The manufacturers of medicinal products are required to audit active ingredient manufacturers every 3 years as described e.g. in the document EMA/196292/2014 (Guidance for the template for the qualified person’s declaration concerning GMP compliance of active substance manufacture): "Audits of each site for GMP compliance should be undertaken at regular intervals, normally within three years”.

The good news is that the outsourcing of audits is accepted by the competent authorities. Specifically, section 5.29 of the EU GMP Guideline (part I) states: "The holder of the manufacturing authorisation shall verify such compliance either by himself or through an entity acting on his behalf under a contract." This means that a quality agreement between the pharmaceutical manufacturer and the service provider should be established in compliance with the requirements of EU GMP chapter 7 “outsourced activities”. Furthermore, the EMA (see Q&A section on EMA’s website) emphasizes that there should be evidence that the contract-giver has evaluated the contract-acceptor. In practice this means that audit service providers should be properly qualified within the quality management system of the pharmaceutical manufacturer.

For each audit at an API manufacturer, there must be an appropriate timeframe available that allows the writing of comprehensive audit reports as defined in EU GMP part I 5.29: "Audits should be of an appropriate duration and scope to ensure that a full and clear assessment of GMP is made." There are different approaches to determining the time required for an on-site audit. In addition to basic factors such as the size of the company to be audited and the number of employees in the audited area, other factors must be taken into consideration such as e.g. the number of APIs in the audit scope and the complexity of the respective synthesis steps. Third party auditing companies having access to a suitable number of qualified auditors usually calculate the audit duration in so-called man-days (audit days multiplied by number of auditors). It is beneficial to perform the audit with at least two auditors who build 2 independent audit streams. This way it is possible to get the most out of the audit duration granted, while also saving time and cost for the audited company.

The audit report is the central evidence with which the holder of the manufacturing authorisation proves the performance of an audit. All GMP-relevant observations of the audit must be reproduced in the report in a precise, comprehensive and complete manner: "The report should fully reflect what was done and seen on the audit with any deficiencies clearly identified" (EU GMP part I 5.29). EU GMP Annex 16 also sets very specific requirements for reports prepared by third parties: "The audit report should address general GMP requirements, as for example the quality management system, all relevant production and quality control procedures related to the supplied product, e.g. active substance manufacturing, quality control testing, primary packaging, etc. All audited areas should be accurately described resulting in a detailed report of the audit." It is also required that the QP must ensure the evaluation of audit reports; the result of this evaluation must be recorded in writing.

Ideally, the quality system and audit procedures of the service provider are directly compatible with the requirements of the respective drug manufacturers, which can be reflected, for example, in the context of an audit at the service provider’s facilities. The existence of certifications (e.g. according to ISO 9001) or accreditations (e.g. according to ISO 17020) is not required by law, but such independent assessments can facilitate the qualification process. Certified or accredited service providers usually have a suitable quality management system that covers general aspects such as document control, internal audits, management reviews, corrective actions, etc. Of particular importance are training procedures for auditors and a regular exchange of experience among auditors.
In addition to ISO 9001 certifications, an accreditation in accordance with ISO 17020 awarded by a national accreditation body can prove the impartiality and independence of the service provider. DIN EN ISO/IEC 17020 defines various requirements for so-called inspection bodies. Accreditation as a “Type A inspection body”, for example, excludes the simultaneous provision of consulting services and thus proves the impartiality and absence of possible conflicts of interest. Thereby, the accredited audit service provider meets the requirements mentioned in the Q&A section of the EMA website, namely that it “must also be satisfactorily demonstrated that there are no conflicts of interests.” Furthermore, the accreditation supports the manufacturing-authorisation holder in his task to ensure “the validity and impartiality of the audit report” (see EMA Q&A section for details). In the framework of the accreditation, the quality of the audit services is also regularly monitored in the form of so-called "witness audits", which are accompanied by appropriate experts (usually GMP inspectors from national authorities). In addition, accredited companies must have suitable procedures in place to handle confidential information collected during each audit.

When outsourcing audits of APIs to third parties, the manufacturers of medicinal products have a responsibility to ensure product safety for patients by applying these high-quality criteria for any outsourced audits.