A New Paradigm to Address the High Cost of Vendor Qualification 

When FDA inspected a Heparin supplier, Shanghai No. 1 Biochemical & Pharmaceutical Co. Ltd., they thought they were seeing the real plant.  It turned out that it was only a show facility.  The real plant was a shadow plant located somewhere else.  The US-FDA Warning Letter later stated, “The inspection revealed that the facility was not manufacturing, and did not appear to have ever manufactured, Heparin Sodium USP (or heparin sodium) for the U.S. market."

This case is similar to Baxter Pharmaceutical's experience with their Heparin supplier in 2008.  The result of that deception was that hundreds of patients suffered life-threatening reactions like severe hypotension, low blood pressure and over 80 people died.

As of today there are more than 150 wrongful death cases filed against Baxter.  The cost of defending itself in those suits in legal fees and employee time will be high to say the least.  Even if Baxter were to win those cases, they would lose.  The effort of an integrated supplier compliance program now seems small in hindsight. 

Could this happen to you? How do you protect the quality of your product?  What are FDA's expectations for supplier qualification?  The Heparin experience shows that even an extreme onsite inspection won't necessarily reveal severe quality problems.  How does one confirm that the supplier plant that you are inspecting is actually the one that supplies your company?

Some things to watch for, according to FDA, include discrepancies in date (e.g., compare when the materials arrived versus when production and testing were done) and if the facility happens to be “renovating” or “not manufacturing the day” you are there for your audit. You have to see the product being manufactured in action. You can also ask to see batch records and other documentation as proof the factory is indeed operational. 

Does this solve the Show and Shadow supplier danger?  No.  Clearly it's not a full solution.  And the fact is there is no sure solution.  It's very difficult to detect someone who is determined to commit fraud.  You as a buyer need to be sure that you have located the actual production facility.  Fortunately these instances are rare, and most suppliers at least try to produce a quality product. 

But this incident shows how critical a supplier's quality program can be.  The message is that even intensive on-site audits cannot find major vendor problems.  'Show and Shadow' is just an extreme example.

Although FDA's suggestions are certainly valuable, they and all the other responses to the increasing concerns over vendor quality all seem to say one thing:  more intensive audits.  More intensive audits, of course, mean higher costs.  And as we have seen even an intensive audit isn't guaranteed to find all the problems at a supplier.  The problem is that audits are only a snapshot; a surface skim at a point in time.  

Any pharmaceutical or medical device plant is a very complex place.  Unless you plan to take up residence at the vendor you have no chance to understand the true nature of these operations.  And what company in today's cost-cutting climate has the resources to do that?  Keep in mind that an audit costs more than what you pay for your auditors to investigate the vendor.  The vendor has to spend their time escorting the auditors around, digging out records, and following up on action items.  Guess who has to cover that cost.  The assumption today is that a BETTER audit means a LONGER audit.  There has to be another way.

What's needed is a new paradigm for vendor qualification; a tool that can drill deeply into the vendor's operation at low cost; something that can provide a more lasting measure of the vendor's performance than simply an audit.

To get to the solution we have to answer this question, why don't vendors always comply with the regulations.  My answer, based on years of auditing and operations management, is that by far the most common reason is lack of knowledge of the regulations through-out the organization.  I'm not talking here about a general understanding of requirements.  I mean a deep Knowledge of the details of how to comply with the regulations – not just that the packaging room needs to be inspected before packaging operations begin; but that previous materials have been removed, packaging and labeling materials inspected, extraneous materials removed, documentation, etc.

Sure, there is generally someone in most vendor organizations who knows the regulations.  But in poorly performing companies the attitude is often that regulatory compliance is up to the Quality Department.

My proposition is that once everyone in an organization knows the regulations as they apply to their jobs, DOING the job right is straightforward.  The biggest hurdle to overcome is disseminating detailed Knowledge of what needs to be done to all the employees.  

How can one use this relationship to assist with the problem of supplier qualification?  What if it were possible to objectively measure what all the employees of a supplier know about GMPs?  That deep Knowledge plus a broad snapshot of the supplier based on an audit will give you a strong measurement of the supplier's performance.

The next question is how does one measure that Knowledge.  Knowledge is not so easily measured in an audit.  You can check training records.  Usually you will see who sat through what training class, or who was checked off as proficient in on-the-job training.  There is rarely any indication of what people actually KNOW.

So how could we effectively measure the Knowledge of all of a supplier's employees?  Well, technology gives us an edge today that didn't exist not too long ago.  Computer Based Training provides a reliable, and relatively cheap way to assure that all employees have a minimum skill level.  Online GMP courses train and test any employee who has access to the internet.  Learning Management Systems track who knows what, and make the results easily visible to management.

If you as a customer insist that suppliers test their employees and provide you with verification that all their employees have passed their GMP courses, then you can have a high degree of confidence that the supplier has the Knowledge to make compliant products.  You as a customer can have independent access to the training verification reports.  When your auditors cross-check the training reports against the names on batch records, the vendor suddenly becomes completely transparent.

There's another advantage when everyone in an organization is passing the same tests, peer pressure.  It's not easy for one person to bypass a GMP requirement when everyone around knows that it's the wrong thing to do.

Requiring your vendor to give their employees online, verified GMP training insures that they have a deep Knowledge of the regulations.  This doesn't really cost any incremental money because this is something the vendor should be doing anyway.  Combining the visibility of an online Computer Based Training system with an audit can make your supplier's quality program truly transparent.

About the author:

Norm Howe is a Senior Partner at Validation & Compliance Institute, consultants for the food, pharmaceutical, and medical device industries. He got his BS at UC, Berkeley, and a PhD in chemistry at UCLA. He is an adjunct professor of Regulatory Science at the University of Michigan, Ann Arbor, and has held many management positions in FDA regulated industries.  http://www.vcillc.com