2. Health authority references to compliance monitoring
Paragraph 111 of Directive 2001/83/EC stipulates that the monitoring of API manufacturing is the duty of the respective competent health authorities. Inspections of API manufacturers by the authorities are mainly conducted if there is a specific reason, especially for foreign API manufacturers.  In Germany, only APIs of human, animal or microbiological origin or from genetically modified microorganisms require inspection; this is also true for APIs, contained in investigational clinical products. Generally in Europe, there is the basic principle that European MAHs are subject to systematic monitoring by the respective competent health authority. The MAH is obliged to qualify and audit its API suppliers around the world, and this is then subject to systematic verification during inspections. In the future, the new regulations stipulate that official inspections will no longer be required for APIs if it can be demonstrated that the monitoring authorities in the country of origin can prove a standard of GMP comparable to that in the EU and feature on an Approved Inspectorate List which is to be created by the European Medicines Agency (EMA). However, it is already expected for manufacturing authorisations and GMP certificates issued by authorities in the countries of origin to be enclosed with the documentation.
Instructions on how a MAH should conduct its “audits at the manufacturing and distribution sites of the manufacturer and distributors of active substances” can be derived from an EMA Guidance.  According to this document, during the GMP inspections performed at the MAH, it must be able to prove to the respective health authority that:
- an auditing/qualification SOP for suppliers and an audit schedule for API manufacturers has been established,
- API manufacturing is audited regularly for GMP compliance, i.e. approximately every 2 – 3 years,
- the audit is summarised by creating corresponding audit reports that are assessed by experts and that the documents are available for discovery by authorities.
A question and answer document issued by the EMA to accompany this guidance explicitly points out that an audit based on documents alone, for example performed using GMP questionnaires and submission of ISO certificates “cannot replace on-site audits of active substance suppliers”.  Even GMP certificates from health authorities in non-EU or European countries cannot replace an audit.
It is however explicitly permitted to use so-called Third-Party-Audits instead of an MAH having to perform its own audit. In this way, there is at least some decreased burden for the pharmaceutical industry, along with the related direct responsibility in delegating this task. The prerequisite for the acceptance of such Third-Party-Audits is the fulfilment of the following conditions:
- the respective contract auditor must be qualified by the contractor,
- a written contract must be established and signed between auditor and contractor,
- absence of any conflicts of interest between auditor and auditee.
These requirements have been fixed by interest groups or are laid down in the above-mentioned question and answer document from the EMA or in respective national legal regulations (in Germany for example in §11 of the AMWHV).
Upon closer examination, especially in connection with the requirements of Annex 16 of the EU GMP Guideline, it becomes clear that the requirements for Third-Party-Auditors are quite challenging. According to the EMA and also the European Qualified Person (QP) Association, Third-Party-Auditors must be able to prove that they are qualified; they must be independent and free of any potential conflicts of interest – for instance no financial relationships between the auditor and the auditee. In addition, the QP Association points out explicitly that such audits must be API specific and must have a minimum duration of two days (audits of shorter duration require a risk-based justification). [20, 21]
The release of (finished) drug products in the European Union is the personal responsibility of the QP from the pharmaceutical company supplying the products to the market. The QP thus takes on the legal responsibility for the product and represents to a certain extent the last entity in the entire manufacturing chain. In so doing, the QP also takes on the responsibility for the quality and the validity of the GMP audits of the manufacturing of the API. As an example, when an application for a marketing authorisation, variation or renewal is made in the EU for a medicinal product, the QP has to submit a declaration to the EMA and other regulatory bodies about the GMP conformity of the APIs used. For this purpose, the EMA has produced a QP declaration template, along with a question and answer document. [5, 6]
The QPs should take the monitoring of API GMP compliance very seriously, as can be derived from the Compilation of Community Procedures of the EU regulatory bodies . If an (event-driven) inspection of an API manufacturer conducted by a competent health authority discovers significant deficiencies, the European medicinal product manufacturer using this API, and especially its QP, are judged as responsible and personally liable:
“Serious GMP non-compliance found at an active substance manufacturer means that manufacturing authorisation holders using the active substance in question as a starting material have failed to fulfil their legal obligations and therefore action may be taken against the manufacturing or import authorisation or QPs connected with it.” 
Also, in view of criminal activities which repeatedly come to light , tight monitoring of the API manufacturers used is required. For this purpose, local authorities and inspectorates and their European counterparts need to cooperate closely.
As on-site auditing time is often very limited, inspectors, QPs or other GMP auditors are not able to cover every detail of the API manufacturing process during inspections and audits. This shows that it is necessary to conduct a risk-based evaluation and assessment of the GMP compliance level at the API manufacturing site, in order to fulfil the legal, regulatory and also internal requirements.