Fewer but better audits
So, wouldn't it be a great idea for the MAH to concentrate on those audits that are most important to the company? But which
audits are most important? All APIs need auditing. A risk-based approach will only help to prioritize which API needs to be
audited first. Audits can, however, be prioritized not only according to risk, but also according to their individual relevance.
Even though an API may pose few risks, it can still be extremely relevant to the MAH, for example, because of the intellectual
property involved, the sheer quantity of the API, or any number of other reasons. It would be prudent to prioritize audits
into those that the MAH will conduct and others that can be sourced out. The MAH would concentrate on audits that are most
important to him. All other audits can be sourced out to a third party.
This approach especially makes sense for APIs that are used by several MAHs. Currently, each MAH will send an auditor to the
API manufacturer, so that the same manufacturing process is being checked over and over again. From a quality point of view,
this situation is not advisable. The overall time spent in auditing the API and the burden put on the API manufacturer are
considerable, each single audit is relatively short, and the same aspects are likely to be audited repeatedly while other,
equally important aspects, tend to be left out of an audit. It will, therefore, be much more efficient if MAHs pool the effort
spent on auditing an API. The combined audit could be more thorough, although still being considerably shorter than the current
sum of individual audits. Sharing an API audit thus does improve audit quality and reduces the burden for API manufacturers.
EMA has explicitly permitted such third-party audits, provided that contractual arrangements are made corresponding to Chapter
7 of the GMP Guide and that the auditor does fulfill certain requirements (5). Industry initiatives, which are discussed in
the "Industry initiaves" section of this article, help in this situation (17). Most of these initiatives have set up strict
rules regarding auditor qualification. Most initiatives also have set their own standards for conducting the audit, so that
the buyer of the resulting audit report can expect certain minimum standards.
Rx-360. Rx-360 was founded in the US in June 2009 by volunteers from the pharmaceutical and biotechnology sectors, including branded
and generic-drug producers and suppliers. It aims to provide a broader, more thorough audit than is typically conducted. The
findings of Rx-360 audits can then be shared with multiple pharmaceutical firms, thus reducing the number of audits that a
supplier must host and that a pharmaceutical firm must conduct. In this way, the consortium believes it can reduce the overall
audit burden on both suppliers and drug manufacturers.
Rx-360 offers three types of audits: "collaborative audits," in which several MAHs ask Rx-360 to have one supplier audited
and the MAHs share the audit costs; "sponsor's audits," in which one pharmaceutical manufacturer covers the costs of the audit,
the report of which is then released to additional requestors for a fee; and "subscription offers," in which manufacturers
can access the available audit reports of the consortium for a fee.
Rx-360 organizes the audits but commissions their execution to external auditors. These auditors must comply with a set of
minimum qualifications including, but not limited to, a minimum of five years of GMP operational pharmaceutical experience,
involvement in at least five audits of the relevant supplier/audit type, and at least three conducted audits in the last 12
months. The Rx-360 audit guidelines are based upon regulatory standards as well as best practices; the standard for API audit
and the corresponding report matches the structure of ICH Q7 (18, 19).
CEFIC/APIC. CEFIC is an association of chemical manufacturers in Europe. CEFIC's Active Pharmaceutical Ingredients Committee (APIC) has
started the "APIC Audit Program" as a third-party program for auditing API manufacturers and contract manufacturers as well
as distributors. Its aim is to offer a turnkey solution for auditing GMP compliance of API manufacturers and/or distributors.
Audits can be initiated by one or more MAHs "in order to get independent information about the GMP compliance status about
the API supplier (e.g., when preparing for authority inspections)" (20). Audits can also be initiated by an API manufacturer.
It should be noted, however, that, at least for the time being, European competent authorities generally will not accept self-initiated
As with Rx-360, auditors working for the APIC Audit Program must fulfill a strict set of formal requirements and pass through
APIC's own training courses. As a rule, APIC audits will be performed by two auditors for two days. These audits result in
a standardized report that is not tightly bound to ICH Q7 but will include "detailed descriptions of all subjects covered
during the audit, objective evidence for any GMP deficiencies found during the audit" and an unambiguous rating of these deficiencies
Apart from larger association initiatives, such as Rx-360 and CEFIC, other company initiatives exist, ranging from intercompany
associations such as the German Association of Research-Based Pharmaceutical Companies (Verband forschender Arzneimittelhersteller,
VfA), in which audit reports are only shared between members to Diapharm, a company that markets accredited API GMP audit
reports to pharmaceutical companies.
VfA. Roughly 20 members of VfA have started an exchange-scheme for audit reports, called JA VfX, through which the audit results
can be shared with other members of the community. Audit standards and criteria for auditor selection, however, are not made
transparent to nonmembers.
AFA. The Asociación Fórum Auditorías (AFA) was founded in Spain in 2005 by pharmaceutical companies to provide an infrastructure
to satisfy requirements for supplier validation. AFA offers joint sponsorship of audits by common interest or by campaigns
for distant geographical areas, sharing travel and accommodation expenses. Differing from initiatives such as Rx-360 or Diapharm,
AFA not only organizes the audit, but also conducts the audit with its own auditors who need to demonstrate, among other qualifications,
a minimum of two-year's experience working in an organization regulated by GxP principles, holding an upper-management position,
and audit execution experience prior to any AFA-internal training course. Information on AFA's auditing standard has not yet
Diapharm. Diapharm, an international pharmaceutical service provider with offices in Germany, Austria, and the UK, started an API GMP
auditing scheme in 2008. Audits can either be ordered by one or by several pharmaceutical companies. As a speciality, Diapharm
also offers a joint audit even if each MAH obtains a different API from the API manufacturer. Again, the actual audits are
conducted by external auditors. The audit as well as the audit report (35 to 70 pages) match the ICH Q7 standards. Auditor
qualification standards are among the highest in the industry in that Diapharm only commissions audits to inspection bodies
that are accredited according to ISO 17020.
EXCiPACT. In 2009, a group of industry experts from the European Fine Chemical Group (EFCG), the International Pharmaceutical Excipients
Council (IPEC) Europe, IPEC Americas, the European Association of Chemical Distributors (FECC), and the Pharmaceutical Quality
Group (PQG) set out to develop a certification scheme for excipient suppliers. The resulting consortium, EXCiPACT, is starting
an auditing scheme to provide independent third-party certification of manufacturers, suppliers, and distributors of pharmaceutical
excipients (21). EXCiPACT's guidelines are dedicated to excipients only and are rather detailed and state-of-the-art. Auditor
requirements again are comparable to Rx-360, with a detailed standard having been defined based on ISO 19011, a standard for
auditors; ISO 17021, a standard for certification bodies; and additional items.
GMP and GDP audits of pharmaceutical material suppliers are legally required and are crucial to support the safety of drug
products. High quality audits by independent third parties and the sharing of such audits between pharmaceutical manufacturers
are important means to reduce the burden for MAHs and API suppliers alike. Organizations such as Rx-360 or EXCiPACT help by
setting and enforcing the necessary quality standards for these third party audits. As a consequence, effective and efficient
GMP auditing is turning into daily practice more and more, thus resulting in fewer but better and more thorough audits.
Stefan Kettelhoit* is managing director at blue inspection body GmbH, Hafenweg 18-20, 48155 Muenster, Germany, tel: 49 251 625620 40, email@example.com. Martin van Trieste is senior vice-president of quality at Amgen and a member of the Rx-360 board of directors.
*To whom all correspondence should be addressed.