EU GMP Annex 1 (2022): a practical contamination control strategy checklist

Many first-generation CCS documents were long narratives that summarised existing SOPs. They were hard to review and went out of date quickly. A structure that works better in practice has two parts.

1. A short strategy document

Scope (site, product or line), responsibilities, the risk method used, how the CCS is reviewed, and how it links to the pharmaceutical quality system — deviations, CAPA, change control and management review.

2. A register of contamination hazards and controls

One row per hazard, with four columns that matter:

• Hazard — the contamination route, for example personnel shedding in Grade A, ingress through a door interlock failure, or bioburden in incoming components.
• Control — the design, technical or procedural measures that prevent it.
• Monitoring — how you would know the control was failing: EM points, pressure differentials, utility sampling, gowning assessments.
• Effectiveness — the evidence and review that shows the control works: trends, media fill results, deviation history.

Add an owner and a risk rating to each row, and reference the SOPs, validation reports and monitoring programmes that hold the detail rather than copying them. That keeps the CCS short enough to review and makes it obvious which documents need to change when a hazard row changes.

The register makes gaps visible. A hazard with a control but no monitoring, or monitoring with no defined review, is exactly what an inspector will find.

Facility and equipment

• Cleanroom grades, airflow, pressure cascades and room qualification status documented and current.
• Barrier technology (RABS or isolator) justified, with decontamination and glove integrity controls.
• Preventive maintenance and requalification frequency based on risk.

Personnel

• Gowning qualification before Grade A/B access, with periodic requalification.
• Aseptic technique training and behaviour in the cleanroom covered by the CCS.
• Operator participation in aseptic process simulation.

Utilities

• Water for injection, purified water, clean steam, compressed gases and HVAC each with alert and action limits.
• Sampling plans and trending defined, with action breaches investigated.

Materials, containers and closures

• Supplier qualification and incoming controls for components that contact the product.
• Bioburden and endotoxin controls for starting materials where relevant.
• Container closure integrity assured and tested.

Process and sterilisation

• Sterilisation cycles validated and each cycle released against defined parameters and indicators.
• Sterilising filter integrity tested after use, and before use unless a risk-based justification applies (pre-use post-sterilisation integrity testing, PUPSIT).
• Aseptic process simulation (media fill) design, frequency and acceptance criteria — any contaminated unit is investigated.
• Hold times, lyophilisation and visual inspection controls covered.

Monitoring and prevention

• Environmental monitoring programme (viable and non-viable) based on risk, with defined locations and frequencies.
• Trending, excursion investigation, root cause analysis and CAPA linked to the CCS.
• Cleaning and disinfection programme, including disinfectant efficacy and rotation.

Annex 1 expects the CCS to be reviewed and updated. A static document signed once at the start of the programme will not satisfy an inspector. Build these triggers into your procedure:

• Periodic review — at a defined frequency, typically aligned with management review.
• Change control — any change to facility, equipment, process or materials assesses its CCS impact.
• Deviations and excursions — an adverse EM trend or a failed media fill prompts a review of the related hazard rows.
• New knowledge — supplier changes, new products or regulatory updates.

Each revision should be versioned and approved, with the previous version superseded rather than overwritten, so you can show an inspector what the strategy said at any point in time.

Inspectors rarely read the CCS front to back. They pick a hazard and follow it. For example: “Show me how you control operator contamination at the filling line.” They then expect to see, quickly:

1. The hazard row and its stated controls.
2. Gowning qualification records for the operators on a given batch.
3. EM results for that shift and location, with any excursions and their investigations.
4. The current media fill that qualifies the line and those operators.
5. The batch record showing the controls were in place at the time.

If those records sit in five different binders or systems, the answer takes hours. If they are linked, it takes minutes.

Swat iQua Suite covers the Annex 1 controls for sterile and injectable manufacturing on the same platform as its batch records, laboratory and quality modules.

• Contamination control strategy records per site, optionally per product version, with a hazard → control → monitoring → effectiveness register. Approval is e-signed with segregation of duties and supersedes the previous CCS of the same scope.
• Environmental monitoring with a cleanroom register, monitoring points and versioned alert and action limits. An action result opens an excursion; its e-signed disposition raises a deviation and blocks batch release.
• Gowning qualification recorded with an e-signature, where the assessor cannot assess themselves.
• Utilities monitoring for WFI, clean steam, compressed air, HVAC and other systems, with versioned limits; an action breach raises a deviation.
• Aseptic process simulation: versioned protocols, runs where any positive unit means a fail, and a line-qualification gate that blocks aseptic filling without a current passing media fill.
• Sterilisation cycles with biological and chemical indicator results, QA release with segregation of duties, and filter integrity tests before and after use.
• Lyophilisation cycles, visual inspection runs (100% or AQL, level recorded) and container closure integrity results — failures raise a deviation and a release blocker.

At batch level, a sterile step cannot start unless the operator holds a current gowning qualification, the cleanroom is ready and qualified, there is no open EM excursion in the room and the filling line has a current passing media fill. The CCS register itself is a controlled document and register; you link its monitoring rows to your EM and utilities programmes through your procedures.