Preparing for a Productive CDMO Audit

Auditing is an essential task to ensure quality assurance of a cGMP Contract Development and Manufacturing Organization (CDMO). Ideally, an audit can benefit both the customer and the CDMO, as regulatory compliance of the CDMO generally increases. Difficulties arise when the CDMO’s standard of performance and motivations collide with the customer’s expectations. We will discuss the typical audit process and identify critical elements for success, providing tips to optimize the process for both auditor and CDMO.

Customers should furnish the agenda to the CDMO at least one week in advance of the audit. Auditors should confirm start and end times consistent with the facility’s standard operating times. A typical start time is 9:00 AM to give the host team time to organize their day.

If documents are requested in advance, understand that companies have different document control policies. Don’t be offended when those policies affect which documents the CDMO can distribute. If time is a concern, request a master SOP directory. This allows auditors to select the initial documents that the CDMO should prepare for review ahead of time.

CDMOs should review the audit plan for non-routine items and proper scope. Will key staff be on hand? Notify auditors if closed or steel-toed shoes are required for a facility tour or if there are prohibitions against jewelry, makeup, or dresses.

An essential part of CDMO audit preparation is choosing the host team that will escort auditors through the facility, supply requested documents, and answer questions. CDMOs should select individuals familiar with the critical SOPs and revision history, the validation protocols relevant to the supplied goods and services, and the relevant regulations.

Host team members should familiarize themselves with the contracted product or services and new projects that auditors may have a particular interest in. When the audit is underway and process flow is discussed, the host team needs to have the correct information.

Predictably, auditors will review previous audit reports and the associated responses. Host teams should ensure that all outstanding items from prior audits have been addressed or are in process with a target date, the responsible person assigned, and a clear written action plan. Expect that auditors will request proof that response obligations have been met and this information is readily available.

Auditors need to review the CDMO history before coming on site. This should include previous customer audit reports, responses, and any complaints. If auditors are not directly familiar with the business relationship, they should discuss the audit plan with customer staff that interacts with the CDMO, such as the purchasing group, project management, or regulatory affairs group. Sometimes, auditors can serve as ambassadors to enhance the relationship by identifying improvements for both parties rather than solely finding fault with the service provider.

The relationship history dictates the scope of the audit. Is this a first-time audit or a follow-up? Generally, first-time audits (or primary audits) are more comprehensive as customers become familiar with the CDMO and probe areas not likely to require reexamination. Repeat audits build upon the primary audit by verifying prior corrective actions, confirming routine compliance, and discussing organization and operation changes.

Customers may occasionally audit “for cause” triggered by a deviation, complaint, or changes at the CDMO. The complexity of the outsourced services is also a factor in determining the scope. Aseptic operations significantly affect the audit by reviewing room qualification, environmental monitoring, aseptic training, media fills, sterilization processes, and sterility testing

Before auditors arrive, a conversation may dispel potential confusion in initial audits. Occasionally, CDMOs are surprised to learn customers have compliance plans different than initially contemplated. The clinical materials CDMO might also become the site for the commercial filing. Or customers have added a European (EU) market authorization or Japanese submission. Caught without the appropriate compliance program, or at least a gap analysis prepared, the CDMO is embarrassed and frustrated.

Consider that even for a competent CDMO, universal compliance takes time. CDMOs can easily update simple things like gowning procedures; however, more substantial endeavors such as qualifying cleanrooms under new classifications will add months to the project.

Along with the scope, it is essential to establish the time available for the audit. Customers should recognize that smaller CDMOs may lack dedicated staff to manage audits. Work schedules may allow only one audit per week to minimize disruptions, or CDMOs may confine audit days to Tuesday through Thursday to avoid Monday morning chaos and late Friday afternoon wrap-ups.

A smart agenda allocates time wisely and should alert the CDMO to the topics and compliance standards. The agenda, which should be provided well in advance, should include:

• Contact List. The names and job titles of the auditors.
• Audit Standard. The applicable regulatory standards (e.g., 21 CFR Part 211, EU Guide to GMP).
• Introductory Presentation. Occasionally, the parties exchange opening presentations as an icebreaker.
• Document List. Documents should be immediately ready for review, such as an organizational chart, facility layout, master SOP directory, and company brochures.
• Facility Tour. Identify any critical areas so the CDMO can make prior arrangements.
• Specific Topics. Identify areas of particular focus.
• Validation. Reports related to equipment, facility, and processes.
• Investigations. History and resolution of complaints or non-conformances, if applicable.
• Regulatory History. Recent regulatory inspection dates and outcomes. Auditors commonly ask for FDA 483s. If possible, CDMOs should include their responses or corrective actions. A compelling written explanation and satisfactory closeout letter from the FDA may reassure customers.
• Closeout Meeting. This post-audit meeting allows audit teams to present findings and CDMOs to clarify issues or correct misunderstandings.

Large multinational customers usually have dedicated audit teams traveling year-round and seeing many sites. These auditors may not be aware of the entire scope of the contractual relationship or specific issues concerning the project. However, these teams are knowledgeable of the regulations and skillful at auditing.

Some customers, particularly overseas or emerging companies, may contract a consulting firm to perform an audit on their behalf. These third-party auditors’ interpretation of the regulations and areas of audit emphasis varies with their experience. Therefore, customers need to select knowledgeable consultants about the CDMO’s services, the latest draft regulatory guidance, and recent FDA-483 observations. Many consultants are former FDA investigators and may have good insight into issues and a nose for finding GMP compliance gaps quickly.

In our experience, third-party audits can run approximately 50% longer than customer-staffed audit teams. Conversely, third-party auditors are generally more impartial and may have less incentive to interpret ambiguous regulations on the CDMO.

In our experience, the most effective audits are carried out by two auditors familiar with the relationship and whose professions complement each other. For example, representatives from the quality and technical groups will split the quality system and the process and engineering areas. Working in their respective areas of expertise, auditors will plow through the agenda much quicker. A two-auditor team also provides opportunities for some good cop, bad cop dynamics in reaching a consensus with the CDMO on a sticking point.

Avoid using the relationship manager to the CDMO as an auditor. They may be biased in their observations based on prior interactions or a reluctance to apply pressure.

Traditionally, the CDMO’s Quality Assurance group hosts the audit, although the CDMO sales team typically greets the arriving visitors to make introductions.