Standards for on-site audits
The standards for GMP-compliant production of APIs are laid down in the International Conference on Harmonization's (ICH)
guideline, ICH Q7 Good Manufacturing Practice. But what exactly are the requirements for such on-site audits to monitor the GMP compliance of API suppliers? A generally
accepted standard for auditing GMP compliance of API or other starting-material manufacturers, however, is still missing.
Instead, both in scientific literature and in practice, quite different approaches to auditing can be found. From an industry
point of view, recommendations for "good" auditing often are limited to hints, examples, or a collection of typical findings
(7). Many authors seem to believe that GMP audits of APIs cannot be fully standardized (8, 9). The quality of an audit then
depends on the experience and quality of the individual auditor. Consequently, the quality of audits does vary considerably
(10). Clearly, a defined quality management for such audits is essential for monitoring GMP and quality-management system
compliance during audits.
Table I: Documents to be reviewed to establish GMP conformity of the quality system.
|
Indeed, initiatives by third-party industry groups, such as the European Chemical Industry Council's (CEFIC) Active Pharmaceutical
Ingredients Committee (APIC); blue inspection body GmbH, which provides accredited GMP audits; and Rx-360, an international
pharmaceutical supply-chain consortium, have already proposed audit standards, as discussed later in this article. The authorities,
too, have taken tangible steps towards standardization. For example, FDA has issued a guidance document for its inspectors
that explicitly covers the conduct of API GMP inspections (11). Similarly, the Pharmaceutical Inspection Convention and the
Pharmaceutical Inspection Co-operation Scheme (PIC/S) have issued an Aide Memoire for GMP-inspectors who conduct audits of
API manufacturers (12).
Table II: Product-specific documents to be reviewed during API GMP audits.
|
A standardized, ICH Q7 compliant, API GMP audit would consist of the following (13):
- A document review (approximately 40% of the on-site audit time) in which a minimum set of documents concerning both the site's
GMP system and the individual API(s) must be looked at (see Tables I and II). The more documents that are available before the actual audit the better because these can be evaluated without compromising
the on-site audit time and process flow.
- An on-site assessment of the shop floor (approximately 50% of the on-site audit time), which covers the entire process flow
but prioritizes individual aspects. One example is corrective actions and preventive actions (CAPAs) of earlier audits/inspections
(see Table III).
- Meetings (no more than 10% of the on-site audit time).
- The resulting audit report, which demonstrates to the authorities that the audited API supplier is in fact GMP-compliant.
The audit report must contain all relevant GMP-related observations and findings and should be structured according to the
chapters of ICH Q7. In particular, all deficiencies must be referenced to specific ICH Q7 requirements (10).
Table III: Checkpoints for on-site assessments according to International Conference on Harmonization (ICH) Q7.
|
The time between audits (i.e., from initial audit to surveillance audit) and the amount of time needed for each individual
audit (i.e., on-site audit time, time for audit preparation, report writing, CAPA follow-up) are important. European MAHs,
for example, are advised by EMA to audit their API manufacturers on a risk-based schedule, approximately every two to three
years (14). The suggested minimum duration of each audit is set to two or three days by the European Compliance Academy's
Qualified Person (QP) Association and EMA, respectively (15, 16). According to the QP Association, shorter audits may be acceptable
if a risk-based justification can be provided, whereas larger sites and/or audits abroad will definitely require additional
time. The suggested audit times do include preparation and post-processing. The sheer number of audits required and the time
needed for each one, however, still put MAHs and API suppliers through a tough time.
|
