Which External GMP Audit Reports may be used?

We are often asked about the acceptance of third GMP audits at API manufacturers. The background for this is that more and more organisations offer such audits. Now, the question is what do you have to pay attention to?

It is essential to clarify who gave the order: has the audit been initiated from another pharmaceutical company? From the auditor himself/ herself or the organisation behind? Or from the API manufacturer?

Audits (and their reports) which have been initiated by the API manufacturers or their traders have to be viewed in a critical light. Also audits performed by the auditor - i.e. the audit organisation requires closer examination and analysis. Especially possible conflicts of interest have to be clarified.

At best, a contract audit is requested by one or several medicinal product manufacturers who buy themselves a product from the API manufacturer. If the API manufacturer is the customer, then the independence of the auditor has to be clearly demonstrated. In such a case, it is absolutely necessary to obtain a confirmation from the auditor in writing.

Acceptance, Accreditation and "Conflict of Interest": what should you keep in mind?

A medicinal product manufacturer can basically perform an audit himself or let it perform by a so-called Third Party. Commonly, the medicinal product manufacturer assigns a consultant who has experience in the performance of audits. Yet, - here again - a few elements should be considered because the external auditor will be acting for the pharmaceutical company as if he were an own employee. The important thing here is to choose an auditor who knows the processes which have to be audited. If for example a biopharmaceutical API i.e. the manufacturer has to be audited, the auditor should have relevant experiences in biopharmaceutical processes. The auditor should also confirm that he/ she hasn't been acting as a consultant in the area to be audited for at least the last 2 years. This should help to avoid eventual conflicts of interest. For this, a documented confirmation is helpful but often forgotten. The qualification of the GMP auditor is an essential aspect. You should require a CV of the auditor (education, work experience, audit history and audit trainings) and qualify him/ her. The execution by an accredited body doesn't play any role. Accreditation is of no significance in pharmaceutical law.

Purchasing audit reports later:

More and more audit reports are available for purchase. In principle there is no objection to the purchase of an audit report. However, the same rules apply as those concerning the initiation of an audit. In any case, the auditors must be independent. This must also be confirmed in writing. You should check whether the audited products are the products which are also relevant for your supplier qualification. The audit of another product is quite unhelpful. The audit report should contain concrete information about the product-specific processes and procedures. This is the only way for the customer to decide on the basis of the available information whether the supplier can be suitably qualified.

Important: an audit report is only a part of the supplier qualification!

Audit reports are the main focus of interest. However, it is often forgotten that audit reports are only a part of the supplier qualification but a central one. Audit reports contain a description of the GMP situation on the audit day(s). The real assessment of the results is done by the customer - for example by a quality unit or the Qualified Person. Beside the audit report, further data should be consulted like the experiences with the supplier and the assessment of the products delivered. How valuable is an audit report with a good GMP rating when repeated deviations from the specifications are observed in the course of withdrawal of samples? The assessment of further information like for example inspection reports of the FDA which are generally accessible through the Freedom of Information Act, or EDQM's database with the list of CEPs of API manufacturers which have been withdrawn because of GMP deficiencies. All these data should flow into a risk analysis to be used to qualify (or not) a supplier.