The Rx-360 audit programs and BSI

A partnership in supply chain quality and security

WES SCHMIDTMember of the Audit Operations Group (AOG)

AbbVie

3

Rx-360 Mission

Protect patient safety by sharing information and

developing processes related to the integrity of the

healthcare supply chain and the quality of materials

within the supply chain.

Patient safety should never be compromised as a competitive advantage

The Rx-360 Join Audit Program

In keeping with the Rx-360 Mission, three audit programs

were developed. Today’s focus is on:

1. The Joint Audit Program

2. Audit Report Licensing

3. The Shared Audit Program

55

Rx-360 Joint Audit Program

Audits are conducted on behalf of members using third party auditing service providers

Audit costs are equally divided amongst audit sponsors

Prior to conducting an audit suppliers can exclude specific companies (i.e., competitors) from viewing the audit reports

Audits may be requested by both manufacturers and

suppliers

666

Key Benefits of Rx-360 Joint Audits

Reduce the number of audits at a supplier site while

increasing the effectiveness of the audits performed

Utilize a standardized audit approach and report

template

Improve transparency of audits and improve ‘collective’

assessment of supplier QMSs

The report can then be licensed (with supplier approval)

in lieu of conducting an on-site audit

Requirements of a Supplier Auditing ProgramHow Rx-360 meets the fundamental needs

Audit Standards

• Rx-360 Audit Guidelines are based on globally acknowledged standards for auditing of suppliers of materials and services

Audit Reports

• Standard audit report templates are applied, which address authority expectation for the content of audit reports, e.g. according to the EMA Q&A: GMP.

• Rx-360 Audit Reports provide a high level of detail

• Critical information is immediately forwarded

Auditor Qualification

• Detailed requirements for qualification of auditors are established

• Auditor orientation is provided

• Appropriate qualification is verified and documented for each individual auditor;

• Requirements and documentation address the expectations of authorities, e.g. according to EMA Q&A: GMP

Addressing Specific Needs of Audit

Sponsors

• Audits are planned prospectively

• Specific aspects to be covered are provided to the auditors in the pre-audit information request

• Rx-360 audits include follow-up of CAPAs related to previous sponsor’s audit

• Beside the Rx-360 audit, suppliers are still open to receive customers for technical visits, focusing on very specific issues without wasting time for standard audit topics

CAPA Follow-up

• CAPAs are evaluated regarding appropriateness by the auditors

• CAPA implementation follow-up will be performed until completion of actions

• Effectiveness of CAPAs is verified during the next audit

7

Search for an Audit Partner

• Rx-360 issued an RFP in search of an auditing firm that meets the level of quality and commitment needed for this specialized audit program.

• After considering more than a dozen highlyqualified auditing firms BSI was selected for this engagement.

• Rx-360 has chosen a partner in BSI that has proven its commitment to patient safety through its extensive work in the medical device industry.

• With over 70,000 clients worldwide and more than 150,000 audit days in 150 countries per year, BSI has the resources and infrastructure required to assist Rx-360 with their audit needs and is perfectly positioned to serve as a partner with Rx-360 members’ supplier base.

Rx-360 Selects BSI

The partnership between the two organizations

was announced…

Audit SchedulingauditsPLUS

In 2014 Rx-360 introduced auditsPLUS, a new custom

audit database

• Members enter audit requests into auditsPLUS

• The database matches like requests

• BSI monitors the database and sends

audit requests to suppliers

• BSI auditors conduct the audits

• The audit is tracked, viewed and made

available to members through the

database

10

1111

Audit GuidelinesCurrent guidelines

API and Registered Intermediates

• Adopted from ICH Q7 with additional TSE/BSE text

Excipients

• Adopted from EXCiPACT GMP standard for excipients

Basic Chemicals/Raw Materials (including Chromatography Resins Index)

• Based on IPEC/PQG excipients audit guide

Packaging/Printed Materials

• Adopted from ISO 15378 standard

Additional Audit InitiativesNew Guidelines in Development

Medical Device

Good Distribution Practices (GDP)

Supply Chain Security

• Every Rx-360 audit has a Supply Chain Security component

• Standards were adopted from C-TPAT guidelines and internal company

guidelines and practices

Observations

• Rx-360 Audit reports use two types of Observations

• A deficiency that indicates a critical system failure that may pose an immediate risk to patient safety or health, or may result in adverse impact to the safety, identity, strength or purity of a product.

Potentially Critical

• A deficiency against the Rx-360 audit standards, guidelines, checklists, but that are not potentially critical

Other

14

Joint Audit Process

Rx-360 member contacts Supplier

asking them to accept an Rx-360 audit

Rx-360 members enters audit request into

auditsPLUS

Once minimum number of sponsors is satisfied, audit request is sent to

supplier

Rx-360 obtains supplier agreement; selects and

assigns auditor

Auditor contacts supplier; conducts pre-

audit questionnaire; develops audit plan

Auditor conducts audit and notifies supplier of observations during the

closing meeting

Auditor reports any Potentially Critical

Observations (PCO) to Rx-360 within 24 hours

Rx-360 immediately reports PCO to

Sponsors; Sponsors address PCO directly

with Supplier, separately from Rx-360

Auditor submits audit report to Rx-360.

Coordinator forwards report to the Sponsors

Sponsors review report; Auditor sends final

report and establishes CAPA plan

Sponsors follow up and close out CAPA’s.

Supplier reports CAPA follow-ups to Rx-360

Audit Reports stored in auditsPLUS

1

11

10

9

6

7

8

5

3

2

4 12

16

Agreements for Joint Audits Program

Rx-360 Secretariat

Rx-360 Member

requesting audit

Suppliers

(Rx-360 Members and

Non-members)

Membership

Supplemental

Confidentiality Agreement

Service Agreement;

Statement of Work

BSI

Audit and

Confidentiality

Agreement

Confidentiality - the foundation of the Rx-360 audit programs

Member ResponsibilitySteps to Adopting the Joint Audit Program Internally

Enter audit requests into the AuditsPLUS database

Provide input during the pre-audit call about topics that need to be covered

Formally accept Rx-360 audits for supplier qualification, update relevant SOPs

Incorporate Rx-360 audit reports into their internal supplier audit repository/database, assure internal distribution of reports and results

Perform internal rating of audit observations

Perform specific assessment of the audit results for the sponsor company and provide an overall recommendation

Contact the Supplier to request their participation in the Rx-360 Joint Audit Program.

18

Rx-360 Audit Licensing Program

• Audit reports originating from the Joint

Audit Program may be licensed to

both members and non-members for

a fee through the Rx-360 Secretariat

• A list of reports available for licensing

can be found on the Rx-360 website

using the following link Rx-360

Reports for Licensing

• Suppliers determine which

organizations may license an audit

report through an addendum to the

original CDA

• Members are provided access to the

reports and corresponding materials

through auditsPLUS

18

18

Return on InvestmentThe Joint Audit Program from a Financial Perpective

Audit of a Member

Company

New EU GMPs: Impact to Supplier

Audit Programs at Drug Manufacturers

• Effective 1-March 2015, Law applies to any medicinal products authorised for marketing in the EU

• Changes are follow-throughs of Falsified Medicines Directive

• New EudraLex Volume 4 updates

• Chapter 5 revisions specific to Active Pharmaceutical Ingredients• Supply chain traceability records shall be available [maps]

• Audits should be carried out at manufacturers and distributors of API’s to confirm GMP/GDP compliance

• The market authorisation holder shall verify compliance either by himself or through an entity acting on his behalf under contract

• Audit duration and scope commensurate with document risk assessments

• Repeat audits to ensure maintenance of standards and to verify approved supply chain [every 3 years]

NEW

New EU GMPs: Supplier Audit Programs

• If a Manufacturer outsources the production and/or distribution of the API, and supplier audits have not been done routinely or at all:• They have to be performed now, and on a routine basis

• Audits can be outsourced with appropriate allowances and controls which may be documented in the manufacturers quality system

• Providing such items exist, such as:

• Auditing firm has been selected based on competency

• Auditors are deemed competent and trained

• Audit checklists are aligned with scope of audit

• Reports are clear and are good quality records

• Risks can be determined; conclusions [audit ratings, severity]

• Corrective actions can be opened and tracked

• Effectiveness of CAPAs

Oversight: Appropriate actions can be taken

based on findings and inherent risks

Return on InvestmentThe Joint Audit Program from a Financial Perpective

22

22

Audit of a Nonmember Company

Summary• Rx-360 and BSI share a vision of providing high quality

audits

• Working together the audit process can be streamlined to meet the needs of Rx-360 members while reducing the number of audits requested of suppliers each year

• Confidentiality is maintained through every step of the process

• Reports can be licensed, with supplier approval, through the Rx-360 Secretariat by both members and non-members, potentially reducing the number of audit requests

• Audits will remain an important risk management tool and a demonstration of oversight, as well as a requirement

BEN MILLSBritish Standards Institution (BSI)

The changing environment in the pharmaceutical sector

Impact on the Supply Chain

BSI Expertise

• BSI was the World’s first National Standards Body and Globally recognized

as champions of best practice

• Play a Key Role in Standards Development and Leading Supply Chain Risk

and Compliance Based Solutions.

• Preferred Registrar for 23 of the World’s Top 25 Global Medical Device

Manufacturers

• Leading Supply Chain Risk Management and Compliance Provider to

Pharmaceuticals

• 53% of Leading Global Pharma Companies Utilize BSI

Risk Management and Compliance Services

09/10/2015

Audit Experience in High Risk Healthcare

Markets• Medical Device

• Competence and quality of service is critical

• BSI Delivers >7000 Medical Device Factory Audits Annually to ISO 13485

• Auditing for the US FDA, Japan JPAL, Australia TGA etc

• The Leading EU Notified Body (NB) Delivering Product Conformity

Assessments & Market Access to 28 states

• Circa 75% of the Worlds Leading 100 Medical Device Companies Choose

BSI as their Notified Body

• Supply Chain Risk & Compliance Management

• 53% of Supply Chain Customers are within the Pharmaceutical industry

• Provider to Dept Homeland Security (CBP) with SCREEN intelligence

09/10/2015

THE JOINT AUDIT

PROGRAMThe BSI Approach

Overview

• Rx-360 Auditor Competency

• Auditor Training

• Rx-360 Audit Standards/Guidance Documents

• Audit Process

09/10/2015

Joint Audit Program

• The Joint Audit Program applies to suppliers of:

- Active Pharmaceutical Ingredients and API

Intermediates

- Pharmaceutical Excipients

- Basic Chemicals and Raw Materials

- Pharmaceutical Packaging Materials for Medicinal

Products

09/10/2015

31

Qualification of Third Party Auditors

• They key to a successful audit program is experienced auditors

• BSI maintains stringent guidelines for auditors to be qualified to conduct audits on behalf of member.

• All auditors register with the consortium

• The Rx-360 Audit Operations Subgroup regularly reviews auditor qualifications to ensure they are in keeping with Rx-360 standards

• Auditors are assigned to an audit based on qualifications and location

32

Auditor Orientation

Prior to conducting audits all auditors must

1. Participate in auditor orientation with Rx-360 subject matter experts

2. Review all relevant documents for Auditors

3. Sign an Ethics Statement

4. Sign a Statement of Understanding upon finishing orientation

Rx-360 Auditor Competence

• Education - Bachelor’s Degree in a Science, or Demonstrated Relevant Work Experience that Provides Equivalent Knowledge

• Professional Experience - Minimum of Five years of GMP Operational Pharmaceutical Experience and or Similar Experience. Operational Experience Includes those Skills and Competencies Gained while Working within a Pharmaceutical GMP Environment or Equivalent

• Regulatory Knowledge - Must be Knowledgeable about Pertinent Regulatory and Best-Practices Requirements (e.g.ICH Q7 for APIs, CFRs for USA, IPEC Guidelines for Excipients)

• Audit Experience – Applicable Experience in the Types of Audits Including Leadership

• Auditors are Approved by Subject Matter Expert

09/10/2015

Auditor Competency - General

• Auditors are Qualified under ISO 17021 Accreditation Requirements

• Defined Processes are in Place for Selecting, Training, Formally Authorizing Auditors

• Initial Competence Evaluation of an Auditor includes the Ability to Apply Required Knowledge and Skills during Audits, as Determined by a Competent Evaluator Observing the Auditor Conducting an Audit (Qualifying Review)

• Monitoring Procedures for Auditors includes a Combination of On-Site Observation, Review of Audit Reports and Feedback from Clients

• Regular Observation on the Performance of Each Auditor On-Site (Re-qualifying Review)

09/10/2015

Auditor Training – Rx-360

• Rx-360 Audit Process Including Guidelines

• Regulatory/GMP (US & EC)

• Supplier Quality Considerations in the Pharmaceutical Industry

• Supply Chain Security

• Regular Refresher Training

• Data Integrity

09/10/2015

NEW

Code of Ethics for Rx-360 Auditors

• Integrity

• Objectivity

• Confidentiality

• Competency

• Signed Responsibility Statement

09/10/2015

RX-360 Audit Standards/Guidance

Documents• Rx-360 Audit Standards for Active Pharmaceutical Ingredients

and API Intermediates

• Rx-360 Audit Guide For Pharmaceutical Excipients

• Rx-360 Audit Guide for Basic Chemicals and Raw Materials

• Rx-360 Audit Guide For Pharmaceutical Packaging Materials for Medicinal Products

• Rx-360 Supply Chain Security Guide for Audits of Excipients, Raw Materials/ Basic Chemicals, APIs, Repackaging/ Relabeling and Distribution Facilities [Embedded within all Audits]

09/10/2015

Active Pharmaceutical Ingredients and

API Intermediates

• Rx-360 Audit Standards – Document 2460627

• Based on:

• ICH Q7 – Good Manufacturing Practice Guide for Active

Pharmaceutical Ingredients, and….

• EMEA/410/01 Revision 2 – October 2003 – Note for

Guidance on Minimizing the Risk of Transmitting Animal

Spongiform Encephalopathy Agents via Human and

Veterinary Medicinal Products

09/10/2015

Excipients

• Rx-360 Audit Guide – Document 2577321

• Based on the Entirety of:

• EXCiPACT Certification Standards for Pharmaceutical

Excipient Suppliers: Good Manufacturing Practices

09/10/2015

Basic Chemicals and Raw Materials

• Rx-360 Audit Guide – Document 2460023

• Based on the IPEC/PQG Good Manufacturing Practices

Audit Guide for Pharmaceutical Excipients (2007)

• Applies to all Basic Chemicals and Raw Materials Used in

Pharmaceutical Manufacture

09/10/2015

Pharmaceutical Packaging Materials

• Rx-360 Audit Guide – Document 2671203

• Based on:

• ISO 15378: “Primary packaging materials for medicinal

products – Particular requirements for the application of

ISO 9001:2008, with reference to Good Manufacturing

Practice (GMP)”

09/10/2015

Supply Chain Security

• Rx-360 Supply Chain Security Guide for Audits of

Excipients, Raw Materials/ Basic Chemicals, APIs,

Repackaging/ Relabeling and Distribution Facilities –

Document 2790748

• Based on a Number of Different Documents Including the

C-TPAT Best Practices Guide and Rx-360 Member

Company Internal Documents on Supply Chain Security

• Used in Conjunction with the Rx-360 Audit

Standards/Guidelines that Address the GMP/Quality

Assurance Topics

09/10/2015

Rx-360 Audit Process

• Pre-Audit Questionnaire Provides Information to Assist Audit Planning and Background Information for the Final Report

• Audit Plan Template Gives the Outline Plan for the Audit.

• Special Requests from Sponsor(s) Need to be Covered as Appropriate During the Audit while Maintaining Confidentiality between the Sponsors

• The Audit is a Comprehensive Evaluation of the Auditee’s Ability to Produce/Provide Materials/Services Compliant with cGMP and/or other Designated Regulatory Requirements

• The Audit Encompasses all Key Aspects of Supply Chain Security Auditing

09/10/2015

Audit Observations

• Observations are Classified as “Potentially Critical or “Other”

• A Potentially Critical Observation is:“A Deficiency that indicates a Critical System Failure that may pose an Immediate Risk to Patient Safety or Health, or may result in Adverse Impact to the Safety, Identity, Strength or Purity of a Product. The Potentially Critical Observation should be Objectively Verifiable based upon Documentation, Facts, and Observations”

• If a Potentially Critical Observation is identified during an Audit must Notify Rx-360 Member Company Sponsors within 24 hours

• Definition of “Other” – an Observation which is not Potentially Critical.

• Note: Sponsors Manage “Other” Observations According to their Individual Management System Requirements.

09/10/2015

Rx-360 Audit Process – Opening/Closing

Meeting• Opening Meeting:

• An opening meeting setting the audit process is outlined

• Closing Meeting:

• Review of any observations (including potentially critical

observations) arising during the audit

• Observations presented on a specific form

• Observations listed in order of their significance

• The full audit report is not issued at the time of the audit. The

audit report is reviewed internally within BSI and then goes

through a review process with RX-360 prior to final issue

09/10/2015

Rx-360 Audit Process – Reporting &

CAPA Management

• Specific RX-360 Report Templates are used

• BSI Report Review Process Ensures consistency, compliance and accuracy of reports and drives continual improvement (e.g. future training considerations)

• Report Review Process with Rx-360 and Sponsors Prior to Final Issue

• BSI Agrees CAPA Plan with the Supplier

• BSI Submits the plan to the Audit Sponsors and Rx-360

09/10/2015

The Elephant in the Room

Can We Implement the Rx-360 Audit Program?

• Through VOC, we have built a program that works

• Initial points of perceived resistance:

• Quality issues

• Staffing issues

• Regulatory reception

• Budget

VOC: What Level of Quality Can We Expect?

• The report format has been created to capture the

complete compliance picture

• Observations have been vetted with Supplier

• CAPA responses are included

• Sponsors review for clarification

The Rx-360 Audit Report & CAPAA detailed response

VOC: We Have an Internal Audit Program

• The Rx-360 Audit Program can supplement your audit

program

• Multiple sponsors can increase opportunity of audit

• BSI has global presence of FTE staff

• Internal staff are freed up to address internal supplier

projects/issues

VOC: Will regulators accept audits conducted

using third party auditors?

“FDA is very much in favor of industry’s

cooperative efforts, such as Rx-360…”

Rick Friedman

…This should normally provide sufficient assurance that

the results of an audit carried by the third party are

credible thus waiving the need for an audit conducted

by the manufacturing authorization holder itself….

More from Regulators

API audits by 3rd Party Auditors are regarded as suitable by MHRA on the

following basis:

• The scope of the audit must be clearly defined and must include

appropriate/defined elements of the supply chain.

• Auditors must be appropriately qualified.

• A 3rd party auditor may provide audit reports to multiple Manufacturing

Authorisation holders. Manufacturing Authorisation holders may make use

of such a report as far as the scope is fully pertinent to the APIs in

question.

Budget

• Co-sponsors pay reduced audit fees

• Internal travel costs are reduced

• Licensing can reduce future audit costs

Built for Success

• The program was designed to be easily implemented

• The program is scalable

• The database is user friendly, and allows visibility

• Multiple staff can have database access

A Success Story

• One of the world’s top biotech manufacturers has turned

over all audits to Rx-360

• Internal study showed significant savings over using

100% internal auditors

• Internal staff allowed to focus more on supplier quality

issues and relationship building

• Yearly audit budget has been reduced

• Reports and requests are managed to manufacturer’s

satisfaction

Business Case

• The Rx-360 Audit Program:

• Reduces audit costs

• Provides control and visibility

• Is scalable to individual needs

• Is accepted by regulators world wide

• Helps to secure difficult supplier audits

• Is managed by a world leader in compliance auditing

• Reduces supplier’s audit time, providing more time for customer

care

• Helps industry meet changing regulatory requirements

Three steps to developing a competitive advantage

BSI Commitment to RX 360

• Good momentum to date, currently managing the delivery of over 150 audits

• Collaborative working relationship between BSI and the Audit Operations Group (AOG)

• BSI is committed to raising the awareness and supporting the RX 360 program on

multiple levels

• Supported Paris and Cologne meetings

• Webinar series

• Roadshows

• Promotional materials

09/10/2015

Contact Information

For further information on Rx-360 and the audit programs, please

contact Kristin Colley Krisko of the Rx-360 Secretariat using the

information below.

Kristin Colley Krisko

Rx-360 Secretariat

www.rx-360.org

1500 K Street, N.W., Washington, DC 20005-1209

phone: +1 (202) 230-5921 e-mail: kristin.colleykrisko@dbr.com

*Secretariat, Drinker Biddle & Reath LLP