How can you conduct GMP audits that drive continuous improvement?

It is very important to plan our approach to evaluate effectiveness. To do this, we need to move away from a checklist-based audit approach, to a process-based approach. Our plan should select a process using a risk-based approach. Risk should be understood in the context of our business objectives. We should plan how we will examine each element of the process(s) for effectiveness. To do this, we should have a clear understanding of its purpose and related measures. As an example, if we are planning to examine the risk management process according to ISO 14971, we should look at how well our process identifies hazards, and estimates, evaluates and controls the safety risks associated with those hazards throughout the product lifecycle.

It is quite necessary to define the scope of audit before initiating it. Well defined purpose of audit make it more effective. If it is intended to see the compliance against the regulatory requirements the methodology to be adopted will be different from if auditors want to see the compliance against established procedures in a company. In the first instance, auditor is supposed to challenge established procedures against regulatory requirements while for the second case practices are looked into for compliance against established procedure. Although these two approaches go side by side in pharmaceutical industry, clarity of objective tends to improve the effectiveness of audit.

Risk based thinking knowledge without interference from the top management. Get the actual condition from the floor but not from the computer.

Time is not the GMP auditors friend - set realistic objectives. We sometimes audit 13485, euMDR, QSR, (how many more requirments?) for the same audit plan. This often only allows a few minutes to cover entire complex processes, reviewing records, interviews, etc., sometimes resulting in 'waterskiing' rather than perform a deep dive to identify risk to the organization. Robust 'Planning' activities & preparation is not optional, and must include previous citations (both open & closed).

Audit preparations & planning is the first stage of performing GMP audits. During this stage, the following actions must occur: Notification of audit, quality system documentation review, defining the audit plan, team assignments, and development of working documents. When establishing the audit scope, you must define the following: product/matrix manufactured, quality system requirements, type of audit to be performed (initial, surveillance, unannounced, etc), physical location of activities and documentation, the regulations, standards, and company-specific requirements. Conducting a desk audit on the quality manual and SOPs is essential to developing working documents and generating the sampling plan.

A common misconception is that an audit is mostly a review of “documentation” to assess compliance to established requirements. Rather, an audit is about effectiveness of a process under review. We can learn a lot more through focused conversations and careful observations. A good auditor is a good listener and a good observer. They do not ask leading, yes/no questions. Rather they ask “how” questions. They have a good awareness of their own biases. They do not seek to confirm those biases to point out deficiencies they feel should be corrected. Rather they focus on finding barriers to effectiveness. When conducting an audit, we have to bring our full attention to the process and leave out personal feelings at the door!

Although stated in this article "You should not only point out problems, but also explore root causes and potential solutions", the audit is not the best time for the auditor to do this. At this stage, the auditee(s) should gather their thoughts, ensure full understanding of the issue, search for additional documentation not yet presented to the auditor, and discuss potential next steps. If there is a clear non-compliance then the auditee(s) should be properly trained in root cause investigation tools where they can apply their expert knowledge of the process to determine how the breakdown occurred. Leaving this up to the auditor will delay, or even prevent, solid cross-functional problem solving techniques throughout the organization.

Using the plan-do-check-act (PDCA) cycle has been helpful in evaluating QMS as a continuous improvement process. Using the QSIT approach , top-down review of the 7 subsystems allows inspectors to focus on specific elements and key indicators within each major subsystem: Management controls, design controls, corrective and preventative actions, production and process controls, material controls, records/documents/change controls, and facility and equipment controls.

Performing audit activities in GMP involves a structured and systematic process to assess compliance with GMP standards, ensure product quality and safety, and drive continuous improvement. Also ensuring that organizations maintain compliance with GMP standards, improve their quality management systems, and produce safe and high-quality products.

Very often CAPAs involve updating SOPs and Work Instructions. However, it is important to remember that these documents should contain only the details required to allow the user or operator to follow the procedure consistently. It is therefore important to consider whether unnecessary complexity can be removed to make the procedures easier to follow. It is important not to let CAPAs add complexity to SOPs and Work Instructions because that is likely to be counterproductive and contribute to further non-conformities.

I personally feel that we need to start moving away from the mindset of “CAPA as a follow up to an audit”. It is not necessary to use the CAPA process for every audit finding. Further, the current thinking according to ISO 13485 is to separate the CA from PA in CAPA. I would love to see a separate, dedicated discussion on the topic of CAPA, not just the in the context of an audit follow up. Having said that, the question still remains - how to best follow up on audit findings? I don’t believe the audit report should provide “recommendations”. Findings should be written in a way that the gap(s) and their potential impact are crystal clear. How to fix those gaps should be given a lot of serious thought by a cross functional team.

A critical component of the process and so rarely given due consideration. Pay close attention to an organizations maturity model, we see some folks spending considerable energy fighting (legit) cited observations, often using the band-aid approach to correct. Doesn't usually end up well when the Agency shows up.

Non-conformities identified in the audit report should be specific in nature and includes the following: requirements of the internal and external standard, severity with respect to the requirements, and traceable and verified evidence. Audit completion may require the approval of the corrective action plans (with root cause analysis) and defined timelines provided by the auditee. The auditing organization and the auditee should agree on a plan for completing necessary corrective actions, and if required, reaudits to verify corrective actions were taken. Periodic reports may be requested by the auditing organization to determine the status of corrective actions.

Effectively follow up on audit results in a GMP audit, ensuring that non-compliance issues are addressed, corrective actions are implemented, and the organization maintains compliance with GMP standards.

To generate continuous improvement you need to also apply continuous improvement to your audit practices. A stagnant audit program will likely only find the same types of issues cyclically. By changing your approach and focus each time in line with the current regulatory environment, you're far more likely to expose previously unrecognized risks. Keep it fresh!

Reviewing audit activities in Good Manufacturing Practice (GMP) is a crucial step to ensure the effectiveness of the audit process, adherence to regulatory requirements, and continuous improvement. By systematically reviewing audit activities in GMP, organizations can ensure that audit processes are effective, drive GMP compliance, and promote the production of safe and high-quality products.

Applying the PDCA process to reviewing the audit program is helpful in ensuring the effectiveness. I have found that process mapping the auditing procedures ensures that risks are identified and helps narrow down areas to apply monitoring metrics to continually improve.

Completely agree Naveen. If a finding is a "potential non-conformity", it really is not up to an auditor to dictate what the action should be. Rather, it should be the starting point for investigation, analysis and identification of what are likely to be several different actions by the audited organisation. How many times have you seen "recommendations" treated as the ONLY thing that the auditee feels they need to do just to close out an audit?

#1 Most Important aspect. Fail here, and the rest quickly becomes an exercise in futility. Work to consistantly upskill the auditors. Make sure they don't get caught up in 'go-fix-its' vs. real issues, systemic break-downs. You can never be 'too' open, candid & transparent with your auditees.

Enhancing audit culture is facilitated by ensuring adequate resources (competent staff, financial support, time, technical information, and external expertise) dedicated to the audit process. The audit team must have the necessary professional and technical competence to cover the scope of the audit, and where competencies are lacking, external subject matter experts may be recruited to cover technical areas to be audited. Assessing competence includes considering professional qualifications, education, skills, training, experience, and personal attributes. Written auditing procedures that include the responsibilities and requirements for managing, planning, conducting, reporting, and maintaining records should be defined and documented.

Review recent performance and past audits to review all previous nonconformances to prepare audit plan. In the opening meeting, set the tone to ease everyones minds, that this is a partnership and it is intended to be constructive and not I caught you moment and it is intended to help with improvement. Start At management review to ensure the right positions are attending and action items are being recorded and followed up on, then move to internal audits for effectiveness and that will lead you to CAPAs. Once there, judge everything from root cause to effective checks. From there move to DHRs to ensure that the records are complete and follow GDPs. Review equipment maintenance and calibration records and then training.

I believe the intent of this article is to provide guidance on internal GMP audits. These should be conducted differently to external audits. While you should not hide any issues from an external auditor, you wouldn’t deliberately lead them to a NC either. However, with an internal audit, you may wish to consider helping the auditor find a NC. Better it is identified internally and resolved than leave it to be found by an external auditor or worse to end up causing harm to the end user. A zero finding internal audit is not necessarily positive… My point is, internal audits are there to test your processes, their aim is to find problems and fix them internally. This may be a controversial opinion but your QMS will benefit in the long run!

Always remember - a confused Auditor/ Investigator is a dangerous auditor/investigator... We overuse the phase, but work to get your documents/ records to a 'Stand-Alone' state. You'll be glad you did.