Digital Supplier Audit: What a Remote Audit Can Demonstrate – and What It Cannot

Supplier Qualification Remains a Responsibility When Manufacturing Is Outsourced

Organizations outsourcing manufacturing or testing need to establish whether the contract acceptor can perform the agreed activities under the required conditions.

In the EU GMP framework, Chapter 7 governs outsourced activities. The contract giver must assess the contract acceptor's suitability and competence, appropriately oversee the outsourced work, and review the related results. Responsibilities must be defined in a written agreement. ^[1]

ICH Q10, Section 2.7, also addresses the assessment, monitoring, and improvement of outsourced activities and purchased materials. ^[2]

EU GMP Chapter 5 contains additional requirements for selecting and qualifying suppliers of starting materials. The relevant personnel must understand the suppliers, supply chain, and associated risks. ^[3]

This does not mean every supplier requires the same type of audit. The scope, depth, and frequency of assessments depend on the product, activity, risk, and applicable regulatory framework.

Consider the following fictional case.

A pharmaceutical manufacturer contracts an external facility to perform a processing step for batch CH-918. The responsible head of QA wants to establish whether the work followed the agreed instructions, which deviations occurred, and whether the required checks were completed.

Responsibility for the relevant release decisions is not discharged simply by receiving an audit report.

On-Site and Remote Audits Provide Different Types of Evidence

A remote audit is particularly suitable for examining information that the contract acceptor can make available in an appropriate format.

This includes approved work instructions, qualification records, documented activities, results, deviation reports, and recorded decisions.

An audit trail can support the examination of relevant changes to electronic records and their history. Live interviews with responsible personnel can also be conducted remotely.

A screen, however, cannot replace every observation made on-site.

An on-site visit provides opportunities to directly observe the condition of rooms and equipment, work organization, and activities as they are performed. Unplanned questions and observations beyond prepared records may also be relevant to the audit.

Video transmission supports some of these observations, but the available viewing angle, selection of footage, and visibility impose limitations.

Regulatory distant inspections must be distinguished from private supplier audits. Authorities follow their applicable procedures and guidance, including EMA guidance on distant assessments. That guidance does not itself establish the requirements for a company's private supplier audit. ^[7]

Certification audits, such as assessments of quality management systems against ISO standards, also have their own objectives and procedures. They are not equivalent to the qualification of a contract manufacturer for a specific outsourced activity.

For CH-918, a remote assessment may establish whether equipment cleaning was documented and reviewed. Determining whether the equipment was in the required condition at the relevant time may require further evidence or an on-site assessment.

A risk-based hybrid approach combines the examination methods suited to the particular audit objective.

Showing Paper Records on Camera Does Not Resolve the Evidence Problem

A digital supplier audit depends on more than the ability to display information. The auditor must be able to examine its context.

Four difficulties are particularly relevant.

Legibility: Photographed pages or records shown through a camera may be difficult to read. Marginal notes, tables, and signatures may become unclear.

Completeness: The auditor initially sees only the records selected for presentation. Other entries, corrections, or activities may remain unidentified.

Selection by the auditee: When only the contract acceptor decides which screen views or documents to show, the auditor's ability to select an independent sample is restricted.

Missing context: An individual test result does not establish which material was examined, which specification applied, or what decision followed.

For CH-918, the external manufacturer presents a table containing an acceptable test result. The head of QA also needs the batch association, applicable specification, and any relevant correction history.

This connects the supplier audit with ALCOA+ principles, including attributable, legible, contemporaneous, original, and accurate records.

Data integrity throughout the data lifecycle also matters. Exporting a file is insufficient if required metadata or relationships are lost.

An electronic record is therefore more than a scanned sheet of paper.

Ongoing Visibility Makes Batch Activities Available for Review Earlier

The greatest operational difference arises when quality-relevant information is recorded in a structured form during the outsourced activity.

For CH-918, the head of QA does not necessarily have to wait until the complete batch documentation is available to identify particular unresolved issues. Agreed interim status information can be provided promptly: Has processing been completed? Is a test result available? Was a deviation addressed? Which approval remains outstanding?

An Electronic Batch Record connects documented batch execution with its steps, results, and reviews. In multi-stage processing, batch traceability is also important for following material movements and subsequent batches.

This visibility changes audit preparation. Instead of first assembling scattered files, the review can begin with a particular batch and its unresolved questions.

External data verification addresses a separate issue: how selected records can be technically checked against a protected reference point. Such a technical check does not establish whether the documented manufacturing activity was correct in substance.

Ongoing visibility requires agreed access rights, appropriate data formats, and clear responsibilities. It does not give the contract giver unrestricted access to all operational data held by the contract acceptor.

Confidentiality, trade secrets, and control over data must be considered. The information shared should be limited to the agreed assessment purpose.

Supplier Evaluation Combines Audit Findings With Operational Experience

A supplier evaluation should consider more than the outcome of a single audit. Complaints, deviations, delivery performance, and implementation of agreed corrective actions may also contribute to the assessment.

For CH-918, the audit may show that processing was fully documented. At the same time, repeated delays in test reports or inadequately resolved deviations may affect the assessment of the contract acceptor.

ICH Q9(R1) describes quality risk management principles for aligning the formality and scope of assessments with risk and uncertainty. ^[4]

The analysis of process variants can provide additional insight into recurring rework or delays across comparable orders. An observed pattern does not, by itself, establish its cause.

The evaluation informs whether another assessment is necessary, which areas warrant closer investigation, and whether a remote, on-site, or combined audit is appropriate.

For outsourced activities in medicinal product wholesale distribution, Chapter 7 of the EU GDP Guidelines expressly requires audit frequency to be determined according to risk. ^[5]

A fixed annual audit is therefore not a universal benchmark for every supplier.

Quality Agreements Must Define Access to Information

Ongoing information exchange requires both parties to understand what data must be available, when it must be provided, and in which format.

Within the EU GMP framework, Chapter 7 requires a written agreement defining responsibilities and communication arrangements. ^[1]

For a digital supplier audit, the parties should specify which records fall within the assessment scope, how samples will be selected, how quickly documentation must be available, and who responds to questions.

Deviation handling is equally important. When must the contract giver be informed? Which results must be available before a decision? How will corrections and rework be identified?

An approval workflow illustrates why submission, review, return for revision, and subsequent approval are distinct states.

For CH-918, the agreement could require prompt communication of quality-critical deviations and availability of the associated records before final batch assessment.

The agreement should also address access restrictions, confidentiality, retention, and technical outages.

Remote access does not remove the need to assess the suitability, scope, and evidentiary value of the audit itself. The value of a digital supplier audit comes from verifiable relationships among operations, records, and accountable decisions—not simply from eliminating a business trip.