| Audit Duration | 2-3 days (solo) / 1.5-2 days (team) |
|---|---|
| Key Standard | ICH Q7 (GMP for APIs) |
| FDA Reference | Program 7356.002F (2025) |
| Industry Guide | APIC How-to-do V17 (2024) |
| UDCA CAS | 128-13-2 |
| Audit Frequency | Every 2-3 years for high-risk APIs |
Auditing a UDCA API manufacturer is the single most consequential step in building a reliable bile acid supply chain. For procurement teams, the decision to onboard a new supplier can cost $50,000-150,000 in qualification alone and lock in supply relationships for years. A structured GMP audit — built around ICH Q7 and aligned with FDA Program 7356.002F — turns a subjective factory visit into a repeatable, defensible quality assessment.
UDCA production involves a multi-step synthetic route: cholic acid extraction from bovine bile, followed by selective epimerization of the 7α-hydroxyl group, and final purification to pharmaceutical grade. Each step introduces quality risks that a paper-based DMF review cannot catch:
Before stepping onto a plane, complete these six steps. They will determine whether an on-site visit is even warranted:
Organized by the six GMP systems per ICH Q7 and FDA 7356.002F. Each item includes what to look for and why it matters for UDCA specifically.
| # | Audit Item | UDCA-Specific What to Check |
|---|---|---|
| 1.1 | Quality Unit Independence | Confirm the Quality Unit reports to senior site management, not production. Check that QA — not the plant manager — signs every UDCA batch release. Verify that the Quality Unit is copied on all customer complaint correspondence. |
| 1.2 | Annual Product Quality Review (PQR) | Review the last two PQRs for UDCA. They must cover: batch yield trends, impurity profile trends (CDCA, lithocholic acid), OOS/OOT events and investigations, customer complaints, stability data, and changes to process or equipment. Look for gaps — a PQR that skips impurity trend charts is incomplete. |
| 1.3 | Change Control | Ask: "When did you last change the cholic acid supplier, the epimerization catalyst, or the recrystallization solvent?" Then check whether each change went through formal change control with a risk assessment before implementation. Post-implementation changes without prior approval are a major finding. |
| 1.4 | Deviation & CAPA System | Request the deviation log for UDCA production over the past 12 months. Pick 3 deviations and trace them through investigation → root cause analysis → CAPA → effectiveness check. If any CAPA is still "open" after 12 months, the system is not working. |
| 1.5 | Internal Audit Program | Review the internal audit schedule and the last two completed audit reports. Verify that (a) the auditor was independent of the area audited, (b) findings were tracked to closure with documented verification, and (c) audit scope included all six GMP systems over a defined cycle. |
| 1.6 | Quality Risk Management (QRM) | ICH Q9(R1) requires QRM to be applied, not just documented. Ask for the risk assessment that justifies the UDCA API Starting Material definition — why was cholic acid selected as the ASM rather than an earlier intermediate? Look for a real FMEA or HACCP analysis, not a one-page checklist. |
| # | Audit Item | UDCA-Specific What to Check |
|---|---|---|
| 2.1 | Contamination Prevention | Walk the epimerization and purification areas. If the facility produces multiple bile acids (CDCA, cholic acid, TUDCA), verify physical or temporal segregation. Check pressure differentials between rooms — purification suites should be positive to corridors. Look for open transfers of powder between vessels. |
| 2.2 | Cleaning Validation | This is the #1 finding in bile acid facility audits. Request the cleaning validation protocol for the epimerization reactor. Verify that: acceptance criteria use health-based exposure limits (PDE/ADE), worst-case product (UDCA → CDCA cross-contamination) is validated, and recovery studies document swab recovery factors. If a facility runs 3+ bile acid campaigns on the same line without dedicated cleaning validation per product changeover, this is a critical deficiency. |
| 2.3 | Utilities Qualification | Purified water is used in the final UDCA recrystallization. Review water system validation, ongoing monitoring data, and alert/action limit trends. A single out-of-specification TOC or conductivity result on the day of the audit, without investigation, is serious. |
| 2.4 | Equipment Maintenance & Calibration | Check the maintenance log for the epimerization reactor — especially seals and temperature probes. The 7α→7β conversion requires precise temperature control (±2°C). An uncalibrated temperature probe or a leaking reactor seal can shift the CDCA impurity level by 0.5% or more. |
| 2.5 | Environmental Monitoring | The final purification step (recrystallization and drying) should occur in an ISO 8 (Class 100,000) or better environment. Review particulate and microbial monitoring data. Check that alert and action limits are defined and trending is performed. |
| # | Audit Item | UDCA-Specific What to Check |
|---|---|---|
| 3.1 | API Starting Material Definition | Under ICH Q11, the manufacturer must scientifically justify why cholic acid is the API Starting Material. Ask for the justification document. It should address: structural complexity of cholic acid vs UDCA, impurity purge capability across the synthetic steps, and analytical methods available to characterize cholic acid. |
| 3.2 | Cholic Acid Supplier Qualification | Cholic acid from bovine bile is the critical raw material. Request the supplier qualification file. Does the manufacturer audit their cholic acid supplier? Do they test each incoming lot for identity, assay, and impurities — or rely on the supplier's CoA? A manufacturer that cannot demonstrate control over their starting material supply chain cannot reliably produce consistent UDCA. |
| 3.3 | Incoming Material Testing | Observe how cholic acid lots are received, sampled, and quarantined. Check that identity testing follows a statistically valid sampling plan per ANSI/ASQ Z1.4. Ask for the last three incoming cholic acid CoAs and compare them against the manufacturer's own test results. |
| 3.4 | Solvent Management | UDCA synthesis typically uses ethanol, acetone, or ethyl acetate for recrystallization. Verify that solvents are pharmaceutical grade, tested on receipt, and stored in dedicated, labeled tanks. Check residual solvent data on finished UDCA CoAs against ICH Q3C limits — ethanol must be ≤5,000 ppm per the EP monograph. |
| 3.5 | Supplier Performance Monitoring | Request the supplier scorecard for cholic acid vendors. It should track: on-time delivery, CoA conformance rate, quality complaints, and audit status. A supplier that has delivered 3 non-conforming lots in 12 months without a corrective action plan is a supply risk. |
| # | Audit Item | UDCA-Specific What to Check |
|---|---|---|
| 4.1 | Batch Records | Review 3 completed batch production records (BPRs) for UDCA. Trace every step: cholic acid dispensing → epimerization → extraction → recrystallization → drying → milling → packaging. Check for: contemporaneous entries (no retrospective filling), second-person verification of critical steps, and documented yields at each stage. UDCA yield from cholic acid is typically 35-45% — investigate any batch outside this range. |
| 4.2 | Critical Process Parameters (CPPs) | The epimerization reaction has 3 CPPs: temperature, pH, and reaction time. Verify that each CPP has a defined range, is continuously monitored and recorded, and that excursions are investigated. Ask: "Show me the last time the epimerization temperature went outside the validated range and what you did about it." |
| 4.3 | Process Validation | Request the process validation report (Stage 2 / PPQ). It should demonstrate consistent UDCA quality across at least 3 consecutive batches at commercial scale, with data on: yield, assay, CDCA content, lithocholic acid content, other individual impurities, specific rotation, and residual solvents. If the validation report is older than 5 years, ask for continued process verification (Stage 3) data. |
| 4.4 | Reprocessing vs Reworking | This distinction is widely misunderstood in API facilities. Reprocessing = repeating a validated step (e.g., second recrystallization within validated parameters) — acceptable if justified. Reworking = using a different, unvalidated process to salvage an OOS batch — requires full validation and regulatory notification. Ask: "Have you ever reprocessed or reworked a UDCA batch? Show me the documentation." |
| 4.5 | Yield Monitoring | UDCA yield from cholic acid is a direct indicator of process control. Review yield trend charts for the last 30 batches. A sudden 5% drop in yield is as significant as an OOS impurity result — it may indicate an uninvestigated process deviation, a cholic acid quality issue, or equipment malfunction. Check that yield trends are included in the annual PQR. |
| # | Audit Item | UDCA-Specific What to Check |
|---|---|---|
| 5.1 | Analytical Method Validation | The HPLC method for related substances (CDCA, lithocholic acid) is the most critical assay. Review the method validation report. It must demonstrate specificity (baseline separation of UDCA from CDCA and lithocholic acid), sensitivity (LOQ ≤0.05% for each impurity), linearity (R² ≥0.999), and precision (RSD ≤2.0%). A poorly validated method can miss an OOS impurity level. |
| 5.2 | Impurity Profile Control | Request the complete impurity profile for the last 5 batches. Beyond CDCA and lithocholic acid, look for: cholic acid (starting material carryover), 7-ketolithocholic acid (oxidation product), and any unidentified peaks above 0.05%. A manufacturer that cannot identify and control every impurity above the identification threshold is not ready for regulated markets. |
| 5.3 | OOS/OOT Investigations | Request the OOS log for the past 2 years. Pick 3 investigations related to UDCA and trace the entire process: Phase 1 (laboratory error check) → Phase 2 (full investigation with hypothesis testing) → root cause → CAPA. The most common OOS in UDCA testing is elevated CDCA — check whether CDCA OOS events always trigger a review of epimerization conditions. |
| 5.4 | Reference Standards | UDCA reference standard should be a qualified primary standard (USP or EP). Verify the certificate, storage conditions, and requalification schedule. The working standard used for routine testing must be qualified against the primary standard and requalified annually. |
| 5.5 | Stability Testing | UDCA is hygroscopic and can degrade under humid conditions. Review the stability protocol: ICH climatic zones covered, packaging configuration (25 kg drum with PE liner?), testing frequency, and key stability-indicating parameters (assay, CDCA content, water content). Check at least one batch with 36-month data — UDCA is stable under proper storage, but a rising CDCA trend at 25°C/60% RH indicates insufficient packaging. |
| # | Audit Item | UDCA-Specific What to Check |
|---|---|---|
| 6.1 | ALCOA+ Compliance | Pick the HPLC system used for UDCA related substances testing. Check: (a) each user has a unique login (no shared accounts), (b) audit trail is enabled and reviewed, (c) manual integrations are justified with a comment, (d) no "trial injections" or deleted sequences before the official run, (e) system time is synchronized and cannot be changed by the analyst. If the HPLC software allows data deletion without a trace, this is a critical data integrity finding. |
| 6.2 | Audit Trail Review | Ask the QC manager: "Show me your audit trail review process for the UDCA HPLC system. When was the last review performed? What did you find?" A blank stare or a response that "the IT department handles that" means audit trails are not being reviewed. FDA expects documented evidence of periodic audit trail review. |
| 6.3 | Backup and Data Retention | Verify that electronic raw data (HPLC chromatograms, electronic batch records) is backed up daily and stored off-site or in a fireproof server room. Ask to see the most recent successful backup verification test. UDCA batch data must be retained for at least 1 year after the expiry date of the batch, or longer per local regulations. |
| 6.4 | Document Control | Check that SOPs, specifications, and batch record templates are version-controlled, approved before use, and that obsolete versions are removed from active use areas. The simplest check: ask an operator in the purification area to show you the current SOP for recrystallization. Then ask QA for the master copy. They should match. |
The epimerization step is the heart of UDCA quality. If the manufacturer limits access to this area, they are likely hiding undocumented process changes, unvalidated equipment, or inadequate cleaning between campaigns.
A manufacturer that cannot explain why cholic acid is the ASM — or worse, has never written a justification document — has not applied ICH Q11. This is a fundamental GMP gap and a frequent regulatory finding.
This is the single most common data integrity finding in API QC laboratories. If every analyst logs in as "QC" or "Admin," individual accountability is impossible. Walk away.
If CDCA levels have risen from 0.05% to 0.08% over 12 months with no documented investigation, the epimerization process is drifting and the manufacturer either does not know or does not care.
A legitimate GMP manufacturer keeps inspection reports (EIRs, 483 responses, EU GMP certificates) organized and accessible. Refusal or inability to share them is inconsistent with a transparent quality culture.
In multi-product facilities, UDCA often gets lumped into a generic "QA covers everything" arrangement. Without a QA person who understands bile acid chemistry and the EP monograph, quality decisions are made blindly.
"We buy from a trader" with no upstream visibility is not acceptable for your DMF. The manufacturer must know which slaughterhouses supply their bile and have veterinary certificates on file. TSE/BSE risk assessment depends on this traceability.
"Probable laboratory error" as the root cause for 5 consecutive OOS events, with no corrective action beyond analyst retraining, is a pattern. Real root causes require process investigation, not scapegoating the laboratory.
The audit does not end when you leave the facility. A structured close-out process separates professional procurement from checkbox compliance:
The post-2020 shift toward remote audits created a practical middle ground, but for UDCA API — a high-risk starting material for essential medicines — regulators increasingly expect on-site verification. Here is a practical framework:
| Scenario | Recommended Approach | Rationale |
|---|---|---|
| Initial supplier screening (new vendor) | Remote document review + video walk-through | Eliminates clearly unqualified candidates before committing travel budget |
| Re-audit of existing supplier (no major changes) | Remote if last on-site was within 2 years and no critical findings | Cost-effective for monitoring; risk-based per ICH Q9 |
| New supplier qualification for regulated market (FDA/EU) | On-site required | FDA and EU regulators expect on-site audits for initial qualification of high-risk API suppliers. Your ANDA/MA holder obligations are at stake. |
| Supplier changed manufacturing site or cholic acid source | On-site required | A site or supply chain change invalidates the previous audit. New facility, new process, new risks. |
| Follow-up on Critical CAPA closure | On-site required | Documentary evidence alone cannot verify that a data integrity or contamination risk has been resolved. |