Document and Evaluate GMP Audit Information and Findings

The audit information is documented by the auditors in a comprehensible form, e.g. through clear references to relevant documents or records of discussions held. The verifiable audit evidence obtained in this way is then evaluated against the pre-defined audit criteria. Deviations (audit findings) are recorded in writing.

Audit findings are classified according to the following criteria:

Critical: The finding is likely to affect the safety, quality or efficacy of the product, or is in violation of applicable law, or a large number of significant findings indicate a fundamental failure of the quality assurance system.

Major: The finding is not critical, but represents a significant violation of the GMP guidelines or existing quality agreements, or a large number of minor findings indicates fundamental problems with the quality assurance system.

Minor: The finding is of minor importance with respect to the required compliance with GMP guidelines or existing quality agreements.

Every company is faced with the question of how to evaluate audit findings. A number of companies then follow the procedure of the authorities as described, for example, in the procedural instruction 121103(04) of the German GMP inspectorates - after all, what the authority does cannot be wrong, so the thinking goes ...

However, the objective of an inspecting authority is by no means identical to that of an auditing company, so that the assessment of the findings collected will also be different. For example, the above-mentioned procedural instruction considers a defect in a product to be critical only if the product is "potentially life-threatening or can cause serious damage to health". Companies, on the other hand, would do well to hold their suppliers (for whose products they pay and who can have a considerable influence on the quality of their own products) strictly accountable much earlier. An auditing company should therefore by no means consider a defect to be critical only when there is an imminent danger to life and thus give the necessary emphasis to the implementation of corrective measures.

Other companies use a rating system that generally places persistent findings from a previous audit (i.e. those that are re-discovered during a re-audit) in the next higher category. This has the advantage that such findings automatically receive more attention over time. However, not every minor finding "really" becomes a major or critical finding simply because it persists for a longer period of time. Instead, the automatic upgrading can obscure the view of the findings that are truly relevant.

Depending on the criticality of a finding, some companies also set fixed timeframes for implementing corrective actions. This is not advisable either. Critical and serious deficiencies in particular should be corrected quickly. However, the time frame for the full implementation of a corrective action depends on the specific action. If timeframes for the implementation of corrective actions are set, it is better to set them in the audit report for the specific findings rather than in a general way in the audit SOP.

Whatever the specific assessment of audit findings looks like: In any case, it is important that a company responsibly chooses assessment specifications that fit its own quality management system and meet its requirements.

The auditors record and document the audit information and, in particular, the audit findings in communication with the auditee so that any misunderstandings can be clarified as soon as possible.

It is strongly recommended that audit findings be identified as soon as they become apparent, rather than waiting until the closing meeting. On the one hand, this provides an opportunity to clarify the observed facts directly with the audit committee experts accompanying the audit, to clear up any misunderstandings and thus to verify the audit findings. On the other hand, the final discussion is much more effective: all findings are already known from the audit and only need to be summarised.

In the case of critical audit findings that indicate an immmediate and significant risk, e.g. processing of a wrong active ingredient in the medicinal product, wrong labelling (label and contents are different products), (medicinal product) counterfeiting, etc., the discovering auditor immediately informs the lead auditor. The lead auditor verifies the facts and then informs the contact person of the audit committee, also immediately, and then interrupts the audit to inform the responsible persons of Maas & Peither Pharma GmbH (competent person, head of production, head of quality control, management). This enables the immediate coordination of corrective actions between the auditee and Peither Pharma GmbH, as well as any additional actions required at Peither Pharma GmbH.

The article is a translated excerpt from the German sample SOP-106-02 ‘Audits und Selbstinspektionen’ (audits and self-inspections).