survival guide of fda inspection - before audit - part 1

7/24/2019 Survival Guide of FDA Inspection - Before Audit - Part 1

1/6

concerns, problems,

and difficulties are

those that FDA

inspectors look out

for. Then we make

sure you know how

to address those

issues properly (see

the Prepare for an

FDA Inspectionsidebar).

Much of an

inspection focuses

on a companys

quality systems. By

definition, a quality

system is a program

that addresses the

needs and elements

of a specific part of a

manufacturing oper-ation. A training

program, for exam-

ple, is a quality

system a quality

system that defines

in detail how the

company will ensure

that its employees have the proper knowledge to

carry out their responsibilities.

Pharmaceutical and biotechnology companies

typically determine how they are going toclassify their quality systems. Quality systems

typically include standard operating procedures

(SOPs), monitoring programs, change control

policies, validation programs, training, deviation

and investigation programs, and consistent docu-

mentation practices.

Our survival guide, therefore, also begins by

focusing on quality systems: on determining

those quality systems needed and in place, on

ascertaining how practical particular quality

systems are, and on checking how well thosequality systems have been implemented and

followed. It is the responsibility of a companys

management to ensure that quality systems are in

place, reviewed periodically, upgraded, imple-

mented, and followed.

STANDARD OPERAT ING PROCEDURESSOPs are a critical quality system feature, and

they frequently get inspected their contents,

the quality of their preparation, and how well

they are followed. SOPs are detailed documentsthat specify operating guidelines and instructions

for every procedure within the company.

F

or many companies, coping with an

FDA inspection can be a nightmare.

Workloads increase significantly before,

during, and after an inspection, andthere is always the potential that a major

regulatory economic downfall could be

part of a companys future if the inspec-

tion yields negative or mixed results.

This three-part series addresses common

issues that arise during an FDA inspection and

provides advice on how to prevent those difficul-

ties. Part 1 describes those actions and programs

that must be part of routine operations, whether

an inspection is imminent or not. Part 2 focuses

on inspection day and what to do during thatexamination. Part 3 follows the aftermath

responding to inspection results, implementing

corrective actions, and learning from the entire

inspection process.

We dont try to predict all the possible

questions and concerns that can come up during

an inspection. Even an FDA inspector couldnt

do that. Instead, we discuss common deficiencies.

This survival guide ensures that you know what

an inspection is, what aspects of company opera-

tions (equipment, documents, tests) are likely tobe inspected, and what the most common

Would your company

survive a surprise

inspection? An FDA

inspection can be anightmare that costs

your company money,

time, and reputation.

Proactive managers

understand the logic

behind FDA regulations

and prepare accordingly.

This three-part survival

guide to inspections

(whether from FDA, a

client, an investor, or a

European agency) willsharpen your vision

of your companys

regulatory compliance

picture.

20 BioPharm AUGUST 2002

Massoud Lavian and Paul W. Allen


2/6

Figure 1. Validation protocols for a typical softwarelife cycle

BioPharm AUGUST 2002 21

SOPs two to do. Two types of SOPs are

common. The first type is corporate or global

SOPs (policies and procedures set forth by the

companys highest management level), that de-

scribe general company policies. A companys di-

visions, functions, and groups subject to GMP

requirements (that is, all departments excluding

functions such as finance, marketing, and sales)

are required to comply with global SOPs (13).

Local SOPs document routine tasks and makeprovisions for nonroutine tasks for all specific

functions or departments within the company.

These documents detail the tasks that must be

performed at each step in the manufacturing

process. Examples of these tasks include steril-

ization, equipment operation, emergencies, and

documentation practices. Examples of observa-

tions that FDA inspectors make about SOPs are

listed in the SOP Failuressidebar. Remember,

SOPs are the first line of defense during an in-

spection: They describe how procedures and situ-ations are supposed to be handled, even those sit-

uations, such as an emergency or a contaminated

batch, that a company has never faced before.

Monitoring systems. Another quality system that

is closely scrutinized during a typical inspection is

the monitoring program. Typically, a production

site must have a continuous monitoring program of

all critical elements of the manufacturing opera-

tion. Critical elements include, for example, build-

ing and equipment monitoring, water quality

assessment, environmental monitoring, andmicrobial level measurements in aseptic fill areas.

Monitoring samples. The monitoring program

clearly defines what needs to be sampled and

when, how the sample is taken, and ho w the

sample must be handled and tested. It also

outlines acceptable results supported by valida-

tion studies. Monitoring programs must include

provisions for test results outside acceptable

limits, assigning action and alert limits, address-

ing who needs to be notified, assessing the effect

of the out-of-specification (OOS) result, andapproving and implementing a corrective action.

Responsibility must be assigned to a specific

person who reviews the results in each area and

identifies trends in the data.

OOS results. FDA observations about monitor-

ing programs cite the lack of clear specifications

for when to sample, the location from which to

draw the sample, the number of samples, and

poor handling for OOS or failed test results. It is

inevitable that at some point a test result will fail.

(In fact, an experienced inspector will doubt thevalidity of test results that remain acceptable over

long periods of time.) Inspectors want to know

how the failed result was handled, how the effect

of the OOS result was assessed, how the correc-

tive action was agreed upon, who approved the

corrective steps, what the thought processes were

behind the final decision about corrective action,

and how the entire episode was documented.

Therefore, before your company is notified that

an inspection is imminent, review your monitor-

ing programs and make sure they are sound androbust.

Design

Vendor audit

Functional

requirements

Vendor RFP

Validation master plan

Configuration designProgram design

specifications

21 CFR Part 11

assessment

Security plan

Data migration plan

Tool description

Hardware description

Installation

qualification

Acceptance criteria

Development

Source code

Configuration

Vendor

documentation

SOP development

SOP validationSOP system use

Change control

process

Audit trail

specifications

Testing

Unit test

enhancements

Change control

Traceability matrix

System test user

acceptance

Problem report

resolution

Training

Operational

qualification

Installation

Performance

qualification

Stress test

Disaster recovery plan

Validation summary

report

Maintenance

Routine audits

Back-ups and archive


3/6

process is carried out is the best example of how

work is planned, executed, and documented on a

daily basis. Therefore, the quality of a companys

validation program shows an inspector the level

of detail and technical knowledge that the

company applies to day-to-day operations. Even

if an inspection does not start with validation, it

almost always raises issues that can be traced

back to the original validation work.

A comprehensive validation program startswith policies that establish guidelines and respon-

sibilities for validation processes. Those policies

typically cover procedures for preparing, review-

ing, approving, executing, and completing the

validation plan.

In separate documents, the validation require-

ments for individual areas, such as laboratory

equipment and processes, computers, cleaning,

and utilities, among others, must be clearly

defined. This set of documents establishes a com-

panys commitment to its validation efforts. Thedocuments also establish a requalification

program at timely, preestablished intervals to

verify the results of the original validation effort.

A validation master plan (VMP) is also essential

because it establishes a companys validation

plans for the near future. It should include a list

of validation activities that the company plans to

complete within a reasonable time frame. Once a

VMP is approved, periodic reviews will ensure

that validation plans are on schedule assuring in-

spectors that the company is committed tocompleting its validation tasks. VMPs do not,

however, replace completed validation efforts.

Validation protocols are the most critical element

of a validation program. Figure 1 shows the vali-

dation processes in a typical software life cycle.

Creating validation protocols is an extremely

detailed process, but as a general rule, companies

should ask the questions in the Before an

VAL IDAT ION PROGRAMSAt your next staff meeting, ask your coworkers,

Does our company have a comprehensive

validation program in place?Be prepared for

several interesting responses.

Validation programs are arguably what inspec-

tors are most interested in when they visit your

company. During validation, critical parameters

and acceptable ranges are established for

processes and equipment. The quality of the vali-

dation program indicates how tests are performed

and documented, how deviations are handled, and

how conclusions are reached. How a validation

This list of five To Do or Not to Do items will help you prepare for an

FDA inspection.

Dont procrastinate. Never wait until the last minute to prepare for a scheduledinspection. At a minimum, examine your quality systems, your training program,

how well your SOPs are being followed, your documentation, and your

correction processes at departmental levels on a regular basis. This will ensurethat you are current with any changes in your systems and are properly

documenting them.

Correct issues that FDA has already cited. Make sure that all corrective actions have

been taken and thoroughly documented. Simply knowing that a problem exists

is not a defense. Be proactive, and review public records on actions the agency

has taken against other companies.

Assign responsibilities. Assign specific responsibilities to departments. Allow the

department leader to assign the responsibility to a specific individual or job role,

making both the department leader and the individual accountable. Build the

responsibilities directly into job descriptions, and make them part of an

employees annual review. There is no substitute for accountability.Document everything. FDAs unwritten rule is that if something is not documented,

it either does not exist or never took place. Follow good documentation

procedures (GDP). Technology makes it easy to follow established formats and

requirements.

Work with QA, not against it. The QA department is responsible for overseeing

quality system implementation and approves final decisions. Ultimately, the

responsibility of producing drugs and devices rests with QA (actually theres not a

lot of resting involved). So work collaboratively with them instead of against them.

To Prepare for an FDA Inspection

A proactive manager asks questionsabout the companys validation

protocols well before an inspection is

anticipated. Questions such as the

following will shine a light on any fog in

your companys regulatory compliance

picture.

Is our validation approach sound? That

is, are we testing what we should be

testing? Is our validation approach in line

with current industry practices and with

the latest guidelines?

Are our validation protocols clear anddetailed enough that they can be followed

easily without further explanations?

Are all equipment, computer systems,

processes, utilities, and lab equipment

validated? Has the final report for those

validation activities been reviewed and

approved?

Does our validation effort establish

operation limits? Are those limits

incorporated into our daily operation? Are

instructions in place on what to do whenthose limits are exceeded?

Are all instructions in our generalprotocol followed? If not, why?

Are all results supported by data and

reproducible?

Is our companys requalification program

on track and on time?

Are all our validation documents

assembled, reviewed, and included?

What is the quality of our companys

documentation?

Are all GMPs included and followed in

our validation efforts?

Before an Inspection

22 BioPharm AUGUST 2002


4/6BioPharm AUGUST 2002 23

DEV IAT IONS AND CORRECT IONS

Another frequent focus during inspections is a

companys deviation management and its correc-

tive actions. Deviations can occur during manu-

facturing, validating, laboratory testing, or

program monitoring.Deviation managementis a

program under which OOS results are reviewed,

analyzed, trended, and corrected. Typical ques-tions that an experienced inspector has in mind

when inspecting a companys deviation manage-

ment and corrective actions are listed in the

Inspecting Deviationssidebar.

Deviations can take place when manufacturing

equipment breaks down or when operators make

errors. In these circumstances, it is important to

analyze trends in the deviations and to determine

the reason for the failures. If there is a trend, what

is causing it? Is it user error or improper equip-

ment use? If the equipment is being used improp-erly, was there an SOP on the machine, and was

the SOP being followed? Deviations are red flags

that can portend even bigger problems.

T R A IN INGA review of the most recent citations issued to

companies by FDA shows that many of the issues

they cite relate to human error (4). The key to

overcoming human error problems is proper and

frequent training.

Inspectors examine training records when theyreach the conclusion that improper use of the

machinery or human errors are the cause of a

cited issue. The inspector in these cases will natu-

rally ask if proper training was conducted. There-

fore, you need to ask the questions first.

When evaluating your companys training

program, be sure to document your responses to

training questions. Does a formal program

mandate training? Does the training program

specify who needs to be trained and on what

equipment or processes? Are training materialspresented properly by a qualified trainer? Do the

training records indicate who was trained and on

Inspectionsidebar about the companys valida-

tion programs.

BATCH RECORDSThe biopharmaceutical industry generates

massive batch records (about the size of tele-

phone books) full of comprehensive data that

include each step taken during manufacturing and

a log of the necessary controls, checks, and

balances. These documents are a compilation ofproduction records, test data for raw materials,

components, and product integrity. Everything is

documented in batch records: the vials used, the

equipment used, and the product temperature

when machines are in operation, among many

other items. Batch records are the ultimate proof

that the batch was prepared using established and

predefined steps.

Batch record violations. Batch records are often

one of the first items that FDA inspectors examine

for deviations, missing information, the quality ofa companys documentation practices, and other

operating weaknesses. Inspectors want to assess

whether the companys records are comprehensive

enough to reflect all production facts, how the

companys quality assurance department reviews

the records, how deviations are detected and re-

sponded to, and whether there is any missing data

in such documents. FDA frequently cites compa-

nies that fail to properly analyze their batch record

data, that keep inadequate data, that fail to describe

deviations in detail, or that provide insufficientresponses to deviations. If batches are OOS, com-

panies must understand why and demonstrate that

they can correct the problem and prevent recur-

rence. Such documents can be long and the analy-

sis process tedious, but the process can result in

cost savings if the company can identify ways to

solve ongoing problems.

Batch records as preventive measures. Batch

records can clear a companys name and disprove

suspicions of wrongdoing. In 1982, McNeil

Consumer Products, a division of Johnson &Johnson (www.jnj.com) and the maker of

Tylenol, was faced with product alteration in

which Tylenol was laced with cyanide, causing

several U.S. deaths. McNeils batch records

helped the company defend its procedures and

supported the theory that the problem was not a

production deviation but postproduction tamper-

ing. Therefore, a company should pay close

attention to the contents of its batch records, how

those records are filled out during operation, and

how the documents are reviewed.

Following are typical

questions that an

experienced inspector has

in mind when inspecting a

companys deviationmanagement and

corrective action plans.

Is a formal investigation

program in place to address

deviations?

Are deviations noticed by

chance, or are they detected

in a timely manner during

systematic evaluation?

How was the effect of the

deviation determined? Whoapproved that determination?

Was trend analysis

conducted under a formal

program or SOP? Was there

a global approach to

determining whether a

deviation was an isolated

incident? Was a trend

detected?

Was the root cause of a

deviation found and

corrected?

Who was involved in

determining corrective

action? How was the

corrective action decision

reached?

Was the investigation of the

deviation performed and

concluded in a timely

manner?

Was corrective actionuniversal? Was it effective?

What was done to prevent

the deviation from happening

again?

What measures were taken

to assess the corrective

action to ensure that it would

not be the source of future

deviations?

Were all of the above actions

properly documented?

Inspecting Deviations


5/624 BioPharm AUGUST 2002

glassware, clean gowns, coveralls, and chemicals

or components that are used to manufacture drugs

and medical devices.

A receiving and inspection program needs to

define the expectations about each commodity or

ingredient being received. The SOPs on the

program should state those steps that need to be

taken when ingredients or components are

received to ensure that the material received meets

expected quality attributes. The SOPs may includea review of vendor certificates of analysis and of

test results, or they may require internal sampling

and testing approved by the quality assurance and

quality control (QA/QC) functions within the

company. When a company conducts sample tests,

it must document the results properly. Companies

concerned about quality standards often consider

third-party organizations that can conduct tests and

confirm the required attributes of the raw materi-

als. If this route is chosen, the outside testing labo-

ratory should be audited and qualified.

C H A NG E C O NT R O L

Throughout the manufacturing operation and

within all production processes, change is

inevitable. New process steps, changes in equip-

ment, and improvements or corrected inadequacies

all cause change within a companys operations.

A formal program must be in place to handle

changes. Inspectors often focus on this facet of

production during an inspection. Inspectors

reviewing a companys change control programswill ask if a formal change control program is in

place, who adminis-

ters the program,

and which

department has ulti-

mate authority over

change control.

They will ask how

the effects of a

change are as-

sessed, what stepsare taken to mini-

mize or prevent ad-

ditional impacts,

how decisions are

made, the thought

processes behind

change, and who approves them. And, as in all

other production processes reviewed, an inspector

will want to know how the entire change event, the

actions taken in response to the change, and the de-

cisions made regarding the change have beendocumented.

what equipment or process? Are the records

available for inspection? Was training effective

in preventing further deviations?

Inspectors can choose to determine the effec-

tiveness of a companys training for them-

selves. For example, they may observe the

gowning procedures for entering classified

areas when the cause of a contamination prob-

lem was determined to be improper gowning

practices. To be proactive and prevent the need

for this type of inspection, companies should set

up comprehensive training programs that

clearly define who needs training, what type of

training they need, and how frequently addi-

tional or refresher training will be required.

Training programs attended should be docu-

mented and attached to each employees record.

R E C E IV ING A ND INS P E C T IO NMost companies have standard procedures in

place for accepting raw materials and consumable

commodities. Receivables include not only active

ingredients and excipients but also items such as

Reviewing FDA warning letters (4) to other companies can help ensure

that your company isnt making the same mistakes. The most frequently

cited SOP failures include:

Lack of global or corporate policies (at upper management level) for all major

elements of the companys operation: validation, change control, batch release,

and other functions

Lack of local (departmental or functional) level procedures for every job and

task in all company operationsLack of clarity or specificity in SOPs, which must not require or allow individual

interpretations

Lack of proper training (when employees covered by an SOP are not trained on

the contents of that document)

Lack of assigned responsible functions for each specific task (SOPs must

assign specific responsibilities, defining who is responsible for carrying out each

particular task)

Lack of or incomplete document history file (each SOP must have a history file

that includes the entire history of that document, the reasons for any changes,

and approval documentation)

Use of outdated SOPs (an SOP system must be properly set up to archive and

remove outdated SOPs from circulation; audit trails now allow this to happen

automatically, if the information technology (IT) team sets them up properly); a

mechanism must be in place to ensure that the latest version of each SOP is

available and in use at all times

Failure to follow SOPs (all SOP instructions must be followed word for word

without exception); in extreme cases of deviation, documentation on what

happened, why it happened, what the effect was, how it was corrected, and who

approved the corrective action mustbe provided; SOPs should describe how to

handle deviations, actions that must be taken, and necessary approval levels

A majority of inspection observations relate to SOPs that were not followed and

the lack of appropriate instructions when a deviation occurred.

SOP Failures

Continued on page 49

Corresponding author

Massoud Lavianis assistant director

of compliance and Paul W. Allen is

the managing partner responsible for

life sciences at Clarkston Consulting

(a management and IT consulting firm

specializing in FDA and validation

issues), 595 Market Street, Suite 1450,

San Francisco, CA 94105,

310.869.4060 or 888.486.1141,

ext. 4931, fax 415.354.8743,[email protected],

www.clarkstonconsulting.com.


6/6BioPharm AUGUST 2002 49

DOCUMENTAT ION PRACT ICESPeople in the biopharmaceutical industry often

joke that, In God we trust, everything else must

be documented.That phrase speaks for itself

and for the mountains of documents that regula-

tory compliance requires.

FDA inspectors insist on reviewing documen-

tation processes. Documents are the only proof

that companies have with which to defend their

practices and operating procedures. Therefore no

amount of effort put into preparing proper docu-

ments is in vain. Long before an inspec tion,

review your companys documents . . . and then

review them again. Find and fill document gaps,

obtain approval signatures, be clear and, most

of all, be factual in your documentation. Always

remember, If you dont have the proper docu-

mentation for an action or item, you dont have

that item, or no action was taken.

TO PREPARE . . . PERCHANCE TO SUCCEEDTo biopharmaceutical, pharmaceutical, medical

device, outsourcing, or other health carerelated

companies, an inspectiontranslates to an FDA

inspection.But inspections come from other

sources as well, from your customers as due dili-

gence audits, from European and other national

inspecting agencies, and from potential merger,

acquisition, and investing partners.

Preparation for an inspection is critical.

Responsible individuals within the company must

ask all the questions listed in this article to deter-

mine how the companys operations are function-

ing. Responsibility must be assigned to those who

can ensure success. Rules and regulations can be

cumbersome and time consuming, but they serve

specific purposes. Proactive managers are those

who understand the logic behind the regulations

before they attempt to implement them.

R E F E R E NC E S(1) Current Good Manufacturing Practice in

Manufacturing, Processing, Packing, or Holding ofDrugs,Code of Federal Regulations, Food andDrugs, Title 21, Part 210 (U.S. Government PrintingOffice, Washington DC), revised 1 April 2001.

(2) Current Good Manufacturing Practice for FinishedPharmaceuticals,Code of Federal Regulations,Food and Drugs, Title 21, Part 211 (U.S.Government Printing Office, Washington DC),revised 1 April 2001.

(3) Biological Products,Code of Federal Regulations,Food and Drugs, Title 21, Part 600 (U.S.Government Printing Office, Washington DC),revised 1 April 2001.

(4) FDA Warning Letters. Available at www.fda.gov/foi/warning.htm (accessed May 2002). BP

Survival Guide continued from page 24