While drug and device makers often can’t tell which of their suppliers are virtual companies, seven steps to qualify suppliers have proven effective for any supplier — including those that are, or could be, virtual, an expert says.
“At least 10 to 11 percent of your suppliers are virtual companies,” John Avellanet, founder of Cerulean Associates, told a Wednesday FDAnews webinar. “So for at least 10 percent of your suppliers, you’ve got to be doing extra things to control them because you’re never going to be able to go on site.”
Traditional qualification involves remote prep work for an audit, the onsite audit and then contractual control negotiations. But for a company that may be virtual, or can’t be physically audited because of distance or other factors, drug and device makers must put much more work into remote qualification, Avellanet said. Manufacturers should keep the results of this process in a vendor dossier to show US Food and Drug Administration (FDA) investigators and other regulators.
Avellanet recommends the following seven-step supplier qualification procedure:
Step 1: Rapid red-flag review. This should be a 20-minute activity that involves looking at the supplier’s website for consistency, misspellings (particularly regulatory acronyms like HIPAA or FDAAA), whether information is current, whether email addresses match the website URL, and whether physical mailing addresses fit expectations.
A Google Earth revelation of an address mismatch is the No. 1 way drug and device makers discover a company is virtual, Avellanet said. “You must have your people be familiar with Google Earth. It is absolutely critical.”
Drug and device makers should also check debarment lists from FDA, the Department of Health and Human Services’ list of excluded individuals and entities, and the US State Department’s list of debarred parties.
Step 2: Basic criteria verification. This involves checking whether a company is incorporated with liability insurance, looking at basic financial history (such as through Dun & Bradstreet), assessing a supplier’s relative experience with whatever the drug or device maker wants to purchase, experience dealing with regulated customers, and experience dealing with customers in the drug or device maker’s region. “To drive down risk, make sure that the supplier has at least one employee fluent in your language, or vice versa,” Avellanet said.
Step 3: Reputational due diligence. Drug and devicemakers should check for industry accreditations or certifications such ISO or BBB, association memberships, industry awards, independent third-party assessment reports, industry periodical publications, public speeches, and regulatory compliance history.
Step 4: Key executive red-flag review. This review, which may only be necessary for critical vendors, involves a web search for the names of the supplier’s point of contact, CEO, CFO and other top executives, alongside terms such as “fraud,” “prison” and “debar.”
Step 5: Audit preparation. To prepare for a remote or on-site audit, drug and device makers should collect the data from steps one through four and note anything that is missing or requires further verification. Then, drawing upon the rationale to obtain a supplier (from product development, business outsourcing decisions, etc.), create an audit checklist and determine a sampling plan and statistical rationale.
Avellanet noted that initial audits should look at possible future monitoring metrics. “Potential metrics, such as reject rate, frequency of internal audits, and number of open corrective and preventive actions versus time open, are all metrics that firms should consider incorporating into their supplier qualification audit, especially since these are metrics that a company may later want to use to monitor the supplier. So use the initial qualification audit to find a baseline now,” said Avellanet.
Step 6: Audit. During the audit, companies should ask to see the last report from the supplier’s annual review and find out how they manage their own suppliers. It is also important to review SOPs critical to the drug or device maker’s processes or requirements. Pictures from inside the facility should be obtained — ideally, a broader shot of the manufacturing bay and relevant areas, rather than a picture of a single machine, Avellanet noted. “If you have to do this remotely, then ask them to take the photos for you. Be careful about relying on canned website shots. If nothing else, you want a quick visual check to get an idea of whether this is relatively modern facility or someone’s basement.”
Typical items to request during a remote audit include:
- Five to 10 specific, directly related SOPs;
- Process validation summary reports of those SOPs;
- Current organizational charts;
- Training records on the SOPs for relevant personnel;
- Results of the most recent quality system management review;
- Recent third-party audit summaries; and
- A list of critical suppliers that will be used to supplier ingredients or components.
Step 7: Supply chain map. Avellanet advised drug and device makers to create a supply chain map for critical suppliers. This is a top-level, linear workflow map that should indicate the contract manufacturing organization, the critical component or ingredient makers, and key distributors. “Keep it simple and confine it to a single page. Companies can set themselves apart by going beyond second-tier suppliers,” he said.
During the webinar, Avellanet pointed to several recent FDA warning letters on supplier control that cite U.S. v. Park and U.S. v. Dotterweich — cases that raised the bar for corporate responsibility (see the Entrenet Nutritionals and Pristine Bay warning letters). These letters indicate “the agency is getting very frustrated regarding supplier oversight and they’re really looking to hammer home this concept of ultimate accountability,” he told attendees.
Adapted for the web from original July 2013 publication in the “The GMP Letter”