In today’s market, many biotech and medical device companies start off as a virtual or semi-virtual operation to keep fixed costs low. Virtual companies are run by a very small team, often one or two founders. With the rise of contract research organizations (CROs), contract manufacturing organizations (CMSs) and laboratories, most validation experiments right through clinical trials can be performed by outsourcing. Virtual companies are becoming more common and seen as attractive by investors.

All companies in the biopharma and pharma sectors must comply with regulatory demands. Many virtual companies feel they do not require a quality system as much of the regulated work is outsourced to vendor companies. They assume their vendors have adequate quality management systems (QMS) in place to ensure that regulations are met. While vendors may have a QMS in place both the FDA and the European Health Authorities have been clear that they expect the Sponsor (virtual company) to take responsibility for the oversight of all contracted vendors. So, even a virtual company of a few people will need to have at a minimum a quality system that documents the vendor oversight process.

There are two business drivers that should be considered when designing a QMS. The first is risk mitigation, and the second is to be as efficient as possible in today’s challenging financial landscape. Drug owners are responsible for assuring that any drug introduced into interstate commerce isn’t adulterated or misbranded because of the actions of their selected contracted facility. This is an important statement from FDA, making it clear that even a virtual pharmaceutical company, with perhaps one or two employees, is ultimately responsible for any drug placed into interstate commerce even if manufactured by a vendor company.

Meeting this expectation requires a risk-based approach. This is generally accomplished by the virtual company performing a documented, formal procedure, quality assurance audit of their vendors. So, even a virtual company of a few people will need to have a quality system that documents the vendor oversight process. More specifically:

• Conduct a risk assessment analyzing the appropriate supplier controls, based on the services or products provided by that supplier;
• Assess the supplier’s ability to perform the services required through audits, testing of components and supplies, and a review of previous issues or regulatory enforcement activities;
• Suppliers’ performance should be monitored, documented, and reviewed frequently. Owners should ensure that any issues are addressed adequately and expeditiously; and
• Ensure appropriate written quality agreements are completed between all parties regarding responsibilities for GMP activities. A table or chart of responsibilities for each organization is recommended.

While some of these expectations may seem burdensome, they boil down to good business sense. All virtual companies need a quality system; it is just a matter of assessing which aspects are relevant, and ensuring that the system grows appropriately with the company. Global Regulatory Partners is adept at “right sizing” your quality system, and anticipating when and what pieces will need to be added as your company grows.