What do you mean by risk-based audit? Is it different from routine audit?
I would put the two concepts in separate boxes. A routine audit is something that you do with a supplier or service provider that you're already working with, and you have a schedule defining when to audit them. It's typically 3 years, following the frequency of authorities' inspections. So that'd be the "routine" part of it, just making sure how things are going, if they're solving the problems, etc. But we would say that all audits should be risk-based. As we know, auditors don't have unlimited time for audits. We wish we could have unlimited time to learn everything about a company and even find what needs to be improved.
But the reality is that you don't. We normally get one day, in some happy cases we get 2, 3 days, but still, it's limited time. So everything should be based on risk: You identify the procedures that they're following, the processes that they're doing, the intended use of the products, maybe previous issues and problems. And then you base how you are going to structure the audit and the kinds of questions that you will be asking and the kinds of topics that you will be diving into based on risk. You should always do it based on risk. So that's why preparation is key to be well prepared for the audit.
Came across a deviation in a facility where OOS in pressure differential was observed during pre-flight checks in a compounding facility. As an auditor in QA, what am I supposed to be concerned with?
I understand that during the tests, before actually running the facility, the pressure differential could not be achieved. If you find this situation during an audit, probably you're looking too deep, this will probably not pop up during a normal audit. But if you were lucky enough to find it, this is concerning. Even just in the design and the installation of the facilities, you're already finding that the facilities are not capable of achieving the design that you've made. And the design is there for a reason, the pressure differential is there to avoid particles from entering from a dirtier area to where you probably have manipulation of the product or dust generation, and you don't want external particles to enter. If you're finding this during an audit, you'd probably look for other examples about actual work being done, and, like Jordi was saying, evidence that the actual pressures are being recorded? Is there maybe an online graphic of how the pressure is behaving? So maybe not focus so much on the past.
But if you are the QA responsible for the installation of the facility and the release of the facility for actual work, this, for me, would be a red light to stop whatever is coming after that part of the process, and fix this problem. Because if you start with the left foot, as seems to be the case here, you need to check if the design of the cascade is what you actually need and can achieve, and if the equipment that you have will be sufficient to achieve this design.
Practice 1 - Has the auditor seen the stability procedure?
In this hypothetical scenario the SOP was not requested to be reviewed but in a real case, it could be requested during the audit. In any case, it is likely that the stability procedure would mention the storage conditions, the tolerances for pulling samples from the chambers, and for testing them, etc. But not necessarily how to react in the case of an unexpected result.
Practice 1 - Since it took so much time to finish the investigation, wouldn't the result be put in question?
In this case, we did not observe any evidence to doubt any result of the investigation. The issue here was the timelines that were not accomplished as stated in their SOP.
Practice 1 - Since the reaction time is supposed to be 20 days, why was a CAPA not started to complete the investigation?
A: That is the point we mentioned in the conclusions section. It was found that they did not follow their SOP regarding timelines and this can be an observation.
Practice 3 - Is fingerprint log-in practical in the lab? With the need of gloves usage?
We as auditors can recommend some things, but we are not consultants so if they applied this system we guess it is practical for them.
Is it mandatory to audit a chemical manufacturer that is used for key starting materials of an API manufacturer? If so, can we apply APIC guidelines?
What is mandatory is for manufacturers of intermediates and/or APIs to have a system for evaluating the suppliers of critical materials, and to purchase materials against an agreed specification, from suppliers approved by the quality unit. This evaluation and approval process may include auditing, but it is not mandatory. However, a sound and well-justified risk assessment would be expected to be in place to confirm that an audit is not needed. If the audit is to be performed, the APIC Guide for Auditing Registered Starting Material Manufacturers can be used.
