Risk-Based Inspection (RBI) is a GMP inspection planning method that prioritizes sites, systems and products based on the risk they may pose to patients and to product quality, instead of inspecting everyone in the same routine cycle. CDSCO’s RBI guidance describes it as rating manufacturing sites using intrinsic risk (product/process/site complexity and criticality) plus compliance risk (track record), so regulators can decide the frequency, depth and breadth of inspections more effectively. CDSCO
Link to Schedule M (India GMP)
Schedule M expects a documented Pharmaceutical Quality System (PQS) and explicitly requires Quality Risk Management (QRM) as part of GMP implementation. This means inspection focus shifts from “paper compliance” to whether the firm’s PQS actually identifies, controls and reviews risks across lifecycle stages (e.g., deviations/CAPA, change control, validation status, supplier controls, data integrity).
RBI also uses “signals” to prioritize and scope inspections—such as complaints, NSQ history, recall history, inherent product risk, and inspection history—and allows unannounced inspections when non-compliance is suspected.
WHO TRS 986 (Annex 2) – Point 7.1 to 7.5 (Contract/Outsourced Activities)
WHO TRS 986 section 7.1–7.5 tightens control over contract manufacturing/analysis/outsourcing, which is a common high-risk area in inspections:
7.1 Principle: outsourced GMP activities must be clearly defined, agreed and controlled to prevent misunderstandings that could lead to poor quality.
7.2 Contract arrangements (including tech transfer and changes) must remain consistent with the marketing authorization.
7.3 The contract must allow the contract giver to audit the contract acceptor (and approved subcontractors).
7.4 For contract testing, final release/approval remains with the authorized person as per GMP and MA, as written in the contract.
7.5 The contract giver’s PQS must control and review outsourced work and ensure the acceptor is legally suitable, competent, and follows GMP/QRM.
Practically, an RBI under Schedule M uses these TRS expectations to target outsourced controls, vendor qualification, quality agreements, audit effectiveness, and batch release governance.