auditing manufacturers: linking data integrity with ......“data integrity is the assurance that...

Auditing Manufacturers: Linking Data

Integrity with Quality Culture

FDANews 14th Annual FDA Inspections Summit

October 24, 2019

Presented by:

Susan Schniepp, Distinguished Fellow

2019 © Regulatory Compliance Associates Inc.1

W E L L N E S S F O R B U S I N E S S®

Topics

•Data Integrity Concepts

•Background

•Current Situation

•Available Information

•Get Back to Basics

•What to Look For When Auditing

•Summary

2019 © Regulatory Compliance Associates Inc.

2


What is Data Integrity?

“Data integrity is the assurance that data records are accurate,

complete, intact and maintained within their original context,

including their relationship to other data records. This

definition applies to data recorded in electronic and paper

formats or a hybrid of both.”

“…integrity denotes validity.”

“Ensuring data integrity means protecting original data from

accidental or intentional modification, falsification or even

deletion, which is the key to reliable and trustworthy records

that will withstand scrutiny during regulatory inspections.”


Excerpt From regulatoryfocus.org April 2014

3


ALCOA

Data Integrity Element Description 21 CFR Reference

Attributable All data generated or collected must be attributable to

the person generating the data

§§ 211.101(d), 211.122, 211.186,

211.188(b)(11), and 212.50(c)(10)

Legible All data recorded must be legible (readable) and

permanent

§§ 211.180(e) and 212.110(b)

Contemporaneous results, measurements and data is recorded at the time

the work is performed

§§ 211.100(b) and 211.160(a)

Original Original data, sometimes referred to as source data or

primary data, is the medium in which the data point is

recorded for the first time.

§§ 211.180 and 211.194(a)

Accurate complete, consistent, truthful, and representative of

facts

§§ 211.22(a), 211.68, 211.188, and

212.60(g)


4


ALCOA+•Attributable, Legible, Contemporaneous, Original, Accurate plus:• Complete: Information that is critical to recreating and understanding an event. This would

include any repeat or reanalysis performed on a laboratory test sample.

• Consistent: The data are presented, recorded, dated, or time-stamped in the expected and defined

sequence.

• Enduring: The data or information must be maintained, intact, and accessible throughout their

defined retention period.

• Available: The data or information must be able to be accessed at any time during the defined

retention period.

Annex 5

Guidance on good data and record management practices

Appendix 1

Expectations and examples of special risk management considerations for the implementation of ALCOA (-plus) principles in paper-based

and electronic systems

5


What is Data Integrity? (cont’)

Example of Data Integrity Violations

•Fabricating Data•Backdating•Presenting Existing Data as New Data•Reporting Only Passing Values •Testing into Compliance by Re-running Samples Until Results Pass

•Discarding/Altering Data (Electronic or Hard Copy)•Reported Not Supported by Raw Data•Forging and/or Unauthorized Signatures•Not Recording Activities Real-time


6


What’s Going On Out There?


7


History

“Progress, far from consisting in change,

depends on retentiveness. Those who cannot

remember the past are condemned to repeat

it.”George Santayana (1863—1952)


8


Significant Events

1989 – Generic Drug Scandal

“several manufacturers had falsified data submitted in seeking FDA authorization

to market certain generic drugs”

1993 – The Barr Decision

“The reported problems include misplaced records, test data recorded on scrap

paper, failure to control manufacturing steps such as those governing products'

physical properties, release of products not meeting their specifications, inadequate

investigation of failed products, and failure to validate test methods and

manufacturing processes, including cleaning processes.”

1990 – 2003 – Issuance of Consent Decrees

“Of the more than 25 consent decrees issued between 1990 and 2003, only one or

two firms have been removed from their decrees.”


9


Significant Events (cont’)

2005 – The Case of Able Labs

“Able Laboratories recalled all of its prescription drugs in one of the USAs largest

drug recalls.” & “…failed to tell regulators when drugs failed quality tests and

sometimes substituted failing with passing results.” & “The substitutions involved

"cutting and pasting" computer records and were done by supervisors and lab

analysts, the report says.”

2013 – Ranbaxy

“The fraud, investigated over eight years by US authorities, was brought to light by

a whistle-blowing ex-employee, who said Ranbaxy created ‘a complicated trail of

falsified records and dangerous manufacturing practices.’ ”

2019 - AveXis 483

“It was alleged that two senior executives altered or instructed others to alter small

amount of raw data…”

Response: “…ensure a robust culture of quality…”


10


Warning Letters

“the investigator noticed that during an inspection of the packaging area for

(b)(4) # (b)(4) a production employee had recorded the final packed

quantity of the batch in Step (b)(4), even though the quantity was not

yet known because the operator had not yet weighed the batch.”

“For example, the batch record includes information that indicates

citric acid was added during the initial manufacture of the batch;

however, an investigation report conducted by the firm alleges that

citric acid was not initially added to this batch. In addition, there is no

indication within the batch record that the batch was reprocessed and the

citric acid added at a later time.”


11


Warning LettersThe inspection of your facility documented multiple incidents of performing "trial"

testing of samples, disregarding test results, and reporting only those results from

additional tests conducted. For example,

• a. The official release data for (b)(4) and (b)(4) Tablets (b)(4) mg batch (b)(4) for

unknown impurities was reported to be within specification (NMT (b)(4)%). However,

the chromatographic data showed that the "trial" injection data for this batch failed

the unknown impurities specification with a result of (b)(4)%.

• b. The official High Performance Liquid Chromatography (HPLC) impurity data for

(b)(4) mg Tablets batch (b)(4) ((b)(4)), 3-month stability time-point @ 25oC/60% RH

only included the most favorable result obtained from multiple test results

without any justification. The data from this batch was submitted to the U.S. FDA as

an exhibit batch.


12


Warning Letters

“You conducted purity testing by HPLC at (b)(4) on January 27,

2012. This sample failed the purity specification limit (NLT

(b)(4)%) with a result of (b)(4)%, but you did not document, report or

investigate the failure. Your QC data package, which you used to

support batch disposition decisions, showed passing results from

(b)(4) on the same day but does not include the initial failing

results.”

“One of your analysts stated that another, unknown individual had

logged into the system using the analyst’s credentials. This unknown

individual performed injections and deletions without the analyst’s

knowledge.”


13


Warning Letters“On August 28, 2014, FDA investigators identified instances of non-contemporaneous

documentation of batch production activities. Two uncontrolled Excel spreadsheets were used to

record discrepancies and certain in-process drug quality data. This data was initially missing in

the batch manufacturing record. Your firm later entered this data into batch records and

backdated them.”

“During interviews with our investigators, your contract employee who trains other contract

employees on good documentation practices was unable to explain the material he was

required to present during training. In addition, while a significant number of your contract

employees do not speak English, you only provided English training materials to these employees.”

“We also found an employee’s failing equipment qualification training assessment form in the

trash, yet that employee’s official file showed passing results. According to your company

policies, personnel with failing scores must be retrained, but your firm was unable to provide

evidence of retraining in the employee’s official record.”


14


Warning Letters

“During the inspection, the investigator observed that the

server that maintains electronic raw data for HPLC and

GC analyses contains a folder named “Test,” and that

chromatographic methods, sequences, and injection data

saved into this folder can be deleted by analysts. The

investigator also found that data files initially created and

stored in the “Test” folder had been deleted, and that back-

up files are overwritten.”


15


Warning Letters

• Prior to conducting official analyses, your quality control laboratory

performed “experimental” analyses on product batches to assess

whether your API met specifications, but failed to document these

“experimental” tests in official laboratory records or to justify their

exclusion. Our investigator found the results of 2,404 high

performance liquid chromatography (HPLC) injections in a folder

titled “Experimental” on instrument SZG-002-006l. Your quality unit

indicated that these “experimental” injections were being conducted in all

(b)(4) chromatographic units in your quality control laboratory. Your

management provided different explanations in an attempt to justify

the practice, including “fear” that the sample results would not pass.


16


Interesting Factoids

Between 2005 and 2018 there were ≈300 Warning Letters

Issued for “Data Integrity”

In 2002 at the International GMP Symposium Issues of

Concern Were:

• Improper documentation

• Lack of Thorough Investigations

• Insufficient Training


17



18


Industry Changes

• Emergence of Generic Industry

• Emergence of Biosimilars

• Emergence of Virtual Companies

• Emergence of CMOs

• Emergence of Compounding Pharmacies & 503b

Outsourcing Facilities

• Institutional Knowledge Lost through M&A

• Emergence of Information Technology


19


Data Integrity


20


Quality Culture

21



FDA’s Quality Metrics ProgramA maximally efficient, agile, flexible,

pharmaceutical manufacturing sector that

reliably produces high quality drug

products without extensive regulatory

oversight.

Janet Woodcock,FDA,Center for Drug

Evaluation and Research October 5, 2005

22



Nov

PDA Culture Metrics Survey

ISPE Pilot Announced

ISPE Pilot Results Wave 1

PDA Metric Conf #2

FDA Draft

Guidance (rev

1)

“Metrics of Potential Interest”

Feb 2013 May Aug NovFeb2014 May Aug

Feb2015

Brookings Stakeholder

Meeting

Initial Industry Responses

FR Notice Requesting Metrics to

Prevent Drug Shortages

PDA’s Metrics Journey

May Aug Nov

PDA Metric Conf #3

PDA Metric Conf #1

Industry White Papers Published

NovFeb2016

May Aug NovFeb2017

FDA Draft

Guidance

(rev 2)

PDA Metric Conf #4

FDA Technical

Conformance

Guidance

May

ISPE Pilot Results Wave 2

PDA Q Culture Assessment Pilot

23



• Metrics is a very complex topic, fraught with

unintended consequences.

• Trending is most important

• Optimizing a metric program takes time to evolve

• Metrics has to be combined with a strong Quality

Culture to be meaningful

• Focusing on a metric can compromise its utility

• Finding forward looking metrics is very difficult

Lessons Learned

24



Regulatory Expectations

25



PIC/S: Good Practices for Data Management and Integrity in

Regulated GMP/GDP Environments

• 6.3 Quality Culture

• Management should aim to create a work environment (i.e. quality culture) that is transparent and open, one in which personnel are encouraged to freely communicate failures and mistakes. Organisational reporting structure should permit the information flow between personnel at all levels.

26



MHRA ‘GXP’ Data Integrity Guidance and Definitions

3. The principles of data integrity

3.1 The organisation needs to take responsibility for the systems used and the data

they generate. The organisational culture should ensure data is complete, consistent and

accurate in all its forms, i.e. paper and electronic.

3.3 The impact of organisational culture, the behaviour driven by performance

indicators, objectives and senior management behaviour on the success of data

governance measures should not be underestimated. The data governance policy (or

equivalent) should be endorsed at the highest levels of the organisation.

27



World Health Organization: Guidance on good data and record

management practices

1. Introduction

1.4 Examples of controls that may require development and

strengthening to ensure good data management strategies include, but

are not limited to:

•adoption of a quality culture within the company that encourages

personnel to be transparent about failures so that management has an

accurate understanding of risks and can then provide the necessary

resources to achieve expectations and meet data quality standards:

28



World Health Organization: Guidance on good data and record management

practices

4. Principles

4.7 Quality culture. Management, with the support of the quality unit,

should establish and maintain a working environment that minimizes the risk

of non-compliant records and erroneous records and data. An essential element

of the quality culture is the transparent and open reporting of deviations, errors,

omissions and aberrant results at all levels of the organization, irrespective of

hierarchy. Steps should be taken to prevent, and to detect and correct

weaknesses in systems and procedures that may lead to data errors so as to

continually improve the robustness of scientific decision-making within the

organization. Senior management should actively discourage any management

practices that might reasonably be expected to inhibit the active and complete

reporting of such issues, for example, hierarchical constraints and blame

cultures.

29



30



Harvard Business Review April 2014 “Creating a Culture of Quality”

CEB (Corporate Executive Board) Results of Two Years of Research

* *

Time to Correct a Mistake

HourlyWage

Number ofEmployees

2 Hrs. 26,300$42.55

Annual Costto ResolveErrors

$774M

For every 5,000 employees, moving from the bottom to the top

quintile would save a company $67 million annually

Business Benefits of a Quality Culture

31



The Business Benefits to Quality Culture

2000’s The Importance of Culture was Realized

32



The PDA Quality Culture Journey

Response to FDA Metrics

2013-2014

Hypothesis to measure Culture

Quality Culture Survey

2014-2015

Is there a correlation between behavior

and attributes?

Quality Culture Model

2015-2016

What attributes are most important?

Quality Culture Pilot Program

2016-2017

Can I compare with other sites?

33



What is quality culture?“True culture of quality” is an environment in which employees not only follow quality guidelines but also consistently see others taking quality-focused actions, hear others talking about quality, and feel quality all around them (Harvard Business Review)

Culture is the behaviors and beliefs characteristic of a particular social group. It indicate what is important to the companies, thus, impacts their decision making

Quality culture is the root cause of many of quality problems, such as data integrity

Many of the things you can count, don’t count, many of the

things you can’t count really counts – Albert Einstein

34



35



PDA’s Vision / Mission:

Promote Quality Culture, its understanding, assessment

and improvement within the Pharmaceutical /

Biopharmaceutical Industry by providing tools and

knowledge to enable continuous improvement. The

ideal state is to ensure a quality mindset and behaviors

are imbedded into the daily work of all functions

resulting in positive patient outcomes.

PDA’s Program to Enhance Quality Culture

36



Can Quality Culture be measured?

1. Is there a relationship between Quality Culture Behavior

scores and Mature Quality Attribute scores?

2. Which Mature Quality Attributes relates to Quality

Culture behavior?

Is there a set of Mature Quality

Attributes that are a surrogate for

Quality Culture Behaviors?

37



What is a Quality Attribute?

Quality Attributes:

• Objective characteristics of a quality system

• Can be verified

• A tangible program or system

• Can be verified

Examples include:

• Deviations reporting

• Change control system

• CAPA system

• Complaints management system

• Environmental monitoring program

38



55 Quality Attributes were identified

39



Attributes grouped into 7 areasSeven Areas of Questions1. Prevention Programs

2. Quality Management and Issue Escalation

3. Training and Personnel Development

4. Quality System Management

5. People and Communication

6. Continuous Improvement

7. Site Metric Reporting

These 7 areas identified 55 Mature Quality Attributes

40



What is a Quality Behavior?

Quality Behaviors:

• Actions that need to observed or experienced

• Difficult to quantify or audit

• Are the characteristics of the culture

Examples include:

• Communication & Transparency

• Rewards and Recognition

• Engagement

• Cross Functional Vision

41



Quality Culture BehaviorSeven Areas of Behavior Questions

1. Communication & Transparency

2. Commitment & Engagement

3. Technical Excellence

4. Standardization of Criteria or Requirements

5. Cross Functional Vision

6. Rewards and Recognition

7. Speak Up for Quality Culture

These 7 areas identify 42 specific behaviors

42



Can Attributes be used as a proxy for Quality CultureIF....

Quality

Attributes(Quantifiable & Easily

measured)

Quality

Behaviors(Difficult to measure, often

need to be observed)

Quality Culture

(Defined by behaviors & Beliefs)

= =

Then…

Quality

Attributes(Quantifiable & Easily

measured)

Quality Culture

(Defined by behaviors & Beliefs)

=

43



Is our hypothesis confirmed?

• Higher MQA score the higher the behavioral score

• Given this is a Social Science Analysis, this is a strong relationship

Yes! There is a relationship between Quality Culture

Behavior and Mature Quality Attribute

PDA Quality Culture Survey analysis

http://journal.pda.org/content/69/5/631.full.pdf+html?sid=1d68365b-c441-4c68-943f-eb0f39ce084e

44


http://journal.pda.org/content/69/5/631.full.pdf+html?sid=1d68365b-c441-4c68-943f-eb0f39ce084e


Higher Quality Maturity is correlated with Higher Quality Behavior

St.Gallen confirms PDA‘s Quality Culture Survey outcome

R2 = 0.34 R2 = 0.66

▪ 326 pharmaceutical sites of different size and focus within St.Gallen database confirm PDA

PDA Survey Analysis 2014 St.Gallen Analysis 2017

Dr. Thomas Friedli, Measuring Quality Systems & Quality Culture February 2017

Beh

avio

rs

Mature Quality Attribute

45



Top 10 Quality Attributes significant impact

1. Participation at conferences to stay current

2. Collecting Error Prevention Metrics

3. Management Communication that Quality is Everyone’s Responsibility

4. Utilization of new proven technologies

5. Clear performance criteria for feedback and coaching

6. EH&S Environmental Program with trained staff (risk assessments, emission controls, spill prevention and response)

7. Site has formal quality improvement objectives and targets

8. Quality topics included in at least half of “all hands” meetings

9. Collecting Management Review Metrics

10. Collecting Employee Turn Over Rate Metrics 11. Program to show how employee’s specific goals

contribute to overall quality goals

12. Program to measure, share and discuss product quality performance and improvement from shop floor to executive management.

13. Continuous Improvement Program / Plans with active support of CEO and Corp Management of QMS

14. Program that establishes quality system maturity model and action plan and tracking to measure progress

15. Internal survey measuring a company/

site quality culture

Voted by ~225 Conference Participants, Dec 2014

Most impactful attributes identified

46



PDA tool was developed with five categories

Overview of the on-site assessment tool – 24 sub-attributes

1. Accountability and Quality Planning

Accountability & Quality Planning3. Quality Communications

Quality Communications

4. Communication and Collaboration

Operations Readiness & Knowledge

5. Understanding Quality Goals

Impact on Product Quality

Patient Impact

6. Staff Empowerment and Engagement

Process Ownership &

Engagement

Safety Program

7. CAPA robustness

Root Cause

Human Error

8. Management Review and metrics

Management Reviews

Metrics

10. Internal Stakeholder Feedback

Internal Stakeholder Feedback


11.Utilization of New Technologies

Manufacturing Technologies

12. Maturity of Systems

QMS Processes

Business Conduct

Quality Risk Management

2 . Enabling Capable Resources

Feedback & Staff Development

Training

Rewards and Recognition

9. Clear Quality Objectives and Targets

Continuous Improvement

Leadership Commitment

Communication & Collaboration

Technical Excellence

Employee Ownership and Engagement


47



5. Understanding Quality Goals

Impact on Product Quality

Patient Impact

48



7. CAPA robustness

Root Cause

Human Error

8. Management Review and metrics

Management Reviews

Metrics

10. Internal Stakeholder Feedback

Internal Stakeholder Feedback


9. Clear Quality Objectives and Targets



• CAPA Robustness

• Ability to determine true root cause

• Minimize human error

• Management Review

• Are right issues brought to senior leadership

for discussion?

• Are right actions taken as outcome?

• Clear quality objectives and targets

• Continuous improvement

• Internal stakeholder feedback

• Understand your customer and partners

need and consistently provide feedback

49



11.Utilization of New Technologies

Manufacturing Technologies

12. Maturity of Systems

QMS Processes

Business Conduct

Quality Risk Management

Technical Excellence

• Utilization of new technologies

• Adoption of technologies to

improve product quality

• Provide technical leadership to help

regulators identify requirements

• Maturity of systems

• Do the process owners have the

authority to make improvements?

• Business conduct and ethics

• Implementation of QRM

50



Who participated in the pilot?

Pilot contained 43 sites from 24 companies

Total of 75 assessors trained; 9000+ survey respondents

51



What did the pilot involve?

Assessmen

t tool

On-line

surveyPDA course Benchmarking

52



Example of site pilot results

53



Key learnings from the pilot

Positive feedbacks

• Clear framework and scoring

method

• Drive effective discussion with

site leadership

• “Best PDA training”

• In-person discussions provides

more value in understanding the

culture at the site (vs. only a

survey)

• Reliable way to help select

partners and CMOs

Challenges

• Assessment is most effective

with a different mindset and

approach

• Pre-work needed to gain

efficiency

54



Critical pilot objectives were met• Was the training effective?

• Can sites be differentiated?

• Was the tool user-friendly?

• Were the assessment results useful for discussion with site management?

55



There’s clear differentiation among sites for each attribute.

Results for all attributes will be

captured in the final report for pilot

participants

Internal stakeholder

feedback

Understanding

quality goals

Leadership

commitment to

quality

1 2 3 4 5

Maturity levels

Analysis of Tool Results from the Pilot Program Sept. 2017

56



Over 100 regulators from MHRA and USFDA have

been trained on PDA’s Culture Assessment Tool

57



“[We] can apply the Quality Culture Attributes to improve how we assess

firms in non-compliance context”

“As industry becomes aware and comfortable with this tool… it can be a

powerful tool for evaluating CMOs and business partners.”

“Industry can use the PDA tool as part of internal/self-assessment for

improvement of Quality Systems.”

“Industry could use the PDA tool to be more open with regulators on

quality culture.”

“I will consider quality culture when reviewing data from industry.”

“Nice to differentiate quality Culture from Quality Systems and emphasize

the importance of what we make relative to what we do.”

“This course does help identify quality culture issues in a company. This

may help [us] to evaluate the quality of a pharmaceutical company.”

58



Standard Development

59


PDA (Parenteral Drug Association)

Contact: Christine Alston-Roberts, (301)-656-5900-, [email protected] Bethesda Towers, 4350

East-West Highway, Bethesda, MD 20814

New Standard

BSR/PDA Standard 06-201x, Quality Culture Assessment Tool (new standard)

Stakeholders: Quality assurance, quality control, quality engineering, operations, production,

manufacturing, general interest, regulatory interest members.

Project Need: Provide a data-driven assessment approach to allow companies to effectively

measure quality culture and its importance in providing high-quality medicinal products to

patients.

A comprehensive Quality Culture Assessment Tool and Training, designed to guide companies to

a better understanding of quality culture, how to assess it, and what actions to take to improve it.

The tool helps a company effectively collect verifiable data that will help them to assess their

culture at all levels of their organization. The tool allows the company to facilitate positive

culture changes and continuous improvement within their organization.

ANSI Standards Action - October 11, 2019 - Page 17 of 73 pages

60

62

Aseptic Processing & Sterilization

Biopharmaceuticals &

Biotechnology

Manufacturing Science

Quality & Regulatory

Supply Chain & Outsourcing

PDA Five Topic Areas:

a01x, Standard Practice for Quality Risk Management of Aseptic Processes.

Mr. Hal Baseman (Chair)

Draft Under Development

PDA Standard 02-201x, Cryopreservation of Cells for Use in

Cell Therapies and Regenerative Medicine Manufacturing

Quality & Regulatory: Confidence and efficacy affecting the development, manufacturing of healthcare products as related to compliance or conformity to a rule, such as a specification, policy, standard or law

Manufacturing Science: Related to the “how” of

pharmaceutical production, including such topics as

validation practices, analytical methods, and in-line

measurements.

Aseptic Processing & Sterilization Process:

Sterile materials are handled in an environment

in which the air supply, materials, equipment

and personnel are controlled to prevent

microbial and particulate contamination. This

process promotes final product quality and

safety.

Biopharmaceuticals& Biotechnology: Technologies that use living cells or genetic material to treat a condition or illness (e.g., genetic disorders, tissue replacement/repair, cancer treatments), biosimilars and antibody therapeutics, and cell line maintenance and production technologies.

Supply Chain & Outsourcing: Proper management of raw materials and delivery of final product and in working efficiently and effectively with Chief Marketing Officer, Contract Manufacturing Organization, and or Commercial Testing Laboratory (CMOs/CROs/CTL). Also involves maintaining data integrity and improving quality culture.BSR/PDA Standard 06-

201x,Quality Culture

Assessment Tool

63

BSR/PDA 05

BSR/PD

A-04BSR/PDA

03

BSR/PD

A 02BSR/PDA

01

BSR/PD

A 06


Cylia Chen (Amgen) – team lead

Steve Mendivil (Amgen)

Machelle Eppler (Patheon)

Pritesh Patel (Novartis)

Sue Schniepp (Consultant)

Chuck Bornhoeft (Upsher-Smith)

Joerg Gampfer (Hovione)

Dixie Webster (Allergan)

Tara Gooen-Bizjak (FDA)

Gerald Heddell (MHRA)

Matija Gabrovsek (Novartis)

Brianna Peterson (BI)

Jan Paul Zonnenberg (PwC)

Sandra Lueken (AstraZeneca)

Anne Eickhoff (GSK)

Rick Burdick (Consultant)

Bob Kieffer (Consultant)

David Leuck (Patheon)

Denyse Baker (PDA)

Rich Levy (PDA)

David Talmage (PDA)

64



Available InformationMHRA GMP Data Integrity Definitions and Guidance for Industry (March 2015)

MHRA: A GxP Data Integrity Definitions and Guidance for Industry Draft version for

consultation (July 2016)

FDA Data Integrity and Compliance With CGMP Guidance for Industry Draft Guidance

(April 2016)

WHO: Annex 5, Guidance on good data and record management practices (June 2016)

Draft PIC/S Guidance: Good Practices for Data Management and Integrity in Regulated

GMP/GDP Environments (August 2016)

Parenteral Drug Association (PDA): Elements of a Code of Conduct for Data Integrity

(2015 – Free on PDA Website)


65



66


Basic Training

•Schedule Annual GMP Training

•Schedule Annual GDP Training

•Schedule Annual Data Integrity Training


67


Quality Agreements• Establish and Maintain Quality Agreements

• Talk to your Client/CMO on a regular basis

• Clearly define responsibilities

2019© Regulatory Compliance Associates Inc.

68


Network with Your Colleagues


69


Last but not least….


70


Pay Attention to Quality Culture

• Excerpts From PDA’s Elements of a Code of Conduct for

Data Integrity

– Each company that develops, tests and manufactures APIs,

intermediates, or pharmaceutical and biological products or

vendors/suppliers that provide supporting data may adopt a company

Code of Conduct for Data Integrity which establishes standards of

ethical behavior for all employees and officers of the company.

– In support of this code companies will establish programs that: (1)

promote an organizational culture that encourages ethical conduct; (2)

demonstrates the company's commitment to compliance with

applicable laws; and (3) requires the prevention and detection of data

integrity lapses.


71


Organization LevelsIn

crea

sin

g S

tra

tegic

Va

lue Dissociative

Company objectives include minimal

intrusion into operations, minimal

compliance efforts, inspect for quality;

Low training and implementation of

superficial processes.

Synergistic

Interactive

Proactive

Reactive

Dissociative


72


Organization Levels (cont’)In

crea

sin

g S

tra

tegic

Va

lue Reactive

Achieve basic compliance and implement

rudimentary QA/QC functions to avoid

serious violations and minimize costs.

Implement basic

design controls to meet basic reporting

requirements and accept product

classification risks.

Synergistic

Interactive

Proactive

Reactive

Dissociative


73



crea

sin

g S

tra

tegic

Va

lue Proactive

Perform gap analysis and implement an

effective quality program. Audit program

for compliance, conduct training,

communicate with regulatory agencies,

solicit employee input and demonstrate

cost/benefit advantage.

Synergistic

Interactive

Proactive

Reactive

Dissociative


74



crea

sin

g S

tra

tegic

Va

lue

Interactive

Quality objectives are the

company’s objectives. New

product introductions are

accelerated by understanding

regulatory and technology

concerns. Process established for

review and acceptance of new

technology to the FDA.

Synergistic

Interactive

Proactive

Reactive

Dissociative


75



crea

sin

g S

trate

gic

Va

lue Synergistic

Quality is internalized at all

levels and aligned with corporate

strategies. Regulatory agencies as

customers allowing root causes

of problems to be identified and

eliminated.

Synergistic

Interactive

Proactive

Reactive

Dissociative


76


“Quality is always fashionable.”

Boy George (George Alan O’Dowd), Lead Singer of Culture Club

1961 - present

77



78



What to Look For


79


Data Integrity Failures

Intentional acts of deception by operators/analysts

Managers allowing, ignoring, or even encouraging operator/analyst acts with

deception

Quality systems do not have adequate controls in place to guarantee data integrity

Managers initiating deception or requiring operators/analysts to act with deception

Unintentional and ignorance of personnel at any level not knowing the guidelines

of the industry


80


FDA Expectations

Should personnel be trained in detecting data integrity

issues as part of a routine CGMP training program?

Yes. Training personnel to detect data integrity issues is

consistent with the personnel requirements under §§ 211.25

and 212.10, which state that personnel must have the

education, training, and experience, or any combination

thereof, to perform their assigned duties.


81


Who Is Responsible?

Areas for Detecting Data Integrity issues

–QC and Laboratory

–Computer Systems

–Manufacturing

Detecting Data Integrity issues is not only a

function of audits, but as part of batch release

Quality culture- All of us play our part and have

some responsibility for data integrity.


82


Define Your StrategyFocus on high risk areas

Verify Controls are in Place

Focus on areas where relevant data may not part of standard review package.

–Deleted data

–Reprocessed data

–Test Injections

–Mirror records/records not recorded real time or orphan data

–Definition of file structure and naming conventions

–Product History/OOT results

–Products with High level of OOS or investigations

Problem Areas- Define areas of opportunity for breaches and/or products which pose

additional risks.


83


Data Integrity StrategyStrategies are built from a risk assessments, trending analyses, a GAP analyses, or complaints

as a way of identifying areas for needed improvement.

Annual Product Reviews can also provide information on high risk areas, is there higher than

expected rates of batch failure, or batch retest. Review OOS/OOT/CAPA’s and deviations to

determine what areas see a significant number of issues.

Interviews with management/leadership regarding level of involvement, level of awareness

and primary focus of company. Also what types of incentive programs, metrics or corrective

action programs are in place. Aggressive metrics programs focused only on timelines and

batch release volumes (financial) can indicate a lower priority for quality.

When auditing, utilize employee interviews in addition to management responses to obtain

the full story.

Look for Opportunity and Motivation to identify high risk data

Don’t Underestimate the importance of walking the floor to get “feel” for issues.


84


Mistakes

Mistakes happen and should not be construed as a

falsification

Integrity of the Data can still be at risk:

–It can be a failure in a Quality System

–Personnel issues/Quality Culture Issue

–Organizational Culture

–It can be any combination of any or all of the above

Focus on trends and if suspicious data is found, look for

other similar acts, track the suspicious acts and identify

patterns.


85


Evaluate the Quality CultureAre the Right People in Right Positions?

Do they have the right education, experience and training?

Do they have clear roles, responsibilities and accountabilities?

Are employees trained on and are there adequate job descriptions?

How do they know what to do hourly, daily, weekly, monthly, quarterly?

Do investigations implement effective corrective actions?

Does Management get involved in problem resolution?

Are there enough personnel to execute and provide OVERSIGHT?

Evaluate the Infrastructure – is there enough space, people. software, hardware, computers,

automation, etc.?

Are there have Metrics to drive performance and compliance?

Evaluate procedures and goals between departments: are they in alignment with each other?


86


Discovering Data Integrity Failures

After identification of high risk area or products, Select a broad data set

over a finite period of time and trace data sets from start to end. For

example, choose a product with high level of OOS issues, and select all

batches within a defined time period. Then track data generation from

start (such as raw materials release/warehouse) through

manufacturing/batch records clear thru QA/QC up to product release.

Three Areas of Major Areas of Focus:

A) Manufacturing

B) QC Analysis

C) Quality Systems


87


Batch RecordsIdentify all batch manufacturing records for a particular product or manufacturing area within

a time period for audit.

Review Documentation. Look for proper entry of Operator Signatures and

supervisor/management signatures in timely manner

Confirm Dates/Times are linear through the batch record execution and appropriate to process

Look for general GDP corrections that change the acceptability of data such as time

corrections which revised from data which exceeded hold time requirements to acceptable or

Corrections to get values in acceptable range (uncompliant data into compliant is likely to be

suspicious)

Verify suitable Document Control over batch issuance (no ability to create re-issue, reprint,

duplicate or create alternate working copy)

Review raw materials align when cross referenced to SAP records, QA release records,

material transfer records or other independent sources. Look for raw materials issued to area

on same time/date that may not be documented in batch record.


88


Batch Records - ContinuedVerify work staff align when cross referenced against personnel work logs,

timecards, area entry records or other independent sources.

Delays in batch step completion times vs. actual specified times

Delays in sampling of intermediates, in-process or batch completion samples,

as well as delays in in-process sampling against timing for in-process test

results, or SAP entry of intermediates and final batch completion.

Look for missing data, such weigh slips, raw material distribution records,

deviations to approved processes.

Check batch accountability or yield records, does it appear that product or

material is missing.

Review if SAP tracking entries made in a timely fashion upon completion of

specified steps.


89


Manufacturing Operations

Equipment and supplies present, are properly labeled and properly recorded in

batch record

Log books in place and used regularly

Look for notes, loose leaf memos/papers or other uncontrolled documentation

Check that Supplies are within expiry and properly released by QC

Batch Records are with personnel while manufacturing steps are taking place

Equipment is present and matches batch record entries, logbooks are present

near the equipment itself and use entries align with batch record.

Equipment Calibrations are current.

Interview employee regarding areas of responsibility, ask them where

instructions/SOPs are found, how problems are addressed.


90


Analytical DocumentsLaboratory Notebooks/Worksheets are properly controlled and tracked including a

reconciliation process for issued notebook/laboratory worksheets.

Verify inability to reprint uncontrolled copies of laboratory worksheets.

Audits trails are implemented and in use for all Electronic Data systems.

Review the data package against the electronic data. Does the data submitted for

review match the raw electronic data: date/time of final processing, batch number,

filename, method and instrument/user name match.

Part 11 compliance present, restricted access via user password/ID

Verify user access permissions are appropriate to the job responsibilities. Analyst

should not be able to delete electronic data!

Tests are performed in appropriate lab notebook or per the current analytical

method


91


Lab Equipment/Electronic Systems

Electronic Method can be reviewed to verify it matches version listed in data package.

Manual Integration should be used sparingly, and justified when used. Data package

should include original integration to visually verify improper integration and

reprocessed results, both expanded enough to visual confirmation.

If investigations are performed, review the progression from initial analysis,

investigation documentation, approval for following up testing through till data package

review for release. The investigation #No. is documented on laboratory

notebook/worksheet as well as within quality systems. Cross References are

documented

Investigation is opened prior to investigational analysis and all investigation analysis is

pre-documented in the Investigation

Check Audit trails for power outages, deleted data, aberrant file naming conventions,

aborted injections or sequences, test or trial injections or similar named data sets near

the time of data in question.


92


Lab Instrumentation

Analytical documents make appropriate cross reference to electronic data so data can be

retrieved

–Sequences and chromatograms of HPLC/GC

–FTIR spectrums

–Centrifuge, autoclave, ovens, or other instrument programs exist and can be verified

Check Audit Trails on instruments. Are they turned on and used 100% of the time. Review

time period surround data generation. Red flags can include unexplained power outages or

disconnected from server, file deletions, test injections or data generated with similar file

names.

Do systems have Password restricted access and unique log in id’s?

Data stored directly to the a filed server, and backed regularly, Can data be retrieved?

Is that backup copy of data package retrievable and does it match package?


93


Document ControlYou can not have Quality without well controlled documents and properly functioning quality

systems. The objective of well controlled quality systems is to close loopholes for data

manipulation by creating a permanent, traceable record of what occurs, who performs the task

and the outcomes.

Controlled Documents are a key component of Data Integrity

–Batch Records

–Analytical Records

–Investigations

–Protocols/Reports

–SOPS

Redundancies in records are a good thing, and provide added documentary support of data

integrity, but only when they align with each other.

Weak documentation control opens up windows of opportunity for abuse


94


Document Control (cont.)

Weakness can be:

–Copies/ Duplicates (2nd chance at getting it right without anyone

knowing)

–Ability to print second or working copy of controlled document

–Lost and misplaced pages or documents in a weak tracking/storage

system

–Supplemental records not cross referenced to Primary records

–Paper notebooks or loose leaf notebook pages must have proper

issuance and reconciliation for proper control.

–LIMS not properly versioning Analytical records (without any

loopholes)


95


Material ManagementInventories need to be identified, tracked, controlled, and be accurate

SAP or warehouse systems should match inventory

Applies to Manufacturing and Laboratory

Manufacturing (ex. SAP)

–Starting Materials

– In-Process

–Excipients

–Solvents

–Finished Product

Lab (ex.LIMS)

–Dry & Wet chemicals,

–Solvents

–Standards

–Test Samples

–COA’s

Items need proper labeling at all times, not just when leaving specified area

Inventory applications/software packages need to be validated for all functions that are being utilized


96


ForensicsForensic Auditing

–Forensic Audit is needed when a intentional deception is suspected

–Should be done by an independent, 3rd party Forensic Professionals

–Might include and/or identify extent of falsification

•Date Ranges in question

•Departments and people responsible for breach

•Product effected

•Batched effected

•Markets effected

–May include a Risk Assessment

–Compliance Gap Analysis

–Remediation plan and potential oversight


97


In Summary:Have a game plan for detecting data integrity issues.

Focus of high risk areas and areas which provide opportunity for integrity

breaches.

Evaluate the overall quality culture of the company. Interviews can be highly

informative, but also evaluate the documentation and resource structure.

Do not limit yourself to the records used for batch release, expand and verify

against audit trails, electronic records, and other independent sources.

Be systematic, follow the batch documentation from starting point clear

through to product release.

Trust your instincts when something doesn’t add up, or seems disconnected.


98