Key takeaways
Outsourcing an audit does not outsource responsibility. You still need to show how you assessed the competence of whoever audits on your behalf.
Auditor experience and report quality matter more than day rate. A report your QP or RP cannot rely on is a cost, not a saving.
Ask for a redacted sample report and the profiles of the auditors who will actually attend.
Choose a provider that supports the programme around the audit, including risk-based scheduling, trending and CAPA follow-up.
Most pharmaceutical companies choose a GxP audit provider in much the same way. A supplier needs auditing before the end of the quarter. A few names come from colleagues or a quick search. The decision comes down to availability and day rate.
The problem shows up later. An inspector asks to see the audit report behind a supplier approval, and it turns out to be a generic checklist with no reference to the requirements it was assessing against. The Qualified Person is uneasy relying on it. The supplier has to be audited again.
Choosing GxP audit services in the UK is not a procurement exercise. The provider you appoint produces evidence your quality system depends on, and that evidence will be read by people with the authority to question it. This guide sets out what to look for, what to ask before you sign and where the common mistakes sit.
Why the choice of GxP audit provider matters
The GMP and GDP guidance referenced in UK medicines legislation is based on the EU guides as they stood at the end of the Brexit transition period. Chapter 7 of the EU GMP Guide makes the company that outsources an activity, the contract giver, ultimately responsible for controlling it. Before outsourcing, the contract giver is responsible for assessing the legality, suitability and competence of the contract acceptor. The EU GDP Guidelines take the same position for distribution activities.
For active substances, the expectation is sharper still. Chapter 5 of the EU GMP Guide states that audits should be carried out at manufacturers and distributors of active substances to confirm they comply with GMP and GDP requirements.
Auditing is an outsourced activity like any other. If a third party audits a supplier on your behalf, you remain accountable for the conclusion. An inspector is entitled to ask how you satisfied yourself that the auditor was competent and whether the report gave you enough to make a sound approval decision.
That changes the question. You are not buying a day of someone's time. You are buying evidence that has to stand up to scrutiny.
Define what you need before you compare providers
Many selection problems are really scoping problems. Before approaching anyone, be clear on four things.
The type of audit. Supplier qualification, routine supplier surveillance, internal audits against your own quality system, for-cause audits after a quality event and mock inspections all call on different skills. A provider that is strong in one is not automatically strong in all of them.
The GxP area. GMP, GDP, GCP and GVP audits draw on different regulations and different experience. An excellent auditor of sterile manufacturing may be the wrong choice for a pharmacovigilance service provider or a third-party logistics partner.
The geography. If critical suppliers sit outside the UK, ask how the provider resources audits there and whether the auditor will attend in person.
The shape of the work. A single audit to unblock a supplier approval is a different engagement from a rolling programme covering dozens of suppliers across several sites. Mid-sized companies with a growing supplier base often start with the first and discover they need the second. Our article on supplier qualification explains why approval is only the start of that relationship.
Auditor competence: the question most buyers skip
Audit firms sell capability, but audits are carried out by individuals. The most useful question you can ask is simple. Who will actually attend, and what have they audited before?
ISO 19011, the international guideline for auditing management systems, separates general audit competence from discipline and sector-specific knowledge. It is guidance rather than a legal requirement, but the distinction is useful. An auditor can be well trained in audit technique and still lack the sector experience to recognise weak cleaning validation, an incomplete temperature mapping study or poorly controlled data in practice.
When comparing GxP audit services, ask for:
Profiles of the named auditors, not just the firm's most senior people
Evidence of audits completed in the relevant GxP area and type of operation
Audit qualifications and training, such as a recognised lead auditor certification
Industry or regulatory background that gives the auditor a realistic view of inspector expectations
Certification is a useful signal, but it is not proof of sector competence. Experience auditing the kind of operation you need audited counts for more.
Judge the report before the price
The audit report is the deliverable. It is what your QP, Responsible Person or quality lead will rely on, and what an inspector may ask to read.
Ask every shortlisted provider for a redacted sample report. A good report makes it easy to see what was in scope, what was examined and what was not. Each finding should reference the requirement it relates to, carry a risk grading and be clear enough that the supplier cannot reasonably dispute what is being asked of them. The conclusion should support a decision: approve, approve with conditions or do not approve.
Illustrative scenario (not a TDP project)
A mid-sized UK manufacturer appoints the cheapest available auditor to qualify a new excipient supplier. The report lists eleven observations with no grading and no regulatory references. The Head of QA cannot tell which observations are critical, and the supplier disputes several of them. The company commissions a second audit three months later. The saving on the first quote has gone, and the approval is a quarter late.
Look for a programme, not just an audit
Individual audits are only useful if they sit inside a programme that makes sense. The EU GDP Guidelines state that audit frequency should be defined based on risk, and inspectors will generally expect to see a documented rationale for why each supplier is audited when it is.
A capable provider should help you set and defend that schedule, trend findings across suppliers and report on the health of your supply base to senior management. For companies managing several sites or a long supplier list, this is often where the real value sits. It turns audits from isolated events into oversight you can demonstrate.
If you already run your own programme and only need extra capacity, say so. A good provider will work to your procedures, templates and risk classification rather than imposing their own. We cover the wider set-up in how to maintain GxP audit coverage without an in-house audit team.
Check independence, practicalities and follow-through
A few practical points often decide whether an engagement works.
Independence. Ask whether the auditor has consulted for, or worked at, the supplier being audited. A conflict does not need to be improper to undermine confidence in the report.
On-site or remote. Remote audits can be appropriate in some circumstances, such as lower-risk suppliers or as an interim step. The choice should be justified by your risk assessment rather than driven by cost. Ask how the provider makes that call.
Mobilisation. If a supplier issue is holding up a batch, how quickly can the provider get a suitable auditor in front of it?
What happens after the report. Findings only matter once they are closed. Ask whether the provider will review CAPA responses, assess closure evidence and confirm when actions are complete, or whether that sits with you. Our article on CAPA effectiveness explains why closure on paper is not the same as closure in practice.
Shortlisting audit providers? Request a call back and talk it through with TDP →
Questions to ask a GxP audit provider before you sign
Who will carry out the audit, and what relevant audits have they completed?
Can we see a redacted sample report?
How are findings graded, and what requirements do you reference?
How do you decide between an on-site and a remote audit?
Do you or the auditor have any relationship with the supplier?
What support do you provide for CAPA review and closure?
Can you work to our procedures and templates?
How quickly can you mobilise, including overseas?
How Total Delivery Pharma approaches GxP audit services
Total Delivery Pharma provides Global GxP Auditing as a Service for companies that need senior audit capability without building a permanent in-house team. Audits cover internal, supplier, vendor and system audits, including excipient and printed materials suppliers, across GMP, GDP, GCP and GVP.
Clients can commission a single audit or a full rolling programme. Audits are delivered on site or remotely where appropriate, and each report sets out prioritised findings. TDP also supports CAPA definition and closure evidence, trending and oversight reporting, and readiness checks and audit hosting ahead of inspections.
TDP has supported clients in more than 15 countries, which makes it a practical option for UK-based companies whose suppliers and operations sit overseas.
Choosing an audit provider is ultimately a quality decision. If the report behind a supplier approval would not survive an inspector's questions, the saving on the day rate was never real.
Frequently asked questions
-
Start by defining the audit type, GxP area, geography and whether you need a single audit or a programme. Then compare providers on the sector experience of the named auditors, the quality of a sample report, their approach to risk-based scheduling, their independence from the supplier and the support they offer for CAPA follow-up. Price matters, but only between providers that meet those standards.
-
Look for providers that can evidence auditor competence in your specific GxP area, produce reports your QP or RP can rely on and support the programme around each audit. Options range from large global firms to specialist consultancies. Total Delivery Pharma offers GMP, GDP, GCP and GVP audits as single engagements or rolling programmes, with clients supported in more than 15 countries.
-
Yes. Under Chapter 7 of the EU GMP Guide, the contract giver remains responsible for outsourced activities and for assessing the competence of whoever carries them out. You need to be able to show why you trusted the auditor and the report.
-
There is no single interval that suits every supplier. The EU GDP Guidelines state that audit frequency should be defined based on risk, and the EU GMP Guide expects supplier controls to be proportionate to the risk posed by the material. Your rationale should be documented and reviewed.
-
It can be, depending on the supplier's risk profile and what needs to be verified. Remote audits suit some document-led assessments but cannot fully replace seeing a facility in operation. The decision should be justified in your risk assessment.