Supplier Qualification and Outsourcing
Outsourcing is a critical process in the pharmaceutical industry. A whole series of quality assurance requirements are laid down in the corresponding GMP regulations. EU-GMP Guidelines and national legislation refer to what has to be regulated between the contract giver and the contract acceptor or supplier to ensure the quality of the product. The qualification of suppliers, contract manufacturers and contract laboratories is an essential part of the selection and subsequent cooperation. Many aspects have to be clearly regulated in advance, e.g. in contracts. Furthermore, questions arise in the operative business for which both contractual partners must find mutually acceptable answers while fulfilling the GMP requirements.
Legal basis
The pharmaceutical manufacturer is obliged to control all outsourced activities. Chapter 7 of the EU-GMP Guidelines clearly states: "Any activity covered by the GMP Guide that is outsourced should be appropriately defined, agreed and controlled [...]. There must be a written Contract between the Contract Giver and the Contract Acceptor which clearly establishes the duties of each party. The Quality Management System of the Contract Giver must clearly state the way that the Qualified Person certifying each batch of product for release exercises his full responsibility" and under point 7.4 "The pharmaceutical quality system of the Contract Giver should include the control and review of any outsourced activities. The Contract Giver is ultimately responsible to ensure processes are in place to assure the control of outsourced activities."
Supply chain requirements are described in Chapter 5.29 of the EU-GMP Guidelines. API manufacturers are also and above all taken into account here and audits are clearly required: "Audits should be carried out at the manufacturers and distributors of active substances to confirm that they comply with the relevant good manufacturing practice and good distribution practice requirements". For manufacturers of excipients it is required to carry out at least a risk assessment, which might also foster the need to perform an on-site audit.
According to Annex 16 of the EU-GMP Guidelines, supplier qualification is one of the tasks of the Qualified Person, which can, however, be delegated. The Qualified Person must ensure that "supplier quality management systems are in place that ensure only materials of the required quality have been supplied". (1.7.6)
Recommendation
Berlin, Germany4/5 December 2024
Root Cause Analysis
The ICH Q10 Pharmaceutical Quality System Guidance also emphasizes the responsibility of pharmaceutical manufacturers for outsourced activities. The document states that a contract giver "should be responsible for assessing the suitability and competence of the contract acceptor to carry out the work required".
Further requirements can be found in the appendix.
Supplier qualification is more than just an audit
When it comes to supplier qualification, it is unfortunately still frequently forgotten that audits or audit reports are only one component of supplier qualification. Audit reports eventually contain a description of the GMP situation determined during the audit. In addition to the audit report, however, further information must also be consulted. For example, other available reports from authorities (e.g. FDA warning letters), non-compliance reports from the EudraGMDP database, or information from the EDQM database. The type of service or purchased goods also plays a role in the overall evaluation, as does a consideration of transport routes.
All information should be included in a risk assessment, with the help of which one can not only plan audits and audit frequency, but also evaluate and qualify suppliers accordingly. Two systematic methods of risk analysis are often mentioned in this context, FMEA (Failure Mode and Effects Analysis) and HACCP (Hazard Analysis and Critical Control Points), which can be used here.
The ICH Guideline Q9 lists a number of points that should be considered during audit planning. Those are also helpful during final and ongoing assessment and qualification:
- Existing legal requirements;
- Overall compliance status and history of the company or facility;
- Robustness of a company's quality risk management activities;
- Complexity of the site;
- Complexity of the manufacturing process;
- Complexity of the product and its therapeutic significance;
- Number and significance of quality defects (e.g., recall);
- Results of previous audits/inspections;
- Major changes of building, equipment, processes, key personnel;
- Experience with manufacturing of a product (e.g., frequency, volume, number of batches);
- Test results of official control laboratories.
A new PIC/S guideline on GMP inspections1 is being considered to help Competent Authorities prioritising their resources for GMP inspections of human or veterinary medicinal products. The document is a non-binding guide for authorities involved in the International Coalition of Medicines Regulatory Authorities (ICMRA) and PIC/S, but the process presented can also be used by pharmaceutical companies as a model for their risk-based supplier qualification and auditing activities.
A clearly structured documentation system is then required to summarise and document the risk assessment and evaluation. Forms and appropriate IT systems facilitate the procedure here. All facts and figures should be brought together. At the latest, the Qualified Person (QP) should be involved in the supplier qualification and approval process - the QP must at least have free access to all information (see also EU-GMP Guidelines Annex 16 1.7.2 and 1.7.3). A summary report with cross-references can also be presented to an authority representative during an inspection without immediately submitting complete audit reports.
Already qualified suppliers must be assessed or re-qualified regularly. This involves a comparison of the supplier's current performance with the previously defined and agreed specifications. The experiences with the supplier and the evaluation of received service or delivered goods are also taken into account here. Furthermore, changes at the supplier (e.g. personnel, manufacturing process, etc.) must be evaluated. The pharmaceutical manufacturer should be informed of these changes immediately. Re-qualification is also supported by a documented risk assessment. This makes processes more transparent and comprehensible and facilitates decisions. Possible risks are identified early enough and countermeasures can be taken in due time. On the other hand, a positive risk assessment can reduce the cost of audits (less and, if possible, shorter audits). This helps to save direct and indirect costs.
Contracts
In the GMP environment, contracts are an important element to define tasks, responsibilities and specifications. Ultimately, all elements of cooperation between the contract giver and the contract acceptor can be part of the contract. For a better overview, it is advisable to create different contracts:
- Supply contract: regulates individual commercial conditions for the order including delivery conditions, payment modalities and warranty.
- Non-disclosure/ secrecy agreement: regulates and clarifies the conditions for the exchange of information.
- Quality contracts (technical contract / quality agreement / delimitation of responsibilities): all GMP-relevant aspects are defined here, such as
- detailed description of all manufacturing and testing processes (possibly with flow and process step diagrams)
- Process parameters with specifications
- Procurement, testing and storage of starting and other materials
- Assignment of quality-relevant activities
- Flow of information
- Preparation and provision of documentation
- Matrix of responsibilities
In the EU-GMP Guidelines Chapter 7 on outsourced activities, the expectations regarding quality contracts are clearly defined. In the USA, guidance on this topic was not particularly detailed until a few years ago. In 2016, the US Food and Drug Administration (FDA) finalised and published its Guidance for Industry entitled "Contract Manufacturing Arrangements for Drugs: Quality Agreements".
In order for existing contracts to fulfil their purpose, they must always be up to date. As in the case of supplier qualification, this results in the obligation to regularly review and evaluate contracts. This is also required in the EU Product Quality Review (PQR) (EUGMP Guidelines Chapter 1, Section 1.10 xii).
Conclusion
Supplier qualification is intended to identify and minimise risks arising from outsourcing. The overall package of all measures is intended to increase the transparency of the supply chain, verify the trust placed in suppliers and service providers, aim for constant quality of the service or product and ensure a good and steady relationship.
Recommendation
22/23 January 2025
HPLC Data Integrity - Live Online Training
Appendix: Additional Guidance
Article 8 of EU-Directive 2001/83/EC
"The application [of a marketing authorization] shall be accompanied […] by […] a written confirmation that the manufacturer of the medicinal product has verified compliance of the manufacturer of active substance with principles and guidelines of good manufacturing practice by conducting audits."
Article 46 of EU-Directive 2001/83/EC
"The holder of a manufacturing and/or import authorisation shall at least be obliged […] to use only active substances, which have been manufactured in accordance with GMP for active substances and distributed in accordance with GDP for active substances and … to ensure that the excipients are suitable for use in medicinal products by ascertaining what the appropriate GMP is."
Article 46b of EU-Directive 2001/83/EC
"Active substances shall only be imported if they have been manufactured in accordance with standards of good manufacturing practice at least equivalent to those laid down by the European Union". This can be shown by a written confirmation or the exporting country is included in the so called white list or a waiver has been granted."
EU-GMP Guidelines Chapter 5 (Production):
5.27 "The selection, qualification, approval and maintenance of suppliers of starting materials, together with their purchase and acceptance, should be documented as part of the pharmaceutical quality system..."
5.29 "Audits should be carried out at the manufacturers and distributors of active substances to confirm that they comply with the relevant good manufacturing practice and good distribution practice requirements. (…) Audits should be of an appropriate duration and scope to ensure that a full and clear assessment of GMP is made; (…). The [audit] report should fully reflect what was done and seen on the audit with any deficiencies clearly identified. Any required corrective and preventive actions should be implemented. Further audits should be undertaken at intervals defined by the quality risk management process to ensure the maintenance of standards and continued use of the approved supply chain."
5.45 "The selection, qualification, approval and maintenance of suppliers of primary and printed packaging materials shall be accorded attention similar to that given to starting materials."
Chapter 7 of the EU-GMP Guidelines (Outsourced Activities) describes the responsibilities of the Contract Giver when it comes to contract manufacturing and testing. He needs to assure the control of the outsourced activities, incorporating quality risk management principles and including continuous reviews of the quality of the Contract Acceptor's performance. Audits are helpful tool to assess the "legality, suitability and the competence of the Contract Acceptor". Chapter 7 was designed to intensify the control of Contract Acceptors by the Contract Giver and extend those controls to subcontractors.
Author:
Wolfgang Schmitt
... is Operations Director and organises and conducts courses and conferences on behalf of the ECA Academy in the areas QA and GMP.
