Noncompliance of APIs with specified quality standards can be fatal, as shown by the heparin scandal in 2008. Quality control
tests of the API imported from China by finished dose manufacturers in the United States were unable to discover the deliberate
adulteration with oversulfated chondroitine sulfate because analytical methods can detect only those quality defects and impurities
for which the analyst is actively looking and the method is capable of detecting. Although new analytical methods, such as
spectroscopic screening, may help to further improve quality-control tests, quality can never be "tested into" a product (1,
2). Hence, vigorous quality management is needed during production; GMP and GMP monitoring are also needed.
During the past years, FDA and the competent authorities in Europe have tightened their supervision of pharmaceutical supply
chains. In the US, FDA began to prepare industry for tougher standards; from the podium at various conferences, FDA officials
have stated plans to require companies to conduct on-site audits at outside contract-manufacturing facilities.
In the European Union, the case is even clearer: every manufacturing authorization holder (MAH) is responsible for monitoring
the GMP compliance of all APIs and certain excipients used in manufacturing "by conducting audits at the manufacturing and
distribution sites of the manufacturer and distributors of active substances" (3). The upcoming revision of chapter 5.26
of the EU GMP guide will state, "Suppliers of active substances and certain excipients considered to be high risk materials
used as starting materials should be periodically audited to confirm that they comply with current GMP requirements" (4).
ISO certificates, GMP certificates from third countries, and certificates of suitability (CEP), for example, "cannot replace
on-site audits of active substance suppliers" and may serve only as interim and temporary measures between audits (5). If
the European authorities discover significant GMP deficiencies during their own inspections of an API manufacturer, the MAHs
using these APIs, and especially their qualified persons (QP), are held liable for neglecting their duties (6).
