How to Choose a GMP Audit Consultant: 10 Questions to Ask

Choosing the right GMP audit consultant is one of the higher-leverage decisions a quality team makes: the wrong appointment buys you a tidy report and a false sense of security, while the right one exposes the risks that would otherwise surface in front of the MHRA or your customer's auditor. Whether you are qualifying a new contract manufacturer, preparing a site for inspection, or filling a gap in your own oversight, the questions you ask before engagement matter far more than the day rate you negotiate.

The brief below sets out ten questions worth putting to any prospective auditor, grouped by what they actually tell you. None of them are about price. All of them are about whether the person walking your manufacturing floor can defend their judgements when it counts.

Competence and credentials: can they actually do the work?

Start with the obvious, because it is where the most damage hides. A polished CV is not the same as relevant, current competence.

1. What is their direct GMP background?

Ask what they have operated, not just inspected. A credible GMP audit consultant should have hands-on history in pharmaceutical manufacture or quality — ideally as a Qualified Person, QC/QA manager, or production lead — not solely a generic quality-management pedigree borrowed from another sector. Sterile, biologics, ATMPs and solid-dose all carry distinct risks; someone whose career was spent in oral solids may not be the right choice to audit an aseptic fill under Annex 1.

2. Are they trained and current as a lead auditor?

Look for formal auditor training (for example to ISO 19011 principles) plus evidence of continuing practice. Auditing is a perishable skill. Someone who certified ten years ago but has run two audits since is not current, regardless of seniority. Ask how many audits they have led in the last twelve months and across which dosage forms.

3. Which frameworks do they audit against, in practice?

The answer should be specific. Expect fluency in EU GMP (EudraLex Volume 4) and its Annexes, the relevant ICH Q9 (quality risk management) and Q10 (pharmaceutical quality system) expectations, and — where your supply chain touches the United States — 21 CFR Parts 210 and 211. If distribution is in scope, they should be equally comfortable with GDP guidelines. Vague reassurance here is a red flag.

Independence and integrity: will they tell you the truth?

An audit is only worth what its objectivity will bear. The most uncomfortable findings are usually the most valuable, so probe whether your consultant is structurally able to deliver them.

4. Are they genuinely independent of the audited party?

Confirm there is no conflict of interest — no commercial relationship with the site, no consultancy work that they would, in effect, be auditing themselves. A consultant who helped write the procedures cannot objectively assess them. Independence is a regulatory expectation, not a courtesy.

5. How do they handle data integrity?

Data integrity is where modern inspections live or die. Your auditor should treat ALCOA+ as a working method, not a buzzword — examining audit trails, reviewing the contemporaneity and attributability of records, and probing electronic systems against Annex 11. Ask for an example of a data-integrity issue they uncovered and how they substantiated it. The specificity of the answer tells you everything.

An auditor who has never made a client uncomfortable has probably never audited deeply enough to protect them.

Methodology and rigour: how do they reach a finding?

Two auditors can spend the same day on the same site and produce wildly different reports. The difference is method.

6. Is their approach genuinely risk-based?

Under ICH Q9, audit effort should follow risk. Ask how they decide where to spend their time on the day, how they scope before arrival, and how they avoid the trap of auditing what is easy rather than what is important. A defensible methodology focuses scrutiny on the processes most likely to harm the patient.

7. How do they classify and evidence findings?

You want a clear, consistent system — critical, major and minor — with each finding tied to a specific regulatory reference and supported by objective evidence rather than opinion. Inconsistent grading undermines the whole exercise, because it distorts how urgently your supplier responds. Ask to see a redacted sample report so you can judge the quality of the writing and the traceability of conclusions before you commit.

Deliverables and value: what do you actually get?

The report is the product. Treat its quality, timing and usefulness as part of your selection criteria, not an afterthought.

8. What does the report contain, and how quickly?

Agree the format, the turnaround time and the level of detail up front. A strong report does more than list non-conformances: it explains the risk, references the relevant requirement, and gives your team enough to act. Reports that arrive weeks late, or that read as a tick-box checklist, have limited value when a customer or regulator is waiting.

9. Will they support corrective action, or just hand over findings?

Findings are the beginning, not the end. Ask whether they will review the resulting CAPA plans, assess root-cause adequacy, and — where needed — verify closure. There is a meaningful difference between an auditor who drops a report and one who helps you demonstrate that the system has genuinely improved. Our case studies illustrate how that follow-through changes outcomes.

10. Can they represent you credibly to a regulator or client?

Finally, gauge gravitas. If the MHRA or a major customer questions a finding, can your consultant stand behind it with calm authority? An auditor who can articulate the basis of their judgements — and hold a professional line under challenge — protects your reputation as well as your compliance. You can see the breadth of support we offer across our full range of services.

Key takeaways: choosing a GMP audit consultant with confidence

The right GMP audit consultant is defined less by their rate card than by competence, independence and the rigour of their method. Before you appoint anyone, satisfy yourself on these points:

• Relevant, current expertise in your dosage forms and the frameworks that govern them.
• Demonstrable independence and a track record of delivering uncomfortable findings honestly.
• A risk-based methodology with consistent finding classification and traceable evidence.
• Reports and follow-through that move you towards closure, not just documentation.

If you would like an independent, QP-led perspective on your next audit — supplier qualification, site readiness or routine GMP oversight — explore our GMP audit services or get in touch to discuss what your operation actually needs.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EudraLex Volume 4 — EU GMP Guidelines
• EU GMP Chapter 9 — Self Inspection
• MHRA Inspectorate Blog
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.