Schedule M (Revised 2023) — what Indian pharma labs must do before their next CDSCO inspection

If your lab manufactures any formulation under the Drugs and Cosmetics Act, the revised Schedule M is not optional. The original Schedule M (1988) was a baseline that most labs grew past on paper. The revised Schedule M (notified December 2023, mandatory for large manufacturers from January 2024 and for MSMEs from January 2026) brings Indian GMP into substantive alignment with WHO TRS 1019 and EU GMP Part I. It introduces 13 new annexes covering Quality Management System, Quality Risk Management, Pharmaceutical Quality System, Product Quality Review, and Computerised Systems — areas the older Schedule M simply did not address.

If you are a QA Head reading this between two firefighting calls: the CDSCO inspector who walks in next year will be looking for evidence of an operational QMS, not a binder of SOPs. This is the operational checklist your lab needs before that inspection — written for the person who has to make it happen, not the policy committee that decided it.

What's actually new (and what it means for you)

The revised Schedule M is structured in two parts. Part I covers the GMP for finished formulations — this is what most labs operate against. Part II covers GMP for APIs and the new biologicals annexes. The big changes that affect QC laboratories specifically:

Your pre-inspection checklist (the operational version)

This is the checklist a QA Head can give to a junior analyst and have it executed. Each item is something an inspector will ask to see — and that you can prepare for in days, not months.

1. Quality Management System documentation

• Quality Manual documenting your PQS structure, with stated quality objectives reviewed annually. Schedule M Part I §3.5.
• Site Master File covering site activities, products, key personnel, and quality systems. §3.7.
• Management review minutes from the last two cycles, showing trended data on OOS, deviations, complaints, and CAPAs.

2. Annual Product Quality Review (APQR) — most cited gap

• One APQR per product per year, signed off by QA Head and Production Head. Per §16.2.
• Covers at minimum: starting material results, in-process controls, finished product results (including OOS), deviations, complaints, recalls, returns, qualification status, stability data, and CAPA effectiveness.
• Conclusions and recommendations for the next review period — not just data dumps.

3. Calibration and qualification

• Master instrument register with calibration frequency, last/next due dates, NABL-traceable certificates. §13.
• Out-of-Calibration (OOC) impact assessment for every failed calibration in the last 24 months — and evidence of the impact on test data, batches, and releases.
• Validation status sheet for every equipment train and computerised system, showing IQ/OQ/PQ completion and next review date.

4. Computerised systems & data integrity (Annex 11 equivalent)

• Inventory of all GMP-relevant computerised systems with validation status.
• Audit trail review evidence — quarterly minimum, by QA. Inspector will look for evidence the audit trail was actually reviewed, not just configured.
• User access review — quarterly minimum. Shared accounts are an automatic observation.
• Data integrity training records for every analyst, refreshed annually. ALCOA+ principles must be evidenced.

5. Supplier qualification

• Approved Vendor List with risk classification (Low / Medium / High / Critical) per supplier.
• Audit records — annual desk audit minimum, on-site audit for high-risk suppliers.
• Annual re-qualification with documented review of supplier performance over the last 12 months.

6. Recall management

• Recall SOP covering Class I, II, III recalls with the named recall coordinator.
• Annual mock recall executed within the last 12 months, with effectiveness ≥ 90%. §28.
• Effectiveness check evidence from the mock — distribution scope, consignee notification log, recovered quantity.

The 14-day path to inspection-ready

If you have 14 days before the inspector arrives, this is the order to execute in. Each day is one focused area. The order matters — earlier items unblock later ones.

1. 1Day 1-2: Quality Manual + Site Master File current versions, signed, latest revision dated in the last 12 months.
2. 2Day 3-5: APQR for top 5 products by volume — if you don't have them, start now. One APQR per day per product. Pull the data, write conclusions, get signed.
3. 3Day 6: Calibration master list audit — every instrument current, every certificate NABL-traceable, every OOC has an impact assessment.
4. 4Day 7: Validation status review — every equipment train, every computerised system, every method has a current validation status sheet.
5. 5Day 8: User access review — quarterly review document signed, shared accounts eliminated, role permissions documented.
6. 6Day 9: Audit trail review evidence — quarterly review minutes signed by QA for the last 4 quarters.
7. 7Day 10: Supplier audit records — AVL with risk classification, last 12 months of audit reports, annual re-qualification status.
8. 8Day 11: Mock recall execution — if you haven't done one in 12 months, do it now. Document effectiveness.
9. 9Day 12: Training records — every analyst, every SOP they're trained on, last refresher date, data-integrity training current.
10. 10Day 13: Management review — if last one was > 6 months ago, hold one. Trended data on OOS, deviations, complaints, CAPAs.
11. 11Day 14: Walkthrough by a senior QA as if they were the inspector. The questions they can't answer are the gaps you'll fix in the next 24 hours.

What changes the trajectory

The labs that pass post-Schedule-M inspections without observations are not the ones with more SOPs. They are the ones with live data — a calibration master register that an inspector can audit on a tablet in real time, an APQR that pulls itself together from the data already in the system, an audit trail that was actually reviewed last quarter. The revised Schedule M is the regulator catching up to what compliant labs already do.

ValiCore was built for exactly this. If your lab is staring down a CDSCO inspection and you'd rather not assemble 14 days of paperwork by hand, book a 30-minute walkthrough — we'll show you what an inspection-ready system looks like with your own data. No pressure, no commitment.

References

• Schedule M, Drugs and Cosmetics Rules 1945 — revised by Ministry of Health & Family Welfare notification G.S.R. 922(E) dated 28 December 2023.
• CDSCO Guidance — Implementation of Revised Schedule M (CDSCO/2024/03).
• WHO TRS 1019 — Good Manufacturing Practices for Pharmaceutical Products, Annex 2.
• ICH Q9 (R1) — Quality Risk Management.
• ICH Q10 — Pharmaceutical Quality System.
• MHRA Data Integrity Guidance (March 2018) — ALCOA+ principles.