The Migraine Known As The Supplier Audit — And Some Simple Remedies
By Ken Christie, COO, VTS Consultants, Inc.
The topic of supplier audits can cause severe anxiety and headaches for many biopharma companies. This pain stems from the combination of having to understand the applicable regulations, determine the elements of a supplier audit in terms of criticality, establish the frequency and type of audits to be performed based on this evaluation, and follow-up on any issues found. Sufficient time is needed to prepare for and execute such activities, and time is one thing few of us have enough of. However, without adequately planning what needs to be done, how and when to do it, and how issues will be tracked and resolved when found, a supplier audit can easily become a failed exercise.
In this article, I will review the current regulatory expectations for the qualification of suppliers through the use of on-site audits and so-called “paper audits” — for those partners deemed as critical based on the potential impact to the final quality of your product. In addition, I will provide best practices for conducting the various stages of a supplier audit, based on lessons I’ve learned while performing such audits in the biopharma industry over the years.
Understanding Regulatory Expectations
The need for supplier audits is indicated and defined in numerous international regulatory documents. Following are a few examples:
- In Health Canada’s Good Manufacturing Practices (GMP) Guidelines, section 6.3.3 states that: “The available evidence should include an on-site audit report of the vendor, by a person who meets the requirements of interpretation 1 under Section C.02.006, addressing at least the following aspects:
- the nature and status of the manufacturer and the supplier and their understanding of the GMP requirements of the pharmaceutical industry;
- the Quality Assurance system of the manufacturer of the raw material; and
- the manufacturing conditions under which the raw material is produced and controlled.”
- Chapter 7 (Outsourced Activities) of the EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use states: “Prior to outsourcing activities, the Contract Giver is responsible for assessing the legality, suitability and the competence of the Contract Acceptor to carry out successfully the outsourced activities.” It further indicates that: “There should be a written Contract covering the outsourced activities, the products or operations to which they are related, and any technical arrangements made in connection with it.” While this article does not get into the expectations of quality agreements, it does highlight the expectation that such agreements should clearly define the expectations and responsibilities of both parties.
- In the U.S., 21 CFR 211.84 expects an assessment of suppliers as well, especially when companies accept certificates of analysis (C of A) for components or raw materials. When no, or minimal, additional testing is performed beyond what is accepted, the expectation is that the company has performed an assessment of the quality systems in place to ensure they meet current expectations and/or corporate requirements.
Writing A Supplier Qualification Procedure
What the aforementioned (and other) regulatory requirements and guidances fail to explicitly describe is what elements should be included in a supplier audit, or how the audit should be conducted. As such, the first thing a company must do is to write a procedure that not only defines these elements for its organization, but, just as important, that can also be adhered to, based on resources and procedural requirements. Some companies write procedures that they cannot uphold, despite their best efforts, and are eventually cited by corporate or third-party audits.
When writing a supplier qualification procedure, there are some basic expectations that should be included. The first item that should be addressed classifying your (often numerous) suppliers based on a risk assessment of their potential impact on the quality of the final product or component. The typical categories used for classification are critical, major, and minor. Examples of critical suppliers would include testing laboratories whose results directly impact product release, or companies performing calibrations that directly impact the accuracy of data provided by various instruments.
The second item often included in a supplier qualification procedure is a list of the “types” of audits that will be used — either paper, which is often a questionnaire-based form, or on-site. (I have seen companies use questionnaires as long as 28 pages to cover the typical areas examined during an on-site audit). The supplier classification would dictate the type of the audit required. Paper audits are commonly used for suppliers that are not rated as critical, since the accuracy of responses submitted is not always high. When an on-site audit will also be used, a questionnaire can serve as a guide to verify that all important items are addressed.
Preparing For An Audit
Before sending a paper audit to supplier, the questionnaire should be reviewed to ensure it addresses the issues associated with the applicable regulations against which the supplier will be evaluated. This is an area in which many pharma companies struggle. Often, they try to evaluate their suppliers against regulations that do not apply, even though suppliers often state up-front the applicable regulations or standards (such as ISO) to which it adheres. An effective audit — paper or on-site — is therefore based on an understanding of what regulations the supplier is required to abide by, not merely the expectations of the pharma company.
For an on-site audit, you need to schedule it well in advance and ensure the supplier will make the necessary resources available. Provide the supplier with an agenda at least two weeks prior to the audit, defining start and end times, specifying whether you plan on having a working lunch break, etc. At this time, you also should request copies of necessary documents, such as a standard operating procedure (SOP) listing, certifications, and quality manuals.
Do not be surprised if some of your requests are denied by the supplier. I had one supplier that refused to tell me the square footage of their facility! Despite finding such refusals hard to believe, the responses you receive from suppliers must be respected — but also noted in the final report.
And while it is uncommon, some suppliers today — especially those that must host countless audits — have begun to manage the demand on their time by either charging for the hours spent on site or limiting the amount of time they will devote to hosting an audit request. One very large and well-known supplier instituted specific dates throughout the year on which they would hosts auditors from around the world; they would not entertain on-site audits on any other days. Potential customers either performed their audits on these dates or waited another year before they could complete them.
Performing The Audit
In order to maximize the time allotted for an on-site audit, prepare by having a prioritized checklist of items to review based on the nature of the service, raw material, or component supplied. Typical areas to be covered in an audit checklist include: general company information/history, organizational charts and personnel, facilities, equipment, computerized systems, quality systems and document control. Under each of these areas, more specific topics would be covered as defined in the applicable regulation that applies to the supplier.
During the opening meeting, explain to the supplier that you will only focus on the equipment, areas, procedures, and processes that apply to the item, material, or service they will provide to your company. This helps both parties avoid wasting time on details that have no impact on the partnership.
When performing the audit, record details like the title, number, revision, effective dates, etc. of all procedures reviewed, along with any documents that are presented to you. Names and titles of people interviewed should also be recorded.
Do not be afraid to ask questions. And when observations are made, evaluate them for potential risk and assign them a rating (critical, major, or minor, for example) before presenting them at your wrap-up meeting. This will give your supplier a chance to ask questions and provide explanations, especially if they disagree with the rating.
The wrap-up meeting should cover all items that you will ultimately include in your final report — there should be no surprises when the supplier receives the report. Suppliers should also be informed of the timeline when their written responses to observations will be due.
One important piece of advice regarding the audit process: Remember that you are dealing with people and not just assessing processes and equipment. The supplier should feel that, despite the observations you may have, you are there to tell them how to remedy your observations and even make recommendations for improvement. Audits should benefit both parties. Take the time to make observations that the supplier will understand, and be willing to explain the reasons behind your concerns — and offer suggestions. Suppliers do care, as you represent their business and their means for success.
After The Audit
I once gave a seminar on auditing practices, and after the presentation one of the attendees said, “I think there is more work after an audit than preparing for it.” In fact, this is a very true statement.
Upon completion of the audit, the final report must be written and reviewed prior to sending it to the supplier. The report should clearly list the observations that you made and discussed during the wrap-up meeting, along with their classification in terms of severity. It is also important to list the respective regulatory requirement against which the observation was cited, when applicable. This provides the verification that the observation was not a subjective opinion but one that can be defended.
The second item that should be indicated in the report is the timeframe in which you expect responses to be received for each observation. Common industry practice is 20 business days, and I have found this time period to be reasonable in almost all cases. At the same time, you should expect that, for some observations, the supplier will feel that their current practices are acceptable and will take no further action. This can be acceptable, but make sure that they provide adequate proof and that you agree to it.
Finally, do not just communicate negative observations — let them know what practices you were impressed with, and to thank them for taking the time to host your audit. Kindness goes a long way in building business relationships, but sadly it is often overlooked.
One final note: When the evaluation process is completed for your suppliers, the one item that should follow — though it is beyond the scope of this article — is the development of a supplier quality agreement. This document is clearly defines the expectations and responsibilities for both parties. It also addresses the specifications for what you will purchase, the understanding that audits will be conducted on a routine basis, and, most importantly, the issue of change notification by either party. This agreement should be in place and approved before you begin to purchase the items or services you seek.
About The Author:
Ken Christie has over 30 years of sterile manufacturing and regulatory GMP consulting experience in the areas of quality assurance and validation management in the pharmaceutical and biotechnology industries. He is currently the COO for VTS Consultants, Inc., located in Amherst, MA. His responsibilities include quality system auditing, GMP training, and serving as a subject matter expert for aseptic manufacturing processes, equipment and utilities, medical devices, and solid dosage processes on a global basis. Mr. Christie also performs vendor audits, conducts site pre-approval inspections, and assists clients with addressing and correcting regulatory observations.
Mr. Christie was the validation manager at Parke-Davis' sterile products facility, where he was involved in the review and approval of all facilities, equipment, and system commissioning/qualification activities. He had routine interaction with the FDA and European inspectors (EMEA), corporate management, and third-party contract manufacturing representatives to defend validation practices and to assure regulatory compliance for the manufacture of aseptically produced products.
Mr. Christie is a speaker and trainer for several professional organizations in the U.S., Canada, Europe, and Asia and is a published author of several articles dealing with the challenges of aseptic processing. Additionally, he has served as a member of the ISPE’s Professional Certification Commission (PCC) as an Examination Development Committee (EDC) member.
Mr. Christie earned a bachelor’s degree in biology from Shippensburg State University (PA) and an executive MBA degree from Michigan State University. You can connect with him on LinkedIn or contact him at ken_christie@vtsinc.net or 413-253-0077.