Remote Audits Reignite Regulated Companies and Supply Chains

EDITOR'S NOTE:The following article is a Q&A with regulatory compliance expert Derek Churchill from Quality Support Group (QSG). 

The COVID-19 pandemic disrupted many aspects of global societies, lifestyles and economies. It slowed some industries and brought others to a complete halt. In particular, the tight travel restrictions had a severe impact on regulated companies as auditors were unable to conduct on-site inspections. Companies were at risk of falling out of compliance, which potentially jeopardized the global public health supply chain.

Fortunately, technology has enabled regulatory agencies and businesses to conduct audits for current good manufacturing practices (CGMP) remotely. According to Derek Churchill, senior consultant at Quality Support Group (QSG), this new auditing paradigm for regulated industries has presented new opportunities for improving the efficiency of achieving and maintaining regulatory compliance. GxP Lifeline recently met with Derek Churchill, where he shared some expert insights and best practices for successfully preparing for and conducting remote audits.

Q: What’s the general mindset of regulated companies right now?

Derek: There is a high level of anxiety triggered by a variety of concerns. Clearly, this is an unprecedented situation that’s having a significant impact throughout the world. Regulated companies are concerned that their certifications may lapse. Failing to maintain compliance or losing customer-mandated certifications could render companies unable to contribute to the value chain, which puts their business at risk.

From the auditors’ standpoint, regulations still must be met. Auditors need to conduct audits that comply as well as provide value to the customer. At the same time, companies, auditors and audit consultants are experiencing anxiety around needing to learn new technologies and processes for conducting remote audits. In addition, the COVID-19 outbreak has added a level of risk to the health of auditors and company staff in the event an site visit becomes necessary.

Q: How do remote audits work?

Derek: In general, audits are performed on-site, remotely, or as a combination of remote and on-site activities, depending on the nature of the audit. As a result of the pandemic, audits typically conducted on location are now being completed remotely using video conferencing and file sharing technology. This allows all audit participants to converse and simultaneously review documents and records.

Obviously, remote audits require more planning and preparation to ensure everything is functioning properly, so the majority of the auditor’s time can be spent on the inspection. For the observation part of the audit, if the auditors have already visited the site multiple times, a site tour might not be necessary. Otherwise, the company can have someone walk around carrying a mobile device, allowing auditors to see the facility. One advantage to this is the person can transmit photos of specific items for a more detailed inspection.

Q: What challenges have companies faced with remote audits?

Derek: Typically, people struggle with change. In audit situations, companies stick to their routines and processes and auditors hold tight to their checklists. Change is not easy, but the current circumstances are leaving companies and auditors with few options.

For example, documentation can impose a big challenge. Auditors need to review and qualify various types of documents, including quality manuals, procedures, nonconformance logs, complaint logs, deviation records, the list goes on. If all the documents are in electronic format, the audit can be relatively easy. If the documents are all hard copy, the audit can cause anxiety.

Another common challenge involves the technology. Conducting audits remotely requires operating video conferencing equipment and software applications. People don’t all have the same technical aptitude so there can be some steep learning curves for all participants.

Q: What insights can you share for successfully conducting a remote audit?

Derek: First, I want to point out that you absolutely can accomplish what you need with a remote audit. In some cases, depending on the product or service, such as for food safety, audits need to be onsite. Otherwise, you can complete a thorough, fully compliant audit remotely. The key components of a successful remote audit are planning and communication — you cannot overdo either.

I’ll start with auditors. Since audits are not a one-size-fits-all scenario, auditors need to engage early and often to set up an audit process that best fits the organization they’re inspecting. Naturally, audits with existing clients are easier. With new clients, auditors should expect the activities to involve more conversations, more advanced preparation and more time conducting the audit. For a remote audit, I recommend that auditors:

• Engage with companies at their comfort level.
• Be creative in achieving goals, rather than sticking with how they have always done things.
• Create an audit plan ahead of time and communicate it to the company. This might include what records and documents will need to be reviewed, if a facility tour from a mobile device will be necessary and which members of the staff will need to be available?
• Be patient. I stress this above all else. The audit proceedings will likely take longer and involve last-minute changes or activities that weren’t planned for.

Audit consultants can be extremely helpful to companies preparing for remote audits. Again, being proactive and identifying specific areas where companies need to make changes and improvements will help ease anxiety. To help companies prepare for remote audits, I recommend consultants:

• Help bring companies up to speed with the technology, equipment and processes. This includes educating companies on the different video conferencing platforms and potential compatibility issues when audit participants use different platforms.
• Inform companies about applying cybersecurity measures with video conferencing. For example, some applications have security vulnerabilities that put some materials, such as drawings and proprietary data, at risk. All participants involved in remote audits need to be aware of the cybersecurity and compliance aspects of video conferencing.
• Have clients go through mock audits and request the same documentation that the auditors would require. This will expose any hiccups or gaps in the documentation that will need to be addressed.

The companies undergoing a remote audit can improve their chances for success by being creative and willing to adopt new approaches to hosting and conducting audits. To prepare for a remote audit, I recommend that companies:

• Set up a strategic plan around compliance and involve all stakeholders in determining how to satisfy compliance through a remote audit. This could become a master plan for all audits.
• Complete an internal gap assessment of how much documentation is available in electronic format and how much is hard copy that will need to be scanned. For example, completed production documentation packages are typically the biggest collection of documentation. Pull all that together, and make sure it’s available in electronic format.
• Set up a shared drive so that auditors and company stakeholders can simultaneously review documents during the audit.
• If not already using video conferencing, sign up for a platform and receive training on the technology as well as the compliance and cybersecurity regulations.
• Make sure video conferencing equipment is set up and working properly prior to the audit and arrange for a device to conduct a remote tour of the facility if needed.
• If the audit participants have different preferred video conferencing platforms, make sure that is worked out ahead of time.
• Get the consultants, certification auditors and company together virtually beforehand to resolve potential issues, such as connectivity for all participants. Invite IT to participate because there might be some potential issues that wouldn’t occur in an onsite audit.

Q: What is your perspective on the future of quality audits?

Derek: Overall, everyone is trying to work together — governing bodies, auditors, consultants, and so forth, to be successful. Still, the perception that this pandemic situation is only a temporary circumstance and eventually everything will go back to the way it was may not be the case. The reality is conducting audits and other business processes remotely might actually become the new norm.

I want to reiterate that you can accomplish everything you need for GMP compliance with a remote audit. As companies start completing their audit cycles, they should look at the experience and determine how much of the audits can be done remotely and how much will still need to be done onsite. Then they can build a more effective audit strategy around that scenario.