External (2nd Party) Audits: Their Importance

External (2nd Party) Audits

If you’re a UK wholesale distributor of medicinal products, maintaining compliance with Good Distribution Practice (GDP) is not just a regulatory obligation, it is a core part of safeguarding patient safety and product integrity.

GDP guidelines, issued by the European Commission and enforced by the Medicines and Healthcare products Regulatory Agency (MHRA), aim to ensure that the quality of medicines is protected throughout the entire supply chain. 

One essential GDP requirement outlined in Chapter 5 of the EU GDP Guidelines (2013/C 343/01) is the need for due diligence checks on your suppliers and outsourced activity providers. One method of due diligence is conducting external audits also known as second-party audits, as part of your supplier or provider qualification and monitoring processes. 

What Are External (Second-Party) Audits?

External audits (also referred to as second-party audits) are assessments performed by you or on your behalf, on suppliers or third-party service providers (such as storage and transportation companies). These audits are different from internal (first-party) audits because they extend your compliance oversight outside your organisation, helping you manage risks across your supply chain.

A well-conducted second-party audit enables you to:

1. Assess whether your suppliers and service providers operate in compliance with Good Manufacturing Practice (GMP) and/or Good Distribution Practice (GDP) standards
2. Identify potential gaps, weaknesses, or deviations that could compromise the quality and safety of the medicines you distribute
3. Evaluate the reliability, suitability, and ongoing capability of your contracted partners
4. Demonstrate proactive compliance and due diligence to regulatory bodies like the MHRA
5. For GDP compliance, as part of your supplier qualification due diligence checks, external audits should be backed by a robust written procedure covering:
6. Planning and scheduling audits
7. Audit execution and documentation
8. Reporting of findings
9. Corrective and Preventive Action (CAPA) management
10. Follow-up and closure

This process should be overseen by the Responsible Person (RP) or another suitably qualified and trained member of the quality team. If expertise is lacking internally, outsourcing to experienced GDP audit consultants such as Paradigm Shift Consulting can provide an objective and thorough approach while meeting regulatory expectations.

Why Are External Audits So Important? 

External audits are more than just a box-ticking exercise.  They are a powerful tool for risk management and regulatory preparedness.

Here’s why they matter: 

• They offer direct evidence of your supplier or provider’s GDP/GMP compliance and operational integrity.

• They help ensure that the quality and safety of medicinal products or related services are not compromised at any point in the supply chain.

• They act as a compliance shield, allowing you to identify and address contracted-party issues before they affect your licence, business continuity, or patient safety. 

• They demonstrate your active oversight responsibilities, as expected under both GDP Guidelines and Human Medicines Regulations 2012. 

• They foster open communication and alignment with your suppliers and service providers, thus promoting a culture of quality and continuous improvement. 

Many companies assume a signed Quality/Technical Agreement (QTA) alone is enough to ensure compliance. However, the QTA should be supported by tangible evidence, such as audit reports, showing that the agreed standards are being met in practice. 

When and How Often Should You Conduct Second-Party Audits?

The frequency of external audits should follow a risk-based approach, taking into consideration:

1. The criticality of the outsourced activity.
2. Any deviations, complaints, or incidents involving the provider.
3. Changes in ownership, facilities, or key personnel at the supplier.
4. Past audit outcomes and CAPA history.
5. Provisions laid out in the QTA.

Best practice recommendations include:

1. Conducting an audit before entering into a QTA.
2. Re-auditing suppliers at least once every three years.
3. Performing additional ‘For Cause’ audits if there is a history of non-compliance, increased risk, or regulatory interest.
4. Documenting a justification when extending audit frequency based on low risk.
5. Ensuring your auditors are trained in UK National legislation and are experienced in GDP auditing, NOT GMP or ISO 9001!! 

This periodic and proactive audit cycle not only satisfies GDP but also future-proofs your compliance against unexpected MHRA inspections.

How to Conduct Effective External Audits

To make your external audits meaningful and effective:

1. Plan thoroughly. Define audit objectives, scope, criteria, and timelines in advance. Refer to our upcoming Audit Tips and Hints blog for more planning strategies.
2. Use trained and competent auditors. Ensure auditors are familiar with GDP, GMP, National legislation and relevant regulatory frameworks, OR consider using qualified consultants.
3. Cover all relevant processes. Pay attention to aspects that directly or indirectly impact your own compliance, such as storage, handling, transportation, and record-keeping.
4. Document clearly. Prepare a structured audit report with findings, observations, risks, and recommendations.
5. Ensure the supplier/provider addresses non-conformances promptly and implements sustainable corrective actions.
6. Keep records. Maintain your external audit records securely for a minimum of five years, in line with GDP expectations.

Conclusion 

External audits are a valuable tool in your GDP compliance and supplier qualification programme.
They provide essential oversight, protect your business from downstream compliance risks, and help you to build confidence in your supply chain. 

Failing to uncover external supplier/service provider related deficiencies can leave you exposed to serious consequences, including MHRA inspection findings, license variation or suspension, and loss of product integrity. Even seemingly minor non-conformances, if undetected, can lead to costly deviations, complaints, and/or affect your business reputation. 

By embedding a structured, risk-based external audit programme into your quality system, you position your organisation not just for compliance, but for excellence in safeguarding public health. 

Advice and Support 

If you need guidance or assistance on how to conduct external, second-party audits, or would like one of our CQI qualified lead auditors to perform an audit on your behalf, email us at: info@paradigmshiftconsulting.co.uk. 

For further reading:

1st and 2nd Party Audit Report and Follow-up

Audit Planning: Tips and Tricks

Contracts for Outsourced Activities

Outsourced Activities – How to Manage Them

Non-Conformance and Deviation Management