19 February 2019

EMA/694531/2017 – Rev. 1
Committees and Inspections

Joint Audit Programme for EEA GMP inspectorates

JAP Procedure

1. Aim
This procedure describes how the Joint Audit Programme (JAP) and its audits are performed.

2. Scope
This document covers the planning for audits and the audit process of competent authorities (CAs) in
charge of the Good Manufacturing Practices (GMP) compliance programme as detailed in the ‘Evaluation
Guide for GMP Regulatory Compliance Programme - Audit Checklist’ (JAP Audit checklist) as well as the JAP
Observed inspection checklist.

3. Definitions and responsibilities

Audit: systematic, independent and documented process for obtaining audit evidence and evaluating it
objectively to determine the extent to which audit criteria are fulfilled.

Auditee: GMP inspectorate being audited. The management of the auditee:

 informs the relevant staff about the objectives and scope;

 ensures the availability of all relevant documents and of all relevant staff;

 co-operates with the audit team and observers;

 establishes a CAPA plan on the basis of the preliminary audit report and is responsible for its
realisation.

Auditor: person carrying out the audit and responsible for preparing the audit report.

Note: auditors are normally GMP inspectors from European Economic Area (EEA) competent authorities
with good knowledge of and experience with European Union (EU) regulations related to medicinal
products, authorisation/licensing systems, quality defects, auditing processes, quality systems and the
JAP documents. Equally experienced staff from EEA competent authorities or EU Institutions can also
be auditor, but only co-auditor not observing GMP inspections. Retired inspectors/auditors can
participate in the JAP Programme if they have a contract with their former agency covering JAP audit
activities on behalf of that agency.

30 Churchill Place ● Canary Wharf ● London E14 5EU ● United Kingdom

Telephone +44 (0)20 3660 6000 Facsimile +44 (0)20 3660 5555
Send a question via our website www.ema.europa.eu/contact An agency of the European Union

© European Medicines Agency, 2019. Reproduction is authorised provided the source is acknowledged.
Foreign language skills are essential and at least a good command of the English language is required.
Each auditor must complete the EMA electronic declaration of interests (DoI) and curriculum vitae (CV)
and be included in the EMA Experts database. Exceptionally and based on a justification, an auditor can
provide the DoI and CV in paper format without inclusion in the database. Each auditor must also
complete the JAP Confidentiality agreement for audits prior to the audit if requested by the company
from the observed inspection or by the auditee.
All audit team members, who have not yet participated in JAP/Joint Reassessment Programme (JRP)
audits and who have not attended JAP/JRP training, must review – in full – the recorded version of the
last joint EMA and Pharmaceutical Inspection Co-operation Scheme (PIC/S) training of auditors (link),
and send confirmation of this training to the Compliance Group secretariat (European Medicines
Agency (EMA)) before they participate in the on-site visit.

Audit team: auditors conducting an audit.

Note: audits should generally be performed by an audit team with one auditor appointed as lead auditor.
The audit team can include auditors-in-training and auditors from EU Institutions, MRA-partners and
PIC/S-members. Observers can accompany the audit team, but do not act as part of it.

Audit findings: results of the evaluation of the collected audit evidence against audit criteria.

Best practice: procedures or working methods that have been shown to be more effective than current
methods in producing optimal results and suitable for adoption by other inspectorates.

Lead auditor: trained auditor confirmed during the planning phase of the audit whose responsibility it is
to:

 create, coordinate and maintain the communication between the audit team and the auditee;

 assign work within the audit team including appointment of his/her back-up;

 evaluate together with the team the documentation submitted;

 prepare the audit plan;

 prepare the on-site visit;

 prepare the audit report;

 reach an agreement with the team for the preliminary audit report to be sent to the auditee;

 send the preliminary audit report to the auditee and the Compliance Group secretariat (EMA);

 ensure the evaluation of responses from the auditee;

 prepare the final audit report considering also responses from the Compliance Group on the report;

 send the final audit report to the auditee and the Compliance Group secretariat (EMA);

 provide input in the follow-up of corrective and preventive actions (CAPA).

Compliance Group: a subgroup of the GMDP Inspectors Working Group (GMDP IWG) responsible for
managing and supervising the Joint Audit Programme. EMA provides the secretariat for the Compliance
Group as per the Compliance Group mandate and maintains the following information on JAP audits:

 date of the last audit performed and organisation having performed this audit;

 status of the audit;

 results of the audit;

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 2/11
 exchange of information with other equivalent programmes (e.g. PIC/S and MRA);

 composition of the audit team;

 archive of all final audit reports;

 issue the formal audit notification and send it to the auditee.

Sponsor: Compliance Group member assigned to perform the full detailed review of the preliminary
and/or final audit report to facilitate the other Compliance Group members to focus on the key aspects
of the audit report and to act as topic technical leader for the audit report enabling a timely adoption of
the final audit report by the Compliance Group.

4. Step 1: Initiating the audit

The performance of audits follows the audit schedule prepared by the Compliance Group and adopted
by the GMDP IWG. The actual audit starts after the official notification by the EMA.

4.1. Objectives

The objectives of the audits in the JAP scheme are:

 to assess compliance with EU GMP legislation and guidelines;

 to check compliance with the Compilation of Union Procedures on Inspections and Exchange of
Information;

 to conduct observed inspection(s).

4.2. Scope

Each individual audit is based on a clearly defined scope. Four types are possible:

Initial audit (full scope): This initial confirmation of equivalence covers all elements of the GMP
compliance programme as defined in the JAP Audit checklist and the JAP Observed inspections checklist.
The initial audit normally consists of a desk-top assessment, an on-site visit and observed inspections.

Re-audits:

 Triggered on-site audit based on risk criteria including intrinsic risks such as the number of
companies to be inspected by the GMP inspectorate and the number of critical manufacturers, the
number of critical indicators that were not met at the previous audit, a major reorganisation of the
GMP inspectorate or Medicines Agency or failure in the maintenance of equivalent standards. The
scope of such an audit is determined by the Compliance Group and adopted by the GMDP IWG and
may be limited to certain elements of the JAP Audit checklist.

 Regular audit after 5 years unless a triggered audit has been performed, based on risk criteria
including intrinsic risks such as the number of companies to be inspected by the GMP inspectorate
and the number of critical manufacturers, the number of critical indicators that were not met at the
previous audit, a major reorganisation of the GMP inspectorate or Medicines Agency or failure in
the maintenance of equivalent standards. The scope of such a default audit (full or partial scope) is
determined by the Compliance Group and adopted by the GMDP IWG.

 Desktop audit consisting of a self-assessment by the GMP inspectorate based on the JAP Audit
checklist, replacing an on-site audit based on risk criteria including intrinsic risks such as an
acceptable outcome of the previous audit, all critical indicators met at the previous audit, no major

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 3/11
 reorganisation of the GMP inspectorate or Medicines Agency, no failure in the maintenance of
equivalent standards or no indications of major changes since the last audit from the MRA annual
reports’ review. The scope of such a desktop audit, i.e. full or partial scope, to complement a
regular audit, to replace a regular audit or upon specific reasoned request, is determined by the
Compliance Group and adopted by the GMDP IWG. The self-assessment is reviewed by an assigned
auditor who will report the outcome to the Compliance Group. The Compliance Group will evaluate
the outcome and consult the GMDP IWG on the necessity for a triggered full or partial on-site
audit. There should be not more than 1 desktop audit between regular, on-site audits.

4.3. Feasibility of the audit

The Compliance Group agrees with the auditee and the audit team the scope of the audit, the
resources necessary to conduct the audit such as the number of auditors and number of observed
inspections. The size of an audit team should be proportionate to the audit scope, but in general it
should not exceed the numbers of persons working at the GMP inspectorate to be audited. The
participation for auditors-in-training and/or observers is agreed with the auditee and the Compliance
Group.

4.4. Establishing the audit team

The size and composition of the audit team is related to the:

 audit objective(s), scope, location, duration;

 competence requirements (e.g. language skills, technology);

 size of the GMP inspectorate to be audited;

 observed inspection(s) if conducted.

4.5. Notifying the auditee

The Compliance Group Secretariat (EMA) sends the formal audit notification to the auditee and the
audit team after adoption of the audit schedule by the GMDP IWG, including the audit team
composition and the audit date, using the JAP Audit notification template.

The lead auditor contacts the auditee to establish communication channels, requests documentation
and historical records, if needed, and initiates the arrangements for the audit.

The documentation necessary for the audit, previous audit report, self-assessment as per the JAP Audit
checklist and other relevant documents are subject to an initial review by the audit team.

The documentation is reviewed for adequacy taking into account the size and complexity of the GMP
inspectorate in order to determine readiness for the audit.

If the documentation is found to be inadequate to start the audit, the auditee is informed and the audit
is postponed until the supplying of the necessary documentation. In case of difficulties, the Compliance
Group could be involved for helping to solve them.

The language used during the audit is English unless otherwise formally agreed between the auditee
and the audit team. In case that it would be not possible to perform the audit in English, arrangements
for interpretation should be planned for as necessary including any document translations. In this case,
an individual with technical expertise from the audited agency if possible should provide translation as
required. The lead auditor and the auditee should agree before the audit if translations of documents

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 4/11
and to which extent are necessary. It is the responsibility of the auditee to translate the documents.
The audit report is always written in English.

5. Step 2: Preparing the on-site auditing activities

5.1. Audit plan

The lead auditor, together with the other auditors prepares the audit plan (see JAP Audit plan
template), which is reviewed and accepted by the auditee.

The audit plan includes:

 the audit objectives and scope;

 the date and place where the audit is to be conducted;

 the identification of functional units to be audited;

 the identification of the individuals within the auditee having significant direct responsibilities for
and in the units to be audited;

 the expected time and duration for audit activities, including meetings with auditee’s management,
observed inspections and audit team meetings;

 the working and reporting language of the audit including any translation arrangements;

 the identification of roles and responsibilities of auditors and any observers and accompanying
persons;

 the confidentiality requirements for observed inspection(s) and for the audit in relation to all
participants including observers .

The amount of details provided in the audit plan depends on the audit scope and objectives. The audit
plan is adapted to suit the size and complexity of the auditee.

5.2. Audit team work assignments

The lead auditor assigns to each member of the team responsibility for audit specific elements and
agrees who will act as their back-up. Such assignments take into account the efficient use of the
resources. Changes to the work assignments can be made to ensure the achievement of the audit
objectives.

6. Step 3: Performing the on-site auditing activities

6.1. Opening meeting with the auditee

An opening meeting is held with the auditee including its management. The lead auditor conducts the
meeting and the following list of items is considered:

 confirmation of the audit scope and objectives;

 introduction of the audit team and the auditee and encouragement of active participation in the
audit;

 introduction of any observers and auditors-in-training, including an outline of their roles, reasons
for attendance and permitted activities;

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 5/11
 review of the audit plan;

 the audit timetable and other relevant arrangements with the auditee, such as the time and date of
the closing meeting, any interim meetings between the audit team and the auditee management,
and any late changes;

 overview of the way to conduct the on-site auditing activities and observed inspections;

 possibility of identifying best practice and if applicable, where approved by the auditee, to share
these with the EEA inspectorate network;

 identification of the formal communication channel between the audit team and the persons
responsible for functions to be audited, and any resources and facilities needed by the audit team;

 confirmation of translation arrangements;

 confirmation of matters relating to confidentiality;

 confirmation that during the audit, the auditee should be kept informed of progress and, if the
objectives appear to become unattainable, the audit team will discuss the reasons and the possible
adaptations with the auditee, as necessary.

The opening meeting may be followed by a short introduction (30 minutes) by the auditee regarding its
status, structure, responsibilities and key personnel.

6.2. Collecting information

Information is obtained in different ways from several sources such as:

 interviews;

 observation of activities (as observed inspections) and the surrounding work environment and
conditions;

 internal documentation;

 records, reports, meeting minutes, webpages on the external website and the intranet.

Interviews are an important means of collecting information and will be carried out in a manner adapted
to the situation and person interviewed. The auditor will consider the following:

 in order to obtain representative information, persons from different levels within the auditee are
interviewed during the audit, especially those persons performing activities under consideration;

 the interview is performed at the normal workplace of the interviewed person, if possible;

 every attempt is made to put the interviewed person at ease prior to the actual interview;

 the interviewed persons are asked to describe the nature of their work and how it is carried out, or
to describe a particular issue under consideration;

 the results of the interviews are summarised and any conclusions drawn are verified where
possible.

Examples of best practice if identified should be noted and discussed with the auditee, including their
willingness or otherwise, to share these with other inspectorates.

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 6/11
6.3. Evaluating evidence

The information collected during the audit is verified or confirmed by the auditors, using alternative
sources where possible. Such information, after verification, can be considered objective evidence and
evaluated against specified requirements. Information that appears relevant but cannot be verified are
identified and recorded. Copies of working documents, etc. may be requested during the audit, if
necessary.

Evidence suggesting non-conformities is noted and investigated if significant, and within the scope of
the audit.

The observed inspections are performed following the JAP Procedure for observing inspections.

If a significant concern arises which is outside the scope of the audit, it is noted and shared within the
audit team, for possible communication to the auditee separately from the audit report.

The information collected during an audit is inevitably only a sample of the information available, since
an audit is conducted during a limited period of time and with limited resources. There is thus an
element of uncertainty inherent in all audits. The audit team reviews its findings at suitable stages
during the audit, and in particular prior to the closing meeting with the auditee.

Conformities and non-conformities are recorded in adequate detail and in a manner, which is easily
understood by the auditee. Reference is made to the underlying quality documents.

Non-conformities are reviewed together with appropriate auditee representatives to obtain

acknowledgement of the factual basis. The auditee’s acknowledgement indicates that the facts
contained in the non-conformity are accurate, and understood. Every attempt is made to resolve any
divergence of opinion concerning the facts, and unresolved points are recorded.

6.4. Closing meeting preparation

The audit team confers prior to the closing meeting in order to:

 review result of the audit against objectives and scope;

 reach team consensus on the results, non-conformities and conclusions;

 agree roles and tasks for the closing meeting;

 discuss observations and recommendations for improvement (opportunities for improvement);

 discuss any examples of best practice, if applicable.

Observers, if any in the audit team, are invited to participate in this preparation meeting.

6.5. Closing meeting with the auditee

A closing meeting is held with the auditee including its management. The lead auditor conducts the
meeting. The purpose of this meeting is to present the audit findings and the observations raised for
non-conformities in a manner ensuring that they are clearly understood and acknowledged by the
auditee.

The lead auditor should present the audit team’s conclusions in line with stated audit objectives and
scope. Any outstanding diverging opinions between the audit team and the auditee are discussed and if
possible resolved. If not resolved, both opinions are recorded. If agreed between the audit team and
the auditee, the lead auditor may present the team’s recommendations for improvement (opportunities

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 7/11
for improvement), emphasizing that these recommendations are not binding. The audit team should
present examples of best practice if identified and confirm the auditee’s agreement (or otherwise) to
share with other inspectorates.

7. Step 4: Reporting on the audit

7.1. Report preparation

The lead auditor prepares the audit report using the JAP Audit report template and ensures that the
drafting of the report is fairly distributed amongst the team. He/she is responsible for the collection of
the different parts and preparation of the audit report. The audit team ensures the accuracy and
completeness of the audit report.

7.2. Report content

The audit report provides an accurate record of the audit findings and conclusions. These can include
whether:

 the system conforms to the specified requirements;

 the system is properly implemented and maintained;

 the implemented quality system is effective in meeting stated policy and objectives.

The audit report lists in sufficient detail:

 observations raised for non-conformities;

 recommendations for improvement (opportunities for improvement);

 examples of best practice, if identified (in an annex).

An observation is raised in case an indicator from the JAP Audit checklist is not met or partially met. A
CAPA plan for such observation is required from the auditee in the responses to the preliminary audit
report. The audit team evaluates this CAPA plan and includes the outcome of the evaluation in the final
audit report. The implementation of the CAPA plan can be verified before the finalisation of the audit
report if the deadline for the CAPAs and for the report allows it or, if not, after the finalisation of the
audit report.

An opportunity for improvement can be recommended if an indicator from the JAP Audit checklist is
met or if an indicator is not or partially met where already an observation is raised. A CAPA plan for
such recommendations from the auditee is possible and acceptable in the responses to the preliminary
audit report. The audit team evaluates this CAPA plan and includes the outcome of the evaluation in
the final audit report. The implementation of the plan can be verified before the finalisation of the audit
report if the deadline for the CAPAs and for the report allows it. If not, the implementation can be
acknowledged at the next audit. There is no follow-up of opportunities for improvement by the
Compliance Group.

The lead auditor ensures that the indication of fulfilment of indicators in the audit report is the same as
reported in the JAP Audit checklist.

In case major difficulties were encountered during the audit with a possible conclusion of non-
compliance of the auditee, the lead auditor contacts the Compliance Group to seek support in the
preparation of the preliminary audit report. The audit report can include a recommendation for a follow-
up audit and/or a referral to the Compliance Group for the follow-up of a particular CAPA.

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 8/11
7.3. Report approval and distribution

Each auditor prepares their part of the preliminary audit report and its annexes and sends it to the lead
auditor. The lead auditor consolidates these partial reports into a complete preliminary audit report with
its annexes.

This preliminary audit report and its annexes are sent simultaneously to each auditor for formal
comments. Each auditor sends their comments to the lead auditor.

After these comments have been received, the lead auditor finalises the preliminary audit report and its
annexes, signs the last page on behalf of the audit team, notes the date of issue of the report and sends
it to the auditee and to the Compliance Group secretariat (EMA) at the latest 8 weeks after the closing
meeting with the auditee.

The auditee prepares its responses and a CAPA plan to address the observations and opportunities for
improvement with clear deadlines for implementation within one month of receipt of the preliminary audit
report (delays could be acceptable under reasonable request, such as holidays, urgent matters within
the auditee, ….).

The auditee sends these responses and CAPA plan to the audit team which has 2 weeks to review and
comment.

The lead auditor combines these comments and evaluations of the CAPA plan to create the final audit
report with a clear conclusion on the compliance with EU GMP legislation and guidelines and JAP
requirements in liaison with the other auditors. The lead auditor notes the date of issue and signs the
final audit report on behalf of the audit team. The final audit report (including any CAPA) and its
annexes are sent to the auditee and the Compliance Group secretariat (EMA) within 2 weeks. In
addition, the lead auditor sends the documentation of all relevant communication to the Compliance
Group secretariat (EMA) for archiving purposes.

If no conclusion on compliance of the auditee or agreement on a CAPA plan can be reached by the
audit team, this should be described clearly in the final audit report where the conclusion on
compliance and/or the follow-up on the CAPA plan can be referred to the Compliance Group. If
required, the Compliance Group can further escalate the issue to the GMDP IWG.

A sponsor assigned by the Compliance Group performs a detailed review of the audit final report and
its annexes as relevant and contacts if necessary the lead auditor for technical clarifications on the
report. If proposed by the sponsor, the lead auditor considers preparing an updated final audit report
as appropriate.

The Compliance Group reviews the final audit report and adopts it on behalf of the GMDP IWG.
Arrangements should be made by the Compliance Group to share any examples of best practice if
applicable across the EEA GMP inspectorate network where these have been authorised for sharing by
the auditee.

The Compliance Group secretariat (EMA) lists the CAPAs to be followed-up after the finalisation of the
audit report in a follow-up document using the JAP Follow-up on CAPA implementation template.

The final audit report and its annexes are archived in electronic form (no archiving of paper copies) at the
EMA. These records will be kept confidential. Copies will be issued only upon request from an EEA
competent authority after information to the auditee.

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 9/11
8. Step 5: Audit completion
The audit is completed when all activities in the audit plan have been concluded, including the adoption
of the final audit report by the Compliance Group.

9. Step 6: Follow up
CAPA implementation can be verified:

 administratively by checking the documented evidence supporting the implementation of the CAPA
by the audit team during the preparation of the audit report or by the audit team in liaison with the
Compliance Group if the deadline for implementation is after the finalisation of the report;

 by a follow-up audit.

The auditee is fully responsible for determining and initiating any CAPA needed to deal with non-
conformities (observations). CAPAs and subsequent follow-up actions, which may include internal
audits, are completed within an agreed period of time.

Within the agreed time frame for implementation, the auditee provides the audit team as well as the
Compliance Group secretariat (EMA) with evidence of implemented CAPA activities. The audit team or
the Compliance Group in liaison with the audit team when the follow-up was referred to the
Compliance Group, assess the evidence and concludes on the fulfilment of the JAP requirements. Once
resolved, the audit report is complemented with an addendum to document the follow-up measures,
the evaluation of the implementation of CAPAs and the final audit conclusion by using the JAP Follow-
up on CAPA implementation template. If the information is not received in due time, the Compliance
Group will notify the auditee and the GMDP IWG, who decides on the need for involvement of the
European Commission (EC) and the Heads of Medicines Agencies (HMA).

In case no clear conclusion on compliance was included in the final audit report, the Compliance Group
assures in agreement with the audit team that a final audit conclusion is communicated to the auditee
after finalisation of all CAPA activities.

The need and timing of any follow-up audit will be decided by the Compliance Group and adopted by
the GMDP IWG.

10. Auditors’ expenses

If costs are not covered by the European Commission or any other body, the auditee pays for flights,
accommodation and meal costs of the auditors and any subject matter expert. The auditee pays for a
night before the audit starts if necessary to allow the audit team to arrive in time for the start of the
audit and/or for a night after the visit if the time that the visit ends does not allow the auditors to take
a flight home at a reasonable time. Costs for auditors-in-training, observers, MRA-partners and PIC/S-
members are covered by their own agency.

Internet access for the audit team should be made possible at the audited agency and in their hotel
room to work during the evenings.

Reference documents
 JAP Programme.

 JAP Procedure.

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 10/11
 JAP Audit plan template.

 JAP Audit notification template.

 JAP Audit checklist.

 JAP Audit report template.

 JAP Confidential agreement for audits template.

 JAP Procedure for observing inspections.

 JAP Observed inspections checklist.

 JAP Follow-up on CAPA implementation template.

Joint Audit Programme for EEA GMP inspectorates

EMA/694531/2017 Page 11/11