1. Purpose
To provide guidance on assigning Lead Audit Team/Site responsibilities, establishing an external supplier’s audit program, and the high level principles involved in conducting supplier audits.
2. Scope and Applicability
This Guideline is applicable to all manufacturing Operations and Research and Development sites performing audits of suppliers used by the buyer company. This includes routine audits, “for-cause” audits and initial supplier selection audits. Note: this document does not cover computerized systems supplier audits. Note: this document does not cover the certification process for materials/services supplied to the
3. Definitions
3.1 Audit
A systematic and independent examination to verify that the quality influencing activities comply with relevant regulations as well as company policies, standards, procedures and guidelines.
3.2 Lead Audit Team (LAT)
The team that is accountable for conducting audits of vendor’s facilities on behalf of Operations
3.3 Active Pharmaceutical Ingredient (API)
Any substance or mixture of substances intended to be used in the manufacture of a drug (medicinal)product that when used in the production of a drug becomes an active ingredient of the drug product. Such substances are intended to furnish pharmacological activity or other direct effect in the diagnosis, cure, mitigation, treatment or prevention of disease or to affect the structure and function of the body.
3.4 Certification
Is the act of approving (accepting) quality control results provided by the supplier in relation to a specific material, thereby eliminating the need to undertake some or all laboratory tests on receipt of that material unless specifically required to meet regional/local MP and/or import regulations?
3.5 Decertification
Is the act of reverting back to full or partial analysis on receipt of the material from the supplier?
3.6 Material
A material is an Active Pharmaceutical Ingredient (API), intermediate, raw material, packaging component, excipient, formulated product, or packaged product.
3.7 Certified materials
A certified material is a material supplied to receiving operation that is released by the receiving site, or released by a contractor directly into receiving site’s distribution chain, without repeat testing by the receiving site or an independent laboratory approved by the receiving site, unless such testing is necessary to meet cGMP requirements, e.g. identity testing and/or local import regulations.
3.8 De-certified material
A de-certified material is a material that has had its ‘certified’ status revoked.
3.9 Supplier
An umbrella term that covers both Vendors and Contractors supplying API, intermediates, raw materials, packaging components, excipients, formulated products, packaged products, and/or providing laboratory testing to/forth receiving company.
3.10 Contractor
Provides a product/service to the buyer (i.e. laboratory testing, producing an intermediate product, and producing a finished product), that it cannot provide tother companies (e.g. making/packing products on which buyer owns the intellectual property). Note: Buyer will retain ownership of any method or process used to manufacture the material made at a contractor.
3.11 Vendor
Provider of API, raw material, excipients, intermediates and packaging component to the buyer. A vendor supplies articles of commerce (i.e. available for purchase by other companies).
3.12 Service
Activity contracted out, covered by an Agreement and carried out by an external company or individual. A GMP critical service is defined as where failure to specify and control quality requirements could adversely affect product quality/patient safety.
3.13 Consumable
A consumable is a material or item of disposable equipment used in the manufacture of an API or finished product that is not a process chemical(solvent), API raw material/intermediate, excipient or packaging material. Examples are filters, and disposable tubing used in the manufacturing process. A GMP critical consumable is defined as where failure to specify and control quality requirements could adversely affect product quality/patient safety.
3.14 Non-Contributory Raw Material (NCRM)
Is a raw material used in the production of an API that does not contribute to the final molecular structure of an API (e.g. catalyst, water/solvents that are dried offing process, cleaning fluids).
3.15 Lead Team only applicable to Contracted Materials
The Lead Team/Site is the team/site accountable for conducting specified material related activities. Usually the QA Management of the buyer site acts as a Lead Team for the buyer (Lead site). Lead site/Team would be responsible for GMP related interactions and issues, conducting audits, and development of the Quality Assurance Agreement.
3.16 API Starting Material [Contributory Raw Material (CRM)]
A raw material or intermediate, that is used in the production of an API and that is incorporated as a significant structural fragment into the structure of the Apian API Starting Material can be an article of commerce, a material purchased from one or more suppliers under contract or commercial agreement, or produced in-house. API Starting Materials are normally of defined chemical properties and structure.
3.17 Packaging Component – Critical (PCC)
Is any printed packaging component, primary (product contact) component or device? Furthermore, any secondary packaging component critical to the microbiological integrity, stability and/or administration of the product (e.g. aluminium pillow packs around semi-permeable).
3.18 Packaging Component – Non-Critical (PCNC)
Is any non-printed or secondary (non-product contact) packaging component or device that does not fall within the definition of a PCC.
3.19 Sterile Active Pharmaceutical Ingredient (SAPI)
Is an API isolated and stored in a way that ensures its sterility for subsequent use in the preparation of a sterile formulated product that is not subjected too further aseptic or terminal sterilization?
3.20 API Intermediate (INT)
A material produced during steps of the processing of an API that undergoes further molecular change or purification before it becomes an API. Intermediates may or may not be isolated.
3.21 Microbiological (BIO)
Is a material from an animal or plant source that is used to grow and/or culture microorganisms and to monitor the production and quality assurance of sterile products (i.e. culture media)?
3.22 Non-Sterile Excipient (EX) – Sterile Excipient (Sterile EX)
Is a material used to formulate API’s into pharmaceutical dosage forms suitable for administration to a patient? If sterile it is stored in a way that ensures its sterility for subsequent use in the preparation of a sterile formulated product that is not subjected too further aseptic or terminal sterilization.
3.23 Supplier Quality Review (SQR) = Postal Review
Is a documented review of a supplier’s quality performance that may be filed in lieu of an audit for both certified and non-certified materials or for a recently (<12 months) inspected (e.g. FDA) supplier manufacturing site for the considered material. The supplier quality review should include a recently completed questionnaire as well as a report on the supplier’s quality history (prior audit issues, rejections, deviations, etc.) since the last audit.
3.24 Receiving Site
A site receiving materials or services directly from a supplier.
3.25 Supplier Quality and Compliance Approval Status
Supplier status is assigned by the Lead team/site based on its assessment of the effectiveness of the supplier’s quality and compliance systems, that are in place to assure that the activities undertaken by the supplier (i.e. the activities specified in the Quality Assurance Agreement) are under control.
A supplier may be:
Acceptable (approved) – none or minor issues only.
Or
Acceptable (provisional approval) – major issues and concerns with the supplier that are being addressed. The observations are considered to be not directly affecting the quality of the product/service being provided.
Or
Disapproved/recommendation to find alternative supply or suspend supply until significant improvements are made.
3.26 “For cause” audit
An extraordinary audit focused to find the cause of a problem that is probably related to gaps/deficiencies in the quality system. It may be performed for critical issues or bad performance. It could affect the routine scheduled audit frequency.
3.27 Quality & Technical review meeting
A meeting/visit held at the supplier’s facility with a specific objective for assuring supply other than that covered by the routine scheduled audits, for example: technology transfer readiness for full scale manufacture, pre/post validation exercises, mock-pre approval inspection visits, etc.
4. Responsibilities
4.1 Supply Chain
4.1.1 Supply Chain is responsible for co-ordinating the overall manufacturing Operations supplier audit plan and monitoring progress against this plan.
4.1.2 Supply Chain is responsible for assigning Lead Audit team to each supplier.
4.1.3 Supply Chain is responsible for providing or identifying appropriate training courses and
audit document templates to assist Lead Audit Team to maintain internationally consistent auditing standards.
4.2 Outsourcing and Procurement QA
4.2.1 Outsourcing and Procurement QA (a part of QA Division) is responsible for coordinating the audit
program for APIs and associated intermediates and raw materials required for either development or commercial use.
4.2.2 Outsourcing and Procurement QA is responsible for auditing suppliers if they are introducing a major change
involving the manufacture of development or commercial APIs or associated intermediates and raw materials.
4.3 R&D
4.3.1 Is responsible for coordinating audits of suppliers supplying solely to R&D.
4.3.2 Is responsible for providing the resource to conduct the audits at the suppliers to which they are assigned, to meet the overall audit plan.
4.3.3 Is responsible for ensuring that auditors are properly and consistently trained to conduct the audits they are asked to perform.
4.4 Lead Audit Team/Site
4.4.1 Lead Audit Teams are responsible for providing the resource to conduct the audits at the suppliers to which they are assigned, to meet the overall audit plan.
4.4.2 Lead Audit Teams are responsible for ensuring that auditors are properly and consistently trained to conduct the audits they are asked to perform.
4.4.3 Lead Audit Teams are responsible for deciding an overall QA/Compliance status for each
supplier and recommending to Receiving Sites (can be the same site) whether materials/services from specified suppliers could be certified
5. Guideline
5.1 Selection of Lead Audit Team
The Lead Audit Team shall be assigned on the following basis: knowledge/experience of the type of manufacture/service being supplied, the proximity to the supplier and the cultural awareness of the supplier.
5.1.1 Availability of Resources
After accepting the Lead Audit team assignment, Operations and QA are accountable for establishing the appropriate level of trained personnel and resources to conduct the audits.
5.2 Change in Lead Audit Team Assignment
It is Supply Chain responsibility to re-assign Lead Audit team.
5.3 Audit Program
The designated LAT should establish a rolling routine scheduled audit program. This program should be recorded. Changes can only be made with the agreement of the Receiving Sites involved with that supplier.
5.4 Audit Frequency
On-site supplier selection audits of critical materials/services will be conducted for all new suppliers, preferably before the use of material in manufacture. The minimum assigned routine scheduled audit frequency should be based upon criticality and the following guidelines are provided:
| Suppliers of | Audit Frequency (months) | ||
| 12 | 24 | 36 | |
| Sterile Finished Products | X | ||
| Non-Sterile Finished Products | X | ||
| General Services* | X | ||
| Sterile API and Sterile Excipient for Sterile Finished Product | X | ||
Non-Sterile API and Non-Sterile Excipient for Sterile Finished Product | X | ||
| Non-Sterile API for Non- Sterile Finished Product | X | ||
| Non-Sterile Excipient for Non-Sterile Finished Products | X | ||
| XIntermediate | X | ||
| API Starting Material (CRM) | X | ||
| NCRM | X** | ||
| Consumables (critical) | X | ||
| Consumables (non critical) | X*** | ||
| Microbiological Supplier | X | ||
| PCC | X | ||
| PCNC | X*** | ||
(*) Including contract laboratories, warehouses, labelling, calibration centres, etc.
(**) These materials should be audited initially, if possible; then SQR is normally acceptable, if no quality issues and no major changes occurred. Some NCRMs (e.g. solvents going into final stage) need to be audited to the same frequency arms. SQR should not be substituted for full audits of suppliers of critical materials or services.
(***) SQR is acceptable. The frequencies detailed in the above table are guidelines, valid for “Approved” status suppliers. The frequencies for “Provisional Approval “or “Disapproved” status suppliers should be increased.
If a supplier supplies more than one type of material, the audit frequency shall be determined by the material with the minimum (shortest) audit frequency.
All routine scheduled audits should be performed within a ± 3-month interval of the routine scheduled audit date. Extensions in supplier audit frequencies should be exceptional. A supplier’s routine audit frequency may increase for cause (e.g. From 2 years to annually). Any changes to the routine scheduled audit frequency shall be agreed with the Receiving Sites management, fully justified and documented by the LAT and recorded. Quality & Technical Review meetings are not considered audits. Notes/minutes of such meetings may be recorded.
5.5.1 R&D QA Audit Frequency (principles)
The audit frequency and types of audits completed by R&D sites may vary from the detail specified in the table above (providing the supplier is supplying solely too R&D). The frequencies listed in the table should be used as guidance and following principles should be applied:
– Suppliers of raw materials, excipients or packaging components that are intended for use in clinical studies should be audited. If intended to be used for Phase I studies only, the material may be subjected to intensive testing and a SQR instead of a full supplier audit. This should be considered and documented on a case-by-case basis.
Suppliers of finished product (sterile and non-sterile) intended for use in clinical studies should be audited applying the frequencies listed above. In the event the product is a biopharmaceutical, consideration should be given as to whether the supplier should be audited on a more frequent basis.
– Supplier evaluation via risk assessment in lieu of a full audit may be acceptable, however this should be based on the Supplier history and the nature and criticality of the service being provided.
– Clinical Pharmacology Units (CPUs) and comparator suppliers (wholesalers and pharmacies) should be considered for inclusion in audit plans.
– Stability testing providers critical to R&D should be audited at a greater frequency than36months (egg 24 months)
– Interactive Voice Response Systems (IVRS) providers should be included in R&D audit plans (may be audited by the IS Function)
5.6 Audit Preparation
A questionnaire may be sent out to the supplier. Copies of the supplier’s laboratory test methods for each material supplied to receiving site should be requested from the supplier if these have not been provided previously. If already provided the supplier should be asked to confirm that these are still current.
The LAT should identify, that site has received material/product from the supplier.
The LAT should distribute the latest information on laboratory test methods tithe site for its review. The receiving site should inform the auditor of any issues/concerns about these methods, or changes made to them by the supplier, for discussion with the supplier. The LAT should collate data on the supplier from other receiving sites (if applicable, supply history since last audit, quality issues provided by other receiving Sites etc.) and review the most recent questionnaires/audit actions.
The LAT/QA Site should request this information by sending the ‘Pre-Audit Information Request’ form to the other receiving sites. Any quality issue raised by RS should be indicated in the form. Input from other functions’. Purchasing, Process Development, etc. should also be sought.
The LAT/QA Site should contact the supplier at least one month in advance of any audit, arrange the audit date(s) and agree upon the supplier’s materials/services site(s) to be audited.
The LAT/QA Site should agree upon the audit team (Note: 1) May need technical assistance if the audit is on a specialized topic. Note: 2) Only appropriately trained staff should lead the audit), and define the scope of the audit. The receiving site may nominate a representative as member of the audit team. The plan (or agenda) for the audit should be proposed by the audit team and details (e.g. travel, name of auditors, etc.) be finalized with the supplier who, in turn, may need to arrange for an expert to be present for the audit. The draft planes only a guide and subjects may change, depending on findings (this should be stated on the plan to the supplier).
5.7 Auditor Characteristics
Only people with appropriate training should carry out audits.
5.8 Performing the audit
At the opening meeting to the quality and compliance audit, the purpose, scope, standards, agenda should be described for attending representatives from the supplier.
During the audit, the Lead Auditor shall ensure there is a review of the Quality Assurance Agreement, the issues associated with the supplier’s laboratory test methods and specifications agreed with buyer.
Observations shall be discussed with the relevant facts at hand, preferably when and where observations are made.
At the end of the audit (e.g. the ‘Closing Meeting’), comments (including observations) to be included in the report should be discussed with the supplier.
5.9 Audit Reporting
Immediately upon return to the office the Lead Auditor should record the date of the audit and the auditor’s name and mark the materials covered by the scope of the audit. Additional audit related information should be added to the database as it becomes available.
All Receiving Sites should be informed on critical observations as soon as possible.
Each audit shall be documented in a report. Audit reports are confidential and shall be marked as such. The report should not to be shared with other companies. The only exception is when Authorities request a copy of the audit report.
The Lead Auditor shall make the audit reports available to the Receiving Sites.
The audit report shall include paragraphs specifically addressing the issues on laboratory test methods and conduct of quality control tests on materials supplied to buyer as a basis for making/re-confirming the LAT certification recommendation.
The audit report shall be available in English or, in the case of a local supplier, in the local language (an English summary may be included).
Audit reports should be issued within 30 calendar days after the audit, unless critical observations have been identified. The report should be sent to the supplier (signed and in pdf format) and its inclusion notified to the receiving site(s). The supplier should be requested to provide a formal response to the audit observations within 30 calendar days of its receipt, unless critical observations have been identified.
Audit observations may be presented in the form of a table at the Closing Meeting (see below) by hand or by electronic form (like Word format) at the Closing Meeting.
The table can then be typed and formally issued with the audit report. The audited supplier may then complete their proposed follow-up action, by whom and when, in order to formally track the responses, progress through to closure). Once the Lead Auditor is satisfied with progress, the “date observation closed out” and “closed out by “can be added to the observation table and the formal audit closure record.
5.10 Audit Follow-up
Once the initial audit response and resultant actions, including timescales, have been agreed with the supplier, the Lead Auditor (or designated nominee) that conducted the audit shall track progress of outstanding Critical and Major audit observations and resultant actions. Critical observations should generate immediate corrective actions. If no response is received by the due date that/QA Site will issue a reminder to the supplier and agree upon a new date for the response. If no response is received 30 calendar days from the agreed new date a formal complaint may be raised. Upon satisfactory response to actions and/or observations by the supplier, that/QA Site, after recording the supplier’s response, can close the audit, sending out an audit closeout letter. The LAT/QA Site may then inform the supplier of its status within the buyer company. Receiving Sites should be informed when the audit is closed.
5.11 Archiving of audit documentation
Master copies of audit reports, questionnaires, SQR, etc. should be retained by the LAT/QA Site for a minimum of 6 years past audit (including postal audits). Electronic copies should be made available.
5.12 Audit Standards
The standards in the following table are those that are recommended for an audit of the listed material. The supplier should be requested to meet any agreement made with buyer regarding the audit standards, which are those included in Quality Assurance Agreement or those presented during the audit preparation orate the opening meeting.
* = including contract laboratories, warehouses, labelling, calibration centres, etc.
** = Pharmaceutical Excipients
*** = Pharmaceutical Packaging Material