Computer System Validation & Quality Assurance: Third Party Supplier Audits

Pharmaceutical outsourcing is predicted to grow to $60 billion by 2022. The rise in outsourcing strategies in addition to rapid technological change invariably means there are more IT providers; new systems, changes to existing systems and decommissioning. We are all familiar with the advantages of outsourcing such as; to reduce and control costs, provide a competitive advantage and freeing up of internal resources. However, the rise in outsourcing has led to an increase demand in audits.

Audits and assessments are an integral part of the quality strategy within the Pharmaceutical industry. For example,

MHRA EU Annex 11 part 5 (2007 p, 147) states “the software is critical component of a computerised system. The user of such software should take all reasonable steps to ensure that it has been produced in accordance with a system of Quality Assurance".

FDA ICH Q9 (Quality Risk Management) “Risk can be identified and mitigated through the supplier audit”.

Teams are in place to perform this activity, yet, the rise in outsourcing strategies equates to an increase of workload on quality departments as a consequence, this can lead to an increase demand in third party supplier audits.

The benefit of the third party audit is to;

Meet the Good Practice for computerised systems in regulated GxP Environments (2007) recommendations of performing supplier assessments
Meet the requirements of “GAMP 5” approach to verifying software
Identify non-conformances, associated with quality process, design process, implementation, testing maintenance and the likes
Determine the extent of conformity of the management system to be audited
Determine the conformity of activities, processes and products
Evaluate the capability of the management system to ensure compliance
Identify the gaps in the service function that must be augmented by third party suppliers
Identify areas of improvement within the processes and procedures used by your supplier
Enhance client/supplier relations (by building quality understanding)
Identify documentation that can support any future clients validation needs
Learn more about your suppliers organisation.

For suppliers an audit will reveal any shortcomings and identify solutions from the wider software engineering community, such as;

Suggest improvements in current processes from experience
Receive an objective and independent voice from independent auditors
Highlight major problems and suggestions for improvement, before they become major complications
Identify additional processes to further optimise your approach
Boast quality and cost efficiencies.

Auditing is an appropriate tool for monitoring and assurance purposes and should be part of a continuous process.

What makes a good supplier auditor?

the auditor must be unbiased
be able to gather factual information
avoid personal judgement
have an open mind
have no conflict of interest
be timely
good communicator
establish a professional report

Moreover the FDA (2002) states that “the combined lack of understanding of software can lead managers to believe that highly controlled engineering is not needed as much for software as it is for hardware. In fact, the opposite is true. Because of its complexity, the development process for software should be even more tightly controlled than for hardware, in order to prevent problems that cannot be easily detected later in the development process”.

I believe that those people with the combined expertise of software engineering and quality assurance within the software space make the best auditors. As well as provide the perfunctory audit checks against quality manuals, plans SOPs and the likes. This person can resonate with a developer, a tester or project manager to identify;

areas of strengths that can be consumed to reduce the validation burden
identify quality weaknesses and suggest improvements from the wider software engineering community

By having knowledge of business strategy, quality and engineering expertise, the auditor will easily reduce the burden on validation and identify with technical and process approach and provide a highly accurate assessment of the suppliers environment. As a direct result the auditor will help you to bridge the gap between business risk, quality risk and IT.

EmpowermentQE audit and assessments evolved from Total Software Quality Management, GMP and our on the job experience within the Pharmaceutical industry. We have performed 3rd party supplier audits on behalf of a clinical trials company. We have applied our audit approach as a health check for IT companies in order to identify process improvement roadmaps. Our audit services range from establishing check list for questionnaires to identifying lines of enquiry for questionnaires through to providing short term access and providing fully comprehensive ISO9001 audits.

Figure 1: EmpowermentQE Audit Services