GMP audit of a contract manufacturer: a sponsor's due-diligence checklist

Why does a sponsor need to audit a contract manufacturer?

Outsourcing manufacturing does not outsource responsibility. EU GMP Chapter 7 (Outsourced Activities) states that the contract giver "is ultimately responsible to ensure processes are in place to assure the control of outsourced activities", and that before outsourcing it must assess the "legality, suitability and the competence" of the contract acceptor. It must then monitor and review the contractor's performance and review the records and results of the outsourced work.

ICH Q10 (section 2.7) says the same in quality-system terms and names audits, material evaluations and qualification as ways to assess a partner's suitability. For active substances, EU GMP Chapter 5 (point 5.29) requires audits of active substance manufacturers and distributors, carried out by the manufacturing authorisation holder "either by himself or through an entity acting on his behalf under a contract".

The audit also feeds batch release. Under Annex 16, the Qualified Person (QP) must be assured that audits of the sites involved in manufacture and testing have been carried out and that the reports are available to them (point 1.7.3).

What to check before any visit: the desk review

A desk review filters out unsuitable sites and tells the auditor where to focus:

• Authorisation and GMP certificate. Search EudraGMDP, the EU database of manufacturing and import authorisations, GMP certificates and GMP non-compliance statements. Confirm that the site address, dosage forms and operations on the authorisation match what you intend to buy, and note the date of the last inspection.
• Irish sites. The HPRA explains that manufacturers need a manufacturer's/importer's authorisation (MIA) and a valid GMP certificate, issued after an inspection if compliance is satisfactory. The HPRA points to EudraGMDP for its list of authorised manufacturers.
• US inspection history. The FDA Data Dashboard publishes final inspection classifications: NAI (No Action Indicated), VAI (Voluntary Action Indicated) and OAI (Official Action Indicated). It does not include every inspection; pre-approval and state inspections, for example, are excluded. Also search FDA warning letters.
• Quality defects and recalls. Check the HPRA quality defects and recalls pages and equivalent notices in other markets the site supplies.

For a first list of Irish sites by location and activity, the Ireland pharma map and the CDMO directory are starting points; neither replaces the regulatory checks above.

What the GMP audit checklist should cover on site

Annex 16 (section 2.2) says an audit report should address the quality management system and all relevant production and quality control procedures for the supplied product, with every audited area accurately described. In practice, the scope looks like this.

For sterile products, our articles on EU GMP Annex 1 in Ireland and 21 CFR 211 versus Annex 1 go into more detail.

Documents to request from the CDMO

Ask for these before or during the audit, under a confidentiality agreement:

1. Manufacturer's/importer's authorisation and current GMP certificate(s).
2. Site Master File.
3. Quality manual and an index of quality procedures.
4. Summaries of recent regulatory inspections and the site's responses.
5. Deviation, complaint, CAPA and change control trends for a recent period.
6. Recall history and any open quality defect investigations.
7. Validation master plan, with cleaning validation and process validation approach.
8. Data integrity and computerised system validation policies.
9. List of subcontractors and critical suppliers, with their approval status.
10. For sterile sites: the contamination control strategy and recent environmental monitoring trends.
11. A draft technical or quality agreement.

Who should carry out the audit?

An audit and an inspection are different things. A regulatory inspection is carried out by a competent authority such as the HPRA and can lead to a GMP certificate or a non-compliance statement. A sponsor audit is commissioned by the contract giver under the contract and answers a narrower question: is this site suitable for our product?

The auditor can be the sponsor's own quality staff, a QP, or an independent auditor contracted to act for the sponsor. Annex 16 (section 2) allows a QP to rely on third-party audits, provided this is arranged in line with Chapter 7, and requires a written final assessment and approval of those reports. Whoever audits needs GMP knowledge relevant to the dosage form and no commercial interest in the site being chosen.

Remote or on-site: which is acceptable?

Remote assessment grew during COVID-19, but the published guidance is written for regulators. The EMA guidance on GMP/GDP distant assessments states that it "is not intended for use or to replace on-site inspections". The FDA's final guidance on remote regulatory assessments (June 2025) treats them as a tool alongside inspections, not a replacement.

For sponsors, a reasonable approach is to use remote document review and video walk-throughs for the desk phase or lower-risk suppliers, and to plan a physical audit for sites making sterile or high-risk products. PIC/S PI 041-1 (point 10.1.4) specifically notes "the challenges of remote supervision" when relying on copies and summary records.

Red flags that should slow down a signature

• A GMP non-compliance statement in EudraGMDP, or a recent OAI classification or warning letter, without a credible remediation record.
• Authorisation scope that does not cover your dosage form or operations.
• Reluctance to grant audit rights, or refusal to show raw data and audit trails.
• Undisclosed subcontractors for critical steps such as testing or sterilisation.
• Repeat deviations with the same root cause, or a large backlog of overdue CAPA.
• Cleaning limits with no documented scientific basis in a multi-product facility.

After the audit: quality agreement and CAPA follow-up

The audit report should, as Chapter 5 puts it, "fully reflect what was done and seen on the audit with any deficiencies clearly identified". Agree a CAPA plan with dates, and decide which findings must close before the first batch.

Then put the responsibilities in writing. Chapter 7 requires a contract that says who does each step, from technology transfer and materials testing to batch release, that keeps records available to you, and that permits audits. Repeat audits should follow quality risk management principles (Annex 16, point 2.2).

Getting an independent assessment when you cannot travel

For teams outside Ireland, flying in to audit a shortlist is not always practical. Priya Life Science's CDMO and CRO sourcing service can coordinate an independent facility assessment: it briefs and arranges a qualified independent auditor or QP and gets a structured report back to you. Priya Life Science does not certify sites or carry out audits in its own name, and the decision to approve a supplier stays with your quality system and your QP.