How to Prepare for a Quality Assurance (GMP/GCP) Interview in 2026

QA interviews in pharma and biotech are unforgiving about fundamentals. Hiring managers at biotech companies, CROs, and CDMOs don't want theoretical knowledge — they want to know you've written a deviation, led a CAPA, survived an FDA inspection, and made a batch disposition decision. If you haven't, they want to know you understand these processes deeply enough to do them on day one.

Here's what gets asked and how to prepare.

The Regulatory Landscape QA Interviews Test

Before getting into processes, interviewers confirm you have the regulatory framework right. These aren't easy trivia questions — they're context-setters for everything else:

21 CFR Part 210: Current Good Manufacturing Practice — general regulations. Sets the baseline framework.

21 CFR Part 211: cGMP for finished pharmaceuticals. This is the core QA regulation for drug manufacturers. Know the key subparts:

• Subpart B: Buildings and facilities
• Subpart C: Equipment
• Subpart E: Control of components, containers, closures
• Subpart F: Production and process controls
• Subpart I: Laboratory controls (OOS/OOT lives here under 211.192)
• Subpart J: Records and reports
• Subpart K: Returned and salvaged drug products

21 CFR Part 820: Quality System Regulation for medical devices. If you're interviewing at a device company or CDMO that handles devices, expect deep questions here. FDA finalized alignment with ISO 13485 in 2024.

21 CFR Part 11: Electronic records and electronic signatures. Often tested at companies running paperless QMS systems.

21 CFR Part 58: Good Laboratory Practice (GLP) — for non-clinical laboratory studies. Distinct from cGMP.

ICH Q10: Pharmaceutical Quality System — the overarching quality system framework. Covers quality planning, knowledge management, continual improvement, and CAPA.

ICH Q9: Quality Risk Management. Know the framework: risk identification, risk analysis, risk evaluation, risk control, risk review. Know common tools: FMEA, HACCP, FTA, risk ranking and filtering.

The cGMP vs GCP vs GLP Distinction

This question appears in almost every QA interview, especially at CROs and companies with both manufacturing and clinical operations:

• cGMP (Current Good Manufacturing Practice): Governs manufacturing of drug and device products for commercial and clinical use. FDA 21 CFR Parts 210/211 (drugs), 820 (devices).
• GCP (Good Clinical Practice): Governs clinical trial conduct. ICH E6(R3) — covers investigator responsibilities, IRB/ethics committee oversight, informed consent, source data, monitoring.
• GLP (Good Laboratory Practice): Governs non-clinical (preclinical) safety studies. 21 CFR Part 58 — covers study conduct, raw data, archiving of preclinical toxicology data.

Common follow-up: "Can the same site be inspected under both GCP and GMP?" Yes — a clinical manufacturing site that also conducts Phase I studies can receive both. Know who at FDA conducts each: ORA (Office of Regulatory Affairs) handles GMP; BIMO (Bioresearch Monitoring Program) handles GCP/GLP.

Deviation Management

Deviation questions are the most-tested area in QA operational interviews:

Classification:

• Critical: Potential direct impact to patient safety or product efficacy. Requires immediate escalation and potential batch rejection. Example: sterilization cycle failure, wrong active ingredient.
• Major: Could indirectly impact product quality. Example: documented departure from batch record, OOS result with investigation initiated.
• Minor: No impact to product quality or safety, but represents a departure from procedure. Example: documentation error corrected same day.

Common question: "A manufacturing operator discovers at the end of a batch that one of the in-process checks was performed 30 minutes late. What do you do?"

Expected answer: Open a deviation, classify it (likely minor or major depending on the check), investigate — was the check performed correctly when it was performed? Was the product within acceptable ranges? Review impact on product quality. If impact is ruled out with scientific rationale, the batch may be dispositioned for release. If impact cannot be excluded, escalate to Quality leadership for potential rejection or additional testing.

What interviewers are looking for: That you know you can't just close a deviation — you need to assess impact, document the investigation, and justify the disposition.

Root Cause Analysis Tools

QA interviews test RCA methodology — especially for CAPA and repeat deviation scenarios:

5-Why Analysis: Ask "why" five times iteratively until you reach the root cause. Effective for process and human error causes. Limitation: can lead to blame-focused or single-root-cause thinking for complex problems.

Fishbone / Ishikawa Diagram: Cause-and-effect diagram organized by categories — typically Man, Machine, Method, Material, Measurement, Environment (6M). Forces systematic brainstorming across all potential causes. Better for complex problems with multiple contributing factors.

Failure Mode and Effects Analysis (FMEA): Proactive risk tool. Identify failure modes, assess severity × occurrence × detectability to get Risk Priority Number (RPN). Prioritize CAPAs based on highest RPN.

Fault Tree Analysis (FTA): Top-down deductive analysis. Start with the undesired event and work backwards through causal chains. Used for complex system failures.

Common question: "Walk me through how you would conduct an RCA for a sterility failure in a fill-finish operation." Expect to use Fishbone to brainstorm across Man/Machine/Method/Material/Environment, then 5-Why on the most probable causes, supported by data (environmental monitoring trends, equipment logs, operator training records, batch records).

CAPA Lifecycle

CAPA (Corrective Action / Preventive Action) is asked about at every level:

CAPA lifecycle steps:

1. CAPA initiation: Triggered by deviation, OOS, complaint, audit finding, or trend analysis
2. Problem statement: Clear, specific description of the observed nonconformance
3. Impact assessment: Who or what is affected? Other products, sites, batches?
4. Root cause investigation: Using RCA tools above
5. Corrective action: Fixes the specific problem identified
6. Preventive action: Changes the system to prevent recurrence across similar processes
7. Effectiveness check: Did the CAPA actually work? Measured at a defined time post-implementation
8. CAPA closure: Documented evidence that actions taken are effective

Common interview questions:

• "What's the difference between a correction, a corrective action, and a preventive action?" Correction = fix the immediate defect (quarantine the batch). Corrective action = fix the root cause for this specific occurrence. Preventive action = change the system to prevent it happening again anywhere.
• "How do you know a CAPA is effective?" Define an effectiveness metric at CAPA initiation — measurable, time-bound. Example: "Zero recurrence of this deviation type over the next 6 months" or "Operator error rate on this procedure drops below 1% within 90 days."
• "What happens if a CAPA is not effective?" Re-open, re-investigate, escalate — and consider whether the root cause analysis was insufficient.

OOS/OOT Investigation

Out-of-Specification (OOS) and Out-of-Trend (OOT) investigations are core QA knowledge under 21 CFR 211.192:

OOS investigation phases (per FDA 2006 OOS guidance):

1. Phase I — Laboratory investigation: Was there an assignable laboratory error? Check equipment, analyst, method, calculation. If an assignable cause is found and confirmed, invalidate the result and retest (with documentation).
2. Phase II — Full-scale investigation: If no lab error found, expand to manufacturing investigation. Review batch record, equipment, raw materials, process parameters. If no assignable cause found → potential manufacturing failure → batch cannot be released.

OOT: Not a regulatory requirement but a best practice for trending. OOT alerts before OOS occurs. Establish trend limits (e.g., 3-sigma from historical mean) to catch drift before specifications are breached.

Common question: "An analyst gets a failing assay result for a finished product batch. The batch is scheduled to ship tomorrow. What do you do?" Hold the shipment immediately. Initiate OOS investigation Phase I. Do not release under any circumstances until investigation is complete and disposition is made by QA.

Batch Record Review and Batch Disposition

Batch record review: QA must verify that all manufacturing steps were executed per the Master Batch Record (MBR), all in-process checks were performed and passed, all deviations were opened and closed (or still under investigation), environmental monitoring results were acceptable, and all raw material COAs were reviewed and released.

Disposition decision:

• Approved for release: All criteria met, investigations closed, no open deviations with unresolved impact
• Rejected: OOS result with no assignable lab cause, critical deviation with unresolved impact, failed process validation criteria
• Under investigation/hold: Open OOS or open deviation — cannot disposition until resolved

QA is the final authority on batch disposition. This is non-negotiable in the interview — if you imply that production or management can override QA on batch release, you've failed.

Change Control

Change control questions test whether you understand the risk stratification process:

• Minor change: No impact to product quality, safety, or regulatory filings — document and implement
• Moderate change: Potential impact — assess, possibly require validation or comparability testing before implementation
• Major change: Requires regulatory notification or prior approval — CBE-30 (Changes Being Effected in 30 days) or PAS (Prior Approval Supplement) for NDA/BLA holders

Common scenario: "The manufacturing team wants to change the granulation speed for a solid oral dosage form to improve throughput. How do you evaluate this?" Assess impact on CQAs (dissolution, content uniformity) using risk assessment. Review prior validation data. If impact cannot be excluded by science alone, require process qualification runs. Determine regulatory reporting category.

Validation (IQ/OQ/PQ)

IQ/OQ/PQ questions come up for both manufacturing and QC/laboratory contexts:

• IQ (Installation Qualification): Confirms equipment/system is installed correctly per design specifications. "Did we get what we ordered and is it installed right?"
• OQ (Operational Qualification): Confirms equipment operates within specified parameters across its operating range. Typically includes worst-case testing of upper and lower limits.
• PQ (Performance Qualification): Confirms the process, using the equipment, consistently produces product meeting specifications under representative production conditions.

Also know:

• Process Validation (PV): Stage 1 (process design), Stage 2 (process qualification), Stage 3 (continued process verification) — per FDA 2011 Process Validation guidance
• Cleaning Validation: Demonstrates that cleaning procedures remove residues to below acceptable limits. Know MACO (Maximum Allowable Carry-Over) calculation: MACO = (NOEL × MBS × SF) / (LDD × SS) or similar approaches.
• Computer System Validation (CSV): 21 CFR Part 11 compliance for electronic systems used in GMP environments.

Audit Preparation and Response

Audit questions are heavily weighted for QA manager candidates:

Internal audit:

• Risk-based audit schedule: high-frequency for critical systems, less frequent for low-risk areas
• Use checklist against 21 CFR / ICH Q10 / company SOPs
• Finding classification: Critical → immediate corrective action required; Major → CAPA required; Minor → observation
• Audit report within defined timeframe (typically 30 days), CAPA responses due within 30–60 days

FDA inspection readiness:

• "What do you do when FDA arrives for an unannounced inspection?" Greet the investigator professionally, verify credentials, notify senior QA and management, escort to the conference room, begin the 483 log, retrieve the most recent inspection history.
• "How do you prepare for a pre-approval inspection (PAI)?" Review all batch records for the NDA/BLA-referenced batches, ensure all validation studies are complete, review any deviations or CAPAs for impact on the submission, conduct a mock inspection.
• Know the 483 vs Warning Letter vs Consent Decree distinction: 483 = list of inspectional observations (not a violation notice); Warning Letter = official notice of violation; Consent Decree = court-enforceable agreement following regulatory action.

Real QA Interview Questions by Setting

Biotech (pre-commercial, small team):

• "We're building our QMS from scratch ahead of our first GMP manufacturing campaign. Where do you start?"
• "Our Phase 3 clinical supply is manufactured at a contract manufacturer. How do you ensure they meet our quality standards?"
• "We've never had an FDA inspection. How do you prepare an organization that has no inspection history?"

CRO / CDMO (Catalent, Lonza, Charles River):

• "How do you manage quality oversight across multiple client programs with competing priorities?"
• "A client's batch fails OOS. How do you communicate this to the client while managing the internal investigation?"
• "You identify a systemic issue affecting multiple clients' programs. What's your escalation path?"

Medical device (Class II/III manufacturer):

• "Walk me through how you'd handle a complaint investigation for an implantable device with a reported malfunction."
• "What's the MDR (Medical Device Reporting) timeline for a malfunction that could cause serious injury if it recurred?"
  (30-day MDR report for malfunctions; 5-day report if the event required immediate remedial action)
• "How does ISO 13485 differ from 21 CFR Part 820?"

Preparation Checklist

Two weeks out:

• Re-read 21 CFR Part 211 Subparts F, I, J — these are the most tested
• Review FDA's OOS investigation guidance (2006) and process validation guidance (2011) — both are free on FDA.gov
• Prepare 2–3 STAR examples from your own experience for: CAPA ownership, deviation investigation, batch disposition, audit management

One week out:

• Know the company's manufacturing focus: solid oral dosage, sterile injectable, biologics, device — the questions will be specific to that
• Review any recent FDA warning letters to the company or competitors in their space (available on FDA.gov)
• Practice walking through a complete CAPA from initiation to effectiveness check out loud

Day before:

• Review ICH Q9 risk management tools — FMEA and risk ranking are commonly asked
• Prepare your answer to: "Tell me about a time you made a difficult quality decision." It needs a real story with a real outcome.

QA is where science, regulation, and operational judgment intersect. The candidates who get offers can show they've made hard calls — not just followed procedures.

Practice QA scenario interviews with AI-powered mock sessions at CareerLift.ai.