can anyone provide me with some basic lists or insights to get me on track preparing an audit of a supplier and service.
My company is considering to buy a license in order to use software on a remote server (supplier end). Via web browser we will gain access to the software installed on this server. The software package will help us for method validation.
Would there be any validation required since my company will not become owner of the software, but merely use it through web access.
Always use a good vendor audit document, one that has been reviewed by your peers and approved by management. (This way you have everyone in agreement, it is not just your opinion)
Always ask for documents to substantiate a claim (I.E if they have in house training - they will have training records and syllables; ask for copies, allow them to edit (blot out with marker pen) as required.
Adopt the philosophy; no records; you don’t do it and never have.
With a good audit document you can weight it to put emphasis on the most important requirements. The most consistently important items I have found, have been delivery (1) and Documentation (2).
Detail all the GMP requirements splitting them into sections (8 to 10), then raise around (8 to 10) queries in each section. (all with documents that prove conformity).
Build in a KT analysis so that you can present your audit finding as a simple percentage, which is really essential when you are comparing vendors, and explaining your audit outcome to your client, your boss or the regulators. Yes, do not forget that the audit is a regulatory requirement, so your regulators can ask to review it. Also remember that in certain instances very substantial orders are redirected because of an audit outcome. Which can lead to law suits, which also means your audit can be the subject of a legal process.
2nd point.
Validation is not governed by who owns the equipment, it governed by what the equipment was used for. The regulators have been down this road often. If you use a software tool to generate or modify a regulatory controlled piece of equipment – then that tool must be validated.
