Howard Silver is the manager of GMP compliance at Cubist Pharmaceuticals.

Howard Silver

Whether for reasons of risk management, capacity requirements, capital limitations, or lack of available human resources, pharmaceutical companies are increasingly entering into outsourcing relationships for the management of their supply chains. Outsourcing allows a company to realize the benefits of production and sales without maintaining infrastructure or making large capital investments. Although such relationships are advantageous, the pharmaceutical company entering into them retains ultimate responsibility for the quality of its compound. Therefore, careful consideration must be given in the selection and review of an outsourcing provider to ensure compliance. 

A company must first determine whether outsourcing is needed. The answer can be as simple or as complex as a given supply chain and may comprise several answers. The company must make a clear-eyed evaluation of its strengths and weaknesses, its available resources, and its risk tolerance to develop an outsourcing model that is applicable to its unique situation. For companies in need of outsourcing, this article serves as a guide for selecting where outsourcing should take place. 

The factors to consider when selecting an outsouring provider and the relevant questions a company should ask include the following: 					

Capability: Does the provider have the equipment, personnel, and experience to meet my outsourcing needs? Are investments needed to close any gaps to meet this needs? Does the facility have a history in my area of interest?

Capacity: Will my product be fighting for share of voice with others?

Commitment: Is the company financially sound? Have we reviewed their annual report? What is the long-term view of the company?

Competition: Does the company work with our competition? Do we have guaranteed access to capacity? Are there systems in place to protect proprietary information?

The first stage in entering into outsourcing, then, is ensuring that a potential partner has the infrastructure, experience, and financial health to provide assurance that the project will succeed. It will do no good if the company has excellent systems and equipment but is ready to shut its doors because of a lost contract. Conversely, a company with a strong balance sheet may not have the right experience that would be required. More, a sponsor company and its competition may arrive at the same conclusion, and so the sponsor's information must be protected and product supply needs must be ensured. With these answers, the sponsor company can proceed with confidence to evaluating the compliance capabilities of the supplier. 

Each product and process is different. Therefore, ensuring compliance in an outsourced model must take into account the specific needs of the product in the context of GMPs and other relevant regulations. 

In the United States, for example, the US Food and Drug Administration expects drug, medical device, and biologics manufacturers to have an active facility and supplier audit program, even though there are no specific requirements in the regulations that show that audits of the quality systems have been conducted. Although the word 

 Parts 210 and 211, the requirement for and responsibilities of a "quality control unit" are nonetheless elucidated. FDA currently takes a systems approach that includes the quality system, facilities and equipment, materials management, production, packaging and labeling, and laboratory controls. The elements of these systems are defined in 21 

 211 and in the various FDA guidances and should be included in the audit. 

Audit checklists can cover all areas of production, from the receipt of raw materials to final release of product, as well as support systems and controls. Or, they can be custom made by the auditor to ensure that each term in the audit plans is specifically addressed. The following are a sample checklists an auditor might use to perform a GMP lab audit. 

Does the quality assurance (QA) staff review calculations, weights, record completeness? Does it perform final approval?

Are procedures in approved, written documents?

Does the QA staff review all deviations and investigations?

Does the QA staff routinely review production records to ensure that procedures are followed and properly documented?

Is there a standard operating procedure that defines the QA department's responsibilities?

Is there a standard operating procedure (SOP) for investigation of out of specification (OOS) results?

Does it describe notification, investigations, product impact, corrective actions, trending, regulatory reporting?

Are investigations performed in a timely manner?

Are investigations thorough and complete?

Are corrective actions followed up in a timely manner?

Is all documentation associated with the routine testing approved?

Does the QA unit have an authorized person or department specifically charged with the responsibility of obtaining approval by signature/date for production and testing procedures, forms, and records?

Is there an SOP that defines the scope and roles and responsibilities for the document control and retention system?

Are all production and control records specifically associated with a batch maintained at least one year after the expiration date of the batch?

Is there a document control procedure that would prevent the use of invalid or obsolete documents?

Are there SOPs covering all elements of the change control process?  Do change requests include description, requirements (e.g., revalidation), impact evaluation, and effective date designation?  

Is change control documented, evaluated, and approved?  

Is a procedure in place to ensure that personnel are trained on the changes in a timely manner?  

Are customers notified of critical changes?

Review some change requests and ensure that they are implemented according to procedure.  

Are personnel trained to perform their assigned tasks? By what method? Are training materials, including GMP training materials, available?  

Indicate how on-going, periodic GMP training is accomplished, including training following an operator or analyst error.

Is all training documented in writing that indicates the date of the training, the type of training, and the signature of both the employee and the trainer?

Does a formal auditing function exist in the QA department?  

Does a written SOP specify who shall conduct audits and qualifications (education, training, and experience) for those who conduct audits?

Does a written SOP specify the scope and frequency of audits and how such audits are to be documented?  

Articles

The authors provide detailed lists of important checkpoints to consider when selecting an outsourcing provider.