using macros and spreadsheets in a regulated...

Best Practice

Survival Guide to FDA InspectionsPreparation – Conduct – Follow up

April 2012

Publication from

www.labcompliance.comGlobal on-line resource for validation and compliance

Copyright by Labcompliance. This document may only be saved and viewed or printed for personal use. User may not transmit or duplicate this document in whole or in part, in

any medium. Additional copies can be ordered from www.labcompliance.com.

While every effort has been made to ensure the accuracy of information contained in this document, Labcompliance accepts no responsibility for errors or omissions. No liability can be accepted in any way.Labcompliance offers books, master plans, complete Quality Packages with validation procedures, scripts and examples, SOPs, publications, training and presentation material, user club membership with more than 500 downloads and

Survival Guide to FDA Inspections

audio/web seminars. For more information and ordering, visit www.labcompliance.com/solution

www.labcompliance.com of 90


Contents

1. Introduction 42. Laws – Regulations – Guidelines 6

Laws..............................................................................................7

Regulations....................................................................................8

Guidance Documents.....................................................................9

Inspection Guides........................................................................11

Compliance Policy Guides............................................................11

Industry Guidance........................................................................12

3. FDA Inspections 12Traditional vs. Risk-based system Inspections..............................13

Focusing Inspections on Highest Risks.........................................16

4. Consequences of Non-compliance 17483 Inspectional Observations......................................................18

Establishment Inspection Report (EIR).........................................19

Warning Letter.............................................................................20

Product Recall..............................................................................21

Seizure........................................................................................23

Consent Decree...........................................................................24

Import Alerts and Denials.............................................................25

Debarment...................................................................................26

5. Studying FDA Inspection Reports 27Most Frequent Citations...............................................................27

Examples of Citations...................................................................28

6. Efficient Quality Systems to Prevent Non-compliance48

Comply with Common Requirements for all Regulations...............49

Inspection Findings from Previous Inspections.............................51



Look at Specific Details as Required by Individual Regulations.....52

Quality Systems...........................................................................52

Facilities and Equipment..............................................................54

Materials Systems........................................................................55

Production Systems.....................................................................56

Packaging and Labeling Systems.................................................57

Laboratory Control Systems.........................................................58

7. Preparing for and Conducting FDA Inspections 59Preparing your Organization for FDA Inspections.........................60

Internal Audits..............................................................................65

Prepare Required Documentation.................................................67

Conducting the Inspection............................................................70

After the Inspection......................................................................72

8. Responding to 483’s and Warning Letters 73Responding During the Inspection................................................73

Response to 483 Inspectional Observations.................................73

Response to Warning Letters.......................................................75

Preparing for the Next Inspection.................................................75

Appendix A: Glossary 76Appendix B: References 82




1. Introduction

The United States Food and Drug Administration’s (FDA) mission is to protect consumers' health and safety under the Federal Food, Drug, and Cosmetic Act (FD&C) (1) and other laws. To do this the FDA has developed two basic strategies:

Monitoring the quality of products through surveillance activities such as sampling and analyzing products in distribution.

Evaluating through factory inspections, including the collection and analysis of associated samples, the conditions under which products are developed, manufactured, tested, packed, labeled and held. An FDA inspection can be a nightmare that costs your company money, time and reputation, or it can be an opportunity to improve your quality system and to make a long-lasting good impression on the FDA

During inspections the FDA verifies that a company’s procedures and processes are in compliance with FDA GxP regulations such as Good Laboratory Practices, Good Clinical Practices and Good Manufacturing Practices. If the FDA inspections identify deviations from the regulations, they will issue inspectional observations using a special form containing the number 483. These reports are usually called 483’s or 483 inspectional observations. Depending on the severity of the deviations the company may get a warning letter later on.

Over the last couple of years many companies have received FDA 483 inspection observations and warning letters because they failed to comply with FDA’s GxP regulations. Some of these companies are well-established and well-known with global presence. Warning letters have not only been issued to companies in the United States but also in Europe, Asia and



Australia. Receiving a warning letter can mean a financial disaster for a company because new product approval may be delayed, manufacturing of drugs can be stopped or import and marketing of finished drugs, active pharmaceutical ingredients, bulk material or medical devices into the United States can be denied. In some cases warning letters can also cause personal problems for individual employees if they are held accountable for non-compliance. The FDA publishes the warning letters on the Internet and so makes consumers, competitors and business partners aware of a company’s non-compliance, which is obviously bad for the image of a company.

The risk of receiving 483’s and warning letters can be minimized by following a couple of recommendations:

1. Know regulations and guidelines. As well as knowing the text you also need to understand the intent and the meaning. This includes GxP’s as well as 21 CFR Part 11 on Electronic Records and Signatures.

2. Inform yourself on the consequences of deviations of non-compliance. Make your management aware of these consequences.

3. Learn about mistakes others have made through studying inspectional observations (483s) and warning letters.

4. Build up a quality system in line with industry standards and regulations and guidelines.

5. Develop procedures and practices on how to make the best out of FDA Inspections. To do this take learning experience from FDA inspectional practices, inspectional observations and warning letters.

6. Minimize the damage of 483 inspectional observations and warning letters by effective response.

It is far out of the scope of this paper to teach readers in detail about the necessary regulations and guidelines. There is a lot of literature available, for example a 120-page primer on GLP and GMP (2) and a series of audio seminars with guidance on understanding and implementing FDA and other regulations and guidelines,(3). Reference 4 includes a list of FDA regulations or so-called predicate rules.

This primer will focus on steps two to six. There are individual chapters on building a quality system, understanding the FDA’s



inspection and enforcement practices, preparing your organization for FDA inspections and responding to FDA inspection observations and warning letters. After the introduction section we will continue with a brief chapter on FDA regulations and guidelines followed by a chapter on FDA actions in case of deviations. The next chapter lists typical and most frequently cited deviations. For this we studied several hundred GxP related warning letters and inspection reports. Readers can use this information to educate themselves on the current thinking of FDA inspectors as well as learning from past mistakes and how to avoid them.

For this paper we made extensive use of the Internet. Most literature and reference material cited in this paper are available online. Links can be found in Appendix B of this primer.

2. Laws – Regulations – Guidelines

In preparation for FDA inspections companies are advised to study laws, regulations and guidance documents related to their business. In this chapter we describe the official documents that are important and how they relate to each other. The relationship between different documents is shown in figure 1. The starting point is laws, which are the highest-level documents followed by regulations and various guidance documents.


Passed Congress• Federal Food, Drug, and

Cosmetic Act

Promulgated by FDA• cGMP, GLP, GCP• E-records/signatures

Issued by FDA• Compliance policy• Inspection, Industry guidance

Issued by FDA• 483’s, EIR’s• Warning letters

Law

Regulation/Rule

Guidance

Inspection report


Figure 1. Hierarchy and Meaning of Laws, Regulations and Guidance Documents

Laws

Laws are passed by the U.S. Congress, and therefore derive from the highest authority. Laws are created by and can only be changed by this Congress. An example is the Federal Food, Drug, and Cosmetic Act (FD&C) (1). It is the single most important law for the pharmaceutical, biopharmaceutical and medical device industry and therefore a good reason to discuss it a little bit more in detail.

The first Act was passed by the Congress as early as 1906. In 1937, a public health disaster tragically drove home the need for a stronger federal law. Sulfanilamide, the first ‘wonder drug’ and a popular and effective treatment for diseases like strep throat and gonorrhea, was formulated into an Elixir of Sulfanilamide and marketed for use on children. But the liquid formulation contained a poison, the same chemical used in antifreeze, and it killed 107 people, most of them children. The earlier law did not require the drug manufacturers to test the formulation for safety before it was sold.

Congress corrected this weakness in the law the next year when it passed the Federal Food, Drug, and Cosmetic Act (FD&C). This law, for the first time, required companies to prove the safety of new drugs before putting them on the market. The new Act became effective in 1938 and also added the regulation of cosmetics and therapeutic devices, and generally updated the law to improve consumer protection.

This Act from 1938 is intended to reassure the consumer that:

Foods are pure and wholesome, safe to eat and produced under sanitary conditions.



Drugs and medical devices are safe and effective for their intended uses. This includes drugs used in medicated feeds for animals.

Cosmetics are safe and properly labeled. Packaging and labeling of these products is truthful and

informative.The FD&C Act has been amended several times since 1938. Amendments in1962 required that all drugs be proven effective as well as safe and gave the FDA the authority to regulate prescription drug advertising. The Medical Device Amendment of 1976 gave the FDA authority to ensure the safety and effectiveness of medical devices, including diagnostic products. Laws are quite general and usually don’t state how they should be implemented.

Regulations

The Food and Drug Administration’s (FDA) mission is to enforce the Federal Food, Drug, and Cosmetic Act (FD&C) and other laws that are designed to protect consumers' health and safety. The FDA’s responsibilities are specified by the scope of the laws. Laws with impact on the FDA can be downloaded from Reference 5. These laws equally apply to domestic and imported products.

For enforcement of laws Federal Agencies such as the FDA promulgate rules or regulations. These are published as the Code of Federal Regulation (CFR) in the Federal Register and inform the public and industry how the laws are implemented. For example, the Federal Food, Drug, and Cosmetic Act (FD&C) generally states that no food labeling may be “false or misleading in any particular” and that “the name and address of a manufacturer shall appear on the label”. The FDA “Labeling” regulation 21 CFR 201 specifies exactly what should appear on the label as well as its size and location and the regulation includes many examples of different labels. Unlike laws, which can only be changed by the Congress, regulations can be changed by the FDA. It takes time and the FDA would have to publish a Notice of Proposed Rule Making and accept comment - but it is possible.



The most well-known FDA regulations are the GLP, GCP and GMP regulations. GMP stands for Good Manufacturing Practice, GCP for Good Clinical Practice and GLP for Good Laboratory Practice. Sometimes these regulations are also called “predicate rules”. The most important FDA regulations can be downloaded from Reference 4. They refer to the regulations that the FDA has promulgated under the Federal Food, Drug, and Cosmetic Act (FD&C) and other laws to ensure that products are developed, manufactured and held in a state of control, thereby contributing to their safety, effectiveness and purity. Regulations assist all company employees in knowing what is necessary to help ensure company compliance by setting quality standards. It is therefore very important for everyone to be familiar with the regulations.

Guidance Documents

In many cases regulations are not detailed enough for inspectors and for the industry. In this case the FDA develops guidance documents. They provide assistance to the regulated industry by clarifying requirements imposed by Congress or issued in regulations by the FDA and by explaining how industry may comply with these statutory and regulatory requirements. They also provide specific review and enforcement approaches to help ensure that the FDA's employees implement the agency's mandate in an effective, fair and consistent manner.

These documents describe the FDA’s interpretation or policy on a regulatory issue and represent the agency’s current thinking on a particular subject. Guidance documents include documents that relate to the design, production, labeling, promotion, manufacturing and testing of regulated products; the processing, content and evaluation or approval of submissions and inspection and enforcement policies. They are not legally binding for either the pharmaceutical industry or the FDA. Therefore guidance documents must not include mandatory language such as “shall”, “must”, “required” or “requirement”, unless the FDA uses these words to describe a statutory or regulatory requirement. An alternative approach can be used if such approach satisfies the requirements of the applicable statute, regulations or both. However, if alternative approaches are used, they should be



justified and correctly documented. FDA inspectors are advised not to cite guidance documents in inspectional observations or warning letters. Development of FDA guidance documents is regulated by 21 CFR 10.115, called Good Guidance Practices (GGP) (6). The regulation describes two levels of guidance documents: Level 1 guidance documents set forth initial interpretations of

statutory or regulatory requirements and changes in interpretation or policy that are of more than a minor nature. They may cover complex scientific issues or highly controversial issues.

Level 2 guidance documents are guidance documents that set forth existing practices or minor changes in interpretation or policy.

The regulation also states that an agency may not use other documents or other means of communication to informally communicate new or different regulatory expectations to a broad public audience for the first time. Good Guidance Practices must be followed whenever regulatory expectations that are not readily apparent from the statute or regulations are first communicated to a broad public audience. According to 21 CFR 10.115 the industry has a variety of options to influence the type and content of guidance documents: Suggest areas for guidance document development.

Suggestions should address why a guidance document is necessary.Provide input on guidance documents that the FDA is developing.

Submit drafts of proposed guidance documents for the FDA to

consider. At any time, suggest that the FDA revise or withdraw an

already existing guidance document. The suggestion should address why the guidance document should be revised or withdrawn and, if applicable, how it should be revised.

Once a year the FDA will publish, both in the Federal Register and on the Internet, a list of possible topics for future guidance document development or revision during the next year. Industry can comment on this list (e.g., by suggesting



alternatives or making recommendations on the topics that the FDA are considering).

If the FDA agrees to draft or revise a guidance document, industry can participate in the development of that guidance.

Give inputs to draft guidances within 60 days. The regulation also describes the procedures for developing and issuing guidance documents: Before the FDA prepares a draft of a Level 1 guidance

document they can seek or accept early input from individuals or groups outside the agency. For example, the FDA can do this by participating in or holding public meetings and workshops.

After the FDA prepares a draft of a Level 1 guidance document they will publish a notice in the Federal Register announcing that the draft guidance document is available and post the draft guidance document on the Internet as well as making it available on hard copy.

Industry is invited to comment on the draft guidance document. After providing an opportunity for public comment on a Level 1 guidance document, the FDA will review any comments received and prepare the final version of the guidance document that incorporates suggested changes, when appropriate.

The FDA publishes a notice in the Federal Register announcing that the guidance document is available.

Within each center and office there must be written procedures that detail the approval of guidance documents. The procedures must ensure that appropriate senior officials review and approve the issuing of guidance documents. Examples of guidance documents are: Inspection Guides Compliance Policy Guides Industry Guidance Technical Inspection Guides



Inspection Guides

Inspection guides are used by field investigators to assist in performing inspections of specific products or processes. Inspection guides were previously known as the Inspector’s Technical Guide (ITG). Both are meant to provide investigators with additional technical information when they encounter highly technical issues during inspections. The Office of Regulatory Affairs (ORA) issues the inspection guides.Examples are: Guide to Inspections of Pharmaceutical Quality Control

Laboratories (7). Guide to Inspections of Foreign Pharmaceutical Manufacturers

(8). Guide to Inspections of Quality Systems (23)

Compliance Policy Guides

A Compliance Policy Guide (CPG) explains the FDA’s policy on regulatory issues related to the FDA regulations. These include Current Good Manufacturing Practice (CGMP) regulations and application commitments. They advise the field inspection and compliance staff on how the agency's standards and procedures should be applied when determining industry compliance. Compliance Policy Guides may derive from a request for an advisory opinion, from a petition from outside the agency, or from a perceived need for a policy clarification by FDA personnel. The purpose of the CPG is to provide a convenient and organized system for statements of FDA compliance policy, including those statements that contain regulatory action guidance information.

Examples are:

Drug Manufacturing Inspections Program (9) Computerized Drug Processing, Input/Output Checking (10)

Industry Guidance

Industry guidances are targeted to the pharmaceutical and medical device industry and represent the Food and Drug



Administration’s (FDA) current thinking on specific topics. It does not create or confer any rights for or on any person and does not operate to bind the FDA or the public. An alternative approach may be used if such an approach satisfies the requirements of applicable statutes and regulations.

Examples are:

General Principles of Software Validation, Final Guidance for Industry and FDA Staff (11)

Good Clinical Practice, Consolidated Guidance (12)

Guidance for Industry Part 11, Electronic Records; Electronic Signatures Scope and Applications (24)

Quality Systems for Drug CGMPs (28)

3. FDA Inspections

A primary mission of the Food and Drug Administration is to conduct comprehensive regulatory coverage of all aspects of production and distribution of drugs and drug products to assure that such products meet the 501(a)(2)(B) requirements of the Food, Drug, and Cosmetic Act (FD&C) (1). To ensure the safety of marketed products, FDA staff inspect domestic and foreign manufacturers, check shipments of imported products and collect and test product samples for signs of contamination.

For drugs the FDA has developed two basic strategies:

Evaluating through factory inspections, including the collection and analysis of associated samples, the conditions and practices under which drugs and drug products are manufactured, packed, tested and held, and;

Monitoring the quality of drugs and drug products through surveillance activities such as sampling and analyzing products in distribution.



Factory inspections should to be done every two years. These are called routine inspections. In addition the FDA can initiate “for cause” inspections if they have any reason for it. A reason for a “for cause” inspection can be poor quality of drugs found during routine monitoring or if they are initiated as a result of other serious health risks that were brought to the FDA’s attention.

Before a product is released into the market the FDA makes a pre-approval inspection and after it has been introduced a post-approval inspection. In addition whenever a company makes a significant change to its process, the FDA has to be notified. The FDA may decide to come and inspect the new process for compliance.

A primary source of information regarding agency policy and procedures for field investigators and inspectors is the Investigations Operations Manual (IOM) (13).

Traditional vs. Risk-based system Inspections

It is very important to understand how the FDA conducts inspections. There was a change from traditional inspections of profile classes towards risk-based system inspections.

Traditional FDA InspectionsAt traditional inspections FDA inspectors checked compliance of a specific product across departments and systems. The inspectors may have gone from production areas to storage rooms. Emphasis was on profile classes and there was no connection between a system and infrastructure. The focus was on products (see figure 2). If deviations were found no conclusion could be made as to whether this was a specific site or department problem or if it was a company-wide process problem.


• Inadequate procedures

• Procedures not followed

• Inadequate computer validation

• Missing raw data

• Procedures• Org charts• Laboratory

controls• Validation• Training• Raw data• E-records• OOS

•Facilities•Personnel•Processes•Procedures•Equipment•Storage areas•Laboratories•Cleaning practices

• Company compliance history

• File review• Submission

review• FDA Guidances• IOM

ObservationsDocumentationReview

TourPreparation

• Inadequate procedures

• Procedures not followed

• Inadequate computer validation

• Missing raw data

• Procedures• Org charts• Laboratory

controls• Validation• Training• Raw data• E-records• OOS

•Facilities•Personnel•Processes•Procedures•Equipment•Storage areas•Laboratories•Cleaning practices

• Company compliance history

• File review• Submission

review• FDA Guidances• IOM

ObservationsDocumentationReview

TourPreparation


Figure 2. Flow of Product Inspections

System Based cGMP Inspections

Nowadays however, the FDA promotes the system-based inspections approach for cGMP inspections. The FDA has defined six systems including the quality systems. The systems are illustrated in figure 3.

Figure 3: System based inspections



1. Quality Systems: They assure overall compliance with cGMP and internal procedures. The quality assurance unit is part of this system.

2. Facilities and Equipment: They include the measures and activities that provide an appropriate physical environment and resources.

3. Materials Systems: Include measures and activities to control finished products.

4. Production Systems: Include measures and activities to control the manufacture of drugs and drug products.

5. Packaging and Labeling Systems: Include measures and activities that control the packaging and labeling of drugs.

6. Laboratory Control Systems: Include measures and activities related to laboratory procedures and processes like testing.

The quality system is always inspected plus one additional system for abbreviated inspections and three more systems for full inspections. Management controls are always reviewed and most likely the Corrective Action and Preventive Action (CAPA) procedure and systems, people qualification, change control and validation will be inspected at each inspection. With this approach the FDA takes a broader look at a firm’s operations. If the FDA finds a problem with any single drug it can then extrapolate it to all drugs within that profile and assume there could also be problems with any of the other drugs.

Focusing Inspections on Highest Risks

Because of limited resources the FDA cannot inspect all the required pharmaceutical sites, and within a site they cannot inspect all systems. As part of the FDA’s 21 CGMP initiative it announced that it would be focusing on those aspects that pose the greatest potential risk to the public.

The FDA has identified some priorities for inspections: Sterile manufacturing operations Prescription drug manufacturers



New registrants not previously inspectedOther factors include the company’s compliance history and type of drugs that are manufactured at a specific site, e.g., typical extent of patient exposure. One likely result could also be more frequent inspections of plants producing injectable therapies as opposed to conventional drugs. With many biotech therapies clearly in the high-risk category, the agency will be increasingly emphasizing a risk-based control point’s analysis in its scientific approach to cGMPs.A good source of information for the FDA’s risk-based approach is its Quality System Regulation (QSR) for medical device manufacturers (29), which came into effect in 1997. Like device manufacturers, drug manufacturers are also advised to estimate and document the risk involved in a drug. The standard document for risk management in pharmaceutical industry is the ICH Guide Q9: Quality Risk Management (30). This guideline provides principles and examples of tools for quality risk management that can be applied to different aspects of pharmaceutical quality. These aspects include development, manufacturing, distribution, and the inspection and submission/review processes throughout the lifecycle of drug substances, drug (medicinal) products, biological and biotechnological products.

The process to estimate and document risks has been described and extensively documented by L. Huber (31). The drug and its manufacturing process is identified and all types of anticipated risks documented. Next the severity and probability of occurrence are estimated and the levels defined as high, medium or low. From this the overall risk is calculated and defined as high, medium or low risk. The rationale behind your risk assessment should be well-documented. However, the ultimate objective is not only to assess risks, but also to mitigate them to the extent necessary and possible. This requires a program for cost effective mitigation and ongoing monitoring and control. Reference 30 describes the process and includes templates for risk assessment, mitigation and ongoing control.



4. Consequences of Non-compliance

Deviations from GxP regulations can have several consequences. The type of consequence will depend on the severity of the deviation and even more importantly on a company’s compliance history. Most critical for a company is if deviations from previous multiple inspections have not been corrected, especially if the deviation can have a severe negative impact on public health.

Typical outcomes of non-compliance can be:

483 form inspectional observation, written by inspectors during the inspections and handed over at the end

Deviations cited in the Establishment Inspection Report (EIR) Warning letter Product recall Import Alert for foreign companies with possible denial for

importing the product into the U.S. Civil money penalties Product seizure Consent decree

483 Inspectional Observations

When an inspector finds non-compliance he/she will write an inspectional observation during the inspection. Inspectors use a special form, the so-called FD 483 form. A 483 is actually an inspectional observations form that the FDA uses to convey to a company the issues they have observed during their audit or inspection. The information can be handwritten or typed using a typewriter or a computer and is handed over to the company at the conclusion of the inspection.

483 forms include the statement: The observations noted in this Form FDA-483 are not an exhaustive listing of objectionable conditions under the law. Your Firm is responsible for conducting internal self audits to identify and correct any and all violations of the quality system requirements.



This is to inform companies that the observation did not cover all aspects of the quality system. The advantage of 483’s is that firms get a direct response on deviations immediately after the inspection so that prompt corrective action can be initiated. The problem is that they only give the inspector’s or inspection team’s viewpoint and are not approved by FDA management with consequent inconsistencies. It may also happen that certain citations may never be approved because they may not be in line with the FDA’s current way of thinking.

However they can also have consequences, for example withholding of product approvals, and because they can be made available to business partners and competitors they can have a negative impact on the company’s reputation.

An example of a typical 483 can be downloaded from Reference 15. 483’s are inspectional observations, and do not represent a final agency determination regarding a company’s compliance. If a company has an objection to an observation, have implemented, or plan to implement corrective action in response to an observation, they may discuss the objection or action with the FDA representative(s) during the inspection or during the exit meeting. Most companies take advantage of this option to make an initial verbal response during the exit discussion and send a written response afterwards.

In theory 483’s are available to the public right after they have been handed over to the company. However, in practice they are difficult to obtain. In general they are not published on the Internet but selected 483’s are available through service providers for a fee. For example, selected representative examples are available through www.fdawarningletter.com. Visitors can see excerpts for free and download the full observation for an annual fee. They are also available from the Freedom of Information (FOI) but one would have to know that this exists, it takes may take several years to get them and they are also not free of charge.

Also, parts will be blackened out that are proprietary in nature so when you receive a copy of a 483 from the FDA through FOI don't be surprised to see parts missing.


http://www.fdawarningletter.com/


Establishment Inspection Report (EIR)

After the inspection an Establishment Inspection Report (EIR) is written by the agency when the inspector is back in the district office. The observations are classified as “No Action Indicated (NAI)”, “Voluntary Action Indicated (VAI)” or “Official Action Indicated (OAI)”. The OAI is typically a warning letter but can also have other consequences like an Import Alert for foreign companies, withheld approvals, product recalls, seizure, civil money penalties or consent decrees combined with fines of millions.

The EIR is reviewed, e.g., by the regional headquarter office and if the deviations and conditions are serious enough, a warning letter may follow.

EIR’s are more helpful in preparation for FDA inspections than 483’s or warning letters. They report all inspection findings and give a good overview on inspection practices, especially on the type of questions asked. Typically they include paragraphs on:

Persons interviewed Individual responsibility History of business Facility and design SOP Review Laboratory review (or other systems) Training Stability Manufacturing batch record review Complaints review Annual reports review Closing meeting Objectionable conditions Attachments

An example of a typical 483 can be downloaded from Reference 16. Unfortunately EIR’s are also not easy to get hold of. There are a couple of commercial service providers offering selected EIR’s,



e.g., some excerpts can be viewed at www.fdawarningletter.com and downloaded for a member fee.

Warning Letter

Depending on the severity of the deviations and possible negative impact on public health the FDA may send a warning letter to the company. Warning letters are described in FDA/ORA’s Regulatory Procedure Manual (17) as: A Warning Letter is a written communication from FDA notifying an individual or firm that the agency considers one or more products, practices, processes, or other activities to be in violation of the Federal FD&C Act, or other acts, and that failure of the responsible party to take appropriate and prompt action to correct and prevent any future repeat of the violation, may result in administrative and/or regulatory enforcement action without further notice.

An example can be downloaded from Reference 18. The warning letters frequently make references to the 483 inspection observations and sometimes also to the company’s response to the 483.

Warning letters are reviewed by higher-level FDA officials and since March 1st, 2003, by FDA centers. This should help provide a more consistent approach for warning letters as well as help identify possible program inconsistencies and resolve them before warning letters are issued and to analyze deviations. Regular analysis of these data aids the centers in identifying trends used to further develop a risk-based strategy towards cGMP enforcement practices. The FDA can also use this knowledge to enhance policy, provide guidance and establish training for the FDA field staff and regulated industry.

A warning letter indicates that the FDA believes that a serious regulatory violation exists. Companies are expected to respond within 15 days. If there is no response or if the response is inadequate the FDA will take further actions which may cause delay of new product approvals, Import Alerts and denials, product recalls, seizure or consent decree or the company may also lose any governmental contracts. Generally, a follow-up inspection is scheduled so that the company has time to fix the problem. But we should not forget, any company that gets a warning letter is on the FDA’s radar screen and this will go into its




records under the “company’s compliance history”. FDA’s assumption is that if there are serious quality problems at one site, they also may exist at other sites.

The FDA publishes warning letters on two websites: Letters that are supplied by the CDER Freedom of Information

Office (FOI). This page only covers letters issued by the Division of Drug Marketing, Advertising, and Communications and by Headquarters (33).

District Office warning letters (34).

The only problem is that there are thousands of them and they mostly relate to marketing and labeling so it is difficult to find the ones that are of interest, for examples ones related to GxP issues. Excerpts are available on www.fdawarningletter.com, they are searchable by keywords and full text can be downloaded for an annual member fee.

Product Recall

A recall is a firm’s removal or correction of a marketed product that the FDA considers to be in violation of the laws it administers.

Recalls are described in FDA/ORA’s Regulatory Procedure Manual (6) as: Recalls are an appropriate alternative method for removing or correcting marketed consumer products, including their labeling and/or promotional literature, that violate the laws administered by the Food and Drug Administration (FDA). Recalls may be undertaken at any time on the initiative of manufacturers and distributors to carry out their responsibility to protect the public health and well-being, or in response to a formal request by FDA.

Product recall is required when distributed products do not comply with regulations or are not in specifications. An example of a product recall announcement can be downloaded from Reference 14. A product recall can also be initiated if the analytical equipment used to measure impurities in the finished drug was not calibrated or qualified and there exists a high risk that the analytical test result as the criterion for product release was incorrect.. Another example would be if the person who authorized the release of a batch was not qualified to do so.




U.S. product recalls are divided into three categories, depending on the time delay (6):

Class I: A situation in which there is a reasonable probability that the use of, or exposure to, a violative product will cause a serious adverse health consequence or death.

Class II: A situation in which the use of, or exposure to, a violative product may temporary or reversible adverse health consequences or where the probability of serious health consequences is remote.

Class III: A situation in which the use of, or exposure to, a violative product is not likely to cause adverse health consequences (6).

Companies should have an SOP for product recall. This should include sections on responsibilities, the reason for the recall and classification according to the categories above and detailed steps for the recall. Recalls should be managed by the QA department.

Figure 4. Example of a Drug Class II Product Recall

The first step is to form a team with representatives from manufacturing, laboratories, compliance and regulatory affairs and the legal department. QA should notify the regulatory agency about cause, classification, planned steps and time schedule. Notification should also include a corrective action plan and a



preventive action plan that demonstrates how to avoid similar occurrences in the future.

U.S. product recalls are published on the Internet in the FDA Enforcement Report (14). Recalls are sorted by month and year and within each month by drugs, biologics and devices. An example is shown in Figure 4.

Seizure

Seizure and the steps taken by the FDA and its consequences are described in FDA/ORA’s Regulatory Procedure Manual (17).

Seizure is an action taken to remove a product from the market because it is in violation of the law. In serious compliance or quality cases, original documents, including batch records and laboratory data, hard disk drives, or downloads of e-mail messages may also be seized as evidence.

The seizure of a product that violates the Federal Food, Drug, and Cosmetic Act is an action taken against the product, not against the owner. Its purpose is to prevent consumption or use of the seized product. When by inspection and laboratory analysis, the FDA discovers that a product does not conform to the law, the Agency requests the U.S. Department of Justice to file a “libel” with the proper federal court.

Acting on a warrant issued by the court a U.S. marshal (usually accompanied by an FDA official) then seizes the articles. The owner is notified, and given an opportunity to appear in court to contest the government's charges if he/she believes them to be in error.

Sometimes the FDA publishes a press release about a specific seizure (32).

Consent Decree

According to the FDA/ORA’s Regulatory Procedure Manual (17) an injunction is a civil process to stop or prevent violation of a law, and to correct the conditions that caused the violation to occur. In serious violations companies may decide to consent to a decree



of preliminary or permanent injunction before the issue goes to trial. Typically a consent decree is a long-term process where at the end the company under consent decree voluntarily enters into the agreement. Frequently, the consent decree is the last step before criminal prosecution and usually there are multiple 483 inspectional observations, EIR’s, warning letters and other documented communications between the FDA and senior management. At the end the company agrees to pay a one-time charge and to initiate corrective action plans, frequently with the help of outside consultants.

Probably most well-known are the consent decrees with Abbott and Schering Plough. Abbott’s consent decree resulted in a one-time charge of $168 million in 1999. This was not the only financial loss. The decree included:

After January 10th, Abbott removed 80 diagnostic kits from the market.

180 kits were deemed to be medically necessary so they could still be sold. Abbott had one year to bring their manufacturing systems into compliance. If the FDA did not certify manufacturing for compliance, Abbott was required to pay the U.S. Treasury 16% of the gross revenue generated by these products.

Abbott was required to submit a compliance master plan and a validation plan with a time frame on how to fix the problem. If the deadlines could not be met, Abbott had to pay $15,000 per business day per process.

Schering Plough was charged $500 million in 2002, which was the highest charge at that time (19, 20). Figure 5 shows excerpts of a press release. Typically lost sales revenues and costs for upgrading systems are higher than the charges.


• $500M fine• Production of new Blockbuster successor delayed• GMP quality problems

• $500M fine• Production of new Blockbuster successor delayed• GMP quality problems


Figure 5. Example of Consequence of Non-Compliance

Import Alerts and Denials

With the exception of most meat and poultry, all food, drugs, biologics, cosmetics, medical devices, and electronic products that emit radiation, as defined in the FD&C and related Acts, are subject to examination by the FDA when they are being imported or offered for import into the United States. Most meat and poultry products are regulated by the U.S. Department of Agriculture.

All imported products are required to meet the same standards as domestic goods. Imported foods must be pure, wholesome, safe to eat and produced under sanitary conditions; drugs and devices must be safe and effective; cosmetics must be safe and made from approved ingredients; radiation-emitting devices must meet established standards; and all products must contain informative and truthful labeling in English.

Import Alerts were developed to communicate guidance to FDA Field Offices. The purpose of an Import Alert is to identify and disseminate import information (problems, violated trends, etc.) to the FDA personnel thus providing for more uniform and effective import coverage. Import Alerts identify problem commodities and/or shippers and provide guidance for import coverage.

If serious manufacturing problems exist at a specific site the FDA can recommend withholding approval of any new product application or companies are not allowed to import products into



the United States when the product was manufactured at that particular site. Products can be finished drug products, Active Pharmaceutical Ingredients (API) or bulk material. It is not unusual that losses resulting from an Import Alert are as high as $100 k/day.

An example of a warning letter with an announcement for Import Alert until successful re-inspection is available from Reference 36: Until FDA has re-inspected this facility and confirms compliance with CGMPS and correction of these deficiencies, this office will recommend withholding approval of any new drug applications listing this facility as the manufacturer of active pharmaceutical ingredients (APIs). Failure to promptly correct these deficiencies will result in the refusal to permit entry of these products into the United States (www.fdawarningletter.com W-097)

Debarment

In 1992 the Generic Drug Enforcement Act became effective. The act enables the FDA to debar companies and individual employees from providing services or participating in drug applications. Individuals are not allowed to work for companies producing drug products. Individuals can be fined up to $250,000, companies up to $1 million. Debarment can be temporary or permanent. The names of individuals and companies who have been debarred are posted on the FDA website (35).

It is interesting to note that while in the past the list was populated mostly by companies, more recently it only includes names of individuals.


http://www.fdawarningletter/


5. Studying FDA Inspection Reports

FDA regulations are usually valid for a long time period but they are not specific. They still leave a lot of room for interpretation and inspection practices can also depend on the expertise and opinion of individual inspectors. That’s why the FDA has developed guidance documents for the industry to document FDA’s interpretations on critical topics and for inspectors to ensure harmonization across all FDA inspections. Unfortunately guidance documents are still not specific enough to educate the industry on all details and many times they include very general statements such as “enforcement depends on the risk on product quality” or “the extent of validation depends on the system complexity”. This leaves a lot of room for interpretation by inspectors and interpretations may also change over time. The real current thinking of the FDA and their inspectors can be judged from 483 inspectional observations and warning letters. 483’s are written during or right after inspections by inspection teams or individual inspectors and give the inspector’s point of view. Warning letters are more representative because they have to be approved at a higher level. To some extent they can be seen as the FDA’s most current and most specific thinking on how to interpret regulations. This is the reason why one chapter of this primer is dedicated to warning letters and 483’s. The chapter includes two parts. Part one lists most frequently cited deviations while part two cites specific warning letters. We also include examples of 483 observations in situations, which in our opinion are generic enough not only to show the viewpoint of an individual inspector.

The citations are categorized into various topics and with correct understanding can be viewed as recommendations on how such citations can be avoided. For each citation we also give references as to where the full text of the FDA document can be downloaded. This is important as a lot of the time excerpts of warning letters only make sense in the context of the full text that typically also describes the application.



Most Frequent Citations

In this section we list most frequent citations. They are not sorted in any specific order. They are all important and therefore it is not necessary to put them in ranking order.

No or inadequate procedures Procedures not followed. No management review of procedures. The responsibility of quality control unit not defined or the

quality control unit did not follow the procedures. No internal audits. No or inadequate employee training. Manufacturing process not validated. Inadequate laboratory controls. No or inadequate equipment maintenance and cleaning. Inadequate environmental monitoring. Inadequate validation of analytical methods. No or inadequate stability testing. Incomplete validation of computer systems. Raw data not maintained. No or inadequate security procedures. No procedures for handling Out-Of-Specification situations or

procedures not followed. No procedures for corrective and preventive actions to avoid

occurrence of similar problems.

Examples of Citations

In this section we give some citation examples. They are considered to be representative within their categories. Originals with complete text are available from Reference 21. W-xxx references in the text below correspond to the numbers in Reference 21.

Procedures



Written standard operating procedures covering .... were inaccurate, incomplete, and contained no documentation of origin, review or approval (W-051).

Failure to follow written production and process control procedures as required by 21CFR 211.100 (W-051).

There are no cGMP training SOPs in place and at least one employee denied knowledge of cGMP regulations (W-051).

Failure to establish and to follow written control procedures designed to assure batch uniformity and the integrity of drug products

(W-066). Failure to follow the Standard Operating Procedure (W-053).

Written procedures are not followed for the maintenance of equipment used in manufacture, processing, packing or holding (W-217)

Failure to establish and maintain procedures to control the design of the device in order to ensure specified design requirements are met (W-218)

Management Controls/Reviews Appropriate management representatives do not review audit

reports (W-038). Failure to establish management review procedures and

failure to document the dates and results of these management reviews (W-048).

Failure to conduct management reviews as required by 21 CFR 820, 2O(c) and as called for in your procedure QOO1 “Quality System”, to assure that your firm is in compliance with the regulations (W-050).

Failure to appoint and document such an appointment of a member of management who irrespective of other responsibilities shall have established authority over and responsibility for ensuring that quality system requirements are effectively maintained and to report on the performance of the quality system to management with executive responsibility (W-092).



Management has not ensured that quality system requirements have been effectively established and maintained (W-134)

Failure of management with executive responsibility to ensure that the established quality policy is understood, implemented, and maintained at all levels of the organization (W-195)

Failure of the management with executive responsibility to ensure that an adequate and effective quality system has been fully implemented and maintained at all levels of the organization, as required by 21 C.F.R. § 820.20. For example, your firm's management has not effectively implemented adequate and global corrective actions in a timely manner to correct quality issues across your analyzer product lines (W-196)

Failure to have management with executive responsibility to ensure the quality policy has been fully implemented and maintained [21 CFR 820.20(a)]. Admittedly, you lack a Quality Plan and a management representative and have continued to operate since 2004 (W-205)

Quality Control Unit/Quality Assurance Programs Failure to have a document, which delineates the

responsibilities and procedures applicable to the quality control unit (W-044).

Failure to establish and operate an effective quality control unit in conformity with requirements of 21 CFR 211.22 (W-051).

There are no written procedures concerning individual responsibility for quality control operations (W-051).

Your firm does not have a quality assurance program in place to: a) qualify analytical equipment prior to their use, and b) calibrate and maintain analytical equipment according to manufacturers’ specifications (W-058).

There is no documentation of the Batch Production Records being reviewed and approved by the quality control unit since January 1, 2001 (W-054).

Failure to have an adequate quality control unit to perform its functions and responsibilities. Failure to have an adequate quality control unit is demonstrated by the number and types



of inspectional observations made during this inspection (W-065).

Failure to have an adequate quality control unit to perform its functions and responsibilities, as required by 21 CFR 211.22. Failure to have an adequate quality control unit is demonstrated by the number and types of inspectional observations made during this inspection (W-066).

Failure to maintain written procedures that describe the responsibilities and procedures applicable to the quality control unit (W-173)

Document Control/ Documentation Failure to promptly remove obsolete documents from all

points of use (W-173) Your firm failed to establish and maintain adequate

procedures to control documents and ensure all obsolete documents are promptly removed from use or otherwise prevented from unintended use (W-212)

The response states that retrospective validation studies have been completed for all APIs and that protocols and final validation reports are attached. Only the Chinese versions were attached. We are unable to evaluate these studies at this time (W-090).

During the inspection, our investigator requested to see investigations of process deviations and Out-Of-Specification laboratory results. She was informed that these investigations are conducted but not documented (W-102).

(Internal) Quality Audits Failure to document the dates and results of quality audits

(W-048). Failure to conduct quality audits required by 21 CFR 820.22,

and in your procedure QO02, “Audits” to assure your firm is operating in compliance with the regulations (W-050).

Quality audits are inadequate to assure that the quality system is in compliance with the established quality system requirements and to determine the effectiveness of the quality system (W-064).



We are requesting that you submit to this office on the schedule below, certification by an outside expert consultant that he/she has conducted an audit of your establishment’s manufacturing and quality assurance systems (W-074).

Personnel There are no cGMP training SOPs in place and at least one

employee denied knowledge of cGMP regulations (W-051). Failure to ensure that each person engaged in such activities

has the education, training and experience, or any combination thereof, to enable them to perform their assigned functions, as required by 21 CFR 211.25. Your failure to have staff adequate to perform their assigned functions is the number and type of inspectional during this inspection (W-065).

Your formalized training program is inadequate in that it does not address current Good Manufacturing Practices (W-091).

Your firm fails to have sufficient personnel with the necessary training to assure that all activities required by ... are correctly performed (W-100).

Employee training on the use of the new [redacted] computer system, which is used in donor screening and product processing, was not complete (W-103).

The center director had not received any training on this computer system even though he retains a high security level for data entered on this computer system (W-103).

There are no records to document that the Information Technology (IT) service provider staff personnel have received training that include current Good Manufacturing Practice regulations and written procedures referred by the regulations (W-101).

No one on the organizational chart, including supervisors in QA and QC, are identified as having academic or other suitable training in chemistry or microbiology (W-135)

A supervisor and QC manager could not explain how the calculation was done for the xxx assay determination (W-135)

Individuals responsible for supervising the manufacture, processing, packing, holding of a drug product lack the



education, training, experience to perform their assigned functions (W-219)

Our review of your firm's training program disclosed that there was no requirement for on-going CGMP training of employees. The firm only had an initial CGMP training and did not provide regular CGMP training to all employees involved in the manufacture of drug products. There is no reference to CGMP training of supervisors or directors. (W-219)

Specifically employees who manage, perform, and assess work affecting quality have not been adequately trained as members of your firm’s quality unit. Quality Assurance employees have not performed effectively in conducting complaint investigations, corrective/preventive action activities, design activities, internal audits, risk analysis and/or document reviews (W-211)

Building and Facilities / Environmental Conditions Failure to maintain adequate control over air handling and

exhaust systems (W-065). Failure to have adequate building design and construction

used in manufacture, processing, packing, or holding of drug products to facilitate cleaning, maintenance, and proper operations (W-181)

Failure to establish and maintain adequate procedures to control environmental conditions (W-200)

Complaint Procedures There was no documentation describing any evaluations of

the returned goods or their quality problems as they were related to your customer complaints (W-062).

Complaints are not handled in a uniform and timely manner as specified by your procedures. Specifically, there are instances where the assignee of a complaint did not notify the complaint coordinator and indicated an expected date of investigation completion after the 60 day due date which is specified by the complaint handling procedures (W-212)



Material / Supplies The reliability of the supplier's certificate of analysis (COA)

was not established in that a complete analysis was not performed with the COA at the appropriate intervals. (W-149)

Procedures for solvent recovery have not been established to ensure that solvents are controlled and monitored (W-149)

Incoming labels received from the vendor are not proofed against the master label (W-149)

Failure to establish and maintain purchasing control procedures (W-205)

There are no data to support extension of expiration for xxx Reference Standard (W-217)

Your firm has not established procedures for purchasing controls which include the evaluation and selection of raw material suppliers and the establishment of specified purchasing data requirements for purchased or otherwise received product (W-218)

Failure to establish and maintain procedures for acceptance activities including inspections, tests, or other verification activities. (W-218).

Manufacturing Process Products were manufactured and shipped in interstate

commerce before process validation was successfully completed (W-063).

Revalidation protocols do not cover the largest batch size or the most complex manufacturing process (W-085).

There is no manufacturing process validation in place for drug products (W-099).

No change control SOP for documentation and manufacturing processes (W-094).

Failure to validate a process whose results cannot be fully verified by subsequent inspection and test (W-200)

Cleaning Validation Failure to clean and maintain equipment … at appropriate

intervals (W-086).



Cleaning procedures for non-dedicated reaction vessels, holding vessels, re-crystallizers, centrifuges, and dryers used to produce APIs and intermediates have not been validated (W-096).

The cleaning validation documents did not include a sampling, test method for analyzing samples, and specification limits.(W-124)

Vendor/Supplier/Service Provider Qualification Failure to establish and maintain the requirements, including

quality requirements that must be met by suppliers. For example, your firm has not specified quality requirements for suppliers, maintained lists of approved suppliers and developed written procedures describing how suppliers are evaluated for quality acceptance requirements (W-048).

The firm has no SOP for the qualification of vendors and contract laboratories, nor has such documented qualification been conducted (W-094).

The firm has been using the service of .... for the testing of Purified Water, however there has been no audit conducted at this contract laboratory (W-094).

Subcontractors / Contract Laboratories Failure to conduct audits of contract laboratories that perform

testing-of-incoming API. Your SOPs indicate that these audits are to be conducted every two years (W-173)

The firm does not receive and review all raw data from contract testing laboratories (W-187)

Your firm did not qualify the contract laboratories used for the testing (W-219).

It is FDA's expectation that your firm have a quality agreement with the contract laboratories in place. We recommend that this agreement be signed by all parties involved and that it include, as a minimum, specific details delineating the roles and responsibilities of each party. A description of the materials, services, communication, and all testing expected to be performed by each party should also be included. Your firm should ensure that the contract laboratory facility is compelled to produce accurate analytical results for the tested material,



conduct adequate laboratory investigations of out-of-specification results, and report to the client such investigations or any changes (219).

Equipment Failure to adequately clean, maintain, and sanitize equipment

and utensils at appropriate intervals to prevent malfunctions or contamination that would alter the safety, identity, strength, quality or purity of the drug product and failure to follow written procedures for cleaning and maintenance of equipment, including utensils, used in the manufacture, processing, packing, or holding of a drug product as required by 21 CFR 211.67(a) & (b). (W-214)

Written procedures are not followed for the maintenance of equipment used in manufacture, processing, packing or holding (W-218)

You indicated that the Installation Qualification and Operation Qualification have been completed and that the Performance Qualification of your ... system is expected to be completed by the end of 2009. You stated that a preliminary study and periodic monitoring of the system has to be done. However, no details of protocol, short term or long term action plan with supportive documentation were included in your response - In addition, there is no assurance that the ... used in the preparation of your ... meets the USP requirements for ... because your facility has not completed the requalification of the ... system (W-219).

Computer/Software Failure to have an adequate validation procedure for

computerized spreadsheets used for in-process and finished product analytical calculations. SOP 644.00, QA/QC Spreadsheet Validation, is deficient in that only a small range of values are being used to challenge computerized spreadsheet mathematical calculations. (W-063)

Validation of the system did not include critical system tests such as volume, stress, performance, boundary and compatibility (W-067).

Failure to validate computer software used as part of the quality system for its intended use according to an established



protocol as required by 21 CFR 820.70(i). For example: Software such as Excel, Access, and Word used to create and maintain databases (rejects, complaints, and concessions) and electronic documents, is not validated (W-073).

Firm lacks to validate computer data integrity acquisition for the use of the xxx. Also stress of the computer has not been tested proven that the system can run in parallel at the same time. (W-132)

The validation and installation records for the [redacted] computer system were incomplete (W-103).

Complete software structural design descriptions have not been maintained or updated from original design specifications (W-101).

Complete diagrams and text descriptions identifying all other network program interfaces with XXX, and which specify the data being exchanged between the XXX and other programs have not been maintained or updated from original design specifications (W-101).

Wide Area Network diagrams (WAN) with appropriate definition documentation identifying corporate sites on the network that use XXX have not been included in any XXX validation documents (W-101).

No procedures are established to validate for its intended purpose the Microsoft Word or Microsoft Excel software used in creating and maintaining nonconformance records, product return records, internal audit corrective records, or corrective action records (W-189)

During the inspection, I asked if the computer software has been validation to assure that it performs for it's intended use. I was told that the software was validated by the manufacturer. The managing director provided me a copy of the letter the received from (the vendor). The letter indicated that the software was validated. She also the gave me a copy of validation information that was obtained from (the vendor) during the inspection. - I told the managing director I still need to see what they have done to validate the system since the computer was making a decision to accept or reject potential donors (W-191)

There was inadequate software version control (W-099).



Software used as part of the production quality system was not validated for its intended use according to an established protocol [21 C.F.R. 820.70(i)]. Specifically, (a) Spreadsheets intended to check for outliers and calculate mean, SC, % CV, value assignments for finished devices.(b) Complaint handling software (c) Quantrol database program (W-201)

Computer Numerical Control (CNC) Machine #C-4 had out of specification results during operational qualification conducted during validation. These out of specification results were not investigated or addressed in the validation report (W-207)

Laboratory Controls Your firm has no system for the receipt and storage of

standards and analytical chemicals (W-058). Expired standards were used in the calibration of equipment.

Working solutions were not properly labeled or documented in laboratory notebooks or other records in that the data did not bear complete information, including the analyst or preparer’s identity, solution designation, strength and expiry dates (W-058).

Failure to perform laboratory testing on each batch of drug product prior to release, to determine satisfactory conformance to final specifications for the drug product, including the identity and strength of each active ingredient (W-086).

Extraneous HPLC peaks continuously explained to be auto injector contamination, no further investigation (W-014).

The firm needed to upgrade several pieces of their equipment. Principally, the old HPLC being used still was using the equivalent of a strip chart recorder. (W-133)

Failure to establish and maintain procedures to ensure that sampling methods are adequate for their intended use, to ensure, that when changes occur the sampling plans are reviewed, and that sampling plans are written based on a valid statistical rationale (W-206)

Failure to establish and implement sampling plans based on a valid statistical rationale. You did not have a rationale for the number of packages which are visually inspected every [redacted] hours on the [redacted] packaging machines (W-211)



Laboratory Equipment Qualification The calibration procedure for HPLC systems is inadequate in

that it did not include integrator and detector’s linearity, injector’s reproducibility, and accuracy of temperature settings for column heater and detector (W-097).

Calibration records show many instances where examination of the pipettes found them Out-Of-Specification. There is no way to determine when the (pipettes) units in question have been in use for analytical purposes while Out-Of-Specification (W-089).

Failure to ensure that all inspection, measuring and test equipment is suitable for its intended purposes and is capable of producing valid results (W-092).

Analytical balances are used outside specified range (W-089). You continued to utilize this revised QC Lab data acquisition

system without ensuring that the system would perform as intended (W-130).

The balance used to weigh more than 20 mg did not comply with the USP 0.1% requirement for balance measurement uncertainty (W-161)

The firm does not have a written procedure that includes requirements for the performance verification of HPLC and GC systems. They do not have specific directions (W-161)

During the inspection, the firm did not provide an SOP for the performance verification of the HPLC and GC systems. Actually, they are contracting services for the verification of those systems, and then they are adopting contractor's SOP. Each of them has different SOPs, which includes different types of tests that does not compare. The firm should establish a procedure to assure uniformity providing specific directions and requirements for all GC Systems. Also, it will apply to HPLC systems. (W-161)

Methods Linearity and limits of detection were determined above the

limit of the test (W-017). Laboratory tests for assay, impurities and … were not

performed according to established procedures described in



the individual Drug Master Files (DMF) that specify the USP methods (W-090).

Laboratory controls have not established that the test method for assay of xxxx content of xxxx “is scientifically sound to assure that this product conforms to specifications of strength, quality and purity” (examples: insufficient separation, no verification of method suitability under actual conditions etc) (W-024).

Your firm uses USP methods to analyze your products, but changes have been made to the USP methods and no validation has been performed. For example, for Migrazone Capsules, the USP uses three different wavelengths to analyze the three active ingredients. Your firm changed the method to use [redacted] of or all three actives and no validation of the new procedure was performed (W-182)

Failure to establish and document the accuracy, sensitivity and reproducibility of test methods employed. for example, methods that were validated at one facility and transferred to xxx site are being used without method transfer or revalidation protocol (W-184)

The test methods performed for heparin sodium USP have not been verified to ensure suitability under actual conditions of use. Specifically, you have failed to conduct adequate verification of USP compendial test methods as applied to the production of your firm's API. You assert that USP <1226>, Verification of Compendia1 Procedures, states that verification is not required for basic compendial test procedures that are routinely performed unless there is an indication that the compendial procedure is not appropriate for the article under test. We disagree with your assertions that verification is not required for those USP test methods used by your firm (W-213)

Microbial / Microbiological Testing No microbial limits testing (W-016). No written procedures for any microbiological tests performed

(W-016). A total of ...microbial tests were conducted for this product, yet

there was no documented investigation into these



discrepancies nor was there any conclusion or follow-up (W-098).

The microbiological laboratory fails to document the lot number and expiry date of xx (W-149)

Your firm has not established appropriate written procedures designed to prevent microbiological contamination of drug products purporting to be sterile, including procedures for validation of any sterilization process (W-219).

Active Pharmaceutical Ingredients (API) There were inadequate laboratory procedures and records to

assure that APIs have the appropriate quality and purity. The inspection reported deficiencies regarding the following laboratory procedures and records: Analytical methods validation, systems suitability testing, incomplete laboratory records, inaccurate laboratory calculations and inadequate calibration of laboratory equipment (W-042).

This letter concerns FDA inspections of your active pharmaceutical ingredient manufacturing facilities located in .... During both inspections, our investigators documented significant deviations from current Good Manufacturing Practices (cGMPs) in the manufacture of active pharmaceutical ingredients (API’s) (W-096).

Failure to test each batch of API to determine conformance to specifications (W-164)

The laboratory did not have an adequate impurity profile that identifies organic, inorganic and solvent impurities to monitor unidentified and apparent impurities in the API (W-149)

Aseptic Processes The aseptic powder fill process simulation (media fills) did not

adequately address several critical issues such as the lengths of campaign and the length of time critical equipment is issued without re-sterilization (W-095).

Qualification of procedures for sanitizing equipment surfaces not adequate to ensure an aseptic processing environment (W-095).

Stability Testing



Failure to implement a written testing program designed to assess the stability characteristics of drug products, using reliable meaningful and specific test methods (W-086).

One internal standard was four months old with no data on its stability over that period, in-process testing inadequately performed (W-090).

Failure to follow your firm's written stability testing program as required by 21 CFR 211.166(a) in that your firm has no validation data to demonstrate that the method used to analyze products for stability is capable of detecting degradation of the products (W-182)

Failure to establish a stability testing program which includes reliable, meaningful, and specific test methods' (W-203)

Out-Of-Specification / Out of-Trend / Failure Investigation Laboratory controls are deficient in that the firm established a

written procedure, which allowed for the averaging of Out-Of-Specification and within-specification analytical test data results (W-056).

There are no documented investigations of process deviations or Out-Of-Specification (OOS) laboratory results (W-102).

The chromatographic test data reflecting the out-of-specification test results were not recorded in laboratory notebooks. Instead, a new sample preparation was injected within the same chromatographic run without supervisory approval, as required by your firm's SOP (W-180)

Any OOS result obtained should be investigated and documented according to a procedure. This procedure should include analysis of the data, assessment of the extent and cause of the problem, allocation of the tasks for corrective actions, and conclusions. (W-209)

Any re-sampling or retesting after OOS results should be performed according to a documented procedure. (W-209)

- Written procedures should be established and followed for investigating deviations or the failure of a batch of intermediate or API to meet specifications. The investigation should extend to other batches that may have been associated with the specific failure or deviation. (W-209)



Although results above your alert limits may be an indication of an ongoing uncorrected problem, no investigation was conducted to identify a potential root cause of the problem (W-219)Comment by Labcompliance: this is an example for OOT (out-of-Trend) deviation

Your firm invalidated failing microbial test results of ... obtained from your contract testing laboratory and retested four of the five samples without conducting an investigation or providing scientific justification. Your firm's retests were used to inappropriately replace four of five failing samples with the following result (W-219)

Corrective and Preventive Actions (CAPA) Failure to verify or validate corrective and preventive action to

ensure that such action is effective and does not adversely affect the finished device (W-071).

Failure to maintain adequate procedures for implementing Corrective and Preventive Actions (CAPA) such as analyzing data to identify existing and potential causes of non-conforming product or other quality problems (W-084).

The response does not document that all other laboratory procedures have been reviewed for similar deficiencies (W-090).

Failure to establish procedures for implementing corrective and preventive action addressing the analysis of sources of quality data to identify existing and potential causes of non-conforming product or other quality problems (W-092).

Your firm failed to analyze, identify and document existing and potential causes of non-conforming product and other quality problems (W-100).

Your firm failed to establish and maintain adequate procedures for implementing corrective and preventive action (CAPA) to ensure the analyzing of sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems and employ appropriate statistical methodology, where necessary, to detect recurring quality problems (W-212)

Trend Analysis



Your firm also lacked a trend analysis of your ... sample results and failed to monitor the ... level prior to or after the .... (W-219).

Raw Data Laboratory records do not always include raw data for all the

laboratory testing performed (W-085). Laboratory procedures are inadequate in that raw data was

not always recorded (W-090). During the inspection of your facility, you were unable to

present records of raw data pertaining to the subject stability batches submitted (W-097).

Operating parameters were maintained with the relevant xxx. However, electronic raw data was not saved (W-176)

The firm routinely assigned method validation chemists, lead chemist, and laboratory supervisors system administrator status with the ability to modify and delete raw data files in the HPLC data acquisition system (W-187)

During discussions and lab demonstrations, it was determined that neither system prevents analysts from overwriting original raw data. A review of the software validation showed initial failures for modules demonstrating the ability to delete or overwrite data. Documentation in the validation report stated that this capability could not be changed. During the laboratory demonstration, I observed the statement, "Data will be overwritten" with the option to ignore this.(W-192)

Records Failure to retain all production, control, or laboratory records to

assure that drug products adhere to established specifications (W-018).

Failure to maintain records of changes to documents (W-071). Failure to include in laboratory records complete records of the

periodic calibration of laboratory instruments and there are no calibration records available for the FTIR Spectroscope and the HPLC laboratory instruments (W-086).

Failure to maintain records of calibration checks and inspections of automatic, mechanical, or electronic equipment (W-098).



Electronic Records In addition to the above listed violations, our investigator noted

that the laboratory is using an electronic record system for processing and storage of data from the atomic absorption and HPLC instruments that is not set up to control the security and data integrity in that the system is not password controlled, there is no systematic back-up provision, and there is no audit trail of the system capabilities. The system does not appear to be designed and controlled in compliance with the requirements of 21 CFR Part 11, Electronic Records (W-081).

Data files are automatically deleted after a hard copy is generated (W-087).

Review of your electronic complaint files reveals they have not been properly validated, there is no ability to generate accurate and complete copies of records in human readable and electronic form, there is no protection of records to enable their accurate and ready retrieval, access to your system has not been limited, as well as other significant deficiencies. (W-068)

We strongly encourage you to perform a thorough and complete evaluation of all your electronic records in accordance with 21 CFR Part 11 as well as any guidance generated by FDA to assure conformance to our requirements.(W-068)

You failed to encrypt and/ or physically secure your data back-up system to comply with the requirements to prevent deterioration or deletion of the analyzer data (W-185)

The audit trail generated within xxx does not truly reflect the identity of the responsible individuals. Individuals have been able to log on to the system under an other individuals account and make changes which then show up on the audit trail to the first individual (W-187)

The firm's review of laboratory data does not include the audit trail/revision history to determine if unapproved changes have been made. (W-187)

Electronic records generated during manufacture of APIs were not reviewed prior to release of validation lots or for any lots manufactured thereafter to include the most recently released API lot (W-190)



Furthermore, your system does not have an audit trail to document changes (W-203)

Failure to establish adequate controls and procedures to assure the authenticity, integrity, and security of all electronic records including data generated in the laboratory (W-203)

System administrator privileges were to be assigned to validation chemists, lead chemists, and laboratory supervisors only. These privileges include the ability to modify and delete raw data files and to lock/unlock projects for reprocessing in the chromatographic data acquisitions system which is used in the laboratory for finished product release testing, stability testing, and method validation studies (W-203)

Our investigators documented many instances with extensive manipulation of data with no explanation regarding why the manipulation was conducted. This manipulation would include changing integration parameters or re-labeling peaks such that previously resolved peaks would not be integrated and included in the calculation for impurities (W-203)

System Security Password protection can be bypassed in the system (W-087). Failure to establish and implement adequate computer

security and data integrity in that during this inspection it was observed that an employee was found to have utilized another person's computer access into the..... computerized record system (W-040).

Insufficient security controls to prevent analysts from submitting modified data (W-029).

The xxx system computers in the lab do not time-out. If an employee fails to log off a computer and walks away other individuals can easily access the computer under the first employees account. (W-187)

Validation of the (brand name) laboratory software used to control instruments, generate data, perform calculations, and store data from raw material and finished product testing failed to demonstrate adequate security. Analysts have the ability to overwrite original data, and are not required to utilize the protection of individual passwords (W-192)



Good Laboratory Practice Regulation You failed to maintain a copy of a master schedule of all non-

clinical laboratory studies (W-088). You failed to assure QAU oversight during the preparation of

histology slides for all GLP studies (W-088). You failed to assure that protocol deviations and QAU

inspection reports for study #323 were evaluated by a replacement study director (W-083).

Failure of the study director to assure that all experimental data were accurately recorded and verified and document the reason for any change in the entries (W-194)

For study xxx your study director failed to assure that dosing were accurately recorded to confirm that study animals received protocol-specified doses of the vehicle. (W-194)

Failure of QAU to assure that reported results in the final study report accurately reflected the raw data (W-194)

Failure of QAU to maintain written and properly signed records of each periodic inspection (W-194)

Failure to identify the test and control articles with appropriate characteristics in the final report (W-194)

Clinical Investigations / Trials Failure to ensure adequate monitoring of the investigation (W-

183) Data were missing and inaccurate data was corrected for

Subject [redacted] (W-183) Failure to secure the investigator's compliance with the signed

investigator agreement, the investigational plan, applicable FDA regulations, and any other conditions of approval imposed by the reviewing IRB or FDA (W-183)

There are repeated deviations from the investigational plan, spanning several years, with no apparent steps taken to bring the clinical investigators into compliance, which indicates failure to ensure investigator compliance (W-183)

Review of the inspection report indicates that the IRB failed to follow written procedures for conducting initial and continuing review of research (W-184)



The IRB's written procedures state that "the IRB shall consist of thirteen (13) members." Since October 12, 2005, the IRB membership roster has listed only 12 members (W-184)

The IRB's written procedures state that "meetings will be held on an as-needed basis, but no less than quarterly." However, the IRB records indicate that the IRB has met at intervals greater than three months on four occasions since August 2004. (W-184)

Failure to use expedited review procedures only for certain kinds of research involving no more than minimal risk or for minor changes in approved research [21 CFR 56.110] (W-184)

Failure to ensure that the IRB reviewed proposed research at convened meetings at which a majority of the members of the (W-184).

FDA Notification Failed prompt reporting to … the FDA of any unanticipated

problems involving risks to human subjects or others, any issues of serious or continuing non-compliance with these regulations (W-093).

Risk Analysis/Critical Steps Failure to conduct a thorough risk analysis to identify and

document any possible hazards associated with the design of the devices in both normal and fault conditions (W-113)

The protocol did not identify critical process steps, critical process parameters, in-process tests or specifications (W-102).

Your firm failed to conduct and document adequate risk analyses that discuss the safe use of your devices with/without their accessories (W-202)

Risk analysis is incomplete. The risk analysis for the hazard of linking PET/CT scans to the incorrect patient was performed after a June 2006 incident. The risk analysis has not been re-assessed/updated for increased probability given the three subsequent incidents. Your firm's Standard Operating Procedure directs risk analysis be reviewed and updated upon receipt of safety-related complaints. However, no risk analysis



was performed for complaints related to incorrect normalization values in [redacted] PET/CT scanners ( W-212)

6. Efficient Quality Systems to Prevent Non-compliance

In this chapter we will give recommendations on what companies should do to be able to demonstrate that they are in compliance with FDA regulations. Recommendations are based on FDA regulations, FDA inspection and compliance policy guides, 483 inspection reports, EIR’s and warning letters, industry guidances and ISO standards as well as the author’s personal experience with inspections and audits.

Some good sources of information include the many FDA publications related to risk-based inspection approaches for medical devices and drug manufacturers. Another good source of information is the FDA’s Compliance Policy Guide for Inspection of Medical Device Manufacturers (22). This program provides guidance to FDA field and center staff for the inspections and administrative/enforcement activities related to the Quality Systems and Good Manufacturing Practices.

The Guide to Inspections of Quality Systems (23) was designed to inspect quality systems of medical device manufacturers but the concept of system-based inspections is very much in line with the FDA’s 21st century GMP initiative and therefore also worthwhile having a look at.

In September 2004 the FDA released an Industry Guidance dealing with quality systems for drug cGMPs: Quality Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations (28). This guidance describes a comprehensive quality system (QS) model for manufacturing human and veterinary drugs, including biological drug products. It is intended to help implementing modern quality systems and risk management approaches and at the same time to meet cGMP



requirements. It is positioned as part of FDA's pharmaceutical CGMP initiative for the 21st century where the FDA explained the agency's intent to integrate quality systems and risk management approaches into existing programs with the goal of encouraging the adoption of modern and innovative manufacturing technologies.

Other documents include the Inspection Guide for Quality Control Laboratories (7) and the Foreign Inspection Guide (8). Probably the most useful document to find out what inspectors are advised to look at for pharmaceutical drug manufacturers is the FDA’s Compliance Program Manual for Drug Manufacturing Inspections (9). The document provides a lot of details and most concepts of this program are very much in line with the FDA’s new approach to risk-based system inspections.

Besides FDA documents, reference books of private authors are also very good resources for selected topics, for example reference books on validation (25, 26).

This chapter has three basic recommendations as preventive actions to avoid non-compliance findings:

1. Look at and comply with high-level requirements that are typically common to all regulations and quality systems.

2. Correct deficiencies from previous inspections.

3. Look at specific detailed requirements of the target regulation. As an example we recommend looking at the FDA’s Compliance Program Manual as described in Reference 9.

Comply with Common Requirements for all Regulations

Despite the fact that different regulations have different requirements there are a couple of things that are common to all regulations. These are listed at the beginning of this section with a strong recommendation to look at them first. Typically these are also higher-level requirements and should be part of any quality system. They are typical primary targets of FDA inspections as deficiencies at higher levels also indicate non-compliance at detailed levels.

Based on these requirements the recommendations to achieve compliance are:



Develop a corporate compliance master plan or quality plan that describes the companies policies and intent towards quality and compliance

Develop an organizational structure as required by the regulation.

Define and document roles and responsibilities of the management, of the quality control and quality assurance unit and of other functions that are important for compliance.

Develop corporate or global standard procedures that describe general company processes and procedures to implement the company policies.

Develop step by step standard operating or working procedures (SOPs) to document routine tasks.

Develop and implement procedures to develop, review, distribute, update and archive documentation.

Implement procedures for internal audits.

Implement procedures for people qualification. The program should specify who needs to be trained on what and how frequently refresher training will be required. Training should include regulations, and training activities should be documented.

Implement procedures to assess and qualify suppliers, service providers and subcontractors.

Implement procedures to validate processes, e.g., manufacturing processes and analytical processes.

Implement procedures to validate equipment. Development and periodic review of an equipment Validation Master Plan (VMP) is strongly recommended. This should include information on which systems should be validated, how tests are performed, how acceptance criteria are defined and how deviations from acceptance criteria are handled. The VMP should also include recommendations and criteria for revalidation.

Implement procedures to validate computer systems.

Implement and periodically review procedures to ensure system security and data integrity of electronic records.



Implement procedures to define, archive and retrieve electronic records generated by computer systems. Archiving media and the time frame for processing of records should be based on documented risk assessment.

Develop and implement procedures on how to test and accept incoming material, e.g., raw materials, active pharmaceutical ingredients and reference standards. Test results should be documented. If such tests are performed by an outside test laboratory, the lab should be audited and qualified.

Develop procedures to document production records, test data and raw material. Test data should include information on equipment used, analytical procedures, environmental conditions and personnel operating the equipment.

Implement procedures to investigate non-compliance and Out-Of- Specification situations, for Corrective and Preventive Actions (CAPA) to avoid occurrence of the same or similar problems.

Implement procedures to assess the risk that a process, equipment, or products can have on public health. Categorize the systems and processes into high, medium or low risk systems.

Implement formal change control procedures that should assess the need for revalidation for process and equipment changes. Changes should be justified, approved and documented.

Implement procedures for management reviews and on-going improvements

All procedures should be documented, well communicated to employees, understood by employees, and readily available at workplaces and to inspectors. Internal audits should confirm that procedures are followed.

Inspection Findings from Previous Inspections

The most important recommendation is to look at previous inspection reports, if any exist. Look at each deviation and your response. Check if all actions described in your response were followed up in time and corrected. Also check if the root cause of



the problem was identified and if a program was initiated and documented to prevent occurrence of similar problems in other areas.

Look at Specific Details as Required by Individual Regulations

Looking at all details of regulations is probably the most time-consuming step and requires an in-depth knowledge of the regulation and frequently a common sense interpretation and science-based implementation.

A good tip is to look at interpretations and recommendations for inspections made by the FDA. An excellent document to look at is the FDA’s GMP Compliance Program as defined in Reference 9. The program refers to system-based inspections and defines six systems:

1. Quality Systems

2. Facilities and Equipment

3. Material Systems

4. Production Systems

5. Packaging and Labeling Systems

6. Laboratory Control Systems

The program recommends always inspecting the quality system and three of the other five systems for full inspections and one of five for abbreviated inspections.

Quality Systems

It is expected that a company’s quality system is always the first step evaluated during each inspection. The assumption is that without a well functioning and well-documented quality system a company cannot ensure GMP compliance at lower levels. Therefore a well-documented quality system and procedure should be in place.



The system should ensure overall compliance with cGMP and internal procedures and specifications. The system includes the quality control unit and all of its review and approval duties (e.g., change control, reprocessing, batch release, annual record review, people qualification, validation protocols and reports). It also includes all product defect evaluations and evaluation of returned and salvaged drug products.

The system should also define roles and responsibilities of management. Procedures should be in place to review all processes as defined by the quality system.

According to Reference 9, procedures should be available for:

Product Reviews: at least annually; they should include information from areas listed below as appropriate; batches reviewed, for each product, are representative of all batches manufactured; trends are identified.

Complaint Reviews (Quality and Medical): documented; evaluated; investigated in a timely manner; includes corrective action where appropriate.

Discrepancy and Failure Investigations Related to Manufacturing and Testing: documented; evaluated; investigated in a timely manner; includes corrective action where appropriate.

Change Control: documented; evaluated; approved; need for revalidation assessed.

Product Improvement Projects: for marketed products.

Reprocess/Rework: evaluation, review and approval; impact on validation and stability.

Returns/Salvages: assessment; investigation expanded where warranted; disposition.

Rejects: investigation expanded where warranted; corrective action where appropriate.

Stability Failures: investigation expanded where warranted; need for field alerts evaluated; disposition.

Quarantine Products.

Validation: status of required validation/revalidation (e.g., computer, manufacturing process, laboratory methods).



Training/Qualification of employees in quality control unit functions.

Facilities and Equipment


Facilities Cleaning and maintenance.

Facility layout and air handling systems for prevention of cross-contamination (e.g. penicillin, beta-lactams, steroids, hormones, cytotoxics, etc.).

Specifically designed areas for the manufacturing operations performed by the firm to prevent contamination or mix-ups.

General air handling systems.

Control system for implementing changes in the building.

Lighting, potable water, washing and toilet facilities, sewage and refuse disposal.

Sanitation of the building, use of rodenticides, fungicides, insecticides, cleaning and sanitizing agents.

Equipment Adequacy of equipment design, size and location.

Equipment installation and operational qualification where appropriate.

Equipment surfaces should not be reactive, additive or absorptive.

Appropriate use of equipment operations substances, (lubricants, coolants, refrigerants, etc.) contacting products/containers etc.

Cleaning procedures and cleaning validation.

Controls to prevent contamination, particularly with any pesticides or any other toxic materials, or other drug or non-drug chemicals.

Qualification, calibration and maintenance of storage equipment, such as refrigerators and freezers for ensuring that



standards, raw materials, reagents etc. are stored at correct temperatures.

Equipment qualification, calibration and maintenance, including computer qualification/validation and security.

Control system for implementing changes in the equipment. Equipment identification practices (where appropriate).

Documented investigation into any unexpected discrepancy.

Materials Systems


Training/qualification of personnel.

Identification of components, containers and closures.

Inventory of components, containers, closures and storage conditions.

Storage under quarantine until tested or examined and released.

Representative samples collected, tested or examined using appropriate means.

At least one specific identity test is conducted on each lot of each component.

A visual identification is conducted on each lot of containers and closures.

Testing or validation of supplier's test results for components, containers and closures.

Rejection of any component or container or closure not meeting acceptance requirements. Investigate fully the firm's procedures for verification of the source of components.

Appropriate retesting/reexamination of components, containers and closures.

First in-First out use of components, containers and closures.

Quarantine of rejected materials.

Water and process gas supply, design, maintenance, validation and operation.



Containers and closures should not be additive, reactive, or absorptive to the drug product.

Control system for implementing changes in the materials handling operations.

Qualification/validation and security of computerized or automated data handling system.

Finished product distribution records by lot.


Production Systems



Control system for implementing changes in processes.

Adequate procedure and practice for charge-in of components.

Identification of equipment with contents, and where appropriate phase of manufacturing and/or status.

Validation and verification of cleaning/sterilization/depyrogenation of containers and closures.

Calculation and documentation of actual yields and percentage of theoretical yields.

Contemporaneous and complete batch production documentation.

Established time limits for completion of phases of production.

Implementation and documentation of in-process controls, tests, and examinations (e.g., pH, adequacy of mix, weight variation and clarity).

Justification and consistency of in-process specifications and drug product final specifications.

Prevention of objectionable microorganisms in non-sterile drug products.



Adherence to preprocessing procedures (e.g., set-up and line clearance etc.).

Equipment cleaning and use of logs.

Master production and control records.

Batch production and control records.

Process validation, including validation and security of computerized or automated data handling system.

Change control; the need for revalidation evaluated.


Packaging and Labeling Systems



Acceptance operations for packaging and labeling materials.

Control system for implementing changes in packaging and labeling operations.

Adequate storage for labels and labeling, both approved and returned after issued.

Control of labels which are similar in size, shape and color for different products.

Finished product cut labels for immediate containers which are similar in appearance without some type of 100 percent electronic or visual verification system or the use of dedicated lines.

Gang printing of labels. This is not done unless differentiated by size, shape or color.

Control of filled unlabeled containers that are later labeled under multiple private labels.

Adequate packaging records that will include specimens of all labels used.

Control of issuance of labeling, examination of issued labels and reconciliation of used labels.



Examination of the labeled finished product.

Adequate inspection (proofing) of incoming labeling.

Use of lot numbers, destruction of excess labeling bearing lot/control numbers.

Physical/spatial separation between different labeling and packaging lines.

Monitoring of printing devices associated with manufacturing lines.

Line clearance, inspection and documentation.

Adequate expiration dates on the label.

Conformance to Tamper-Evident Packaging (TEP) requirements (see 21CFR 211.132 and Compliance Policy Guide, 7132a.17).

Validation of packaging and labeling operations including validation and security of computerized or automated data handling system.


Laboratory Control Systems



Adequacy of staffing for laboratory operations.

Adequacy of equipment and facility for intended use.

Calibration and maintenance programs for analytical instruments and equipment.

Validation and security of computerized or automated data handling system.

Reference standards; source, purity and assay, and tests to establish equivalency to current official reference standards as appropriate.

System suitability checks on chromatographic systems (e.g., GC or HPLC).



Specifications, standards and representative sampling plans.

Adherence to the written methods of analysis.

Validation/verification of analytical methods.

Control system for implementing changes in laboratory operations.

Required testing is performed on the correct samples.


Complete analytical records from all tests and summaries of results.

Quality and retention of raw data (e.g., chromatograms and spectra).

Correlation of result summaries to raw data; presence of unused data.

Adherence to an adequate Out-Of-Specification (OOS) procedure which includes timely completion of the investigation.

Adequate reserve samples; documentation of reserve sample examination.

Stability testing program, including demonstration of stability indicating capability of the test methods.



7. Preparing for and Conducting FDA Inspections

At this stage you have now done your very best to bring your department, site or organization into compliance with FDA regulations. But you can still make many mistakes prior to and during the inspection and your excellent preparation can be a waste of time if you are not careful. In this chapter we give advice on how to prepare your organization and personnel for an FDA inspection and how to make a good impression during the inspection.

Preparing your Organization for FDA Inspections

FDA inspections are important for your department, your company and your people. Failing an inspection can have tremendous consequences and therefore your department should be well prepared. Recommended steps in preparation for an FDA inspection are:1. Develop a Standard Operating Procedure for FDA inspections.2. Develop checklist3. Train management and staff4. Conduct ‘FDA inspection’ like internal audits5. Establish an FDA inspection response team. 6. Review previous inspections and corrective actions7. Reserve and prepare meeting rooms.

Review Previous Inspections

If you have already experienced inspections the first step is to take a close look at the inspection report (EIR) and deviations, if any. There are two reasons for this:

1. This is how the inspectors will prepare themselves. They will look at your company compliance history, at the latest inspection reports and deviations. They will follow-up on these



with questions to see if deviations have been taken care of and corrective actions have been completed.

2. Failing the same deviations twice is very bad. This brings your company into the FDA’s radar screen and you will have the reputation that you are either not able or willing to bring your system into compliance.

Don’t only look at inspections that took place at your department or site, but also at your entire organization. Determine what commitments your company has previously made and whether or not these commitments were properly addressed and if everything was documented. If previous commitments were not addressed, identify why and find out if there is still a plan in place to address them in the near future.1. The (chief) auditor/inspector writes a report (the detailed report

should not contain any surprises that were not mentioned in the summary under 1). The (chief) auditor/inspector sends the report to the laboratory management. This also includes a time frame as to when the response, e.g., 30 days, is needed.

2. The laboratory makes a plan to resolve the problem and writes an official statement to the auditor.

3. If the statement is accepted by the audit team, the file is closed.

Develop Standard Guide or SOP for FDA Inspections

FDA inspections are so important that there should be a standard inspection guide or operating procedure. The procedure should include information on:

Areas and documents that are subject to FDA inspections as well as those that are not. Prepare a list with examples.

Responsibilities (by department and function) and internal contacts for the audit.

Who should be informed and how when the inspection is announced.

Who should be informed and how when the inspector arrives. How inspections are prepared. How inspections are to be conducted.



How inspectors are to be handled. How to answer questions. How to treat company confidential information. How documentation is provided to inspectors. How to follow-up on inspections. How to distribute inspection reports.

Establish the Inspection Response Team

Prior to the inspection a response team should be established with members from:

Quality assurance (owners, host) Quality control Regulatory affairs IT department Manufacturing/Laboratories Validation groupMembers should be knowledgeable in particular business areas or about particular projects. For each team member a back-up should be identified mitigating the risk of unavailability of core members. A list should be created and maintained with contact information of core members and back-ups (Figure 6).

Team members should be asked to reserve time prior to, during and after the inspection. They should form sub-teams to address specific inspection issues, e.g., preparing appropriate documentation. For example, if a new LIM System has been implemented, the responsible “validation” contact forms a LIMS sub-team to make sure all validation documents are available and there are no open issues that have not been documented. If you subcontract major work to a 3rd party organization, a representative of that organization should also be on the list.



Function Name OfficePhone

CellPhone

E-mail

Quality Assurance

Back-up

Quality ControlBack-up

Regulatory Affairs

Back-up

ITBack-up

ManufacturingBack-up

QC-LabBack-up

Figure 5: Members of the Audit Response Team

People Assignment

Prior to the inspection people should be assigned for:

The role of the host, who will be the company’s direct interface with the inspector, prior to, during and after the inspection.

Keeping notes to document what happens during the audit, for example which documents have been given to the inspector.

The role of the escort, who picks up the inspector at the front desk, accompanies the inspector during the inspection and makes sure that the inspector is never left alone.

Bringing/removing documents requested by the inspector.



People Training

Employees should also be prepared for FDA inspections. Obviously they will be nervous in answering questions asked by the inspector, especially if it is the first FDA inspection. Internal audits will help in the preparation but employees should also be trained and receive information on:

Why the inspections are necessary.

Inspection items and also areas that are not subject to inspections.

Content and meaning of the inspection SOP.

How to react to questions.

What to give the inspector to take back to the office, e.g., how to deal with proprietary information or what to do if they ask to take software for evaluation of specific data.

What are typical questions that go beyond the daily work, e.g., about the company’s quality policy.

Company policies for visitors, e.g., safety and whether visitors are allowed to take photos or not. How to apply policies to FDA inspectors, for example what to say if they try to get into areas that can only be entered with specific qualification requirements.

How to provide documents, electronic vs. paper.

How to report inspection findings to management to make sure management is aware of any problems.

Inspection Announcement

Typically the FDA notifies companies on upcoming inspections using a form 482. This form also describes the reason for the inspection. When the FDA announces the inspection, company management should be immediately informed. Ask the FDA about the type of inspection, its scope, focus and anticipated length. Next actions are: Agree on a date and exact location.

Arrange for meeting rooms for the inspector and for the inspection response team.



Send out an e-mail to employees announcing the audit. Include a list of most important things and most frequently asked questions.

Pull documents from the archive or other locations and review the documents for completeness.

Have a “dry run” with the inspection team, which can include a review of documentation and a walk-through of the facility.

Reserving and Preparing Meeting Rooms

Meeting rooms should be reserved in time. It is a good practice to prepare two rooms: one for meeting with the inspector (inspector’s room) and one for the inspection and response team (preparation room). Both rooms should be close to each other and equipped with office supplies, phones, computers, printers and modem or LAN connection. The preparation room should also be equipped with a photocopier. Try to locate the meeting rooms away from manufacturing and laboratories so that the daily operation is not interrupted too much.

Internal Audits

Internal audits are a key element of any quality system. Their objective is to evaluate activities and existing documentation to check whether these meet predetermined internal regulations andor customer requirements.

Internal audits are an ideal tool in preparing an organization for external inspections.

Internal audits should be well-planned and follow a certain structure. Needless to say not all systems can be audited for all items in one go. A better recommendation is to set up a schedule so that different systems are audited at different times and over a certain period of time all items should have been checked in all systems. Priorities of the audits should be based on risk assessment and high-risk systems should be audited first.

Internal audits are divided in three phases:

Preparation



Conduct

Conclusion, Report and Follow-up

In the following lists recommendations for all steps of a laboratory control system audit are summarized:

Preparation 1. Establish audit team and lead auditor.

2. Review results of previous audits, if any.

3. List areas to be evaluated.

4. Contact the department.

5. Prepare an agenda.

6. Review agenda with the department and get consensus.

Conduct1. Review selected documents, e.g. procedures for handling Out-

Of- Specification situations and procedures for operator training.

2. Interview management and ask for organizational structure and responsibilities of management, QA/QC and other functions.

3. Ask for a risk management procedure to categorize your laboratory into high, medium and low risk systems. Ask for a list with high and low risk systems and discuss the rational behind it.

4. Walk through the facilities, observe people at work and interview operators.

5. Select an analytical system with high impact on product quality.

6. Ask for a description of the system, its intended use and specifications.

7. Ask for topological diagrams if the system is networked with other systems.

8. Verify if the equipment hardware has been qualified.



9. Verify if software and computer systems have been validated.

10. Ask if tests were done under high load.

11. Check system security. Try to access the system.

12. Verify that limited access to computer systems and data have been challenged.

13. Examine test procedures and ask for results from a certain time period.

14. Trace the result back to methods for analysis and data evaluation, operators and raw data. Review raw data.

15. Check data integrity. Specifically check if operators could manipulate electronic records interactively on the computer and if so check if the changes were recorded by the system through an electronic audit trail.

16. Ask which application software and which version was used at that time.

17. Ask what the difference was to the previous software version and how users made sure that the new version worked as intended.

18. Verify if operators are trained and successful completion of the training has been documented.

19. Verify if Out-Of-Specification situations have been handled adequately. If the situation was caused by a laboratory error, check if a preventive action plan in addition to a corrective action plan has been implemented.

20. Give immediate advice if any non-compliance with FDA regulations or company standards has been found.

Conclusion, Report and Follow-up 4. Have a closing meeting with all auditors and the laboratory

management.

5. The (chief) auditor/inspector summarizes all findings, assigns levels of concern to each finding and listens to the lab’s response. Any misunderstandings should be resolved at this point.



Prepare Required Documentation

Inspectors will spend quite some time with document review. Key documents should be available in the meeting room and others easy to access. The key documents should be checked for compliance.

Collect Required Documentation

Make sure that documents typically required are readily available. There are three reasons why it should not take long to find and deliver a specific document:

It is required by some regulations. For example, subpart 21 CFR 211.180(C) reads: Records that are covered under Subpart J of 21 CFR 211 should be readily available.

It does not make a good impression if it takes too long to find a specific document. It indicates to the inspector that you are not in control of your documents. Inspectors record everything they asked for and can make a note how long it took to get specific answers.

Long search times for multiple documents will extend the length of an inspection.

Typical documents that should be available for all records include: Organization charts with responsibilities.

Procedures for internal audits and audit schedules.

Job descriptions and training records.

Validation Master Plans.

Procedures for change control and change control logs.

Risk assessment procedures and list of high/low risk systems.

Corrective Action and Preventive Action procedures and plans (CAPA).

Procedures to ensure system security and data integrity.

Glossary with terms related to the inspection.

System descriptions, specifications, validation plans and validation reports for systems classified as “high-risk”.



List of authorized people who have access to critical computer systems.

Analytical laboratory notebooks and logs.

Analytical methodologies and validation reports.

Reports of analysis performed for specific lots, supported by spectra, chromatograms and charts.

Deviation reports.

For pre-approval inspections additional documents should be available:: Production records of batches related to clinical trial materials

used to demonstrate bioavailability or bioequivalence. These clinical trial batches could have been used in early clinical studies.

Batch records that are submitted in the application that demonstrate that the proposed production process is the process that was used to manufacture the bioavailability, bioequivalency or stability batches.

Development notebooks that contain data on bioavailability, bioequivalency or stability of a new product.

Inventory records and/or receiving records of drug substance purchases.

Stability data.

Subpart J of 21 CFR 211 specifies documents required by GMP: Equipment cleaning and use log.

Component, drug product container, closure and labeling records.

Master production and control records.

Batch production and control records.

Production record review.

Laboratory records.

Distribution records.

Complaint files.



Obviously not all these documents will be reviewed during an inspection. Knowing that maybe only 10% or less will be reviewed can be quite frustrating to individuals who have devoted their time and efforts to write, prepare and review all the documentation, but it seems to be Murphy’s law that the inspectors will always ask for that one document that has not been prepared.

Check all Documents for Compliance

Documents should be checked if they comply with predicate rules as well as with internal standards. For example, check if documents are signed when a signature is required either by a regulation or by an internal procedure. For example, we are not aware of any regulation that requires students to sign training records. Such signatures are frequently required by internal procedures, so they should exist. And if the training record system is fully electronic, signatures should be in electronic form.

For US-FDA inspections information should be available in English. This is a requirement under 21 CFR 312.23(C) that a sponsor submit an accurate and complete English translation of each part of the IND. The same requirement is true for NDSs under 21 CR 314.50(G).

Conducting the Inspection

The Inspector Arrives

When the inspector arrives treat him/her as you would any other visitor. Ask for his/her photo ID card, FDA ID and name, office, address and phone number. If other people accompany the inspector, ask why and what their role will be. Notify the host and escort the inspector to the designated room. Confirm the type of inspection, e.g., routine or “for cause” inspection and how long the inspection is expected to last. After that you can create some kind of an agenda together with the inspector.



20 important things to consider during the inspection:

There are a couple of important do’s and don’ts during the inspection:

1. Don’t panic. Keep in mind that you know your processes much better than the inspector. Act professionally and provide the courtesy that should be offered to any visitor.

2. Be cooperative. Don’t view the FDA inspector as a threat. 3. Treat inspectors as human beings instead of enemies.

Working with the inspector rather than against him/her is to your advantage.

4. Avoid arguing with the inspector about observations during the inspections. A better time to do this is during the exit meeting.

5. Escort the inspector at all times. Try to keep him/her in the designated room or areas.

6. Take notes on all questions and answers.7. Have SOPs, validation protocols and other documentation

readily available. Pay special attention to deviations, rejected batch records and failed tests. Information should be complete and accurate. There should be a good explanation if any required documentation is missing. Also, remove any misleading items from the documents, like personal notes or observations.

8. Make a list of all documents provided to the inspector.9. Make a copy of all documents requested by the inspector for

removal and keep the original. 10. Make sure all questions are clearly understood before they

are answered. If the inspector’s question is unclear, ask for clarification. Try to get the answers to questions and requested documents as quickly as possible.

11. Don’t guess or assume anything! In case of any doubt, you may repeat the question for clarification.

12. Be honest and open to questions. Don’t try to mislead the inspector.

13. Be consistent with your answers. Inspectors take notes from questions and answers. Inspectors become suspicious if they get different answers to the same question.

14. Listen carefully to what you are asked and be as specific as possible when responding to the question.



15. Only answer questions that are asked. Stop talking when you have answered the question and don’t even explain your answer.

16. Try to avoid answering open-ended questions. Ask for more specific details.

17. If you don’t know the answer, make this clear to the inspector. It is fine to ask the inspector for more time to get and review the details surrounding the question. If there are other people who may know the answer say: “Please give me more time to contact the right person and I will get back to you on your request”. You may leave the room and get the answers from somebody else in the inspection team or you may refer to other people who know the answer and bring them into the room. This is why creating a contact list with back-up names and phone information is so important.

18. Try to answer with your company’s perspective and policies in mind rather than giving your own opinion. For example, if an inspector asks, “Why did you not test this or that as part of a validation study?”, your answer may be: “Do you mean: why does our validation master plan not recommend to do such tests?”

19. If the inspector asks for a document that you are not familiar with, ask: “What do you mean by this?” You may have the document but under a different name.

20. Try to fix problems during the inspection whenever possible.

After the Inspection

The exit meeting

When the inspection is finished the inspector will note observed deviations in the 483 form. Use the time when the inspector writes the 483 form to review your notes and write down any questions you may still have. The inspector will present the 483 form with inspection observations in an exit meeting. Your management team is given the opportunity to defend the deficiencies cited by inspectors. The observations should be reviewed with the inspector. If the observations are not understood or too general



ask for more details and examples. For example, you may ask what the inspector means by “the procedures are inadequate”. During the process avoid conflict, and do not become too emotionally involved. Document all your questions and the answers. You can discuss and suggest corrective actions but don’t make firm commitments for corrective actions or any other follow-up before discussing the consequences with the inspection team.

Follow-up

After the inspector has left your site review the observations with the inspection team, assess the impact of the observations and summarize the findings from the inspection. Develop a corrective action plan as a direct response to the observations but also assess the impact the observations may have on other areas not covered during the inspection.

8. Responding to 483’s and Warning Letters

When inspectors find deviations, there are several ways to respond and correct problems:

During the inspection before the inspection observation has been drafted.

In response to the 483 inspection observations. In response to warning letters. Through other communications with the FDA.In this chapter we give recommendations on how to respond most effectively.



Responding During the Inspection

Sometimes minor deficiencies can be fixed short-term. This is very effective but unfortunately an exception. Examples have been documented in EIR’s, for example in Reference 27 an investigator reports:

“Dr. xxx informed me that he was responsible for the use of computer/HPLC units in the laboratory. I asked Dr. xxx if there was a topology map showing which computers control the HPLC units and how they are linked to the major system. At that time there was none available, but the next morning I was provided with a topology map”.

The deviation was fixed during the inspection and did not show up as a 483 observation.

Response to 483 Inspectional Observations

Typically the investigation team presents the 483 form to the firm’s representatives in the exit meeting. The content is then discussed. It is extremely important that all points are perfectly understood. The firm should not hesitate to ask questions for clarification. Terms used in the form should be understood as well as the meaning of the observations. If the text is too general, the firm should ask for examples and other details. The firm can also ask for advice on how the problems could be best solved. If you disagree with an observation and you feel it could have been caused by a misunderstanding or because insufficient information was provided to the inspector, state this openly. There have been situations where inspectors have made changes to the form’s content. You can also point out corrective actions that you have taken during the inspection before the exit meeting. You also can discuss alternatives for remaining corrective actions but be careful about making time commitments until you have talked to your company’s inspection team. The inspectors can document your suggestions in the EIR.

Response to the final 483 observation can be sent in writing addressed to the district director with a copy to the inspector. The FDA will expect a response within 15 working days. Only when the response arrives within this time frame, the content, for



example planned and/or executed corrective actions will be taken into consideration for drafting a warning letter. If the observation is really serious, you should call the district office or headquarter staff depending on who performed the inspection. What matters is not the number of observations but the type and severity. Try to set up a meeting or teleconference and make sure you understand the observations and that they are confirmed by higher-level FDA officials before developing a written response.

In preparation for the written response, form a committee that includes members of quality assurance, regulatory affairs and operations. The committee should review and clearly understand the observations made by the FDA. The committee should also determine whether the observation is isolated or if it is the result of a bigger issue or trend. If necessary, subcommittees should be formed to identify the root cause of the observation.

When you write the response it is very important to first focus on the most serious observations and to address the root cause of those. Describe how you plan to fix a problem. Include very specific corrective action plans, owners and a realistic time schedule to fix the problem.

It gives a bad impression if you have to go back more than once and explain why you need more time. Making promises you can’t keep can lead to unnecessary non-compliance in the future. For multiple deviations, list each item separately and assign separate action plans and completion dates for all of them. Besides corrective actions also explain your action plan on how to prevent occurrence of similar problems at your and at other sites (CAPA).

Response to Warning Letters

Recommendations on how to respond to warning letters are not that different from what was said in the previous section about 483’s. Response must come within two weeks. It is important to make a statement that you understood that you are in non-compliance but it is your company’s policy to comply with regulations. Address each item of the warning letter point by point with clear reference to each citation. Make it clear that you understand the root cause of the problem and that your corrective and preventive action plan is designed not only to fix the problem cited in the warning letter but also similar problems in other areas.



Include a realistic time frame for the plan. Realistic means a time that is acceptable by the FDA and is doable by your company. If you have already started or finished some of the corrective/preventive actions, attach supporting documents to the warning letter. If the deviations are really serious, especially if you have received a second or third warning letter on similar items, include the use of external consultants in your correction plan because the FDA may believe you cannot fix the problem on your own.

Preparing for the Next Inspection

The best time to start preparations for the next inspection is during or shortly after the previous one. Start implementing the action plan immediately after you have submitted your response to the FDA. Train your people on how to implement all actions. Define responsible persons to monitor and document the progress of each corrective and preventive action. Ask for regular status reports on the timely progress from each responsible person.

Finally, develop a “best practices” document with all your good and bad inspection experiences. Distribute the document within and outside your department to learn how to avoid mistakes at future inspections, and also to improve your quality system.

Appendix A: Glossary

API Active Pharmaceutical Ingredient

CDERFDA Center for Drug Evaluation and Research



CFRUS Code of Federal Regulation. Collection of all regulations issued by U.S. government agencies. The individual titles making up the regulations are numbered the same way as the federal laws on the same topic. For example, the Federal Food, Drug, and Cosmetic Act is found in Title 21 of United States Code and the companion regulations implementing the law are found in 21 CFR.

CAPACorrective and preventive action plan. Required for FDA compliance in case of specification situations or other deviations.

Change controlA procedural formality required for validation, defining how and when changes may be made and in which situations revalidation is required

Consent decreeStatus imposed by the FDA in serious violation of federal regulations and related safety and quality standards. A company must agree to a series of measures aimed at bringing it's manufacturing standard into compliance with federal regulations. Until agreed-upon conditions are met, a company may be forbidden to distribute its products in interstate commerce, except for those products deemed essential for the public health.

CPGFDA Compliance Policy Guide

EIREstablishment Inspection Report. Written after an FDA inspection by the agency. The observations from 483's are classified as no action indicated (NAI), voluntary action indicated (VAI) of official action indicated (OAI).

FD&CFederal Food, Drug, and Cosmetic Act

Functional specificationA written definition of the function that a system or system component can perform



GCPGood Clinical Practice. Term used to describe a collection of loosely-related regulations that define the responsibilities of those involved in a clinical trial. The regulations include those that govern institutional review boards, informed consent, and sponsors and monitors. Refer to 21 Code of Federal Regulations Parts 50 and 6.

GGPGood Guidance Practices

GLPGood Manufacturing Practice. Regulations of the U.S. Food and Drug Administration and other countries that spell out the requirements for non clinical (animal or laboratory) studies that will be submitted to the regulatory agency to support a marketing application. U.S. GLPs are found in 21 CFR Part 58.

GMPAlso known as current good manufacturing practices, CGMPs and GMPS. U.S. regulations in 21 CFR Part 211 contain the minimum current good manufacturing practices for methods, facilities, and controls to be used for the manufacture, processing, packing, or holding of a drug to assure that it meets the requirements of the Federal Food, Drug, and Cosmetic Act for safely and has the identity and strength and meets the quality and purity characteristics that it claims. There are good manufacturing practices for medical devices found in 21 CFR Part 820 and for blood and blood products found in 21 CFR 606.

GxPGood x Practices. X = laboratory (L), clinical (C) or manufacturing (M)

INDInvestigational New Drug application. An application which a drug sponsor must submit to FDA before beginning tests of a new drug on humans. The IND contains the plan for the study and is supposed to give a complete picture of the drug, including its structural formula, animal test results, and manufacturing information. Detailed instructions for the submission of IND's can be found in 21 CFR 312.



IOMFDA Investigations Operations Manual

LANLocal-area network - A group of computers and associated peripheral devices connected by a communications channel, capable of sharing files and other resources among several users. A LAN provides a means of communications between network nodes. A LAN provides a means of communications between network nodes.

Life TestsLive, user-site tests: these tests are performed in the end user's computing environment under actual operating conditions. Testing should cover continuous operations for a sufficient time to allow the system to encounter a wide spectrum of conditions and events in an effort to detect any latent faults that are not apparent during normal activities (Part 11 validation guidance, draft version). Such tests need to be performed for FDA compliance.

LIMSLaboratory Information Management System. LIMS need to be qualified for FDA compliance. For details see: www.labcompliance.com/books/validation3

MacroMini program that performs a specific task - to repeat steps perfectly and with much greater speed. In Excel Macros are written in a programming language called Visual Basic for Applications (VBA). In Excel Macros don't have to be created, they are recorded as keystrokes and mouse actions. Need to be validated for FDA compliance. Macros need to be qualified for FDA compliance. For details see: www.labcompliance.com/books/macros


http://www.labcompliance.com/books/macros

http://www.labcompliance.com/books/validation3


MDRMedical Device Reporting (MDR) regulation became final on December 13, 1984. As a result of changes mandated by the Safe Medical Devices Act (SMDA) of 1990, and the Medical Device Amendments of 1992, the 1984 MDR regulations (21 CFR 803 & 807) were revised and published on 12/11/95. The FDA Modernization Act of 1997 made additional changes to MDR and a revised MDR Regulation was proposed in May 1998. The final MDR regulation was published in the Federal Register on January 26, 2000.

MESManufacturing Executing System

MRPMaterial Requirements Planning System

MRPIIManufacturing Resource Planning System

NDANew Drug Application. New drug application. A New Drug Application is an application requesting FDA approval to market interstate commerce a new drug for human use. The application must contain among other things, data from clinical studies needed for FDA review from specific technical viewpoints, including chemistry, pharmacology, biopharmaceutics, statistics, and anti-infectives, microbiology. Detailed instructions for the submission of NDA's can be found in 21 CFR 314.

NetworkA group of computers and associated peripheral devices connected by a communications channel capable of sharing files and other resources among several users. Networks need to be qualified for FDA compliance.

OOSOut of specification situation. Requires failure investigation and corrective and preventive action plan.



ORAFDA's Office of Regulatory Affairs

OROFDA's Office of Regional Operations



QAQuality Assurance. A set of activities, often performed by employees in a similarly named department, that check that the characteristics or qualities of a product actually exist at the time the product is sold. Oversight function that audits operations to determine that procedures and systems are suitable and recommends required changes to provide evidence that the quality function is functioning correctly. QA is involved from product concept through design, manufacture and distribution until the ultimate use of the product by the patient.

QCQuality Control. Day to day control of quality within a company, responsible for the acceptance or rejection of incoming raw materials and packaging components, in-process tests, labeling, and inspection, assurance that systems are being controlled and monitored, and for the approval or rejection of finished dosage forms.

QualificationAction of proving that any equipment works correctly and actually leads to the expected results. The word validation is sometimes widened to incorporate the concept of qualification.Equipment and networks need to be qualified for FDA compliance. For details see: www.labcompliance.com/books

Raw DataAny laboratory worksheets, records, memoranda, notes, or exact copies thereof, that are the result of original observations and activities of a non clinical laboratory study and are necessary for the reconstruction and evaluation of the report of that study. It may include photographs, microfilm or microfiche copies, computer printouts (not for electronic records systems), magnetic media, including dictated observations, and recorded data from automated instruments.


http://www.labcompliance.com/books


ServerAny computer that makes access to files, printing, communications, and other services available to users of the network. In large networks, a dedicated server runs a special network operating system; in smaller installations, a non-dedicated server may run a personal computer operating system with peer-to-peer networking software running on top. Servers need to be qualified for FDA compliance.

Substantive ruleA substantive rule is a regulation that carries the force and effect of law

SOPStandard Operating Procedure. Documented instructions that should be followed when operating a process for the process to be considered valid. Required under GLP regulations. Written documents that prescribe the detailed methods and action steps to be followed in order to accomplish a particular task. The U.S. Food and Drug Administration requires SOPs for virtually every aspect of production, control and testing of pharmaceutical products. One of the SOPs should describe the issuance and control of SOPs.

TraceabilityThe property of a result of a measurement whereby it can be related to appropriate standards, generally international or national standards, through an unbroken chain of comparisons all having stated uncertainties.



ValidationEstablishing documented evidence that provides a high degree of assurance that a specific process will consistently produce a product meeting its predetermined specifications and quality attributes. Computer Systems and software need to validated for FDA compliance. See: www.labcompliance.com/books/validation3

VMPValidation master plan. Demonstrates a companies approach for validation. Improves efficiency and consistency for validation.See: www.labcompliance.com/books/masterplan

Warning LetterThe purpose of a warning letter is to notify the firm’s senior management that the company is in violation of the law and that FDA is ready to take regulatory action if voluntary corrections are not accomplished. For computer validation, warning letters are usually issued as a result of a field investigator’s FD-483 observation in which a computer system used to ensure the quality of a product is found to be deficient. In most cases, warning letters are issued by an FDA center compliance office. The letters signify concurrence by the FDA field and headquarters staff and are therefore excellent resources for identifying current agency policy and expectations.

Appendix B: References

1. Federal Food, Drug, and Cosmetic Act, 2004 updatehttp://www.fda.gov/RegulatoryInformation/Legislation/FederalFoodDrugandCosmeticActFDCAct/default.htm




2. L. Huber, Good Laboratory Practices and Current Good Manufacturing Practices, Agilent 5988-6197EN, 2002, 130 pageshttp://www.labcompliance.com/info/links/ref/inspections.aspx

3. Labcompliance, Audio Seminars with 10+ Best Practice Documents, 2009 (update)http://www.labcompliance.com/seminars/audio/default.aspx

4. FDA regulations (Predicate Rules), 2009 (update)http://www.labcompliance.com/info/links/fda/regulations.aspx

5. Compilation of Laws with Impact on the U.S. Food and Drug Administration http://www.fda.gov/RegulatoryInformation/Legislation/ucm153119.htm

6. FDA, General Administrative Procedures, Sec. 10.115 Good Guidance Practices. http://www.labcompliance.com/info/links/ref/inspections.aspx

7. FDA, Inspection guide, Guide to Inspections of Pharmaceutical Quality Control Laboratories, www.fda.govhttp://www.labcompliance.com/info/links/ref/inspections.aspx

8. FDA, Inspection guide, Guide to Inspections of Foreign Pharmaceutical Manufacturershttp://www.labcompliance.com/info/links/ref/inspections.aspx

9. FDA Compliance Guide: Drug Manufacturing Inspections Program 7356.002 http://www.labcompliance.com/info/links/ref/inspections.aspx

10. FDA, Compliance Policy Guide, Computerized Drug Processing; Input/Output Checking (CPG 7132a.07)http://www.labcompliance.com/info/links/ref/inspections.aspx

11. FDA, General Principles of Software Validation; Final Guidance for Industry and FDA Staff, www.fda.govhttp://www.labcompliance.com/info/links/ref/inspections.aspx

12. FDA, Guidance for the Industry, Good Clinical Practice, Consolidated Guidance, www.fda.govhttp://www.labcompliance.com/info/links/ref/inspections.aspx

13. FDA, Investigations Operations Manualhttp://www.fda.gov/ICECI/Inspections/IOM/default.htm


http://www.fda.gov/ICECI/Inspections/IOM/default.htm

http://www.labcompliance.com/info/links/fda/inspections.aspx

http://www.fda.gov/


http://www.fda.gov/






http://www.fda.gov/RegulatoryInformation/Legislation/ucm153119.htm

http://www.fda.gov/RegulatoryInformation/Legislation/ucm153119.htm

http://www.labcompliance.com/info/links/fda/regulations.aspx

http://www.labcompliance.com/seminars/audio/default.aspx



14. FDA Enforcement Reportshttp://www.fda.gov/Safety/Recalls/EnforcementReports/default.htm

15. FDA 483 Inspectional Observation, Example, 2007 http://www.labcompliance.com/info/links/ref/inspections.aspx

16. FDA Establishment Inspection Report (EIR), Example 1 2004http://www.labcompliance.com/info/links/ref/inspections.aspx

17. FDA/ORA Regulatory Procedure Manual, Chapter 6: Judicial Actions, US FDA, 2009http://www.fda.gov/downloads/ICECI/ComplianceManuals/RegulatoryProceduresManual/UCM074317.pdf

18. FDA, Warning Letter, Example, 2008http://www.labcompliance.com/info/links/ref/inspections.aspx

19. FDA Consent Decree, Example, http://www.fda.gov/AboutFDA/CentersOffices/CDER/ucm095873.htm

20. Software Quality Management, Inc. (SQM), Press Release about Consent Decreehttp://www.sqminc.com/merchant/whatsnew.ihtml

21. Excerpts and Downloads of Warning Letters, 483’s and EIR’s. www.fdawarningletter.com

22. FDA Compliance Policy Guide 7382.845: Inspection of Medical Device Manufacturers, October 2000http://www.labcompliance.com/info/links/ref/inspections.aspx

23. FDA, Guide to Inspections of Quality Systems’http://www.labcompliance.com/info/links/ref/inspections.aspx

24. FDA Guidance for Industry Part 11, Electronic Records; Electronic Signatures Scope and Applications, 2003http://www.labcompliance.com/info/links/ref/inspections.aspx

25. L. Huber, Validation of Computerized Analytical and Networked Systems, Interpharm (IHS), Englewood, April 2002, www.labcompliance.com/books/validation3

26. L. Huber, Validation and Qualification in Analytical Laboratories, Interpharm (IHS), Englewood, May 1998www.labcompliance.com/books/labvalidation/default.aspx


http://www.labcompliance.com/books/labvalidation/default.aspx






http://www.sqminc.com/merchant/whatsnew.ihtml

http://www.fda.gov/AboutFDA/CentersOffices/CDER/ucm095873.htm

http://www.fda.gov/AboutFDA/CentersOffices/CDER/ucm095873.htm


http://www.fda.gov/downloads/ICECI/ComplianceManuals/RegulatoryProceduresManual/UCM074317.pdf

http://www.fda.gov/downloads/ICECI/ComplianceManuals/RegulatoryProceduresManual/UCM074317.pdf



http://www.fda.gov/Safety/Recalls/EnforcementReports/default.htm

http://www.fda.gov/Safety/Recalls/EnforcementReports/default.htm


27. FDA, Establishment Inspection Report (EIR), Example 2http://www.labcompliance.com/info/links/ref/inspections.aspx

28. FDA Guidance for Industry Quality Systems for Drug CGMPshttp://www.labcompliance.com/info/links/ref/inspections.aspx

29. FDA, 21 CFR Part 820, Quality System Regulation http://www.labcompliance.com/info/links/ref/inspections.aspx

30. ICH Q9: Quality Risk Managementhttp://www.ich.org/LOB/media/MEDIA1957.pdf

31. L. Huber, Risk Management Master Plan, Best Practices, Labcompliance, 2009. www.labcompliance.com/books/risk

32. FDA Press Release about Seizurehttp://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm169093.htm

33. FDA Warning Letters issued by the Division of Drug Marketing, Advertising, and Communications and by Headquartershttp://www.labcompliance.com/info/links/ref/inspections.aspx

34. FDA Warning Letters issued by District Officeshttp://www.labcompliance.com/info/links/ref/inspections.aspx

35. FDA Debarment Listhttp://www.labcompliance.com/info/links/ref/inspections.aspx

36. FDA Warning Letter, Announcement of import alert,320-01-14 (W-097)http://www.labcompliance.com/info/links/ref/inspections.aspx


http://www.labcompliance.com/info/links/ref/inspections.aspx




http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm169093.htm

http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm169093.htm

http://www.labcompliance.com/books/risk


