Automated Compliance: Reducing Costs and Maintaining Quality

The US Food and Drug Administration initiative, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach, focusses on pharmaceutical processes that present the highest risk to product quality. This article examines automated compliance; that is, utilizing innovative technologies and building quality into the compliance infrastructure. This includes standard operating procedures, work instructions, analytical methods, data sheets, batch records and more. Compliance-based activities can be automated, minimizing compliance risk and maximizing productivity and quality.

In an interview earlier this year (Bio-IT World, April 2003), Janet Woodcock, director of the Center for Drug Evaluation and Research (CDER), stated that "The original intent of the rule (21 CFR Part 11) was to facilitate the introduction of electronic technology to the process of the US Food and Drug Administration (FDA) submissions, as well as manufacturing and production. Part 11 was created to provide common-sense guidelines on how to do in the electronic world what was previously done on paper. During the last 5 years, however, confusion regarding what is included in the regulation and how to enforce it was impeding the introduction of new technology. The rule had created exactly the opposite of what was intended."

Compliance: keeping IT simple

Leading pharmaceutical companies show strong agreement regarding compliance trends. FDA's initiative, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach, is seen to make much sense, as does merging 21 CFR Part 11 into this policy. In every regulatory area, a lot of time can be spent discussing subtle interpretations of regulatory boundary conditions. Recent FDA guidance allows more discretion at the boundaries, but maintains a clear focus on the centre. And, it is not complicated.

To assess events to date, two important factors must be understood:

• In the current paper-based environment, FDA is challenged to review and audit the entire regulatory spectrum to the most rigid compliance interpretation. The agency has been unable to comprehensively audit all facilities subject to good manufacturing practices (GMPs) biannually. It is clear that the public interest is better served through consistent audit and enforcement of critical products and processes. Risk-based assessment is simply the agency's prioritization to best serve the public's interest and safety.

• Electronic data automation is critical to accelerating reviews and audits while ensuring compliance and quality. Part 11, therefore, plays a key role in moving forward. The intent of Part 11 is to stimulate innovative technology and facilitate the growing use of electronic records. Today, superior and cost-effective technology is available to enable the industry to comply with the rule.

Part 11 will now be reviewed in the process of GxP audits of critical products and processes. By focussing enforcement on predicate rules, the industry is able to focus on compliance and remediation. In the pharmaceutical industry, the most critical procedures and data are part of new drug applications (NDAs) and support the release and stability of marketed products.

Some organizations may choose to minimally comply because of a lack of regulatory clarity. The consequence, however, is that they will have less time available to achieve full compliance once the deadlines are firmly set. Most leading companies clearly understand the regulatory direction and are proceeding steadily toward fully compliant operations before final deadlines are set and enforced.

Figure 1 Compliance and quality define process and procedural standards that must be met for approval to market a drug or other regulated product.

Much of the current debate regarding compliance and enforcement assumes the historical paradigm that compliance is expensive, resource-intensive and time-consuming. This need not be the case. Rapidly improving, innovative technologies are available that enable better compliance and increased productivity than ever before - not higher costs. Automated compliance provides increased efficiency and is not an additional burden. Technology will transform compliance, just as HPLC technology transformed separation, and mass spectrometry transformed detection.

Part 11 update

FDA has reassigned responsibility for Part 11 to CDER and will review the regulation in conjunction with its cGMP re-examination initiative. FDA withdrew its prior guidance for industry and issued a temporary draft guidance on 20 February 2003, which was issued requesting comments during the following 60 days. The agency then indicated that new guidelines would be issued during July.

The cGMP re-examination is referred to as "risk-based," therefore, the interpretation and enforcement will also presumably be risk-based. The first step will be to define and focus on the areas that present the highest risk to product quality. Plant HVAC systems, for example, are likely be considered 'low risk,' even if temperature data comprise part of the record. Analytical data to release products or supporting clinical supplies are almost certainly to be considered 'high risk.'

Part 11, however, has not been rescinded. The temporary guideline introduces several clear positions and then proceeds to state

• FDA will more narrowly interpret Part 11 applicability, enabling it to focus on critical areas.

• FDA will use discretion in enforcing Part 11. By focussing industry's efforts, it can rapidly address critical systems. FDA can prioritize inspecting critical systems.

The temporary guidance clarifies the definition of electronic records. It states: "Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any records requirements set forth in Agency regulations. Part 11 also applies to electronic records submitted to the agency under the ... (various acts) even if such records are not specifically identified in Agency regulations. The underlying requirements set forth in (the acts) other than Part 11 are referred to as predicate rules."

The list of predicate rules is extensive and includes 21 CFR 58, 210, 211, 310, 312, 314, 510, 511 and 514. Whereas FDA claims it will apply risk-based enforcement, the industry is now faced with risk-based compliance. Predicate rules will provide the context in which all compliance is assessed. In terms of Part 11, the question is no longer: "Is it an electronic record?" but: "Is the record covered by a predicate rule and what is the risk assessment of the record?"

Strategic observation

Examining FDA's initiative, it is clear that an 'automated compliance platform' is in alignment with future FDA direction. Some important comments and observations from an FDA press release include

Figure 2 Electronic data review with compliance flags.

• "Using state-of-the-art approaches in FDA's many critical review and inspection activities will encourage innovation and continuous improvement in drug manufacturing to minimize production problems and that will make it easier to get safe, high quality medications to patients who need them," said Mark B. McClelland, FDA commissioner.

• The initiative was designed to evaluate and improve FDA's approach to reviews and inspections regarding the manufacturing of human and animal drugs and biologics.

• FDA believes the revision to the Part 11 guidance is part of this movement.

The initiative will include additional intermediate and long-term steps, and its major goals include

• ensuring that state-of-the-art pharmaceutical science is utilized in the regulatory review and inspection policies

• encouraging the adoption of new technological advances in high quality and efficient manufacturing by the pharmaceutical industry

• assessing the applicable cGMP requirements relative to best quality management practices

• enhancing the consistency and co-ordination of FDA's drug quality oversight activities.

It is important to note that FDA planned to complete and publish a comprehensive implementation plan for this cGMP initiative by mid-year. Clearly, predicate rules will be a priority for FDA and records subject to predicate rules will be examined regarding Part 11 and risk.

Part 11 update conclusions

There is strong consensus among leading pharmaceutical companies that critical electronic laboratory data will be subject to Part 11 requirements. Low risk, non-critical computer use will be subject to Part 11's narrower interpretation and discretionary enforcement. Legacy systems put in service prior to 20 August 1997 are Part 11 exempt. This may be a moot point because the exemption relates to Part 11 and not predicate rules. If records cannot satisfy Part 11 requirements, it is unlikely they can be considered valid to support predicate rules.

In specific uses, companies may state that computers were incidental to creating valid (cGMP) paper doc-uments. This requires them to maintain the resource-intensive administrative controls and blocks the use of the electronic source data in their longer- term paperless initiatives. Although this may enable a more orderly transition to full technical Part 11 compliance, it delays adoption of electronic filings, reviews and audits

Requirements for a Part 11 technical remediation solution in analytical laboratories

The purpose of Part 11 is to ensure that records maintained in electronic form on behalf of FDA as a consequence of predicate regulations are controlled and tested in a sufficiently rigorous manner to ensure their accuracy and integrity. There is no requirement that records be maintained electronically for FDA; however, if such records are maintained electronically, the records, systems and manner that control their creation and maintenance are subject to Part 11. For any comprehensive technical remediation solution to meet the requirements of Part 11, the following issues must be addressed:

• the ability to create accurate and complete copies of records in both human readable and electronic form

• protection of records to enable their accurate and ready retrieval

• system access to authorized individuals

• secure, computer-generated, time-stamped audit trails for any file change

• authority checks to ensure only authorized individuals can use the system and electronically alter and sign a record

• determine that persons who develop, maintain or use electronic record/signature systems are trained and are authorized to perform their assigned tasks

• control of system documentation

• validation.

To satisfy these requirements, a practical solution should be expected to provide

• complete security and access control ensuring that only authorized individuals can use the system (centrally administered)

• granular eligibilities for people, applications, computers and files ensuring compliance

• immediate security of a record upon creation, providing physical as well as logical security

• consistent record storage with state-of-the-art security.

These features are important not just in meeting Part 11 requirements, but are also the foundations of valid GxP e-records.

Automated compliance: better quality with increased productivity and compliance

There is a transformation under way. Progressive organizations are recognizing that compliance is "good science" applied to quality and not just a regulatory burden. As compliance is built into processes and human factors are minimized using innovative information technologies (ITs), compliance will become an asset and not a risk, as it is often currently perceived. Compliance and quality define process and procedural standards that must be met for approval to market a drug or other regulated product (Figure 1).

Table I Experiment 1 - high volume QC.

Market research has discovered resource constraints in key quality control (QC), stability and analytical development laboratories. It has also identified a large and growing resource redeployment to satisfy the GMP demands required for paper-based manual operations. Further analysis confirmed that approximately 70% of the work of the analytical team (analysts, data reviewers, quality assurance [QA] and first line supervisors) is now dedicated to compliance driven activities such as redundant checking of manual data; correcting simple errors; investigations of unexpected or out-of-specification (OOS) data; formal documentation; and review and approval of final results.

It concluded that laboratory productivity can be dramatically increased by replacing manual, paper-based operations with a validated electronic solution - from data acquisition through method execution to data review and results reporting.

What would this new environment be like?

• In a paperless laboratory, all primary laboratory data and their metadata are quickly and easily acquired in electronic form and stored in a secure, compliant database.

• Procedures are stored and accessed electronically, and are executed and documented in full compliance. Test methods and standard operating procedures (SOPs) reside in a shared enterprise-wide database, so they are always current and consistent at all sites, worldwide.

• Redundant checking is replaced by at-a-glance "review by exception" in which only the data that indicate audit trail or an out-of-limit condition is reviewed. Reviews, approvals, investigations, audits and submissions are fast and efficient because all necessary infor-mation is captured and instantly available in a relational structure.

• The risk of warning letters and citations is reduced because there is always a ready, accurate and complete answer to the inevitable FDA question: "How do you know?"

• Electronic data becomes available to other laboratory information systems enhancing them through a richer source of laboratory data.

• Not only does the laboratory operate more efficiently, but errors are also minimized because warnings are displayed in real-time as a procedure is executed.

• Error prevention replaces the current mode of error detection.

• Equipment calibration and validation procedures will be managed to ensure full comp-liance is performed by qualified individuals.

• Training materials and competency assessment can be built into electronic systems to provide instant training and skills records access.

What quality benefits are likely to follow in this electronic process managed and compliant environment?

• Consistency using controlled workflow and consistent data acquisition formats. It is far easier to review well-formatted electronic data than handwritten notations in notebooks with metadata logically linked to analytical data (Figure 2).

• Fewer errors and more rapid investigations, for example, by eliminating transcription errors. Data limits flag unexpected results in real-time permitting rapid investigations and disposition. As a validated system, calculations do not have to be manually checked.

• Instrument calibration verification prior to using instrumentation.

• Review by exception (all changes or OOS events flagged with full audit trail). All available at the reviewer's terminal.

Additionally, one of the major benefits of an automated compliance platform should be a measurable reduction in labour content compared with the equivalent paper-based operations.

Automated compliance "controlled experiments"

Several major pharmaceutical companies have performed controlled experiments to benchmark an automated compliance platform against their current manual, paper-based operations on a variety of different laboratory methods. The scope of these evaluations included

• data and metadata acquisition

• result documentation: preparation of data for review and approval

• data review

• result approval.

In controlled comparisons, the use of the automated compliance platform reduced the laboratory labour content by 40–50% compared with the equivalent paper-based operations.

Experiment 1 - high volume QC.

A study was performed in a high volume manufacturing QC laboratory to determine the actual resource improvements resulting from deploying an automated compliance technology. Several experiments were performed utilizing time to measure the difference between paper-based and automated processes - a composite of the experiments is shown in Table I.

This controlled experiment demonstrates the significant savings (almost 60%) gained by replacing paper-based manual operations with electronic automated compliance.

Table II Experiment 2 - inventory audit.

Experiment 2 - inventory audit. A controlled experiment was performed comparing a manual inventory process with an ePMC electronic notebook platform. The experiment involved a team of people assigned to count inventory in a Class II controlled substance environment. The inventory audit procedure contained three main elements:

• team 1 counted the inventory

• team 2 recounted the inventory

• management compared the data and determined any aberrant results, then confirmed results with a final recount.

An automated compliance platform clearly improves compliance while delivering compelling productivity gains (Table II).

Summary

The pharmaceutical industry has an urgent need. Leading pharmaceutical companies must develop and commercialize new products more quickly, improve productivity throughout their operations and ensure compliance under more demanding regulations.

The industry and FDA is committed to electronic filings and audits. Part 11 defines how electronic records can meet or exceed today's paper based-records. Twenty years of automation and IT innovation have set the stage for the paperless laboratory. The technology is available today and it is rapidly improving, affordable and integrates readily with legacy systems.

Bibliography

1.

www.fda.gov/bbs/topics/NEWS/2003/NEW00872.html

2. E. Halpin, K. Rapp and F. Zenie, "Application of a Paperless Electronic Process Management and Compliance System in Drug Development," Arn. Lab. 33(8), 20–25 (2001).

3. www.fda.gov/ora/compliance_ref/part11/FRs/background/pt11finr.pdf

4. www.pda.org

Acknowledgement

We appreciate the effort and collaboration of several leading pharmaceutical and biotech companies for their contribution to the metrics and conclusions in this article.