3PL Providers Rarely Get Audited Beyond Paperwork. Here Is What a Substantive GDP Audit Checks.
A GDP (Good Distribution Practice) certificate on the wall of a logistics partner’s warehouse does not reveal who in that company has the authority to halt a shipment if a refrigerated truck breaks down on a Friday evening. A formal paper audit will find signed Standard Operating Procedures (SOPs), a valid license, and a neat deviation log. What it won’t find is the driver who doesn’t know the proper protocol when a refrigeration unit fails, or the warehouse handler who places expired products back onto a general rack because the quarantine zone is occupied by another batch.
The distributor is held responsible for the quality of a pharmaceutical product across the entire supply chain — including the operations of a 3PL (third-party logistics) provider to whom storage or transport has been outsourced. This responsibility cannot be transferred along with the cargo. Here is a breakdown of what a pharmaceutical company’s auditor must inspect to distinguish an active, working quality management system from a binder of signed documents.
Paper Audits of Warehouses and Their Blind Spots
Standard qualification of a 3PL provider is usually limited to reconciling paperwork. An auditor requests the pharmaceutical activities license, a copy of the GDP certificate (or the report from the latest regulatory inspection), a list of SOPs, and the staff training log. If the documents are in order, the partner receives approved vendor status.
However, such a review fails to answer the questions raised by Decision No. 80 of the Council of the Eurasian Economic Commission dated November 3, 2016, «On Approval of Good Distribution Practice Rules within the Eurasian Economic Union» (hereinafter referred to as the GDP Rules or Decision No. 80). Paragraph 5 of the GDP Rules obligates the distributor to justify and, where necessary, validate significant distribution steps. Paragraph 7 requires that the effectiveness of the quality system be regularly monitored and analyzed.
This can only be verified on-site: the mere existence of a document does not prove that the process described within it is actually being performed.
The same applies to outsourced activities. Paragraph 12 of the GDP Rules requires the contract giver to evaluate the competence of the contract acceptor and analyze quality risks throughout the entire duration of the agreement — not just upon signing. Paragraph 111 goes further: the contract giver must verify the contractor’s competence before work commences and repeat this assessment whenever significant changes occur in the operations, with the frequency of audits determined by risk assessment.
A 3PL provider’s self-inspection process is structured similarly. Paragraph 118 of the GDP Rules requires the self-inspection program to cover all aspects of Good Distribution Practice within a defined timeframe. Paragraph 120 obligates the documentation of the causes of any identified deviations and the development of Corrective and Preventive Actions (CAPA). An impeccably clean self-inspection report with zero logged deviations over several years of warehouse operation should trigger an auditor’s scrutiny: is the program truly functioning as required by Paragraph 118, or are deviations simply going unrecorded?
What an Auditor Must Check in Practice
A substantive audit shifts the focus from document availability to the 3PL provider’s ability to demonstrate compliance through concrete operational examples. The table below outlines key audit parameters and highlights the differences between the two approaches:
| Audit Parameter | Formal Paperwork Check | Substantive Inspection |
|---|---|---|
| Responsible Person | Appointment order filed in a binder | The individual cites specific instances of halting shipments or approving returns (Para. 21 of GDP Rules) |
| Outsourcing & Subcontracting | Signed contract with the 3PL provider | Subcontractor audit reports and written approval from the contract giver to delegate work to third parties exist (Para. 114) |
| Self-Inspection | Self-inspection program is on file | Reports contain findings, root-cause investigations, and CAPA statuses (Paras. 117–120) |
| Temperature Control | Mapping report rests in the archives | Temperature mapping reflects the current physical layout and was re-performed following changes (Para. 39 of GDP Rules; Paras. 107–108 of Order No. 260n) |
| Computerized Systems | The computerized system is used for warehouse record-keeping | Data modification access is restricted to personnel responsible for that specific task; audit trail exists; backup copies are restorable (Paras. 45-49) |
| Product Returns | Return invoice is generated | Verified packaging integrity, batch number match, and transport storage conditions compliance (Para. 96) |
The Responsible Person
Paragraph 17 of the GDP Rules mandates that both the distributor and, by extension, the 3PL provider appoint a Responsible Person with appropriate qualifications. Paragraph 21 outlines their duties: approving outsourced activities, ensuring self-inspections occur per the schedule, and making decisions regarding returned, recalled, and falsified medicinal products. A crucial question for the auditor to ask is: «When was the last time the Responsible Person actually halted an outbound shipment or rejected a batch?» A job description alone will not answer this.
Outsourcing and Subcontracting
Chapter 7 of the GDP Rules covers this exact scenario: when a client (a pharmaceutical company or distributor) delegates storage and transport to a contractor (3PL provider). Paragraph 114 explicitly prohibits the contractor from subcontracting work to a third party without prior evaluation and written approval from the client, as well as an audit of that third party. In practice, this means the 3PL provider must present contracts with its own subcontractors alongside their audit records. A single primary contract with the client is insufficient.
Transportation
Transport is the phase where maintaining storage conditions is most challenging: cargo changes vehicles, drivers, and sometimes interim storage facilities. Chapter 9 of the GDP Rules requires these conditions to be maintained along the entire route (Paras. 121–124) and that medicines be delivered directly to the recipient’s premises without intermediate offloading elsewhere (Para. 129). For emergency deliveries outside standard business hours, dedicated personnel acting under a documented procedure must be designated.
Paragraph 130 applies Chapter 7 requirements to transport subcontractors: the responsibility for transport conditions remains with the distributor, regardless of who physically drives the vehicle. Furthermore, Paragraphs 134–137 regulate the transport of narcotic, psychotropic, poisonous, and temperature-sensitive (thermolabile) drugs, including staff training on preparing insulated shippers considering seasonal temperature fluctuations.
Storage Facilities and Areas
Co-mingling quarantine and commercial stock is a common physical finding during warehouse walkthroughs — and one that remains invisible on paper. Paragraph 32 of the GDP Rules mandates that medicinal products with an unconfirmed status (returns, expired stock, suspected falsifications) be stored in a dedicated, clearly designated quarantine area, separated either physically or via an equivalent electronic segregation system. Paragraph 36 requires a pest control program, while Paragraph 37 strictly prohibits storing food, drinks, or employees’ personal medications in storage areas.
Personnel and Training
A quick conversation with a warehouse loader or driver about handling contingencies reveals far more than a signature in a training log. Paragraph 25 of the GDP Rules requires mandatory training for all personnel involved in pharmaceutical distribution prior to starting work and on a regular basis thereafter, including training on identifying falsified products. Paragraph 26 specifically highlights thermolabile, radioactive, and highly hazardous medicinal products as categories requiring specialized staff preparation.
Data Integrity and Documentation
Having system backups proves little on its own; what matters is whether data can actually be restored from them. Paragraphs 45–49 of the GDP Rules state that warehouse computerized systems must be validated before use, and that data entry and modifications must only be performed by personnel responsible for that specific task, leaving a record of all changes alongside the user ID. Backups must be retained for at least 5 years in an isolated, secure location in accordance with member state legislation.
The same principles apply to paper records. Paragraph 56 of the GDP Rules mandates that procedures be approved, signed, and dated by the Responsible Person, and that any corrections be made in a manner that leaves the original text readable. Paragraph 58 sets a minimum document retention period of 5 years. During a random sampling of logbooks across different shifts, pay close attention to handwriting and ink color: identical handwriting and ink across different shifts and days usually indicates that the log was filled out retroactively.
Returns, Falsifications, and Recalls
Paragraph 96 of the GDP Rules allows returned medicinal products to be restored to saleable stock only if several conditions are met simultaneously: packaging integrity is uncompromised, no extraneous labeling is present, shelf life has not expired, the product is not subject to a recall, the recipient confirmed adherence to special storage conditions, and the batch number matches the delivery documentation. Stolen products, according to Paragraph 100, can never be returned to commercial distribution under any circumstances.
In cases of suspected falsification, Paragraph 101 obligates the distributor to immediately notify the competent authority of the member state and the marketing authorization holder. The effectiveness of recall procedures must be evaluated at least once a year (Para. 104). Records required for recalls must be accessible at all times, including outside regular business hours (Para. 108).
To test compliance across all these points, an auditor can utilize the vertical audit (traceability) method: select a specific batch currently in the warehouse and reconstruct its full history — its movement trail, temperature logs, and the calibration status of all equipment that serviced it. When investigating root causes for deviations, standard analytical tools (such as the Ishikawa diagram or the «5 Whys» method) are beneficial. While the GDP Rules do not mandate a specific methodology, selecting an appropriate tool remains the distributor’s responsibility.
Action Plan for Auditors
Request proof of the Responsible Person’s operational authority. Ask for two or three real examples where the Responsible Person exercised their right to halt a shipment or approve a return decision (Para. 21 of the GDP Rules). A formal appointment order alone does not prove this.
Inspect the entire outsourcing chain. Request the 3PL provider’s contracts with their own subcontractors along with their respective audit reports. Delegating work without prior client approval violates Paragraph 114 of the GDP Rules.
Conduct a vertical audit test. Pick a single batch in the warehouse and trace its complete journey: review its temperature records, the calibration status of connected equipment, and the logs of the personnel who handled it.
Review self-inspection reports and CAPA logs from the past year. Assess whether they reflect genuine root-cause investigations or if every entry simply concludes with «retrained personnel» (Paras. 118-120 of the GDP Rules).
Verify access controls in the warehouse computerized system. Ensure that modifying data regarding temperature, expiration dates, and batch numbers is restricted to personnel responsible for that specific task and leaves a trace in the system (Para. 47 of the GDP Rules).
The final decision to partner with a 3PL provider rests with the pharmaceutical company. A substantive audit answers a crucial question: will the partner withstand an inspection by national regulators (such as Roszdravnadzor) or EAEU inspectors under real warehouse and transit conditions?
A signed contract alone cannot answer that. Responsibility for product quality across the entire supply chain is anchored in Article 54 of Federal Law No. 61-FZ «On Drug Circulation» and the GDP Rules — and that ultimate responsibility remains with the distributor, regardless of who physically stores and transports the goods.
Regulatory Framework:
1. Federal Law No. 61-FZ dated April 12, 2010, «On Drug Circulation» (Article 54)
2. Decision No. 80 of the Council of the Eurasian Economic Commission dated November 3, 2016, «On Approval of Good Distribution Practice Rules within the Eurasian Economic Union»
3. Order No. 260n of the Ministry of Health of the Russian Federation dated April 29, 2025, «On Approval of the Rules for Storage of Medicinal Products for Medical Use» (effective September 1, 2025; superseded Order No. 706n dated August 23, 2010)