Establishing and Operating an Effective GMP Auditing Program

An audit is an independent assessment of operations, not a tattling expedition. It may not be a joyous experience but it is a necessary exercise in regulatory compliance. GMP auditors are professionals with a special set of skills that ensure an auditee is in good shape from a regulatory compliance perspective.

“Hi, I’m from the Corporate Auditing Group and I’m here to help.” This popular phrase,appropriately modified to reflect the place from where the “helper” comes, is often heardand sometimes associated with Corporate Auditors and Corporate Auditing Groups. Noone likes to have their work reviewed and evaluated by an outside pair of eyes, especiallywhen those eyes belong to someone who has been trained to be critical and look foroperational inconsistencies and examples of regulatory non-compliance - and worse yet, report on those examples to one’s superiors and senior management. Yet performing anindependent assessment of operations, identifying an area of potential concern andensuring that appropriate and effective corrective actions are taken is critical to ensuringthat firms maintain a solid compliance posture and that management is aware of anypotential compliance concerns. So who are these Corporate Auditors, how did they cometo be what they are, and how do world class auditors and audit groups operate?

To begin with, audit programs should be structured so that the auditors have completeindependence of the functions they are auditing. They must also have the completesupport of management to ensure they are free to evaluate what they see and hear, andreport on their findings without fear of retribution. Corporate audit programs shouldreport to components that are reasonably high within the company organization, again toensure they have the ability to engage in dialogue with other senior management of theircompany on an equal footing.

 Auditors require special skills and attributes. They must, of course, be intimately familiarwith the regulatory requirements of the operations they are auditing, as well asappropriate company policies and practices. They must also have a sound understandingof the technology involved in the operations they are auditing. Strong interpersonal skillsare critical to the success of an auditor and the audit he or she is performing. There is anatural defensiveness which occurs on the part of the auditee and an audit can be anemotional experience. Anyone who has ever sat through a tax audit by the InternalRevenue Service can attest to this fact. Empathy, good listening skills and goodorganizational skills are critical elements associated with good auditors. Good auditorsare persistent without being relentless; ensure they have their questions answered andthoroughly understand a situation before they evaluate whether what they have seen and heard represents a true non-compliance or just a way of accomplishing something that isdifferent than expected. There is, as the expression goes, more than one way to skin a cat, and an auditor who thinks that his or hers is the only “right way” will never be seen as a good or fair auditor. A good auditor also knows when enough is enough, and once thenecessary information has been gathered, evaluated and the decision is made, moves on.I’m sure many of you have encountered the auditor who views the job as arriving on thescene after the battle is over and then bayoneting the wounded. Such an auditor will not have the respect of his or her peers, and will not be able to be effective in the job.
Good audit programs are also effective at ensuring any problems encountered during theaudits are properly reported on and that they are placed in the proper perspective. Notevery non-compliance is a capital offense and good auditors can prioritize their findingsappropriately. They are also skilled at reducing their findings to a complete, accurate andbalanced audit report for management. Once this report has been written and distributed,a good audit program ensures that appropriate corrective actions are developed andimplemented in a timely manner; and reports when the audit findings have been corrected.These follow up reports should be provided to the same individuals who received theoriginal audit report. Auditees generally like their management to know that they havebeen responsive and have corrected the audit findings in a timely manner.

So, while the job of a GMP auditor can be difficult (many auditors feel that no one isloved or appreciated less), the role that they play in helping to ensure that a company ison sound ground from a compliance role is critical. That is not to suggest that the peopleinvolved in daily operations aren’t critical to the compliance of an organization – theyare clearly the first line of defense in this situation. Their day in and day out involvementand familiarity with the operations they work in and manage is of paramount importance.When their diligence and hard work is complemented by an effective audit programwhich provides an independent and second pair of eyes looking at an operation, acompany should be in good shape from a regulatory compliance perspective.

Robert Dana is Vice President, Quality and Regulatory Affairs at the Parenteral Drug Association (PDA) in Bethesda, MD. He has over 40 years of experience in the pharmaceutical industry, and over the course of his career, has been a GMP auditor, directed a corporate compliance organization responsible for GCP, GLP and GMP compliance support for a large multinational pharmaceutical company and consulted in the areas of quality and regulatory compliance. He also has experience in product development and CMC filings in support of NDA’s and NADA’s.

The concepts outlined here and more will be described in more detail in an upcoming PDA Training and Research Institute (TRI) course Dana will teach entitled “Establishing and Operating an Effective GMP Auditing Program.” The course is scheduled for September 12, 2008 in Bethesda, Maryland, following the 2008 PDA/FDA Joint Regulatory Conference. For more information on PDA’s Training and Research Institute and this and other TRI courses, go to their web site at For information on the 2008 PDA/FDA Joint Regulatory Conference, go to

Read more about auditing and auditing solutions: