KGMP On-Site Audit in South Korea: Preparation, Models and Remediation

1. Key takeaways

Korea resumed KGMP on-site audits in January 2023, and since then foreign manufacturing sites generally must undergo an in-person verification. The on-site audit is executed by review organizations designated by the Ministry of Food and Drug Safety; the designated review organizations currently carrying out the relevant audits number 4: KTL, KTR, KCL, and KTC.

Two preparation points decide the outcome of an on-site audit: the selection of representative models and the pacing of remediation. Choosing representative models well narrows the audit scope to a controllable product family and avoids an explosion of auditor-days from covering every model; pacing remediation well keeps the certificate date from being stretched repeatedly by the remediation cycle.

GRZAN’s view: the center of gravity of on-site audit preparation is not filling in documents, but letting the auditor see a verifiable chain of evidence within limited time. Documents can be supplied afterwards; verification of the state of the site happens only once.

2. Legal basis

The on-site audit regime rests on the following instruments.

3. Expert insights

Representative model selection is a scope control tool, not a sampling game. An on-site audit cannot cover every model; in practice representative models carry the audit scope and sibling models are covered through commonality explanations. GRZAN applies three selection rules, which constitute a practical estimate: prefer the model with the most complete process chain, so the audit covers as many process steps as possible; prefer the model with the highest risk class, so audit depth matches product risk; and prefer the model already notified in Korea or planned for notification, so the audit conclusions are directly usable for the registration project. Breaching any of the three can produce the result that the audit passed but the model to be notified is not covered.

An on-site audit verifies execution traces, not policy texts. A gap exists between documents being complete and execution happening on the floor, and that gap is the main source of on-site nonconformities. Auditors look at whether records are created in real time, whether deviations are closed, and whether changes leave an approval trail. GRZAN’s experience accompanying audits: records that can be pulled up on the spot persuade more than beautifully bound manuals. In preparation, self-check against the standard of whether a randomly picked batch record can be traced to a raw material batch (practical estimate).

Remediation should be sequenced by the nature of each nonconformity. Remediation times vary widely: documentary defects can close within days, while facility and process defects need weeks or more of rectification and verification. GRZAN sequences in three tiers (practical estimate): record defects are remedied and evidenced immediately after the audit; process defects complete policy revision and training records within 2 to 4 weeks; facility defects first produce a remediation plan and timetable, then submit verification materials at each node. Pushing every defect to the audit organization in one batch, without tiering, actually prolongs the confirmation time.

Scheduling differences among the 4 designated review organizations are a project management variable. KTL, KTR, KCL, and KTC carry out the relevant audits, and their schedules and review emphases differ. This difference is not a statutory provision; it is a practical estimate. GRZAN treats each organization’s schedule as an independent variable in project planning and does not assume identical processing speed across organizations.

The statutes contain no independent overseas site registration provision; on-site investigations have their own legal basis. Foreign manufacturers are often told to complete a so-called overseas manufacturing site registration, but Korean statutes contain no such standalone registration rule. Management of overseas sites actually sits on three lines. First, the recognition of conformity of manufacturing and quality management systems under Article 28 of the Medical Device Act, which requires a fresh audit when the site or overseas site location changes. Second, Article 32-2 (newly established on 11 December 2018), on on-site investigation of overseas sites and import suspension, under which the competent authority may investigate an overseas site on the ground and suspend imports where necessary. Third, submission of site information at the import approval stage under Article 15 paragraph 2 together with Article 30 paragraph 1 of the Enforcement Rule. The procedure for on-site investigations is detailed in Article 56-2 of the Enforcement Rule: advance notice must be given 20 days before the investigation, and results must be notified within 30 days after completion. GRZAN’s message to foreign manufacturers: treat these three items as one continuous management chain — first work out which link you actually sit on, then decide where to concentrate preparation; the word registration itself corresponds to no specific filing action (practical estimate: specific deadlines follow the dates stated in the advance notice issued by the competent authority).

4. Practical recommendations

• Fix representative models early and explain commonality in writing. Apply the three priorities of fullest process coverage, highest risk, and direct relevance to the Korean submission (practical estimate).
• Replace document counting with a traceability self-check. Randomly pull one batch record and verify it can be traced to the raw material batch and test records (practical estimate).
• Sequence remediation in three tiers. Record defects close immediately, process defects complete within 2 to 4 weeks, facility defects submit a plan first and verify at each node (practical estimate).
• Assign Korean-language technical accompaniment on site. Communication efficiency directly affects audit coverage within the auditor-days available (practical estimate).
• Schedule the on-site audit as an independent stage. Since on-site audits resumed in January 2023, travel, interpretation, and remediation time should be estimated separately from document review.

5. Verification checklist

• □ Audit applicability — judged by class; standard: Classes 2-4 must pass the KGMP conformity audit, Class 1 is exempt.
• □ Audit organization — check the list of designated review organizations; standard: executed by the 4 designated review organizations (KTL, KTR, KCL, KTC).
• □ Representative model selection — checked against process completeness, risk class, and notification relevance; standard: all three rules satisfied and commonality explanations complete (practical estimate).
• □ Traceability — sample batch records traced to raw materials and test records; standard: the sample closes completely with no broken links (practical estimate).
• □ Remediation tiering — remediation plans checked against record, process, and facility tiers; standard: every tier has an owner and a completion node (practical estimate).
• □ Language and accompaniment — site communication arrangements checked; standard: Korean-language technical accompaniment and Korean versions of key documents in place.
• □ Audit format — checked against the implemented form; standard: prepared on the basis that on-site audits resumed in January 2023.
• □ Overseas site legal basis — checked against Article 28, Article 32-2, and Enforcement Rule Article 56-2; standard: the re-audit obligation on location change and the advance notice and result notification deadlines are all scheduled into the preparation plan.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, Korean licence holder and local testing support for the Republic of Korea. Our team manages MFDS approvals, certifications and notifications, prepares equivalence dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com