QP, Global Supply Chain and Inspections: Managing Risk and Outsourcing

Introduction: Responsibility Beyond Corporate Boundaries

In the modern pharmaceutical industry, in-house production is increasingly rare. The supply chain is global: the active ingredient (API) comes from China or India, the formulation (bulk) is made by a third-party manufacturer (CMO) in Germany, and the secondary packaging is in Italy.

For the Qualified Person (QP), this scenario represents the greatest challenge. The law (Directive 2001/83/EC and Annex 16) is clear: the QP who certifies the finished batch is responsible for the entire supply chain, even the phases he or she has never physically seen .

Inspectors (EMA, AIFA, FDA) know this, and during GMP audits, managing outsourcing and imports is a primary focus. How can a QP be audit-ready when they have to answer to a supplier 10,000 km away?

What Inspectors Look For: Supply Chain Management

When an inspector evaluates the QP, he doesn't just check the batch records; he sees how the QP checks what he can't see.

• Critical Finding 1: API from Unqualified Suppliers. The inspector discovers that the API used comes from an unqualified supplier or, worse, a supplier other than the one declared in the dossier. This is a critical finding that can lead to suspension of the workshop. The QP has failed in its verification duty.
• Critical Finding 2: Failure to Perform Re-testing (Import). The company imports a drug from a non-EU country (without an MRA), and the QP releases it based solely on the original manufacturer's Certificate of Analysis (CoA), without performing full analytical testing in the EU. This is a direct violation of Article 51 of the Directive.
• Critical Finding 3: Absent or Inadequate Quality Agreements. The company uses a CMO, but the Quality Agreement (Technical/Quality Agreement) is vague, does not define the QP's responsibilities, or clarifies how to manage deviations and change control.

Audit Readiness: Managing Imports from Third Countries (Extra-EU)

Importing is a very high-risk activity. The importer's Quality Manager is the key figure who "Europeanizes" the batch.

Mandatory Re-testing (Art. 51)

With some exceptions, the QP must ensure that each batch imported from a third country (e.g., India, China) undergoes a complete qualitative analysis, a quantitative analysis of all APIs, and any other tests required by the MA after arrival in the EU. Simply relying on the manufacturer's CoA is not enough.

The Exception: Mutual Recognition Agreements (MRAs)

The EU has MRA agreements with some countries (e.g., the USA, Switzerland, Canada, Australia). If a drug originates from an approved site in an MRA country, the QP can avoid retesting, provided they receive equivalent documentation (e.g., the Batch Certificate signed by the US Quality Unit). The QP must still review the documentation and the CoA.

API, FMD and "Written Confirmation"

For Active Pharmaceutical Ingredients (APIs), the Falsified Medicines Directive (FMD) requires that imported APIs be accompanied by a "Written Confirmation" from the health authority of the exporting country, certifying that the manufacturing site complies with GMP standards equivalent to those of the EU. The QP must verify the presence of this document for each non-EU API supplier.

Audit Readiness: Outsourcing (CMOs and External Laboratories)

When production (or analysis) is entrusted to a third party (Contract Manufacturing Organization), the QP's responsibility does not diminish.

The Quality Agreement

This is the fundamental legal-technical document (required by GMP Chapter 7 and Annex 16). The QP must ensure that the agreement clearly defines:

• The responsibilities of each party.
• How deviations, OOS and Change Controls will be handled.
• The CMO's obligation to immediately inform the QP of any critical issues.
• The right of audit by the company (and the QP).

The "QP Confirmation" (Annex 16, 1.4)

If the supply chain involves multiple EU sites (e.g., bulk produced at Site A, packaged at Site B), the final QP (Site B) does not need to redo all the work. The Site A QP can issue a "QP Confirmation," a formal document certifying that their process step is compliant. The final QP (Site B) can then (legally) rely on that statement to certify the finished batch.

Typical Error vs. Corrective Action (Outsourcing)

• Error: The QP releases a batch produced by a CMO based only on the final CoA, without having reviewed (or received confirmation of review) the BMR and deviations that occurred at the subcontractor. * Corrective Action: The Quality Agreement must specify that the CMO will provide, with the batch, a complete "release package" (including QP Confirmation and deviation report), and the internal QP will not certify the batch until this package has been reviewed and approved.

New Challenges: ATMP, Digital and AI

The future of QP is even more complex, requiring audit readiness in emerging areas:

• Complex Medicinal Products (ATMP): For advanced therapies (CAR-T, gene therapies), the supply chain is often "patient-specific" (autologous). The challenge for the QP is absolute traceability ( Chain of Custody and Chain of Identity ). The inspector will look for irrefutable proof that Patient A's cells were returned only to Patient A.
• Digitalization (Remote QP Certification): The pandemic has accelerated remote QP certification. Auditors expect that, even if the QP is not physically on site, the company must have robust and validated digital systems (according to Annex 11) that give the QP access to all data (eBMR, LIMS, Audit Trail) as if they were there.
• Artificial Intelligence (AI): AI enters processes (e.g., predictive quality , review by exception ). The inspector will ask the QP: "How did you validate this AI algorithm (according to the future Annex 22)? How do you ensure its advice is reliable?" The QP will also become a "validator" of machine learning models.

Conclusion: QP as a "Hub" of Global Trust

In a globalized supply chain, the QP can't be everywhere, but its responsibility is. To be audit-ready , the QP must build a system of trust based on solid foundations: rigorous audits, secure Quality Agreements, retesting (where required), and intelligent use of technology to maintain visibility across every link in the chain.

For a detailed guide on drafting Quality Agreements, managing third-party imports, interpreting MRAs, and preparing for complex supply chain inspections, GuideGxP.com's " Complete Guide to the Qualified Person (QP) Role " is your survival manual.