The novel coronavirus disease 2019 (COVID-19) pandemic has every industry seeking out ways to accomplish time-sensitive activities using a number of virtual approaches. This is certainly true in the biopharmaceutical sector, in which good manufacturing practice (GMP) audits are required to manufacture medicinal drug products for human use. Examples include supplier/vendor audits, mock inspections, and preapproval and prelicense inspections (PAIs and PLIs) conducted by sponsors and regulatory authorities. Auditors usually perform such activities on site and only sometimes remotely. In the latter case, the process typically involves reviewing documents that are shared electronically. With the current embargo on travel and the need for “social distancing,” on-site visits are impossible. Companies and auditors alike now need to adopt new methods for conducting “on-site” audits without being physically present. We refer to this concept as a virtual audit. Here, we propose a process and provide guidance for a virtual GMP audit that achieves the same main goals as an on-site audit.

“Haves” and “Don’t Haves”
We propose starting by outlining the steps associated with a conventional on-site audit and then considering how to achieve the same experiences and objectives. Companies also should brainstorm activities that will be difficult to execute virtually and then develop workarounds to satisfy the intended objectives. This initial analysis identifies the “haves” and “don’t haves” for transitioning to a virtual approach. Where workarounds are difficult, a risk-based approach must be considered to assess problems associated with the “don’t haves.” The next step is to determine risk categories and follow-up actions that might be required after completing a virtual audit.

Communication Remains Critical
Communication between auditor and auditee is always important. But a virtual audit increases the need for significant preinspection communication and planning. Both parties must agree on goals, methods, and outcomes. A rehearsal should be conducted to test applications and equipment in the virtual-audit environment. Factors as straightforward as time-zone differences are important to consider when an auditor is working from a distant location.

Preparation
Legal Contracts: Because virtual audits are conducted digitally, additional language must be added to conventional confidentiality disclosure agreements (CDAs). Activities performed during a virtual audit might require additional legal permission relative to what typically is required during an on-site inspection. Hence, updates to terms and conditions outlined in legal contracts with an auditee’s organization must be reviewed closely to ensure that all necessary information and systems can be accessed during a virtual audit. Video feed (live or recorded) of confidential information to an off-site auditor is a legitimate legal concern. Furthermore, an auditor might need to request a separate information-technology (IT) account with access to an auditee’s shared data space. Ensuring that both parties understand the actions required to conduct a virtual audit will prevent complicating issues from arising during the inspection.

Requests for Electronic Documentation: Below is a list of electronic documents that auditors might request in preparation for a virtual audit. It includes all documents needed for a conventional on-site review:

• quality manual
• site master file including a building layout; process, waste, and personnel flows; and a heating, ventilation, and air conditioning (HVAC) plan
• standard operating procedures (SOPs) for specific functions related to the audit — e.g., manufacturing, quality control (QC), and warehousing
• training records for personnel involved in audit-related activities
• calibration and qualification protocols and reports for equipment involved in relevant production/analytical testing
• lists of change controls, deviations, nonconformances, and corrective and preventative actions (CAPAs) that have occurred in the previous six months.

Video Communication: Video communication is critical to performing a virtual audit. It is recommended that an employee of an auditee’s company act as the eyes of the virtual inspector. Multiple aspects should be considered such as video conferencing and use of live web streams.

Videoconferencing already is used extensively throughout the industry to share information in a live setting during everyday meetings. In a virtual audit, an auditor may request that a company share confidential documents that typically are provided only during an on-site audit. To enable such sharing, it is critical to ensure that the videoconferencing software assures confidentiality and is safe from hacking.

A live stream can be accomplished by outfitting an employee with a webcam. That employee would perform a facility walkthrough and thus enable auditors to interview facility operators and employees in a live setting. Again, it is crucial that the video-streaming device is secure.

Audit Plan: It is crucial that an audit schedule is agreed upon before initiation of the inspection to ensure that relevant employees will be available.

Conducting the Audit
Documentation Review: Depending on the amount of information shared electronically before an inspection, review of documentation and question-and-answer (Q&A) sessions during a virtual audit should be planned accordingly.

If an auditor receives all requested documents in advance, virtual inspection can proceed primarily to Q&A sessions with relevant employees. However, as with typical on-site audits, auditors are likely to request additional documents to review during Q&A. Those materials can be shared using live videoconferencing or provided using a secure account established before the audit. If an auditor did not receive any documents prior to audit, live viewing will be required. Such an approach would allow both parties to review documents in real time, allowing for a more interactive Q&A session.

Although the first type of virtual inspection would allow for a more efficient and probably shorter audit, the second could yield a more interactive and informative audit.
Facility Walk-Through: On-site audits typically include a facility walk-through to observe relevant operations (e.g., warehousing, manufacturing, testing, and packaging/labeling operations). Companies have multiple options for providing a virtual walk-through.
Advance recordings of operations may be shown through videoconferencing. The disadvantage of this approach is that certain operations could appear “staged” or “static” and not reflective of an active work environment.

Live video feed of operations is the preferred approach for a virtual walk-through. It has been used previously when auditors are on site viewing operations in access-restricted suites that offer limited viewing space from adjacent corridors. However, live streaming of operations to off-site auditors is a different approach and requires rigorous consideration of security and confidentiality. Further, it is an entirely new concept to most auditors. Auditors might need additional training for performing virtual audits. Therefore, careful planning is required to ensure that all aspects of an operation can be viewed — and thus to achieve an informative and successful audit.

Audit Closure
Following completion of a virtual inspection, auditor and auditee will review and discuss an audit summary, including regulator findings and action items. All follow-up items will be agreed upon, and a timetable will be established. Audit results typically are structured into three categories:

• acceptable — minor deficiencies might be noted
• conditionally accepted — inspection identifies problems that require auditee response(s) before “acceptable” status is issued
• rejected — audit reveals a facility to be at high risk.

Because a virtual audit cannot substitute completely for an on-site process, some additional risk beyond that associated with an on-site audit will remain. As a result, a virtual audit would have a high likelihood of yielding only “conditionally accepted” grades upon initial conclusion. Additional risks associated with a company’s “don’t haves” during a virtual audit often can be satisfied by follow-up audit responses and additional data from auditees.

Responding to a Complex Situation
The virtual-audit process that we propose is not equivalent to an on-site audit conducted by an experienced inspector. It is at best a workaround that could, if permitted by regulators, allow the biopharmaceutical industry to maintain timelines and move products through the development pipeline. A virtual audit is not a substitute for one conducted on site, but rather a response to difficulties imposed by current travel restrictions and social-distancing directives.

During this challenging pandemic, our industry must move forward. Patients need access to biotherapeutics that are in development. As life-science professionals, we need to innovate and share our ideas to generate best practices in a difficult regulatory climate. We look forward to reaching out to colleagues to share our collective experiences.

Corresponding author Lotte McNamara is managing director (lmcnamara@bdo.com), and Tony Huynh is director of the BioProcess Technology Group, part of BDO USA, One International Place, Boston, MA 02110; 1-617-422-0700; https://www.bdo.com.