CCS: What Inspectors Actually Asked For in the Last 18 Months

A Head of Quality at a European fill-finish site once described the moment an inspector closed her laptop mid-audit and asked a simple question: "Who owns this document?" The site had a Contamination Control Strategy binder nearly 200 pages long. Nobody in the room could answer in under a minute.

That single exchange, recounted at an industry roundtable, captures where sterile manufacturing inspections have landed in 2025 and 2026. The contamination control strategy (CCS) is no longer a paperwork exercise that inspectors skim. It is the spine of the inspection, and it is where facilities are increasingly failing.

Since EU GMP Annex 1's revised requirements became fully binding, agencies including the MHRA, FDA, and EU national authorities have converged on a shared line of questioning. This article breaks down what inspectors have actually been asking, backed by regulator publications and inspection trend data from the last 18 months, and gives leaders a practical way to close the gaps before the next visit.

Why Contamination Control Sits at the Center of Every Sterile Inspection

Contamination and cross-contamination control have been a top-tier deficiency category for as long as agencies have published inspection data. In the MHRA's own 2011/2012 deficiency review, 75 of the year's findings were tied to chemical, physical, or microbial contamination, alongside 57 personnel-related deficiencies. By 2018 and 2019, Annex 1 had become the second most frequently cited annex of the GMP Guide in MHRA inspections, based on the agency's own published deficiency data.

That is not a coincidence.

Annex 1's overhaul, the first major rewrite since 2008, made the CCS a mandatory, living, cross-functional document rather than an optional summary. Inspectors were told to stop accepting descriptions of controls and start demanding evidence that those controls work, every shift, every batch.

The 2022 Annex 1 overhaul didn't just add a new document — it changed how EM and CCS work together facility-wide. Here's the full breakdown of what changed.
→ Read: Annex 1 Changes: EM & CCS in Cleanrooms

What Inspectors Actually Asked For

Drawing on published inspection commentary, MHRA inspectorate communications, and 2025 to 2026 FDA Form 483 analyses, five questions have recurred:

1. "Show me the traceability between this Annex 1 clause and your CCS."

Reviewers at the 2026 ISPE Aseptic Conference noted that many sites can describe their controls verbally but cannot demonstrate where a specific risk is controlled, how its effectiveness is verified, or what signal would trigger action. Inspectors now expect a document structured so each Annex 1 clause maps to a corresponding CCS section or reference, not a narrative that has to be interpreted.

2. "Who owns this, and how does oversight actually happen?"

MHRA inspectors evaluate the CCS from a systemic, cross-departmental view. They routinely ask who "owns" the strategy and how oversight is maintained at the management level, because a document with no accountable owner tends to drift out of sync with real operations.

3. "Walk me through a recent deviation and show me the root cause, not just the correction."

FDA reviewers weighing 2025 warning letters and 483s repeatedly flagged shallow root cause analysis as a marker of weak CCS governance. Superficial CAPA closure, without a demonstrated link back to the contamination control strategy, was treated as a red flag rather than a resolved issue.

4. "How do you know your sanitisation and disinfection program actually works against what you're seeing on the floor?"

In November 2025, the MHRA inspectorate issued a direct alert to aseptic manufacturers after a rise in reported Bacillus contamination events, some traced to inadequate sanitisation of raw materials and consumables. The advisory pointed sites back to the agency's May 2025 letter to Specials licence holders, which set out explicit expectations for sporicidal cleaning protocols and environmental monitoring rigor.

5. "Is your monitoring data trended, reviewed, and acted on, or just filed?"

Across FDA's 2025 warning letter cycle, agency reviewers made clear that visual inspection and environmental monitoring cannot function as an isolated "catch step." They must be validated, risk-based, and tied into the wider quality system, with defined limits and documented review cycles rather than informal judgment calls.

These 5 questions are just the surface. See the full breakdown of exactly how FDA and MHRA inspectors evaluate a CCS, lens by lens.
→ Read: FDA & MHRA Expectations for CCS in Pharma

The Data Behind the Pattern

Historical deficiency reviews give useful context for why this shift happened. Between 1995 and 2005, the risk of microbiological contamination ranked as the No. 2 critical and No. 1 major GMP deficiency in inspections requested by EMEA's CHMP/CVMP committees. That pattern has not gone away, it has simply moved into the CCS framework.

Where a figure could be tied to a named agency review and a specific period, it is included above and labeled as such. Where industry commentary cited a percentage without a traceable primary source, it has been left out rather than repeated. The overlap that is well documented, and worth leaders' attention regardless of the exact percentage, is that contamination findings and data integrity findings increasingly describe the same underlying failure: an environmental monitoring result that cannot be trusted, traced, or trended is both a problem at once.

Conclusion

Inspectors are no longer asking sites to describe their contamination controls. They are asking sites to prove those controls hold up under routine pressure, and to name the person accountable when they do not. The contamination control strategy has become the single document inspectors use to judge whether a quality culture is real or performative.

Sites that treat the CCS as a living, cross-functional operating tool, reviewed against real deviation and monitoring data, are consistently the ones converting inspections into confirmations of control rather than lists of findings.

FAQs

What is a contamination control strategy under Annex 1?

It is a facility-wide, science-based document that identifies critical contamination risk points across personnel, equipment, materials, and environment, and defines how each risk is controlled, monitored, and reviewed. Annex 1 treats it as mandatory supporting evidence, not optional guidance.

Why are inspectors focusing so heavily on CCS ownership? 

Because a document without a named accountable owner tends to become static. Inspectors use the ownership question to test whether the CCS is actively managed or simply archived after its last update.

What triggered the MHRA's 2025 alert on Bacillus contamination?

A rise in reported Bacillus contamination events in aseptic facilities, some linked to inadequate sanitisation of raw materials and consumables, prompted the MHRA inspectorate to reissue expectations around sporicidal cleaning and environmental monitoring in November 2025.

How often should a CCS be reviewed? 

Regulators expect review cycles tied to defined triggers, including change control decisions, deviation trends, and periodic management review, rather than a fixed annual date treated as a formality.

Do contamination findings and data integrity findings overlap? 

Increasingly, yes. A meaningful share of the deficiencies the MHRA attributes to data integrity involve environmental monitoring and contamination records that were incomplete, untrended, or not recorded at the time the work was done.