Outsourcing is a critical process in the pharmaceutical industry; a whole series of quality assurance measures are required in the corresponding GMP regulations.
EU-GMP guidelines and national legislation refer to what has to be regulated between the contract giver and the contract acceptor or supplier to ensure the quality of the product.
The qualification of suppliers, contract manufacturers and contract laboratories is an essential part of the selection and subsequent cooperation between companies and many aspects have to be clearly regulated in advance, particularly in contracts.
Furthermore, questions arise in the operative business for which both contractual partners must find mutually acceptable answers while fulfilling the GMP requirements.
The pharmaceutical manufacturer is obliged to control all outsourced activities. Chapter 7 of the EU-GMP Guidelines clearly states: “Any activity covered by the GMP Guide that is outsourced should be appropriately defined, agreed and controlled [...].
There must be a written contract between the contract giver and the contract acceptor, which clearly establishes the duties of each party.
Supply chain requirements are described in Chapter 5.29 of the EU-GMP Guidelines. API manufacturers are also, and above all, taken into account
The Quality Management System of the contract giver must clearly state the way that the Qualified Person certifying each batch of product for release exercises his full responsibility”, and under point 7.4 it further states: “The pharmaceutical quality system of the contract giver should include the control and review of any outsourced activities. The contract giver is ultimately responsible to ensure processes are in place to assure the control of outsourced activities.”
Supply chain requirements are described in Chapter 5.29 of the EU-GMP Guidelines. API manufacturers are also, and above all, taken into account here and audits are clearly required as follows: “Audits should be carried out at the manufacturers and distributors of active substances to confirm that they comply with the relevant good manufacturing practice and good distribution practice requirements.”
For manufacturers of excipients, it is required to carry out at least a risk assessment, which might also foster the need to perform an onsite audit.
According to Annex 16 of the EU-GMP Guidelines, supplier qualification is one of the tasks of the Qualified Person (QP). The duties, however, can be delegated. The QP must ensure that “supplier quality management systems are in place that ensure only materials of the required quality have been supplied”.
The ICH Q10 Pharmaceutical Quality System Guidance also emphasises the responsibility of pharmaceutical manufacturers for outsourced activities. The document states that a contract giver “should be responsible for assessing the suitability and competence of the contract acceptor to carry out the work required”. Further requirements are listed in the Appendix below.
Wolfgan Schmitt
More than just an audit
When it comes to supplier qualification, it is unfortunately still forgotten that audits or audit reports are only one component of supplier qualification.
Audit reports eventually contain a description of the GMP situation determined during the audit. In addition to the audit report, further information must also be consulted: other available reports from authorities (e.g. FDA warning letters), non-compliance reports from the EudraGMDP database or information from the EDQM database. The type of service or purchased goods also plays a role in the overall evaluation, as does a consideration of transport routes.
All information should be included in a risk assessment, with the help of which one can not only plan audits and audit frequency but also evaluate and qualify suppliers accordingly.
Two systematic methods of risk analysis are often mentioned in this context: the FMEA (Failure Mode and Effects Analysis) and HACCP (Hazard Analysis and Critical Control Points), which can be used here.
The ICH Guideline Q9 lists several points that should be considered during audit planning. Those are also helpful during the final and ongoing assessment and qualification:
- Existing legal requirements
- Overall compliance status and history of the company or facility
- Robustness of a company's quality risk management activities
- Complexity of the site
- Complexity of the manufacturing process
- Complexity of the product and its therapeutics
- Number and therapeutic significance
- Results of previous audits/inspections
- Major changes in building, equipment, processes, key personnel
- Experience with manufacturing of a product (e.g., frequency, volume, number of batches)
- Test results of official control laboratories
A new PIC/S guideline on GMP inspections is being considered to help Competent Authorities prioritising their resources for GMP inspections of human or veterinary medicinal products. The document is a non-binding guide for authorities involved in the International Coalition of Medicines Regulatory Authorities (ICMRA) and PIC/S, but the process presented can also be used by pharmaceutical companies as a model for their risk-based supplier qualification and auditing activities.
A clearly structured documentation system is then required to summarise and document the risk assessment and evaluation. Forms and appropriate IT systems facilitate the procedure here. All facts and figures should be brought together. At the latest, the QP should be involved in the supplier qualification and approval process — at least the QP must have free access to all information (see also EU-GMP Guidelines Annex 16 1.7.2 and 1.7.3).
A summary report with cross-references can also be presented to an authority representative during inspection without immediately submitting complete audit reports.
Already qualified suppliers must be regularly assessed or re-qualified. This involves a comparison of the supplier's current performance with the previously defined and agreed specifications.
The experiences with the supplier and the evaluation of received service or delivered goods are also considered here. Furthermore, changes at the supplier (e.g. personnel, manufacturing process, etc.) must be evaluated. The pharmaceutical manufacturer should be informed of these changes immediately.
Re-qualification is also supported by a documented risk assessment. This makes processes more transparent and comprehensible and facilitates decisions. Possible risks are identified early enough and countermeasures can be taken in due time. A positive risk assessment can also reduce the cost of audits (less and, if possible, shorter audits). This helps to save direct and indirect costs.
Tasks, responsibilities and specifications
In the GMP environment, contracts are an important element to define tasks, responsibilities and specifications. Ultimately, all elements of cooperation between the contract giver and the contract acceptor can be part of the contract.
It is advisable to create different contracts:
Supply contracts regulate individual commercial conditions for the order including delivery conditions, payment modalities and warranty.
Non-disclosure/secrecy agreements regulate and clarify the conditions for the exchange of information.
Quality contracts (technical contract/quality agreement/delimitation of responsibilities) are used to define all GMP-relevant aspects, such as:
- A detailed description of all manufacturing and testing processes (possibly with flow and process step diagrams)
- Process parameters with specifications
- Procurement, testing and storage of starting and other materials
- Assignment of quality-relevant activities
- Flow of information
- Preparation and provision of documentation
- Matrix of responsibilities
In the EU-GMP Guidelines Chapter 7 on outsourced activities, the expectations regarding quality contracts are clearly defined. In the US, guidance on this topic was not particularly detailed until a few years ago. In 2016, the FDA finalised and published its Guidance entitled Contract Manufacturing Arrangements for Drugs: Quality Agreements.
For existing contracts to fulfil their purpose, they must always be up to date. As in the case of supplier qualification, this results in the obligation to regularly review and evaluate contracts. This is also required in the EU Product Quality Review (PQR) (EU-GMP Guidelines Chapter 1, Section 1.10 xii).
Supplier qualification is intended to identify and minimise risks arising from outsourcing. The overall package of all measures is intended to increase the transparency of the supply chain, verify the trust placed in suppliers and service providers, aim for a constant quality of the service or product and ensure a good and steady relationship.
Appendix: Additional Guidance
Article 8 of EU-Directive 2001/83/EC
“The application [of a marketing authorisation] shall be accompanied […] by […] a written confirmation that the manufacturer of the medicinal product has verified compliance of the manufacturer of active substance with principles and guidelines of good manufacturing practice by conducting audits.
Article 46 of EU-Directive 2001/83/EC
“The holder of a manufacturing and/or import authorisation shall at least be obliged […] to use only active substances, which have been manufactured in accordance with GMP for active substances and distributed in accordance with GDP for active substances and […] to ensure that the excipients are suitable for use in medicinal products by ascertaining what the appropriate GMP is.”
Article 46b of EU-Directive 2001/83/EC
“Active substances shall only be imported if they have been manufactured in accordance with standards of good manufacturing practice at least equivalent to those laid down by the European Union”. This can be shown by written confirmation or the exporting country is included in the so-called white list or a waiver has been granted.
EU-GMP Guidelines Chapter 5 (Production)
5.27 “The selection, qualification, approval and maintenance of suppliers of starting materials, together with their purchase and acceptance, should be documented as part of the pharmaceutical quality system...”
5.29 “Audits should be carried out at the manufacturers and distributors of active substances to confirm that they comply with the relevant good manufacturing practice and good distribution practice requirements. […] Audits should be of an appropriate duration and scope to ensure that a full and clear assessment of GMP is made; […]. The [audit] report should fully reflect what was done and seen on the audit with any deficiencies clearly identified. Any required corrective and preventive actions should be implemented. Further audits should be undertaken at intervals defined by the quality risk management process to ensure the maintenance of standards and continued use of the approved supply chain.”
5.45 “The selection, qualification, approval and maintenance of suppliers of primary and printed packaging materials shall be accorded attention similar to that given to starting materials.”
Chapter 7 of the EU-GMP Guidelines (Outsourced Activities) describes the responsibilities of the contract giver when it comes to contract manufacturing and testing. He needs to assure the control of the outsourced activities, incorporating quality risk management principles and including continuous reviews of the quality of the Contract Acceptor's performance. Audits are a helpful tool to asses the legality, suitability and the competence of the Contract Acceptor”. Chapter 7 was designed to intensify the control of Contract Acceptors by the contract giver and extend those controls to subcontractors.
N.B. This article is featured in the January 2020 issue of Cleanroom Technology. Subscribe today and get your print copy!
The latest digital edition is available online.