Pharmaceutical Quality Due Diligence: What the Data Room Won’t Show
The licence is current. The GMP certificate is on the public register. The last inspection report is in the data room, along with a quality manual and four hundred procedures.
None of that tells a buyer whether the quality system works.
Pharmaceutical quality due diligence exists to answer that narrower, harder question. It tests whether the business being acquired, funded or partnered with can keep making and releasing product without the new owner inheriting a remediation programme, a supply interruption or a difficult conversation with a regulator. A data room is built to show that documents exist. It is rarely built to show how they are used.
What pharmaceutical quality due diligence is for
Commercial, financial and legal diligence each have a settled scope. Quality diligence is often folded into one of them, usually as a line asking whether licences are in place and inspections were passed. That treats compliance as a yes or no fact. In practice it is a condition that can be strong, fragile or already deteriorating, and the difference rarely shows on a certificate.
The scope is also different from CMC and regulatory due diligence, which examines the product: the dossier, the process and the data behind the marketing authorisation. We covered that in an earlier article. Quality and technical due diligence looks at the organisation. It asks how the site or licence holder controls its operations day to day, and whether that control would survive a change of ownership, the loss of key people or an increase in volume.
Where a transaction involves manufacturing, a quality system or operational risk, both reviews are needed. They answer different questions and find different problems.
Why the documents look better than the system
A quality management system, or QMS, is the set of processes a company uses to control quality: deviations, change control, complaints, supplier approval, training, batch release and the rest. Every licensed business has one on paper. The variable is how much of it happens in practice.
Three patterns are worth looking for.
The first is a system written for the inspection and not for the operation. Procedures are comprehensive but describe steps nobody follows, because they were drafted externally or copied from a larger company. Staff work from habit and local knowledge.
The second is a system that works because of one or two people. A long-serving head of quality or Qualified Person holds the operation together, knows where the weak points are and compensates for them personally. The system is only as stable as their employment.
The third is a system under strain. Deviations are raised but closed late. Corrective actions are extended more than once. Change controls sit open. The backlog is manageable today and grows every month.
None of these appears in a document index. All of them appear quickly when someone experienced reads the records and talks to the people who create them.
THE TEST
Whether a procedure exists matters less than whether last month’s records show it being followed when something went wrong.
Reading the inspection history properly
Inspection outcomes are the most visible evidence in a transaction, and the most easily misread.
Start with what is public. In the UK, the MHRA publishes licence and certificate information for manufacturers and wholesalers through its GMDP database. Equivalent information for EU sites is held on EudraGMDP. These confirm that a licence exists and when a site was last certified. They say little about how the inspection went.
The inspection report and the company’s responses matter more. The MHRA grades deficiencies as critical, major or other. A critical deficiency is one that has produced, or significantly risks producing, a product harmful to patients. A major deficiency includes a major deviation from GMP or GDP, or a failure that may produce product that does not comply with its marketing authorisation. The MHRA’s guidance also notes that several “other” deficiencies can together amount to a major one.
The number of findings is less informative than three questions. What was the theme? Were the same areas cited at the previous inspection? And did the company do what it told the inspector it would do?
That last question carries real weight. Under MHRA guidance, an inspector who finds that agreed action plans from a previous inspection have not been resolved will contact the Inspection Action Group, which can refuse or suspend a licence, increase inspection visits or call a meeting with the licence holder. Open commitments to a regulator are a liability that moves with the business. A buyer should know exactly what was promised, by when, and what evidence shows it was done.
Timing matters too. The MHRA inspects on a risk basis and gives each site a risk rating that drives when it is next inspected. A site last inspected several years ago offers less assurance than its certificate suggests, particularly if the business has changed since.
HOW TDP SUPPORTS THIS
TDP’s Quality and Technical Due Diligence gives investors and acquirers an independent assessment of QMS maturity, inspection history and technical operations, with priority gaps set out in practical terms.
Quality and Technical Due Diligence →
Where systemic weakness shows up
A review with limited time should go where systemic problems leave traces.
Deviation and CAPA records are the best single indicator. CAPA stands for corrective and preventive action. Look for repeat events with the same cause, investigations that conclude with human error and retraining, and actions closed without any check that they worked. A site that keeps investigating the same problem has not solved it.
Change control shows whether the site understands the consequences of its own decisions. Changes implemented before approval, or assessed by one department only, suggest that regulatory and validation impact is being missed.
Batch records and release show how the site behaves under pressure. Late entries, frequent corrections and release decisions made close to shipping dates all point to a system working at its limit.
Data integrity deserves direct attention. The term covers the completeness, consistency and accuracy of GMP records. The written framework matters, but behaviour matters more. Shared logins, results recorded after the event and audit trails that are switched on but never reviewed tell their own story.
Supplier and contractor oversight shows whether the site controls what it has outsourced. Quality agreements that do not match actual practice are quickly exposed at inspection.
Management review closes the loop. EU GMP Chapter 1 places ultimate responsibility for an effective quality system with senior management. If leaders see quality metrics that are always green while the backlog grows, the reporting is not doing its job.
People, licences and what a deal can change
Pharmaceutical licences depend on named individuals. A manufacturer’s licence names its Qualified Persons. A wholesale dealer’s licence names its Responsible Person. Under MHRA guidance, changes to named persons and site addresses are standard variations to the licence, and a standard variation may require an inspection.
That creates two diligence questions. Are the named individuals carrying out the role in practice, with the time and authority to do it? And are they staying? A business whose compliance rests on a single contract Qualified Person with other clients, or on a head of quality who intends to leave at completion, carries a risk that should be priced or mitigated.
Deal structure matters as well. Where a licence has to move to a new holder, the MHRA has a change of ownership process. For a wholesale dealer’s licence this is a new application through the MHRA portal, and the guidance limits what can change at that point to the company name, the licence holder’s name and the site name. Other changes need a variation afterwards. How this applies to a particular transaction is a question for legal and regulatory advisers together, and it is better asked before heads of terms than after.
Turning findings into decisions
Quality diligence earns its fee when the findings can be used. A list of observations is not enough. Each significant gap should be translated into its practical consequence.
Some findings affect price, because remediation has a cost and a duration that can be estimated at a high level. Some affect structure: a condition precedent, a specific warranty or indemnity, or a retention against a known regulatory commitment. Some shape the first hundred days by showing who needs to be retained and what must be fixed before the next inspection. A few are serious enough to stop a deal.
Take an illustrative example. An investor reviewing a contract packaging site finds that its last inspection closed with no critical or major findings. The records show forty overdue corrective actions, three of them linked to commitments made to the inspector. Nothing in the data room index pointed to this. The finding does not end the deal. It changes the price, adds a pre-completion condition and sets the first priority for the incoming management team.
The earlier this work happens, the more options remain. Diligence carried out in the final fortnight can confirm a problem but can rarely change the terms.
HOW TDP SUPPORTS THIS
Where diligence identifies gaps that need fixing after completion, TDP’s Compliance and Remediation service designs and delivers structured programmes that address root causes and prepare the business for re-inspection.
Compliance and Remediation →
Getting access and asking the right questions
The depth of a review depends on access. A desktop review of the data room is the minimum and has clear limits. Interviews with the quality lead and the named persons add a great deal. A site visit, even for a single day, adds more than both, because it allows records to be followed from the shop floor to the file.
Sellers sometimes resist this. Reluctance to share deviation logs, CAPA trackers or regulator correspondence is itself information.
Whoever carries out the review should be independent of the target and should have run or audited quality systems themselves. The judgement required is practical: knowing which gaps are routine, which are expensive and which a regulator would treat as serious.
How TDP can help
TDP provides rapid, structured due diligence across quality systems, CMC and regulatory strategy, commercial viability and market access. Our quality and technical reviews assess whether systems are effective in practice, identify compliance exposure and set out priority gaps, with a high-level remediation scope where one is needed.
If you are assessing a manufacturer, wholesaler or other licensed business, request a call back to discuss the scope and timing of a review.