The Annex 1 Contamination Control Strategy Is a Strategy, Not a Binder of Risk Assessments

The revised EU GMP Annex 1 has been in force since 25 August 2023, and most sterile manufacturers now have the individual pieces: a PUPSIT exemption assessment, an environmental monitoring program, a gowning qualification file. What a surprising number do not have is the document Annex 1 actually requires — a single, governed Contamination Control Strategy that ties those pieces into one strategy with an owner and a review trigger. A binder of separate risk assessments filed under the name "CCS" is not the same thing, and inspectors increasingly know the difference.

What the CCS actually is

Annex 1 defines the Contamination Control Strategy as a planned set of controls for microorganisms, endotoxin/pyrogen, and particles, derived from current product and process understanding, that assures process performance and product quality. That definition does a lot of work: it describes one integrated strategy, built on ICH Q9(R1) quality risk management principles, not a compliance folder assembled after the fact from whichever risk assessments a site already had. A CCS with no named owner, no revision history, and no defined trigger for reassessment is a document in name only — it may contain accurate content and still fail the governance test Annex 1 is actually checking.

The elements a CCS has to touch

Annex 1 lists the elements a CCS has to address, and the list is explicitly non-exhaustive — "but are not limited to." In practice, that means a compliant strategy has to reach well beyond aseptic processing itself:

• Facility and process design. Layout, material and personnel flow, and process sequence — decisions made long before a single risk assessment gets written.
• Premises and equipment. Cleanroom classification, equipment qualification, and cleaning and disinfection efficacy.
• Personnel. Training, gowning qualification, hygiene, and behavior in classified areas — a recurring source of environmental monitoring excursions.
• Utilities. Water systems, HVAC and air handling, and gases that contact product or product-contact surfaces.
• Raw materials, components, and product containers and closures. Incoming quality controls on everything that reaches the aseptic core.
• Monitoring systems and prevention. Environmental and utility monitoring design, trending, and the CAPA loop that closes back into the strategy.

A binder of separate risk assessments is not a strategy. Annex 1 expects one document that shows how those assessments fit together — and who is accountable when one of them changes. Why governance is the actual gap

Where companies get exposed

Two patterns account for most of the exposure we see. First, sites treat the CCS as a compliance artifact assembled from documents that already existed — a PUPSIT risk assessment here, an environmental monitoring SOP there — rather than as the master document those assessments feed. Annex 1 does not prohibit that structure, but it does require the CCS to synthesize the pieces into one coherent strategy with visible cross-references, not simply reference them by title. Second, change control often stops at the local procedure: a filter change, a utility requalification, or a gowning revision gets its own risk assessment updated, but the CCS itself is never touched. Annex 1's requirement for ongoing and periodic review is explicit that changes to any system the CCS covers must be assessed for their effect on the strategy — not just on the procedure that changed.

None of this requires rebuilding a site's contamination-control program from scratch. It requires treating the CCS as the governed document Annex 1 describes — owned, cross-referenced, and reassessed on a defined trigger — rather than as a title page in front of a folder of risk assessments a site already had. Manufacturers running sterility assurance under Annex 1 who have not tested their CCS against that governance bar since the revision took effect are the ones most exposed the next time an inspector asks who owns it.