Conducting in-depth investigations during GMP/GDP audits

Every auditor has his own auditing style and skills, but there are two very important characteristics an auditor needs to spot and analyze situations which may be undesirable; intellect and intuition. Intellect helps the auditor grasp the urgency and impact of the issue; intuition helps the auditor detect the issue in the first place.

It may be something as simple as a missing log entry, or a log with entries which are too good to be true. Auditee staff starting to look nervous or suddenly no longer providing answers are good indicators as well. Let’s say you have observed that there is no training record available for an employee in the lab for the HPLC analysis he is performing, what would you do? Simply make the observation; “An employee in QC has not performed required training for HPLC analysis X” or will you start to dig a little deeper?

There are three basic levels of inspection-depth:

• Checking absence,
• Checking adherence,
• Checking adequacy.

Checking Absence

It’s easy and fast to spot something that is missing, it’s undisputable as well. When there’s no record of the operator having followed the training, he didn’t follow it. No discussions there.

Checking Adherence

Now that we know that the operator hasn’t followed the training (absence), it’s time to check adherence. Is he the only operator in QC that hasn’t followed his/her training program or are there others? What happens in other departments? Checking adherence is slower but allows to turn a single event into a systemic flaw, increasing the seriousness of the observation.

Checking Adequacy

By now we may have established that not only QC skips mandatory GMP/GDP training, but other departments do the same. We’ve ticked absence and adherence. So, what about the people who did follow their training program, how adequate is the training?

Are people skipping it because it’s considered boring/repetitive or perhaps not applicable to their actual operations? Checking the adequacy of the training program takes a lot of time but since it’s a fundamental GMP/GDP activity, you would perhaps allocate more time to investigate the training program beyond simply noting that the QC operator did not follow a training on HPLC analysis X.

(Im)perfect systems

Sometimes you will find that nothing is absent at first glance, all logbooks are filled in correctly, everyone is trained according to schedule and all suppliers have been audited. You may find all deviations are closed and regular maintenance is always performed on time. We’ve only inspected one company in our twenty-nine years of GMP/GDP experience where we left with zero observations. With that knowledge in mind, when it looks too good to be true, it usually is.

There are companies which have 99% of their PQS (pharmaceutical quality system)/QMS (quality management system) in order, but only 10% of their process knowledge. They will inevitably fail a government inspection but should fail your audit as well.

There are obvious warning signs in these cases;

• The auditee uses FMEA in risk assessment but no other method or tool,
• Is the auditee really investigating Out of Trends of his process?,
• Training the same operator on the same SOP for the fifth time,
• The auditee has deviations/change-controls/training etc., but no answer when you ask what is critical in the auditee’s process,
• Has beautiful “flow of people”, “flow of material”, etc. (since that is required), but no risk analysis available associated with the flows.

What would you observe in these cases?

All of these warning signs should prompt you to dig deeper. It appears as though everything the QMS is in order, but at what cost? In our experience, there’s always a tradeoff.

Data Integrity

Some of the most common recorded observations in terms of data integrity in government / supplier inspections are;

• Backdating & post dating of records (not contemporaneously)
• Recording/signing for others
• Signing for the absent days
• Erasing of data with blade/eraser etc.
• Rewriting the data without authorization
• Fabricating of data
• Discarding of data
• Failure to retain raw data
• Undesirable results (OOS, OOT) were ignored and not investigated
• Re-testing of failed batches /in-valid assay without justification  /authorization
• Failing or suspect HPLC /sterility results are overwritten
• Selection of ‘good data’ to compensate / average failed batch results

All these issues should invite you to take a deeper look at whether these cases are isolated or systemic. It takes more time than simply observing the absence of a piece of data, but overall data integrity has been a hot topic in GMP and GDP government inspections in the past year (and the years to come), pharma organizations not adhering to data integrity will, justifiably, receive a serious observation in most cases.

The seriousness of your observation on data integrity will have to be based on the cause of the absence; is it a singular case, is it systemic? Why are operators behaving this way? Mistakes, stupidity or is the company falsifying data?

Classifying your observations thus requires in-depth investigation. One of the best sources for the classification of observations comes from the PIC/S 041-1. It divides observations into three categories; critical, major and minor.

Critical GMP/GDP Deficiencies

A deficiency which has produced, or leads to a significant risk of producing either a product which is HARMFUL to the human or veterinary patient or a product which could result in a harmful residue in a food producing animal

A critical deficiency also occurs when it is observed that the manufacturer has engaged in FRAUD, MISREPRESENTATION or FALSIFICATION of products or data.

Major GMP/GDP Deficiencies

Produced or may produce a product, which does not comply with its MARKETING AUTHORIZATION

Indicates a MAJOR deviation from EU GMP;

(Within EU) which indicates a major deviation from the terms of the manufacturing authorization;

Indicates a FAILURE to carry out SATISFACTORY PROCEDURES for release of batches or (within EU) a failure of the Qualified Person to fulfil his legal duties;

Combination of SEVERAL “MINOR” deficiencies, none of which on their own may be major, but which may together represent a major deficiency.

Minor GMP/GDP Deficiencies

A deficiency, which cannot be classified as either critical or major, but indicates a departure from GMP

(A deficiency may be “other” either because it is judged as minor, or because there is insufficient information to classify it as a major or critical).

Most obviously, the auditee isn’t going to be very happy with a major or critical observation. You’re already digging where the auditee hoped you wouldn’t and now it’s time to deliver the bad news. How do you present your conclusions in a way that the auditee is going to accept them?

Always prepare yourself thoroughly, build your case by following a logical thought process;

• Why did you want to investigate the operator training records in QC?
• Why is training important in GMP/GDP? (may be obvious but may not be so obvious to the auditee)
• What prompted you to check whether the absence of training was only in QC or companywide?
• Which observations made you check the adequacy of the training program overall?
• What is your overall conclusion on the GMP/GDP training adequacy?

Describe the behavior you observed. What did you actually see (and not imagine)? This is more concrete and you can avoid piling up irritations. Be specific and limit yourself to the facts Who, what, where, when, how, how much, and how many times?

Keep the following feedback rules in mind;

• Always works from 2 sides; giving and taking
• Receiver has to be open to it; verify this
• (If possible) always provide positive feedback first
• Give the feedback specific, clearly and humane. The receiver has to experience it as advice, not as an attack
• Don’t be afraid to show and talk about your feelings
• Indicate what the effect is of the behavior
• Focus on your future as well, what would you like to see differently?

Keeping these rules and approaches in mind you’re much more likely to be able to not only conduct but also present your in-depth investigations. After all, if the auditee doesn’t accept your conclusions, you’re going to have a long and tedious discussion between client and supplier which may not benefit the patient. After all, we audit to ensure our medicines are manufactured and distributed safely, with the right efficacy and in the right amounts. Not to prove a point. Always make a risk-based decision to investigate further based on the risk to the patient.

Auditor Training

The audit has become one of the most important tools to assess the competence and compliance of pharmaceutical suppliers and contractors. Regulatory requirements, the increasing outsourcing of all sorts of (manufacture) activities and the globalization of the supply chain, have lead to more and more audits being carried out in all parts of the world.

In any audit the real challenge is to come to a thorough and truthful assessment of the company under audit – in spite of any intentional and unintentional difficulties the auditor is faced with. Also, when non-compliances are observed these should be weighed, formulated and communicated in such a way that the auditee is inclined to resolve the actual issues at hand.

PCS has developed a 2-day training to provide more knowledge and more insight into the delicate intricacies of auditing to the attendants. During the training, lectures by highly experienced auditors/trainers, case studies and discussion forums will give opportunity to those present to share their experiences and discuss the challenges they experience when performing audits. This training intends to hand every auditor more tools and tricks to come to a thorough assessment of the company being audited.