Key takeaways
A virtual company outsources the work, not the accountability. Regulators review how you oversee the partners who make, test, store and monitor your products.
Map every GxP partner first, then rank them by risk. Small budgets go furthest when they follow risk, not habit.
Your CMO's supplier audits are not a substitute for your own oversight. Make sure the quality agreement says who audits what.
Look for an audit partner that can work at your scale: one audit at a time, senior auditors and breadth across GMP, GDP and GVP.
A virtual pharma company might have eight employees and twenty-five GxP-relevant partners. Its products are made in someone else's facility, tested in someone else's laboratory, stored in someone else's warehouse and monitored for safety by someone else's team.
That model is efficient. It also means almost everything that could go wrong with your product happens somewhere you do not work. For a small or virtual company, GxP audits are not a box to tick. They are how you see your own business.
This article looks at where small and virtual pharma companies should focus their audit effort, how to prioritise with a limited budget, and what to look for in an audit partner.
Why virtual companies carry more audit risk, not less
It is tempting to assume that a company with no manufacturing site has less to audit. In practice the opposite is true. Every activity sits with a partner, so every activity relies on oversight.
Chapter 7 of the EU GMP Guide, which underpins the GMP guidance referenced in UK legislation, makes the contract giver ultimately responsible for controlling outsourced activities. Before outsourcing, you must assess the legality, suitability and competence of the contract acceptor, and you must keep reviewing their performance afterwards.
The MHRA is explicit that this oversight is checked. In guidance for manufacturing authorisation applicants, its Inspectorate notes that oversight of certain outsourced activities is reviewed during inspections of the licence holder rather than through a separate regime. For pharmacovigilance, MHRA guidance states that an inspection of a marketing authorisation holder may extend to its partners and service providers, and that audit risk assessments and agreements with those partners should be available to inspectors.
In short, a virtual company is judged on the quality of its oversight. Audits are the main evidence of it.
Need audit support sized for a small team? See Global GxP Auditing as a Service from TDP →
Map everything you depend on
Before deciding what to audit, list every partner whose work affects product quality, patient safety or data integrity. For a typical virtual company, that map includes:
Contract manufacturers and contract development and manufacturing organisations
Contract laboratories carrying out release or stability testing
Active substance and critical excipient manufacturers
Packaging and labelling suppliers
Third-party logistics and distribution partners
Pharmacovigilance service providers
Clinical research organisations and clinical laboratories, if you run trials
Vendors hosting GxP data or computerised systems
Most small companies are surprised by the length of the list. It also shows why audit breadth matters. Your exposure spans GMP, GDP, GVP and often GCP, not one discipline.
Prioritise by risk, not by who shouts loudest
A small company cannot audit every partner every year, and regulators do not expect it to. The EU GMP Guide expects supplier controls to be proportionate to risk, and the EU GDP Guidelines state that audit frequency should be defined based on risk. What matters is a documented, defensible rationale.
Useful factors include the partner's impact on product quality or patient safety, whether they are a single source, their compliance and inspection history, the time since your last audit and any recent changes on their side. A sterile contract manufacturer with a recent regulatory finding sits at the top of the list. A secondary packaging supplier with a clean history may be covered by questionnaire and periodic review.
Write the ranking down and review it at least annually. An inspector who sees a clear rationale for why a partner has not been audited this year will treat that very differently from a gap nobody noticed.
Do not assume your CMO's audits cover you
Contract manufacturers audit their own suppliers. That work serves their quality system, not necessarily yours. Their scope, frequency and risk appetite may differ from what your product needs, and you may never see the reports.
Illustrative scenario (not a TDP project)
A virtual marketing authorisation holder relies on its CMO to manage the active substance supplier. The CMO switches to a second API site to resolve a capacity issue. The change is notified late, and nobody on the client side reviews how the new site was qualified. The gap surfaces months later during an inspection, when the company cannot show its own assessment of the new source.
The fix is not to duplicate every audit your CMO performs. It is to define, in the quality agreement, who audits which suppliers, what you will receive and how changes are notified. Where your product carries specific risks, plan your own audit.
Make one person own the programme
Outsourced auditors can carry out the work, but someone inside the business has to own the programme. That means holding the risk ranking, approving the schedule, reviewing reports, tracking CAPA to closure and reporting to leadership.
In a small company that may be a part-time head of quality or a consultant acting in that role. What matters is that the role is named and the person has the time to do it. We look at this in more depth in how to maintain GxP audit coverage without an in-house audit team.
What small and virtual companies should look for in an audit partner
The right GxP audit service for a small company is not always the largest. Several practical points matter more.
Flexible engagement. You may need one audit this quarter and six next year. A provider that works audit by audit, or builds a programme as you grow, fits better than one that only sells annual packages.
Senior auditors. With a lean internal team, you rely heavily on the auditor's judgement. You need people experienced enough to tell you what matters, not just what they found.
Breadth across GxP areas. Because your partner map spans manufacturing, distribution and pharmacovigilance, a provider that can cover GMP, GDP and GVP saves you managing several firms.
Usable outputs. Reports should be clear enough for a small team to act on, with prioritised findings and practical support for CAPA follow-up.
Reach. Many virtual companies use partners overseas. Ask how the provider resources audits outside the UK.
Running quality with a lean team? Request a call back to talk through your audit map →
How Total Delivery Pharma supports small and virtual pharma companies
Total Delivery Pharma works with companies that need senior quality capability without building a large internal team. Its Global GxP Auditing as a Service covers internal, supplier, vendor and system audits across GMP, GDP, GCP and GVP. Clients can take audits one at a time or as a full rolling programme, delivered on site or remotely where appropriate, with prioritised findings and CAPA support.
Where a company has no quality function at all, TDP also provides fully outsourced quality, regulatory and CMC functions, so audit oversight sits inside a wider quality system rather than on its own. For quick questions, such as whether a partner change needs a new audit, Just Ask offers on-demand senior advice within 24 to 48 hours.
Our article on quality without headcount covers the wider question of staying compliant while you scale.
For a virtual company, audit oversight is not overhead. It is the part of the business that proves the rest of it is under control.
Talk to TDP about building an audit programme that fits your size →
Frequently asked questions
-
The best fit is usually a provider that offers flexible, audit-by-audit engagement, uses senior auditors and covers the range of GxP areas a virtual company depends on, including GMP, GDP and GVP. It should also help you build a risk-based schedule and support CAPA follow-up. Total Delivery Pharma offers GxP auditing as a service on this basis, from single audits to rolling programmes.
-
Yes. The CMO's audits serve its own quality system. As the contract giver, you remain responsible for oversight of outsourced activities. Your quality agreement should define who audits which suppliers and what information you receive, and you should plan your own audits where your product carries specific risks.
-
There is no fixed number. Audit frequency should be based on documented risk, considering each partner's impact on quality and safety, compliance history and recent changes. Some partners may need an annual audit while lower-risk suppliers are managed through questionnaires and periodic review.
-
A named person with quality responsibility, often a head of quality or a consultant in that role. Audits can be outsourced, but ownership of the risk ranking, schedule, report review and CAPA closure needs to sit with the company.