Achieving More Effective and Efficient GMP Auditing

Noncompliance of APIs with specified quality standards can be fatal, as shown by the heparin scandal in 2008. Quality control tests of the API imported from China by finished dose manufacturers in the United States were unable to discover the deliberate adulteration with oversulfated chondroitine sulfate because analytical methods can detect only those quality defects and impurities for which the analyst is actively looking and the method is capable of detecting. Although new analytical methods, such as spectroscopic screening, may help to further improve quality-control tests, quality can never be "tested into" a product (1, 2). Hence, vigorous quality management is needed during production; GMP and GMP monitoring are also needed.

During the past years, FDA and the competent authorities in Europe have tightened their supervision of pharmaceutical supply chains. In the US, FDA began to prepare industry for tougher standards; from the podium at various conferences, FDA officials have stated plans to require companies to conduct on-site audits at outside contract-manufacturing facilities.

In the European Union, the case is even clearer: every manufacturing authorization holder (MAH) is responsible for monitoring the GMP compliance of all APIs and certain excipients used in manufacturing "by conducting audits at the manufacturing and distribution sites of the manufacturer and distributors of active substances" (3). The upcoming revision of chapter 5.26 of the EU GMP guide will state, "Suppliers of active substances and certain excipients considered to be high risk materials used as starting materials should be periodically audited to confirm that they comply with current GMP requirements" (4). ISO certificates, GMP certificates from third countries, and certificates of suitability (CEP), for example, "cannot replace on-site audits of active substance suppliers" and may serve only as interim and temporary measures between audits (5). If the European authorities discover significant GMP deficiencies during their own inspections of an API manufacturer, the MAHs using these APIs, and especially their qualified persons (QP), are held liable for neglecting their duties (6).

Standards for on-site audits

The standards for GMP-compliant production of APIs are laid down in the International Conference on Harmonization's (ICH) guideline, ICH Q7 Good Manufacturing Practice. But what exactly are the requirements for such on-site audits to monitor the GMP compliance of API suppliers? A generally accepted standard for auditing GMP compliance of API or other starting-material manufacturers, however, is still missing. Instead, both in scientific literature and in practice, quite different approaches to auditing can be found. From an industry point of view, recommendations for "good" auditing often are limited to hints, examples, or a collection of typical findings (7). Many authors seem to believe that GMP audits of APIs cannot be fully standardized (8, 9). The quality of an audit then depends on the experience and quality of the individual auditor. Consequently, the quality of audits does vary considerably (10). Clearly, a defined quality management for such audits is essential for monitoring GMP and quality-management system compliance during audits.

Indeed, initiatives by third-party industry groups, such as the European Chemical Industry Council's (CEFIC) Active Pharmaceutical Ingredients Committee (APIC); blue inspection body GmbH, which provides accredited GMP audits; and Rx-360, an international pharmaceutical supply-chain consortium, have already proposed audit standards, as discussed later in this article. The authorities, too, have taken tangible steps towards standardization. For example, FDA has issued a guidance document for its inspectors that explicitly covers the conduct of API GMP inspections (11). Similarly, the Pharmaceutical Inspection Convention and the Pharmaceutical Inspection Co-operation Scheme (PIC/S) have issued an Aide Memoire for GMP-inspectors who conduct audits of API manufacturers (12).

A standardized, ICH Q7 compliant, API GMP audit would consist of the following (13):

• A document review (approximately 40% of the on-site audit time) in which a minimum set of documents concerning both the site's GMP system and the individual API(s) must be looked at (see Tables I and II). The more documents that are available before the actual audit the better because these can be evaluated without compromising the on-site audit time and process flow.

• An on-site assessment of the shop floor (approximately 50% of the on-site audit time), which covers the entire process flow but prioritizes individual aspects. One example is corrective actions and preventive actions (CAPAs) of earlier audits/inspections (see Table III).

• Meetings (no more than 10% of the on-site audit time).

• The resulting audit report, which demonstrates to the authorities that the audited API supplier is in fact GMP-compliant. The audit report must contain all relevant GMP-related observations and findings and should be structured according to the chapters of ICH Q7. In particular, all deficiencies must be referenced to specific ICH Q7 requirements (10).

The time between audits (i.e., from initial audit to surveillance audit) and the amount of time needed for each individual audit (i.e., on-site audit time, time for audit preparation, report writing, CAPA follow-up) are important. European MAHs, for example, are advised by EMA to audit their API manufacturers on a risk-based schedule, approximately every two to three years (14). The suggested minimum duration of each audit is set to two or three days by the European Compliance Academy's Qualified Person (QP) Association and EMA, respectively (15, 16). According to the QP Association, shorter audits may be acceptable if a risk-based justification can be provided, whereas larger sites and/or audits abroad will definitely require additional time. The suggested audit times do include preparation and post-processing. The sheer number of audits required and the time needed for each one, however, still put MAHs and API suppliers through a tough time.

Fewer but better audits

So, wouldn't it be a great idea for the MAH to concentrate on those audits that are most important to the company? But which audits are most important? All APIs need auditing. A risk-based approach will only help to prioritize which API needs to be audited first. Audits can, however, be prioritized not only according to risk, but also according to their individual relevance. Even though an API may pose few risks, it can still be extremely relevant to the MAH, for example, because of the intellectual property involved, the sheer quantity of the API, or any number of other reasons. It would be prudent to prioritize audits into those that the MAH will conduct and others that can be sourced out. The MAH would concentrate on audits that are most important to him. All other audits can be sourced out to a third party.

This approach especially makes sense for APIs that are used by several MAHs. Currently, each MAH will send an auditor to the API manufacturer, so that the same manufacturing process is being checked over and over again. From a quality point of view, this situation is not advisable. The overall time spent in auditing the API and the burden put on the API manufacturer are considerable, each single audit is relatively short, and the same aspects are likely to be audited repeatedly while other, equally important aspects, tend to be left out of an audit. It will, therefore, be much more efficient if MAHs pool the effort spent on auditing an API. The combined audit could be more thorough, although still being considerably shorter than the current sum of individual audits. Sharing an API audit thus does improve audit quality and reduces the burden for API manufacturers.

EMA has explicitly permitted such third-party audits, provided that contractual arrangements are made corresponding to Chapter 7 of the GMP Guide and that the auditor does fulfill certain requirements (5). Industry initiatives, which are discussed in the "Industry initiaves" section of this article, help in this situation (17). Most of these initiatives have set up strict rules regarding auditor qualification. Most initiatives also have set their own standards for conducting the audit, so that the buyer of the resulting audit report can expect certain minimum standards.

Industry initiatives

Rx-360. Rx-360 was founded in the US in June 2009 by volunteers from the pharmaceutical and biotechnology sectors, including branded and generic-drug producers and suppliers. It aims to provide a broader, more thorough audit than is typically conducted. The findings of Rx-360 audits can then be shared with multiple pharmaceutical firms, thus reducing the number of audits that a supplier must host and that a pharmaceutical firm must conduct. In this way, the consortium believes it can reduce the overall audit burden on both suppliers and drug manufacturers.

Rx-360 offers three types of audits: "collaborative audits," in which several MAHs ask Rx-360 to have one supplier audited and the MAHs share the audit costs; "sponsor's audits," in which one pharmaceutical manufacturer covers the costs of the audit, the report of which is then released to additional requestors for a fee; and "subscription offers," in which manufacturers can access the available audit reports of the consortium for a fee.

Rx-360 organizes the audits but commissions their execution to external auditors. These auditors must comply with a set of minimum qualifications including, but not limited to, a minimum of five years of GMP operational pharmaceutical experience, involvement in at least five audits of the relevant supplier/audit type, and at least three conducted audits in the last 12 months. The Rx-360 audit guidelines are based upon regulatory standards as well as best practices; the standard for API audit and the corresponding report matches the structure of ICH Q7 (18, 19).

CEFIC/APIC. CEFIC is an association of chemical manufacturers in Europe. CEFIC's Active Pharmaceutical Ingredients Committee (APIC) has started the "APIC Audit Program" as a third-party program for auditing API manufacturers and contract manufacturers as well as distributors. Its aim is to offer a turnkey solution for auditing GMP compliance of API manufacturers and/or distributors. Audits can be initiated by one or more MAHs "in order to get independent information about the GMP compliance status about the API supplier (e.g., when preparing for authority inspections)" (20). Audits can also be initiated by an API manufacturer. It should be noted, however, that, at least for the time being, European competent authorities generally will not accept self-initiated audits.

As with Rx-360, auditors working for the APIC Audit Program must fulfill a strict set of formal requirements and pass through APIC's own training courses. As a rule, APIC audits will be performed by two auditors for two days. These audits result in a standardized report that is not tightly bound to ICH Q7 but will include "detailed descriptions of all subjects covered during the audit, objective evidence for any GMP deficiencies found during the audit" and an unambiguous rating of these deficiencies (20).

Apart from larger association initiatives, such as Rx-360 and CEFIC, other company initiatives exist, ranging from intercompany associations such as the German Association of Research-Based Pharmaceutical Companies (Verband forschender Arzneimittelhersteller, VfA), in which audit reports are only shared between members to Diapharm, a company that markets accredited API GMP audit reports to pharmaceutical companies.

VfA. Roughly 20 members of VfA have started an exchange-scheme for audit reports, called JA VfX, through which the audit results can be shared with other members of the community. Audit standards and criteria for auditor selection, however, are not made transparent to nonmembers.

AFA. The Asociación Fórum Auditorías (AFA) was founded in Spain in 2005 by pharmaceutical companies to provide an infrastructure to satisfy requirements for supplier validation. AFA offers joint sponsorship of audits by common interest or by campaigns for distant geographical areas, sharing travel and accommodation expenses. Differing from initiatives such as Rx-360 or Diapharm, AFA not only organizes the audit, but also conducts the audit with its own auditors who need to demonstrate, among other qualifications, a minimum of two-year's experience working in an organization regulated by GxP principles, holding an upper-management position, and audit execution experience prior to any AFA-internal training course. Information on AFA's auditing standard has not yet been published.

Diapharm. Diapharm, an international pharmaceutical service provider with offices in Germany, Austria, and the UK, started an API GMP auditing scheme in 2008. Audits can either be ordered by one or by several pharmaceutical companies. As a speciality, Diapharm also offers a joint audit even if each MAH obtains a different API from the API manufacturer. Again, the actual audits are conducted by external auditors. The audit as well as the audit report (35 to 70 pages) match the ICH Q7 standards. Auditor qualification standards are among the highest in the industry in that Diapharm only commissions audits to inspection bodies that are accredited according to ISO 17020.

EXCiPACT. In 2009, a group of industry experts from the European Fine Chemical Group (EFCG), the International Pharmaceutical Excipients Council (IPEC) Europe, IPEC Americas, the European Association of Chemical Distributors (FECC), and the Pharmaceutical Quality Group (PQG) set out to develop a certification scheme for excipient suppliers. The resulting consortium, EXCiPACT, is starting an auditing scheme to provide independent third-party certification of manufacturers, suppliers, and distributors of pharmaceutical excipients (21). EXCiPACT's guidelines are dedicated to excipients only and are rather detailed and state-of-the-art. Auditor requirements again are comparable to Rx-360, with a detailed standard having been defined based on ISO 19011, a standard for auditors; ISO 17021, a standard for certification bodies; and additional items.

Conclusion

GMP and GDP audits of pharmaceutical material suppliers are legally required and are crucial to support the safety of drug products. High quality audits by independent third parties and the sharing of such audits between pharmaceutical manufacturers are important means to reduce the burden for MAHs and API suppliers alike. Organizations such as Rx-360 or EXCiPACT help by setting and enforcing the necessary quality standards for these third party audits. As a consequence, effective and efficient GMP auditing is turning into daily practice more and more, thus resulting in fewer but better and more thorough audits.

Stefan Kettelhoit* is managing director at blue inspection body GmbH, Hafenweg 18-20, 48155 Muenster, Germany, tel: 49 251 625620 40, stefan.kettelhoit@blue-inspection.com. Martin van Trieste is senior vice-president of quality at Amgen and a member of the Rx-360 board of directors.

*To whom all correspondence should be addressed.

References

1. M. Tawab, Pharm. Ind. 72 (2) 231-240 (2010).

2. M. Tawab, Pharm. Ind. 72 (3) 418-426 (2010).

3. EC Directive 2011/62/EU, Falsified Medicines Directive, amending Directive 2001/83/EC (Brussels, July, 2011).

4. EC, Draft Chapter 5, "Production," in Good Manufacturing Practice Medicinal Products for Human and Veterinary Use, Eudralex, Vol. 4 (Brussels, 2010), http://ec.europa.eu/health/files/gmp/chapter5_pc11-2010.pdf, accessed Jan. 11, 2013.

5. EMA, "Q&A: Good Manufacturing Practice," http://www.ema.europa.eu/Inspections/GMPfaq.html, accessed Jan. 8, 2013.

6. EMA, EMA/INS/GMP/459921/2010 Rev 13, "Procedure for Dealing with Serious GMP Non-compliance or Voiding/Suspension of CEPS Thus Requiring Co-ordinated Administrative Action," in: Compilation of Community Procedures on Inspections and Exchange of Information (London, 2010).

7. MHRA, "Good Manufacturing Practice: Common deficiencies," http://www.mhra.gov.uk/Howweregulate/Medicines/Inspectionandstandards/GoodManufacturingPractice/FAQ/Commondeficiencies/, accessed Jan. 8, 2013.

8. C. Hösch, Pharm. Ind. 71 (6) 1035-1038 (2009).

9. C. Hösch, Pharm. Ind. 71 (7) 1229-1233 (2009).

10. S. Kettelhoit, Pharm. Ind. 72 (2) 242-247 (2010).

11. FDA, Program 7356.002F, Chapter 56 "Drug Quality Assurance Program," in FDA Compliance Program Guidance Manual (Silver Spring, MD, Sept. 2003).

12. PIC/S PI 030-1, Aide-Memoire Inspection of Active Pharmaceutical Ingredients (Geneva, 2009).

13. S. Kettelhoit and R. Voeller, Pharm. Ind. 74 (6) 902-912 (2012).

14. EMA, EMA/INS/GMP/459921/2010 Rev 13, "A Model for Risk Based Planning for Inspections of Pharmaceutical Manufacturers," in Compilation of Community Procedures on Inspections and Exchange of Information (London, 2010).

15. EMA, EMA/INS/GMP/459921/2010 Rev 13, "Guidance on the occasions when it is appropriate for Competent Authorities to conduct inspections at the premises of Manufacturers of Active Substances used as starting materials," in Compilation of Community Procedures on Inspections and Exchange of Information (London, 2010).

16. QP Association, "Checklist Auditor Qualification and Performance," http://www.gmp-compliance.org/daten/training/QPA_Checklist.pdf, accessed Jan. 8, 2013.

17. H. Champion, "Shared Supplier Audits—A new day for supply chain quality," http://www.contractpharma.com/issues/2012-09/view_features/shared-supplier-audits-275514, accessed Jan. 8, 2013.

18. Rx-360, Rx-360 Audit Standards for Active Pharmaceutical Ingredients and API Intermediates, v. 1.0 (Washington, DC, Aug. 2010).

19. D. Ewalt, et al., Pharm. Tech. 36 (10) 124-127 (2012).

20. API Compliance Institute, "What Is the APIC Audit Programme?" http://www.api-compliance.org/mse_APICOMPLIANCE_Registration.html, accessed Jan. 8, 2013.

21. EXCiPACT, Certification Standards for Pharmaceutical Suppliers: Good Manufacturing Practices, Good Distribution Practices (Brussels, Jan. 2012).