Information-Technology Criteria in CMO Selection and Management

Pharmaceutical companies that seek to hire a contract manufacturing organization (CMO) must consider information technology (IT) concerns when they evaluate service providers. A sponsor company must investigate the manufacturing automation and systems, laboratory automation and systems, IT infrastructure, and business applications of each potential CMO. The authors describe the criteria that help pharmaceutical companies hire the appropriate CMO for their project.

Pharmaceutical and biotechnology companies use a web of contract research organizations (CROs), contract manufacturing organizations (CMOs), and other service providers to produce clinical-trial materials, provide process and formulation development, resolve problems in scale-up, and produce commercial quantities of drug substances and finished products. Pharmaceutical and biopharmaceutical companies may also seek contract organizations that can provide day-to-day operating services for internal functions that are not considered core competencies. When an organization outsources many of its key business processes to contract partners, it may be considered a virtual enterprise. Managing various contractors is difficult under any circumstances, but this task is particularly challenging in the highly regulated pharmaceutical industry. Effective project management, well-planned service-level agreements (SLAs), practical quality assurance, and effective use of information technology (IT) are key elements in managing a virtual enterprise, even when IT itself may be outsourced. Shortcomings in any of these areas can cause the delicate web of the outsourced supply chain to fail (see Figure 1).

Figure 1

A sponsor evaluates potential CMOs on the basis of their proposals, management experience, references, manufacturing capabilities, and record of compliance with good manufacturing practices (GMPs). The initial evaluation involves an assessment of a CMO's manufacturing facilities, processes, and supporting systems. A further assessment of the CMO candidates' quality and IT systems is crucial because these systems provide the sponsor with regulatory evidence, information and electronic reports, actionable data, and communications capabilities to monitor and manage the CMO. For example, the CMO's IT systems must be able to collect and report data on material-handling processes, laboratory results for active pharmaceutical ingredients, excipients, and finished products, as well as the manufacturing process controls (e.g., cleaning, sterilization, labeling, packaging) and the transport of the finished product.

Preselection IT assessment

A potential CMO might initially appear to meet the sponsor's superficial manufacturing requirements but closer assessment of the CMO's IT and control systems might reveal underlying risks. Figure 2 identifies key areas to assess regarding CMOs' manufacturing and laboratory automation and critical IT components.

Figure 2

Evaluating automated support and control systems as part of the due-diligence process in CMO selection is critical for identifying weak technology and business processes that will create risk for the sponsor. Depending on the size of the project to be outsourced, a preselection IT assessment of infrastructure, select systems and data, and communications capabilities should take between two to four days. A preselection IT assessment should include an evaluation of manufacturing automation and systems, laboratory automation and systems, the IT environment, and IT processes and controls.

Manufacturing automation and systems

The sponsor must evaluate whether the CMO's automated manufacturing-control systems are qualified. These systems may either control or collect data from manufacturing process equipment or packaging equipment. The sponsor should assess the CMO to determine whether the CMO has defined processes or procedures for the installation, qualification, and validation of manufacturing equipment, systems, and processes. If these processes and procedures are absent, then the CMO probably does not have evidence of a consistent controlled qualification of its manufacturing equipment or systems (see Figure 3).

Figure 3

The CMO should have records documenting the installation (installation qualification) of the equipment. These records will include the specifications and verification of materials, piping, wiring, vacuum, air supplies, and other equipment components as applicable. Records should also include functional and design specifications for automated equipment control. Often called programmable logic controls (PLCs), these computer systems are specifically designed to interface with certain types of manufacturing or packaging equipment. These computers' programs should be subjected to unit-level testing to confirm that they function correctly before they are integrated with the equipment. The connections and wiring between the automation or computer and the equipment should also be documented in wiring diagrams and verified as part of the qualification activities.

The CMO should have documented evidence that the integrated equipment and automation have been tested together and shown to function correctly according to the given specifications. This evidence is often called installation qualification (IQ) and operational qualification (OQ) of the integrated unit. A final check should determine whether the CMO has documented procedures for the ongoing operation, maintenance, and change control of these integrated equipment units. If the CMO has performed these activities and retained the specifications and records, the sponsor can be confident that the CMO's automated equipment is qualified and ready to execute the manufacturing or packaging processes required to produce the sponsor's product.

If the CMO candidate cannot produce the documentation discussed above, the sponsor could be at risk for increased costs. These qualifications will need to be performed to ensure that the sponsor's product will meet specifications and that the records will satisfy regulatory expectations.

A CMO may also use various manufacturing systems that help execute the manufacturing business processes but do not control or interact directly with the manufacturing equipment. These types of systems include manufacturing execution systems (MES), inventory-control and materials-management systems, warehouse-management systems, and electronic-batch-record (EBR) systems. Because these systems are used to perform GMP activities, they should be validated. The US Food and Drug Administration provides its expectations for validation in General Principles of Software Validation; Final Guidance for Industry and FDA Staff (1).

Evidence for validation of these types of applications includes a validation plan, requirements specifications, functional specifications, design specifications, configuration specifications, development-level testing, IQ protocols and results, OQ protocols and results, and either user-acceptance testing or performance qualification (PQ) protocols and results. An overview of the mapping between the specifications and testing should be presented in a traceability matrix. Standard operating procedures (SOPs) should exist for the ongoing use, maintenance, and control of these systems. Finally, a summary of the validation activities and evidence created should be presented in a validation summary report.

As it did for the manufacturing-automation assessment, the sponsor should ask the CMO to provide evidence that it has defined processes for validating a manufacturing operation business application system. If the CMO can share with the sponsor a risk-based method for qualification or validation, it will demonstrate that it has achieved a high level of compliance sophistication (2). If the CMO has no documented processes for qualification, validation or ongoing control, this omission may be a source of compliance risk to the sponsor. A CMO with uncontrolled automated manufacturing equipment or systems can jeopardize the acceptance of a clinical study or the approval of a new drug application (NDA) or cause the recall of a commercialized batch of product.

A final, subjective assessment of the manufacturing automation or systems area can be made by simply touring the CMO's manufacturing facility and observing its equipment, automation, and practices. The sponsor can look for some of the following indicators that may be warning signs of regulatory noncompliance, CMO financial instability, or inability of the CMO to meet contractual agreements with the sponsor:

• Obsolete computer equipment

• Automated equipment or computers that are independent and not networked together

• A totally paper-based environment

• Computer workstations that are active and unsecured even when left unattended

• Computer workstations at which operators share one identification code and password

• Automated control systems with unsecured computer code or programs

• Computer equipment in areas that are experiencing environmental extremes (e.g., of temperature, humidity, airborne particulate matter, or water)

• Computer cabling that is dangerously located and subject to damage or electromechanical interference.

The subjective observation criteria can also be applied to the assessment of a CMO's quality-control laboratory, automated laboratory instrumentation, and laboratory systems.

Laboratory automation and systems

The sponsor should determine whether the CMO candidate will provide quality control (QC) laboratory capabilities and operations. In certain cases, the sponsor may decide to hire an independent QC laboratory contractor. If the CMO candidate is to provide QC capabilities, the sponsor must determine whether the CMO's QC laboratory instruments and systems are qualified. These systems may control or collect data from analytical laboratory instruments or help automate laboratory processes such as sample management. The sponsor should assess the CMO to determine whether it has defined processes or procedures for the installation, qualification, and validation of automated laboratory instrumentation, laboratory systems, and processes. If these processes and procedures are absent, the CMO probably does not have evidence of a consistent, controlled qualification of its laboratory instrumentation, analytical methods, or laboratory systems (see Figure 4).

Figure 4

Laboratory instrumentation is considered differently than manufacturing equipment because the automation portion of the laboratory instrument is normally embedded into the instrument by the vendor. Thus, the analytical instrument and its embedded computer controls are installed as a single unit. The CMO should have functional and design specifications for the automated laboratory instrumentation and records documenting the installation (IQ) of the automated analytical instrument. These records may include the instrumentation specifications or installation instructions provided by the vendor. In the case of automated laboratory instruments, parameters will often be set or configured according to the intended use of the instrument. The CMO should retain a record of these configuration settings.

A laboratory-instrument application software package often provides the functional interface between the automated instrument and the laboratory technician. At a minimum, functional requirements or specifications should document the functionality of the application. The CMO should also have documented evidence that this application software, and any associated computer hardware, has been installed according to the manufacturer's specification and the CMO QC laboratory configuration requirements (IQ). The CMO should also verify that the application communicates correctly with the automated instrument.

Once these activities have been completed, the CMO should provide evidence that the integrated application and laboratory instrument have been tested together and shown to function correctly according to the given specifications. This is often referred to as OQ.

As with manufacturing systems, a final check should determine whether the CMO has documented procedures for the ongoing operation, maintenance, and change control for this automated laboratory instrumentation and associated systems. If the CMO has performed these activities and retained the specifications and records, the sponsor can be confident that the CMO's automated laboratory instruments are qualified and ready to execute the analytical methods that the sponsor requires. The sponsor will specify the analytical methods that must be performed by the CMO's QC laboratory. The CMO will be responsible for validating the analytical method on its automated instrumentation and within its laboratory environment.

If the CMO candidate cannot produce the documentation discussed above, the sponsor could be at risk for incorporating unacceptable materials into product, clearing unacceptable product for release, or maintaining inadequate specifications and records for regulatory purposes.

The CMO may also use various laboratory or quality systems that help execute the QC laboratory business processes but do not interact directly with automated instrumentation. These types of systems include laboratory information management systems, laboratory-chemicals inventory management, material-safety data sheets management, and deviation-reporting systems. These systems may be governed by select sections of 21 CFR 210 and 211, 21 CFR Part 58 (Good Laboratory Practice for Nonclinical Laboratory Studies), and 21 CFR Part 11 (Electronic Records; Electronic Signatures). The need for system validation depends on the system's intended use and the applicable regulations. If validation is required, the CMO should use a process similar to the one described in the manufacturing section. The sponsor should require the CMO to have similar documentation for this validation.

IT environment

The quality and capabilities of the CMO's IT systems and environment are as critical to the success and compliance of the sponsor as the CMO's manufacturing and QC laboratory capabilities. Figure 5 presents an overview of the components of the IT environment.

Figure 5

During the preselection IT assessment process, early identification of weaknesses and risks in the IT infrastructure, applications, or data-management areas enables the sponsor to avoid hidden costs and compliance failures.

IT infrastructure. The following areas of the CMO's IT infrastructure should be evaluated: network and communications capabilities, servers, data-storage devices, and the facilities that house these primary infrastructure components.

The facilities that house the infrastructure components should be inspected to determine whether they are adequately secure. Security can be provided by physical locks, password- or code-enabled locks, identification-card readers, or biometric sensors. The sponsor should also look for physical elements that ensure the safe, continued operation of the equipment within the facility or data center. Fire-extinguishing systems, heating and air-conditioning systems, uninterruptable power supplies and power-conditioning units, battery backup, and power generators protect the equipment and the data or records they hold.

The CMO's networks provide the communications capabilities within the CMO's own organization and between the CMO and the sponsor. During the preselection assessment, the sponsor should ask the CMO candidate for an explanation of the networks and communications capabilities. This overview will help determine how the CMO approaches network design in the manufacturing, laboratory, and administrative or corporate areas. The sponsor should look for network design elements that provide the appropriate level of isolation, security, and performance for the functioning of the specific area. Isolated proprietary shop floor or laboratory networks are often used to protect the data and equipment or instrument controls from the day-to-day business or administrative operations and data. The CMO should have processes and controls in place for securing their internal network through user identification and passwords.

Firewalls should be in place to provide additional security between the CMO's internal IT environment and the outside world. The network components that provide data exchange between the CMO and the sponsor should have the capacity and speed the sponsor requires. If electronic data exchange is a critical concern and requirement for the sponsor, actual transmission tests can confirm the connectivity and transmission speed between the CMO and the sponsor.

The CMO should be able to pre-sent evidence to the sponsor that the network has been qualified accor-ding to industry good practices. The evidence should show that the CMO understands the current network configuration, knows that it is functioning properly, and has controls in place for the ongoing support and control of the network.

The CMO should be able to present evidence that its computer servers have been properly installed and qualified. The evidence should include an inventory of all servers, configuration information for each server (e.g., vendor, model, major components, processor model, amount of memory), amount and type of other internal server storage, operating system and utility software installed along with the version and patch level, communications addresses, and identification of any application software (version and patch level) installed on each server. Controls should be in place for the ongoing operation, support, and control of the servers.

If the CMO uses mass data-storage devices that are external to the computer servers, then it should show evidence that the data-storage devices were properly installed and qualified and that adequate strategies are in place for their ongoing operation, support, and control. Basic configuration information should be available.

Applications. During the preselection assessment, the sponsor should determine which business processes the CMO candidate performs with the assistance of computerized applications. The sponsor's quality unit can provide an initial determination of the applicability of federal good practices regulations (GXP) for the computerized applications. This determination will allow the sponsor to focus on systems that have high GXP visibility. Regulatory inspectors tend to focus on systems that:

• Have a direct effect on product safety, purity, or efficacy (e.g., manufacturing-recipe systems, materials management, inventory tracking, and systems that provide required procedures)

• Have an effect on the patient (e.g., systems that directly affect the product such as labeling and packaging systems and automated inspection and materials-handling systems)

• Directly affect the creation, maintenance, or retention of critical records (e.g., manufacturing-batch records, quality-control records for raw materials and finished products, and product-distribution records).

The CMO should be able to present evidence showing that systems governed by GXP were validated according to an established process or method. Table I identifies some of the types of documentation that the sponsor should request for a validated system. The set of appropriate documentation depends on the type and criticality of the specific system and the CMO's approach to computer-system risk management.

Table I: Documentation that shows an application has been validated.

In addition to investigating the compliance of the CMO's GXP-related applications, the sponsor should use the preselection assessment as an opportunity to identify the application systems that support the CMO candidates' business operations such as procurement, financials (e.g., accounts payable and accounts receivable), human resources (e.g., hiring, training, and termination), document management, production and capacity planning, equipment inventory and asset management, corrective and preventive action (CAPA), deviation tracking, project management, management of customer change orders, and desktop operations. Compiling a list of the CMO candidates' applications and their installed version of the application enables the sponsor to evaluate the compatibility of its own applications with those of the CMO candidates. If sponsor applications are different from those of the CMO candidates, then the sponsor's IT support staff can advise the sponsor about the efforts and costs that will be required to establish application compatibility, create a custom interface to a CMO system, or implement a manual solution for the incompatibility problems. Having this information before selecting the CMO will help to develop an accurate cost estimate for doing business with the particular CMO candidate.

Data and records. A crucial element of the preselection assessment is the determination of how the CMO proposes to produce, store, and transfer critical manufacturing records (i.e., actual manufacturing-batch records), regulatory data (e.g., lot and batch traceability, certificates of analysis for raw materials and sponsor product), and data or records that may be critical for the sponsor's business (e.g., finished-product inventory, locations, and QC status) (see Figure 6). These data and records flow from the CMO to the sponsor.

Figure 6 indicates that the sponsor is providing highly confidential intellectual property (e.g., product formula and manufacturing recipes) to the CMO. It is therefore essential for the sponsor to determine whether or not the CMO candidate can provide an appropriate level of security to protect the sponsor's intellectual property.

Figure 6

The sponsor should identify whether the CMO candidate will create paper-based records or electronic records and which records will be available to the sponsor. For example, the CMO may produce a paper-based manufacturing-batch record or an EBR. If the CMO can only provide paper records, the sponsor must determine whether the records will suit the sponsor's business processes. If they will not, the sponsor must identify alternative solutions and the costs for converting the paper record into an electronic format. If the manufacturing-batch record is only available in paper form, then the sponsor can estimate the cost of scanning the paper record into an PDF-file format and programming a function to link searchable metadata to that PDF file. This estimate is valuable information to have when the sponsor is ready to negotiate the SLA-based contract with the selected CMO. This exercise can be done for each type of critical record.

The final item of note in Figure 6 is the two-way flow of data and information between the CMO's and the sponsor's IT systems. The sponsor should look for compatibility between the CMO's and the sponsor's systems. Compatibility can be facilitated when the CMO uses systems that are based on open-standards products such as UNIX operating systems and SQL-compliant databases or products that have the flexibility to produce output in different standard file formats (e.g., ASCII format and PDF format).

Some additional items should be explored during the preselection assessment of the CMO candidate's IT environment. The CMO should provide the sponsor with an overview of how it can provide data and record security. At a minimum, the CMO should address the following areas:

• How the sponsor's proprietary information, data, and records will be stored

• How sponsor data will be kept separate when more than one sponsor database resides on the same server

• What security measures are in place to ensure that only authorized individuals will be able to access the sponsor's data and records

• The process for backup and recovery of the sponsor's data and records

• How the CMO will ensure the ongoing business continuity of its IT systems and the sponsor's data and records.

IT processes and controls

During the preselection assessment, the sponsor can interview key CMO IT personnel. It is recommended that the sponsor interview a diverse sample of representatives in the CMO's IT department (e.g., IT application manager, computer-room operator, network engineer, programmer, technical engineer, and help-desk and support personnel). The interviews should yield an overall impression of the processes, practices, standards, and procedures that exist within the CMO candidate's IT area. A complete review of all IT processes is not practical at this point of the CMO selection process, but the sponsor should look for indicators of the following good practices:

• Documentation of a service-delivery methodology. The International Organization for Standardization has developed several standards such as ISO 20000 that provide guidance in this area. The IT Infrastructure Library is also a guidance system for the development and delivery of IT services and infrastructure (3, 4).

• Implementation of a quality-management system (QMS). Evidence of this may include a quality manual and quality policy. ISO 9001 and Control Objective for Information and Related Technologies provide guidance for establishment of a QMS (5, 6).

• Commitment to continuous improvement. This commitment may be demonstrated by a simple SOP or may be an elaborate Six Sigma program.

• Documentation of security practices and proof that the procedures are followed. Evidence includes new account requests and their approval, network designs that include firewalls, automatic password expiration for desktop users, and account deactivation. The ISO 27000 series provides standards and guidance on IT security.

• Establishment and testing of business-continuity and disaster-recovery plans.

• Documentation of records-retention policy and procedures for paper and electronic records and proof that the process is being followed.

• Documentation of procedures for change control and configuration management. This criterion is especially important when the CMO is providing services to several sponsors. Operational records should indicate strict adherence with these procedures.

Good project-management practices are key to the successful development, implementation, delivery, and maintenance of systems or services. During the preselection assessment, the sponsor should look for evidence of good project-management practices such as clear definition of roles and responsibilities and clear identification of deliverables, milestones, and dependencies. Metrics for tracking progress, cost, and resource utilization should be clearly defined and appropriate. Reporting mechanisms should be efficient and timely. These project-management practices can be successfully applied to all areas of the CMO's operations.

Managing CMOs through SLAs

The preselection assessment verifies that the CMO properly maintains electronic records related to the manufacturing batches and controls and has adequate IT infrastructure, systems, and communications in place. Once the preselection assessment is completed and a CMO is selected, the sponsor should establish SLAs for ongoing monitoring and improvement and negotiate the final contract.

Developing SLA-based contracts is the most critical and valuable work that a sponsor will conduct during the outsourcing engagement. SLA-based contracts are the only way to ensure that the sponsor and the service provider (CMO) have a clear understanding of the services required and being provided.

In the manufacturing, QC, and IT areas, record requirements are specified within the following regulations:

• 21 CFR Part 210 "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General" (3)

• 21 CFR Part 211 "Current Good Manufacturing Practice for Finished Pharmaceuticals" (4)

• 21 CFR Part 58 "Good Laboratory Practice for Nonclinical Laboratory Studies" (5)

• 21 CFR Part 11 "Electronic Records; Electronic Signatures; Final Rule" and its companion guidance "Electronic Records; Electronic Signatures—Scope and Application" Guidance for Industry, Part 11 (6, 7).

The failure to properly maintain the required records is a major source of regulatory noncompliance. IT good practices and standards can increase the effectiveness of the CMO's automated systems and applications and reduce compliance risks associated with records creation, maintenance, and retention. Therefore, the sponsor can reduce its risk by including several IT-related requirements as part of an SLA-based contract.

The sponsor can require the CMO to establish a plan and timeline for the remediation of substandard systems that pose a compliance risk and substandard practices that do not meet industry or regulatory expectations.

The sponsor can require the CMO to ensure that its IT infrastructure supporting business areas is qualified to meet industry and regulatory expectations. Meeting expectations includes the establishment of related IT procedures or work instructions to install, maintain, and support the infrastructure components.

The sponsor can require the CMO to ensure adequate management of change to the automation and systems configurations that have been agreed to at the initiation of the contract. Management can be demonstrated by establishing documented procedures for the management of:

• Formal requesting of a change

• Approval of a requested change by appropriate representatives of the sponsor and the CMO

• Documented evidence of the implementation and testing or verification of the change

• Tracking of all changes applied over the life of the contractual agreement.

Through periodic audits by a representative, the sponsor can monitor the CMO's continuous-improvement and compliance efforts. Areas to be monitored may include the following:

• Status of CAPA plans and activities related to required remediations

• Number or percent of CAPA items closed since the last audit or in a specified period of time

• Number or percent of remediation projects that are tracking to schedule

• Percent of qualified IT infrastructure

• Percent of CMO employees trained in good IT practices, GXP awareness, good documentation practices, and applicable CMO policies and SOPs.

The sponsor can require the CMO to establish documented processes and procedures for the qualification and validation of GXP-related automated equipment, automated laboratory instrumentation, and application or business systems. This documentation might include the following:

• A policy and rationale for qualification and validation

• A process or tool to help determine whether qualification or validation is necessary. This may include a GXP-assessment process or a risk-assessment process.

• Standard processes or procedures to support qualification and validation (see Table II).

Table II: Recommended procedures for the support of qualification and validation.

The sponsor may also require the CMO to establish a business-continuity plan and to agree on financial penalties it will pay for failed FDA audits.

The contract should provide for periodic, unannounced audits by the sponsor for the life of the agreement. In addition, the sponsor should insist on timing regular audits before specific milestones such as regulatory submissions or product launches. SLAs should establish that the CMO will maintain adequate product supplies to ensure that clinical-trial or other batch quantities are sufficient.

SLAs should establish detailed descriptions of the type and frequency of electronic data, records, and reports that will be provided to the sponsor. The failure to establish the timing of these reports in the SLA up-front often results in the sponsors paying extra for electronic reports that should have been part of the basic agreement or receiving electronic files that are incompatible with the sponsor's IT systems.

Conclusion

Pharmaceutical and biopharmaceutical companies will continue to take advantage of the economic benefits of outsourcing the manufacturing of their clinical supplies and commercialized products. The goal of the contract manufacturing organization selection process is to find a stable business partner that manufactures the sponsor's product according to specifications, satisfies regulatory requirements for product manufacturing and control, and provides the sponsor with the information, data, and records needed to sustain the business relationship.

A thorough information technology assessment of the CMO candidates should be considered part of the standard project management for the CMO-candidate identification and selection process. Early identification of the CMO's IT capabilities and practices will enable the sponsor to avoid common problems such as erratic availability and retention of electronic data and batch-related information, incompatibility of CMO and sponsor information systems and data, hidden costs for upgrades of CMO technology components, and failure to meet regulatory expectations.

Working with a CMO business partner that has implemented and uses industry good practices for IT processes and controls will reduce the sponsor's compliance risks, provide the sponsor with the data and information they need, and allow the sponsor to focus on the core business functions that the sponsor has chosen to pursue.

Kathleen A. Pelley* is head of the life-sciences quality practice, and John Postle is head of the life-sciences enterprise practice at Court Square Group, 1350 Main St., 5th floor, Springfield, MA 01103, tel. 215.340.5779, pelley@courtsquaregroup.com.

*To whom all correspondence should be addressed.

References:

1. FDA, General Principles of Software Validation; Final Guidance for Industry and FDA Staff (Rockville, MD, 2002).

2. FDA, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach (Rockville, MD, 2002).

3. International Organization for Standardization, "ISO–IEC 20000-1:2005 IT Service Management: Specification for Service Management" (Geneva, 2005).

4. ISO, "ISO–IEC 20000-2:2005 IT Service Management: Code of Practice for Service Management" (Geneva, 2005).

5. ISO, "ISO 9001:2000 Quality Management Systems—Requirements" (Geneva, 2000).

6. Information Systems Audit and Control Association, "COBIT 4.1 Control Objectives for Information and Related Technology" (Rolling Meadows, IL, 2007).

7. FDA, "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General," 21 CFR Part 210 (Rockville, MD, 2007).

8. FDA, "Current Good Manufacturing Practice for Finished Pharmaceuticals," 21 CFR Part 211 (Rockville, MD, 2007).

9. FDA, "Good Laboratory Practice for Nonclinical Laboratory Studies," 21 CFR Part 58 (Rockville, MD, 2007).

10. FDA, "Electronic Records; Electronic Signatures; Final Rule," 21 CFR Part 11 (Rockville, MD, 2007).

11. FDA, "Electronic Records; Electronic Signatures—Scope and Application," Guidance for Industry, Part 11 (Rockville, MD, 2003).