Frequently Asked Questions

What are the advantages of EXCiPACT audit versus a pharma company audit?

The European Falsified Medicines Directive requires Manufacturing Authorisation Holders (customers of certificate holders) to assess the GMP used in the manufacture and GDP used in the distribution of your excipients. All customers not currently auditing their supplier are able to use a supplier’s EXCiPACT audit report instead of their own audit. There are similar requirements from the U.S. FDA, and excipient GMP certification is required by the authorities in the permitting process for New Drug Applications. EXCiPACT is designed to ensure all customers of an EXCiPACT-audited supplier may be given access to an initial audit report and surveillance audits that follow on at least an annual basis. This provides the customer with more data than from their own audits.

Will an EXCiPACT certificate be recognised by regulatory authorities?

The FDA have indicated that they need to work in partnership with 3rd parties to secure the pharmaceutical supply chain. They have mentioned EXCiPACT several times in public meetings as being a suitable scheme to help secure the supply chain. Similarly, in Europe the UK’s MHRA has stated that they could not see how a 3rd party certification scheme could be effective unless it was structured like EXCiPACT with suitable standards and providing oversight of both the 3rd party organisation and their auditors.

The EU GMP guideline 3.3 issued on 19 March 2015 that that came into effect in March 2016 states that  “Certification of quality systems and/or GMP held by the excipient manufacturer and the standards against which these have been granted should be considered as such certification may fulfil the requirements.” EXCiPACT certification fulfils these requirements.

The European Health Authorities do not (and will not) officially recognise EXCiPACT certification in place of customer audit.  This is because, in the EU-GMP and EMA spirit, it is the full responsibility of the Manufacturing Authorisation Holder’s Qualified Person to approve the level of Excipient quality and to ascertain it is suitable for use.

However, after assessment of the certification and corresponding audit report, the MAH’s QP can decide not to audit the certified supplier based on the conclusion of its quality risk analysis.  If such decision is documented, it is is fully accepted by European Health inspectors.

Is an EXCiPACT certificate a substitute for a regulatory inspection?

No, but regulatory inspections of excipient suppliers are rare. Occasionally, a supplier may volunteer for such an inspection to obtain a “GMP Certificate” which is required for the import of excipients into certain countries. Where “GMP Certificates” are a legal requirement, an EXCiPACT certificate would not be an acceptable alternative. There is no requirement in the developed world for an excipient user to show the excipient supplier has such a “GMP Certificate”.  Excipient users are not allowed to use “GMP Certificates” of excipient suppliers as a substitute for their own (or commissioned) audits.

Will EXCiPACT certification replace the need for a pharmaceutical manufacturer to conduct its own audits of excipients suppliers?

An EXCiPACT certificate and audit reports are an indication that the supplier meets the minimum GMP and or GDP requirements for excipients. It follows that some users may have more demanding requirements for GMP and GDP and may require a separate audit. Hopefully, in such cases, both parties can agree not to duplicate the EXCiPACT audit scope but instead to ensure the new audit’s scope meets only the customer’s additional needs.

How can a pharmaceutical manufacturer access an EXCiPACT audit report?

EXCiPACT audit reports are available directly from the certified supplier. They are required to have a process to share these reports with their customers in accordance with Section 8.2.1 of the EXCiPACT GMP and GDP standards.

They may publish their EXCiPACT Certificate on their website too. An up-to-date alphabetical list of all Certificate Holders and a summary of the certificate scope and reference can be found on our website here.

What does an EXCiPACT audit cost per product and per site?

EXCiPACT audits only assess the management system of the excipient supplier’s site. EXCiPACT certification is not applied to specific products. The audit applies to the site location on the scope of the certificate and is dependent upon the complexity of operations on that site.

EXCiPACT makes no recommendations nor places any limitations on how the excipient supplier provides the Certificate and audit reports to their customers. Each supplier makes its own decision. Also, the supplier may wish to redact any commercially sensitive or confidential information from the audit report.

There is a certification fee to be paid to EXCiPACT by the supplier for each 3-year certificate issued. The fee is used by EXCiPACT to maintain the standards and to apply strict oversight to each Certification Body and their auditors who perform the audits.

What is the duration of an EXCiPACT audit?

The process for estimating the minimum audit duration for the certification process is set out in the Standards document. An estimate for the likely audit duration will vary depending on the excipient supplier, the complexity of their site operations, their compliance with the chosen standard(s) and any corrective and preventive actions (CAPA) they may need to put in place following each stage of the audit. The estimated audit duration will form part of the 3rd party Certification Body's cost estimates included in their draft Agreement. The certification process varies with each Certification Body but on average it takes 26 weeks to complete from a supplier’s first contact with a Certification Body to the publication of a successful certification on the EXCiPACT website.

How can an excipient supplier decide which type of EXCiPACT certificate is suitable for their site’s activities?



EXC certification standards decision chart



Can FSSC-22000 certification replace ISO-9001 preliminary certification requirement for EXCiPACT certification?

No.  ISO-9001 concerns Quality Management System, whereas FSSC-22000 concerns food safety and security, so they are not interchangeable and also not equivalent.

Therefore the ISO-9001 certification is a mandatory prerequisite for an EXCiPACT certification.

Please note that several EXCiPACT CBs are also providing ISO-9001 certification.

Is an EXCiPACT GDP certified supplier also EXCiPACT GWP Certified ? (May 2022)

Yes, as the EXCiPACT GWP standard is fully aligned with the requirements of the EXCiPACT GDP standard, concerning the warehousing practices.