Can a GMP supplier audit be done remotely?

For active substance suppliers, the answer is largely written into EU law, and it leans to no. Point (f) of Article 46 of Directive 2001/83/EC obliges the holder of a manufacturing authorisation to verify GMP compliance of active substance manufacturers and distributors through audits. Chapter 5 of the EU GMP Guide specifies that such audits “should be carried out at the manufacturers and distributors of active substances”, with “an appropriate duration and scope” so that “a full and clear assessment of GMP is made”. A purely remote exercise rarely meets that bar, and the remote formats regulators developed for their own inspections carry declared limits and do not replace the audit obligation. For lower-risk suppliers and for defined stages of the audit cycle, remote work is defensible when a documented risk assessment supports it. For most supply chains the strongest operating model is hybrid: remote document work first, then a shorter, targeted on-site visit.

For active substances, the requirement is an audit at the supplier, and a certificate or a questionnaire does not discharge it. Article 46(f) of Directive 2001/83/EC places the verification duty on the manufacturing authorisation holder, who may audit directly or through an entity acting on their behalf under a contract. EudraLex Volume 4, Chapter 5 (paragraph 5.29) sets the standard of the exercise itself: audits “should be carried out at the manufacturers and distributors of active substances”, their duration and scope must allow a full and clear assessment, and further audits follow “at intervals defined by the quality risk management process”. ICH Q10 (section 2.7) puts the audit inside a cycle, assessing suitability before outsourcing and monitoring performance after. For outsourced GMP activities, Chapter 7 adds the contractual hook: the written contract “should permit the Contract Giver to audit outsourced activities” (paragraph 7.17). The texts describe a recurring, evidence-based exercise conducted where the work happens.

A remote audit is defensible where the physical dimension of the activity is small, the risk is assessed in writing, and the format is declared for what it is. The reference points come from the authorities’ own practice. The EMA guidance on distant assessments (version 4, June 2024) accepts them outside crisis situations only for sites with limited activities and a good compliance history, gives the examples of purely documentary sites, quality control laboratories running few methods and verification of CAPA implementation, and states that the guidance “is not intended for use or to replace on-site inspections”. PIC/S guidance PI 056-1, in force since January 2025, standardises the vocabulary for inspectorates: fully interactive, partially interactive, desktop, hybrid. Both documents address inspections by authorities. Neither rewrites the manufacturer’s audit obligation. Read together, they support remote work in a supplier programme for desk assessment before a visit, CAPA follow-up between visits and low-risk, non-API suppliers, with the rationale recorded.

The findings that decide a qualification are mostly physical, and a camera shows you what it is pointed at. Paragraph 5.29 asks the auditor to weigh cross-contamination “from other materials on site”, which means looking at what else the site runs, not at what the slide deck says. It also sets the reporting standard:

Material and people flows, segregation in shared warehouses, the real state of a drying room, gowning behaviour when nobody announces the visit: this evidence exists only on site. In the medical cannabis supply chain the gap matters more than elsewhere, because suppliers are often young companies in third countries, crossing from GACP into GMP, where documentation and practice can live far apart.

A hybrid audit combines remote assessment and on-site presence in one exercise, and it works when the split follows the risk, not the travel budget. PIC/S PI 056-1 defines the hybrid inspection as an assessment “using a combination of on-site inspection and remote assessment”. Applied to supplier audits, the workable pattern has three parts:

• remote preparation: quality documentation, site master file, layouts and records reviewed before travelling, with interviews by video where useful;
• a shorter on-site visit spent where the physical risk lives: production areas, storage, segregation, utilities, behaviour;
• remote follow-up: CAPA evidence reviewed as it is produced, instead of waiting for the next visit.

The failure mode to design against is the symbolic walk-through, a remote audit with a courtesy tour attached. The on-site scope should be written before the audit, derived from the risk assessment, and reported as its own section.

The choice is a quality risk management decision, and for active substances the starting point is fixed by the texts. Four questions settle most cases. What is the material: an active substance points to the supplier’s site, an excipient is controlled “based on the results of a formalised quality risk assessment” (paragraph 5.29), a service provider sits with Chapter 7. What is the history: a supplier never audited on site deserves the visit, and the EMA guidance itself gives priority to sites never inspected on site before. What is the process: the more critical and the more physical the step, and drying in a cannabis supply chain is both, the stronger the case for presence. What does the contract say: paragraph 7.17 only helps if the audit clause was written in. Whatever the outcome, the format is part of the audit programme and carries its own rationale, because the first question anyone reviewing the qualification will ask is why this audit was done this way.

Written by

Riccardo Longato

GMP Pharmaceutical Quality Systems Lead Auditor

LinkedIn