GDP Inspection for Storage and Distribution in Sri Lanka

1. Key takeaways

Medical devices in circulation in Sri Lanka are subject to Good Distribution Practices (GDP). The Market Control Division of NMRA is responsible for carrying out GDP inspections of storage, handling and distribution facilities, with the purpose of preserving product integrity. The MAH’s obligation is to ensure conformity with GDP throughout the storage and transport of the device. In other words, registration compliance does not end at the certificate: the physical journey of the product — every warehouse it sits in and every truck it travels in — remains within the scope of regulatory oversight, and the MAH carries that responsibility continuously for as long as the product is on the market.

For most companies this is the least-documented part of the compliance programme. Registration work is project-shaped, with a clear beginning and end, while GDP conformity is continuous and spreads across parties that sit outside the company. Experience shows that distribution compliance decays quietly: recording equipment drifts out of calibration, ledgers fall behind, and subcontracted warehouses change without notice. A scheduled annual cycle, described in section four, is the practical answer to that decay.

This page sets out the published basis for GDP inspection in Sri Lanka, reads the practical consequences for manufacturers and MAHs, and closes with a checklist that can be adopted directly into an annual distribution compliance review.

2. Legal basis

The GDP framework and its related functions, as published on the NMRA website, are set out in the table below. Reading the rows together shows how GDP inspection connects to the wider post-market machinery: it shares an authority with recall and sampling, draws on NMQAL for laboratory analysis, and rests on an obligation assigned directly to the MAH.

3. Expert insights

Insight one: the object of GDP inspection is the facility, not the company. The rule is framed as inspection of storage, handling and distribution facilities. A company operating warehouses at multiple sites can have every single site inspected. This changes how compliance effort must be allocated: it is not enough for the head office to hold a clean procedure manual, because the inspector will stand inside a specific building, look at its own temperature and humidity records, its own receiving and dispatch logs, and its own storage conditions. Each site must individually satisfy the same standard, and a weakness at one location cannot be compensated by strength at another.

Insight two: the MAH is the party bearing the GDP compliance obligation. Even where actual warehousing is operated by a distributor or a third party, the MAH must still ensure conformity with GDP during storage and transport. This requires the MAH to hold genuine management and audit capability over the party that controls the warehouse. Outsourcing logistics does not outsource the obligation. In contractual terms this means audit rights, defined standards for temperature and humidity control, agreed record formats, and the ability to verify rather than merely request. A MAH that cannot inspect its own logistics chain has, in substance, delegated a statutory duty to a party that owes it nothing. The audit rights should therefore be written into the distribution or logistics agreement itself, not left to goodwill.

Insight three: GDP inspection, sampling and recall are three functions of the same division. All three are executed by the Market Control Division as one body of work, which means a single inspection can touch all three lines at once. An inspector reviewing storage conditions may reasonably ask about the traceability of the batches on the shelf — a sampling question — and about what would happen to those batches if a recall were ordered. Preparing for a GDP inspection therefore means preparing all three domains: facilities and records, sample-ready stock with batch documentation, and a recall procedure that can be articulated on demand. Companies should also expect questions that cross between the domains, since the same inspector may carry authority over all three and will naturally follow the batch from shelf to record to customer.

4. Practical recommendations

The annual routine GRZAN applies in the distribution phase is a three-point check: check the warehouse (temperature and humidity recording equipment and its historical data), check the ledger (receipt, dispatch and flow records traceable by batch), and check the credentials (the status and validity of registration certificates and import licences). Each check is performed at least once a year, and must be repeated in full whenever the warehouse operator is changed. The reasoning behind each point is direct: recording equipment proves the storage environment was controlled, the ledger proves the goods can be found, and the credentials prove the product may lawfully remain in circulation. All three checks should be documented with dated evidence, since a check that leaves no record cannot be demonstrated to an inspector later. Where several products share the same warehouse, the checks can be run for the portfolio at once, but the evidence must still identify which batches and which certificates were covered on each occasion.

5. Verification checklist

• □ Warehouse temperature and humidity recording equipment is in use and historical data are retained
• □ Receipt, dispatch and flow ledgers are traceable by batch
• □ Registration certificates and import licences are valid and current
• □ The party responsible for GDP compliance (MAH or warehouse controller) is clearly defined
• □ Compliance checks have been repeated after any change of warehouse operator

Regulatory information verified as of 28 October 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across South Asia, including Sri Lanka. Our team prepares dossiers to NMRA expectations, manages submissions and deficiency responses, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com