Postal audits

Postal Audits are usually used as part of the supplier selection shortlisting process. They may recommend an audit on a supplier s premises where extra detail is required, but typically such Supplier Audits are reserved for the preferred supplier in order to confirm their acceptability from a compliance perspective. 

Howard Garston-Smith, formerly of Pfizer, has published a book on software quality assurance. It provides a postal audit checklist reproduced in Appendix 7C. If the supplier has already prepared an internal ISO 9000 mapping or an internal audit report on how it aligns to industry standards such as the GAMP Guide, this can be offered as an alternative to the auditor s postal checklist. A reduced postal checklist may be agreed upon, at the very least. Wherever possible, photocopies of actual example documents and test records should be inspected for documentary evidence of validation. Remember that the pharmaceutical and healthcare companies are themselves being inspected for documentary evidence of validation. 

The key to the process is to understand the system that is being proposed. It is good practice for the auditor to spend time reviewing the User Requirement Specification and the system descriptions and understanding of what software categories exist for the proposed system. This should be followed up, with the postal audit checklist. This will also provide valuable information to enable the auditor to plan the audit. Available information should be used to customize the audit checklist to address the specific issues that are relevant to both the supplier and proposed project. Consider, for example, a system that includes hardware and software, where some of the software is custom, other parts are configurable and yet others are part of a standard package. The auditor will need to establish how each part of the system will be developed, and how the build phase will be controlled. There may even be more than one supplier. The auditor would need to split up the main elements and examine how each part of the system will be built. 

A flow chart indicating the activities of the auditor or audit team is given in Figure 30.4. The foUowing sample supplier questionnaire can be used as the basis of the supplier audit, postal audit, and audit checklist. 

Where a site audit is required, the audit can focus on the main areas of concern raised by the postal audit, thus reducing the duration of the audit and enabling a more in-depth review of the main areas of risk. 

An audit report will be produced for each supplier, documenting the positive and negative observations made during the assessment of the response to the postal audit questionnaire and/or the site audit. All corrective actions must be followed up, possibly requiring further site visits, in order to ensure that nonconformance issues have been appropriately addressed in a timely manner to minimize the impact on project success. 

The Supplier Audit establishes whether the controls applied to the development of the core product and application configuration are consistent with GxP requirements and whether the organization is technically, organisationally and commercially capable of supporting the application for its anticipated life. The Supplier Audit will collate information for review and, where required, corrective action and whether a follow-up audit is required. An example postal audit questionnaire is presented in Table 7.3. The questionnaire is not exhaustive however, it clearly demonstrates the objective and scope of the postal audit. 

Appendix 1C Example Postal Supplier Audit Questionnaire.174... 

A supplier may be contacted informally to discuss the most appropriate audit route, prior to any formal approach being made to conduct an audit. Any proposal or bid made by a supplier should contain the contact details for the quality managers and personnel so that the auditor can easily liaise with the appropriate representative in the supplier s organization to discuss the next steps. When the auditor contacts the supplier to organize an audit, the supplier should also get the auditor s details (full name, postal address, telephone, fax, e-mail, and even video conference details where appropriate) for future communications. 

Auditors should agree to response times with suppliers when using the postal checklist. Busy contract periods, illness, holidays, and staff turnover may all delay the responses. Before agreeing to a response time, suppliers should ask to see a copy of the audit checklist so that the amount of work needed to reply can be gauged. 

The supplier should prepare presentation material to introduce the QMS, the quality management organization and an overview of the main procedures. The supplier may well be asked to respond to a postal questionnaire prior to an audit on the supplier s premises. This response may even negate the need for an audit of the supplier s premises if information returned fully answers audit questions. Even if an audit visit is still required, a good postal questionnaire response will enable the customer to focus on open topics during the audit, so it is in the supplier s interest to put sufficient effort into the postal exercise. 

---