes the grading definitions. It changes what you can defend a grade on.

The line that matters is who controlled the retrieval. When you name the record, batch, or query and watch the auditee retrieve it live on screen, that evidence carries the same weight as something you pulled yourself on site, because the auditee could not have pre-arranged what you were going to ask for. When the auditee instead hands you a document they selected and exported before or during the call, a PDF of “representative entries,” a curated screenshot, you are trusting their curation, and that is exactly the kind of trust a critical or major finding cannot rest on alone.

Working rule: grade a finding critical or major off remote evidence only when the retrieval was live and auditor-directed, or the artifact is independently reproducible later by someone other than the auditee (a regulator pulling the same system’s raw log, for instance). Where the only evidence is a provided export, write the finding as provisional, record the evidence limitation in the working paper, and either secure live access before the report issues or schedule a focused follow-up, live remote or on site, before the finding closes. A minor documentation gap rarely needs this discipline. A finding trending toward falsification always does.

Worked example. During a remote supplier audit, the auditee’s quality lead shares a screen and, on the auditor’s instruction, opens the CDS audit trail and searches a specific lot for deletion events, live. Nothing turns up for that lot, but the search incidentally surfaces a deletion pattern on three adjacent lots the auditee had not anticipated being asked about. That evidence is as defensible as an on-site pull, because the auditor chose the path to the record and the result could not have been staged. Now contrast the same audit if, instead, the quality lead had emailed a PDF export of “representative audit trail entries” ahead of the call. The auditor has no way to know what a self-selected export left out, so a critical finding cannot rest on that PDF alone. It can support a request for live access or a follow-up, but not a finished, issued critical grade.

The common mistake is treating a remote audit’s document flow as equivalent to on-site access by default, then having a finding unravel weeks later when the auditee produces a different export and says the first one “wasn’t complete.” For the logistics of running a defensible remote or hybrid audit itself, see the remote-audit section of Conducting a supplier audit and the records request / RRA response checklist; this section covers only how the evidence source changes what grade it can carry.

How to grade, step by step

When you see something during the audit, run this sequence rather than jumping straight to a label.

1. Confirm it is a real nonconformity. Is there an actual requirement, and is it actually not met? If you cannot name the requirement, you do not yet have a finding; you have a question. Ask it.
2. Gather and pin the objective evidence. Get the identifiers before you leave the room or the screen. Evidence you cannot relocate later is evidence you will lose in the closing meeting.
3. Establish spread. Is this one instance or a pattern? Pull a few more samples on the spot. The difference between minor and major usually lives here, and you can only assess it while you still have access.
4. Score severity (consequence). Map the consequence to the protected interest. Direct patient/subject risk or falsification points to critical. Marketing-authorization deviation or systemic process failure points to major. Isolated low-risk lapse points to minor. Use the ICH Q9 severity lens to keep this consistent.
5. Apply the aggregation test. If you have several related minors, ask whether together they show a broken system. If yes, write the major and reference the constituent observations.
6. Apply your SOP’s decision rules. Your program may have a grading matrix or scoring table. Use it, but treat it as a floor, not a ceiling: a matrix should never downgrade a falsification below critical.
7. Draft the finding with all four parts. Requirement, condition, evidence, consequence. The grade should be obvious from the consequence sentence alone.
8. Sanity-check against challenge. Read it as the auditee would. Where would they push? If the weak point is the evidence, get more before you finalize. If the weak point is the grade, make sure the consequence statement carries it.

The grade itself falls out of a short decision path once the evidence is pinned. Run it in order and stop at the first tier that fits:

The order matters: test critical before major and major before minor, so a falsification never gets caught in the minor net on the way down and an aggregation is considered before you settle for a single minor.

Acceptance criteria: what a good finding and a good grade look like

Use this as a checklist before a finding leaves your report.

• The requirement is cited specifically (clause, section, or SOP step and version), not by a vague principle.
• The condition is verifiable by a second person from the identifiers given.
• The evidence is recorded as artifacts, not impressions, with enough identifiers to relocate it.
• The consequence ties to a protected interest (patient/subject safety, product quality, or data reliability) and the grade follows from that consequence.
• The grade matches the definitions in both the applicable framework and your own SOP, with no looser-than-regulation grading.
• Spread was assessed, and aggregation was considered for repeated minors.
• The finding is factual and neutral in tone, with no speculation about intent beyond what evidence supports, and no proposed solution embedded (the auditee owns the corrective action).
• Two competent auditors reading the same evidence would land on the same grade. That reproducibility is the real test of a mature grading system.
• For evidence gathered remotely, the working paper records whether each artifact was retrieved live under the auditor’s direction or provided by the auditee, and a critical or major grade does not rest solely on evidence that was provided rather than live.
• For a data integrity finding, the record states whether the gap is a design gap or an act, and names the specific ALCOA+ attribute at issue.

Roles and responsibilities

The separation that matters most: the auditor grades, the auditee fixes. Letting the auditee negotiate the grade down to ease their own remediation burden is how grading systems rot.

Grading data integrity findings

A data integrity gap does not sit comfortably beside an ordinary quality departure, because the thing at risk is not one batch, it is the trustworthiness of every record the affected system produced before and after the instance you happened to catch. PIC/S PI 041-1, “Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments” (in force since 1 July 2021), FDA’s “Data Integrity and Compliance With Drug CGMP: Questions and Answers” (December 2018), the MHRA “GXP” Data Integrity Guidance and Definitions (Revision 1, March 2018), and WHO Technical Report Series 1033, Annex 4, “Guideline on data integrity” (2021), all converge on the same point without printing a grading table of their own: a DI finding is graded by what it says about the reliability of the record set, not by how many records happen to be wrong.

That means the base three-tier test needs a second layer applied first, specific to DI: is this a design gap, or is it an act? A design gap is a control that never gave anyone the means to falsify, alter, or lose a record undetected, and nobody has been shown to exploit it, a shared login that exists but has no evidence of misuse, an instrument with no time synchronization, a review step missing from a procedure. An act is someone using an existing hole, or a hole that should not have existed, to make a record say something other than what happened, a deleted failing injection, a backdated entry, results recorded before the test ran. Acts go straight to critical under the falsification and fabrication door already defined earlier in this piece, on a single instance, whether or not you can trace a specific bad batch to it. Design gaps run through the ordinary severity test, and usually land major, sometimes minor, depending on whether a working compensating control still catches an exploit before it matters.

Working through it:

1. Name the specific ALCOA+ attribute that failed, attributable, legible, contemporaneous, original, accurate, or one of the plus elements (complete, consistent, enduring, available). A finding that says “lacks data integrity” has not yet said anything checkable.
2. Ask whether the gap sits in the design of the control or in someone’s use of an existing control. Same underlying weakness, very different grade.
3. If it is an act, one instance is enough for critical. Do not wait to see if it repeats before grading it correctly; check for a second instance because it matters for scope and CAPA, not because it changes the tier.
4. If it is a design gap, ask what a working exploit would take, and whether the surrounding controls, segregation of duties, periodic review, a second signature, would likely catch it anyway. A design gap with an intact compensating control tends to land major. A design gap where the compensating control has also failed, or never existed, deserves a harder look at whether it is closer to critical.
5. Write the consequence in data-reliability terms specifically: which decisions leaned on this record, and does the gap mean those decisions cannot be trusted at all, or only that one belt is missing while the suspenders still hold.

Acceptance criteria specific to DI findings: the finding names the ALCOA+ attribute; the finding states explicitly whether it graded a design gap or an act, and why; and a design gap graded critical carries a stated reason the compensating control also failed, rather than a blanket “data integrity findings are always critical.”

Add the system owner, the person who can speak to configuration and who has ever held admin rights, and the process or data owner, who can speak to how the record is actually used downstream, to the roles in the table above for any DI finding. Grading DI purely off the technical configuration, without hearing how the record is used, is how a genuinely low-risk gap gets over-graded or a genuinely dangerous one gets under-graded.

Common mistakes specific to DI findings:

Grading every access-control gap critical by default. A shared-login or broad-admin-access observation with no evidence of use is major, not critical. Grading it critical anyway trains the organization to argue every DI finding down, because the first one was inflated and everyone noticed.

Grading a clear act as major because the record was corrected before release. The falsification is what triggers critical, not the downstream outcome. “It didn’t reach the patient” does not rescue a deleted result from the critical tier.

Writing the conclusion instead of the mechanism. “Data integrity concerns” is not a finding. Name the ALCOA+ attribute and the specific control or behavior that failed it.

Treating a missing audit trail the same as a disabled one. A legacy system with no audit trail capability at all is a design gap to be remediated. A modern system where the audit trail exists but was switched off is closer to an act, and usually grades higher, because someone had to choose to disable it.

Modality-specific grading: cell and gene therapy and combination products

The base test built through this piece (could this harm a patient or subject, or does it involve falsification; does it show a systemic breakdown; is it isolated and low consequence) assumes a conventional batch, where one bad unit sits inside a larger population and a pattern needs repetition to show itself. Two product categories break that assumption structurally rather than by exception, and the grading logic has to bend without breaking.

An autologous or otherwise patient-specific cell or gene therapy has a batch size of one, made from a single patient and returned to that same patient. There is no larger population to dilute a defect into, and no next lot to compare against. A combination product splits its quality system across drug cGMP (21 CFR Parts 210 and 211) and, depending on which path the manufacturer elected under 21 CFR Part 4, either the device Quality Management System Regulation (21 CFR Part 820, which incorporated ISO 13485:2016 by reference as the QMSR effective February 2026) in full, or a defined subset of ISO 13485 clauses folded into the drug-based system. Neither situation changes what critical, major, and minor mean. Both change how you apply the test and which requirement you cite.

Chain of identity and chain of custody. For an autologous product, FDA’s guidance on CAR T cell products describes chain of identity (COI) as the traceable, permanent link between a patient’s own starting material and the product ultimately administered to that same patient, verified with at least two independent identifiers at every handoff from collection through administration, under the traceability requirements of 21 CFR Part 1271 Subpart D. Chain of custody (COC) is the parallel record of who held the material, where, and under what condition, at every one of those handoffs. A COI or COC break, meaning the identifiers or the custody record at a handoff do not reconcile, or reconcile only after an undocumented correction, is graded against the same “could this directly harm a patient” test already established for critical. The word “could” is doing real work here: because there is no population to dilute the risk into, a single break that a downstream check catches before infusion still meets that test, the same way a caught-in-time critical process deviation elsewhere in GMP does not get downgraded merely because someone caught it in time. What moves a COI or COC observation to major instead of critical is when the control that caught it was operating exactly as designed and nothing further failed, for example a routine bedside two-identifier check finds a labeling discrepancy and stops the infusion. The control worked. The finding then is the upstream gap that let a mismatch exist at all, which is a systemic process question, not a control failure, and a single miss anywhere upstream on a product with this risk profile still earns real scrutiny of why it happened.

Combination products. A device-constituent finding runs through the identical severity test, but which vocabulary and which specific provisions apply depends on how the finding maps to the manufacturer’s Part 4 compliance path. Where a finding touches a device constituent evaluated under the streamlined approach, meaning specific ISO 13485 clauses folded into a drug-based system rather than full dual compliance, cite the specific clause invoked, not the drug regulation alone, or the requirement citation will not hold up under challenge. A device-constituent failure capable of affecting dose delivery, an autoinjector spring-force result out of range, a failed leak test on an on-body delivery system, is graded by the same ladder as a drug-side finding: critical if it touches patient harm, major if it is systemic or breaks from the registered design, minor if it is isolated. It does not become automatically lower severity for being “just the device part.” For many combination products the delivery mechanism is the entire route by which the drug reaches the patient.

Acceptance additions for this category: a CGT finding states which handoff the COI or COC element belongs to (collection, manufacturing, release, distribution, administration) and whether the control that caught or missed it was operating as designed. A combination-product finding cites the specific Part 4 pathway provision the manufacturer actually uses, dual compliance in full or the named streamlined clause, rather than a generic device reference.

Add the qualified person or equivalent disposition authority who cannot release a patient-specific product with an unresolved COI or COC question, and the device quality engineer or constituent-part owner who supplies the device-side technical consequence the same way an SME supplies it elsewhere, to the roles table for these findings.

Common mistakes in this category:

Grading a caught-in-time COI break as minor or major because no patient was harmed. The critical test is about capability, the same principle the article already applies to a sterility breach that was caught before shipment.

Citing 21 CFR Part 820 or ISO 13485 wholesale against a manufacturer that elected the streamlined Part 4 approach. Only the specific clauses that manufacturer adopted apply, and the wrong citation is itself a defensibility problem for the finding, independent of whether the underlying observation is real.

Treating every device-constituent gap as automatically minor because “it’s not the drug.” For a device-led combination product, the delivery system can be the entire mechanism of patient harm, and grading it on a lower scale than the drug side has no basis in the regulation.

For the deeper mechanics behind these examples, see Cell and gene therapy: why data integrity is structurally different, Data integrity in gene therapy, Combination products: cGMP compliance under 21 CFR Part 4, the chain of identity and chain of custody SOP, and the Part 4 provisions matrix.

Common mistakes and real inspection-finding patterns

These are the failure modes that show up in audit-of-the-audit reviews and in regulatory critiques of company audit programs.

Grade inflation and grade deflation. Inflation makes every finding a major to look thorough; it exhausts the auditee and devalues the genuine majors. Deflation, the more dangerous one, downgrades real problems to keep relationships smooth or to avoid triggering escalation. Regulators have cited firms whose internal audits “failed to classify deficiencies commensurate with their risk,” meaning the company saw the problem and graded it away.

No objective evidence behind the grade. A finding that says “concerns regarding data integrity” with no record, no timestamp, no specific instance, cannot be acted on and cannot survive a challenge. The fix is discipline at the point of observation: pin the artifact before you write the conclusion.

Citing a principle instead of a requirement. “Violates ALCOA” is a conclusion, not a citation. Name the attribute and the underlying regulation (Part 11, Annex 11, the predicate rule, or the SOP). A finding that cannot point to a breached requirement is an opinion.

Missing the aggregation. Listing twelve isolated minors and never stepping back to see that they are one systemic major. Inspectors do exactly this synthesis, and a firm whose own audits missed the pattern looks like it was not really looking.

Embedding the solution in the finding. Writing “should retrain staff and revise SOP” inside the finding. This presupposes the root cause, lets the auditee skip a real investigation, and blurs the line between the auditor (who states the problem) and the auditee (who owns the fix). State the condition and consequence; let CAPA find the cause.

Speculating about intent. Writing “the analyst deliberately falsified” when the evidence shows only that a result is not attributable. Grade what the evidence supports. A data integrity finding can be critical on the facts (a deleted failing run) without you having to prove motive. Overreaching on intent is the fastest way to get a finding thrown out.

Inconsistent grading across auditors. The same gap graded major by one auditor and minor by another, because the program has no calibration. This is a quality-system finding waiting to be made against the audit program itself. Calibration sessions, where auditors grade the same scenarios and reconcile, are the countermeasure.

Letting the auditee write or soften the finding. Findings negotiated for tone until the consequence statement is gone. The audit record should be the auditor’s, factual and unedited as to substance.

Regulatory pattern (GMP): common deficiency themes published by inspectorates repeatedly include inadequate investigation and classification of deviations and out-of-specification results, weak data integrity controls (shared logins, disabled or unreviewed audit trails), and quality systems that detected problems but did not grade or escalate them properly. The through-line is not that firms missed problems, but that they misclassified them.

Amending or withdrawing an issued finding

Findings are not static once the report is out. CAPA investigation surfaces new evidence, an auditee eventually produces a record that genuinely was not available during the visit, or the auditor realizes on review that the condition itself was mis-stated. A grading program needs a defined, honest way to handle that, or the correction path quietly becomes the same deflation pattern already covered above, dressed up as housekeeping.

Two different situations get handled differently, and confusing them is the whole risk. A factual correction is where the condition itself was wrong, the wrong lot number was cited, or a record the auditor believed was missing in fact existed and simply was not produced during the visit. That is a correction to the record, not a negotiation of the grade. A re-grade is where the condition stands as written, but new information changes the severity read, a suspected isolated gap turns out, after a wider sample pulled during the CAPA investigation, to affect every lot made that year. A re-grade can move in either direction, up as often as down, and both directions need documenting.

How to run it:

1. Log any change to an issued finding as a dated, attributed addendum. Never edit the original record in place. The original stands, and the addendum sits beside it.
2. State plainly which situation applies, factual correction or re-grade, and the specific new evidence that drove it.
3. Route the addendum through the same review the original finding required, so a critical or major re-grade gets QA review whether it moves the tier up or down.
4. Require an independent reviewer, someone other than the original auditor, for any downgrade specifically. An upgrade does not need that extra gate, though it still gets logged and reviewed.
5. Update the CAPA and any escalation already triggered to match the corrected grade, including reversing an escalation that turns out to have been triggered on a mis-stated condition, and including opening one that a corrected upgrade now requires.

Acceptance criteria: the addendum names the finding ID it amends, states factual correction or re-grade explicitly, records who requested the change and why, carries an independent reviewer’s sign-off for any downgrade, and the original finding record is never deleted or rewritten in place.

Worked example. Finding INT-2026-019 (Major, CDS audit trail review documented after disposition) was investigated under CAPA-2026-0231. The root cause investigation pulled all 22 batches made in the affected period, not the original audit sample of 4, and found the same after-the-fact review pattern in 21 of 22. Addendum INT-2026-019-A1 does not change the grade; it records the wider spread as confirming evidence that the original sample correctly represented the population, and feeds the fuller figure into the CAPA’s scope and the network read-across. Now contrast the alternative: had the wider sample instead shown only 2 of 22 affected, with the original 3 of 4 explained by those particular reviewers having missed a training update, the addendum would document a re-grade toward minor, or toward a training-focused major depending on how the training-update failure itself reads, reviewed by someone other than A. Patel before the downgrade takes effect.

Roles: the originating auditor proposes a correction or re-grade and cannot downgrade their own finding unilaterally. An independent reviewer is mandatory for any downgrade. The QA or audit program owner approves the addendum and confirms the CAPA and any escalation records are updated to match.

Common mistakes: editing the original finding text in place, so the finding’s own record carries no trace that anything ever changed, which is precisely the failure the finding was probably written to catch when it happened to the auditee. Letting the original auditor downgrade solo after pushback from the auditee, recreating the deflation pattern this article warns against elsewhere, just one review cycle later. Never revisiting a grade once issued, so a CAPA investigation that legitimately proves a wider or narrower pattern than the audit sample suggested never updates the record that drives escalation, network assessment, and the regulatory file a future inspector will read.

Linking classification to what happens next

The grade is the handoff to the rest of the quality system, and the connection points should be explicit in your program.

• Critical typically triggers immediate notification to senior management and QA, a possible product or batch hold, a formal CAPA with root cause analysis, and in supplier audits a possible hold on the supplier or a for-cause re-audit. In regulated inspections it can lead to refusal of certification or regulatory action.
• Major triggers a CAPA with documented root cause and effectiveness check, with a defined response timeline (commonly tighter than for minors).
• Minor triggers correction and, where useful, a lightweight corrective action, often grouped and tracked to closure without a full investigation.

Programs make this concrete with a grade-to-response table in the audit SOP, so the response commitment is not renegotiated every time. The exact numbers are yours to set and defend against your risk appetite; what matters is that they are defined, tighter for higher grades, and actually met. A common shape:

Two design rules for the table. Interim containment for a critical is not the same as the CAPA; you contain first (protect product and subjects) and investigate root cause in parallel. And a due date with no owner is not a commitment, so every row of every finding lands on a named owner in the tracker.

Every grade should map to a response commitment with a due date and an owner. A finding with no owner and no date is not closed-loop, and an audit program that does not drive its findings to closure is itself a finding. The mechanics of that closure (root cause, corrective and preventive action, effectiveness verification) sit in the CAPA process, and the grade you assign sets how rigorous that process has to be.

Interview-ready: questions you will be asked and how to answer

“Define critical, major and minor findings.” Anchor each to its protected interest. Critical: a deficiency that has caused or risks causing product harmful to the patient (or subject), including data falsification and fraud. Major: a non-critical deficiency that produces or could produce product not meeting its marketing authorization, or a systemic GMP failure, or a failure of release controls, including an aggregation of related minors. Minor: a real departure from requirements that is isolated and low risk. Mention that the PIC/S and EU GMP definitions are the source, and that GCP uses the same structure anchored to subject safety and data integrity.

“A single instance of a backdated record. Critical or minor? Why?” Critical. It is data falsification class, which the definition places in critical regardless of count, because it destroys confidence in the record set, not just the one entry. Do not let “it was only one record” pull you toward minor.

“Fourteen unsigned training records across four departments. How do you grade it?” Major, by aggregation. Individually each is a minor documentation gap, but the spread shows the training documentation system is not in control. State that you would also assess whether any affected person performed GMP work untrained, which could escalate it further.

“How do you keep grading consistent between auditors?” Tight written definitions in the SOP that do not go looser than the regulatory definitions, a grading lens based on severity and spread (ICH Q9 vocabulary), calibration sessions where auditors grade common scenarios and reconcile, and lead-auditor review of all critical and major findings before issue. The acceptance test is that two competent auditors reach the same grade on the same evidence.

“What makes a finding defensible?” Four parts: a specifically cited requirement, a verifiable condition, recorded objective evidence (artifacts with identifiers), and a consequence tied to patient safety, product quality, or data reliability, from which the grade follows. If any of the four is missing, the auditee can challenge it.

“An auditee disputes a major and wants it downgraded. What do you do?” Separate the facts from the grade. If they have evidence the condition is wrong, correct the condition. If the condition stands, the grade follows from the definition and the consequence, and that is not negotiable for convenience. Document the discussion. Never downgrade to ease their remediation or preserve the relationship; that is exactly the deflation pattern regulators cite.

“Where in the regulations are these categories defined?” PIC/S guidance, in particular the inspection report format and shared deficiency classification, mirrored by EU GMP inspection procedures. ICH Q9(R1) supplies the risk vocabulary for severity. For computerized systems, GAMP 5 Second Edition. For clinical, ICH E6 with the EMA/national GCP inspection grading. For management systems and labs, ISO 19011 and ISO/IEC 17025 with major/minor nonconformity terms. No single global rule defines them, but the three tier model is consistent across all of them.

“How does classification connect to CAPA?” The grade sets the rigor and timeline of the response. Critical demands escalation and a full root cause investigation, often with product impact assessment. Major demands a documented root cause and effectiveness check. Minor can be a correction or a grouped lightweight action. Every grade maps to an owner and a due date so the loop closes.

“How do you decide whether a data integrity gap is critical or major?” Ask whether it is a design gap or an act. A control that never gave anyone the means to falsify or lose a record, with no evidence anyone exploited it, a shared login with no shown misuse, an unsynced instrument clock, runs through the ordinary severity test and usually lands major. Someone actually using a hole to make a record say something other than what happened, a deleted result, a backdated entry, is an act, and one instance is enough for critical regardless of whether you can trace a specific bad batch to it. Grading every access gap critical by default just trains people to argue the real ones down.

“How is grading different for a cell or gene therapy product with a chain of identity break?” The test is the same, capability to harm, not realized harm, but the population it applies to is different. A conventional batch dilutes one bad unit into thousands of identical ones. An autologous product has a batch size of one, made from and returned to a single patient, so a break caught before infusion still meets the critical test the same way a caught-in-time process deviation elsewhere does not get downgraded for being caught. It only moves to major when the control that caught it was operating exactly as designed and the finding is really about the upstream gap that let the mismatch exist.

“Can you grade a critical finding off evidence from a remote audit?” Only if you controlled the retrieval, meaning you named the record and watched the auditee pull it live, or the artifact is independently reproducible later by someone other than the auditee. A document the auditee selected and exported before the call is their curation, not your observation, and a critical or major grade should not rest on that alone. Write it provisional, flag the evidence limitation, and get live access or a follow-up before the finding closes.

“New evidence surfaces after a finding is issued that changes what you think the grade should be. What do you do?” Log a dated, attributed addendum next to the original record; never edit the original in place. State whether it is a factual correction or a genuine re-grade, and route it through the same review the original finding needed. A downgrade specifically requires a reviewer who was not the original auditor, because that is exactly where the deflation pattern hides. Update the CAPA and any escalation to match the corrected grade either way.

Practical tips

• Pin evidence before you write the conclusion. The hardest finding to defend is the one whose evidence you could not relocate. Identifiers first, prose second.
• Pull one more sample. The minor/major line almost always turns on spread, and the only place to assess spread is in the room with access. One extra sample often converts an opinion into an aggregated major.
• Write the consequence sentence first. If you can state the consequence in one clean line, the grade names itself. If you cannot, you do not yet understand the finding well enough to grade it.
• Cite the auditee’s own SOP when you can. It is the requirement they cannot argue with.
• Keep intent out of it unless evidence proves it. Grade the facts. Critical does not require proving motive.
• Calibrate the team periodically. Grade the same five scenarios as a group and reconcile the differences. Drift between auditors is invisible until you test for it.
• Never embed the fix. State problem and consequence; leave cause and remedy to the auditee’s investigation.
• On a remote audit, say who drove the mouse. A live, auditor-directed pull carries the same weight as an on-site one. A file the auditee selected and sent ahead of time does not, at least not for anything trending toward critical.

Related reading

• Internal audit program
• Conducting a supplier audit
• Quality event classification and triage
• Deviation management
• What is a CAPA
• CAPA effectiveness verification
• Root cause analysis techniques
• Quality risk management
• ALCOA+ in detail
• Audit trail design and review
• FDA 483 response strategy
• GCP audits and inspections
• Cell and gene therapy: why data integrity is structurally different
• Data integrity in gene therapy
• Combination products: cGMP compliance under 21 CFR Part 4