Suppliers auditing

These packages are developed to meet specific needs of the user. Full life cycle validation is required and supplier audits are usually appropriate. 

For any new excipients, APIs or drug products (where new does not necessarily mean novel, but new to the receiving site) there are additional testing criteria, e.g. supplier audits, third-party contract laboratory audits, analytical method transfers, sample management/tracking, etc. For those key excipients, where there is on-site historical experience, it still behoves both parties to check whether the local grade/supplier used by the CMO is equivalent to that used by the supplier (Worsham, 2010). There are many examples of differences in excipient physical properties, e.g. particle size, which have been attributed to different excipient sources that could ultimately impact on the performance of those excipients in formulated products (Frattini and Simioni, 1984 Dansereau and Peck, 1987 Phadke et al., 1994 Lin and Peck, 1994). 

Category 4—Configurable Software Packages These software packages can be conhgured according to user requirements. A supplier audit is usually required to conhrm software has been developed according to a documented quality system. Validation should ensure software meets URS requirements. Full life cycle vahdation is needed. 

Note / required X not required."Supplier audit may be required for some category D instruments. Optional. 

System Evaluation and Supplier Assessment Usually there are many choices and suppliers for common COTS laboratory instruments. The user requirements and the operational requirements will provide the basic criteria for the selection. Obviously the chosen instrument must be able to fulfill the key requirements for its intended use. Other factors concerning the instrument such as its ease of use, maintenance, and reputation of the suppliers in terms of quality, reliability, and support should be considered. From a practical point of view, a supplier audit may not be viable or necessary for commonly used COTS instruments. A supplier assessment is sometimes used to evaluate whether the supplier has a good-quality system in place to support the development and manufacturing of the instrument of interest. The need for a supplier assessment depends on the criticality and complexity of the system to be obtained. 

URS preparation Supplier audit and evaluation Qualification protocol preparation Qualification review and reporting System access security Backup, archiving, and retrieval System operation and management Contingency/recovery planning System maintenance Calibration... 

Two main areas should be addressed, and the vendor records may need to be examined during the supplier audit. 

In many instances operating system software has already been developed and is offered as a fundamental part of the computer system ready for application software to be developed or configured. In such cases it is prudent to establish the existence of the respective software quality assurance plans and procedures and the design, development, and testing records. Identification and examination of this documentation can be conducted and recorded as part of the supplier audit. (See Sec. VI.)... 

Supplier prequalification response Supplier audit report Project and quality plans Software quality assurance plan Commercial and purchasing specs. 

Manufacturing Process Description Quality Critical Parameters User Requirement Specification Supplier Audit(s)... 

If the software will not be developed in house, conduct a software supplier audit... 

If elements of the hardware are unique, conduct a hardware supplier audit Select suppliers)... 

Conduct a Supplier Audit of the Computer Technology Suppliers and/or Developer... 

For colored plastics producers, a combined audit for ISO 9001 or ISO 9002 with laboratory assessment for ISO 17025 may be the preferred method of operation. For supplying the automotive industry, regardless of whether it is as a tier 1, 2, or 3 supplier, QS 9000 is a necessity. The good news is that interest and acceptance of ISO certification has virtually eliminated supplier audits. 

Quality control in the upstream supply chain is part of our supplier approval system and regular supplier auditing. The applied control systems are based, as within our own factory premises on the HACCP systems (Hazard Analysis on Critical Control Points). These quality control systems have been elaborated for each individual raw material. It is our objective to source our raw materials as far as possible from approved suppliers these are suppliers who are able to guarantee the qualities we require. 

Supplier Forum (2000), Guidance Notes on Supplier Audits Conducted by Customers, available through GAMP Forum (www.ispe.org). 

Validation Planning Supplier Audit Risk Management... 

Individual procedures can easily consume 10 to 15 days effort to produce, even with experienced staff. Use should be made of industry guidance when developing procedures, e.g., GAMP example procedures and IEEE standards. Where existing procedures are being revised to secure validation compliance, this estimate of effort could be reduced by about half. As recommended above, this should be supplemented with about 20 days effort across all the procedures, shared among a team of end users. The individuals should contain the core users who are involved in all the procedures in order to ensure consistency. Other end users on the team, however, can be seconded for the development of particular procedures in which they have a specific interest, or can contribute a particular skill or competence. For instance, an end user quality representative may wish to be seconded for the development of the Supplier Audit procedure. 

The steps in the validation life cycle are not necessarily executed in the order indicated. Rather, the steps are usually executed as an iterative process in which various functions may be carried out concurrently. If necessary, steps may be repeated. For instance, the Validation Master Plan may be developed after, or concurrently with, the User Requirements Specification (URS) rather than before, as indicated. Equally, a Supplier Audit often involves a series of steps that may not be complete until well into the validation project. 

Supplier Audit (for external rather than internal supphers)... 

Supplier Audits are conducted to determine at first hand the snpplier s capability. Audits are not normally reqnired for COTS software because they are market-tested. The performance of a... 

Supplier Audits are more beneficial if they are conducted as part of the supplier selection and procurement process so that any actions arising can be progressed within a project s implementation. More than one Supplier Audit may be appropriate or necessary for a system where multiple subsystem suppliers or subcontractors are used. The Validation Plan will document which suppliers require and do not require auditing and when these audits should take place. Table 5.2 indicates when Supplier Audits are required. 

A Source Code Review must be performed on application software unless there is evidence from the Supplier Audit that the source code has been, or will be, developed in a quality assured manner and subjected to review as part of its development life cycle. The decision and justification not to perform a review must be documented within the Validation Plan. 

Pharmaceutical and healthcare companies may consider conducting predelivery checks on their suppliers to verify that Supplier Project/Quality Plans have been implemented. Computer systems should not be accepted at their user sites if outstanding and agreed issues from the Supplier Audit have not been resolved to the satisfaction of the pharmaceutical or healthcare company. 

OQ protocols should define any ordering between individual tests. Specific tests may be reconunended by Supplier Audit, GxP Assessments, and Design Reviews. The RTM should be updated with OQ cross-references. The RTM should specifically identify where GxP functionality identified by the GxP Assessment is tested. 

Table 5.6 also defines responsibilities. The Originator responsibility is preparing a document or record, Review responsibility is confirming technical content and consistency with other validation activities, and Approve responsibility is authorizing the activity as complete and correctly documented. The Quality Unit may at its discretion, as part of its approval process, review or audit supporting and referenced deliverables. Due account must also be taken where a Supplier Audit determines that the pharmaceutical or healthcare company should take over a lead responsibility for a supplier s documentation responsibilities. The review and approval roles presented in Table 5.6 are consistent with the review of regulatory expectations presented in Chapter 14. 

Supplier Audit Report — X X For bespoke and critical COTS-based appUcations... 

Prequalification Activities X X X X on from Supplier Audit Site preparations, commissioning, and calibration... 

The definition of supplier validation activities and documentation should be embedded in contractual agreements. In addition, suppfiers should agree to potential inspection by GxP regulatory agencies and Supplier Audit by pharmaceutical and healthcare companies. Supplier Audits can be conducted by the pharmaceutical or healthcare company s own personnel or, if this would compromise the supplier s commercial interests, by an independent software quality assurance auditor, consultant, or validation expert employed by the pharmaceutical or healthcare company. Auditors must be suitably qualified, for example by independent certification by examination to the quafity system standards such as ISO 9001 2000. Suppfier Audits are discussed in detail in Chapter 7. 

Supplier Audit for complex and/or critical software packages. 

---