There’s a phrase I’ve found myself repeating more and more in recent years when speaking with wholesalers, virtual manufacturers and logistics providers:

"You can outsource activities — but you can’t outsource responsibility."

That was a key theme in a recent presentation delivered by Laura Bashford, Senior Consultant at Orion GxP Consulting, titled “Ensuring Supply Chain Integrity: Managing Subcontracted Partners Under GDP” at BioPharma & Life Sciences Connected Live in Cork.

It’s not a dramatic statement. It’s simply the reality of operating under GDP as a Responsible Person (RP) or WDA holder today.

Outsourcing has always been part of pharmaceutical supply chains. What has changed is the scale and complexity. It’s now entirely normal for a single product to move through multiple transport providers, storage sites, monitoring services and specialist logistics partners before it reaches a pharmacy or hospital. Each of those partners plays a role in maintaining quality, and each introduces a point of potential failure if oversight isn’t strong.

From an RP or WDA perspective, that complexity doesn’t dilute responsibility — it concentrates it.

The reality behind the theory

On paper, the GDP guidance on subcontracting is clear. Activities can be delegated, but responsibility remains with the authorisation holder. Contracts and quality agreements must be in place. Partners must be qualified. Oversight must be maintained.

In practice, though, the challenge isn’t understanding the guidance. It’s applying it consistently across real supply chains with real commercial pressures.

Routes change. New partners are introduced quickly to meet demand. Temperature-controlled lanes are added at short notice. Storage providers subcontract transport without always making that visible. And suddenly, the tidy supply chain map created during onboarding no longer reflects reality.

That’s where regulators are focusing their attention, and rightly so.

Inspection experience across the EU continues to show that when issues arise, they often occur at interfaces between partners. A temperature excursion not escalated correctly, a subcontractor operating outside the agreed controls or a deviation handled locally but not communicated upstream. Individually, these issues might seem manageable. But collectively, they create a risk to product integrity and, ultimately, to patients.

From a regulatory standpoint, the expectation is simple, if your authorisation covers the activity, you must be able to demonstrate that you understand and control the network performing it.

What inspectors really want to see

There’s sometimes a misconception that inspectors arrive looking for missing documents. In reality, they’re usually trying to answer a broader question:

Does this organisation genuinely understand its outsourced supply chain, and is it actively overseeing it?

Contracts and technical agreements are part of that picture, but they’re only the starting point. Inspectors will typically probe beyond the mere existence of paperwork and examine how oversight operates in practice. They want clarity on roles and responsibilities; they want to understand how partners were selected and approved. They’ll look for evidence that performance is monitored, that deviations are reviewed, and that changes to routes or subcontractors are assessed properly.

Most importantly, they look for signs that oversight is real rather than theoretical. An RP signature on a procedure means very little if there’s no visibility of what’s happening day to day across the network.

Qualification: the work that happens before the contract

Strong oversight begins long before a contract is signed.

One of the most valuable exercises any organisation can undertake is mapping its supply chain in detail; not just its primary partners, but also the subcontractors it relies on. In today’s logistics environment, it’s common for transport providers to use secondary carriers or for storage sites to subcontract distribution services. Without visibility of those layers, oversight becomes reactive rather than proactive.

When qualifying a new partner, the focus shouldn’t be on ticking boxes but on understanding risk. What exactly is being outsourced? How critical is the activity to product quality? What environmental controls are required? What is the partner’s compliance history? How will issues be escalated?

Audits remain a key tool in this process, but they’re most effective when targeted at the areas that matter most: temperature control, equipment qualification, deviation handling, data integrity and record management. A well-planned audit can provide valuable assurance, but it is only a snapshot in time.

Audits are a moment; oversight is continuous

If there’s one recurring theme in inspection findings related to subcontracting, it’s over-reliance on audits as the primary control mechanism.

An audit shows how a system performed on a particular day. It doesn’t show how it performs over months or years, under pressure, during peak periods, or when something goes wrong.

Ongoing monitoring is where real control sits. That might involve reviewing KPIs, tracking temperature performance, assessing deviation trends or examining the impact of changes to routes and equipment. It also means ensuring that information flows effectively between partners and that issues identified at one point in the chain are visible to those responsible for overall oversight.

From an RP or WDA perspective, visibility is critical. Not because every minor issue needs escalation, but because patterns matter. A series of small deviations across different partners can indicate a systemic weakness that wouldn’t be visible through isolated audits alone.

Inspectors understand this. Increasingly, they’re asking to see evidence of how performance is monitored over time and how oversight decisions are made.

The role of quality agreements in the real world

Quality and technical agreements are often treated as regulatory necessities; documents to be drafted, signed and filed away. In reality, they should function as operational tools.

A good agreement doesn’t just define responsibilities; it reflects how the partnership actually works. It sets out how subcontracting is controlled, how information is shared, and how deviations are managed. Most importantly, it should align with day-to-day practice.

Where gaps appear is when agreements exist but aren’t embedded operationally. Perhaps a subcontractor is introduced without formal approval. Perhaps escalation timelines aren’t followed. Perhaps responsibilities are assumed rather than defined. These are the kinds of discrepancies inspectors notice quickly, because they indicate that oversight exists on paper but not in practice.

For an RP or WDA holder, maintaining alignment between agreements and reality is an ongoing task. Supply chains evolve, and documentation must evolve with them.
 

💊 If you require support with Vendor qualification, Audits or GDP in general, please contact:
📩 admin@oriongxp.com | ðŸŒ www.oriongxp.com