Expert Insights into GDP Certification

What this article covers and who it is intended for

This article is a practice-oriented analysis of the GDP certification process, including audit mechanisms, certification standards, and strategic compliance considerations. It is written for QA leads, Responsible Persons (RPs), regulatory affairs professionals, and distribution site managers who wish to refine their approach to GDP compliance or prepare their organization for an audit or re-inspection.

The GDP certification process (and legislation)

The legal basis for GDP certification varies by market. The distinction between mandatory inspection models by competent authorities and voluntary certification schemes of (commercial) third parties is not always clear to organizations operating in multiple regions.

EU GDP guidelines and the role of inspections by competent authorities

Within the EU, GDP Directive 2013/C 343/01 forms the reference framework for Good Distribution Practices for medicinal products.

Compliance with the GDP Directive is a condition for obtaining and maintaining a Wholesale Distribution Authorisation (WDA) . The competent authority of the Member State conducts inspections to assess whether a distributor meets the requirements. In the Netherlands, these inspections are carried out by the Health and Youth Care Inspectorate (IGJ) . The licence is issued by Farmatec.

GDP certification by commercial parties

In addition to inspections by competent authorities, third-party certification schemes exist. In some markets, the competent authority explicitly recognizes specific certifications. The "WHO Guide to Good Storage Practices for Pharmaceuticals" (TRS 908, 2003) and "Good Distribution Practices for Pharmaceutical Products" (TRS 957, 2010) provide a framework that is used as a reference, particularly in developing countries, especially in markets where local regulations are less detailed.

The NABP DDA program in the US is the most concrete example of this. Some states even require it as a condition for a permit.

Third-party certification never replaces a mandatory inspection by the competent authority. However, it can serve as additional proof of compliance, as a tool for risk assessment during supplier qualification, or as preparation for an official inspection. Organizations must clearly document which standards they follow and why.

A GDP audit or inspection: what auditors / inspectors look at and how to prepare

Audit scope and critical areas of attention

Whether it concerns a GDP inspection by a competent authority or a third-party GDP audit, this follows a predictable pattern. Consider the following:

• Qualification of buildings and equipment, including temperature mapping of storage areas
• Temperature monitoring and temperature surveillance during storage and transport
• Validation of transport processes and transport routes
• Qualification of suppliers and customers, including verification of wholesale status
• Documentation and data integrity in accordance with ALCOA++ principles
• The exercise of supervisory duties by the RP, both on paper and in practice

An audit or inspection often begins with a tour of the warehouse and shipping department. This is followed by a review of the QMS, often driven by findings from the tour.

Common critical and major findings that delay or prevent GDP authorization

Recurring observations emerge from IGJ inspection trends:

• Inadequate management of temperature excursions: no clear procedure for assessing the impact on product quality, or assessments not authorized by the RP.
• Inadequate oversight of outsourced activities: contracts with carriers that do not specify GDP requirements, or the absence of audits at logistics service providers
• Weak CAPA effectiveness: corrective measures that address symptoms but not the root cause, or the lack of effectiveness verification after implementation.
• Insufficient verification of the legitimacy of suppliers and customers, particularly with new business relationships

Building a good QMS

Organizations that treat the GDP as a checklist run a risk. Continuous quality and compliance require that the patient comes first. This is what the GDP is ultimately about. Inspectors and auditors look for this.

Patient safety first

European inspectorates, including the IGJ, do not only check for the presence of quality system elements. They check for the assurance of patient safety. Naturally, all quality system elements must be present, but compliance with them is equally important. A procedure is good. But if it is not followed, it is worthless in the eyes of the inspectorate.

In GDP (and GMP), everything revolves around patient safety; after all, this is why this legislation was established and still exists. Everything you decide, conceive, and do as a company must be documented with sufficient rationale. For example, do you decide that your warehouse only needs to be cleaned once a year? Then consider:

• What impact will this have on contamination? Not only direct microbiological contamination but also the potential increase in pests and cross-contamination,
• Because less cleaning is being done, your capability to detect contamination also decreases.
• The same applies to the detection of spills / leaks of products / bags,
• How does the air handling system deal with an increase in dust?
• And what influence all of this has on the patient.

When you identify these risks, you will quickly come to the conclusion that it is better for the patient if you clean more frequently. However, if you can demonstrate that there is no impact on patient safety, document this in as much detail as possible. That makes your decision defensible and inspectable.

The role of the Responsible Person in the GDP certification process

The Responsible Person bears personal responsibility for compliance with GDP requirements. Prior to an audit or inspection, the RP must be able to demonstrate that he or she actively monitors: approval of procedures, involvement in deviation review, authorization of supplier and customer qualifications, and training activities (personnel qualification).

During the inspection, GDP inspectors expect a direct conversation with the RP. They assess not only knowledge of regulations but also actual involvement in daily operational decisions.

Delegation of tasks is permitted, but responsibility remains with the RP. This must be formally documented: who is authorized for which tasks, and how does the RP supervise delegated activities?

Preparing for recertification and responding to regulatory changes

Recertification or re-inspection does not require a complete overhaul if the QMS is continuously maintained. New or revised GDP guidelines can be implemented via the existing Change Control process: perform a gap analysis, document the impact assessment, adjust procedures where necessary, and train staff on the changes.

During the recertification cycle, it is advisable to conduct an internal audit well in advance that specifically covers the scope of the expected inspection. Any deficiencies can then be addressed via the CAPA process before the external audit takes place.

Conclusion

• The GDP certification process/GDP licensing process is not a one-off event but a continuous quality obligation that must be embedded in the daily operations of the distribution organization, with the patient first.
• The GDP requires risk-based systems and decisions. Make everything traceable, inspectable, and defensible.
• Success during a GDP audit or GDP inspection depends on a demonstrable quality culture and demonstrable, active oversight by the RP. Inspectors assess not only documentation but also the actual involvement of the RP in operational decisions. (The GDP is not a checklist but a quality framework).
• Data integrity and the cold chain remain the areas with the highest risk of observations during an audit or inspection. Invest in robust systems for temperature monitoring, audit trails, and ALCOA++ data.
• Use the Change Control process to implement regulatory changes in a structured manner.