Having a CCS is not the same as having one that survives contact with an inspector. This checklist walks your Contamination Control Strategy the way an EU GMP, MHRA, or PIC/S-trained inspector does: it starts holistic, traces a single risk end to end, cross-checks the document against the floor, probes the feedback loops, and tests ownership and competence. Use it as a self-inspection before someone external does it for you. Mark each item Pass, Fail, or N/A with evidence; every Fail is a remediation action with an owner. A filled specimen extract follows. Verify each cited requirement against the current Annex 1 text before you rely on it.
How to use
- Do it with the people who run the line, not only the CCS author; the competence test is real.
- Demand evidence, not assertion: pull the gowning re-qualification dates, read the disinfectant efficacy study, check the magnehelic gauges against the CCS.
- Every Fail gets an owner and a due date and feeds the CCS review.
Section 1: Does the CCS reason, or just index?
| # | Item | Ref | Pass/Fail/NA | Evidence |
|---|---|---|---|---|
| 1.1 | The CCS is a document that reasons from hazard to control, not a binder indexing many SOPs | Annex 1 CCS | ||
| 1.2 | It covers the full Annex 1 element list and shows how the elements interact | Annex 1 CCS | ||
| 1.3 | A risk-to-control-verification-residual matrix exists and is traceable | Annex 1, ICH Q9 | ||
| 1.4 | It exists as a controlled, approved document set with version, date, and a named owner by function | ICH Q10 |
Section 2: Can you trace one risk end to end?
| # | Item | Ref | Pass/Fail/NA | Evidence |
|---|---|---|---|---|
| 2.1 | For operator interventions at the fill point, the chain runs hazard to barrier to procedure to APS to monitoring to trend to deviation history with no break | Annex 1 | ||
| 2.2 | Evidence a control works (qualification) is separated from verification it keeps working (monitoring) | Annex 1 | ||
| 2.3 | Every control maps to evidence; no control is asserted without proof | Annex 1 |
Section 3: Are limits and monitoring sound?
| # | Item | Ref | Pass/Fail/NA | Evidence |
|---|---|---|---|---|
| 3.1 | Alert and action limits are derived from site data with a stated method, not copied from the Annex 1 maxima | Annex 1 | ||
| 3.2 | Grade A viable expectation is no growth, and any recovery is investigated | Annex 1 | ||
| 3.3 | Continuous viable and non-viable monitoring runs for the duration of critical Grade A processing | Annex 1 | ||
| 3.4 | Classification (Table 1) and monitoring (Table 5) limits are not confused, including the removed Grade A >=5 micron classification figure | Annex 1, ISO 14644-1 |
Section 4: Is barrier, filtration, and APS logic defensible?
| # | Item | Ref | Pass/Fail/NA | Evidence |
|---|---|---|---|---|
| 4.1 | Barrier technology is justified for the product/process, and its failure modes (glove breach, VHP cycle, open-door intervention) are named hazards | Annex 1 | ||
| 4.2 | Isolator glove integrity is a defined test program, not just a visual check | Annex 1 | ||
| 4.3 | PUPSIT is performed, or its omission is justified by a documented risk assessment addressing flaw masking | Annex 1, 8.87 | ||
| 4.4 | APS acceptance is zero growth (any positive fails), design includes worst-case interventions, and results feed back into the CCS | Annex 1, 9.46 |
Section 5: Is the CCS a living document?
| # | Item | Ref | Pass/Fail/NA | Evidence |
|---|---|---|---|---|
| 5.1 | Defined triggers force CCS review (deviations, adverse trends, contamination events, new objectionable isolates, facility/process change) | ICH Q10 | ||
| 5.2 | There is evidence the CCS was actually updated after such events, not just at issue | ICH Q10 | ||
| 5.3 | The CCS sits in periodic review and management review | ICH Q10 | ||
| 5.4 | Disinfectant efficacy is validated against organisms actually recovered on site, including spore-formers | Annex 1 |
Section 6: Ownership and competence
| # | Item | Ref | Pass/Fail/NA | Evidence |
|---|---|---|---|---|
| 6.1 | A named CCS owner by function exists and is current (not a departed author) | ICH Q10 | ||
| 6.2 | Current floor and quality staff can explain why each control exists, not just that it exists | Annex 1, ICH Q9 | ||
| 6.3 | As-built matches as-designed; no undocumented transfer hatch, moved HEPA, or changed flow | Annex 1 | ||
| 6.4 | Utilities (WFI, pure steam, gases) and CCIT are pulled into the CCS, not siloed | Annex 1 |
Scoring summary
| Section | Items | Pass | Fail | N/A | Highest-risk open gap |
|---|---|---|---|---|---|
| 1 Reasoning | 4 | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 2 Traceability | 3 | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 3 Limits/monitoring | 4 | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 4 Barrier/filtration/APS | 4 | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 5 Living document | 4 | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 6 Ownership/competence | 4 | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Signoff
| Role | Name | Signature | Date |
|---|---|---|---|
| Assessor | <<FILL>> | ||
| CCS owner | <<FILL>> | ||
| Site Quality Head | <<FILL>> |
References
EU GMP Annex 1 (2022), including clause 8.87 (PUPSIT) and 9.46 (APS acceptance). ICH Q9(R1) Quality Risk Management; ICH Q10 Pharmaceutical Quality System. ISO 14644-1 (cleanroom classification), referenced for particle limits.
Confirm the current version and clause numbers of each reference before issue.
Filled specimen
An extract from a self-inspection two months before an expected EU GMP inspection.
| # | Item | Result | Evidence / action |
|---|---|---|---|
| 1.1 | CCS reasons, not indexes | Pass | Document walks each route hazard-to-control; not a table of SOP references |
| 3.1 | Data-derived limits | Fail | Grade B settle-plate action limit still set at the Annex 1 maximum of 5, not derived from site history (site normal is 0-2). Action: derive percentile-based alert/action limits, update EM program. Owner: QC Micro. Due 3 weeks. |
| 4.3 | PUPSIT | Pass | PUPSIT performed on single-use assemblies; risk assessment on file for the two products where it is omitted, addressing flaw masking |
| 5.2 | Evidence of update | Fail | CCS not updated after the March pressure-cascade excursion. Action: run the CCS review trigger, document the update. Owner: CCS owner. Due 2 weeks. |
| 6.2 | Staff can defend controls | Pass | Two line supervisors explained the disinfectant rotation rationale and the RABS intervention limits without notes |
Two Fails, each dated and owned: limits copied from the maximum rather than derived from data (a classic finding), and a CCS not updated after a real excursion (the living-document failure). Catching both in a self-inspection two months out is exactly the point, versus having the inspector find them.
Common inspection findings this checklist catches early
- A stapled CCS that indexes SOPs without reasoning tying them to risks.
- Action limits set at the Annex 1 maxima, so adverse trends within the maximum go unnoticed.
- PUPSIT omitted with no risk assessment addressing flaw masking.
- A CCS not updated after a contamination event or facility change.
- An author-only CCS that current staff cannot defend under “why is this control here?”
How to adapt this checklist
- Add site-specific rows for your products, barrier types, and utilities.
- Run it with the floor and quality staff who would face the inspector, to test competence for real.
- Convert every Fail to a dated, owned action and feed it into the CCS review.
- Repeat it on a cadence and before any inspection.
- Confirm the referenced Annex 1 clauses against the current text before issue.