GxPRoster

Hire guide: vetting an independent GxP or regulatory consultant

Neutral, practical checks you can run before engaging any consultant – including firms listed here. Nothing below is legal advice; your own quality unit remains accountable for decisions.

1. Define the scope before you search

  • Write down the regulation set (e.g. 21 CFR 210/211, EU GMP / EudraLex Volume 4, ICH E6, ISO 13485 / QMSR), product type, and deliverable (audit report, CAPA plan, validation package, dossier section).
  • Decide whether you need on-site presence (sterile operations, mock inspections, QP certification on site) or whether remote work is acceptable.

2. Verify claimed qualifications at the source

  • Auditor certifications – ASQ offers public information on the Certified Quality Auditor (CQA) and Certified Biomedical Auditor programmes: asq.org/cert/quality-auditor. Ask for certificate numbers and check them with the issuing body.
  • EU Qualified Persons – the QP role and batch certification are defined in EU GMP Annex 16 (EudraLex Volume 4). Manufacturing/import authorisations can be checked in EudraGMDP. Confirm which authorisation(s) the QP is or will be named on.
  • Regulatory affairs – RAPS describes the Regulatory Affairs Certification (RAC): raps.org. A credential is a starting point, not proof of experience with your product type.
  • "Former FDA" claims – ask for dates, district/office and role, and how recently they left; investigators' experience differs widely by program area.

3. Check relevant, recent experience

  • Ask for anonymised examples of comparable work (e.g. a redacted audit report or CAPA plan template) and references you can call.
  • For remediation work, review the public record of the issue you are addressing. FDA publishes warning letters and inspection/citation data on the FDA Data Dashboard; ask the consultant how they would respond to the specific citations.
  • For CSV work, ask how they apply FDA's risk-based Computer Software Assurance guidance and EU GMP Annex 11, rather than generic scripted testing.
  • For sterile and aseptic work, ask how their approach maps to the revised EU GMP Annex 1 and its contamination control strategy (CCS) requirement.
  • For device QMS work, confirm familiarity with FDA's Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference.
  • For GCP audits, ask how they have adapted to ICH E6(R3).

4. Independence and conflicts of interest

  • Ask whether the consultant has audited, worked for, or holds a commercial interest in the supplier, CDMO or software vendor being assessed.
  • An auditor should not be auditing their own previous work. For mock inspections, prefer someone not involved in building the system under review.

5. Contract essentials

  • Confidentiality agreement and data-handling terms (especially if they will access GxP records or systems).
  • Clear deliverables, timelines, acceptance criteria and who signs what – consultants advise; your quality unit approves.
  • Professional indemnity insurance appropriate to the work; subcontracting rules; ownership of work products.
  • For QP services: a written agreement defining responsibilities consistent with Annex 16 and your authorisation.

6. Red flags

  • Guaranteed inspection outcomes or "483-free" promises.
  • Reluctance to name who will actually do the work.
  • Templates offered as a substitute for understanding your process.
  • Credentials that cannot be verified with the issuing body.

Links point to public sources maintained by regulators and professional bodies; check them for the current versions.

— The GxP Roster team