Revised Schedule M self-inspection checklist (2026)

In November 2025, CDSCO (India's national drug regulator) told state drug regulators to start inspecting units against Revised Schedule M. A few weeks later, the health ministry signalled it would not extend the deadline for MSMEs (micro, small and medium enterprises) past 31 December 2025.

The proof of a gap is usually split across three spreadsheets. Nobody reads them side by side until an inspector does.

Use this checklist to do that reading yourself, first.

---

What does Revised Schedule M require for self-inspection?

Revised Schedule M was notified, meaning officially published, as G.S.R. 922(E) on 28 December 2023. It rewrites Indian GMP to follow the WHO structure. GMP stands for Good Manufacturing Practice, the rules for making medicines safely.

The new rule adds a formal pharmaceutical quality system. That is one joined-up way of managing quality across the site. It also adds quality risk management, which means judging what could go wrong and how much it matters. And it asks for much stricter paperwork.

Larger manufacturers had six months to comply. MSMEs with turnover up to ₹250 crore got twelve. Those that applied with an upgrade plan were given until 31 December 2025. That date has passed.

Self-inspection has its own section in the notification. It is Part I, section 10, "Self-inspection, quality audits and suppliers' audits and approval". In other words, it covers checking yourself, quality audits, and checking suppliers before you approve them.

You need a written, regular plan of self-inspections. It must cover all production work and all QC (quality control) work. You run it at least once a year, and your written procedure must say how often.

Management chooses the team. The members must be experts who know GMP. They can come from inside or outside the company.

You can also run special inspections. Examples are after a product recall, after repeated rejections, or when a regulatory inspection is announced. Every corrective action the team recommends has to be carried out. Management reviews the report and the follow-up.

The same section also covers two other kinds of audit. People often mix them up with self-inspection:

	Self-inspection	Quality audit	Supplier approval
Done by	A team of GMP experts chosen by management	Usually outside or independent specialists, or a team chosen by management	The person in charge of QC, working with other departments
Looks at	How well production and QC follow GMP	All or part of the quality system, to improve it	Whether you can rely on a supplier to meet specifications (the agreed standards) and GMP
When	At least once a year, plus special inspections if you choose	Optional, on top of self-inspections	Before you approve a supplier of starting (raw) or packaging materials, with an audit where one is needed

This checklist is about the first one.

---

What should a Schedule M self-inspection checklist cover?

Your written instructions should cover at least the areas below. Look hardest at the last column. A checklist that asks "is this OK?" gets a yes from everyone. One that asks "which record proves it?" gets you evidence.

#	Area	What to check	Record that proves it
1	Personnel	Training is up to date for the work people really do	Training matrix (who is trained on what), training records
2	Premises	Condition, separate areas kept apart, staff facilities	Facility logs, area qualification (proof a room is fit for use)
3	Maintenance of buildings and equipment	Planned maintenance done on time	Maintenance schedule and logs
4	Storage of materials and finished products	Quarantine (stock held until approved), status labels, temperature	Warehouse records, temperature logs
5	Equipment	Qualified (proven to work), clean, fit for use	Equipment logbooks, qualification reports
6	Production controls	Checks during manufacture done and written down	Batch manufacturing records
7	Quality control	Methods followed, results reviewed	Lab worksheets, instrument audit trails (the log of who changed what)
8	Documentation	Current versions, records you can trace, with an audit trail	Document control register
9	Sanitation	Cleaning and hygiene done as written	Cleaning records
10	Validation	Processes and methods validated (proven to work), and proven again after a change	Validation master plan, reports
11	Calibration	Every instrument in date	Calibration log
12	Recalls	Procedure tested, records complete	Recall SOP (your written procedure), mock recall record (a practice recall)
13	Complaints	Logged, investigated, watched for patterns	Complaint register
14	Label control	Labels issued, counted back in, and destroyed	Label reconciliation records
15	Previous self-inspections	Last findings really closed	Previous reports, CAPA register (your list of fixes)

We'd look at row 15 first. Say a finding from last year's self-inspection is still open. That tells you more about your quality system than any new finding does.

---

Where do the gaps actually hide?

Three gaps come up again and again. You won't spot any of them by looking at one record at a time.

The first is overdue calibration. Calibration means checking an instrument against a known standard. Every instrument has a due date in the calibration log. The gap is the instrument that went past its date and stayed in use.

The second is a CAPA backlog. A CAPA (corrective and preventive action) is the fix for a problem, plus the steps to stop it happening again. Each CAPA has a target date. What matters is how many open CAPAs are past it, and how old the oldest one is.

The third is recurring deviations. A deviation is something that didn't go to plan. Each deviation was looked into and closed on its own. Sometimes the same type keeps coming back in the same area. Then the root cause, the real reason behind it, was probably never found.

We tested our self-inspection co-worker on a sample data set. It was laid out like the Excel logs many sites keep. Reading the logs together turned up four overdue instruments. It found six CAPAs past target, the oldest by 132 days. It also found five granulation deviations in 81 days. Granulation is a step in making tablets. None of those records looked wrong on its own.

Those numbers come from demo data, not a customer site. What you can take from it is the method: count every row, and don't sample.

---

How do you score audit readiness without fooling yourself?

A readiness score is only useful if it comes from facts you have counted. "Mostly fine" is not a finding. Think of it like marking a mock exam against the answer key. You don't mark it by how the paper felt to write.

Give each finding a severity, meaning how serious it is. Then add the findings up into one overall band. If you don't already have a scoring scale, a simple one like this works:

Band	What it means
Ready	No critical or major findings open
Conditional	Major findings open, with their CAPAs on track
Not ready	Critical findings open, or major findings with no believable plan

Whatever the band, the report should give the findings, what you make of them and what you conclude. It should also give the corrective actions. Put an owner and a date against each action. Each finding should also name the record that shows it and the clause it breaks. Then a reviewer can check it quickly.

---

Can an AI co-worker run the self-inspection?

It can run the records part, which is where most of the hours go.

Our AI co-workers for pharma quality include a self-inspection co-worker. It reads the calibration log, CAPA register and deviation log you attach, row by row. Fixed rules in code decide whether something is overdue or keeps coming back. The AI model's own judgement does not decide that. It then scores readiness and drafts the report, with a clause against each finding.

After that, it waits. Your QA head (the head of quality assurance) reviews the findings and the score. The co-worker only acts once they confirm. Then it opens a CAPA ticket on the deviation board for each major or critical finding. The area owners pick these up.

It never certifies the site. That signature stays with a person. This is the same idea behind any sensible guardrail in an AI agent.

---

What a records review cannot see

A self-inspection built on records will miss anything that never made it into a record. Think of a door propped open, or a shortcut on the night shift. Or think of an analyst who signed the training sheet for the new SOP without really being trained on it.

So treat the records review as the first half of the job. Use what it finds to decide where to walk, who to talk to and what to look at on the floor. Nothing replaces the person who actually walks the site.

---

The bottom line

Revised Schedule M is no longer a future deadline. The cheapest inspection you will ever have is the one you run on yourself. Use the records you already keep, and do it before anyone else reads them.

If you only have an afternoon, start with the three checks above. Look at calibration dates, how long CAPAs have stayed open, and repeat deviations. You can run all three on logs you already have.

If you also investigate out-of-specification (OOS) test results, read our guide to OOS investigation, Phase I vs Phase II next.

---

Want to see your own gaps before an inspector does? We can run a self-inspection co-worker on your existing logs, with your QA team signing every finding.

Get started: hello@avestalabs.ai