Can you imagine sending a copy of the U.S. Code of Federal Regulations to your foreign supplier for them to read the U.S. Food and Drug Administration’s GMP requirements?
Official GMP regulations can be lengthy and hard to decipher, even as a native English speaker. Just understanding the regulatory jargon would be difficult enough for your supplier, let alone implementing the requirements.
That’s why many importers rely on a clear GMP audit checklist to maintain GMP compliance and find any violations at their foreign suppliers’ facilities (related: GMP Compliance of Foreign Supplier’s: The Importer’s Guide [eBook]). A tailored audit checklist is the backbone of an effective supplier audit.
Having a comprehensive checklist ensures factory staff understand your requirements. It also helps any third-party auditors you’ve hired to follow these requirements when auditing your supplier’s factory.
Let’s look at some of the most important information to include in your GMP audit checklist.
GMP audit checklists organized by factory system
The points in GMP checklists are typically grouped by factory system to reflect requirements at various stages of a factory’s operations. An auditor will check several subpoints related to the GMP requirements within each system.
An audit conducted with an incomplete checklist can provide unreliable results, leading you to believe your supplier is compliant when they really aren’t. Missing a small violation during a pre-audit can snowball into a much bigger problem down the road if you fail an official FDA inspection.
Your own checklist will likely include additional sections specific to your product type and supplier. But most effective GMP audit checklists should, at the very least, include sections addressing the following seven systems:
1. Organization and personnel
Your supplier may source high-quality raw materials and have cutting-edge equipment at their facility. But it will all be for naught without the right personnel handling your products. Your GMP audit checklist should address whether the factory’s hiring and supervising practices are GMP compliant.
According to GMP requirements, factory personnel must:
- Have a background of education, training or experience, or a combination thereof, to provide a level of competency necessary for their assigned functions
- Practice good personal hygiene, sanitation and health habits
- Wear appropriate protective gear to prevent contamination
Organizational responsibilities include:
- Maintaining an adequate number of qualified personnel to perform and supervise the manufacture, processing, packing or holding of products
- Limiting access of controlled production areas to management-authorized personnel
- Excluding any person with an apparent illness or open lesions from any operations that could lead to contamination
- Conducting continual GMP training to ensure employees remain familiar with all GMP requirements applicable to them and maintain training records
Responsibilities of the “quality control unit”
GMP regulations place all responsibilities for product quality on the “quality control unit”.
A professional GMP audit checklist should verify whether a quality control unit operates according to GMP regulations. According to 21 CFR 211.22, the responsibilities of a quality control unit include:
- Approving and rejecting production units, outsourced product components, in-process materials, packaging materials and labeling. The quality control unit should have the authority to review production records and approve or reject goods to assure no errors have occurred.
- Maintaining adequate laboratory facilities for testing and approving components or products.
- Approving or rejecting procedures and specifications that impact the product, including product identity, strength, quality and purity.
- Explicitly outlining procedures and responsibilities in writing.
There are no specific requirements for the size or organization of the quality control unit. But it should be an independent entity capable of objective oversight over other personnel and departments.
2. Buildings and facilities
Proper control of buildings and facilities should begin well before production. In fact, GMP compliance starts with the construction, development and purchasing of a facility. A factory’s layout can directly impact it’s processing, packing and holding efficiency.
Many importers mistakenly assume building and facility requirements only refer to the internal environment of a factory. But the FDA holds factories—and by extension, their customers—accountable for maintaining an appropriate external environment surrounding their facility as well.
Land, air or water resources that surround the factory can offer the potential for water damage, infestation or contamination. Unmaintained areas could become a breeding ground for insects and pests. So something as simple as neglecting to cut the grass on the factory grounds could put products at risk for contamination.
Get facility design right from the start. For most importers, this means looking for suppliers with proper facilities.
Facility design and construction requirements for GMP
Buildings should be of suitable size, construction and location to facilitate cleaning, maintenance and operations without product mix-ups.
Important facilities and equipment requirements to include in your GMP checklist are:
- Lighting: Provide adequate lighting for all work spaces
- Ventilation: Provide adequate ventilation or control equipment to minimize odors, microorganisms and dust, as well as control air pressure, humidity and temperature
- Plumbing: Supply potable water through a plumbing system that’s free of defects that could contribute to contamination
- Sewage and refuse: Dispose of sewage, trash and other refuse in a safe and sanitary manner
- Washing and toilet facilities: Provide hot and cold water, soap, air driers or single-service towels and clean toilet facilities
Though GMP regulations for medical devices lack a specific section dedicated to buildings and facilities, facility controls are no less important for medical devices.
These requirements are mostly indicated in the production and process controls section under “contamination control”, “environmental control” and “buildings”.
Sanitation controls related to GMP
Your supplier should maintain their entire facility in a clean and sanitary condition. Floors, walls and ceilings must be adequately cleaned and maintained to prevent contamination.
Factory staff should maintain written procedures assigning responsibility for sanitation. The factory must also control the use of insecticides, cleaning and sanitizing agents to ensure toxic agents don’t come in contact with products.
Factories often hire a combination of full-time, part-time and contractual cleaning staff. Without clear records, if crew in one shift fail to clean a product testing surface according to the protocol, crew in the next shift might not notice.
This violation could lead to product contamination and serious safety hazards for consumers in the case of food or drug products. So all cleaning staff need to be consistently held accountable to the same cleaning standards and procedures.
3. Equipment and utensils
Almost all manufacturing requires some equipment in even the most basic factories. The equipment system under GMP regulation generally must:
- Not have a negative impact on product quality
- Be easy to clean
- Comply with applicable technical rules
- Be suitable for its purpose
A
ll automatic, mechanical or electronic equipment should be routinely calibrated, inspected or checked as per written procedures to ensure proper performance. Staff should also regularly calibrate and verify inspection, measuring and testing equipment to ensure valid results.
Equipment qualification
A supplier should also conduct equipment qualification to ensure equipment can meet and maintain quality standards for production. Equipment qualification typically involves three stages:
- Installation qualification: Verifying proper installation in alignment with design specifications
- Operational qualification: Verifying operation within specified functional parameters
- Performance qualification: Verifying the ability of a process to meet user-required specifications and output
Equipment cleaning and maintenance validation
Another common equipment checkpoint for GMP is confirming whether the factory conducts cleaning and maintenance validation to prevent malfunctions that could lead to product contamination. Your checklist should address this with points designed to confirm whether your supplier:
- Ensures surfaces that contact components, in-process materials or products are not reactive, additive or absorptive to minimize accumulation of bacteria or contamination
- Prevents equipment lubricants or coolants from coming into contact with products
- Establishes and maintains written protocols and records detailing equipment cleaning and related staff responsibilities
Failure to properly disassemble equipment for cleaning can lead to contamination issues over time. Without these controls, equipment could alter product safety, identity, strength, quality or purity.
4. Production and process controls
The FDA requires production and process control procedures at all stages of manufacturing to ensure products meet all quality attributes and specifications.
Your GMP audit checklist should include points to address production controls, include controlling:
- Raw materials: Do factory staff inspect and properly store raw materials for production?
- In-process materials: Does the quality control unit test, approve and reject in-process materials for identity, strength, quality and purity as appropriate?
- Production units: Does the quality control unit approve and reject production units?
- Rejected units: Has the factory established a quarantine system to prevent the use of rejected in-process materials in further manufacturing?
Change control and GMP
Manufacturers establish change control procedures to ensure that any changes to production processes are introduced in a controlled and coordinated manner. Change control procedures ensure the factory maintains its validated state even if there are changes over time to production processes.
Without change control, changes can disrupt production or lead to product quality or safety problems. There should be change controls for any proposed changes that might affect the validated status of facilities, systems, equipment or processes.
A GMP checklist should typically include points to address change control, including whether supplier staff:
- Clearly define the change, along with the reason for the change
- Identify the potential impact of the change
- Conduct a post-introduction review to confirm the change did not have an adverse impact
Process validation
The FDA defines process validation as:
Establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting its predetermined specifications and quality characteristics.
Process validation is a requirement for both pharmaceuticals and medical devices under GMP regulations. Quality cannot be adequately assured merely by in-process and finished-product inspection or testing.
The three stages of process validation include:
- Design: Through development and scale-up activities, define a process suitable for routine manufacturing that can consistently deliver a quality product.
- Qualification: Confirm the process is capable of reproducible commercial manufacturing by qualifying facility, equipment, utilities and performance.
- Continued verification: Collect information and data about the performance of the process through routine production for ongoing assurance.
Process validation involves collecting data from start to finish. The supplier should evaluate data from the process design stage throughout production to establish scientific evidence that a process consistently delivers quality products.
Checklists for GMP audits at medical device and pharmaceutical plants, in particular, should address these aspects of production and process controls.
5. Packaging and labeling
According to Food Safety Magazine, the number one cause of U.S. food product recalls in 2017 was the improper display of allergenic ingredients on product labels.
The foundation of GMP packaging and labeling requirements is the Fair Packaging and Labelling Act (FPLA) of 1966. Lawmakers established the FPLA to increase consumer product transparency, helping consumers make more informed choices and preventing deceptive packaging.
Labels under this guideline must include:
- A statement identifying the commodity
- The name and place of business of the manufacturer, packer or distributor
- The net quantity of contents in terms of weight, measure or numerical count
Pay attention to how your supplier staff handle packaging materials. Some example questions to include in a checklist as part of a GMP assessment include:
- Is each product marked with either a lot, batch or serial number or another means to reliably track the product?
- Is there a procedure for identifying the product at all stages of receipt, production, distribution and installation to prevent potential mix-ups?
- Are labels printed and applied to remain legible and affixed during processing, storage, handling, distribution and use (where appropriate)?
Incidents like the 1982 Tylenol tampering scandal, which led to seven deaths and a national recall of the popular painkiller, have led to new packaging regulations which are reflected in GMP checklists. For example, verifying tamper-evident packaging is now an essential check during GMP audits at pharmaceutical factories.
6. Warehousing, storage and distribution
GMP compliance isn’t just applicable to the manufacturing of products. The FDA also regulates the holding and storage of products. So even an outside warehouse must comply with GMP standards, as well as a factory’s internal warehouse.
A compliant warehousing, storage and distribution system has steps to preserve the identity, strength, quality and purity of products. Your GMP checklist should include checks to address two main warehousing procedures:
- Quarantining products before their release by the quality control unit.
- Storing products under appropriate conditions to protect product identity, strength, quality and purity. Regulated conditions include warehouse temperature, humidity and light.
Checking this system during a GMP audit helps ensure your supplier establishes and maintains procedures to ensure mix-ups, damage, deterioration or contamination don’t occur during storage and handling.
Distribution record requirements
The FDA requires written records and procedures for distribution. Especially for GMP audits involving food or pharmaceutical facilities, the checklist should include relevant points to assess whether:
- The oldest approved stock of a product is distributed first. This is known as a “first in, first out” (FIFO) system. This type of system is particularly important if the quality of your products deteriorates over time or if your products have a limited shelf life.
- The distribution of each lot of product can be readily determined.
These compliance checks not only ensure product safety, but also ease the process of a future product recall, if one is necessary.
7. Document and records controls
Documentation ensures traceability of all development, manufacturing and testing activities. Factory staff must provide all documentation during an official FDA inspection for review and copying as necessary.
Electronic records and electronic signatures that meet GMP requirements can be used instead of paper records. All records, both paper and electronic, required under GMP regulations are subject to FDA inspection.
Medical device manufacturers must also maintain a design history file (DHF), device master record (DMR) and device history record (DHR). These records basically include all the documents required to design, manufacture and test a medical device.
Common types of documents that should be kept and recorded include:
- Quality manual
- Company policies
- Standard operation procedures (SOPs)
- Batch production and control records
- Test methods
- Logbooks
- Production schedule
- Laboratory records
- Distribution records
- Customer compliant and product recall files
Your GMP checklist should include checks related to the preparation, review, approval and distribution of documentation and records related to the manufacture of any intermediates, active pharmaceutical ingredients (API) and finished products.
Data integrity and GMP
An important subset of GMP documentation requirements in recent years is data integrity.
The FDA defines data integrity as:
The completeness, consistency and accuracy of data. Complete, consistent and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA).
Specific best practices to prevent data manipulation for GMP compliance include:
- Restrict access to alter specifications, process parameters or manufacturing methods by technical means (for instance, by limiting computer permissions to edit or overwrite data).
- Don’t use shared login credentials, so that each unique individual can be identified.
- Establish audit trails (electronic records) to track data creation, modification and deletion. Audit trails should be secure, computer-generated and time-stamped.
- Assign a system administrator role to an individual independent from personnel responsible for recording information.
- Establish a hierarchical document system to restrict access to modify documents as necessary.
Some suppliers might resist providing documentation to auditors because their records contain confidential information or trade secrets. But the FDA does not release trade secrets unless the owner of the information agrees or puts in writing that the information is no longer confidential.
If you’re hiring a professional third party to conduct a pre-audit for GMP compliance, it may be helpful to have them sign a non-disclosure agreement before the audit. This can often put the supplier at ease and reassure them that audit findings will be kept confidential.
Conclusion
A GMP audit checklist is one of the most effective tools available for importers to assess their supplier’s FDA inspection readiness.
But preparing an audit checklist is not an easy task. Creating, implementing and maintaining a detailed checklist can take a lot of time. And the consequences for missing a requirement on the checklist can be major. You could fail your next FDA inspection and face severe regulatory consequences in the future.
A third-party auditor with expertise in each of these industries can help you develop an effective GMP audit checklist. Once you’ve established a checklist, be sure to provide the checklist to your supplier, so they can start to prepare and improve their GMP compliance.
What other points do you include in a GMP audit checklist? Share your tips in the comment section below!
