Risk-Based Auditing of Active Pharmaceutical Ingredient Manufacturers – Recommendations for Standards and Minimal Requirements


The safety of medicinal products is to a major extent determined by the quality standards adhered to during manufacturing and quality control. Manufacturing Authorisation Holders (MAHs) are therefore obliged to use audits to ensure that all active pharmaceutical ingre- dients (APIs) used comply with Good Manufacturing Practice (GMP). However, a generally accepted standard for such audits, i. e. documented (minimal) requirements for the on-site time and content of audits, does not exist. Based on regulatory guidelines and the wide-ranging experience of the authors, the purpose of this article is to develop a proposal for just such a standard for the auditing of GMP-compliance for APIs. It is thereby intended to con- tribute to international consensus building and acceptance for such (minimum) audit requirements in order to overcome the uncer- tainties and divergence in this area which still currently prevail.

in: Pharm. Ind. 74, No. 6 (2012)
Dr Stefan Kettelhoit, Blue Inspection Body GmbH and Dr Rudolf Völler, Regierungspräsidium Darmstadt

1. Obligation to monitor API GMP compliance

Within the European Union (EU), the Qualified Person (QP) of the Manufacturing Authorisation Holder is responsible for the GMP compliance of the manufactured medicinal products. Besides other duties, the QP is thereby also responsible for monitoring the GMP compliance of the APIs and certain excipients used in manufacturing. Increasingly, the competent health authorities are themselves checking whether the MAHs or the respective QPs are complying with this obligation to monitor the GMP compliance of APIs. [10] Furthermore, with the approval of the so called “pharmaceutical package” (Directive 2011/62/EU), the European Parliament and Council have again clearly defined this obligation, leading to a corresponding amendment to the “Medicinal Product Directive” 2001/83/EC. As of 8 June 2011, Article 46 f of Directive 2001/83/EC reads as follows:

“To this end, the holder of the manufacturing authorisation shall verify compliance by the manufacturer and distributors of active substances with good manufacturing practice and good distribution practices by conducting audits at the manufacturing and distribution sites of the manufacturer and distributors of active substances. The holder of the manufacturing authorisation shall verify such compliance either by himself or, without prejudice to his responsibility as provided for in this Directive, through an entity acting on his behalf under a contract.”

It is worth pointing out here that the borders of the definition of term API can be somewhat blurred, and the distinction from excipients or atypical actives is currently the subject of ongoing discussions. [14] However, monitoring of GMP compliant manufacturing is also required for certain excipients. This is pointed out in chapter 5 of the EU GMP Guide Part I for (finished) drug products, which is also currently in the process of being revised. The public consultation on the draft version is already complete. Paragraph 5.26 shall be issued as follows:

“Suppliers of active substances and certain excipients considered to be high risk materials used as starting materials, should be periodically audited to confirm that they comply with current GMP requirements.” [1]

Although the GMP standards applicable around the world are becoming increasingly harmonised, there are currently still considerable differences between different regions of the world. In member countries of the ICH, in particular North America, Japan and Europe, GMP compliance of APIs is assessed on the basis of the ICH Q7 Guideline “Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients”. In the United States of America for example, the ICH Q7 Guideline is valid directly; in Europe the guideline is implemented as EU GMP Guide Part II, which has the same structure and almost identical wording. However, the GMP guidelines of the main supplier countries for pharmaceutical APIs such as India (Drugs & Cosmetics Act, Schedule M) and China (SFDA GMP) are significantly less detailed. [17] Therefore, it is far from the case that a manufacturing batch compliant with Indian or Chinese GMP standards will always also meet the EU standards.

European MAHs are, however, obliged to ensure GMP compliance according to EU standards for all APIs used. Depending on the risk assessment, the use of non-EU GMP compliant APIs must be judged as a major or even critical deficiency.

2. Health authority references to compliance monitoring

Paragraph 111 of Directive 2001/83/EC stipulates that the monitoring of API manufacturing is the duty of the respective competent health authorities. Inspections of API manufacturers by the authorities are mainly conducted if there is a specific reason, especially for foreign API manufacturers. [3] In Germany, only APIs of human, animal or microbiological origin or from genetically modified microorganisms require inspection; this is also true for APIs, contained in investigational clinical products. Generally in Europe, there is the basic principle that European MAHs are subject to systematic monitoring by the respective competent health authority. The MAH is obliged to qualify and audit its API suppliers around the world, and this is then subject to systematic verification during inspections. In the future, the new regulations stipulate that official inspections will no longer be required for APIs if it can be demonstrated that the monitoring authorities in the country of origin can prove a standard of GMP comparable to that in the EU and feature on an Approved Inspectorate List which is to be created by the European Medicines Agency (EMA). However, it is already expected for manufacturing authorisations and GMP certificates issued by authorities in the countries of origin to be enclosed with the documentation.

Instructions on how a MAH should conduct its “audits at the manufacturing and distribution sites of the manufacturer and distributors of active substances” can be derived from an EMA Guidance. [3] According to this document, during the GMP inspections performed at the MAH, it must be able to prove to the respective health authority that:

  • an auditing/qualification SOP for suppliers and an audit schedule for API manufacturers has been established,
  • API manufacturing is audited regularly for GMP compliance, i.e. approximately every 2 – 3 years,
  • the audit is summarised by creating corresponding audit reports that are assessed by experts and that the documents are available for discovery by authorities.

A question and answer document issued by the EMA to accompany this guidance explicitly points out that an audit based on documents alone, for example performed using GMP questionnaires and submission of ISO certificates “cannot replace on-site audits of active substance suppliers”. [8] Even GMP certificates from health authorities in non-EU or European countries cannot replace an audit.

It is however explicitly permitted to use so-called Third-Party-Audits instead of an MAH having to perform its own audit. In this way, there is at least some decreased burden for the pharmaceutical industry, along with the related direct responsibility in delegating this task. The prerequisite for the acceptance of such Third-Party-Audits is the fulfilment of the following conditions:

  • the respective contract auditor must be qualified by the contractor,
  • a written contract must be established and signed between auditor and contractor,
  • absence of any conflicts of interest between auditor and auditee.

These requirements have been fixed by interest groups or are laid down in the above-mentioned question and answer document from the EMA or in respective national legal regulations (in Germany for example in §11 of the AMWHV).

Upon closer examination, especially in connection with the requirements of Annex 16 of the EU GMP Guideline, it becomes clear that the requirements for Third-Party-Auditors are quite challenging. According to the EMA and also the European Qualified Person (QP) Association, Third-Party-Auditors must be able to prove that they are qualified; they must be independent and free of any potential conflicts of interest – for instance no financial relationships between the auditor and the auditee. In addition, the QP Association points out explicitly that such audits must be API specific and must have a minimum duration of two days (audits of shorter duration require a risk-based justification). [20, 21]

The release of (finished) drug products in the European Union is the personal responsibility of the QP from the pharmaceutical company supplying the products to the market. The QP thus takes on the legal responsibility for the product and represents to a certain extent the last entity in the entire manufacturing chain. In so doing, the QP also takes on the responsibility for the quality and the validity of the GMP audits of the manufacturing of the API. As an example, when an application for a marketing authorisation, variation or renewal is made in the EU for a medicinal product, the QP has to submit a declaration to the EMA and other regulatory bodies about the GMP conformity of the APIs used. For this purpose, the EMA has produced a QP declaration template, along with a question and answer document. [5, 6]

The QPs should take the monitoring of API GMP compliance very seriously, as can be derived from the Compilation of Community Procedures of the EU regulatory bodies [2]. If an (event-driven) inspection of an API manufacturer conducted by a competent health authority discovers significant deficiencies, the European medicinal product manufacturer using this API, and especially its QP, are judged as responsible and personally liable:

“Serious GMP non-compliance found at an active substance manufacturer means that manufacturing authorisation holders using the active substance in question as a starting material have failed to fulfil their legal obligations and therefore action may be taken against the manufacturing or import authorisation or QPs connected with it.” [2]

Also, in view of criminal activities which repeatedly come to light [22], tight monitoring of the API manufacturers used is required. For this purpose, local authorities and inspectorates and their European counterparts need to cooperate closely.

As on-site auditing time is often very limited, inspectors, QPs or other GMP auditors are not able to cover every detail of the API manufacturing process during inspections and audits. This shows that it is necessary to conduct a risk-based evaluation and assessment of the GMP compliance level at the API manufacturing site, in order to fulfil the legal, regulatory and also internal requirements.

3. Literature about GMP compliance monitoring

A generally accepted (minimum) standard for the conduct of API GMP audits has so far not been established. Both in scientific literature and in practice, there are quite different approaches to these audits. This is also reflected in the quality of the resulting audit reports, which can vary greatly. [12] The expert circle APIs of the German federal states (EFG 07) has created an Aide-mémoire that contains the most important aspects of inspections. It is still in the trial phase and therefore still “confidential”. In addition, a standard operating procedure of the German federal states (VAW) is available covering the topic “risk assessment”, but this is also still “confidential”. Both documents are based on the GMP Guide Part II and/or ICH Q7, ICH Q9 and ICH Q10.

Overall, review of the current literature gives the impression that many of the authors believe that GMP audits of APIs cannot be standardised in terms of time or content. Thus the recommendations for such audits are limited to some useful hints, practical examples or frequent observations, such as inadequate quality and labelling of raw materials, insufficient pharmaceutical water processing, deficient handling of change control processes or the quite inappropriate use of the term “dedicated equipment”. [10, 11, 18] It is thereby concluded that qualified and “good” auditors are required, who possess both the formal qualification and sufficient experience to be able to identify and assess such deficiencies in individual cases.

Only in rare cases are attempts being made to define standards for certain parts of audits. One example is the GMP questionnaire, which is sent in advance to the auditee in order to prepare for the audit. [15, 16] In this context, the publications of Hösch should be highlighted here, as these detail quite comprehensively the items and tasks to be covered during the audit. However, even in these publications, he refrains from an attempt to standardise such audits: “The audit plan should be created individually and risk-orientated. The use of general checklists and standard questionnaires, especially with the option of tick off should be avoided.” [11]

However, complete rejection of standardised check lists and questionnaires would be detrimental (and certainly this is not Hösch’s intention in this strict sense). The purpose of standardisation is much more to define the minimum requirements for such audits and therefore to provide a basis for a mandatory level of quality which allows the justified assessment of the manufacturer and the manufactured product and the testing of the quality of the API. A standard audit along these lines, covering e.g. the required on-site audit time according to the (risk-based) audit circumstances, a standardised audit plan or even standardised requirements for the document review part of the audit, has to include sufficient freedom to assign additional key areas to be covered. Naturally, these individually assigned key areas must take into account the individual properties of the audited API, the production site, the compliance history etc. Any discrepancies observed must be adequately followed-up and verified. These strategies have already been used for a long time in other areas where normative standards are used, see for example chapter 5.2.4 of the ISO standard related to audit of quality management systems (ISO 19011:2011).

4. Monitoring practice of the health authorities

In contrast to industry, the health authorities have already taken tangible steps towards the standardisation of GMP inspections. Thus the Pharmaceutical Inspection Convention and the Pharmaceutical Inspection Co-operation Scheme (PIC/S) have issued an Aide Memoire for GMP- inspectors who conduct audits of API manufacturers. [19] This Aide Memoire is structured according to ICH Q7 and translates the corresponding chapters of ICH Q7 into so-called ”Crucial questions/Show me“. As an example, for the inspection of in-process controls of the production unit (Section 8.33 of ICH Q7), the inspection should include the question: ”Are IPC results documented in the batch record?“

Since not all individual items from the chapters of ICH Q7 have been translated into ”Crucial questions/Show me“, a clear focus is placed on certain aspects. The Aide Memoire is completed by a list of documents that have to be considered for a certain ”Crucial Question“.

But the Aide Memoire does not explicitly cover the entire ICH Q7 guideline. The chapters ”Personnel“, ”Process Equipment“, ”Documentation and Records“, ”Change Control“, ”Complaints and Recalls“ and ”Contract Manufacturers“ have been omitted. This is justified by the authors with the argument that GMP inspectors are sufficiently experienced with these areas due to their inspection of medicinal product manufacturers.

In Germany the Central Authority of the Federal States for Health Protection with regard to Medicinal Products and Medical Devices (ZLG) also issues such documents, intended to support the German inspectorates. The ZLG is the central coordinating body of the German federal states for medicinal product monitoring. From the published Aide-mémoires and operating procedures of the ZLG guidance, it is possible to see how inspectorates in Germany conduct GMP inspections. Ultimately, these are controlled documents issued by the health authorities, which are contained in the quality manuals of the inspectorates. However, the ZLG has so far not published the Aide-mémoire dealing with the inspections of API manufacturers. As a result, it is only possible for the time being to look into similar documents, especially related to

  • Preparation, conduct and post-processing of GMP inspections, [24]
  • Creation and format of inspection reports, [25]
  • Monitoring/surveillance of medicinal product manufacturers. [23]

In particular, the operating procedure for GMP inspections provides useful details concerning the different aspects of conducting an audit, even though it is primarily focused on medicinal products (EU GMP Guide Part I).
The same is true for the monitoring of medicinal product manufacturers. For every chapter of the GMP guide, the ZLG provides reference items which should be in the focus of the auditor. In fact, the complete coverage of all of the items mentioned within the limited time-frame of an audit is impossible. Despite this, the Aide Memoire does not provide any direction for potential key areas of the audit to be covered, nor does it mention any kind of weighting for the items mentioned.
In general, it has to be mentioned that the most important regulations and proceedings in the EU are fixed in the GMP Guides Part I and Part II. A risk-based focusing should always be a part of the detailed planning of any audit.

The American Food & Drug Administration (FDA) has issued a guidance document for their inspectors, which explicitly covers the preparation and conduct of API GMP inspections. [9] This guidance divides the ICH Q7 chapters into six “systems”:

  • Quality System,
  • Facilities and Equipment System,
  • Materials System,
  • Production System,
  • Packaging and Labelling System,
  • Laboratory System.

In a so-called “full inspection”, e.g. in the event of a first qualification of an API manufacturer or if deficiencies have been detected, FDA inspectors are asked to inspect at least four of these systems. For ”abbreviated“ or ”compliance inspections“, two to three systems are to be inspected. In any case, the ”Quality System“ must be assessed. During the inspections, the assessment of the respective documentation/records concerning topics, which are mentioned in detail as well as the on-site monitoring of the respective areas is required: ”the firms adherence to written procedures should be verified through observation wherever possible“.

The predetermined inspection schedule of the FDA seems to be particularly useful for defining meaningful key focus areas when faced with a limited audit time. This is notably critical for audits conducted for the first time at a certain site. However, experiences from the inspection practice of FDA inspections show that FDA inspectors do not always follow this system-oriented inspection framework: ”In many inspections three or more systems were covered, most notably the areas ’Quality’, ’Laboratory’ and ’Production’.“ [13]

Overall the guidelines of the health authorities (in Germany: the expert circles and their coordinating body ZLG) for their GMP inspectors are not yet fully convincing guidelines which would be suitable for establishing a mutually agreeable industry standard for API GMP audits. This is one of the reasons why the ZLG for example has not yet published these documents.
Such a system of establishing a standard can only be regarded as a dynamic process, keeping in mind that the approaches of authority inspections and manufacturer audits are somewhat different. Nevertheless, the guidelines of the authorities and expert circles provide several valuable considerations. Most prominently, the fact that both the PIC/S and the FDA guidelines are based on the chapters of ICH Q7 shall be mentioned, even though the translation into practice has been performed differently in both cases. It also seems meaningful to identify key focus areas for every audit. Again, the PIC/S and FDA follow different strategies.

Based upon the references provided above and the experience gained by the authors from several hundred GMP audits, the following chapters are intended to provide recommendations for the standardisation of API GMP audits.

5. Standardisation of GMP Audits

For an API GMP audit according to ICH Q7 (or EU GMP Guide Part II), it is mandatory to execute the audit specifically for a single API, including the coverage of specific circumstances and the requirements of the contractor. The decision about GMP compliance or non-compliance derived from the audit can only be made based on the principles of the EU GMP Guide. Each observation made must therefore be referenced to specific chapters and the related subtopics. Thus it is meaningful for API GMP audits – and more importantly the resulting audit reports – to be structured directly according to the underlying guideline.

Each GMP audit consists of the following elements

  • Preparation,
  • Meetings/Discussions,
  • Document review,
  • On-Site audit
  • Audit report.

Only the elements Preparation, Meetings/Discussions, Document review and On-Site audit are conducted at the premises being audited. The required time-frame for such an audit is frequently the subject of discussions.

Some authors recommend a minimum time-frame of two days for audits; more time can be allowed for bigger sites accordingly. [21] Other authors generally recommend a minimum duration of three days for audits conducted in foreign countries. [11] In terms of content, the model of risk-based inspections for the planning of GMP inspections of pharmaceutical manufacturers, developed by the EMA seems to be more appropriate. [7] This model takes into account the severity of potential risks, the probability of occurrence and the probability of detection during the manufacturing process: ”This risk ranking assumes that critical processes and products (e.g. sterile products) would have a higher public health consequence than less critical products and processes; hence these products are given a higher weight.“

Based upon these considerations, the health authority inspectorates assign numbers of inspection days (cf. table 1). The EMA assumes hereby a linear scalability. An audit requiring 10 days for one inspector could therefore be performed in 2.5 days with four auditors. However, this requires the auditors to work separately. This is practicable for one or two teams; in contrast, three or more teams would be quite impossible to manage for the inspectors and the auditees.

The number of inspection days mentioned already includes preparation and post-processing work. The individual time needed for these work packages may differ considerably and is sometimes difficult to forecast. Professional management of audit records and the audit report is therefore of great importance.

On the basis of the aforementioned considerations and the normative requirements, the following can be concluded for API GMP audits: the on-site audit time should be derived exclusively from audit-specific requirements and stated as audit man-days. Concerning audit-specific requirements, the following items must be taken into particular consideration:

  • Size of the organisation of the auditee (e.g. ≤ 20 employees, 21 – 50 employees, 51 – 100 employees, 101 – 200 employees, ≥ 201 employees),
  • Number of sites to be audited,
  • Number of APIs to be audited,
  • Complexity of the manufacturing process of the APIs to be audited (e.g. “simple“/“normal“/“complex“ manufacturing process), grade of automatisation,
  • First audit or Surveillance/repeated audit,
  • Translation during the audit required (mother tongue of auditor, language of auditee, documents in English or in language of auditee)
  • “Multipurpose“ or “Dedicated“ facility,
  • Additional characteristics.

A corresponding risk-based approach for audit planning has also been promoted by the PIC/S since the beginning of 2012. [26] However, the required audit time does not increase proportionally with the number of parameters. Among other things, this is caused by the fact that e.g. the system-specific aspects of audits (see below) are not dependent on the number of APIs to be audited. In addition, other different characteristics such as simple API, complex API, sterile API need to be considered. In practice, a mathematical programming of these parameters using (square) root functions has proven very useful. These calculations represent the starting point; after that common sense is required for assigning meaningful and documented on-site audit times. The information gathered for the preparation of the audit is of great importance.

As an example, a typical audit in Europe could result in an on-site audit time of 2–6 days conducted by one auditor and 1–3 days with two auditors (first auditing of the manufacturing of a ”normal“ API at one site of average size without translation required). A similar audit in China (“including translation”) would in contrast require 2–3 days on site with two auditors.

6. Document review

Generally, the document review should take at least 40% of the on-site audit time. Therefore, the more documents requested or provided by the auditee before the audit the better. This is because the documents can then be thoroughly evaluated without compromising the on-site audit. The on-site audits are typically compliance checks (“Show me“).

The resulting audit report should indicate which documents were provided before the audit and which were evaluated during the on-site audit.

According to currently accepted standards (“Lege artis”), the GMP compliance of the manufacturing of a specific API must be assessed. Consequently, during every audit, conformity aspects (GMP) relating to systems, product and registration must be covered.

For the more general, system-conformity part of the audit, a defined set of documents should be reviewed (cf. table 2). For the product-specific and/or the registration-conformity parts of the audit, the relevant documents need to be audited (cf. table 3).

In addition, the risk profile of the respective API and the related process flow must be individually assessed; as a result, further documentation for review must be chosen. For instance, if water is used in the last step of the process flow and if the API is also converted (or has the potential to be converted) to parenteral forms, the auditor must pay special attention to the qualification and the monitoring of the water system. Furthermore, the microbial status (data, graphical trending) as well as measures for avoiding any unwanted microbial contamination must be assessed in detail in the last steps of manufacturing for these APIs, and more generally also for non-sterile APIs, which may be manufactured to parenteral finished dosage forms. This means that the auditor must pay special attention to clean room qualification & clean room monitoring data, cleaning operation procedures for equipment & rooms and further qualification of utilities. The width-to-depth ratio of the document review and the on-site audit should be well-balanced. A considerable number of documents/impressions in combination with (randomly) conducted detailed evaluations result in a reasonable and comprehensive total picture.

7. On-Site Assessment

From the very beginning, it is important not to neglect the documentation: especially during a first-time audit of a site, the key focus areas should be evaluated. It is necessary to determine whether there are any fundamental problems on the “shop floor”, i.e. in the actual manufacturing area or the documentation. One should start with a (potentially) available inspection report and the related CAPA implementation of deficiencies.

About half of the on-site audit time should be dedicated to the “shop floor”. It has proven quite useful to limit the amount of people performing the on-site audit; this is for practical reasons, i.e. to keep the times needed for lock-in and out low, but also to limit the disturbance of the regular production flow to a minimum. Training records should be available in order to keep the required introduction and training times as short as possible for the inspectors / auditors.

Every audit should be conducted by auditing the entire process flow: starting from the incoming goods area to the production area and the quality control laboratory, up to the storage area for finished goods. In the case of a first-time audit, this may be usefully done as “short walkabout”, if one does not get bogged down or diverted. In practice, an audit “along the process chain” is often not so easy to perform, since for example not all manufacturing steps are conducted concurrently. As far as possible, the manufacturing process flow of the audited API should be questioned in advance (introduction/opening meeting, see below) in order to prioritise the on-site audit assessment concerning the required time for key focus areas. This is of special importance for APIs with an exceptional risk profile: for example, APIs of human, animal or microbiological origin or from genetically modified microorganisms, sterile APIs, potential harms related to specific “toxic” impurities (heavy metals, solvents) in the manufacturing process etc. In these cases, individual and sometimes quite different focus points for the audit must be assigned.

However, there are also topics, which need to be covered to the same extent during every audit (cf. table 4). Part of this is at least the cursory visual inspection of all available storage rooms – for raw & starting materials, solvents, up to the finished goods. Topics for the inspection according to ICH Q7 are temperature control (if applicable including qualification of the energy supply), pest control and the use of pesticides/insecticides, the segregation and labeling of the stored goods, the cleaning, the controls related to incoming goods and outgoing shipments.

Also, the quality control laboratory for incoming goods and finished products should be visually inspected during every audit. Topics for the inspection according to ICH Q7 are (besides other items) the laboratory records, the analytical equipment, reagents, standard solutions, analytical standards, etc. For the quality assurance department in particular, the handling of deviations, OOS results, change control procedures and the implementation of the analytical validation protocols is important to cover. It is of special relevance hereby to compare the issued SOPs, the completed records and the regular practice of handling the goods.

Production certainly represents one of the main focus areas of an audit. General topics for the inspection according to ICH Q7 should be -besides the general status of the buildings and facilities- the lock-in and lock-out of employees & material and the toilet facilities- primarily the equipment log-books, the accuracy and calibration of balances, the labeling and risk of potential mix up of materials (raw materials, intermediates, finished goods). Further attention needs to be given to the cleaning procedures & sanitation and the related documentation. This is especially true if “multipurpose equipment“ is used. Particularly in China and India, different qualities of the same API exist, and this is often also manifested by reduced analytical testing. Therefore, if only one API is manufactured in ”dedicated equipment“ but with different quality standards, e.g. for different markets, this may be an indication of a questionable understanding of GMP. These observations outside of the direct reach of GMP must be assessed and mentioned in the audit report.

If deviations from the accepted GMP status are identified during the on-site part, the review of the related documentation must be extended to the disadvantage of the more general system audit part. Such findings may result in a prolongation of the audit or even –if applicable- in failure of the facility. For audits in non-EU countries, it is always important to make sure that the results of the audit are plausibly described and that it is possible to make a decision based on the report (even for the monitoring health authorities). A re-audit is expensive.

8. Meetings/Discussions

Meetings/Discussions should not take up more than 10% of the on-site audit time. It is in any case meaningful to limit the number of people attending; this is also true for the subsequent on-site assessment (see above). The introduction meeting serves as a reciprocal introduction between auditor and auditee; this is also the place for explanation of the audit plan and the clarification of potential first questions. During the closing meeting, individual findings should be raised (depending on the cultural environment, preferably as “potential for improvement” rather than “deficiencies”). First and foremost, the closing meeting is intended for discussion of the next steps after the audit:

  • Forwarding of the DRAFT audit report within 3 – 4 weeks,
  • Feedback from and/or comments by the auditee within 1 – 2 weeks,
  • Corrective And Preventive Actions (CAPA),
  • Monitoring and implementation of CAPAs.

9. Audit report

For the MAH, the audit report is the only objective evidence based on documented observations that it can use to demonstrate to the health authorities that the audited API supplier complies with GMP. It is therefore the aim of the audit report to contain all relevant GMP-related observations and findings in an unambiguous, understandable and, most importantly, comprehensive manner. Keeping in mind the tight time-frame of audits, it is normally necessary to select certain key audit areas to be subject to thorough auditing. Further topics of the ICH Q7 guideline must then be covered at least survey-like. This shall also be evidenced in the audit report.

The audit report should therefore be structured according to the chapters of ICH Q7. This makes it easy to see whether all GMP-relevant items have been covered and which items are subject of the key audit focus. It goes without saying that every observed audit deficiency is referenced back to a specific chapter (or subchapter) of the ICH Q7 guideline requirements.

The complete elaboration of an audit report standard in this article would certainly exceed the objective. Therefore, we shall only mention the “GMP Inspection Report – Community Format” of the EMA, which is used by health authority inspectors for structuring the inspection reports. [4] In addition and based upon this format, proposals for the standardisation of API GMP audit reports have been made. [12]

10. Conclusion

The primary objective of a common (industry) standard for API GMP audits must be to define minimum requirements for such audits with the aim to agree upon a consistent and homogeneous basis for the quality level of such audits.

A common (industry) standard for the monitoring of API GMP compliance should be in the best interest of pharmaceutical companies: on one hand, not least due to commercial considerations, they are increasingly coming to rely on shared Third-Party-Audits i.e. the work of external audit service providers. A standard for audits could thus lead to a more homogenous audit quality and thereby better comparability of the audit service providers. On the other hand, health authorities are increasingly evaluating and assessing the resulting audit reports of the API GMP compliance audits during their regular GMP inspections of the MAHs. Commonly accepted audit standards would assist in avoiding any unwanted surprises for the MAHs during these inspections.

The recommendations for such a common audit standard drafted in this scientific publication shall serve as a first step towards this goal. These recommendations are derived from the practical daily work conducted as GMP auditor, with further refinement as a result of continuous discussions with health authorities.

About the authors

Dr. Stefan Kettelhoit has been the general manager of blue inspection body GmbH since 2007. The company is the first accredited inspection body for active pharmaceutical ingredients in the European Union. He holds a doctorate in pharmaceutical technology and has previously worked in responsible functions for Bayer AG and Implanta AG. Dr. Stefan Kettelhoit is a qualified IRCA/IATCA Lead Auditor for ISO 9001 and ISO 13485, and he is also a Qualified Person according to Directive 2001/83/EC.

Rudolf Völler is the head of the department monitoring companies for medicinal products, tissues and blood products at the Darmstadt District Council. Before moving to the District Council in 1978, the pharmacist and food scientist worked first as a scientific technician at the Official Medicines Control Laboratory in Wiesbaden. From 1996 to 2010 he was head of the EFG 2, a specialist committee dealing with inspections. Rudolf Völler works as scientific advisor for EU twinning projects, as well as fulfilling roles for the GIZ (German Society for International Cooperation), PTB (National Institute for Natural and Engineering Sciences), UNIDO (United Nations Industrial Development Organization) and WHO (World Health Organization).


[1] European Commission (2010): EudraLex Volume 4 – Good Manufacturing Practice Medicinal Products for Human and Veterinary Use – Chapter 5: Production (DRAFT) ec.europa.eu/health/files/gmp/chapter5_pc11-2010.pdf
[2] EMA (2010): Procedure for Dealing with Serious GMP Non-compliance or Voiding/Suspension of CEPS Thus Requiring Co-ordinated Administrative Action. In: Compilation of Community Procedures on Inspections and Exchange of Information. (EMA/INS/GMP/459921/2010 Rev 13)
[3] EMA (2010): Guidance on the occasions when it is appropriate for Competent Authorities to conduct inspections at the premises of Manufacturers of Active Substances used as starting materials. In: Compilation of Community Procedures on Inspections and Exchange of Information. (EMA/INS/GMP/459921/2010 Rev 13)
[4] EMA (2010): GMP Inspection Report – Community Format. In: Compilation of Community Procedures on Inspections and Exchange of Information. (EMA/INS/GMP/459921/2010 Rev 13)
[5] EMA (2010): Template for the Qualified Person’s declaration concerning GMP compliance of the active substance used as starting material and verification of its supply chain “The QP declaration template” (DRAFT). (EMA/CHMP/CVMP/QWP/696270/2010)
[6] EMA (2010): Questions and answers on the template for the Qualified Person’s declaration concerning GMP compliance of the active substance used as starting material and verification of its supply chain – “The QP declaration template” (DRAFT). (EMA/CHMP/CVMP/QWP/696305/2010)
[7] EMA (2008): A Model for Risk Based Planning for Inspections of Pharmaceutical Manufacturers. In: Compilation of Community Procedures on Inspections and Exchange of Information. (EMA/INS/GMP/459921/2010 Rev 13)
[8] EMA (2006): Q&A: Good Manufacturing Practice (GMP)
[9] FDA (2008): Compliance Program Guidance Manual, Chapter 56 – Drug Quality Assurance. (Program 7356.002F)
[10] Hösch, Christian (2009): Planung und Durchführung von Audits in Europa, Asien und Südamerika, Teil 1. In: Pharm. Ind., Vol. 71, 1035-1038
[11] Hösch, Christian (2009): Planung und Durchführung von Audits in Europa, Asien und Südamerika, Teil 2. In: Pharm. Ind., Vol. 71, 1229-1233
[12] Kettelhoit, Stefan (2010): GMP für Wirkstoffe: Audit-Qualität am Bericht erkennen. In: Pharm. Ind., Vol. 72, 242-247
[13] Kirchstetter, Reiner / Moerck, Kurt E. (2011): FDA-Inspektionen von Arzneimittel- und Wirkstoffherstellern. In: Pharm. Ind., Vol. 73, 847–852 + 1002-1008
[14] Krüger, Carsten (2007): Wirkstoffe im Sinne des Arzneimittelgesetzes. In: Pharm. Ind., Vol. 69, 1077-1080
[15] Linna, Anu et al. (2010): Expertise of using the GMP audit preparation tool in pharmaceutical contract manufacturer audits. In: Drug Dev Ind Pharm., Vol. 36, 632-637
[16] Linna, Anu et al. (2008): Developing a tool for the preparation of GMP audit of pharmaceutical contract manufacturer. In: European Journal of Pharmaceutics and Biopharmaceutics, Vol. 69, 786-792
[17] Meng, Bohong / Kettelhoit, Stefan (2011): Compliance of APIs with International GMP Regulations. In: Pharma, Sep. 2011, 8-10
[18] MHRA (2011): Good Manufacturing Practice: Common deficiencies. www.mhra.gov.uk/Howweregulate/Medicines/Inspectionandstandards/GoodManufacturingPractice/FAQ/Commondeficiencies/index.htm
[19] PIC/S Secretariat (2009): Aide-Memoire Inspection of Active Pharmaceutical Ingredients (PI 030-1)
[20] Podpetschnig-Fopp, Elke (2009): Beispiele zur praxisorientierten Interpretation einiger unbestimmter Rechtsbegriffe in der Arzneimittel- und Wirkstoffherstellungsverordnung. In: Pharm. Ind. 71, 2080-2082.
[21] QP Association (2011): Checklist Auditor Qualification and Performance. www.gmp-compliance.org/daten/training/QPA_Checklist.pdf
[22] Tawab, Mona / Schubert-Zsilavec, Manfred (2009): Heparin-Skandal – Wie es dazu kommen konnte und die Lehren daraus. In: Pharmazeutische Zeitung, Nr. 20/2008.
[23] ZLG (2008): Überwachung von Arzneimittelherstellern (Aide-mémoire 07120102)
[24] ZLG (2008): Vorbereitung, Durchführung und Nachbereitung von Inspektionen im Bereich GMP. (Verfahrensanweisung 07110203)
[25] ZLG (2002): Erstellung und Format von Inspektionsberichten. (Verfahrensanweisung 07110803)
[26] PIC/S Secretariat (2012): A Recommended Model for Risk-Based Inspection Planning in the GMP Environment (PI 037-1)


Blue Inspection Body GmbH
Am Mittelhafen 56
48155 Muenster, Germany
Phone: +49 251 284 972 93