Qualifying the EXCiPACT GMP Certification Scheme as a provider of 3rd party audit reports and GMP certificates

 This regulatory approach has now been adopted in full by the Pharmaceutical Inspection Convention (PIC/S) and so it becomes best practice globally (3). The formalised risk assessment works by combining two key elements of the excipient into one overall assessment from which the relevant GMP can be determined. This involves an evaluation of the risks to patient safety from the excipient itself and its purpose in the pharmaceutical product. Key factors here are the quantity that will be in the final drug formulation and the way it helps deliver the active ingredient to the patient. The other dimension concerns the supplier and the GMP that they apply in the manufacture of the excipient. Ultimately the combination of these two factors determines the suitability of the excipient from a specific supplier for that pharmaceutical product.

Once these steps are completed then existing suppliers have to be assessed against the GMPs noting their overall quality performance and any Certification held by the supplier. A key requirement is that the data needed to make the evaluation is obtained “through audit or from information received from the excipient manufacturer”. The guideline goes on to note that “Certification of quality systems and/or GMP held by the excipient manufacturer and the standards against which these have been granted should be considered as such certification may fulfil the requirements”. Thus, use of 3rd party GMP Certificates is explicitly permitted in the guidelines.

The details required by the formalised risk assessment can be completed using a number of techniques:

1. Questionnaire sent to the excipient supplier for them to complete

2. Third party audit, done by an organisation separate from the supplier-customer relationship

3. Second party audit performed by the customer on the supplier.

Each option has increasing levels of confidence about the degree, extent and capability of the supplier, with the gold standard being a physical onsite audit performed by the pharmaceutical manufacturer, yet the Guidelines permits any three of these options. EXCiPACT is one organisation that provides reliable and credible third party audits.

3rd Party Certification

The Guidelines allow for the use of 3rd party certification of the supplier but what are the key criteria the pharmaceutical manufacturer should use to judge the value of the Scheme and Certificate? In essence they are:

1. the standard used to assess the excipient supplier

2. the competency of the auditors

3. the oversight applied to the 3rd party certifying body to ensure standards are upheld and maintained.

The EXCiPACT Certification Scheme was designed and built by the pharmaceutical industry to address all three criteria and, therefore, to maximise the assurance of the corresponding EXCiPACT GMP Certificates and audit reports. EXCiPACT asbl, which oversees this scheme is a not for-profit association formed in Belgium in 2014, and it may only have as members those organisations that are “professional associations comprised of natural or legal person as members, trade associations or similar organisations that represent groups of organisations who have an interest in manufacturing, distributing or using excipients” (4). In this manner no commercial organisation or individual has undue influence over the EXCiPACT™ Certification Scheme.

Excipient suppliers are audited to two highly complementary standards. One for Good Manufacturing Practices (GMP) and one for Good Distribution Practices (GDP). The latter is aimed at distributors and other suppliers of excipient who store and may repack excipients. These standards were developed from the IPEC-PQG GMP and IPEC GDP Guides and have been fully updated with contemporary approaches, most notably the requirement for the supplier to conduct a number of risk assessments to identify and assure patient safety. Latterly a new and simplified version of the EXCiPACT GDP Standard, for Good Warehousing Practice (GWP) has been developed expressly for warehouses that receive, store and issue excipients in their original packaging.

The EXCiPACT Certification Scheme uses the standard ISO 9001 3rd party audit timetable of certification and recertification every three years with annual surveillance audits in the other year. It uses third party Certification Bodies (CBs) to perform the audits, many of which also provide typical ISO and related certifications. They in turn use auditors which have been qualified by EXCiPACT as capable of meeting the needs of the pharmaceutical industry.

Once an excipient supplier has been successfully audited using one or more of the EXCiPACT Certification Standards then the supplier is free to share the corresponding GxP Certificate, audit report and any CAPA plans with its customers in the pharmaceutical industry. The design of the scheme then allows the pharmaceutical manufacturer to verify all aspects of the Certificate and Audit Reportby checking if the Certifying Body and their auditor(s) are listed on the EXCiPACT website.

Qualifications of 3rd party audit providers

But if a third-party audit scheme is used then this also needs to be qualified by the pharmaceutical manufacturer as they are providing an indirect service. For Certification Schemes like EXCiPACT both the Certification Bodies (CBs) and the Certification Scheme Owner (CBO, e.g., EXCiPACT) need to be qualified as part of the process, as both are separate entities.

The International Pharmaceutical Excipients Council Federation (IPEC-Federation) has now introduced a related document to the excipient in formation packs, the GMP Certification Scheme Certification Body Qualification Guide for this express purpose. This includes templates for the CSO and the CBs. Without this standardisation all pharmaceutical manufacturers would prepare their own questionnaires and approaches, causing extra effort on the part of the CBO and the CBs.

The templates for the CSO and CB have a similar structure and require that the following aspects are described, and where appropriate further evidence of their implementation is supplied:

• Quality Management systems employed

• Freedom from conflicts of Interest

• Impartiality

• Independence

CBOs may have a quality management system, but as their role is highly specialised there is not a set standard which is applied, other than the generic ISO 9001. Even then, certification to ISO 9001 shows the CBO is itself seriousand committed to a quality management system which delivers control of their operations and learning processes. The same applies to the CBs, but in this case the key standard to be applied is ISO 17021-1:2015 (5)

For all stakeholders to have a high degree of confidence in the certification scheme, its audits and the associated reports, there has to be freedom from conflicts of interest between all the parties concerned. Thus, the CBO oversees the activities of the CBs to ensure their audits and certification decisions are not influenced by their customers, the excipient customers. In schemes like EXCiPACT, it is the excipient suppliers who pay for the audits which has potential for a conflict of interest. CBOs have to make sure the rules on freedom from conflicts of interest as defined in ISO 17021-1:2015 are fully followed and respected. To achieve that, EXCiPACT audits the CBs that have agreed to provide GMP audits in accordance with the scheme rules. This freedom from conflicts of interest also applies to the CBO itself and so its governance and legal set up also has to prevent any one party from having undue influence. In the case of EXCiPACT this is assured by having Full Members of the association as independent associations themselves. This prevents any one company having a dominant role in the activities of the association.

It follows that all activities and decisions have to be made with impartiality, that is based on the collected facts and findings in an audit, and that decisions are then made on those facts. There has to be no discrimination towards any party involved in the Scheme.

To ensure these principles of freedom from conflicts of interest and independence are fulfilled, the entities involved have to be legally and fully independent. Thus, the CSO cannot also be a CB as well and conducti ts own audits upon the excipient suppliers.

The templates in the Certification Scheme Qualification Guide have sections dedicated to describing:

1. The legal set up of the CSO or CB

2. The rules of the certification scheme and oversight

3. The details of the certification scheme and how it works.

The first section describes the legal setup of the CSO or the CB, its ownership and governance. This then sets context for how it can administer or apply the certification scheme with freedom from conflicts of interest and impartiality. Participation in any other certification schemes should be detailed in this section as well.

The rules governing the implementation of the certification scheme are explained in the second section. It should be clear here how controls are designed and implemented to assure freedom from conflicts of interest and the implementation of impartiality in certification decisions. This section should also describe how the CSO checks that the rules have been implemented. For EXCiPACT this is done with a legal agreement between the CB and EXCiPACT as CSO, followed up by regular audits of the CB to ensure the scheme riles have been implemented and applied to their audit and certification activities. Central to good audit and certification practices in ISO 17021-1:2015 is that the decision to award a certificate to the excipient supplier is not taken by the auditor concerned, but only after an independent review of the audit, the audit findings and the recommendations of the auditor. This review is performed by a certification board who are independent of the audit process.

The final section explains the certification process and how the relationship between the CSO and the CB is governed. Sub-sections cover aspects such as confidentiality, licencing, auditor competency and how complaints are dealt with.

No certification scheme can be credible unless there is suitable oversight and controls concerning auditor competency and approval. Auditors should undergo additional training, in addition to being a trained auditor, into the needs of the pharmaceutical industry, understand the core principles behind GMP rules and regulations as well as having knowledge of the manufacturing processes used to prepare excipients. They should then be registered with the CBO independently of any CBO who may be their employer. In this way the auditor approval process allows for contracted auditors to be used as well as employees, but wither way ensures they have been qualified for the duty by the CSO.

With these pre-prepared sections completed by the CSO and the CB they can then be made available to the pharmaceutical manufacturer who wishes to qualify the certification scheme participants. Thus, the CSO template can be passed to the pharmaceutical manufacturer along with any additional information such as quality management system certificates, Scheme rules and related information. From this the pharmaceutical manufacturer can judge if the CSO is suitable and reliable for their purpose. They then also need the corresponding templates from the CBs, one for each CB who may be responsible for the audit reports they access from the excipient suppliers. With any additional information they will then be able to approve the CB as a third-party audit organisation who can provide credible and reliable audit reports. With both components in place the pharmaceutical manufacturer can make initial and ongoing use of the excipient supplier excipient GMP Certificates and audit reports, thus aiding the qualification of both the excipient and its manufacturer.

Conclusion

Pharmaceutical manufacturers need to qualify their excipients suppliers. This requires gathering a number of details about the excipient in question, and the manufacturer. The latter aspect requires details about the GMP applied in the manufacture of the excipient. Where that evidence includes a 3rd party certification scheme such as EXCiPACT, then the pharmaceutical manufacturer should also be able to demonstrate the CSO and any associated CBs are also assessed for suitability and approved within their supplier qualification processes. The IPEC GMP Certification Scheme Certification Body Qualification Guide and templates facilitates this exchange of information and thus allows for a faster qualification process with no compromise to quality. The completed CSO document is available from the EXCiPACT website and the ones for each CB are available from the excipient suppliers who hold EXCiPACT Certificates. With all parties qualified in this manner the Pharmaceutical manufacturer will meet all GMP and related regulatory requirements and can so utilise EXCiPACT GMP Certificates and audit reports to maximum effect.

Dr Iain Moore is the Global Head of Quality Assurance at Croda International. He has held a range of QA roles in Croda for over 25 years, including implementing ISO and GMP standards and host ingregulatory inspections t o API GMPs.He has contributed to the publication of both European and US National Standards, the famous IPEC-PQG GMP Guide for Pharmaceutical Excipients and the EFfCI GMP Guide for Cosmetic Ingredients. He was instrumental in the team that took the IPEC-PQGGMP Guide and converted it to the EXCiPACT Certification Scheme for Pharmaceutical Excipients. He is the current chair of the EFFCI GMP Committee and is the current President of the Board of EXCIPACT asbl.

1. Directive 2011/62/EU

2. PIC/S 045-1 1st July 2018

3. Guidelines of 19 March 2015 on the formalised risk assessment for ascertaining the appropriate good manufacturing practice for excipients of medicinal products for human use(2015/C 95/02)

4. EXCiPACT asbl Articles of Association, see www.excipact.org5. ISO 17021-1:201

5. Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1:Requirements.