GDP inspections: How to avoid defects

Very often the quality risk management for the qualification of logistics service providers is too immature. This can have serious consequences: If a logistics service provider is not sufficiently qualified and shortcomings in the logistics service provider are overlooked during the qualification process, this can later lead to situations that call drug quality and safety into question.

Why is risk management not used correctly in GDP practice?

It is often because unsuitable methods are used, or because assumptions are made rather than facts. The following example: At the beginning of the cooperation with a logistics service provider, it is not yet possible to rely on experience or even data. Therefore, an FMEA in which appearance and detection probabilities are evaluated with numbers makes little sense. Other methods, such as fault tree analysis, are more suitable at this point. Nevertheless, we often see FMEAs in which the risks were underestimated, so that these risks were not pursued further in the qualification process.

Are there further deficiencies that can frequently be found in the GDP area that you would like to address here?

Yes, there is indeed a topic, which provides again and again for long faces with the inspected company: the so-called "GDP certificates". If such a certificate is available, the scope of the qualification is gladly reduced. One feels safe because the GDP conformity of the logistics service provider has already been proven.

What exactly is the problem with these certificates?

Beside the GDP certificates of the supervisory authority there are also GDP certificates that are issued by private providers. The criteria, after which a GDP conformity is confirmed by a private certifier, are however not generally known and unfortunately also not uniformly fixed. Therefore one cannot simply trust these certificates blindly.

When are GDP certificates of private providers recognised during an inspection?

In order for a reduced scope of qualification to be recognised on the basis of a GDP certificate, two requirements must be met: On the one hand, the set of rules, the test criteria and the suitability and competence of the certifier must be known. It is therefore a question of transparency and traceability. On the other hand, the extent of the reduction must be risk-based and based on an assessment of the rules and regulations and the certifier. That brings us back to the subject of risk management.

Ms. Joos, thank you very much for this interesting insight into your work!

The interview was conducted by Doris Borchert, PhD, editor at GMP Publishing Peither.

Reading sample

Read below an excerpt from the new GMP Compliance Adviser Chapter 16.S.2 "Frequent deficiencies in the qualification of logistics service providers and how to avoid them".

In this chapter, GMP/GDP inspector Lea Joos describes the most common deficiencies in the qualification of logistics service providers and points out strategies for avoiding them. For each defect, you receive clear instructions in the form of a checklist.

Insufficient transparency

The deficiency

During the inspection, it was not clear why the requalification of logistics service provider Y was delayed. The initial qualification was carried out in 2014. According to the SOP, a requalification should have taken place in 2017. However, the audit did not take place until 10 October 2018. A notification of deviation was not created. There was no audit plan in place. (Ref: EU GDP Guidelines, 1.3, 4.1, 4.2 and 7.2)

The problem was

Good documentation should permit the tracking of operations relevant to GDP at any time (EU GDP Guidelines, 4.1).

Why did transparency fail in this case?

The SOP contains a clear specification for requalification. In the case of logistics service provider Y, the specified interval of 3 years could not be adhered to. The associated documentation concerning the requalification of logistics service provider Y by the wholesale distributor contained no reasons for the delayed audit. A notification of deviation was not created even though the interval specified in the SOP was not adhered to.

A deviation from SOP specifications is not a deficiency in principle. However, the deviation must be documented. The wholesale distributor should have noticed the deviation, documented at first. The wholesale distributor must then make an effort to look into the cause. In this case, according to the information provided by the wholesale distributor, two additional audits for an initial qualification and a follow-up audit had to be carried out unexpectedly in 2017. The audit of logistics service provider Y was therefore postponed by the wholesale distributor until 2018. There was a lack of appropriate risk assessment and documentation.

How to avoid this error

To illustrate the adjustment of the audit sequence, a risk analysis and assessment is required. This does not require the immediate creation of an FMEA. Where applicable, less complex risk analysis tools can also be used. The next steps must then be adapted accordingly in the notification of deviation and, if applicable, in the audit plan.

An audit plan can give a clearer overview in such cases. It makes it easier to see

• Which audits are to be conducted and when
• Which audits have been conducted and when
• Which additional audits were necessary and
• Which audits could not be conducted and were therefore postponed

Figure 1 shows what a wholesale distributor’s audit plan for 2017 should have looked like in this case.

Your checklist for audit planning

Transparency of audit planning

Create an audit plan with the following information for each contract acceptor subject to auditing:

• Interval for re-auditing
• Date of last audit
• Date of next planned audit
• Date of implementation
• Record deviations from the plan in the deviation system.
• Make changes to the audit plan (postponements, additional audits) on a risk basis and document the decisions made in each case.

Figure 2 Transparency of audit planning