How To Conduct Better GCP Audits (Even When You Feel Like An Impostor)

By Iain Pulley, director, Closed Loop Quality Ltd

How many of us drive to work every day? How many of us know the route so instinctively that we no longer think about where we have to go? It’s easy, right?

But what happens when we go to a new office? How many of us pore over maps to plot the route step-by-step? Or do we cheat and program the address into our global positioning systems (GPS), slavishly following every instruction, hoping it takes us to the right destination?

What happens, though, when we have to go somewhere, but we don’t exactly know where it is? What if we aren’t able to prepare extensively but only have a vague idea of where we are going? How do we ensure we reach the right destination?

Sounds nerve-racking, doesn’t it? Yet, this can often be the case in auditing.

A New Auditing Challenge

A few years ago, I found myself in such a scenario. I was working in a company as a good clinical practice (GCP) auditor, and if given an audit type within that area, I was more or less comfortable with what to do, as the subject areas were familiar and I knew what documentation to expect.

That all changed, however, when my local country quality head approached me one day and asked if I could assist with some mock interviews on the healthcare side of the business, in preparation for an external regulatory body audit. I said, “Sure.”

On the outside I was confident, but inside I had a gnawing doubt: I didn’t know what I was auditing. I had very little exposure to healthcare processes, and only a vague notion of what it was they actually did! So, how was I to go about preparing for a series of mock interviews?

My first instinct was to cram on the applicable healthcare processes, like many of us would in preparation for a typical GCP audit. But I didn’t have the time; l had a full workload of my normal day job to perform, which limited my scope for intensive preparation. And to top that, the list of prospective interviewees kept changing as names were added or removed, so I could not be 100 percent sure what processes I would need to review beforehand.

The Solution: Ask The Right Questions

So, what do to? It seemed I would struggle to perform the interviews, not knowing the subject area and with little time for intensive preparations. Now I had committed, I did not want to risk losing face in front of my peers, or disappoint my quality colleagues who were obviously looking to me to carry the quality assurance flag into the healthcare arena.

However, at this point I had something of a light bulb moment. Not something unique or new (because I am not that smart or lucky!), but more that something clicked in my mind regarding the approach to take. My older auditing colleague in the office had something of a reputation for their auditing style; they would seemingly do the minimal amount of preparation in the run-up (which at the time I found infuriating), yet during the audit would often ask the most pertinent question and uncover a process gap or risk. I had always chalked it up to them having been in the industry long enough to know how everything worked. But then I thought, maybe it isn’t that they know everything. Maybe it’s that they know the right question to ask!

With this in mind, I set about preparing for the interviews. I decided right away that rather than asking detailed questions, I would ask more general questions so interviewees would explain what they did (utilizing the classic five “whys” of auditing), and then ask for evidence of the process in action for verification. Their responses could also be compared against the process afterward to check whether the process was being followed. I also decided to focus on identifying during the mock interviews what quality looked like within the healthcare side of the business, how they ensured consistency, and how management maintained oversight.

I now had a game plan for proceeding with the interviews. But I could not wing it entirely, so I spent some of the remaining time doing some basic preparation, such as requesting the relevant company organograms, and reading the UK Code of Conduct so I had a rudimentary understanding of what was expected. I also prepared some basic cues to assist me in remembering what to ask during each interview.

Applying The Technique

The first day of interviews came, and it would be unfair to say I was not nervous about conducting them. I felt a real sense of impostor syndrome: Would my questions be too light; would my peers see through my questions and quickly realize I knew little regarding the subject area? But it was too late to back out, so there was nothing to do but get on with the interviews. I would be leading the interviews, but a colleague would also observe the interviewee for how they responded and what their body language displayed.

Into the first interview we went, and after some introductory questions to establish the interviewee’s role and background, I launched into identifying what they did, and how they did it. As I got more comfortable with the information, I started to go beyond skimming the surface of the process, asking deeper questions once I had an understanding of the process, and then bringing it back to whether there was evidence to support the process in action.

The first interview went well, with the questions I asked helping to draw from the interviewee a good picture of their processes and how work was performed. Some interesting items were identified where there was a lack of supporting documentation to verify the process described. Buoyed by this, I determined to push on with the questioning style, making some tweaks after each interview based on what we were hearing, and if there were subject areas we wanted to probe further during future interviews.

As we progressed, I realized that although I was not an expert in the subject matter, I knew what questions to ask to unlock information on the process. It also became clear that in the GCP world there is an established paper trail and that in some respects quality management systems are much more advanced than in other business areas. Most importantly, I realized I already unconsciously used this technique to a large degree during previous audits; however, I still approached audit preparation with the view of trying to know the process inside and out beforehand, rather than going with the flow.

Overall, the series of mock interviews went very well, and it got me thinking about how I might use this approach when preparing for future GCP audits. Many important risks and process gaps were identified for our organization during these interviews, all done with minimum prior knowledge and by simply applying a logical approach to understanding what was being covered. How do you balance the temptation to perform detailed and time-consuming preparations, with this new approach of asking general process-related questions?

I used these lessons learned in subsequent system audits to further develop my approach. I found a balance whereby as long as I had a broad understanding of the key processes, I could use that as a basis for asking general questions to obtain more information on aspects of specific processes. It greatly cut down the amount of preparation time required beforehand and allowed me to think more about what I wanted to achieve during the audit rather than focusing on verifying every process detail.

For example, I utilized the above method in an audit for a vendor that provided trial management systems to our company. The audit scope was very broad, and I only had a limited understanding of the company processes being audited. However, by applying what I had learned previously, we came out with some interesting audit results and identified for example issues with how the organization handled quality issues and trained on sponsor-specific processes. I have since used this approach in several system audits where GCP processes were being used in conjunction with other GxP disciplines, such as computer system validation (CSV) and good pharmacovigilance practice (GvP).

Break Free From Silos

In summary, there is always a risk that auditors become too comfortable in their knowledge areas. As a result, we become overly dependent on this knowledge to tell us when something is wrong when auditing, rather than trusting our methodology, experience, and instincts.

To fully develop our auditing style, we should constantly push into new subject areas to the extent that we take our auditing style back to basics and ask ourselves what it is that we do. In many organizations, auditing is siloed into different technical specialties, and it is often perceived as a risk when an auditor has to audit outside of their area of expertise, in case real deficiencies are not identified.

However, what if this actually holds back our development as auditors? What if our strength as auditors is not as technical experts but as experts in process interrogation to identify what needs to be verified? Audits in the GCP arena are becoming increasingly complex, and frequently overlap other GxP disciplines as processes and systems grow more sophisticated. So, if companies are to avoid sending large specialist auditing teams to perform more cumbersome system audits (infuriating their auditees), then one left-field approach could be to create an ethos within auditing departments that encourages and empowers their individual auditors to break free of their specialist bonds and develop an auditing methodology that enables effective interrogation of most processes, even if they may not be a specialist in those areas.

About The Author:

Iain Pulley, director of Closed Loop Quality Ltd, is a freelance GCP auditor with over 12 years of experience auditing both global pharmaceutical organizations and clinical trials. With a B.Sc. (Hons) in product design, he is passionately process-oriented and places strong emphasis on ensuring quality management systems add value to achieve right-first-time results. Pulley has also successfully assisted and coached various organizations in preparation for regulatory authority inspections. His interests in his spare time include skiing, woodwork, and winemaking. You can email him at iain.pulley@closedloopquality.com or connect with him on LinkedIn.