Legal and economic framework

During the past years, active pharmaceutical ingredients (APIs), especially those for generic products, have evolved more and more towards globally available trading goods. It is estimated that more than 80 percent of the starting materials and APIs used for manufacturing finished medicinal products in Europe and the USA are sourced from third countries outside the European Economic Area (EEA) or the USA [1] – with constantly increasing tendency. Due to financial reasons these materials are purchased from manufacturers in e.g. India and China.

However, especially for medicinal products and the APIs contained herein, cost savings must by no means have any impact on the final product quality. The manufacturing authorisation holder (MAH) of medicinal products is therefore obliged according to Article 46f of ‘Directive 2001/83/EC’ „to use as starting materials only active substances, which have been manufactured in accordance with the detailed guidelines on good manufacturing practice for starting materials.“ Clearly this sentence refers to the currently valid GMP guidelines of the European recipient country and not to the GMP guidelines of the manufacturing country, which can be somewhat different from those in the EC [2].

Thus, for import and use of APIs in Europe EU GMP guideline part II has to be followed in the country of manufacturing. For all practical purposes this guideline is identical with ICH Q7. Since the latter is better known in third countries, further reference in the following text is only made to ICH Q7. All points mentioned in this article can be found at the same place within the EU GMP guide part II.

The obligation of assessing the GMP compliance of suppliers for (critical) materials as laid down in Directive 2001/83/EC has been transferred into national law, e.g. to §11(2) of the German AMWHV regulation. This paragraph is phrased “The conduct of on-site examinations (audits) through sufficiently well trained personnel of the pharmaceutical manufacturer [is to be stipulated], as far as the manufacturers of active pharmaceutical ingredients or -where applicable- also other critical starting materials for the production of medicinal products are concerned. Instead of own audits the pharmaceutical manufacturer may also revert to adequate knowledge of third parties.” The preparation and conduct of such audits has been elaborately presented elsewhere. [3]

How serious those audits have to be taken for manufacturing authorisation holders can be derived from the current draft of the EMEA Community Procedures (EMEA/INS/GMP/23567/2009, pending adoption). It is phrased: “Serious GMP non-compliance found at an active substance manufacturer means that manufacturing authorisation holders using the active substance in question as a starting material have failed to fulfil their legal obligations and therefore action may be taken against the manufacturing authorisation or QPs connected with it.” [4] Regular audits and meaningful and comprehensive audit reports are indispensable in order to cope with this threat.

Even more specific is the Danish Ministry of Health Lægemiddelstyrelsen. Their “GMP requirements for API – questions and answers” require under point 5-7: “The pharmaceutical manufacturer must have audit reports on all its API manufacturers (in respect of manufacturing, packaging, repackaging, mixing, labelling, relabelling and supplementary labelling). […] From 17 December 2005 the medicinal products of an API manufacturer who is not audited are quarantined on inspection until the API manufacturer has been audited.” [5]

Interestingly enough there is a lack of standardisation for the documentation of the audit results, although the audit report represents the key element for proving evidence of GMP compliance for the used APIs. Only the audit report can demonstrate whether the audit itself was conducted according to the applicable requirements.

Documentation of the GMP compliance status

For the Qualified Persons (QPs) responsible for the GMP compliance of finished medicinal products, an audit report is rarely more than short minutes, covering briefly the findings gathered on site. The own experience of good manufacturing practices seems to be enough proof of evidence; the audit report is often regarded as a necessary but cumbersome and difficult to handle obligation. But this perception bears fundamental mistakes.

First and foremost, the “(supervising) competent authority cannot assess the the Qualified Person’s experiences. The audit report therefore represents the single most important clue for judging the adequacy of the examination of the supply chain by the manufacturing authorisation holder [6]: “Examination, by inspectors, of the audit programmes used by authorisation holders for conducting regular audits (every 2 – 3 years), including review of audit reports, is one of the primary means by which Competent Authorities will determine if manufacturing authorisation holders are in compliance with [Article 46(f) of Directive 2001/83/EC and Article 50(f) of Directive 2001/82/EC].”

Secondly, the audit report should serve as a guide for the auditee to overcome deviations from good manufacturing practices. Therefore the identified deficiencies have to be laid down in a comprehensible manner.

And thirdly, because audits are often performed less and less by the Qualified Person personally: be it due to language obstacles, economic necessities or because the subsequent processing requires the presence and 24-hours of availability. Third-Party-Audits therefore gain more and more acceptance. On behalf of the Qualified Person(s) of one or several pharmaceutical manufacturer(s), the appointed auditor visits the respective manufacturing sites in order to evaluate and assess the GMP compliance status of the API manufacturing production and to report the result to the contract giver(s). In these cases the audit report is the only medium for the responsible Qualified Person to assess the manufacturing quality of the API sourced from India or China.

Consequently, the audit report has to reflect all GMP relevant observations of the audit in an unambiguous, understandable and most importantly in a comprehensive manner.

Formal layout of the report

A specified and accepted standard for the contents of audit reports is not (yet) available. In practice, different layouts such as structured text, tables, tick boxes and also mixtures thereof are used. Preferred are reports, which are formally derived form the “GMP Inspection Report – Community Format” of the EMEA [7]. The competent health authorities are familiar with this report format, which will allow them to quickly get an idea about the underlying audit. This “Community Format” of the EMEA contains the following elements:

• Inspected site(s)
• Activities Carried out
• Inspection date(s)
• Inspector(s)
• References
• Introduction
• Brief report of the inspection activities undertaken
  (Scope of Inspection; Inspected area(s))
• Activities not inspected
• Personnel met during the inspection
• Inspectors findings and observations relevant to the inspection; and deficiencies
  (Headings to be used: Overview of inspection findings from last inspection and the corrective action taken, Quality Management, Personnel, Premises and Equipment, Documentation, Production, Quality Control, Contract Manufacture and Analysis, Complaints and Product Recall, Self Inspection; Distribution and Shipment; Questions raised relating to the assessment of a marketing application; other specific issues identified; Site Master File)
• Miscellaneous
  (Samples taken)
• Annexes attached
• List of Deficiencies classified into critical, major and others
• Recommendations
• Summary and conclusions
• Name(s), Signatures(s), Organisation(s), Date

However, the report format employed by authority inspectors is not ideally suited for API-specific GMP audits within the pharmaceutical industry. First of all, the specifications for the narrative key part of the audit report, the “Inspectors findings and observations relevant to the inspection; and deficiencies” are rather directed to finished medicinal products than APIs. This item will be covered later in this article. Furthermore some topics, which should in fact not be missing in every audit report, are not covered. In particular:

• the illustration of the on-site audit extent,
• the different product quality grades manufactured,
• the manufacturing activities performed during the course of the audit,
• the documents reviewed during the audit including their respective revision version, and
• the qualification of the auditor(s).

These aspects are eminently important for the subsequent assessment of the audit report. Therefore the extent of the on-site audit part should be phrased as accurately as possible. Within the EMEA documents it is only stipulated that “Activities not inspected” should be indicated, if this is deemed to be necessary. This potentially selective description of areas (not) audited would, however, not allow subsequent readers of the audit report to appropriately review the audit extent.

Manufacturing of several different product quality grades at a certain production site takes immediate effect on the preparation of the audit and the priorities selected for the audit. An evident example can be derived from the field of excipients, which are frequently produced by one manufacturer for many different applications. Lactose is used in Dry-Powder-Inhalers (DPI) as a carrier for APIs but tons of Lactose are manufactured at the same time as a filler for oral solid dosage forms. In addition, even higher amounts are used for non-GMP regulated applications. The first application mentioned bears of course much higher quality requirements concerning e.g. purity, microbial load or particle shape and particle size distribution. Special attention should consequently be given to packaging, labelling, storage and re-use of material. If the audit report does not contain any reference to different material quality grades and/or specifications, a subsequent reader may not be able to understand whether the audit scope fully covered the existing risks.

It is also of major relevance for the audit report whether the audited API was being manufactured during the course of the audit at all and, if yes, which steps of the synthesis. From article 46(f) of Directive 2001/83/EC arises that supplier audits, as a matter of principle, have to be conducted specifically for every single API. It is therefore in any case recommended to audit a manufacturer when the respective API production is running. In practice, this will not always be possible and an exhaustive audit of the entire synthetic process flow may not be accomplished at all, since the single, sometimes quite complex manufacturing steps, will usually be executed sequentially and in a multi-shift operation. Rather frequently during audits the respective equipment of the site is “accidentally” just being cleaned, which allows for the auditing of the cleaning processes but not the good manufacturing practices. It is therefore mandatory that the audit report contains a description about the production status, the intermediates and APIs manufactured during the audit and the audited areas.

Besides the implementation level of cGMP requirements at the „shop floor“ level, the relevant GMP documentation, such as Standard Operating Procedures (SOP) of the auditee, has of course to be audited randomly. The documents reviewed should be clearly referenced in the audit report under the relevant report chapter –thus the SOPs covering training of personnel under the chapter “Personnel”, SOPs covering the materials management of raw materials under the chapter “Materials Management” and so on. In addition to (key) SOPs there are further important documents and records to be audited with regard to this:

• the often very comprehensive documentation concerning qualifications and validations (such as the qualification of the cleanroom, qualification of the water system, process validations, cleaning validation and validation of analytical methods etc.),
• (master)production instructions and (master)batch records,
• the Product Quality Review(s) including randomly exemplarily chosen records concerning Change-Control-activities, Failure Investigation, Corrective and Preventive actions,
• physicochemical and microbiological monitoring data (water, resp. other media, clean rooms/controlled areas) and
• GMP training records,
• the audit report should not only contain the title of the audited documents but also the document number and revision number.

The qualification of the auditor will be of minor importance in case of an audit being performed by the Qualified Person of the pharmaceutical manufacturer.

This question is, however, of more importance in the light of increasing amounts of Third-Party-Audits since the Qualified Person has to ensure by written documentation that the Third-Party-Auditor has the required competence, quality and independence to perform the audit. For Third-Party-Auditors belonging to an accredited (inspection) body, these qualification confirmations are part of the accreditation. Therefore this process of qualification is remarkably facilitated. Otherwise the Third-Party-Auditor is due to be audited (including audit report!) before performing the supplier audit.

Content structure according to ICH Q7

Fundamentally the audit report should provide a comprehensive picture about the GMP status of the auditee. API audits should therefore – in addition to the above mentioned formal requirements – cover the entire content of ICH Q7 (cf. table 1). It is therefore recommended to structure the narrative part of the report – “Inspectors findings and observations relevant to the inspection; and deficiencies” – according to the chapters of ICH Q7. This ensures that all the GMP relevant areas are in fact covered, and in a clearly arranged manner.

Within the audit report it should be laid down precisely which GMP aspects were only broadly covered and which were covered in detail. In view of the usually tough time frame of 1.5 to 2 onsite audit days, a selection of some areas to be audited in detail will have to be made. All the other relevant topics have to be considered at least to some extent – and this should be substantiated in the audit report. For example the entire storage areas (incoming goods, solvents, finished goods) should be audited at least briefly during the audit, as these areas provide good evidence of which products are in fact manufactured in the audited site in which qualities and steps of the synthesis. If the API to be audited was to be present in the incoming goods storage area, this would be a strong indication for additional supplies from third parties, maybe just to be relabelled at the respective site. The penultimate and ultimate synthesis step including the purification and often so-called “post-processing” steps i.e. drying, milling, sieving and packaging are recommended as further priorities for the on site part of the audit within a tight audit agenda. The final API product quality is most dependent on these process steps and thus the onsite auditing is most important for the subsequent assessment of the GMP compliance status of the API manufacturing and the related API product documentation. Besides the wet-chemical and instrumental laboratory, potential priorities for the audit of the quality control laboratory should be the storage area for retention samples, the climate chambers for stability testing and also the storage, handling and use of reference standards.

To rule out that different synthetic pathways are used or that API is bought from third parties resulting in different product qualities, the audit report should cover such topics as intermediates used, amounts of stored and manufactured goods or typical batch sizes and also – where applicable – a reconciliation of available API amounts compared to the documented ones.

A good audit documentation standard requires that all the observations made are not only noted but that these notes are structured, preferably according to the chapters of the ICH Q7 or EU-GMP guide. respectively. Only then it is ensured that the report covers the entire knowledge of the auditor about the audited site. Even though this clearly structured presentation of the audit results implies a considerable increase in workload for the author of the audit report, it is after all strongly recommended. A purely chronological report of “audit experiences” is in no case sufficiently appropriate to derive the GMP status – or the quality of the conducted audit – from the resulting audit report.

On the other hand, the structure according to ICH Q7 or the GMP guide may not always be sufficient. One example: item 6.21 of the ICH Q7 states, that “if equipment is dedicated to manufacturing one intermediate or API, then individual equipment records are not necessary if batches of the intermediate or API follow in traceable sequence.” API manufacturers, however, use the phrase “dedicated equipment” in several different manners: from “in this equipment only the audited API is manufactured (but also in other equipment)” to “the audited API is only manufactured in this equipment (but in different product qualities)”. The audit report has to provide a clear answer to the question which equipment is used within the production area for which purpose. Random checks of the respective available records are anyhow a matter of course. The results of these checks should also be given in the audit report.

Especially when auditing companies in Asia, it can frequently be observed that the qualification of clean room areas is reduced to the air handling units. For the audit report it is therefore not sufficient to provide only evidence about the qualification documentation (ICH Q7 item 12.30). This qualification documentation should also be assessed concerning the contents, since a missing qualification of the “entire clean room area” represents a GMP deficiency.

Deficiencies and Recommendations

The “GMP Inspection Report – Community Format” requires from GMP inspectors that for all identified deficiencies the related GMP rule is referenced in the audit report. If, for example, reagents without written shelf life are found in the laboratory, this would have be to be noted as a deviation from rule 11.16 of ICH Q7 (or EU-GMP Guideline part II).

This procedure will be helpful for both parties, as it ensures that the auditor will only take notes of actual rather than “felt” deficiencies. At the same time the target GMP standard is clearly laid down.
This procedure is of particular importance if the underlying GMP regimen of the auditee is based upon national GMP rules and not upon ICH Q7. As an example item 13.10 of the ICH Q7 states: “A formal change control system should be established to evaluate all changes that may affect the production and control of the intermediate or API.” The GMP guideline of the Chinese SFDA does not (yet) require such change control procedures. And the Indian Schedule M covers in chapter 26.5 changes to the manufacturing process. However, this is only judged as a task for the validation: “Significant changes to the manufacturing process, including any changes in equipment or materials that may affect product quality and/or the reproducibility of the process, shall be validated.” A clear reference of the deficiencies found according to ICH Q7 should therefore be obligatory.

If applicable, additional guidelines and regulations besides ICH Q7 have to be considered, which are not always sufficiently well known in third countries. Thus the evaluation of the water generation system of the auditee will usually give the result that the water is in line with the valid pharmacopoeial monographs and the water quality will be continuously monitored. However, for importation of APIs into the European Community the “Note for Guidance on Quality of Water for Pharmaceutical Use” [8] has to be observed as well. The unambiguous reference to the underlying regulations is of utmost importance in order to provide the opportunity to the supplier to understand any deficiencies found.

It is a well accepted standard that the detected deficiencies are classified according to the categories “critical”, “major” and “other/minor”. However, the detailed definition of critical, major and other/minor deficiencies is often missing. Since a dispute between the auditor and the auditee concerning the classification of a detected deficiency is to be expected, a clear-cut description and assessment during the audit (and not just in the audit report) is recommended. One example for such classification of deficiencies based upon the “Community Format” is given in table 2.

The auditor will finally provide an explicit conclusion, derived from the detected deficiencies, whether the audited manufacturing of the respective API is conducted according to current GMP requirements. It is highly recommended to ask a second audit expert, who was not involved in the respective audit, to perform an independent review of the audit report. This four-eye-process will make evident whether all the required GMP aspects have been covered, whether the results are unambiguously and comprehensively phrased and whether the audit results are reasonably well substantiated. After that, the audit report should easily pass the assessments of the competent authority or the Qualified Person of a pharmaceutical manufacturer.

Summary and Outlook

GMP audit reports represent the only proven evidence whether the confirmation of GMP compliance has in fact been derived from comprehensible audit observations. These reports therefore have to contain all GMP relevant findings in an unambiguous, understandable and complete manner.
Currently, a clearly defined standard for the structure and necessary elements of audits report is still missing. Structuring the audit report chapters according to ICH Q7 is suggested in order to cope with the criteria completeness and comprehensibility.

Competent authorities are paying more attention to ensuring GMP over the entire value chain [9]. At the same time, caused by steadily increasing amounts of counterfeited drugs, politicians want to increase the surveillance of manufacturers even further with the EC Pharma package. Finally, the pharmaceutical industry itself is more and more in favour of (shared) Third-Party-Audits, not least due to economic considerations. Consequently, the pressure for auditors is increasing to provide comprehensive and comprehensible audit reports.

It will be in the best interest of the pharmaceutical manufacturers to work towards an international standard of audit reports. Related efforts are currently underway, pioneered by the American Rx-360 consortium as well as the International Pharmaceutical Excipients Council (IPEC).

Literature

[1] cf. EMEA (2006): “Guidance on the occasions when it is appropriate for Competent Authorities to conduct inspections at the premises of Manufacturers of Active Substances used as starting materials” (EMEA/INS/GMP/313538/2006)
[2] see also: Kettelhoit, Stefan (2009): Compliance of APIs with international GMP regulations. In: PharmaAsia, June 2009. www.pharmasia.com

[3] Hösch, Christian: “Planung und Durchführung von Audits in Europa, Asien und Südamerika”, Pharm. Ind. 71, Nr. 6, 1035-1038.
[4] EMEA (2009): “Procedure for Dealing with Serious GMP Non-compliance or Voiding/Suspension of CEPs Thus Requiring Co-ordinated Administrative Action” (EMEA/INS/GMP/23567/2009)
[5] www.dkma.dk/1024/visUKLSArtikel.asp?artikelID=8127
[6] EMEA (2006): “Guidance on the Occasions When it is Appropriate for Competent Authorities ot Conduct Inspections at the Premises of manufacturers of Active Substances Used as Starting Materials” (EMEA/INS/GMP/313538/2006)
[7] www.emea.europa.eu/Inspections/GMPCompproc.html
[8] EMEA/CVMP/115/01
[9] Heisig Wolfgang / Amschler Uwe (2008): “Auditierung/Qualifizierung von Wirkstoffherstellern durch akkreditierte Stellen”. Pharm. Ind. 70, Nr. 12, 1459-1463.

(in: Pharmind, issue 2/2010, 242-247)