Fewer but better audits

So, wouldn't it be a great idea for the MAH to concentrate on those audits that are most important to the company? But which audits are most important? All APIs need auditing. A risk-based approach will only help to prioritize which API needs to be audited first. Audits can, however, be prioritized not only according to risk, but also according to their individual relevance. Even though an API may pose few risks, it can still be extremely relevant to the MAH, for example, because of the intellectual property involved, the sheer quantity of the API, or any number of other reasons. It would be prudent to prioritize audits into those that the MAH will conduct and others that can be sourced out. The MAH would concentrate on audits that are most important to him. All other audits can be sourced out to a third party.

This approach especially makes sense for APIs that are used by several MAHs. Currently, each MAH will send an auditor to the API manufacturer, so that the same manufacturing process is being checked over and over again. From a quality point of view, this situation is not advisable. The overall time spent in auditing the API and the burden put on the API manufacturer are considerable, each single audit is relatively short, and the same aspects are likely to be audited repeatedly while other, equally important aspects, tend to be left out of an audit. It will, therefore, be much more efficient if MAHs pool the effort spent on auditing an API. The combined audit could be more thorough, although still being considerably shorter than the current sum of individual audits. Sharing an API audit thus does improve audit quality and reduces the burden for API manufacturers.

Industry initiatives

Rx-360. Rx-360 was founded in the US in June 2009 by volunteers from the pharmaceutical and biotechnology sectors, including branded and generic-drug producers and suppliers. It aims to provide a broader, more thorough audit than is typically conducted. The findings of Rx-360 audits can then be shared with multiple pharmaceutical firms, thus reducing the number of audits that a supplier must host and that a pharmaceutical firm must conduct. In this way, the consortium believes it can reduce the overall audit burden on both suppliers and drug manufacturers.

Rx-360 offers three types of audits: "collaborative audits," in which several MAHs ask Rx-360 to have one supplier audited and the MAHs share the audit costs; "sponsor's audits," in which one pharmaceutical manufacturer covers the costs of the audit, the report of which is then released to additional requestors for a fee; and "subscription offers," in which manufacturers can access the available audit reports of the consortium for a fee.

Rx-360 organizes the audits but commissions their execution to external auditors. These auditors must comply with a set of minimum qualifications including, but not limited to, a minimum of five years of GMP operational pharmaceutical experience, involvement in at least five audits of the relevant supplier/audit type, and at least three conducted audits in the last 12 months. The Rx-360 audit guidelines are based upon regulatory standards as well as best practices; the standard for API audit and the corresponding report matches the structure of ICH Q7 (18, 19).

CEFIC/APIC. CEFIC is an association of chemical manufacturers in Europe. CEFIC's Active Pharmaceutical Ingredients Committee (APIC) has started the "APIC Audit Program" as a third-party program for auditing API manufacturers and contract manufacturers as well as distributors. Its aim is to offer a turnkey solution for auditing GMP compliance of API manufacturers and/or distributors. Audits can be initiated by one or more MAHs "in order to get independent information about the GMP compliance status about the API supplier (e.g., when preparing for authority inspections)" (20). Audits can also be initiated by an API manufacturer. It should be noted, however, that, at least for the time being, European competent authorities generally will not accept self-initiated audits.

As with Rx-360, auditors working for the APIC Audit Program must fulfill a strict set of formal requirements and pass through APIC's own training courses. As a rule, APIC audits will be performed by two auditors for two days. These audits result in a standardized report that is not tightly bound to ICH Q7 but will include "detailed descriptions of all subjects covered during the audit, objective evidence for any GMP deficiencies found during the audit" and an unambiguous rating of these deficiencies (20).

Apart from larger association initiatives, such as Rx-360 and CEFIC, other company initiatives exist, ranging from intercompany associations such as the German Association of Research-Based Pharmaceutical Companies (Verband forschender Arzneimittelhersteller, VfA), in which audit reports are only shared between members to Diapharm, a company that markets accredited API GMP audit reports to pharmaceutical companies.

VfA. Roughly 20 members of VfA have started an exchange-scheme for audit reports, called JA VfX, through which the audit results can be shared with other members of the community. Audit standards and criteria for auditor selection, however, are not made transparent to nonmembers.

AFA. The Asociación Fórum Auditorías (AFA) was founded in Spain in 2005 by pharmaceutical companies to provide an infrastructure to satisfy requirements for supplier validation. AFA offers joint sponsorship of audits by common interest or by campaigns for distant geographical areas, sharing travel and accommodation expenses. Differing from initiatives such as Rx-360 or Diapharm, AFA not only organizes the audit, but also conducts the audit with its own auditors who need to demonstrate, among other qualifications, a minimum of two-year's experience working in an organization regulated by GxP principles, holding an upper-management position, and audit execution experience prior to any AFA-internal training course. Information on AFA's auditing standard has not yet been published.

Diapharm. Diapharm, an international pharmaceutical service provider with offices in Germany, Austria, and the UK, started an API GMP auditing scheme in 2008. Audits can either be ordered by one or by several pharmaceutical companies. As a speciality, Diapharm also offers a joint audit even if each MAH obtains a different API from the API manufacturer. Again, the actual audits are conducted by external auditors. The audit as well as the audit report (35 to 70 pages) match the ICH Q7 standards. Auditor qualification standards are among the highest in the industry in that Diapharm only commissions audits to inspection bodies that are accredited according to ISO 17020.

EXCiPACT. In 2009, a group of industry experts from the European Fine Chemical Group (EFCG), the International Pharmaceutical Excipients Council (IPEC) Europe, IPEC Americas, the European Association of Chemical Distributors (FECC), and the Pharmaceutical Quality Group (PQG) set out to develop a certification scheme for excipient suppliers. The resulting consortium, EXCiPACT, is starting an auditing scheme to provide independent third-party certification of manufacturers, suppliers, and distributors of pharmaceutical excipients (21). EXCiPACT's guidelines are dedicated to excipients only and are rather detailed and state-of-the-art. Auditor requirements again are comparable to Rx-360, with a detailed standard having been defined based on ISO 19011, a standard for auditors; ISO 17021, a standard for certification bodies; and additional items.

Conclusion

GMP and GDP audits of pharmaceutical material suppliers are legally required and are crucial to support the safety of drug products. High quality audits by independent third parties and the sharing of such audits between pharmaceutical manufacturers are important means to reduce the burden for MAHs and API suppliers alike. Organizations such as Rx-360 or EXCiPACT help by setting and enforcing the necessary quality standards for these third party audits. As a consequence, effective and efficient GMP auditing is turning into daily practice more and more, thus resulting in fewer but better and more thorough audits.

Stefan Kettelhoit* is managing director at blue inspection body GmbH, Hafenweg 18-20, 48155 Muenster, Germany, tel: 49 251 625620 40, stefan.kettelhoit@blue-inspection.com. Martin van Trieste is senior vice-president of quality at Amgen and a member of the Rx-360 board of directors.

*To whom all correspondence should be addressed.