Remote Auditing Best Practices For GMP Compliance

Every organization that is regulated by the FDA has been adversely affected by the coronavirus (COVID-19) pandemic. This tragic situation has exposed the vulnerability of the global supply chain and the lack of emphasis placed on contingency planning. This article will focus on remote auditing for good manufacturing practice (GMP) compliance, with a focus on the challenges, opportunities, and best practices for performing remote internal and external audits.

Audits are used for a variety of reasons, including assessing compliance with standards, regulations, and guidances; adherence to requirements and specifications; evaluating process and system performance; evaluating the adequacy and effectiveness of the quality management system; and confirming conformance with contractual obligations.

When regional, national, or global issues restrict or otherwise prohibit travel, traditional on-site audits may not be an option, exposing the organization to compliance risk and potentially jeopardizing the global supply chain. However, remote audits may provide an organization with a viable alternative to ensure continued compliance with GMP requirements. Remote audits leverage technology such as video teleconferencing and shared file folders to facilitate interviews and share documents and records.

Requirements For Audits

GMP regulations, standards, and guidances have requirements for internal audit programs. Regardless of the regulation, standards, and guidance, the requirements for audit programs are generally the same and include the following:

• Establish, implement, and maintain procedures for quality audits
• Define the audit criteria, scope, interval, and methods
• Determine the necessary competence and ensure competence based on education, training, or experience
• Ensure objectivity and impartiality of the audit process
• Ensure auditors do not have direct responsibility for the matters being audited
• Conduct internal audits considering the status and importance of the processes as well as the results of previous audits
• Ensure audit results are reviewed by managers who have responsibility for the matters audited
• Ensure corrective action(s) are initiated and, if required, re-audit the deficient matters

There is nothing in the GMP regulations, standards, and guidances that prohibits the use of remote or virtual auditing techniques. However, the use of remote or virtual audits must be balanced based upon the relative risk posed by the organization and the products and services produced or supplied.  For example, organizations with a prior history of compliance issues such as recalls, frequently rejected products, and other negative quality trends are probably not a good candidate for a remote or virtual audit.

On-Site Vs. Remote Or Virtual Audits

Audits can be performed on-site, remotely, or as a combination of remote and on-site activities. The determination to use remote auditing techniques should consider the associated challenges and opportunities. As a seasoned auditor, nothing beats boots on the ground. However, when a pandemic or other tragic event limits or otherwise prohibits travel, other options must be considered.

Conducting Remote Audits

Prior to beginning the audit, have the facility provide copies of its quality manual, procedures, complaints log, nonconformances log, corrective and preventive action log, deviation log, master validation plan (MVP), and certificates in PDF or another searchable format. Documents that are sent as unsearchable scans (photographs) are cumbersome and not easy to search.

Obtain a facility map from the auditee that includes the buildings and grounds, infrastructure and equipment layout, storage, maintenance, receiving, shipping, and other areas as appropriate. The map can help plan the route for the virtual plant tour. Do not forget to consider the outside of the facility, including pest control, facility access points, loading and unloading areas, and any outside storage areas.

Review the facility map and other documents. The review is necessary and will help with the development of the audit agenda.

Open the technology platform and conduct the opening meeting. It is really important to ensure the auditee (especially if this is their first experience with a remote audit) that you intend to be flexible (patient) and want to make sure there is open, two-way communications during the entire audit.

Once the opening meeting is completed, it is time for the auditee to conduct the virtual tour of the facility using the preplanned route based on the map the auditee provided. Please keep in mind the auditee may have to take detours due to maintenance and other unforeseen activities. Additionally, the outside tour may have to be recorded at another time if the weather does not cooperate.

Once the virtual tour is complete, review the complaint log, nonconformance log, corrective and preventive actions log, and deviation log. This review will be a good guide to determine what processes and production records should be reviewed during the audit. Discuss the issues that stand out with the auditee and request the auditee provide the underlying records in PDF or another searchable format.

At this point, while the auditee is processing the records request, the auditor can work on any issues noted on the virtual tour and/or enter the information in the audit report. The auditor and auditee should determine if the technology platform will be placed on hold during these times or shut down and restarted as appropriate.

When the records are ready, review them and select a process or processes for review. For example, we will select an injection molding process. To properly audit this process, these are the documents I would request as a batch record and associated documentation, including:

• Inspection records (incoming, in-process, final)
• First article layout
• Process FMEA
• HACCP plan
• Mold maintenance (preventive and corrective)
• Machine maintenance records (preventive and corrective)
• Calibrations
• Validations
• Gauge studies
• Training
• Work instructions
• Specifications

When the process records are ready, review them and request the auditee to conduct a virtual tour of the injection molding process and inspection process, preferably for the part produced in the batch record. This would be a good time to conduct a virtual interview of the press operator and quality inspector to verify what was observed in the records and that the work instructions reflect the actual work practices.

These iterations would continue until the audit objectives are completed.

The closing meeting is conducted as usual using the technology platform.

Best Practices

• Remote audits need to be conducted more like an FDA inspection than a traditional ISO audit. Best practice is to start the remote audit by reviewing the “dirty laundry” list of complaints, nonconformances, corrective and preventive actions, and deviations. This review is a good way to determine what processes and production records should be reviewed during the audit.
• For supplier audits, ensure that nondisclosure agreements (NDAs) are executed prior to the audit.
• Ensure internal and external (supplier) auditing procedures allow for the use of remote or virtual auditing techniques.
• Remote audits are best done in segments. This allows time for the auditor to review records and generate questions and the auditee to gather records, organize interviews, and formulate responses.
• The auditor and auditee should practice using the virtual technology platform prior to the audit and ensure the document and record sharing method is also properly functioning.

Conclusion

Every organization that is regulated by the FDA has been adversely affected by the COVID-19 pandemic. This tragic situation has exposed the vulnerability of the global supply chain and the lack of emphasis placed on contingency planning. Remote audits, which leverage technology such as video teleconferencing and shared file folders to facilitate interviews and share documents and records, are a viable alternative to ensure continued compliance with GMP requirements.

About the Author:

Mark Allen Durivage has worked as a practitioner, educator, consultant, and author. He is managing principal consultant at Quality Systems Compliance LLC, an ASQ Fellow, and an SRE Fellow. He earned a BAS in computer aided machining from Siena Heights University and an MS in quality management from Eastern Michigan University. He holds several certifications, including CRE, CQE, CQA, CSQP, CSSBB, RAC (Global), and CTBS. He has written several books available through ASQ Quality Press, published articles in Quality Progress, and is a frequent contributor to Life Science Connect. Durivage resides in Lambertville, Michigan. Please feel free to email him at mark.durivage@qscompliance.com or connect with him on LinkedIn.