Auditing with APIC
Checking the GMP status of API manufacturers

CEFIC’s APIC committee has
developed an audit program
designed to check the GMP status
of API manufacturers, API contract manufacturers and laboratories.
Here is an introduction to GMP
auditing in general and the APIC
program in particular.


The APIC Audit Program is a framework for evaluating the GMP status of active pharmaceutical ingredient (API) manufacturers, API contract manufacturers or laboratories. It was developed by APIC/CEFIC, the Active Pharmaceutical Ingredients Committee of the European Chemical Industry Council, in co-operation with Concept Heidelberg, a consultancy specializing in pharmaceutical regulatory affairs. The APIC Audit Program is coordinated by the API Compliance Institute, which was founded in December 2002.
GMP auditing is central to the API industry because both European Union and FDA regulations oblige pharmaceutical companies to use only APIs that have been manufactured in accordance with GMP. Audits are a powerful tool for senior managers who need to find out whether their suppliers meet GMP standards, and to compare what is actually in place with what should be in place.
Yet although auditing has become a common tool in the pharmaceutical industry and is frequently required by the authorities, international guidelines do not treat auditing in great detail. There is an ISO standard for quality audits (ISO 19011), but it does not contain specific
advice on GMP auditing. The WHO’s GMP guidelines are also very general.
Problems with GMP audits arise from misinterpretation of ICH Q7a, lack of standardization, and lack of training for auditors. The APIC Audit Program was developed to improve the quality of auditing by addressing all these issues. The result should be high-quality audits that need to be carried out less frequently than at present, with consequent benefits for both API manufacturers and pharmaceutical companies.

Five steps to a
successful audit
Central to the APIC Audit Program is
the recently-published “APIC/CEFIC Auditing Guide”, referred to in this article as the “Guide”. Written by experienced auditors, this document provides expert
guidance on best industry practices in planning, conducting and evaluating
audits, and shows how to set up and
maintain an effective audit system. The Guide covers audit types (internal and external); organizational aspects; steps in managing an audit; the content of an audit; documentation; qualification of the auditors; and the future development of audits.
Any audit should be thoroughly planned, carefully structured, systematically performed and faithfully reported. Any remedial actions should be progressed to
timely and satisfactory conclusions. The Guide defines five steps in managing an audit.
1. The first step is to collect and analyze the pre-audit information. Much of this can be collected from a customer questionnaire, for which Annex B of the Guide provides a template. Information collected at this stage can be categorized as:
general information about the company;
quality-related information;
product-related information;
GMP-related information;
comments from the company; and
(optionally) requested documents including CEPs, DMFs, specimen Certificates of Analysis, Site Master Files, etc.
It is also useful at this stage for the auditor and auditee to sign a secrecy agreement (Annex A). This helps to ensure that auditors get the information they need, while auditees are reassured that this information will not reach their competitors.
2.The second step is to prepare for the audit by evaluating the available information. Sources include the pre-audit questionnaire and previous audit reports. This allows the auditor to concentrate on areas with GMP deficiencies, so as to make best use of limited time and minimize as far as possible the disruption caused by the audit. This step ends with an agenda for the audit that should be agreed on by both parties.
3.The third step is the audit itself. This starts with an opening meeting to introduce staff from the auditor and the auditee to one another, review the scope and objectives of the audit, and finalize the agenda and timetable.
Annex C of the Guide is an aide-mémoire for this step. This checklist contains 19 chapters in accordance with ICH Q7a, and an additional chapter 20 covering the quality management system. Filling in the checklist during the audit helps the auditor to trace back his or her findings to the ICH Q7a guide.
4.The fourth step is the creation of the
audit report—the most important product of the audit. It is a good idea to send a draft of the report to the auditee, not so that the auditee can modify or correct observations but as away to clear up misunderstandings and encourage constructive comments. Audit reports are confidential and should never be shown to other parties without the permission of the auditee.
Annex D of the Guide is a template for the audit report. Recommendations in the report fall into four categories depending on their seriousness:
Conditions are classified serious if they will seriously affect the quality of the products and/or regulatory compliance. Such conditions violate essential GMP rules and basic quality assurance practices, and require immediate action.
Conditions are classified major if they may affect the quality of products and/or regulatory compliance. Such conditions violate GMP rules and basic quality assurance practices, and action is recommended.
Conditions are classified minor if they are unlikely to affect the quality of products and/or regulatory compliance, but still violate GMP rules.
Auditors are free to make recommendations to improve quality, safety and efficiency. Conditions that are subject to such recommendations are not GMP violations.
5.Essential to the whole idea of auditing and continuous improvement is the timely implementation of corrective actions and verification of their effectiveness. The fifth and final step is therefore to monitor follow-up actions closely. Significant delays in correcting problems raised by the audit indicates a lack of senior management support. The Guide gives advice on what to do in the unlikely event of the audit process breaking down.
Putting the Guide into practice
In December 2002, the APIC Audit Program was set up as a framework
within which the APIC Auditing Guide is to be used. The overall aim of the Program is to provide API manufacturers with independent audit reports, including statements of compliance, that they can forward to their customers. The result should be a reduced frequency of audits, and therefore reduced costs, for both API manufacturers and their customers.
Participation in the APIC Audit Program is voluntary and is open to all API manufacturers worldwide. An audit can be ordered by a pharmaceutical company as well as by the API manufacturer.
The basic documents for the APIC Audit Program are the ICH Q7a GMP Guide for APIs; an APIC publication entitled “GMPs for APIs: ‘How to do’ document”, which interprets ICH Q7a and explains best industry practice; and the “APIC Auditing Guide”. The Program follows three basic principles:
standardization of GMP audits;
compliance with the CEFIC/APIC Auditing Guide; and
controlled costs.
Standardization is in turn achieved by the use of experienced and trained auditors who are registered and certified to
carry out APIC audits; a standardized process for preparing, conducting and writing audit reports, including the final release of the audit report; and standardized audit costs. Concept Heidelberg administers the process on behalf of APIC.
Each audit follows a six-step process similar to that set out in the Guide.
1.First are preliminary talks with the customer about the scope and timescale of the audit. A signed contract between the customer and Concept Heidelberg is necessary before progressing any further. The contract framework has been approved by European lawyers and meets the requirements of European competition law.
2.Second, the pre-audit questionnaire (Annex B of the Guide) is sent to the auditee. The resulting basic information
about the auditee is used to plan the next stages of the audit.
3.In the third step, two APIC-certified auditors are chosen and their names forwarded to the auditee. The auditee is entitled to reject the auditors, but must explain the reasons for this; in this case, new auditors are selected. Once the auditors have been agreed, they receive copies of the filled-in pre-audit questionnaire. The auditee chooses a representative to be
responsible for the audit, and this person works directly with the auditors to set a tentative schedule for the audit.
4. The fourth step is the audit itself. The auditors record their observations in the aide-mémoire (Annex B of the Guide).
5. The fifth step concerns the audit report. Once the audit has been conducted, the auditors write their report and send it to Concept Heidelberg within approximately three weeks. Four weeks or less from the date of the audit, the auditee receives a draft audit report which includes a management summary, a statement of compliance, details of the areas covered by the audit, and a detailed list of observations. The auditee may respond to the observations to propose corrective actions, responsibilities and time frames.
6. The sixth and last step is for the final version of the audit report to be sent to the auditee, which may use the report in any way it wishes.
Training and certifying
auditors
Experienced auditors are a prerequisite for a successful audit. Successful GMP auditors need not just scientific competence but also strong interpersonal communication skills, and the APIC Audit Program is designed to ensure that only such people are used.
Every APIC auditor must be certified on behalf of APIC. To reach this stage, he or she must additionally have a suitable educational background and professional experience, training in the form of a special APIC auditing course, and a contract with Concept Heidelberg.
Qualifications as a pharmacist, chemist, medical doctor, chemical engineer, biologist or similar professional constitute a suitable educational background. A good knowledge of regulations, GMP guidelines and current scientific literature, plus practical experience of GMP matters, are also expected. According to the Guide, auditors must have at least two years’ professional experience in industry or a regulatory body.
The next requirement is attendance on a five-day qualification course. Three
days of the course are spent studying the requirements of ICH Q7a for GMP in API production, and the remaining two days are spent learning how to carry out an audit effectively.
After attending the course and signing a contract with Concept Heidelberg, the person concerned is accredited as an APIC auditor and can be chosen to carry out APIC audits. Initial certification of is valid for three years, after which auditors need to take part in a refresher course.
The first auditor training course started in January 2003, and 45 people have already qualified as APIC auditors. Nine of these auditors have asked for APIC certification, and the first pilot audit took place in September 2003.