Frequently Asked Questions
The European Falsified Medicines Directive requires Manufacturing Authorisation Holders (customers of certificate holders) to assess the GMP used in the manufacture and GDP used in the distribution of your excipients. All customers not currently auditing their supplier are able to use a supplier’s EXCiPACT audit report instead of their own audit. There are similar requirements from the U.S. FDA, and excipient GMP certification is required by the authorities in the permitting process for New Drug Applications. EXCiPACT is designed to ensure all customers of an EXCiPACT-audited supplier may be given access to an initial audit report and surveillance audits that follow on at least an annual basis. This provides the customer with more data than from their own audits.
The FDA have indicated that they need to work in partnership with 3rd parties to secure the pharmaceutical supply chain. They have mentioned EXCiPACT several times in public meetings as being a suitable scheme to help secure the supply chain. Similarly, in Europe the UK’s MHRA has stated that they could not see how a 3rd party certification scheme could be effective unless it was structured like EXCiPACT with suitable standards and providing oversight of both the 3rd party organisation and their auditors.
The European Health Authorities do not (and will not) officially recognise EXCiPACT certification in place of customer audit. This is because, in the EU-GMP and EMA spirit, it is the full responsibility of the Manufacturing Authorisation Holder’s Qualified Person to approve the level of Excipient quality and to ascertain it is suitable for use.
However, after assessment of the certification and corresponding audit report, the MAH’s QP can decide to not audit the certified supplier based on the conclusion of its quality risk analysis. If such decision is documented, it is is fully accepted by European Health inspectors.
No, but regulatory inspections of excipient suppliers are rare. Occasionally, a supplier may volunteer for such an inspection to obtain a “GMP Certificate” which is required for the import of excipients into certain countries. Where such “GMP Certificates” are a legal requirement, an EXCiPACT certificate would not be an acceptable alternative. There is no requirement in the developed world for an excipient user to show the excipient supplier has such a “GMP Certificate”. Nor are excipient users allowed to use such “GMP Certificates” of excipient suppliers as a substitute for their own (or commissioned) audits.
An EXCiPACT certificate and audit reports are an indication that the supplier meets the minimum GMP and or GDP requirements for excipients. It follows that some users may have more demanding requirements for GMP and GDP and may require a separate audit. Hopefully, in such cases, both parties can agree not to duplicate the EXCiPACT audit scope but instead to ensure the new audit’s scope meets only the customer’s additional needs.
EXCiPACT audit reports are available directly from the certified supplier at their discretion. It is entirely up to a supplier to decide with whom they share their EXCiPACT audit report.
They may publish their EXCiPACT Certificate on their website too. An up-to-date alphabetical list of all Certificate Holders and a summary of the certificate scope and reference can be found on our website here.
EXCiPACT audits only assess the management system of the excipient supplier’s site. EXCiPACT certification is not applied to specific products. The audit applies to the site location on the scope of the certificate and is dependent upon the complexity of operations on that site.
EXCiPACT makes no recommendations nor places any limitations on how the excipient supplier provides the Certificate and audit reports to their customers. Each supplier makes its own decision. Also, the supplier may wish to redact any commercially sensitive or confidential information from the audit report.
There is a certification fee to be paid to EXCiPACT by the supplier for each 3-year certificate issued. The fee is used by EXCiPACT to maintain the standards and to apply strict oversight to each Certification Body and their auditors who perform the audits.
Not that we are aware of. However, we believe that the principles of supplier qualification are common in all regions with an expectation that the supplier has been assessed for GMP compliance. We expect Australia and New Zealand to be similar to Europe and the U.S. because of their close links. Japan is different and excipients have some direct regulatory authority oversight. China is also developing approaches to excipients that meet local needs and behaviours and is also likely to be different.
EXCiPACT allows Rx-360 to use the EXCiPACT GMP standard in its audits of excipient manufacturers. However, Rx-360 contracts with a Certification Body and Auditor, holds the audit report and controls its distribution through pricing plus legal and confidentiality agreements. In the EXCiPACT Certification Scheme, the supplier contracts with an EXCiPACT Registered Certification Body for the audits. The supplier holds the audit reports and controls their distribution usually at no cost and with minimal legal and confidentiality agreements. Auditors used by EXCiPACT Registered Third Party Certification Bodies must meet the requirements of ISO 17021-1:2015 for auditors and in addition to have successfully completed an EXCiPACT two-day training course plus the exam and have been successfully witnessed during their first EXCiPACT audit before their competency is confirmed as a Registered EXCiPACT Auditor. The Rx-360 requirements for their auditors are less demanding -see
The process for estimating the minimum audit duration for the certification process is set out in the Standards document. An estimate for the likely audit duration will vary depending on the excipient supplier, the complexity of their site operations, their compliance with the chosen standard(s) and any corrective and preventive actions (CAPA) they may need to put in place following each stage of the audit. The estimated audit duration will form part of the 3rd party Certification Body's cost estimates included in their draft Agreement. The certification process varies with each Certification Body but on average it takes 26 weeks to complete from a supplier’s first contact with a Certification Body to the publication of a successful certification on the EXCiPACT website.