What are GMP Audits and what Qualifications do GMP Auditors need to have?

GMP requirements in both the EU and the USA oblige companies to implement a quality assurance system that includes regular audits. In addition to self-inspections (regulated in Chapter 9 of the EU GMP Guidelines), external audits are particularly important: manufacturers must ensure that their suppliers and contractors also comply with GMP standards.

EU legislation requires medicinal product manufacturers to audit their active substance suppliers (Directive 2001/83/EC, Article 46f, and EU GMP Guidelines, Chapter 5.29). These audits must be of appropriate duration and scope to enable a complete and clear assessment of GMP compliance. The Qualified Person (QP) confirms compliance with this requirement during the marketing authorisation procedure by means of a "written confirmation" (Directive 2001/83/EC, Article 8).

For excipients, at least a formalised risk assessment according to the "Guidelines of 19 March 2015 on the formalised risk assessment for ascertaining the appropriate good manufacturing practice for excipients of medicinal products for human use" is required. This assessment may also result in the need for an audit (EU GMP Guidelines, Chapter 5.29).

Written policies, procedures, protocols, reports and the associated records must be available for internal audits as well as for supplier audits (EU GMP Guidelines, Chapter 4.29).

Audits are not only mandatory for active substance manufacturers or critical suppliers, but also for testing activities (EU GMP Guidelines, Chapter 5.36), primary packaging materials (EU GMP Guidelines, Chapter 5.45) and other outsourced activities (EU GMP Guidelines, Chapter 7). Contracts should therefore include an audit right for the contract giver.

Before certifying batches, the QP should be aware of the results of those audits that may have a critical impact on product quality. Repeat audits should be carried out in accordance with the principles of quality risk management (Annex 16 to the EU Guide to Good Manufacturing Practice).

The audit report should address the areas audited, including the quality management system and all relevant manufacturing and quality control procedures for the specific product. It should be assessed whether the audited processes and systems comply with EU GMP, or, for manufacturing in third countries, at least equivalent GMP requirements (Annex 16 of the EU Guide).

The US CFR (21 CFR 210/211) does not contain explicit requirements for supplier qualification or auditing. Guidance can be found in the 'FDA Guidance for Industry - Quality Systems Approach to Pharmaceutical CGMP Regulations', which recommends risk-based, regular audits of suppliers, including verification of their QA system and the reliability of COAs: "The quality systems approach also calls for periodic auditing of suppliers based on risk assessment. During the audit, a manufacturer can observe the testing or examinations conducted by the supplier to help determine the reliability of the supplier's COA. An audit should also include a systematic examination of the supplier's quality system to ensure that reliability is maintained."

Types of external GMP Audits (who audits whom?):

External GMP audits are assessments carried out by a body independent of the audited company (in contrast to self-inspection). In the pharmaceutical industry, the following forms are common:

• Customer audits (second-party audits): Companies audit their suppliers or service providers to ensure their GMP compliance. This is part of supplier qualification.
• Audits by certification bodies or independent third parties (third-party audits): External, qualified auditors perform audits on behalf of a marketing authorisation holder (MAH) or manufacturer, for example for global supply chains when or internal resources are limited.
• Regulatory inspections: These are official GMP inspections carried out by authorities such as the FDA or competent national authorities (e.g. in accordance with Article 111 of Directive 2001/83/EC). They serve to confirm compliance with GMP regulations.

Procedure for an external GMP audit in practice

An external GMP audit typically follows these steps:

1. Audit planning:
Determination of scope, objectives and audit plan. Coordination of dates and advance communication with the audited company for planned audits.

2. Opening meeting:
Introduction of the audit team, explanation of the purpose, procedure, scope and organisational arrangements.

3. On-site audit activity:

• Inspection of premises and equipment
• Review of the quality system, documents and records
• Interviews with staff
• Collection of objective evidence
• Documentation of findings (positive and negative)

4. Closing meeting:
Presentation of preliminary results, description of identified deviations and clarification of possible misunderstandings.

5. Audit report and follow-up:
Preparation of a clear, structured report including all findings. The audited company must submit corrective actions with timelines; follow-up audits may be required.

Qualifications and Experience of GMP Auditors

Legislation provides only limited specificity regarding auditor qualifications. It essentially requires that audits be performed by appropriately trained and competent personnel. There are no official (state-recognised) auditor certifications. Companies must therefore define their own qualification requirements. Generally, sound knowledge and experience in the implementation of GMP requirements, initial audit experience (e.g. by accompanying experienced auditors), and additional training are expected.

Recommended requirements:

• Educational Background:
  Degree in natural sciences or technology (e.g. pharmacy, chemistry, biology, process engineering or similat).
• Regulatory expertise:
  Comprehensive knowledge of GMP requirements, practical experience in GMP-regulated manufacturing and quality control processes.
• Auditor training:
  Training in audit methodology, planning, questioning techniques, report writing; specialisation depending on risk area (sterile manufacturing, active ingredients, CSV, etc.).
• Practical qualification:
  New auditors accompany experienced auditors as co-auditors.
• Soft skills:
  Communication skills, ability to work in a team, analytical thinking, powers of observation, time and organisational management.
• Continuous professional development:
  Participation in training courses, conferences and networks (e.g. ECA or the European GMP Auditor Association).