New third-party audit scheme for excipient suppliers

In Europe, the Falsified Medicines Directive (FMD) was developed as a result of product failures in legitimate supply chains in the early 2000s and had the objective of ensuring the availability of high quality and safe medicines. Although many of the falsified medicines have involved final dosage forms, starting materials have also been impacted, notably with sub-standard active pharmaceutical ingredients (APIs) and some excipients entering the supply chain. The notorious and tragic incidents involving ethylene glycol substitution for glycerine and then adulterated Heparin resulted in hundreds of patient deaths.

The FMD introduced the legal definition of a pharmaceutical excipient for the first time as being: “any constituent of a medicinal product other than the active substance and the packaging material”. It also requires that the manufacturer ensures the excipients are suitable for use through the adoption of a risk assessment approach to determine the required good manufacturing practices (GMP) for the manufacture of the excipient.

Some Guidelines[1] on the risk assessment referred to in the FMD have now been published by the European Commission and these detail the methodology to be used to ascertain the GMP required for excipients. The process involves an examination of the role of the excipient in the drug product as well as the direct threats posed to patient safety. The route of administration and related patient safety factors are then used to determine an overall risk ranking. The Commission recommends that the specific GMPs required to assure the excipient is made with a high degree of assurance are then defined.

Once these steps are completed, existing suppliers can be assessed against the GMPs, noting their overall quality performance and any Certification held by the supplier. A key requirement is that the data needed to make the evaluation is obtained “through audit or from information received from the excipient manufacturer”. The guideline goes on to note that: “certification of quality systems and/or GMP held by the excipient manufacturer and the standards against which these have been granted should be considered as such certification may fulfil the requirements”. On conclusion of the process, the pharmaceutical manufacturer will then have to identify the residual risks and take measures to control them, for example, by increased testing or even seeking another supplier.

So, the FMD and related guidelines now require that pharmaceutical manufacturers have detailed knowledge about their starting materials, where they come from and the standards to which they are made, with the expectation in law for the first time that excipients are made in accordance with GMP principles. The logical method to verify that the GMPs have been implemented is to conduct an on-site audit. However, current practices for the majority of pharmaceutical manufacturers are to qualify their excipient suppliers through other means (i.e., “information provided by the excipient manufacturer”).

In theory, the pharmaceutical manufacturer could increase their audit personnel to increase their audit frequency and coverage, but the suppliers may not be able to accommodate all the additional audits. Excipients are often made for uses other than those of a pharmaceutical nature, and the pharmaceutical use of excipients can therefore be very small in terms of the total quantity manufactured (e.g., cellulosics where around 0.2% of all that is made is used in pharmaceuticals). Where an excipient supplier has many pharmaceutical customers, and hundreds would not be uncommon, then the increased audit burden would quickly become intolerable. At that point, decisions on who comes to audit and who does not would most likely be prioritised based on commercial considerations alone.

This scenario is well known by the International Pharmaceutical Excipients Council (IPEC) and its fellow associations: the European Fine Chemicals Group (ECFG), the Federation of European Chemical Distributors (FECC) and the UK Pharmaceutical Quality Group (PQG). Well before the publication of the FMD and ascertaining GMP Guidelines, together they formed a consortium to design, develop and implement a high quality, third party audit Certification Scheme for pharmaceutical excipients. This Scheme is now called EXCiPACT^TM and is owned by EXCiPACT asbl, a Brussels-based not-for-profit association who provide oversight for its correct use via registered Certifying Bodies to meet the needs of pharmaceutical excipient suppliers and users.

Third party certification

The Guidelines[2] allow for the use of third party Certification of the supplier, however, what are the key criteria the pharmaceutical manufacturer should use to judge the value of the scheme and certificate? In essence they are:

• The standard used to assess the excipient supplier;
• The competency of the auditors;
• The oversight applied to the third party certifying body to ensure standards are upheld and maintained.

There has been much criticism of third party Certification Schemes, for example, as with ISO 9001, and while these can be justified in many cases, many users of the certificates have not taken enough care to check on the three points above. Mindful of the reservations that many in the pharmaceutical industry would have over third party audits, the EXCiPACT™ Certification Scheme was designed and built to address all three criteria and, therefore, to maximise the assurance of the corresponding EXCiPACT^TM certificates.

The EXCiPACT^TM Scheme delivers certificates to the excipient suppliers who pass the audits with the intention that the audit reports are supplied to their customers: pharmaceutical manufacturers. This provides details of the scope of the audit, the findings and any conformance or not. Additionally, by following the classic ISO 9001 certificate three-year audit cycle, a surveillance audit is conducted in years two and three with a full recertification audit in year four. With such annual audit reports, the pharmaceutical manufacturer can quickly build up that knowledge and evidence as well as meeting the need for that information to be based on current arrangements. Such information fits nicely into the changes to Chapter 5.27 of the EU Part 1 GMP Guide which calls for the pharmaceutical manufacturer to have “supporting evidence for each supplier” and “a current knowledge of suppliers”.

Having regular audits is one matter but how can there be confidence that the third party certifying body is following the Scheme rules, and using competent auditors? This is where EXCiPACT as an association comes into play. EXCiPACT asbl is a not-for-profit organisation that was established in Belgium in 2014. It may only have as members those organisations that are “professional associations comprised of natural or legal person as members, trade associations or similar organisations that represent groups of organisations who have an interest in manufacturing, distributing or using excipients”³. In this manner no commercial organisation or individual has undue influence over the EXCiPACT^TM Certification Scheme.

In order to ensure the Certifying Bodies apply the EXCiPACT^TM Scheme rules, EXCiPACT asbl has a strict qualification process which includes a definition of the Scheme rules and a regular audit of the Certifying Bodies. It witnesses their audits once a year to ensure these standards are maintained and implemented. The Scheme rules for Certifying Bodies are based on the ISO 17021 standard “Conformity assessment requirements for bodies providing audit and certification of management systems”. This is the standard all credible ISO 9001 certifying bodies should be accredited to by their national accreditation agency. In the case of the EXCiPACT^TM Scheme it is EXCiPACT asbl which takes the role of the national accreditation body and ensures that standards are upheld. ISO 17021 also requires that Certifying Bodies maintain impartially and avoid conflicts of interest to ensure no consultancy or similar involvement with the excipient supplier occurs by any of the EXCiPACT auditors.

Having established that the Certifying Body has fully implemented the EXCiPACT^TM Certification Scheme requirements into its management systems, and audited those systems to confirm it, EXCiPACT asbl takes an equally close view of the auditors themselves. Each auditor has to apply to be registered with the EXCiPACT^TM Certification Scheme and provide evidence of their audit skills, knowledge and recent audit history. Auditors have to:

• Be ISO 9001-registered auditors with good management systems knowledge;
• Have some knowledge of pharmaceutical regulations and requirements;
• Attend a two-day EXCiPACT^TM GMP and GDP training course designed to concentrate on the GMP and GDP requirements in the EXCiPACT Certification Scheme that are not already covered in ISO 9001. The two-day course is only about the key GMP and GDP principles and how they can be incorporated into an existing quality management system;
• Pass an end-of-course exam in order for them to progress their registration;
• Be witnessed in their first EXCiPACT^TM audit, and then at three-yearly intervals to ensure they have applied the learning points from the course. The person witnessing the auditor can be an EXCiPACT asbl employee (for example, as part of the Certifying Body registration or re-registration process) or they can be a Certifying Body employee with the same competency as the auditor. This auditor competency registration process ensures that not only are the EXCiPACT standards communicated to the auditors, but they are also confirmed as being implemented.

Each auditor is required to register with EXCiPACT asbl independently of their employer. This ensures their registration is transferable to other employers who may wish to use their services for EXCiPACT^TM audits.

Excipient suppliers are held to two highly complementary standards, one being GMP and the other, Good Distribution Practices (GDP). The latter is aimed at distributors and other suppliers of excipients who do not manufacture or repack excipients. These standards have been derived from the IPEC-PQG GMP and IPEC GDP Guides and have been fully updated with contemporary approaches, most notably the requirement for the supplier to conduct a number of risk assessments to identify how their excipients could be compromised and then to apply suitable controls to minimise those risks. Such an approach is exactly the same as elaborated in the more recent ANSI/IPEC/NSF 363-2014 US National Standard, which can also be used as the basis of an EXCiPACT^TM audit for those suppliers who do not hold ISO 9001.

The EXCiPACT and ANSI 363 standards were predominantly developed by the same individuals, with the objective of ensuring they had the same requirements. The parent IPEC-PQG GMP and IPEC GDP Guides have received very widespread acceptance as suitable standards for excipient suppliers, and with this pedigree the new EXCiPACT and ANSI-363 standards are expected to be equally acceptable for the majority of excipients. Excipients with particular risks will require more enhanced GMPs as is required in the EU Ascertaining GMP Guidelines, but these standards form the basis on which such enhancements could be built.

The audit process

Given qualified third party Certifying Bodies and EXCiPACT-registered auditors, how does the Scheme’s audit process work? The steps are as follows.

(1) The excipient supplier selects an approved third party Certifying Body from the list on the EXCiPACT asbl website. If they hold a current ISO 9001 Certificate, they can use that to have an audit to the EXCiPACT GMP and/or GDP standard, and if not, they can be audited against the NSF/IPEC/ANSI 363 standard which includes all the ISO 9001 quality management system elements as well as GMPs.

(2) The standard ISO audit Certification process commences with a Stage 1 audit, usually for one day. This is used to plan the Stage 2 (full) Certification audit by defining the scope of Certification and the audit man-days needed to complete the assessment.

(3) Sometime later, the Stage 2 audit occurs, covering the quality and GMP Management Systems which are in scope for the audit. This is another important aspect of the Scheme, since many excipient suppliers can have other activities and products on site which are not included in the audit process. It is essential that the pharmaceutical manufacturer checks that the scope of any EXCiPACT^TM certificate includes the excipients that they purchase from the supplier.

(4) After the Stage 2 audit, for an EXCiPACT Certificate to be issued there must be no life-threatening, critical or major non-conformities open. ‘Life-Threatening’ was a criteria requested by the US FDA which wanted to be informed immediately of any findings of excipients causing harm to patients. Note this is not situation in which there is a risk of harm, but that there is actual harm. In such cases the EXCiPACT Scheme rules require the excipient supplier to inform the healthcare regulatory agencies immediately of the finding and confirm it to the Certifying Body. ‘Critical’ non-conformities are where there is very high risk of patient safety being compromised and ‘majors’ would be significant gaps in the quality and/or GMP management systems.

(5) Once a Stage 2 audit is successfully completed, a Certificate Fee is paid to EXCiPACT asbl and the supplier’s details are added to the EXCiPACT website. The Fee covers the period the Certificate is valid (three years) and is payable again on recertification.

(6) The excipient supplier is now free to share the Certificate and audit report(s) on a confidential basis with their pharmaceutical customers. Any issues noted in the audit reports would be down to the excipient supplier and their customers to resolve together.

(7) The pharmaceutical manufacturer can then verify all aspects of the Certificate and Audit Report by checking if the Certifying Body and their auditor(s) are listed on the EXCiPACT website. If so, there is a high degree of assurance that the Certificate and Audit Report has been issued under the rules of the Scheme. The Certificate and Audit Report can be used with confidence to meet the requirements in the European Commission Ascertaining GMP Guidelines and therefore in full compliance with Chapter 5 requirements in Part 1 GMPs,

Conclusion

A supplier with an EXCiPACT^TM Certificate and who shares their audit reports with their customers proactively demonstrates that they have implemented current excipient GMP and/or GDPs. Pharmaceutical manufacturers can then be confident that they are purchasing materials from a reliable source. The Scheme meets all the legal requirements and at the same time reduces the audit burden on all parties without compromising quality or patient safety.

To date the 22 EXCiPACT^TM Certified suppliers and their customers have confirmed that these benefits can be realised by both sides when using the Scheme.

References

1. Directive 2011/62/EU
2. Guidelines of 19 March 2015 on the formalised risk assessment for ascertaining the appropriate good manufacturing practice for excipients of medicinal products for human use (2015/C 95/02)
3. EXCiPACT asbl Articles of Association; excipact.org

Biography

Dr Iain Moore is Global Head of Quality Assurance at Croda International plc. After completing his doctorate studies in organometallic chemistry he has been with Croda since 1987, and for the last 20 years in quality roles. He has helped define GMPs for cosmetic and pharmaceutical ingredients and implemented these requirements across Croda’s sites. He is chair of the EFfCI GMP Committee and President of the Board EXCIPACT asbl.