Quality Program, CAPA and Quality Program, CAPA and AuditsAudits

33rdrd Annual FDA and the Changing Annual FDA and the Changing Paradigm for HCT/P RegulationParadigm for HCT/P Regulation

January 25, 2007January 25, 2007Mary Malarkey, Director, OCBQ, CBERMary Malarkey, Director, OCBQ, CBER

SummarySummary

•• CGTP CGMP QS RegulationCGTP CGMP QS Regulation•• ““QualityQuality”” comparisoncomparison•• CAPA comparisonCAPA comparison•• Audit comparisonAudit comparison

QualityQuality

•• Quality Program Quality Program –– 1271.1601271.160•• You must establish and maintain a quality You must establish and maintain a quality

program intended to prevent the introduction, program intended to prevent the introduction, transmission, or spread of communicable transmission, or spread of communicable diseases through the manufacture and use of diseases through the manufacture and use of HCT/Ps. The quality program must be HCT/Ps. The quality program must be appropriate for the specific HCT/Ps appropriate for the specific HCT/Ps manufactured and the manufacturing steps manufactured and the manufacturing steps performed. The quality program must address performed. The quality program must address all core CGTP requirements listed in Sec. all core CGTP requirements listed in Sec. 1271.150(b). 1271.150(b).

Quality ProgramQuality Program•• (b) Functions. Functions of the quality program (b) Functions. Functions of the quality program

must include: must include: •• (1) Establishing and maintaining appropriate procedures relating(1) Establishing and maintaining appropriate procedures relating

to core CGTP requirements, and ensuring compliance with the to core CGTP requirements, and ensuring compliance with the requirements of Sec. 1271.180 with respect to such procedures, requirements of Sec. 1271.180 with respect to such procedures, including review, approval, and revision; including review, approval, and revision;

•• (2) Ensuring that procedures exist for receiving, investigating,(2) Ensuring that procedures exist for receiving, investigating,evaluating, and documenting information relating to core CGTP evaluating, and documenting information relating to core CGTP requirements, including complaints, and for sharing any requirements, including complaints, and for sharing any information pertaining to the possible contamination of the information pertaining to the possible contamination of the HCT/P or the potential for transmission of a communicable HCT/P or the potential for transmission of a communicable disease by the HCT/P with the following: (i) Other disease by the HCT/P with the following: (i) Other establishments that are known to have recovered HCT/Ps from establishments that are known to have recovered HCT/Ps from the same donor; the same donor;

Quality Program (cont)Quality Program (cont)•• (ii) Other establishments that are known to have (ii) Other establishments that are known to have

performed manufacturing steps with respect to the same performed manufacturing steps with respect to the same HCT/P; and (iii) Relating to consignees, in the case of HCT/P; and (iii) Relating to consignees, in the case of such information received after the HCT/P is made such information received after the HCT/P is made available for distribution, shipped to the consignee, or available for distribution, shipped to the consignee, or administered to the recipient, procedures must include administered to the recipient, procedures must include provisions for assessing risk and appropriate provisions for assessing risk and appropriate followupfollowup, , and evaluating the effect this information has on the and evaluating the effect this information has on the HCT/P and for the notification of all entities to whom the HCT/P and for the notification of all entities to whom the affected HCT/P was distributed, the quarantine and affected HCT/P was distributed, the quarantine and recall of the HCT/P, and/or reporting to FDA, as recall of the HCT/P, and/or reporting to FDA, as necessary. necessary.

Quality Program (cont)Quality Program (cont)•• (3) Ensuring that appropriate corrective actions (3) Ensuring that appropriate corrective actions

relating to core CGTP requirements, including relating to core CGTP requirements, including reauditsreaudits of deficiencies, are taken and documented, of deficiencies, are taken and documented, as necessary. You must verify corrective actions to as necessary. You must verify corrective actions to ensure that such actions are effective and are in ensure that such actions are effective and are in compliance with CGTP. Where appropriate, corrective compliance with CGTP. Where appropriate, corrective actions must include both shortactions must include both short--term action to term action to address the immediate problem and longaddress the immediate problem and long--term action term action to prevent the problem's recurrence. Documentation to prevent the problem's recurrence. Documentation of corrective actions must include, where appropriate: of corrective actions must include, where appropriate: (i) Identification of the HCT/P affected and a (i) Identification of the HCT/P affected and a description of its disposition; (ii) The nature of the description of its disposition; (ii) The nature of the problem requiring corrective action; (iii) A description problem requiring corrective action; (iii) A description of the corrective action taken; and (iv) The of the corrective action taken; and (iv) The date(sdate(s) of ) of the corrective action. the corrective action.

Quality Program (cont)Quality Program (cont)•• ((4) Ensuring the proper training and education of personnel 4) Ensuring the proper training and education of personnel

involved in activities related to core CGTP requirements; involved in activities related to core CGTP requirements; •• (5) Establishing and maintaining appropriate monitoring systems (5) Establishing and maintaining appropriate monitoring systems

as necessary to comply with the requirements of this subpart as necessary to comply with the requirements of this subpart (e.g., environmental monitoring); (e.g., environmental monitoring);

•• (6) Investigating and documenting HCT/P deviations and trends (6) Investigating and documenting HCT/P deviations and trends of HCT/P deviations relating to core CGTP requirements and of HCT/P deviations relating to core CGTP requirements and making reports if required under Sec. 1271.350(b) or other making reports if required under Sec. 1271.350(b) or other applicable regulations. Each investigation must include a reviewapplicable regulations. Each investigation must include a reviewand evaluation of the HCT/P deviation, the efforts made to and evaluation of the HCT/P deviation, the efforts made to determine the cause, and the implementation of corrective determine the cause, and the implementation of corrective action(saction(s) to address the HCT/P deviation and prevent ) to address the HCT/P deviation and prevent recurrence. recurrence.

•• (c) Audits. You must periodically perform for management review (c) Audits. You must periodically perform for management review a a quality audit, as defined in Sec. 1271.3(gg), of activities relaquality audit, as defined in Sec. 1271.3(gg), of activities related to ted to core CGTP requirements. core CGTP requirements.

Definitions 1271.3Definitions 1271.3•• t) Responsible person means a person who is t) Responsible person means a person who is

authorized to perform designated functions for authorized to perform designated functions for which he or she is trained and qualified. which he or she is trained and qualified.

•• hhhh) Quality program means an organization's ) Quality program means an organization's comprehensive system for manufacturing and comprehensive system for manufacturing and tracking HCT/Ps in accordance with this part. A tracking HCT/Ps in accordance with this part. A quality program is designed to prevent, detect, quality program is designed to prevent, detect, and correct deficiencies that may lead to and correct deficiencies that may lead to circumstances that increase the risk of circumstances that increase the risk of introduction, transmission, or spread of introduction, transmission, or spread of communicable diseases. communicable diseases.

From the PreambleFrom the Preamble

•• ““..we use the term ``quality program'' to refer to ..we use the term ``quality program'' to refer to the set of activities, including management the set of activities, including management review, training, audits, and corrective and review, training, audits, and corrective and preventive actions, that represent a commitment preventive actions, that represent a commitment on the part of an establishment's management on the part of an establishment's management to the quality of its products. Whether this set of to the quality of its products. Whether this set of activities is regarded as a part of manufacture or activities is regarded as a part of manufacture or as a separate system for overseeing as a separate system for overseeing manufacture, as preferred by the comment, is manufacture, as preferred by the comment, is not material.not material.””

From the Preamble (cont)From the Preamble (cont)•• ““We note that the regulation does not require an We note that the regulation does not require an

establishment to hire a separate quality control establishment to hire a separate quality control employee; moreover, we have removed the employee; moreover, we have removed the requirement for the designation of an individual requirement for the designation of an individual with authority over the program (proposed Sec. with authority over the program (proposed Sec. 1271.160(c)).1271.160(c)).””

•• ““The quality program required under Sec. The quality program required under Sec. 1271.160 is a system that each establishment 1271.160 is a system that each establishment sets up to ensure its compliance with core CGTP sets up to ensure its compliance with core CGTP requirements. These regulations do not contain requirements. These regulations do not contain generalized quality requirements. generalized quality requirements. ““

Quality Control Unit21 CFR 211.22

Quality Control UnitQuality Control Unit21 CFR 211.2221 CFR 211.22

•• Responsibility and authority to approve/reject all Responsibility and authority to approve/reject all components, incomponents, in--process materials, packaging, process materials, packaging, labeling and drug products and authority to labeling and drug products and authority to review records to assure no errors have review records to assure no errors have occurred and if occur; fully investigated; occurred and if occur; fully investigated; including contract operations.including contract operations.

•• Responsibility to approve/reject Responsibility to approve/reject procedures/specifications impacting on identity, procedures/specifications impacting on identity, strength, quality, and purity of the drug productstrength, quality, and purity of the drug product

•• Adequate laboratory facilities for testingAdequate laboratory facilities for testing•• Responsibilities and procedures in writingResponsibilities and procedures in writing

AdditionallyAdditionally

•• 21 CFR 211.10021 CFR 211.100•• Production and process controls procedures (process Production and process controls procedures (process

validation), including changes ..reviewed and validation), including changes ..reviewed and approved by the QCU.approved by the QCU.

•• 21 CFR 211.16021 CFR 211.160•• Establishment of specifications, standards, sampling Establishment of specifications, standards, sampling

plans, test procedures, or other laboratory control plans, test procedures, or other laboratory control mechanisms, including changes to anymechanisms, including changes to any……reviewed reviewed and approved by the QCUand approved by the QCU

AdditionallyAdditionally

•• 21 CFR 211.192 21 CFR 211.192 –– Production Record Production Record ReviewReview•• All drug product production and control All drug product production and control

recordsrecords……shall be reviewed by the QCU to shall be reviewed by the QCU to determine compliance with all established, determine compliance with all established, approved, written procedures before a batch approved, written procedures before a batch is released or distributed. Any discrepancies is released or distributed. Any discrepancies must be thoroughly investigated .must be thoroughly investigated .

AdditionallyAdditionally

•• 21 CFR 211.198 21 CFR 211.198 -- Complaint FilesComplaint Files•• Written procedures established and followed, Written procedures established and followed,

including provisions for review by the QCU of including provisions for review by the QCU of any complaint related to drug product failures; any complaint related to drug product failures; need for investigation; need to evaluate need for investigation; need to evaluate whether represents and adverse drug whether represents and adverse drug experience and, if so, reported properlyexperience and, if so, reported properly

Definition Definition –– 210.3(b)210.3(b)

•• (15) Quality Control Unit means any (15) Quality Control Unit means any person or organizational element person or organizational element designated by the firm to be responsible designated by the firm to be responsible for the duties relating to quality control.for the duties relating to quality control.

Quality System RequirementsQuality System Requirements

•• 820.20 Management Responsibility 820.20 Management Responsibility –– establish establish and maintain:and maintain:•• Quality policyQuality policy•• OrganizationOrganization

•• Responsibility and authorityResponsibility and authority•• ResourcesResources•• Management representativeManagement representative

•• Management reviewManagement review•• Quality planningQuality planning•• Quality system proceduresQuality system procedures•• Quality AuditsQuality Audits

Definitions Definitions -- 820.3 820.3 •• (s) Quality means the totality of features and (s) Quality means the totality of features and

characteristics that bear on the ability of a device characteristics that bear on the ability of a device to satisfy fitnessto satisfy fitness--forfor--use, including safety and use, including safety and performance. performance.

•• (u) Quality policy means the overall intentions (u) Quality policy means the overall intentions and direction of an organization with respect to and direction of an organization with respect to quality, as established by management with quality, as established by management with executive responsibility. executive responsibility.

•• (v) Quality system means the organizational (v) Quality system means the organizational structure, responsibilities, procedures, structure, responsibilities, procedures, processes, and resources for implementing processes, and resources for implementing quality management. quality management.

Differences: CGTP vs. CGMP and Differences: CGTP vs. CGMP and QS Regulation; include:QS Regulation; include:

•• OrganizationalOrganizational•• Designated Designated individual(sindividual(s) or unit or structure (CGMP ) or unit or structure (CGMP

and QS Regulation)and QS Regulation)

•• Responsibility/AuthorityResponsibility/Authority•• Review and approval by QCU (CGMP)Review and approval by QCU (CGMP)•• Management representative (QS Regulation)Management representative (QS Regulation)

•• ScopeScope•• Fitness for use; safety and effectiveness or Fitness for use; safety and effectiveness or

performance (CGMP and QS Regulation)performance (CGMP and QS Regulation)•• Communicable Disease Transmission Communicable Disease Transmission –– Core Core CGTPsCGTPs

CAPA 1271.160CAPA 1271.160•• (3) Ensuring that appropriate corrective actions (3) Ensuring that appropriate corrective actions

relating to core CGTP requirements, including relating to core CGTP requirements, including reauditsreaudits of deficiencies, are taken and documented, of deficiencies, are taken and documented, as necessary. You must verify corrective actions to as necessary. You must verify corrective actions to ensure that such actions are effective and are in ensure that such actions are effective and are in compliance with CGTP. Where appropriate, corrective compliance with CGTP. Where appropriate, corrective actions must include both shortactions must include both short--term action to term action to address the immediate problem and longaddress the immediate problem and long--term action term action to prevent the problem's recurrence. Documentation to prevent the problem's recurrence. Documentation of corrective actions must include, where appropriate: of corrective actions must include, where appropriate: (i) Identification of the HCT/P affected and a (i) Identification of the HCT/P affected and a description of its disposition; (ii) The nature of the description of its disposition; (ii) The nature of the problem requiring corrective action; (iii) A description problem requiring corrective action; (iii) A description of the corrective action taken; and (iv) The of the corrective action taken; and (iv) The date(sdate(s) of ) of the corrective action. the corrective action.

CAPA 211.192CAPA 211.192•• Any unexplained discrepancy (including a percentage of Any unexplained discrepancy (including a percentage of

theoretical yield exceeding the maximum or minimum theoretical yield exceeding the maximum or minimum percentages established in master production and percentages established in master production and control records) or the failure of a batch or any of its control records) or the failure of a batch or any of its components to meet any of its specifications shall be components to meet any of its specifications shall be thoroughly investigated, whether or not the batch has thoroughly investigated, whether or not the batch has already been distributed. The investigation shall extend already been distributed. The investigation shall extend to other batches of the same drug product and other to other batches of the same drug product and other drug products that may have been associated with the drug products that may have been associated with the specific failure or discrepancy. A written record of the specific failure or discrepancy. A written record of the investigation shall be made and shall include the investigation shall be made and shall include the conclusions and conclusions and followupfollowup. .

CAPA 820.100CAPA 820.100•• (a) Each manufacturer shall establish and maintain (a) Each manufacturer shall establish and maintain

procedures for implementing corrective and preventive procedures for implementing corrective and preventive action. The procedures shall include requirements for: action. The procedures shall include requirements for: •• (1) Analyzing processes, work operations, concessions, quality (1) Analyzing processes, work operations, concessions, quality

audit reports, quality records, service records, complaints, audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or otherexisting and potential causes of nonconforming product, or otherquality problems. Appropriate statistical methodology shall be quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems; employed where necessary to detect recurring quality problems;

•• (2) Investigating the cause of nonconformities relating to produ(2) Investigating the cause of nonconformities relating to product, ct, processes, and the quality system; processes, and the quality system;

•• (3) Identifying the (3) Identifying the action(saction(s) needed to correct and prevent ) needed to correct and prevent recurrence of nonconforming product and other quality problems; recurrence of nonconforming product and other quality problems;

820.100 (cont)820.100 (cont)•• (4) Verifying or validating the corrective and preventive action(4) Verifying or validating the corrective and preventive action to to

ensure that such action is effective and does not adversely affeensure that such action is effective and does not adversely affect ct the finished device; the finished device;

•• (5) Implementing and recording changes in methods and (5) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality procedures needed to correct and prevent identified quality problems; problems;

•• (6) Ensuring that information related to quality problems or (6) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the responsible for assuring the quality of such product or the prevention of such problems; and prevention of such problems; and

•• (7) Submitting relevant information on identified quality (7) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for problems, as well as corrective and preventive actions, for management review. management review.

•• (b) All activities required under this section, and their (b) All activities required under this section, and their results, shall be documented. results, shall be documented.

Audits 1271.160(c)Audits 1271.160(c)

•• (c) Audits. You must periodically perform (c) Audits. You must periodically perform for management review a quality audit, as for management review a quality audit, as defined in Sec. 1271.3(gg), of activities defined in Sec. 1271.3(gg), of activities related to core CGTP requirements. related to core CGTP requirements.

Definition 1271.3(gg)Definition 1271.3(gg)

•• ((gggg) Quality audit means a documented, ) Quality audit means a documented, independent inspection and review of an independent inspection and review of an establishment's activities related to core establishment's activities related to core CGTP requirements. The purpose of a CGTP requirements. The purpose of a quality audit is to verify, by examination quality audit is to verify, by examination and evaluation of objective evidence, the and evaluation of objective evidence, the degree of compliance with those aspects degree of compliance with those aspects of the quality program under review. of the quality program under review.

Audits 211?Audits 211?

•• No specific requirement for internal auditsNo specific requirement for internal audits•• Common industry practice to conduct such Common industry practice to conduct such

auditsaudits•• Requirement for annual product reviewRequirement for annual product review

211.180 (e)211.180 (e)•• Written records required by this part shall be maintained Written records required by this part shall be maintained

so that data therein can be used for evaluating, at least so that data therein can be used for evaluating, at least annually, the quality standards of each drug product to annually, the quality standards of each drug product to determine the need for changes in drug product determine the need for changes in drug product specifications or manufacturing or control procedures. specifications or manufacturing or control procedures. Written procedures shall be established and followed for Written procedures shall be established and followed for such evaluations and shall include provisions for: such evaluations and shall include provisions for: •• (1) A review of a representative number of batches, whether (1) A review of a representative number of batches, whether

approved or rejected, and, where applicable, records associated approved or rejected, and, where applicable, records associated with the batch. with the batch.

•• (2) A review of complaints, recalls, returned or salvaged drug (2) A review of complaints, recalls, returned or salvaged drug products, and investigations conducted under Sec. 211.192 for products, and investigations conducted under Sec. 211.192 for each drug product. each drug product.

Audits 820.22Audits 820.22•• Each manufacturer shall establish procedures for quality Each manufacturer shall establish procedures for quality

audits and conduct such audits to assure that the quality audits and conduct such audits to assure that the quality system is in compliance with the established quality system is in compliance with the established quality system requirements and to determine the effectiveness system requirements and to determine the effectiveness of the quality system. Quality audits shall be conducted of the quality system. Quality audits shall be conducted by individuals who do not have direct responsibility for by individuals who do not have direct responsibility for the matters being audited. Corrective the matters being audited. Corrective action(saction(s), including ), including a a reauditreaudit of deficient matters, shall be taken when of deficient matters, shall be taken when necessary. A report of the results of each quality audit, necessary. A report of the results of each quality audit, and and reaudit(sreaudit(s) where taken, shall be made and such ) where taken, shall be made and such reports shall be reviewed by management having reports shall be reviewed by management having responsibility for the matters audited. The dates and responsibility for the matters audited. The dates and results of quality audits and results of quality audits and reauditsreaudits shall be shall be documented. documented.

Definition 820.3Definition 820.3

•• (t) Quality audit means a systematic, (t) Quality audit means a systematic, independent examination of a manufacturer's independent examination of a manufacturer's quality system that is performed at defined quality system that is performed at defined intervals and at sufficient frequency to determine intervals and at sufficient frequency to determine whether both quality system activities and the whether both quality system activities and the results of such activities comply with quality results of such activities comply with quality system procedures, that these procedures are system procedures, that these procedures are implemented effectively, and that these implemented effectively, and that these procedures are suitable to achieve quality procedures are suitable to achieve quality system objectives. system objectives.

For all internal audits:For all internal audits:•• Compliance Policy Guide 130.300Compliance Policy Guide 130.300•• FDAFDA’’s policy is ..s policy is ..””not to review or copy a firm's not to review or copy a firm's

records and reports that result fromrecords and reports that result from…… auditsaudits””•• FDA may seek written certification that such FDA may seek written certification that such

audits and inspections have been implemented, audits and inspections have been implemented, performed, and documented and that any performed, and documented and that any required corrective action has been taken required corrective action has been taken

•• The intent of the policy is to encourage firms to The intent of the policy is to encourage firms to conduct conduct ……..audits and inspections that are ..audits and inspections that are candid and meaningful.candid and meaningful.

•• Limited exceptions Limited exceptions –– e.g. inspections by warrante.g. inspections by warrant