First-party or second-party audit: which one do you need?

A first-party audit is the one you run on your own quality system: the self-inspection that EU GMP requires in Chapter 9. A second-party audit is the one you run on somebody else: a supplier or a contract manufacturer, against your requirements and your quality agreement. The two share the discipline and the toolbox, and they answer different questions. The first asks whether your own house works the way your procedures say it does. The second asks whether a company you depend on deserves that dependence. Both are audits in the full sense of the word: planned, scoped, documented and closed out with tracked corrective actions. EU GMP expects both from a manufacturer, so the real choice is how much independence, depth and follow-up each one gets, and that is where the two differ most in practice.

A first-party audit examines your own operation, by your own decision, on your own calendar. In EU GMP it has a chapter of its own: Chapter 9, Self Inspection, one page long and unusually plain. Its principle: self inspections “should be conducted in order to monitor the implementation and compliance with Good Manufacturing Practice principles and to propose necessary corrective measures”.

Chapter 9 also says what the programme must cover: personnel, premises, equipment, documentation, production, quality control, distribution, complaints and recalls, and the self-inspection system itself. Everything, in other words, examined “at intervals following a pre-arranged programme”.

One thing Chapter 9 does not say is “annually”. No frequency is written in the chapter; what it demands is a pre-arranged programme, and in practice most sites derive the intervals from risk. If your programme says annual, that is your commitment, not the regulation’s.

A second-party audit examines a supplier or service provider, and you are the customer commissioning it. The scope follows your risk assessment, the auditor checks what your quality agreement promises against what the site actually does, and the findings land on your desk for follow-up.

This is the audit that carries supplier qualification. For active substance suppliers it is an obligation: the EMA’s GMP questions and answers state that a valid GMP certificate from an EEA inspection does not replace the manufacturer’s own audit obligation. Inspections serve the licence; your audit serves your qualification decision.

Yes. Chapter 9 is part of the basic requirements for medicinal products, and inspectors treat the self-inspection programme, its records and its corrective actions as evidence that the quality system watches itself. Chapter 9.3 requires every self inspection to be recorded, with the observations, the proposed corrective measures and a statement on the actions actually taken. Inspectors notice when a programme finds nothing for years.

No, and the direction of the failure differs.

• A self-inspection cannot qualify a supplier. It never sees the supplier’s plant, and the audit obligation toward active substance suppliers stays with you regardless of how good your internal programme is.
• A supplier audit cannot watch your own system. Your batch records, your deviations, your training: no customer audit of somebody else covers them.
• What they share is the method: trained auditors, a defined scope, a report, corrective actions tracked to closure. A site that runs one of the two well usually has most of what it needs to run the other.

For the second-party audit the answer is in the name: you, or a third party you contract under the conditions EU GMP sets for outsourced audits.

For the self-inspection, Chapter 9.2 asks for something harder than it sounds: audits “conducted in an independent and detailed way by designated competent person(s) from the company”. Independence is the working problem. In a small quality unit, the person most competent to audit a process is often the person who runs it, and auditing your own work is the one thing an auditor cannot do. The chapter itself offers the way out, in its own words: “Independent audits by external experts may also be useful.” An external auditor inside a first-party programme leaves the ownership where it was and widens what the programme can see.

Put the two programmes side by side and check three things: that every critical supplier has an audit with a date on it, that no one in the self-inspection plan is auditing their own work, and that last year’s corrective actions are closed rather than filed. If one of the three fails, that is where next year’s programme starts.

Written by

Riccardo Longato

GMP Pharmaceutical Quality Systems Lead Auditor

LinkedIn