That accountability is where things go wrong. A superficial audit, or one that skips the CDMO's supply chain entirely, can surface as a critical deficiency finding, a delayed batch certification, or an import restriction. This isn't limited to inexperienced sponsors — established companies with mature quality systems still stumble when audit oversight turns into a box-ticking exercise instead of genuine risk assessment.
This article walks through a practical checklist: what to prepare before you audit, which audit method fits your risk profile, and how to read the findings before you sign a contract or certify a batch.
Key Takeaways
- Legal obligation: Directive 2001/83/EC, Article 46(f) and EU GMP Chapter 5.29 require audits of active substance manufacturers and critical suppliers.
- A pre-audit checklist must cover documentation, quality systems, facility validation, and supply chain traceability.
- On-site, remote, and third-party audits suit different risk levels and CDMO track records.
- Findings are classified as critical, major, or minor, determining remediation before batch certification.
- DRK Research Solutions' GxP compliance consulting can shorten vendor qualification timelines.
What Sponsors Need to Check Before Auditing a European CDMO
Before you schedule an audit, define its scope and gather baseline documentation. EU GMP Chapter 5.29 and Chapter 7 both require sponsors to audit contractors and outsourced activities, but neither tells you where to start. The starting point is always paperwork — what the CDMO already has, and what it's willing to show you.
Documentation and Compliance Records to Request
Ask for these before you set foot on site (or open a video call):
- Current Manufacturing/Importation Authorisation and EU GMP certificate, cross-checked against the EudraGMDP database rather than taken at face value
- Site Master File and Quality Manual
- Recent regulatory inspection history, including any non-compliance statements
- Batch records, deviation/CAPA logs, and change control history for products similar to your own
That last point matters more than it sounds. A CDMO's overall compliance record means little if the process history for your specific product type shows repeated deviations.
Team and Access Requirements
Once you know what documentation exists, decide who reviews it. Send a cross-functional team, not a solo auditor. A typical composition includes:
- The Qualified Person (QP), who ultimately signs off on batch certification
- A QA lead focused on documentation and systems
- A manufacturing or technical SME who can spot process-level red flags a QA generalist might miss
Before the visit, confirm the CDMO will provide facility access, make relevant staff available for interviews, and translate documentation where needed. A refusal at this stage tells you something important on its own.
Scope, Timing, and Risk-Based Planning
With the team assembled, turn to how broad the audit should be and when it should happen. Use a risk-based approach to set scope: product criticality, the CDMO's inspection history, and process complexity all factor in, consistent with the quality risk management principles in EU GMP Annex 16. Schedule the initial audit before contract signing, not after, and set a re-audit cadence based on risk rather than a fixed calendar date.
Audit Methods: How Sponsors Can Evaluate a CDMO's GMP Compliance
EU GMP Chapter 5.29 requires audits of "appropriate duration and scope," which leaves the method up to you. Match it to risk level, budget, and how much access the CDMO will realistically grant.
On-Site GMP Audit
A full physical inspection: opening meeting, facility walkthrough, document review, staff interviews, and a closing meeting to present findings.
Pros: Highest assurance level. You see the equipment, the environment, and the staff in real conditions. Cons: Resource- and time-intensive. Best reserved for new CDMO relationships or higher-risk products, where firsthand verification isn't optional.
Remote or Virtual Audit
A document- and video-based review built around a pre-audit document package, a live video walkthrough, and virtual staff interviews.
Pros: Faster, cheaper, useful when travel is restricted. Cons: Limits firsthand verification of physical conditions. Regulatory guidance from PIC/S notes that remote assessments remain a valid tool but aren't the default choice for initial qualification — they're better suited to periodic re-audits of a relationship you already trust.
Third-Party or Shared Audit
An independent qualified auditor, or a shared-audit platform, assesses the CDMO against a scope you define. Multiple sponsors using the same site then share the report.
Pros: Cost-efficient when several sponsors rely on one CDMO. Cons: Sponsors still retain QP responsibility and must interpret the shared report against their own product risk. A generic report doesn't automatically clear your specific process.
DRK Research Solutions' regulatory compliance consultants help sponsors read a third-party report against their own risk profile, rather than accepting it at face value.
How to Interpret EU GMP Audit Findings
Misjudging severity cuts both ways: you either burn resources chasing trivial issues, or you overlook a genuine safety risk. EU GMP Annex 16 requires the QP to confirm the outcome of critical-impact audits before certifying affected batches, turning severity classification into a regulatory gate rather than a documentation formality.
| Severity | Typical Examples | Required Action |
|---|---|---|
| Critical | Data integrity failures, contamination risk, absent quality systems | Halt the partnership or batch certification until CAPA is verified through a follow-up audit |
| Major | Significant SOP deviations, inadequate process validation | Require a documented CAPA with a firm timeline before finalising the contract or releasing further batches |
| Minor | Small documentation gaps, isolated SOP inconsistencies | Log via CAPA tracking; verify closure at the next scheduled audit without halting operations |
A single deficiency rarely tells the whole story. Several related "minor" findings can combine into a systemic issue that behaves like a major one. Context and pattern matter as much as the individual item.
Common Mistakes and Best Practices When Auditing European CDMOs
Common Mistakes to Avoid
- Trusting the CDMO's self-reported certifications instead of independently verifying current GMP status through EudraGMDP
- Setting audit scope that doesn't match actual product risk, such as skipping a deep dive into aseptic processes for a sterile product, for instance
- Leaving the QP or manufacturing SME off the audit team, which is how technical red flags slip through unnoticed
Best Practices for Ongoing Compliance
- Write audit findings and CAPA tracking directly into the quality/technical agreement so remediation timelines are contractually binding, not just goodwill
- Schedule re-audits on a risk-based cadence, not only at initial qualification, to catch compliance drift before it becomes a finding
- Partner with a CRO already versed in EU GMP audits, such as DRK Research Solutions, whose regulatory compliance team supports sponsors through vendor qualification and audit prep
Conclusion
Auditing a European CDMO requires more than a one-time checkbox before contract signing. It demands ongoing risk management spanning documentation review, choosing the right method, and reading findings correctly rather than glossing over them.
Sponsors who invest in structured, risk-based audits protect patient safety, regulatory standing, and supply continuity simultaneously. Neglect any one, and the other two eventually suffer too.
Experienced partners with established EU operations and combined CRO/CDMO expertise, like DRK Research Solutions, can support sponsors throughout vendor qualification and the audits that follow. If you're weighing a European CDMO relationship, reach out to DRK Research Solutions or read the team's GMP audit preparation guide for more detail on getting audit-ready.
Frequently Asked Questions
What is an EU GMP audit?
An EU GMP audit is a structured review of a manufacturer's quality systems, facilities, and documentation against EU GMP Guidelines. It confirms whether the site consistently meets compliance requirements.
What is the difference between GMP and EU GMP?
GMP is a general global quality framework for manufacturing medicines. EU GMP refers specifically to the detailed guidelines and annexes (EudraLex Volume 4) enforced by EU/EEA regulatory authorities.
What are the requirements for an EU GMP audit?
Audits must have appropriate scope and duration, cover quality systems and manufacturing/QC procedures, and result in a documented report per EU GMP Annex 16. The QP must be aware of critical findings before certifying affected batches.
What is the EU GMP limit?
There's no single, blanket limit. The term usually refers to specific technical thresholds, such as contamination or environmental monitoring limits defined within particular annexes like Annex 1 for sterile products.
How often should sponsors audit their European CDMO?
Frequency should be risk-based rather than fixed, though many sponsors work on roughly a one-to-three-year cycle. Higher-risk products or CDMOs with prior findings warrant more frequent checks.
What happens if a European CDMO fails a GMP audit?
Findings trigger a CAPA process. Depending on severity, the sponsor's QP may withhold batch certification or pause the partnership entirely until the issues are resolved and verified.
