Excipients, together with an active pharmaceutical ingredient (API), are formulated into a final drug that is either prescribed to a patient by a doctor or bought over-the-counter without a prescription. Pharmaceutical excipient users now face increasing demands from regulators to ensure that they understand that the risks in their supply chain are not just API-related, but that excipients may also have an effect. Consequently, they need to secure their excipient supply chain to ensure their products are safe, of high quality and sourced from reputable and compliant suppliers.

Prompted by well documented cases whereby falsified medicines and substandard starting materials - both APIs and excipients - have entered the EU and US supply chains, regulators on both sides of the Atlantic have acted relatively quickly to minimize a repeat of such incidents. The new regulations affecting pharmaceutical excipients are the EU Falsified Medicines Directive (FMD or Directive 2011/62/EU), the Revision of Chapter 5 of the EU GMP Part 1 Guidelines, and the 2012 US Food and Drug Administration Safety and Innovation Act (FDASIA).

New Regulations

Both the EU and US regulations have been designed to improve product quality entering the supply chain by putting more and detailed requirements on the qualification and supervision of excipient manufacturers and distributors. This assumes there will be a risk-based approach to defining an appropriate level of excipient good manufacturing practices (GMP) and an increasing demand on distributors via good distribution practices (GDP).

The new regulations clarify the responsibilities of drug manufacturers regarding starting materials, with the expectation that physical audits of all excipient manufacturers and distributors are conducted. As this will inevitably increase the number of audits required, a cost-effective approach is needed to maintain the quality and safety of excipients. One such approach is to adopt the EXCiPACT Certification Scheme.

EXCiPACT Certification Scheme

EXCiPACT, a nonprofit organization based in Belgium, launched the EXCiPACT Certification Scheme in 2013 specifically to help pharmaceutical excipient manufacturers, distributors and users - the marketing authorization holders - to meet these new requirements.

This new, high quality certification scheme converted the well-known IPEC-PQG GMP and IPEC GDP guides for pharmaceutical excipients into EXCiPACT Auditable Standards as annexes to ISO 9001, making it simpler for them to be adopted and assessed by independent third-party certification bodies for all suppliers registered with the International Organization for Standardization (ISO). For suppliers without ISO 9001, the current GMP (cGMP) audit can be performed by the same certifying body to audit against the ANSI NSF 363 US national standard, which is equivalent to suppliers holding certification to ISO 9001 and the EXCiPACT GMP standard (figure).

Use of the EXCiPACT Certification Scheme is already providing regulators, suppliers and users alike with full confidence in the audits and the use of the audit reports by the marketing authorization holders to help demonstrate regulatory compliance.

Three Key Elements

This confidence stems from the scheme's three key elements that must be covered: cGMP and cGDP standards, auditor competency, and independent third-party certifying bodies. Auditor competency is critical in maintaining the scheme's high quality and service provision. All auditors used by EXCiPACT-approved third-party certifying bodies must first complete a rigorous, two-day training program followed by a written examination before being witnessed on their first live audit to demonstrate their competence to meet the scheme's stringent requirements. All EXCiPACT-registered third-party certifying bodies are audited by EXCiPACT to confirm that their quality-management system meets the requirements set out in the ISO 17021 annex to the EXCiPACT standards. A key requirement is that the post-audit certification decision is made by an independent review board within the certifying body and not by the auditor.

Listings on the EXCiPACT website should be used to verify registered third-party certification bodies, registered auditors, and all certified excipient suppliers and their contact details.

Since the EXCiPACT Certification Scheme has been fully operational, five certification bodies have been registered, 10 excipient suppliers have been certified (mostly in Europe but one in Saudi Arabia and another in Canada) and at least 10 more audits are in progress (table). EXCiPACT plans to begin operations in the US early in 2015, and preliminary discussions have taken place to introduce the scheme in China and India.

Reducing The Audit Burden

The EXCiPACT Certification Scheme, while comprehensive with a scope, duration and quality greater than typical excipients supplier audits, may not replace all pharmaceutical company audits. EXCiPACT certificate holders will provide their customers with their certificates and audit reports, together with any corrective and preventive action plans. The scheme's annual audit frequency is higher than the industry average. This provides for a comprehensive profile of the supplier's compliance to EXCiPACT's high standards.

The scheme permits pharmaceutical companies to use EXCiPACT certification and audit reports to support the initial qualification of the excipient supplier, full qualification of suppliers of all but the highest risk excipients, and as an aid to auditing those aspects of a supplier that are critical to higher risk excipients.

Excipient users are already commenting that they are able to use EXCiPACT certificates and audit reports from their suppliers to determine the audit frequencies. The audit reports are well received, and with at least an annual surveillance audit report as well, a comprehensive profile of supplier compliance to cGMP or cGDP will rapidly build up - faster and more thoroughly than any audits the excipient user could manage. Although both excipient suppliers and users acknowledge EXCiPACT certification will not eliminate all audits, it will reduce the audit burden for both parties and allow the redirection of resources to the mitigation of higher risks.