GMP audits and supplier qualification

In brief

A GMP audit is the systematic on-site examination of a supplier or service provider to determine whether it complies with Good Manufacturing Practice and delivers what has been agreed and described in the marketing authorisation. The sites audited are mainly active substance manufacturers, contract manufacturers, contract laboratories, packaging sites and distributors of active substances. The result is a report that records what was examined and observed and which deficiencies exist.

Many companies commission external auditors for this, because they lack their own staff, because the supplier is located abroad or because specialist knowledge is needed, for example on sterile processes or active substance synthesis. Such a third-party audit is permitted, but responsibility for assessing the supplier remains with the contract giver.

Who needs it

Holders of a manufacturing authorisation, marketing authorisation holders and importers who source active substances or outsource activities.

Legal basis

Chapters 5 and 7 of the EU GMP Guide, Annex 16 and the EMA QP declaration.

Typical scope

Risk assessment, preparation, on-site audit, report with named deficiencies and follow-up of actions.

What matters

Independent auditors with the right expertise and a report on which your Qualified Person can rely.

When you need it

An audit of the active substance manufacturer is mandatory. Anyone who manufactures medicinal products must satisfy themselves through audits that the manufacturers and distributors of their active substances comply with Good Manufacturing Practice and Good Distribution Practice. For marketing authorisation applications, the Qualified Person (QP) confirms this in the so-called QP declaration. According to the EMA guidance, the declaration is based on an audit of the active substance manufacturer, which as a rule takes place on site.

In addition, there are audits of service providers to which you outsource GMP activities, such as contract manufacturing, analytical testing, storage or packaging. Before outsourcing, you must assess the partner’s suitability, and during the collaboration you monitor its performance. Even when you rely on test results from a starting material supplier instead of testing yourself, the sites performing these tests should be audited at risk-based intervals. Further triggers are complaints, recurring deviations and changes at the supplier.

Legal basis and rules

EU GMP Guide, Chapter 5 (5.27 to 5.29)

Supplier qualification as part of the quality system, audits of manufacturers and distributors of active substances, follow-up audits at risk-based intervals.

EU GMP Guide, Chapter 5 (5.35 and 5.36)

Reliance on the supplier’s test results only with justification and with audits of the sites performing the tests.

EU GMP Guide, Chapter 7

Assessment of service providers before outsourcing, monitoring of their performance and a right to audit in the contract.

EU GMP Guide, Annex 16

Before certification, all audits of the manufacturing and testing sites involved and of the active substance manufacturer must have been carried out and their reports must be available to the Qualified Person.

EMA QP declaration

Template for confirming the GMP compliance of active substance manufacture in the marketing authorisation application, supplemented in 2025 by questions and answers on third-party audits.

EMA questions and answers on GMP

Third-party audits under Chapter 7, handling of conflicts of interest, written assessment of the third-party report by the Qualified Person, no replacement of the audit by GMP certificates or paper-based audits.

Guidelines on excipients from 2015

Formalised risk assessment of which GMP is appropriate for an excipient.

Chapter 5 sets clear requirements for the audit itself. It should be of a duration and scope that allow a full assessment of GMP, and should also take into account the risk of cross-contamination from other materials on site. The report should fully reflect what was done and observed, and should clearly identify deficiencies. Any required corrective and preventive actions must be implemented. How often follow-up audits take place is not set by a fixed deadline, but by your own risk management. The manufacturer may carry out the audits itself or have them carried out by a body acting under contract.

For excipients, no audit is prescribed. They are controlled on the basis of a formalised risk assessment that shows which level of GMP is appropriate for the material concerned. According to the 2015 guidelines, the data for comparing this with the actual situation at the excipient manufacturer may come from an audit or from information supplied by the manufacturer. As control strategies, the guidelines mention, for example, audit, requesting documents and testing. An audit is therefore one of several possible outcomes of the assessment.

How the collaboration works

Risk assessment and audit plan

You define which suppliers and service providers are audited and when. The criticality of the material, the supply chain and previous experience determine the order and the intervals.

Assignment and preparation

The auditor receives specifications, marketing authorisation details and history. The date, agenda, confidentiality and documents requested in advance are agreed with the supplier.

On-site audit

The auditor inspects the areas, reviews documents and records and talks to the responsible persons. The audit ends with a closing meeting and an initial classification of the deficiencies.

Report

The report describes scope, conduct and findings with their classification. It is structured so that your Qualified Person can use it for certification and for the QP declaration.

Actions and follow-up

The supplier submits an action plan. You assess it, follow up its implementation and decide on the supplier’s status.

Important

A third-party audit relieves you of carrying out the audit, not of assessing it. Review the report yourself, decide yourself on approving the supplier, and record why you trust the auditor.

What to look for when choosing an auditor

Questions to ask the provider

What qualifications and experience does the auditor have in the relevant field, such as active substance synthesis, sterile manufacturing or analytical testing?

Is the auditor independent of the audited site, and is this declared in writing?

Does the auditor speak the language at the site, or is an interpreter needed?

How is the report structured, and is it suitable as a basis for Part C of the QP declaration?

Does the provider offer shared audits, where several customers use one report? The EMA accepts this if the contract givers jointly commissioned the auditor before the audit, and sees a possible conflict of interest in selling reports after the fact.

How are deficiencies classified, and is follow-up of the actions offered?

How soon after the audit is the report available?

Frequently asked questions

May I leave the active substance audit to a third party? +

Yes. Chapter 5 expressly allows GMP compliance at the active substance manufacturer to be verified by a body acting under contract. According to the EMA questions and answers on GMP, last supplemented in April 2025, Chapter 7 applies to the assignment: you must have assessed the auditor, conflicts of interest must be declared and assessed, and the Qualified Person records their final assessment of the third-party report in writing. The EMA also explained in 2025 how such a third-party audit is to be stated in the QP declaration.

Is a GMP certificate from the authority enough instead of an audit? +

Not for active substances. Chapter 5 requires audits of the manufacturer and distributor, and the EMA guidance on the QP declaration expressly states that the audit cannot be replaced by GMP certificates from an authority. Certificates and inspection reports, for example from the EudraGMDP database, may be attached as supplementary information and help set the priorities of your own audit programme on a risk basis. According to the EMA questions and answers, a purely paper-based audit with questionnaire and documents does not replace the on-site audit either, but it can bridge the gap temporarily.

How often must follow-up audits take place? +

The EU GMP Guide sets no fixed deadline. The intervals are defined through your quality risk management and should ensure that standards are maintained and that the approved supply chain may continue to be used.

When is the QP declaration needed? +

The EMA requires it for marketing authorisations to confirm that the active substance was manufactured in accordance with GMP. For details on when it is needed and what it must contain, there is a template with guidance.

Sources

Every statement in this text was checked against these primary sources (as of 10.11.2026). Laws, guidelines and authority websites, no advertising.

Company	Location	EvidenceQuote from the company’s website (German)	Credentials
A&O Pharma GmbH A&O Pharma GmbH, based in Efringen-Kirchen with sites in Itzehoe and Lörrach, provides service support to pharmaceutical companies, including batch certification by Qualified Persons, regulatory affairs, GMP consulting and GMP-certified analytics.	Efringen-Kirchen	Evidenced „Audits bei Dienstleistern und Lieferanten müssen von qualifizierten internen oder externen Auditoren durchgeführt werden.“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
Chromicent GmbH Chromicent GmbH, based in Berlin-Adlershof, develops and validates chromatographic analytical methods under Quality by Design (QbD) principles and analyses impurities for clients. The company also carries out GMP audits at contract laboratories.	Adlershof Berlin	Evidenced „Durchführung von GMP-Audits gemäß Kundenanforderung, z.B. bei externen Auftragslaboren oder Lohnherstellern“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
Diapharm GmbH & Co. KG Diapharm GmbH & Co. KG, based in Münster, advises pharmaceutical companies on regulatory affairs, GMP quality management and pharmacovigilance, and also assumes responsibility functions such as acting as an external Qualified Person.	Muenster Nordrhein-Westfalen	Evidenced „Diapharm führt unabhängige und qualitativ hochwertige GMP-Audits für Hersteller von Wirkstoffen, Ausgangsstoffen und Packmitteln durch“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
Flavine Europe GmbH Flavine Europe GmbH, based in München, brokers active pharmaceutical ingredients and finished medicinal products and offers laboratory testing in Marseille, regulatory support for manufacturers' dossiers, and logistics with cGMP-compliant warehousing.	München Bayern	Evidenced „cGMP audits and remediation plans“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
MSK-Pharmalogistic GmbH MSK Pharmalogistic GmbH, based in Heppenheim, is a full-service provider of pharmaceutical logistics, offering storage, kitting, packaging and quality management. The company operates storage facilities in Heppenheim and Bensheim under GDP requirements.	Heppenheim Hessen	Evidenced „Lieferantenqualifizierung für Pharma in DE & EU“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
Midas Pharma GmbH Midas Pharma GmbH, based in Ingelheim am Rhein, is a medium-sized pharmaceutical company that develops and manufactures active pharmaceutical ingredients and intermediates on a contract basis. It also offers regulatory and quality services.	Ingelheim Am Rhein Rheinland-Pfalz	Evidenced „Quality Audits and Audit Reports.“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
PROMEDIPHARM GmbH PROMEDIPHARM GmbH in Bensheim has been an independent service provider for pharmaceutical development and marketing authorisation since 1994. The company supports production and batch certification at contract manufacturers, as well as quality systems and regulatory inspections.	Bensheim Hessen	Evidenced „We build your individual quality management system and assist in inspections by competent authorities or customer audits.“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
PharmaKorell GmbH PharmaKorell GmbH, based in München and Lörrach, advises the pharmaceutical industry on GMP, GDP and ISO 13485, provides Qualified Persons for batch certification, and carries out audits. The company also offers storage, primary packaging and labelling services.	München Bayern	Evidenced „Wir führen im Kundenauftrag Qualitätssicherungsaudits (GMP, GDP, ggf. unter zusätzlicher Berücksichtigung von ISO 9001 und ISO 13485) und Due Diligence Audits durch.“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
TentaConsult Pharma & Med GmbH TentaConsult Pharma & Med GmbH, based in Münster with a site in Planegg, advises life sciences companies on regulatory affairs, quality management and pharmacovigilance. Its services also include the external assumption of the Qualified Person (QP) and Qualified Person for Pharmacovigilance (QPPV) roles.	Muenster Nordrhein-Westfalen	Evidenced „Implementierung der GMP-Anforderungen für Dienstleister von Arzneimitteln“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate
zelhealth GmbH zelhealth GmbH, based in Bad Bramstedt, is a wholesaler and service provider to pharmaceutical companies, offering logistics, contract logistics, GDP training, audit support and secondary packaging. The warehouse is located at the Bad Bramstedt site.	Bad Bramstedt Schleswig-Holstein	Evidenced „Wir von der zelhealth GmbH bieten Ihnen Unterstützung bei der Auditierung Ihrer Geschäftspartner an.“ Source · 10 Nov 2026 ↗	Manufacturing authorisation GMP certificate