Auditing by the Numbers

In the pharmaceutical industry, the most frequently audited facilities are without a doubt contract organizations. These organizations are constantly being audited by prospective clients, existing clients, global and domestic regulatory authorities, and their own staffs. They deal with due diligence, regulatory quality systems, routine GMP inspections, preapproval inspections, and internal audits on a monthly, if not weekly basis.

Susan J. Schniepp

Audits can last anywhere from 1 day to 3 weeks depending on the type of audit being performed. In addition to typical audits, such as yearly GMP assessments by clients and regulatory authorities, contract organizations can also be tasked with "for-cause" audits by inspectors due to customer complaints or product recalls. Clients might also decide to perform a "for-cause" audit if the contract organization manufactured a number of lots with associated investigations for deviations during the manufacturing process.

To stay ahead of the audit game, contract organizations must have a system for handling audits that is efficient, consistent, and flexible. A great deal of experience among the audit team is necessary because the team must be audit ready all the time while also assuring that the company's other departments maintain an audit-ready posture. The group must have the ability to host more than one audit at a time and be able to address questions and provide documents—in a timely manner—for as many as three auditors per group. The team must also be prepared to provide some of the same information to more than one group at the same time.

Admittedly, handling two separate audit groups with two to three auditors each is an unusual situation. However, let's say that a contract organization has 14 clients and each client requires an annual GMP audit. To maximize audit time, each client brings two auditors and plans for a 3-day visit. Considering that each audit requires one day of preparation and one day of follow-up activities for the contract organization, each audit ultimately takes up one week of the organization's time.

Let's also assume that the contract organization is trying to attract new business. It has five potential new clients that wish to perform a quality audit before entering into a contractual agreement. In addition, let's assume that the organization provides sterile injectable products (or a similar product) to the global market, placing it in the high-risk category of manufacturing. This classification would result in annual GMP audits from, at a minimum, the regulatory agencies of the US, Europe, and Japan. Agencies typically spend 1 to 2 weeks conducting cGMP audits.

Because contract organizations also must perform internal audits, which typically last one week and occur once a quarter, the numbers above equate to approximately 26 weeks or half of a year devoted to handling and conducting audits. This amount of time does not take into account preparation of responses to any potential audit observations or necessary follow-up activities.

To successfully accommodate all of these audits, a contract organization must maintain a full-time contingent. Organizations must be aware that the time commitment entails more than preparing and hosting audit groups. Each audit could easily take 4 to 5 weeks when considering preparation, hosting functions (both escorting and staging room activities), responses, and followup.

In addition, the organization must have a unique layer of resources to manage internal cGMP audit programs, which are required by regulators to ensure that each facility has a process for meeting compliance. Typically, these resources are passed on to customers as part of the cost for a contracted operation.

Given these expectations, there seems to be an opportunity for industry to work with consortiums such as Rx–360 or the International Pharmaceutical Excipients Auditing (IPEA) program to share audits and thereby ease overall costs and time tied to the audits. Moving in the direction of shared audits, however, requires more consistent interpretations and expectations, general acceptance of responses, and perhaps a certification process.

Companies using contract services must be willing to share their audit programs and compromise on what should be the ideal approach to assessing GMP compliance of contract organizations. They must agree to a set of criterion to be consistently applied for auditing and they must be somewhat consistent in their interpretation of the regulations. This would allow contract organizations to be able to maintain a robust quality system that is suitable for multiple clients. The use of shared audits has been discussed for quite a while and it seems that Rx–360 and IPEA have started down the road of solving the problem for raw-material suppliers. Let's hope they agree to continue with the process and help out contract organizations in the same manner.

Susan J. Schniepp is vice-president of quality at OSO Biopharmaceuticals, susan.schniepp@osobio.com.