Auditing suppliers for pharmaceutical companies is a vital step in ensuring the highest quality of sourced products and services. In recent decades, pharmaceutical companies have begun to look for more cost-effective sources of materials by purchasing from inexperienced vendors in developing markets without the proper oversight. In response, regulatory bodies are mandating more detailed investigations into supplier audits. Regulators recommend using a risk-based supplier audit plan to ensure a systematic and cost-effective method for examining current and potential suppliers.
What Is A Risk-Based Pharmaceutical Supplier Audit Plan?
An audit program typically consists of six key steps: planning, scheduling, pre-audit preparation, onsite audit, report preparation, and follow-up. A Risk-Based Supplier Audit Plan is a comprehensive strategy for reviewing the quality of materials and services supplied by pharmaceutical vendors. These plans are designed to identify any potential risks posed by suppliers and provide valuable insights to decide which vendors (and in which order) to audit. A risk-based management process for audits should also help determine their scope and requirements based on risk assessment results. In this step, the person managing the audit plan defines the standards against which the audit should be performed, a preliminary timeframe, the detailed scope, and the objective and selects the audit team.
Audit scheduling can help to determine the frequency and duration of the audit. Pre-audit preparation involves arranging the agenda with the auditee and requesting the necessary information. Important documents to request include the site master file, validation master plan, GMP certificates, and organizational chart. An onsite audit is when the auditor visits the location and reviews the quality system and processes. During this phase, the auditor will spend most of the time reviewing operations, observing ongoing processes, interviewing relevant staff, and requesting additional documentation. The audit report is the responsibility of the lead auditor and should include the scope, objective and major findings. The last element is the follow-up, which involves implementing the auditors’ recommendations and addressing any discrepancies identified during the audit.
From this point onwards, we will focus on audit planning as the most critical component of a Risk-Based Supplier Audit management strategy.
Why Is A Risk-Based Pharmaceutical Supplier Audit Plan Necessary?
In today’s increasingly competitive pharmaceutical industry, quality and safety standards are of foremost importance. A risk-based supplier audit plan can help ensure that these standards are met and that pharmaceutical companies and suppliers are held accountable for their products.
The implementation of a risk-based audit plan offers numerous advantages. Suppliers’ risk identification allows companies to focus their resources and efforts on areas most likely to cause issues. This leads to more accurate results and a better understanding of the potential risks associated with a supplier of materials or services. A risk-based strategy also helps organizations to develop mitigation strategies in the case that the risks materialize. It can also provide companies with the needed information to create a comprehensive audit plan and make informed decisions about suppliers and manufacturers. Finally, a risk-based audit plan can also help to infer if a supplier complies with industry regulations, which is essential for a company operating in the highly regulated pharmaceutical industry.
This process can even provide significant savings for pharmaceutical companies. GMP auditing is also an expensive process that typically involves several professionals, travel, and accommodation costs. The auditing process doesn’t even finish with the onsite inspection, afterwards, the auditors prepare the report, review the response of the auditee, and do the follow-up of the proposed corrective actions. It is estimated that a typical GMP inspection requires at least 8 person-days of work.
Beyond labor savings, risk-based audit planning can help by reducing the potential cost of non-compliance. The cost of non-compliance for pharmaceutical companies can be immense. Companies that fail to comply with government regulations and industry standards face significant financial penalties, including fines, disgorgement of profits, and potential criminal liability. In addition to the direct financial costs of non-compliance, companies may also face reputational damage, including negative press coverage, damaged customer relationships, and reduced public trust. This reputational damage can impact the company’s brand and its ability to attract and retain customers. Non-compliance can also lead to increased regulatory scrutiny, resulting in additional costs and delays in product development. All of these costs can quickly add up, making non-compliance a costly and potentially damaging situation.
Overall, risk identification is essential in creating a quality audit plan and helps ensure that the supplier is providing products and services that meet regulatory requirements. By focusing on potential risk areas, companies can identify and mitigate risks before they become an issue, thus guaranteeing the highest quality products for patients.
Risk Factors to Consider When Developing an Audit Plan for Pharmaceutical Suppliers
Due to the intricacies of the pharmaceutical supply chain, deciding which vendors to audit and in which order is a complicated task. When developing an audit plan, many risk factors need to be taken into consideration:
1. Risk factors for operations performed:
The risk level of operations at a site is determined by the type of operations conducted. High-risk operations have the highest degree of regulatory oversight and include sterile manufacturing, packaging, labeling, final product release testing, excipient testing, as well as supply chain supervision such as distribution and transport. Medium-risk operations include drug substance manufacturing and solid oral dosage form manufacturing, while warehousing is considered low-risk if adequately monitored. The operations conducted at the supplier’s facility are the most crucial factor in determining the risk level.
2. Compliance Risk Inputs:
The assessment of the supplier’s compliance should also be an important risk factor to consider. The compliance elements should be evaluated by considering its compliance history, more specifically, with recent regulatory inspections. The criticality rating of any inspection findings, the timeliness in addressing them, and the status of any corrective actions should be taken into account. A track record of successful compliance reviews and a positive history of dealing with health authorities is an excellent indicators of a site’s level of compliance. Other important factors to consider when inferring the compliance risk are: recalls, product complaints, major changes in key GxP personnel, ownership, and new product introduction to the site.
3. Site/Facility Risk:
When assessing the risk level of a manufacturing site for clinical or commercial products, a supplier/vendor for materials, or a contract laboratory for release testing, several factors should be taken into account. One of these factors is the compliance of the facility design with current standards. Other important factors are the maintenance plan, calibration of equipment, and any significant changes that have occurred since the last inspection. Additionally, any issues identified in past audits or regulatory inspections should be considered when evaluating the facility’s risk profile.
4. Product/Process Risk:
When determining the risk rank of a supplier/manufacturer, it is important to have specific information regarding the products and processes being used on that facility/site. For example, manufacturers producing multiple product classes, such as parenteral, tablets, capsules, and patches, have a greater risk of mix-up or product contamination. Facilities working with products that pose patient safety risks, like high potency APIs, hormones, cephalosporins, and allergens, also have a higher risk than those manufacturing a single product class. Moreover, if these compounds are produced in the same areas or with the same equipment, this should also be considered when assessing risk. Risk ranking criteria can be further developed based on the product class and formulation type. For example, manufacturing an intravenous formulation of a biologic is a higher risk level than an oral tablet of a well-defined small molecule.
Implementing a risk-based pharmaceutical supplier audit plan
The process for implementing a risk-based supplier audit plan can be broken down into several steps. The first step is risk identification, which is the systematic use of information to identify supplier-associated risk factors. The second step is risk analysis, which is the process of integrating the estimation of the probability of occurrence, severity, and detectability of a hazard. Several standardized tools are available to perform the risk analysis, such as Failure Mode Effects Analysis, Fault Tree Analysis, Hazard Analysis, and Critical Control Points. The third step is risk evaluation, the process of comparing the identified and analyzed risks against predetermined risk criteria. This helps organizations determine the best course of action for addressing risks. By evaluating the auditee’s risks and their potential impacts, organizations can make informed decisions on how to manage and mitigate them.
Conclusion
In conclusion, a risk-based pharmaceutical supplier audit plan is essential for pharmaceutical companies to ensure the highest level of quality and safety for their sourced materials and services. By prioritizing suppliers based on risk factors such as operations performed, site/facility risk, product/process risk, and compliance risk inputs, companies can develop a comprehensive audit plan that is both cost-effective and efficient. A risk-based audit plan can also help to identify potential risks and provide companies with the necessary information to make informed decisions about their suppliers and manufacturers. Finally, implementing a risk-based audit plan can help save costs, reduce the potential cost of non-compliance, and protect the company’s reputation. These factors make a risk-based pharmaceutical supplier audit plan a vital component of any pharmaceutical company’s quality assurance process.
Join us on the 28th of March to ensure you are equipped and prepared to handle new supplier and contract manufacturer qualifications as part of your audit program:
With a dedication to serving the pharmaceutical industry, Qualistery specializes in hosting informational webinars that support both professionals within the pharma sector and service providers. Our commitment lies in empowering businesses to maximize their impact through engaging virtual events and strategic webinar solutions. Additionally, Qualistery supports life science companies through private GxP training and compliance services.
