Preparing for Your Next Supplier Qualification Audit: A Field Guide
What to look for, what to push on, and where our common findings actually come from.
We recently wrapped up reports for three supplier and vendor qualification audits at sterile pharma and biologics manufacturing facilities. Two were biologics/ADC CDMOs. One was a sterile ophthalmic manufacturer. Between them they produced 29 findings, including 8 Majors.
Interestingly, the findings weren’t scattered randomly across quality system categories, but concentrated in the same handful of areas, at all three facilities, even though the facilities were producing completely different products in completely different regulatory environments.
We thought we’d share a quick field guide for auditors and Quality teams preparing for their next supplier qualification. Everything here is drawn from what we actually found. If you audit vendors and suppliers, use this as your roadmap. If you’re a vendor or supplier, use this to audit yourself!
Talk to us if you need auditing, mock inspection, remediation, or other RA/QA/Clinical support.
Before you get on the plane
A huge factor in how useful a qualification audit turns out to be is the work you (or your auditor) do before showing up on site.
A few specific tips here:
Request documents early and read them before the audit
This sounds obvious, but it’s way too often rushed or skipped. You want the Site Master File, the contamination control strategy (if one exists), the most recent media fill report, the vendor qualification SOP, the change control SOP, and the APQR for any product relevant to your scope.
Don’t request them as a formality. Read them!
Compare the facility layout in the SMF to photos you can find online.
Check whether the CCS covers all classified areas.
Look at the media fill protocol for operator participation numbers and intervention lists. When you arrive, you’ll already know where to push.
Check whether the facility has been audited by Western sponsors or health authorities before
A site that handles 400 client audits per year should have a polished audit hosting routine and a back office full of ready-to-go document packages. A facility undergoing its first Western regulatory audit will not. This distinction is important because your audit plan needs to match the facility's maturity level.
At an experienced CDMO, you're looking for cracks in a polished surface. At a newer facility, you're assessing whether the foundation is sound. These require different tactics!
Know your regulatory scope cold
In our Q1 audit reports, the biologics qualifications were conducted against both US FDA 21 CFR Parts 11, 210, and 211 and EU EMA EudraLex Vol. 4 with associated Annexes. The sterile pharma qualification was against 21 CFR Parts 11, 200, 210, and 211.
When you’re auditing against multiple regulatory frameworks, you need to know where they agree and where they diverge, because the facility’s procedures may comply with one framework and violate another.
Annex 1 expectations for clean room design and EM, for instance, are more prescriptive than the FDA equivalents.
On the ground: where the findings actually come from
Alright, now we’re on site. Here are the areas that produced the most findings in our Q1 qualification audits, in order of severity and frequency.
If you only have two days on site (which is typical), these are the places to spend your time.
Clean room design, qualification, and environmental monitoring
This was the single biggest source of Major findings across all three audits. It’s also the area where you can get the most information from the facility tour itself, before you’ve even opened a document binder.
There are a bunch of best practices here, so let’s run through them:
Walk the facility with the CCS in hand. If the site has a contamination control strategy document, bring it on the tour. Compare what it says to what you see. At one of our audit sites, the CCS addressed contamination risks from equipment contact but didn’t address airborne contamination pathways. This is a gap you can spot only if you’re reading the CCS while looking at the actual production area and asking yourself: does this document account for what’s in front of me?
Look at the clean room design classification. One facility we audited had constructed its liquid filling area as Grade-A with a Grade-C background. Current Annex 1 expectations call for Grade-A within Grade-B for aseptic processing. If you see a Grade-A/C configuration, ask for the documented risk-based justification. If there isn’t one, that’s a Major finding!
Check pressure differential documentation. At one site, the filling zone was at negative pressure relative to the turntable vial-feeding area, and the Grade C corridor was at positive pressure relative to the Grade C background of the filling isolator. Both configurations are atypical and neither had documented justification. Pressure-cascade design that doesn’t follow convention isn't automatically wrong, but it requires a documented rationale, and most facilities we audit don’t have one.
Ask about dynamic vs. static monitoring. One facility’s routine requalification for Grade-A areas did not include tests for pressure differentials, viable particulate counts, clean-up rate, or air volume, and none of the testing was conducted under dynamic conditions. Requalification frequency for Grade-C areas was set at yearly even though they directly support Grade-A operations. This is a good example of a program that looks fine on paper until you ask a specific question: “Was this done under dynamic conditions?” The answer tells you a lot.
Look at EM monitoring equipment placement. At two facilities, we found EM monitoring stands positioned above working height. This means the monitoring data is unrepresentative of the actual working environment. It’s the kind of thing you’ll only catch during the facility tour if you’re paying attention to the physical setup of monitoring equipment, not just its calibration status.