One of the first questions to be asked before conducting an audit is: Why? This fundamental question constructs a premise for the auditor who plans and conducts the audit. Quality and compliance audits have different purposes and the answer to the question of “Why?” will define the scope and the type of the audit. This article is addressed directly to the auditor in an attempt to provide some fundamentals about the process of auditing. [Editor’s note: This is a departure from Contract Pharma’s style manual, but I’ve elected to go along with it on the basis of the article’s general tenor. That noted, future contributors should avoid use of the second person (i.e., “you”), as well as the aforementioned “win-win relationship.”.]

Generally audits can be classified as follows:

1. New Contractor Audit

2. Routine Audit of an Existing Contractor

3. For Cause Audit

New Contractor Audit
A sponsor conducts a new contractor audit if the company is thinking about contracting with a new provider and wants to find out if the contractor is compliant and capable of meeting quality and compliance requirements. The audit style here must be comprehensive so that the sponsor develops a broad but full understanding of the contractor’s compliance and quality systems. Some of the key questions you want answered by this audit are:

1. How long has the company been in the business?

2. What are the company’s management philosophies towards quality and compliance? Are they proactive, reactive or retroactive?

3. What is the company’s organization structure? Does it have an adequate talent base? What is the reporting structure? Is the Quality unit independent?

4. Does the company have the resources to manage your particular product (i.e., manufacturing, packaging or testing capacity, equipment, tools and an adequate pool of skilled personnel)?

5. How is the company’s track record in quality and compliance? Has management received any warning letters, participated in recalls or signed any consent decrees?

6. Is this company owned by a larger company? If so, what and how is the relationship?

7. Is the company financially stable?

8. How do your company’s peers in the industry view this company?

9. How will your product impact this company’s business processes?

10. Is the company a “pure-play” contract service provider or does it have its own products? If the latter, what is the ratio of these businesses?

Routine GMP and Quality Systems Audit:
The mission for this type of audit is verification of the contractor’s quality and compliance systems. You must determine if these systems have been maintained or whether any changes in the management, shifts in the company’s business focus or product spread have created new problems.

Routine audits will have no real value if the contractor and sponsor have not agreed to a corrective action plan from the previous audit or have been working on them. Further, these audits could become mindless, time-wasting exercises if the sponsor finds that it is repeatedly receiving the same presentation from the contractor with no measurable shifts in quality indices.

Some of the questions that you would want answered for routine audits are:

1. Has the contractor carried out all the corrective actions noted in the previous audit? If not, why not?

2. How many deviations or investigations have occurred since the corrective actions were implemented?

3. How many employee or process errors have occurred since the last few significant change-controls?

4. How many rejections have occurred? What is the scrap rate?

5. What is the employee turnover rate? Has the company lost any talent base?

6. How are the quality and compliance initiatives viewed within the company? Does it have top management support?

7. Has there been an increase in the workload or the capacity of the company’s production or testing activities?

8. Has there been any regulatory action against the company? How is the company managing it?

9. Has there been any change in ownership of the company?

10. How significant is your business to the contractor and what is its attitude toward that business?

You may want to request a “State of the Business” report from the contractor’s senior management to answer these pertinent questions. These summaries should be an integral part of the routine audit report.

During the routine audit you should allocate approximately 10 –20% of your time in verifying the corrective actions and the rest in auditing other significant areas. If you see that some of the corrective actions are effective and show good results, do not hesitate to mention that to the company’s management. A well-placed appreciation will win lots of cooperation from the contractors.

For Cause Audit
These types of audits can be either very simple or very complex; there is usually no middle road. If the audit is related to one specific system, you may be able to conduct a short focused audit in that area. If the cause of the audit is very serious, such as an FDA action against the company, a pre-approval inspection for your product, a recall of your product or a major rejection involving critical systems, you need to conduct a very thorough audit.

Typically such a complex audit requires a multi-disciplinary audit team. While the scope of the audit is intensive, it could be well managed if you have strong team of auditors that is managed by a disciplined and knowledgeable lead auditor.

Some of the key questions you need answered for this type of audit are:

1. What are the key objectives of this audit?

2. What is the timeline for assuring the closure to all the findings in the audit?

3. Does the contractor have enough resources (time, money, tools and talent) to manage all the corrective actions in the time it is required?

4. What resources can your company offer to the contractor to implement the corrective action plan?

5. Is it all worth it?

This last question is usually a senior management decision, based on your audit team’s recommendation.

Challenges of a Contractor Audit
The major challenges of a contractor audit are:

Defining the roles and responsibilities: Not having a clear agreement on audit objective and role definition will cause several problems during the audit process. While the auditor should strive to maintain control during auditing, you must refrain from going out of bounds.

It should be clearly established up front that the contractor is ultimately responsible for serving the sponsor’s business needs while observing the laws of the land. It should also be established that your company does not have unlimited access to all the information regarding the contractor. This is especially true if the contractor serves many customers. Asking a contractor to establish a new set of rules specifically for your company is asking for failure.

However, it is your job as a customer to establish these clear audit guidelines in your pre-audit letter. Some companies conduct a meeting to discuss these audit objectives and use the minutes of the meeting to plan the audit.

Focus: Maintaining focus during an audit is a challenging task. People tend to go off on tangents, moving to uncharted waters or toward small talk. While some off-tangent conversations are interesting, the auditor must maintain control by keeping the focus on the objectives at hand. Conversely, the auditor may want to spend some time off on a tangent, which may turn out to be an important area of cGMP compliance. In short, you must balance your time and attention on an area depending on your overall audit objective.

Authority: Occasionally power struggles may arise during the audit. Your host may want to steer you in one area, while you may want to spend some more time in another. If you have a valid reason to prod, you should do so politely while explaining your reasons to your host. Conversely, you must make sure not to get carried away just because the item was on the check-list or because it is your pet area.

Business paradigms: As an auditor, you must keep in mind that your company’s business is not always the main business of your contractor. For example your company may have a specialty product that is typically manufactured by a non-food or a non-drug contractor, where you may be discussing rules and regulations with which your contractor is unfamiliar. In those instances, you must educate your contractor about your needs and provide support when and where necessary.

Planning an Audit
To put it simply, no auditor wants to be at a contractor’s site for any more time than is needed to complete the objectives of the audit. A lack of planning will result in wasted time and efforts on both sides. For example, if there are documents that you can review ahead of time and if your contractor is willing to supply you with them, you should try to review them at your office, rather than spend time doing so during the audit.

Other things to plan are gathering and previewing the summary of all the problems encountered since the last audit. For example, you should try to review following items:

• Previous audit reports and the contractor’s response;

• A list of rejected lots and the investigations associated with them;

• All laboratory OOS notices since the last audit. You should include OOS notices related to facilities and processes, not just the batch-specific testing;

• Change-Control summary;

• Adverse Event reports;

• Stability Failure reports;

• Scrap and waste reports;

• Last two FDA-483s or Warning Letters, if applicable;



Typically, the last few years’ annual product reports can supply the information listed above, however, it is usually beneficial to review the most current events.

Scheduling the audit is another critical area. Your schedule should leave you enough time to conduct the audit without becoming a burden on your contractor. You should try to provide at least a month’s notice so that the contractor is aware of your audit schedule and your objectives. A month gives the contractor enough time to plan for the audit and schedule the right personnel to be available for you when you get there. (Another school of thought might say that too much advance notice allows the contractor to superficially “straighten out” the site. However, a good audit team should be capable of checking for systematic improvements and ignoring the superficial ones.)

Pre-Audit Assessment
Pre-Audit assessment is very critical in determining the audit’s overall purpose and scope. A review of all the items listed in the planning section will offer a good understanding of the contractor’s quality and compliance shoreline. You must be careful not to form any strong opinions about the contractor during this pre-assessment. Sometimes those biases, good or bad, will defeat the purpose of the audit. In short, the pre-audit assessment while critical in planning, it is not meant to replace the audit.

Audit Standards
An appropriate set of standards is critical to conduct an effective audit. Use of the wrong standards or standards defined by vague and subjective interpretations can cause potentially explosive situations during an audit.

A typical list of standards include:

• Published government standards (e.g., Code of Federal Regulations);

• Your company’s corporate policy or requirements;

• Specifications;

• Industry standards and guidelines.

If the contractor is manufacturing a drug, use the drug standard. Don’t impose inappropriate standards on a contractor; sometimes, your interpretation of standards may be necessary for your particular product or because of company policy, but it may be more than what the contractor is legally required to do. In these instances, identify those requirements clearly to your contractors, with an acknowledgement that you are asking them for more that they are required to do. In some instances, the sponsor may have to pay a premium for the contractor to meet those requirements.

In other instances, the contractor may only be willing to do the bare minimum. You may have to get your purchasing department involved to help arbitrate such standards. In the cGMP world, though some requirements are specific, many others are broad and subject to interpretations. Fortunately they are all based on common sense.

In most cases however, the contractor will know what is the right thing to do but may be hampered by financial or political reasons. The auditor’s job is to convince them (or, better yet have them convince themselves) that a penny invested in prevention systems will save a dollar’s expense in corrective systems. An additional incentive for contractors is that, if they a have a good reputation, their business will grow and they may be able to charge more for their services (not to you, of course!).

Agenda
Your agenda is the blueprint of your audit objectives. It should include all the details that your contractor should know to help prepare for the audit. The items in the agenda should be specific with timeframes assigned so that your contractor may have the responsible person in that area available.

Where possible, you should avoid going off-site for lunch, unless your audit team will use that time to discuss observations confidentially. Also, avoid audits on Fridays and Mon-days. Typically those are the days when people take off, so important personnel may be absent. Additionally, Mondays are usually very hectic for most businesses. The contractor may need some time on Monday to get some of its real work done. Remember, you are a guest of your contractor and the audit places a significant amount of strain on the contractor’s resources, so choose the agenda items wisely.

Selecting an Audit Team

A typical audit team usually contains two to three people. More members would be cumbersome for both you and your contractor to manage. The team must have a lead person. A lead is not necessarily the most senior person, however; it is more important that the lead has the skills to steer the audit towards it objective and organize all the activities.

Usually, the team will include a technical person, a compliance person and a quality systems person. The collective experience of the team must be complementary, not repetitive. A strong lab person can complement the skills of a strong technical person and a quality systems person. The personalities of the team members are very important. You must avoid people with combative and argumentative personalities in your team. Of course, this is not to say that you avoid “pleasantly persistent” people.

Pre-audit Planning
A pre-audit meeting may be necessary if you think your contractor needs it. Usually this meeting is conducted a week in advance to confirm audit dates and objectives. A telephone conference is usually sufficient. The key objective of this meeting is to let the contractor know of any modification in audit objectives or request any items that the contractor could send ahead of time to make the audit run more efficiently.

Conducting and Audit
Audit roles and code of conducts: Etymologically, the word audit is related to the word listen. An auditor’s key role is to ask open-ended questions and listen to the response. Review of procedures, data and verification of actual activities at the workstations should supplement this “listening.” An audit is not meant to be unpleasant for either the auditor or the contractor. There is no reason why the audit can’t be a friendly, pleasant and effective activity. One needs not carry an impassive or solemn face all the time during the audit. At the same time, audit is not a frivolously everyday activity. It should have the intensity it deserves but no more. At all costs, you must avoid turning the audit into an interrogation (or, worse yet, an inquisition).

You must remember that you are representing the sponsor company during the audit and, as such, must follow all the rules that your company dictates in a professional work environment. Avoid participating in off-color jokes or being overly casual, while respecting your contractor’s property and always asking for permission before touching anything at the site. If your contractor has any visitor policy, observe it to the letter.

Audit Approaches: Pros and Cons
There are a couple of approaches to conducting an audit. You may conduct a standard checklist audit or use the checklist as a reference document only. Checklists have some advantages, but in the long run they tend to restrict the auditor to the items in the list. An effective auditor makes sure that all the critical areas are covered at least once, and is keenly aware of areas that may not be included in the checklist.

Checklist – Eight Major Areas
Whether you use a checklist or not, the following areas should be covered. Please note that this list is not all-inclusive and should not be treated as such.

Personnel & Organization:
People make an organization. Both sponsor and contractor are dependent on their skills, knowledge and training. Some of the questions an auditor should ask about personnel are:

1. Do they have adequate personnel?

2. How do they hire their people?

3. Do they have a steady supply of employees?

4. Do they use temporary employees? If so, what is their role?

5. What sort of training (cGMP and job-specific) is provided? Is the training documented?

6. Can they read, write and speak the language they must use to do their job with?

7. How do they verify the personnel’s basic literacy in the language used?

8. Who has the authority to accept or reject the product?

Manufacturing and Packaging
1. Does the contractor have a master batch record system, which details all the critical manufacturing and packaging processes?

2. Does the contractor have adequate equipment of appropriate design? Is the equipment in a good state of repair?

3. Are the manufacturing and packaging areas of appropriate design and do they have adequate space?

4. Is the equipment maintained regularly?

5. Does the major equipment have a usage, cleaning and maintenance log?

6. Are the personnel in the manufacturing area following cGMPs?

7. Is the area classification, such as specific air pressures and air exchanges, monitored and maintained?

8. Are the gauges and instruments used to monitor the manufacturing and equipment process calibrated and traceable to NIST?

9. Is the equipment easy to clean?

10. Is there an overall system to report mechanical or process failures? Is QA involved in decision making?

Quality Control
1. Is the quality control unit independent of manufacturing operations?

2. Are all the lab procedures validated where applicable?

3. Is there an adequate system of sampling, testing and reporting test results?

4. What is the process of handing out of specification (OOS) reports?

5. Is the laboratory equipment suitable for the testing? Is it calibrated and in a good state of repair?

6. Are the laboratory systems (e.g. information system) validated?

7. Are the personnel qualified or certified before they perform a test?

8. Are the reagents and standards appropriately labeled and stored?

9. How does QC handle obsolete standards and reagents?

10. How are changes to test methods and equipment managed?

11. How are the results recorded? Does QC have an informal reporting? Is the data transcribed from scrap paper? Are the results validated or verified?

12. How long is the data stored?

13. Are there laboratory notebooks with numbered pages?

14. Does QC have a deviation procedure? How does QC determine and validate human or process errors?

15. Does QC have a final authority to accept or reject a lot?

Master Validation Program
1. Does the contractor have a Master Validation Program?

2. Does it include all the critical equipment, systems and processes in the company?

3. Does the contractor have a summary of the status of all the individual validation programs?

4. Does the contractor have the technical and compliance expertise in managing the master validation program?

5. Has the contractor validated its critical computer and PLC systems?

Cross-Contamination Risks
1. How is the space utilized in the company? Is there adequate storage and manufacturing space?

2. Are there specific areas for holding unapproved and rejected material?

3. Is there a locator system for storing and retrieving material?

4. How is the printed packaging material stored? Is it segregated appropriately with limited access?

5. Are there cleaning procedures? Are they validated?

6. Are there line-clearance procedures?

7. Does the contractor stage or manufacture one lot at a time?

8. Are there cleaning and clearance logs for major equipment and lines?

9. Are the equipment and the lines properly identified as to their cleaning status?

10. Are the walls, ceilings and floors clean and free from potential contamination hazards?

11. Are the hoses cleaned and stored properly?

12. Are the clean equipment and utensils stored covered in a clean area?

13. Are there any dedicated equipment or utensils? Are they appropriately coded or identified?

14. Is there a sanitization program? Do they use appropriate cleaning agents that remove product or microbiological residues?

15. Is the employees’ dress properly designed and is the dress code observed in designated areas?

16. Are employee practices conducive to contamination prevention?

Documentation Practices and Control
1. Does the contractor have a Master Documentation system?

2. Does the contractor have all the appropriate procedures for all the critical functions?

3. Are the procedures up to date and consistent with cGMPs?

4. Are the procedures controlled, such that only one version is officially available at all workstations?

5. Are any informal instructions printed and used?

6. Are the forms controlled?

7. Does each procedure have a revision history?

8. Does the contractor inform the customer of any critical changes in the procedures?

9. Are the appropriate individuals or departments involved in developing, approving executing and training for all the procedures?

10. How are the obsolete procedures managed?

Change Control
1. Does the contractor have a formal change control procedure?

2. How are changes reported and implemented?

3. Are the changes documented?

4. Are the customers involved in reviewing and approving changes?

5. Does the supplier maintain a log of all change controls?

6. Who has the overall responsibility for managing the change controls? Is the Quality unit involved?

7. Is the Regulatory department involved in reviewing changes that impact the FDA-filed status of the product?

8. Are all the personnel trained in reporting all changes?

9. Are all the changes consistent with the cGMPs?

10. How do they manage customer-initiated changes?

Warehousing and Distribution
1. Does the contractor have adequate warehousing space to hold all the material?

2. Are all the material and locations adequately identified?

3. Is the warehouse free from clutter?

4. Is the storage space for environmentally sensitive (e.g., light, temperature, humidity) material adequately controlled?

5. Are those areas monitored and mapped where applicable?

6. Are the ceilings, walls and floors free from debris?

7. Are the pallets and material neatly stacked? Are they free from debris?

8. Do they have an adequate pest control program for the site, including the warehouse?

9. How are unidentified materials managed?

10. Is the Quality unit involved in any material damage event?

11. What is the policy on usage of containers and pallets? If reusable, is there a cleaning program?

The Audit Kick-off Meeting
When you arrive at the contractor’s site, your first order of business should to get your hosts comfortable. An auditor can achieve this by pleasantly and professionally setting the right tone for the next couple of days, letting them know that you are not on a mission to find faults but to work with them in identifying any compliance or quality issues. You should discuss the standards that will be used and ask for any questions that they may have.

Next, you should explain the agenda and the role of each of member of your audit team. Find out if agenda items must be shifted because of the contractor’s schedule. You should make sure to thank the contractor for finding the time and resources it is providing you and assure that the audit team will try to be as unobtrusive as possible.

The Audit Process
The Tour: One of the most important aspects of the audit is the plant tour. A typical tour starts with the receiving area and progresses all the way thorough the final release and testing. You may choose to break down the tour in different segments and, if necessary, you can break up your audit team to follow the pertinent contractor personnel. It may not be necessary for every member of your team to visit every area, but the lead auditor may choose to do it all.

Asking Questions: Do’s and Don’ts: Ask a lot of open-ended questions. Make sure not to jump the gun in making qualitative statements about the responses. One of the best ways is to repeat answers in a paraphrase, to better verify understanding. Ask for specific examples, such as a document or a log, to verify the answer. Don’t interrupt when someone is answering. Don’t nod unless you understand what is being said, but offer a smile to facilitate a positive answer.

When speaking, keep your tone low, but speak clearly. Don’t inflect words with cynicism or frustration. You must never lose your temper! If you strongly disagree, just take a step back and make notes. Say something like, “I’ll need to revisit this issue later and verify my understanding of the standard.” Always refer to a known standard where possible.

Making Observations: When making observations that are verified by some evidence such as a document or a process, do so gently. Say, for example, that you believe that such a practice is not consistent with cGMPs, a known standard, or your contractor’s documented procedure. Make notes and let your contractor know that it will be included in your report. Don’t argue or haggle if the contractor disagrees; quickly go on to the next topic.

Verifying Observations: When verifying, look for strongly documented evidence. For example, if the contractor’s procedure requires that an equipment cleaning process is documented immediately after it is cleaned, look for a specific entry that verifies this practice. Try to get the contractor to understand your evidence and always provide an opportunity to explain any discrepancies. Don’t make statements based on superficial observations. You are not there to nit-pick, but rather to make systematic observations. Don’t document any unverified observations.

Classifying Observations
Typically there are three types of observations: critical, major and minor. A critical observation must be strong enough to be corrected immediately. An example would be lack of temperature monitoring for a stability chamber. A critical observation will most likely have impact on marketed products. You must inform your own management immediately about any critical observations after they are verified.

A major observation is reserved for an unacceptable practice that may have an impact but is not as significant as a critical observation. A minor observation is about a practice that has no significant impact on the product quality or its compliance status. However, if you have several minor observations, they may reflect a major or a critical underlying systematic problem.

Establishing Perspective
As you make each observation, do not rush to classify them immediately, unless they are glaringly obvious. Typically, your audit team should discuss these during breaks or lunch, to get a regulatory perspective. It may be necessary to have a conference call with your senior management to get their perspective, but don’t call them for each and every observation.

Handling Disagreements: As an auditor, you need not welcome disagreements; however, you must assure that your contractor understands your particular observation. If the contractor disagrees, the auditor must try hard to define what the disagreement is about. Many times, the contractor may have a point. At times, the contractor may not be clear on what you are referring to. You must tactfully weed out the emotional aspects of the argument and relate yourself and your contractor toward the standard. It may very well be that your observation is an exception. If so, allow your contractor to demonstrate that assertion. If you decide to make such an observation, you must balance it by noting that it was an exception rather than the rule.

Managing Time and Maintaining Focus: Time is a critical resource for you and your contractor. You can use it wisely, with proper planning and placing finite time brackets around your audit areas. Unless an observation is critical or major, you need not hold court at your contractor’s site. If a particular observation takes excessive time, don’t hesitate to note that clearly and politely, then move onto the next topic.

Don’t plan a long lunch and avoid having dinners with the contractors, if you plan to have your audit team meetings that night. If you decide to attend dinner with your contractor, don’t discuss the audit items during dinner. If you are asked about an audit issue, politely decline to comment and offer to discuss it on the next working day. An audit is supposed to be a focused disciplined process conducted in a professional forum at your contractor’s site. Comments made during dinner may be easily misconstrued or forgotten. Plan at least an hour a day to discuss your observations confidentially with your audit team. Keep your phone calls to the “outside world” to a minimum.

Daily Summaries
It is generally a good idea to recap a day’s work with your contractor. This is the time to summarize the day’s findings, confirm your requests for the next day and get an understanding of your contractor’s position. Again, don’t use this time to specifically discuss any particular observation in detail, unless it is critical. This is typically a verbal session, so you need not give anything in writing to your contractor unless specifically requested.

Audit Closure Meeting
It is very critical for your entire audit team and the contractor’s senior management to attend the audit closure meetings. Typically, the audit team should meet and have all the observations tabulated and agreed to before the closure meeting. It is appropriate for the lead auditor to start this meeting by thanking all the contractor’s personnel for their help and hospitality during this audit. The audit team must set the tone in reiterating that the audit is meant as a tool to monitor your company’s quality and compliance systems and not as an all-inclusive survey of all areas. If there are any positive things to be said about the plant or their systems, they should be said before discussing the observations. Remember: tactfulness is key. Allow your contractor to save face. Think of those problems in terms of opportunities.

Lastly, you should let the contractor know that your observations may be corrected if it turns out that you misunderstood any of its processes. But your main objective is to say what you think, clearly and professionally.

If there are agreements about your observations, you may ask your contractor to provide a tentative corrective action plan and a timeline. Don’t get the contractor to commit to a rigid schedule unless there is a critical observation on the list.

If there is a disagreement, you should say that you beg to differ and that you would be willing to take the contractor’s objections to your management and let them know about the outcome. Don’t engage in long arguments. Let the contractor know about your report format and schedule and assure them that there will be no surprises in the report.

The Audit Report
The Audit Report must mirror your audit closure meeting. Some auditors write up their audit report in a plaintext format before the closure meeting and use that to discuss the observations at the meeting.

The audit report language should be professional and deal with the facts. It should not contain any unsubstantiated opinions or any disagreements. It should include a classification for each of your observations.

Where there are multiple observations relating to one system, it is better to categorize them under one heading: e.g., Documentation System or Validation Program, rather than make several individual observations.

Follow-ups
No audit is really complete unless you receive a response from your contractor and your company follows up on all the corrective action items. If the corrective action suggested by your contractor is not adequate, you must schedule a meeting of senior management and get their agreement to an alternative plan. This meeting should be followed by a teleconference with your contractor to discuss your position.

It is not wrong to ask contractors for detailed descriptions of what to expect from their corrective action plan. The auditor must be open to their suggestions, since they are sometimes the process experts. You need not push for a pet solution, if the team agrees to the contractor’s plan.

Once the corrective action plan is agreed to, you may choose to send periodic letters requesting the status of the plan. However, letters should be reserved to discuss critical and major items only, so as not to dilute their impact.

An audit program can be a powerful tool in managing a contractor’s quality and compliance systems. However as with any tool, it is only as good as its user. A poorly managed audit program will result in a waste of resources at both ends and may possibly ruin relationships between a sponsor and its contractors.

If used effectively however, an audit program offers following benefits:

• It provides your company with a comprehensive index of compliance and quality problems with your contractors.

• It facilitates a perpetual corrective action program for you and your contractor to address those problems.

• It creates a forum for planning newer and more effective quality systems to prevent such problems from occurring.

• It fosters a forward-focused team environment and improves relationships between the two companies.