Contact Us

GxP Lifeline Feature Article

Establishing and Operating an Effective GMP Auditing Program

By Robert L. Dana

An audit is an independent assessment of operations, not a tattling expedition. It may not be a joyous experience but it is a necessary exercise in regulatory compliance. GMP auditors are professionals with a special set of skills that ensure an auditee is in good shape from a regulatory compliance perspective.

“Hi, I’m from the Corporate Auditing Group and I’m here to help.” This popular phrase, appropriately modified to reflect the place from where the “helper” comes, is often heard and sometimes associated with Corporate Auditors and Corporate Auditing Groups. No one likes to have their work reviewed and evaluated by an outside pair of eyes, especially when those eyes belong to someone who has been trained to be critical and look for operational inconsistencies and examples of regulatory non-compliance - and worse yet, report on those examples to one’s superiors and senior management. Yet performing an independent assessment of operations, identifying an area of potential concern and ensuring that appropriate and effective corrective actions are taken is critical to ensuring that firms maintain a solid compliance posture and that management is aware of any potential compliance concerns. So who are these Corporate Auditors, how did they come to be what they are, and how do world class auditors and audit groups operate?

To begin with, audit programs should be structured so that the auditors have complete independence of the functions they are auditing. They must also have the complete support of management to ensure they are free to evaluate what they see and hear, and report on their findings without fear of retribution. Corporate audit programs should report to components that are reasonably high within the company organization, again to ensure they have the ability to engage in dialogue with other senior management of their company on an equal footing.

 Auditors require special skills and attributes. They must, of course, be intimately familiar with the regulatory requirements of the operations they are auditing, as well as appropriate company policies and practices. They must also have a sound understanding of the technology involved in the operations they are auditing. Strong interpersonal skills are critical to the success of an auditor and the audit he or she is performing. There is a natural defensiveness which occurs on the part of the auditee and an audit can be an emotional experience. Anyone who has ever sat through a tax audit by the Internal Revenue Service can attest to this fact. Empathy, good listening skills and good organizational skills are critical elements associated with good auditors. Good auditors are persistent without being relentless; ensure they have their questions answered and thoroughly understand a situation before they evaluate whether what they have seen and
heard represents a true non-compliance or just a way of accomplishing something that is different than expected. There is, as the expression goes, more than one way to skin a cat, and an auditor who thinks that his or hers is the only “right way” will never be seen as a good or fair auditor. A good auditor also knows when enough is enough, and once the necessary information has been gathered, evaluated and the decision is made, moves on. I’m sure many of you have encountered the auditor who views the job as arriving on the scene after the battle is over and then bayoneting the wounded. Such an auditor will not
have the respect of his or her peers, and will not be able to be effective in the job.

Good audit programs are also effective at ensuring any problems encountered during the audits are properly reported on and that they are placed in the proper perspective. Not every non-compliance is a capital offense and good auditors can prioritize their findings appropriately. They are also skilled at reducing their findings to a complete, accurate and balanced audit report for management. Once this report has been written and distributed, a good audit program ensures that appropriate corrective actions are developed and implemented in a timely manner; and reports when the audit findings have been corrected. These follow up reports should be provided to the same individuals who received the original audit report. Auditees generally like their management to know that they have been responsive and have corrected the audit findings in a timely manner.

So, while the job of a GMP auditor can be difficult (many auditors feel that no one is loved or appreciated less), the role that they play in helping to ensure that a company is on sound ground from a compliance role is critical. That is not to suggest that the people involved in daily operations aren’t critical to the compliance of an organization – they are clearly the first line of defense in this situation. Their day in and day out involvement and familiarity with the operations they work in and manage is of paramount importance. When their diligence and hard work is complemented by an effective audit program which provides an independent and second pair of eyes looking at an operation, a company should be in good shape from a regulatory compliance perspective.

Robert Dana is Vice President, Quality and Regulatory Affairs at the Parenteral Drug Association (PDA) in Bethesda, MD. He has over 40 years of experience in the pharmaceutical industry, and over the course of his career, has been a GMP auditor, directed a corporate compliance organization responsible for GCP, GLP and GMP compliance support for a large multinational pharmaceutical company and consulted in the areas of quality and regulatory compliance. He also has experience in product development and CMC filings in support of NDA’s and NADA’s.

The concepts outlined here and more will be described in more detail in an upcoming PDA Training and Research Institute (TRI) course Dana will teach entitled “Establishing and Operating an Effective GMP Auditing Program.” The course is scheduled for September 12, 2008 in Bethesda, Maryland, following the 2008 PDA/FDA Joint Regulatory Conference. For more information on PDA’s Training and Research Institute and this and other TRI courses, go to their web site at For information on the 2008 PDA/FDA Joint Regulatory Conference, go to

Read more about auditing and auditing solutions:

Product Data Sheet:

MasterControl Audit™

Product Data Sheet:

QAAD™ Audit

White Paper:

Quality Audit – A Tool for Continuous Improvement and Compliance

Tech Paper:

MasterControl Audit™


MasterControl – Quality Audit Challenges and Solutions

Click here to view all available resources.

If you are a current MasterControl customer click here to download documents directly through our Customer Center.