Supplier Qualification

This paper provides a comparison of three comprehensive programs—Rx–360, EXCiPACT, and IPEA—available to pharmaceutical manufacturers for the purpose of auditing excipient suppliers and ensuring drug efficacy and patient safety.

Ingredient adulteration has been a growing concern for regulators. In June 2009, FDA sponsored a conference on economically motivated adulteration. In October 2009, the results of a study conducted on imported povidone analogs showed there was substandard excipient offered for sale (1). After confirmation, FDA issued an import alert for povidone analogs from an overseas manufacturer (2). Since then, FDA inspections of pharmaceutical manufacturers have added emphasis on supplier qualification. FDA announced at the FDA/Xavier University Global Outsourcing Conference in 2010 that site inspection of component suppliers will become a future requirement (3). Similar expectations are developing in Europe. The Falsified Medicines Directive (FMD) 201⅙2/EU requires the holder of the manufacturing authorization to ensure that appropriate GMP is applied to the manufacture of ingredients (4). Although the FDA and EMA requirements for site audits have not yet been mandated for excipients, the excipient industry must be prepared to receive increasing numbers of audits.

Excipient manufacturers often host 10 or more audits performed by their direct customers per year, which is a small fraction of their many direct and indirect pharmaceutical customers. These audits do not include potential audits by excipient users that purchase material through distributers. The excipient manufacturer usually has no knowledge of the identity of those customers. Thus, it becomes impractical both physically and economically to host an audit from all direct and indirect pharmaceutical customers. Regulators worldwide recognize this conundrum and now allow the pharmaceutical company to rely on third-party audits and certification. As stated by FDA, an important consideration for acceptance is proper qualification of the third-party audit or certification provider. This article provides an overview and comparison of a third-party audit, Rx–360, and excipient GMP certification programs EXCiPACT and IPEA.

Rx–360

The Rx–360 International Pharmaceutical Supply Chain Consortium is a nonprofit international industry organization established in 2009. The mission of this organization is to develop and implement enhanced global quality systems and processes that will help ensure product quality and authenticity throughout supply chains. Members of Rx–360 include pharmaceutical companies and suppliers, working in partnership to achieve the mission of Rx–360. Pharmaceutical associations and industry groups, auditing firms, and regulatory agencies are updated on the status of the audit programs and other initiatives of the consortium. In support of the mission, the consortium developed a Joint Audit Program and a Shared Audit Program, both of which aim to provide knowledge on the quality and authenticity of supplies and their suppliers.

Joint audit program. Pharmaceutical companies that are Rx-360 members (sponsors) can confidentially submit a request to the Rx-360 secretariat to have an audit performed by an Rx-360-qualified third-party audit firm, at a supplier site. Currently, Rx-360 supports audits of API, excipient, raw material, basic chemicals, and packaging suppliers, with potentially more categories to be added into the program (e.g., laboratories). As part of the audit request, the number of additional sponsors required for the audit to progress is stipulated. This can result in a single sponsor or multiple sponsors per audit, depending on the sponsor's needs. The sponsor's confidentiality is sustained throughout the entire audit process. A supplier that is targeted for an audit through Rx-360 must also agree to the third-party audit.

The program benefits both pharmaceutical companies and suppliers. For pharmaceutical companies, the cost of the audit is shared by the number of sponsors, which has the potential to significantly reduce the cost per audit. Additionally, Rx-360 provides a supplemental means to complete routine audits required by regulators worldwide. Suppliers benefit by having a potential reduction in time and resources spent hosting and responding to numerous audits, especially in cases where multiple sponsors are interested in auditing the same supplier.

Auditors from select qualified third-party auditing firms perform each audit. Each auditor must have the education, experience, and accreditation to be eligible to perform an audit. The experience required is specific to the type of audit being performed, whether API, excipient, raw material, or packaging material. Auditors use audit guides during the audit, which have been developed by Rx-360 and agreed to by the pharmaceutical company members. These guides ensure consistency of the audits performed and are based on industry standards such as ICH Q7, Good Manufacturing Practice for Active Pharmaceutical Ingredients for APIs and EXCiPACT GMP or GDP standards (see below) for excipients.

Each sponsor reviews the draft audit reports to ensure clarity of the report, completeness of the audit, and validity of observations. Following sponsor review, the audit report is returned to the auditor to address any questions and any needed revisions for clarity, before the report is issued to the supplier. Responses to any observations are provided to the auditor for review and concurrence. If a sponsor determines that a specific audit observation requires additional follow-up due to its company procedures, or if the response is not adequate per sponsor standards, the sponsor has the responsibility to negotiate further with the supplier.

If a pharmaceutical company is not an initial sponsor for an audit, the company may purchase the given audit report following approval of the report and permission from the supplier. Rx-360 non-member companies can also purchase audit reports, again pursuant to supplier agreement.

Shared audit program. Rx-360 member pharmaceutical companies, with agreement from the supplier, can elect to submit an audit report performed by the pharmaceutical company (rather than through an Rx-360 third-party audit), into the shared audit program. Information is redacted to protect any confidential information from both the pharmaceutical company and supplier perspective. These audit reports can be purchased by another Rx-360 member company, pursuant to supplier agreement, as a means of obtaining additional information about a supplier. This can be quite useful for companies evaluating a new supplier. Suppliers benefit by gaining visibility to a large number of potential customers, and a potential reduction in pre-audit paperwork as well as audit frequency or time spent on a single audit.

For both Rx-360 audit programs discussed, confidentiality is strictly maintained to ensure that only the appropriate information is visible to a sponsor or supplier.

EXCiPACT

EXCiPACT is a voluntary international scheme to provide independent third-party certification of manufacturers, suppliers, and distributors of pharmaceutical excipients worldwide. It aims to ensure patient safety, through supplier quality, while minimizing the overall costs for assessing the excipient supply chain. In early 2009, the European Fine Chemicals Group (EFCG), the International Pharmaceutical Excipients Council (IPEC) Europe, IPEC Americas, the European Association of Chemical Distributors (FECC), and the Pharmaceutical Quality Group (PQG) (UK) formed a project consortium to jointly develop a set of cGMP and current good documentation practice (cGDP) standards for pharmaceutical excipients. Launched as a project of the IPEC Federation, the EXCiPACT Association will become a stand alone not-for-profit organization based in Brussels once commercial activities fully commence.

The EXCiPACT standard is based on the Quality Management System ISO 9001:2008 and provides two annexes to ISO 9001:2008, which cover GMP and GDP requirements for excipients. Excipient manufacturers would be assessed to ISO 9001:2008 and the EXCiPACT GMP annex together, whereas distributors would utilize ISO 9001:2008 and the EXCiPACT GDP Annex. The remaining sections of EXCiPACT cover the requirements for third-party audit organizations, firstly for auditor competency and secondly for quality system requirements for these organizations. The former is based on ISO 19011:2002, Guidelines for Quality and/or Environmental Management System Auditing, whereas the latter is based on ISO/IEC17021:2006, Conformity Assessment—Requirements for Bodies Providing Audit and Certification of Management Systems.

Because the EXCiPACT Association has no auditors, the qualification of EXCiPACT auditors authorized to perform the certification audits is one of the program's most important elements. The EXCiPACT Scheme has two grades of certification: EXCiPACT Auditor and the EXCiPACT Audit Team Leader. These are equivalent to International Register of Certificated Auditors (IRCA) Quality Management Systems (QMS) 2008 certification grades. To be eligible for EXCiPACT Scheme certification, applicants must meet the requirements stated in the EXCiPACT Auditor Competency annex to ISO 19011. Being certified as an IRCA QMS 2008 Auditor or Audit Team Leader meets the basic auditing requirements; however, additional knowledge of excipient manufacturing, GMP, and GDP EXCiPACT Scheme auditing competencies are also required. Both grades require successful demonstration of the application of the fundamental competencies to excipient supplier audits against the EXCiPACT GMP and GDP standards. Demonstration of the additional requirement for at least five years of the IRCA general work experience to be in the pharmaceutical or excipient supplier industry for GMP auditors or three years for GDP auditors for all auditors is also required. If auditors wish to perform GMP and GDP audits then the additional requirement is five years.

For both grades, the successful completion of an EXCiPACT Association approved pharmaceutical excipient supplier auditing course is a prerequisite. This training should be completed within the three-year period immediately prior to application to undertake EXCiPACT certification. Training completed prior to this period may be accepted if evidence is provided of recent, relevant work experience, and currency of their auditing skills, as laid down in IRCA 602. The list of the qualified third-party auditors is published online at www.excipact.org.

The excipient supplier is the sponsor of the EXCiPACT certification audit. The supplier selects from qualified third-party auditing companies listed on the website. The excipient supplier pays for the audit (approximately US$12,500 [10,000 EUR] for the certification audit and approximately US$6500 [5000 EUR] for the annual surveillance audit) and the certification fee (US$7000 [5500 EUR]).

EXCiPACT Certification is expected to take an additional one to three days depending on the size and complexity of the site when done simultaneously with an ISO 9001:2008 audit. The excipient supplier can choose between a GMP, GDP, or combined audit depending on the activities performed with the scope of the EXCiPACT Certification similar to the ISO 9001:2008 audit. The excipient supplier selects the third-party auditing company, the scope, and the date of the EXCiPACT certification. Surveillance audits are performed every year and a recertification audit every three years.

The audit report is reviewed and approved by the Certification Body so that a decision on certification is made. The EXCiPACT Association acts as arbitrator in the case of disputes between the third-party audit organization and excipient suppliers. The auditee and the Certification Body agree to disclose the audit report and associated corrective action and preventive action (CAPA) plan to parties approved by the auditee. The auditee can share the audit report with any of its customers. The excipient user can verify audit report and certificate with the Certification Body.

IPEA

International Pharmaceutical Excipients Auditing (IPEA) was organized in 2001 as a subsidiary of the IPEC-Americas, as a consequence of the poisoning in Haiti that resulted from contaminated Glycerin USP. The objective of IPEA is to reduce the cost of supplier audits through a shared audit program, which can facilitate broader site audit of excipient suppliers for supplier qualification.

Shared audit program. The basic audit is a one-day audit at the excipient manufacturer for a single monographed excipient plus additional time for each additional monographed excipient. The sponsor pays for the audit with the price beginning at US$5500. However for each audit report sold, the sponsor receives a credit of US$500 to be used for the purchase of other services from IPEA. The excipient manufacturer reviews the report for factual accuracy and may append a corrective action plan. Pharmaceutical purchasers of the report remain confidential. To date, The IPEA shared audit program has gained limited acceptance.

ANSI Accredited Certification Program. In 2008, FDA asked IPEA to become accredited by the American National Standards Institute (ANSI) as a conformity body for the operation of an excipient GMP certification program. This accreditation was achieved in April 2010. IPEA certifies conformance to the IPEC–PQG Excipient GMPs, but will soon use the new ANSI Standard NSF/IPEC 363, which is designed for audit assessments. Certification requires a minimum of four man-days at the site with additional time allotted for multiple excipients or processes and off-site operations, including subcontracting. Annual surveillance audits are conducted for one-half the time of the certification audit.

Draft audit reports are reviewed by IPEA for completeness, clarity, the appropriate rating of findings, and to ensure the terminology will be understood by the pharmaceutical reader. The draft is then sent to the excipient manufacturer to review for factual accuracy and so a corrective action plan can be prepared. The draft report and corrective action plan are then submitted to the Certification Board.

The Board is comprised of four members with extensive experience in the excipient or pharmaceutical industry including responsibility for supplier qualification. During a teleconference, the Certification Board reviews the report and corrective action plan and interviews the audit team. If the consensus of the Board is that the site is in substantial conformance to excipient GMPs, the site is recommended for certification.

Certification is founded on the audit and audit report. Auditors must demonstrate extensive prior experience in the performance of GMP audits of component suppliers with an emphasis on excipients. Candidate auditors receive one to three days of training in the certification program, excipient auditing, and conformance expectations. Successful candidates are assigned an excipient audit witnessed by an IPEA executive. The auditor is deemed qualified upon demonstration of appropriate audit skills, rating of observations, and audit report preparation. Qualified auditors are subcontractors who execute an agreement with IPEA that requires their compliance with IPEA standard operating procedures (SOPs) including conflict of interest and maintenance of client confidentiality.

Qualified IPEA auditors conduct certification audits as a member of an audit team. Periodic performance reviews are conducted by an IPEA executive based upon review of their audit reports, participation in Certification Board meetings, and/or witnessing an audit plus their continuing improvement activities.

Certification is paid for by the excipient manufacturer and begins at US$20,000. Annual surveillance audit, priced at 50% of certification, is conducted at the site such that every two years the site has been audited for an equivalent number of days as during the certification audit. To facilitate acceptance of IPEA certification, the audit report is offered to pharmaceutical companies at a nominal cost of $500-750. The majority of the proceeds from sale of audit reports are credited to the excipient manufacturer to defray their surveillance fee.

Conclusion

It is apparent that many generic manufacturers and smaller pharmaceutical companies use means other than physical audit to qualify their suppliers. An ANSI accredited certification program, therefore, is particularly useful because the program has been qualified by ANSI and can be so recognized by government agencies. An ANSI accredited certification program, furthermore, allows pharmaceutical companies to use certification in lieu of site audit for supplier qualification.

Assuring the safety of the drug supply has modified the development of each of these programs. FDA has explicitly stated at meetings and presentations that shared-audit and third-party audit programs are acceptable as part of a supplier qualification program (5). Continuing reports of economically motivated adulteration reminds the industry that each site supplying excipients must be physically audited to ensure conformance to GMP requirements. Supply chain security must begin with a site audit.

Participation by an excipient supplier in any one program can provide adequate assurance of the conformance of the excipient to GMP because the basis of the audit is the well accepted IPEC-PQG GMP Guide for Pharmaceutical Excipients. As described herein, the Rx–360, EXCiPACT, and IPEA programs each exercise great care in the selection, training, and qualification of their auditors. FDA has informally stated that these schemes meet regulatory expectations because they have addressed the issue of auditor competency as a core part of the audit process. Thus the schemes can provide the excipient user with a high degree of assurance that excipient from suppliers that have participated in a program meet cGMP expectations and will continue to do so. The cost barrier for this assurance can be greatly reduced by these programs.

These schemes, therefore, can help to ensure patient safety when the drugs that patients consume have been formulated with excipient components supplied by manufacturers whose facilities have been audited.

Darcy Ewalt is director of divisional GMP auditing at Merck Sharp & Dohme, Corp. (Merck is a member of Rx–360). Tracy L. Cooper, Johnson & Johnson, AD, Consumer Regulatory Compliance (J&J is a member of Rx–360). Frithjof Holtz is quality and regulatory management head of MM-QS Advocacy (EXCiPACT) at Merck Millipore. Irwin Silverstein is vice-president and chief operating officer of International Pharmaceutical Excipients Auditing, Inc.

References

1. I. Silverstein, Pharm. Technol. 33 (10), 84–88 (2009).

2. FDA, Advisory to Drug and Dietary Supplement Manufacturers, Compounding Pharmacies and Distributors of Excipients and Dietary Ingredients-FDA Detects High Levels of Peroxide in Crospovidone (Oct. 21, 2010), www.fda.gov/Drugs/DrugSafety/ucm230492.htm

3. B. Hasselbalch, "Public Health Challenges for the Quality of Human Drugs," presented at FDA-Xavier University Global Outsourcing Conference (Cincinnati, June 2010).

4. The Falsified Medicines Directive (FMD) 201⅙2/EU, http://ec.europa.eu/health/files/eudralex/...2011_62/dir_2011_62_en.pdf.

5. See FDA and MHRA presentations at the EXCiPACT launch event in 2012 which are hosted on the EXCiPACT website at www.excipiact.org.