Are You Inspection-Ready? A 25-Point Health Canada GMP Self-Assessment

Introduction

Most companies do not discover the true size of their compliance gap until an inspector is standing in the corridor asking for a batch record. By then the gap is no longer a project. It is an observation, and observations follow you.

Health Canada is explicit about where the burden sits. Its Good manufacturing practices inspection policy for drug establishments (POL-0011) states that an establishment applying for or holding a Drug Establishment Licence (DEL) "is responsible for being in a state of readiness for an inspection at any time." Not on the date you were notified. At any time.

This article gives you a 25-point self-assessment built directly from Part C, Division 2 of the Food and Drug Regulations and the way Health Canada interprets it in GUI-0001 and GUI-0023. Score yourself honestly, add up the total, and read your band. It takes about 30 minutes and it will tell you something a status meeting will not.

How Health Canada Actually Scores You

Direct answer: Health Canada does not score you out of 25. Inspectors record observations, assign each one a risk classification under GUI-0023, and then assign one overall rating of Compliant (C) or Non-Compliant (NC) based on the nature and extent of the deviations. The self-assessment in this article is a diagnostic tool designed by MFLRC to predict that judgment, not a Health Canada instrument.

The three risk classifications

GUI-0023, published and implemented on August 31, 2020, defines them as follows:

Note the upgrade paths running up both tiers of the table. GUI-0023 states that a Risk 2 observation may be upgraded to Risk 1 where the issue "is not isolated to one area or system," and that any Risk 3 observation could be upgraded to Risk 2. It sets no criterion for the Risk 3 upgrade. In our experience, a Risk 3 finding is most likely to be upgraded once the same weakness turns up in a second system. This escalation is the single most misunderstood feature of the Canadian rating model, and it is why counting observations is a poor predictor of outcome.

How the overall rating is decided

GUI-0023 states that a C rating will generally be assigned where few Risk 2 observations focused on isolated issues are noted, or where only Risk 3 observations are noted. An NC rating will generally be assigned when a Risk 1 observation is noted, when numerous Risk 2 observations indicate the company does not control its processes and operations sufficiently, or when Risk 2 observations identify overarching systemic issues.

Read those words again: "few" and "numerous." Health Canada publishes no threshold. Any consultant who tells you that three Risk 2 findings equals an NC rating is inventing a number that does not exist in the guidance. The inspector makes a judgment, taking into account the nature and extent of the deviations in relation to the products handled and the activities conducted.

One more point worth internalizing: a C rating does not mean there are no observations or corrective actions required. All observations recorded in the Inspection Report require corrective action, regardless of the overall rating.

How much warning you get

Under POL-0011, Health Canada may, as a courtesy, give notice before an inspection. It is not required to provide advance notice of every inspection, and inspectors may withhold notice where there is an immediate risk to consumer health and safety or where the approach supports the assessment of compliance. Health Canada may also periodically perform unannounced random inspections.

Domestic inspection frequency is risk-based and published in POL-0011:

Where an establishment conducts multiple activities, the higher risk activity dictates the frequency. Health Canada may inspect more often based on compliance history, establishment size, products handled and supply chain importance. For a new DEL, Health Canada's service standard is 250 days, an initial on-site inspection is performed in that window, and a first regular inspection is typically conducted within 12 months of the initial inspection. For foreign buildings, no fixed cycle is published. Selection is risk-based, and Health Canada is not required to provide advance notice.

When Should Preparation Start?

Direct answer: Health Canada's own position is that you must be inspection-ready at any time, so the honest answer is "already." In MFLRC's practical experience, however, a site that wants to close real gaps rather than paper over them should begin structured preparation 6 to 12 months before an expected inspection window, because the two longest-lead items, CAPA effectiveness evidence and stability data, cannot be accelerated.

That 6 to 12 month figure is our recommendation drawn from client work. It is not a Health Canada requirement, and we will not dress it up as one.

The logic is simple. Most gaps are fixable in weeks. Two categories are not. CAPA effectiveness evidence needs production cycles to accumulate, so closing a CAPA in month eleven leaves you with a closure record and no evidence that it worked. Stability studies cannot be compressed at all: if your shelf-life justification has a hole, the calendar decides when it closes, not your budget. Everything else, SOP revision, training, sanitation and document control remediation, can be done inside a quarter with focus. Those two cannot. That is what sets the lead time.

The 25-Point Health Canada GMP Self-Assessment

Section A: Pharmaceutical Quality System and Governance (Points 1 to 4)

1. Self-inspection program. You have a comprehensive written procedure describing the functions of your self-inspection program, you carry out periodic self-inspections, and senior management reviews the reports on findings and corrective actions. C.02.012(1)(b) requires only "a program of self-inspection." GUI-0001 adds the substance: it requires that you carry out periodic self-inspections, that senior management reviews the findings, and that your self-inspection team includes personnel or consultants suitably trained and qualified in GMP. Note that no fixed frequency is prescribed anywhere. "Periodic" is GUI-0001's word, and it means you must define and justify your own interval.

2. Quality unit independence. Your quality control department is a distinct organizational unit that functions and reports to management independently of any other functional unit, including manufacturing, processing, packaging and sales. Required by C.02.013(2). GUI-0001 calls this independence "fundamental." A quality unit that reports to the plant manager is a Risk 1 exposure: GUI-0023 lists "the quality control department was not a distinct unit with true decision-making power" and "the production department or management overruled quality control decisions" as critical observation examples.

3. Batch release control. No lot or batch is made available for further use in fabrication or for sale unless the person in charge of the quality control department approves it, per C.02.014(1). Separately, GUI-0001 interprets C.02.011 to require that in-process and finished products are held in quarantine and identified as such until released by your quality control department.

4. Annual product quality review. You conduct regular periodic or rolling quality reviews of all drugs, annually unless a longer frequency is suitably justified, verifying process consistency and the appropriateness of current specifications. This sits inside C.02.011 in GUI-0001, not in a standalone regulation. Importers, note that GUI-0001 expects the scope of your APQR to extend to all batches made using the same process, specifications, facilities and formulation as the imported product, not only the batches received in Canada. This is one of the most commonly missed requirements we see.

Section B: Documentation and Data Integrity (Points 5 to 9)

5. Written procedures exist and match reality. You have written procedures prepared by qualified personnel to ensure the drug meets its specifications, and each lot is fabricated, packaged/labelled and tested in compliance with those procedures, per C.02.011. The test is not whether the SOP exists. It is whether the operator does what it says.

6. Records are complete, contemporaneous and retrievable. Your records satisfy C.02.020 through C.02.024.1 and you can retrieve any batch record on request within the inspection. GUI-0023 lists falsified, misrepresented or inappropriately destroyed records as a Risk 1 critical observation.

7. Audit trails are reviewed, not merely enabled. Your computerized systems capture audit trails and, critically, someone reviews them as part of batch release rather than at some undefined later date. GUI-0023 treats falsified, misrepresented or inappropriately destroyed records as a Risk 1 critical observation, and in our audit experience the review step, not the logging step, is where sites are most often exposed.

8. Master formula control. A written master formula exists for every product, and manufacturing batch documents show no deviations from the formula or the process described in the market authorization. GUI-0023 treats "there was no written master formula" and gross deviations or significant calculation errors as Risk 1 examples.

9. No falsification exposure anywhere. You are confident that no analytical sample, test result or raw datum in your organization has been misrepresented or fabricated, and that no deleted or destroyed record has been used to support a release decision. Both are Risk 1 examples in GUI-0023. This point is binary and unforgiving by design.

Section C: Premises, Equipment and Sanitation (Points 10 to 14)

10. Premises. Designed, constructed and maintained to permit clean, sanitary and orderly operations, permit effective cleaning of all surfaces, and prevent contamination and the addition of extraneous material, per C.02.004.

11. Equipment qualification. Equipment is designed, constructed, maintained, operated and arranged to permit effective cleaning, prevent contamination, and function in accordance with its intended use, per C.02.005. Equipment used for complex manufacturing of critical products is qualified with evidence of appropriate monitoring.

12. Sanitation program. You have a written sanitation program implemented under the supervision of qualified personnel, per C.02.007(1). GUI-0023 cites widespread residue build-up and gross infestation as Risk 1 examples.

13. Personnel hygiene. You have written minimum requirements for the health, hygienic behaviour and clothing of personnel, per C.02.008(1).

14. Contamination and environmental control. Segregation of manufacturing and testing areas is adequate for higher risk products, and air filtration and ventilation systems function as designed. Inadequate segregation for higher risk products is a Risk 1 example.

Section D: Materials and Testing (Points 15 to 18)

15. Raw material testing. Each lot or batch of raw material is tested against its specifications before use, no lot is used unless it complies, and each lot received on a fabricator's premises is tested for identity, per C.02.009 and C.02.010(2).

16. Supplier qualification. You hold current evidence of supplier qualification and certificates of analysis. GUI-0023 lists the case where the supplier or manufacturer provided no evidence of a testing certificate of analysis and the Canadian fabricator did not perform testing as a Risk 1 critical observation.

17. Finished product testing. Finished product is tested for compliance with applicable specifications before release for sale, per C.02.018 and C.02.019. Importers and distributors, note that failing to test with no evidence the fabricator tested the product is a Risk 1 example.

18. Stability program. Data are available to establish the shelf-life of every product, per C.02.027 and C.02.028. No data to establish shelf-life is a Risk 1 example.

Section E: Personnel (Points 19 to 20)

19. Qualifications of key personnel. Fabrication, packaging/labelling, testing and storage occur under the supervision of personnel with technical, academic and other training the Minister considers satisfactory, per C.02.006. For critical or high-risk products, GUI-0023 treats the absence of a relevant university degree plus sufficient practical experience in the person in charge of quality control or production as a Risk 1 example. Note also that no person in charge of quality control being available on the Canadian premises is itself a Risk 1 example, though GUI-0023 lists that one under C.02.013 to C.02.015 rather than under C.02.006.

20. Training records. Training is documented, current, role-specific, and demonstrably effective rather than a signature on a read-and-understand sheet.

Section F: Deviations, CAPA and Recall (Points 21 to 23)

21. Deviation and investigation management. Deviations are captured, investigated to root cause, and closed within defined timelines, with quality unit oversight.

22. CAPA effectiveness. Your CAPAs have documented effectiveness checks, and you have no repeat observations from your last inspection. Under GUI-0023, an observation may be marked as a repeat if it is similar to a past observation, cites the same regulation, and there is a reasonable expectation the earlier corrective measure would have prevented recurrence. Repeat findings drive risk classification upward.

23. Recall system and mock recall. You maintain a system of control permitting complete and rapid recall of any lot or batch on the market, per C.02.012(1)(a), you have a written recall system complying with section 21.3 of the Food and Drugs Act and section C.01.051 of the Regulations, and you verify recall procedure adequacy periodically, including by mock recall where no real recall has occurred, with quality control review and approval of the mock recall report.

Section G: Inspection Logistics (Points 24 to 25)

24. Document retrieval under pressure. You can produce any requested SOP, batch record, training file, qualification report or investigation within minutes, and you have a defined inspection support process with named roles, a front room and a back room.

25. Prior observations closed. Every observation from your last inspection is closed with evidence, and your CAPA commitments to Health Canada have been met on the dates you committed to. Under POL-0011, a CAPA plan deemed deficient gets one opportunity to be amended, and a deficient amended CAPA plan will inform further compliance and enforcement actions such as increased inspection frequency, additional reporting requirements, or terms and conditions on the establishment licence.

Score Yourself

Add up your points. Then find your band.

Sector Note: This Is Not Only a Drug Establishment Issue

The 25 points above are anchored in Part C, Division 2 of the Food and Drug Regulations, which governs drug products. The same readiness logic applies across the other frameworks MFLRC works in, with different citations.

• Cannabis. Good Production Practices sit in Part 5 of the Cannabis Regulations (SOR/2018-144), beginning at section 78.1, covering standard operating procedures (section 80), premises (section 84), equipment (section 86) and the sanitation program (section 87). The Quality Assurance Person position is established at section 19, in Part 2 rather than Part 5. The Part 5 batch approval duty sits at section 88(1)(e), which requires a holder of a licence for processing to ensure that every lot or batch is approved by the QAP before it is made available for sale, and section 88(2) permits that approval to be conducted under the responsibility of the QAP. The recall system requirement is at section 46, outside Part 5, which also requires a recall simulation at least once every 12 months, documented and retained for two years. Our guide on how to pass a Health Canada cannabis inspection covers the operational detail, and EU-GMP vs GPP explains which standard applies to you.
• Natural health products. GMP requirements sit in Part 3 of the Natural Health Products Regulations (SOR/2003-196), sections 43 to 62. Health Canada's Good manufacturing practices guide for natural health products (GUI-0158) Version 4.0 was published September 4, 2025 and came into force March 4, 2026, replacing Version 3.0 of December 1, 2015. If you have not re-baselined against Version 4.0, see our GUI-0158 Version 4.0 compliance checklist.
• Sterile manufacturing. GUI-0023 lists more Risk 1 examples under sterile products (C.02.029) than any other area, including unvalidated sterilization cycles, absent media fills and releasing batches that failed an initial sterility test on the basis of a retest without proper investigation. See why compliant sites still fail Annex 1.

Common Mistakes We See

1. Treating a compliant rating as a clean bill of health. GUI-0023 says plainly that a C rating does not mean there are no observations or corrective actions required, and that all observations require corrective action regardless of rating. Companies that close only the findings they consider serious create next inspection's repeat observations.
2. Counting observations instead of reading them. There is no published number of Risk 2 findings that triggers NC. Nature and extent decide. Two systemic Risk 2 findings are more dangerous than six isolated ones.
3. Confusing CAPA closure with CAPA effectiveness. A closed CAPA with no effectiveness evidence is a repeat observation waiting for a calendar. Under POL-0011, if your CAPA plan is deemed deficient you get only one opportunity to submit an amended one, and a deficient amended plan informs further enforcement action.
4. A quality unit that is independent on the org chart only. If production can pressure a release decision, the independence required by C.02.013(2) does not exist, whatever the chart says.
5. Importers scoping the APQR to Canadian batches only. GUI-0001 expects the scope to extend to all batches made using the same process, specifications, facilities and formulation.
6. Enabling audit trails without reviewing them. The control is the review, not the checkbox. See audit trail review as the new data integrity battleground.
7. Writing SOPs that describe an ideal process nobody follows. Our guide on how to write SOPs that pass a Health Canada inspection addresses this directly.
8. Waiting for the notification call. POL-0011 requires readiness at any time and permits unannounced random inspections.

Frequently Asked Questions

How much advance notice does Health Canada give before a GMP inspection?

Health Canada may, as a courtesy, give notice before an inspection, and an inspector will contact the establishment to schedule it. However, POL-0011 states Health Canada is not required to provide advance notice of every inspection, and inspectors may withhold notice where there is an immediate risk to consumer health and safety or where it supports the assessment of compliance. Health Canada may also perform unannounced random inspections. For foreign buildings, no advance notice is required. Once a date is set, requests to change it are accommodated only at Health Canada's discretion under exceptional circumstances with proper justification.

How many observations will make my inspection non-compliant?

There is no published number. GUI-0023 uses qualitative language only: a compliant rating is generally assigned where few Risk 2 observations on isolated issues are noted or where only Risk 3 observations are noted, and a non-compliant rating is generally assigned when a Risk 1 observation is noted, when numerous Risk 2 observations indicate insufficient control, or when Risk 2 observations identify overarching systemic issues. Any consultant quoting you a threshold number is not citing the guidance.

What happens after a non-compliant rating?

GUI-0023 states that an NC rating may result in compliance and enforcement actions including the expedited implementation of corrective measures, adding terms and conditions to the establishment licence, a proposal to suspend the establishment licence, and the suspension of an establishment licence. Immediate suspension may be initiated where necessary to prevent injury to consumer health. Terms and conditions may be applied regardless of rating. Methods of dispute are outlined in the letter accompanying the exit notices.

Does Health Canada require a specific self-inspection frequency?

No. C.02.012(1)(b) requires a program of self-inspection, and GUI-0001 requires that you carry out periodic self-inspections with senior management review of findings and corrective actions. No fixed interval is prescribed, which means the burden is on you to define and justify an interval appropriate to your operations. Your self-inspection team must include personnel or consultants suitably trained and qualified in GMP, which is why many licence holders use an independent party for at least part of the cycle.

Is the annual product quality review actually mandatory, and where is it in the Regulations?

The APQR is not a standalone regulation. GUI-0001 places it within the interpretation of C.02.011 (manufacturing control) and states that reviews should be conducted annually, though longer frequencies are acceptable if suitably justified. Importers should note GUI-0001's expectation that the scope extends to all batches made using the same process, specifications, facilities and formulation as the imported product, not only batches received in Canada.

My score is low. What should I fix first?

Prioritize by risk classification, not by effort. Address anything touching data integrity or falsification first, because those map to Risk 1 examples in GUI-0023 and a single Risk 1 observation generally produces an NC rating on its own. Next, fix quality unit independence, because it is described in GUI-0001 as fundamental and appears repeatedly in the Risk 1 examples. Then start stability and CAPA effectiveness work immediately, since those are calendar-bound and cannot be accelerated later. Cosmetic and documentation tidying comes last, not first.

How MFLRC Can Help

Self-assessment has one structural weakness: you are grading your own work, and you know where the bodies are buried well enough to score around them. That is exactly what an independent inspector does not do.

MFLRC provides senior-led, technically grounded support across the full inspection-readiness lifecycle:

• Mock audits. We run your inspection the way Health Canada would, using GUI-0001 as the assessment guide and GUI-0023 to classify what we find, so you see your likely rating before it counts.
• Gap analyses. Structured assessment against Part C, Division 2, Cannabis Regulations Part 5, or NHP GUI-0158 Version 4.0, with findings prioritized by risk classification and a realistic remediation sequence.
• Inspection-readiness assessments. Front room and back room process design, document retrieval drills, and preparation of the people who will actually be in the room.
• SOP and quality system development, through our Quality Assurance Services. Internal and supplier audits, CAPA review and auditor training through our Audit Services. Process, equipment, cleaning, computerized system, analytical method and packaging validation via our Pharmaceutical Validation Services. DEL applications, amendments and renewals through our Regulatory Affairs, Licensing and Import/Export practice.

MFLRC is led by Mussarat Fatima, who holds over 20 years in quality assurance, quality control and regulatory affairs across pharmaceutical, food and cannabis sectors, is security cleared by Health Canada, is an approved Quality Assurance Person, and is a member of ASQ and the European QP Association.

Scored below 22? Let's find out what an inspector would find. If an inspection has already happened and you are working on your response, read our guide on how to respond to an FDA Form 483 or Health Canada inspection observation and why your CAPA keeps failing.

Conclusion

The uncomfortable truth in Health Canada's inspection model is that it does not reward effort. It assesses state of control at a moment you may not choose. POL-0011 puts the obligation plainly: an establishment applying for or holding a DEL is responsible for being in a state of readiness for an inspection at any time.

A 25-point self-assessment will not make you compliant. What it does is convert a vague unease into a number and a band, and a band into a decision. If you scored 23 or above, verify it independently, because self-scoring runs optimistic. If you scored between 17 and 22, you have a project with a deadline you do not control. If you scored below 17, the gap is not a documentation problem. It is a rating problem, and rating problems become licence problems.

The best time to find your Risk 1 exposure is when the person finding it works for you.

Sources and References

1. Health Canada. Good manufacturing practices guide for drug products (GUI-0001). Published July 2020.
2. Health Canada. Risk classification guide for drug good manufacturing practices observations (GUI-0023). Published and implemented August 31, 2020.
3. Health Canada. Good manufacturing practices inspection policy for drug establishments (POL-0011).
4. Government of Canada. Food and Drug Regulations, C.R.C., c. 870, Part C, Division 2.
5. Government of Canada. Cannabis Regulations (SOR/2018-144), Part 5 Good Production Practices; sections 19, 46 and 88.
6. Health Canada. Guidance document: Good production practices guide for cannabis. Published August 29, 2019.
7. Government of Canada. Natural Health Products Regulations (SOR/2003-196), Part 3 Good Manufacturing Practices.
8. Health Canada. Good manufacturing practices guide for natural health products (GUI-0158), Version 4.0. Published September 4, 2025; effective March 4, 2026.