Your Vendor Audit Program: On-site or Remote / Virtual?

It is quite common that a sponsor company will outsource services to external vendors, whether for additional expertise, remote locations, or simply due to lack of availability of resources within their own organization. Completion of required tasks and functions are therefore outsourced to these external vendors to manage for them, often generically referred to as “Clinical Research Organizations (CROs).” Sponsor companies are obligated to confirm that the external vendor meets the requirements of any applicable regulations in addition to ensuring the vendors have the appropriate capabilities, experience, and quality systems necessary to perform the services delegated.

In 2020, at the time of the pandemic a remote audit was at times considered a “better than nothing” approach in lieu an actual audit (termed assessments in some cases). Since the pandemic I have noticed many vendors have been slow to move back and allow on-site audits. Some vendors state they have no option for an on-site audit. What do you do if your only option is to conduct a remote/virtual audit? The answer to this question, as with many things is “Well, it depends….”

A high-risk vendor would typically require an in-person audit. However, remote / virtual audits are here to stay (in some cases) and are probably most appropriate for vendors which are assessed as “low risk”. A low to medium risk vendor could be evaluated with a remote /virtual audit (or questionnaire) to confirm the proper processes, procedures and document control system(s) are in place for the vendor.

However, in cases where the vendor is of higher risk, it is very important to not just schedule the audit and wait for an e-mail notification for access the morning of the audit. Capabilities of how the Remote / Virtual audit will be conducted needs to be coordinated to ensure that the audit scope and expectations are met. Several examples include:

• The type of forum used for document sharing needs to be identified. Does it require training or installation of software? A test of access should be performed prior to the audit day(s).
• Will access be restricted to a number of hours, i.e., access turns on / off based on the local time zone of the vendor. This could be problematic depending on where the auditor is located if not determined prior to the audit.
• Will any documents be automatically available? Or will each procedure (SOP, policy, Work Instruction, etc.) need to be requested for upload? If the latter is the case, is it possible to pick out the procedures in advance to have them ready?
• What kind of facility tour will be available? Is it possible to have a live tour? Some vendors provide only a few pictures, while others have a pre-recorded tour. Depending on the type of vendor certain areas may need to be requested, i.e., a Central Lab tour versus a Phase I Unit will need different areas demonstrated during a tour.

It is possible that audit concerns will be identified even before the audit starts based on the answers to some of the above areas and questions. There is sometimes the possibility to negotiate with the vendor to have a shorter time on site after a remote audit has taken place. Ensuring that communications with vendors stay positive while assessing the ability to host a remote audit is key to helping your chances of a partial or even a complete onsite audit (if deemed necessary based on risk).

At ProPharma Group we can help you navigate this process! Our team of experienced specialists includes auditors who are proficient in conducting vendor and supplier audits. We serve as an extension of an organization’s Quality Department with respect to vendor and supplier auditing. Contact us today for help!