EMA - GMP Q&A Updated

16th April 2025

EMA - GMP Q&A Updated April 2025

• Q. Is an audit performed by a third party acceptable?
• Q. What are the expectations for the content of written final assessment of third-party audit reports?

Q. Is an audit performed by a third party acceptable?

A. The document 'guidance on the occasions when it is appropriate for competent authorities to conduct inspections at the premises of manufacturers of active substances used as starting materials', published as part of the Union procedures, states that it is expected that manufacturing-authorisation holders will gain assurance that the active substances they use are manufactured in accordance with GMP through audit of the active-substance suppliers. Article 46 (f) of Directive 2001/83/EC states: "The holder of the manufacturing authorisation shall verify such compliance either by himself or, without prejudice to his responsibility as provided for in this Directive, through an entity acting on his behalf under a contract". Manufacturers may not have the necessary expertise or resources to conduct their own audits and therefore may contract with third parties to undertake relevant audits. MIA holders may rely on audits carried out by active substance manufacturers on their suppliers of active substance intermediates provided that there is an appropriate contractual arrangement in place between the MIA holder and the manufacturer of the active substance.

Section 5.27 of the GMP guideline requires that the selection, qualification, approval and maintenance of suppliers of starting materials, together with their purchase and acceptance, are performed by staff that have a current knowledge of the suppliers, the supply chain and the associated risks involved.

An audit conducted by the manufacturing-authorisation holder itself should be integral to the manufacturer's quality-assurance system and subject to the basic GMP requirements, i.e. conducted by properly qualified and trained staff, in accordance with approved procedures. It should be properly documented. These aspects can be inspected as necessary by the competent authorities.

If a third party is involved, the arrangements should be subject to chapter 7 of the GMP guideline. There should be evidence that the contract-giver has evaluated the contract-acceptor with respect to the aspects described above.

All parties involved should be aware that audit reports and other documentation relating to the audit will be made available for inspection by the competent authorities if requested. This should normally provide sufficient assurance that the results of an audit carried out by the third party are credible, thus waiving the need for an audit conducted by the manufacturing-authorisation holder itself. A third-party contractual arrangement may lead to a conflict of interest arising on the part of one or more of the parties involved. Conflicts of Interest should be regarded as any influencing factor that may affect the judgement of the auditor resulting in an audit report that may not provide a full and impartial assessment against EU GMP requirements. 

Therefore, the MIA holder should ensure that there are arrangements in place to assure that any conflicts of interests are declared, and where declared, that they are assessed for their impact on the impartiality of the audit.  

Potential conflicts of interest may arise from diverse sources and may include for example: 

• An auditor who declares that they have financial, family or social links to the company being audited.
• An auditor who declares that they have previously worked for the company being audited and who may be presented with documents during the audit that were issued, reviewed or approved by them.
• Contract auditors or companies who declare that they stand to make commercial gain from sale or supply of an audit report (particularly to sharing of audit reports between different manufacturing-authorisation holders using the same active substance supplier).
• Auditors who declare that they stand to gain financially from a successful audit outcome, e.g. by payment of bonus or payment only on successful outcome or persons contracted as consultants (to advise) rather than specifically to conduct an impartial audit.

Definition of API starting materials, and hence which steps to perform under GMP, is a critical aspect where conflicts of interest may arise, especially in cases where an API intermediate is manufactured at a site different from the final API manufacturing site.

In addition to the arrangements to assure that conflicts of interest are declared, each auditing body should have a quality system that supports the quality and integrity of audits.

Where a conflict of interest has been declared by a third-party auditor or contracting company, they should document the nature of the conflict of interest, the impact it may have on the conduction of the audit and how the overall assessment of the GMP compliance status of the auditee is assured.

This topic should be addressed in the technical contractual arrangements. Any measures taken by the contract-giver should be documented, e.g. signed undertakings by the auditors. The absence or presence of conflicts of interest on the part of auditors or contracting parties should be identified.

QPs should ensure that the written final assessment and approval of third-party audit reports includes an evaluation of a declaration or absence of any conflicts of interest made by auditors and/or the contracting parties. 

Conflicts of interest may come to light after the QP has relied upon a third-party audit report and it may be necessary for the QP to undertake a retrospective assessment.

The principles outlined above could be used in case of joint audits between different manufacturing authorisation holders or in those cases where the drug manufacturers have jointly contracted the third party auditor and have signed the contract before the audit took place, using the same active substance supplier, provided that the scope of the audits can be shown to be applicable to the active substances of mutual interest. 

---

Q. What are the expectations for the content of written final assessment of third-party audit reports?

A. The QP has the ultimate responsibility to ensure that audit reports are properly evaluated when the audit is performed by a third party. The written final assessment document should provide a comprehensible summary of this evaluation and should be readily available and shared with authorities, if requested.

The assessment should include all expected elements of the auditing process and audit report(s) identified before, during and after the audit. In particular, this includes verification of contractual arrangements, scope and appropriate duration of audit, adequate competence of auditors considering the scope of the audit, planned audit frequency, and CAPAs whether adequate and how these are to be followed up. Any conflicts of interest identified should be discussed.​

Back to Recent News