Management Controls for GMP Compliance

In September 2004, the US Food and Drug Administration issued a new draft document entitled, "Guidance for Industry: Quality Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations." This document represents the latest step in FDA's efforts to encourage the pharmaceutical and biotechnology industry to adopt "...modern quality systems and risk management approaches..." to management of GMP compliance (1). This article examines how a system of management controls can serve to support and maintain a company's GMP compliance status. The establishment of management controls is a concept that is embodied in the draft FDA guidance and has also been advanced by FDA in other contexts in recent years.

Why should companies implement management controls?

FDA's shift to a quality system approach to inspection and enforcement has also been seen in several recent warning letters to pharmaceutical companies citing weaknesses in quality assurance and quality control (QA/QC) operations. At least one consent decree of permanent injunction mandated an audit of QA/QC "management controls" by an expert consultant, followed by quarterly updates for an indefinite period of time (2). Although pharmaceutical good manufacturing practices (GMP) regulations do not specifically address the topic of management controls (3), they are critical to a continued compliance with such regulations. The Code of Federal Regulations provides further insight into FDA's expectations for management controls (4).

The Federal Food, Drug, and Cosmetic Act (5) is a strict liability statute and is a premise supported by two significant Supreme Court cases (6, 7). In the words of the Court, managers who "stand in a responsible relationship" to acts of the corporation and who have the "duty and the power to prevent, detect, and correct" violations of the Act can be held personally liable for violations, even if they did not intend for them to occur. For this reason, almost all FDA consent decrees name individual executives as defendants in addition to the naming company. FDA also can criminally prosecute responsible managers for violations of the Act. Therefore, it is incumbent upon management of all FDA-regulated firms to be proactive in how they manage their company's compliance status.

This article presents examples of management controls that affect GMP compliance but are not specifically required by GMP regulations. In the experience of the author, these areas often contribute to GMP-compliance problems and therefore deserve attention. Companies should be aware of the need for management controls and the effect that those controls—not just those specifically required by GMPs—can have on a company's compliance status.

Management controls defined

Certain management-control activities are designed specifically to address GMP issues such as the establishment of policies that communicate management's intentions or the establishment of a periodic, systematic review of quality data trends. Other management controls, however, are not specifically required by GMP regulations, but can have a significant effect on compliance. Examples include organizational structure, resourcing, prioritization, and performance management and incentive systems.

The pharmaceutical and biotechnology industries can gain valuable insight into FDA expectations for management controls by studying the "Management Responsibility" section of 21 CFR's Quality System Regulation (4). Although this regulation only applies to medical devices, the principles it establishes are valuable for all FDA-regulated industries.

Discussion of management controls

Mission, vision, and corporate quality policy.

Executive management must establish a clear vision that pharmaceutical manufacturing quality and compliance system is important. Without a solid philosophical foundation, the overall quality and compliance program will lack the support it needs to succeed.

Organizational design and quality control unit reporting structure. It is commonly believed, and often stated, that there must be an organizational separation between the quality unit and other operational divisions. Companies spend hours wrestling with this issue and, at the very least, go to great pains to give the impression that the quality unit is an independent area of the organization. This split tends to distract attention from the real issue: Can the quality control unit exercise the responsibilities it has been given under GMP regulations (21 CFR 211.22, 211.100, 211.192, 211.198, and other sections) without undue influence or conflict of interest? In other words, operational independence is more important than organizational independence. This is not to say that structure is unimportant. Rather, it is necessary to point out that even a proper structure can fail in execution.

In the preamble to the revised September 1978 GMP regulations, FDA commissioner Donald Kennedy stated, "The CGMP regulations do not subordinate the quality control unit's authority and responsibility to any other unit. At the same time, the regulations regarding the quality control unit do not encroach upon the expertise or responsibility of other units in a firm and do not dictate the organizational structure of a firm. They simply require that the quality control unit has final responsibility for certain actions in the manufacturing process" (8).

Risk assessment and management through systematic review of quality data. The GMP regulations require that companies perform, at minimum, an annual comprehensive review of batch records, complaints, failures, and other issues associated with products to determine whether changes must be made to the specifications or manufacturing control procedures [211.180(e)]. This regulation has existed since at least 1979 and no longer sufficiently ensures continuing quality and GMP compliance. The regulation is product oriented, not system or facility oriented. The frequency of review is insufficient to allow early recognition of adverse trends that would prevent problems rather than correct them after the fact.

In addition, 21 CFR 211.180(f) requires that "Procedures shall be established to assure that the responsible officials of the firm, if they are not personally involved in or immediately aware of such actions, are notified in writing of any investigations conducted under (specific sections) of these regulations, any recalls, reports of inspectional observations (or regulatory actions by the FDA)." This section also dates to the late 1970s and, in today's regulatory environment, is only minimally adequate to ensure that managers are aware of quality and compliance issues.

What is needed today is a system of quality metrics that will identify adverse trends early. Management should review these metrics at least quarterly. Minutes of management review meetings should list the action items identified, who is responsible for their accomplishment, and the time frames for completion. A system should be in place to ensure that the action items are completed or modified, if needed, on the basis of new information.

The type of data to be reviewed may vary depending on the operations conducted, but typical metrics include the number and types of deviations, out-of-specification results, environmental- and personnel-monitoring results, batch rejections, time to closure of investigations, stability program data, first-pass quality successes, internal and external audit findings, and others.

Prioritization of workload. An agreed upon system of workload prioritization must be in place to ensure that time-sensitive tasks are accomplished on schedule. For example, if stability testing is performed by the same analysts who test batches for release to the market, stability testing may take a back seat. This prioritization causes missed test intervals. Moreover, deviation and failure investigations must be completed within established time frames (typically 30 days). In this case, an emphasis on timeliness may result in the staff working to meet the time frame, giving priority attention to less-important investigations that are close to the metric's limit. First priority should always be given to investigations of more-serious deviations.

Role definition. Each person with GMP responsibilities should have a clear and unambiguous understanding of what is expected of him or her. When roles intersect or overlap, a risk of duplicated effort, gaps, or even conflicts occurs. Documents that define roles include job descriptions, procedures, and performance plans. Management should ensure that all compliance responsibilities are assigned properly and are understood. These duties must be revisited periodically because responsibilities shift as organizations evolve, creating gaps or inconsistencies.

Performance management. Performance management objectives that are linked to an incentive system are powerful motivators. It can be accurately said that "what gets measured gets done." Performance management objectives should be strategically aligned; that is, the company's top management should all have essentially the same objectives. This does not simply mean including quality control and compliance objectives in the manufacturing manager's objectives. It means having everyone accountable for the same objectives horizontally across the organization. The tactics may change vertically, but the objectives should remain the same.

For example, if an objective is to reduce the number of deviations, what a laboratory analyst does to further that goal may differ from his or her colleague in manufacturing, but the objective is the same. A good example of a strategically aligned objective is "Ensure a successful preapproval inspection for (new product X)." This objective is simple, easily measurable, requires that a state of compliance be achieved and maintained, and clearly furthers the company's business objectives. Each unit must have various tactics to attain this goal, but the goal itself is shared.

Resourcing. Companies not only must ensure that there are enough people to perform GMP-required activities, but also that they are appropriately qualified (21 CFR 211.25). The managerial span of control must be kept within reason. If managers have too many areas of responsibility, their performance will eventually degrade or they will be forced to spend less time than they should on each area. If staffing is insufficient, gaps will take place during illnesses and vacations, and if a person leaves the company, compliance may suffer. Companies should consider developing backup personnel for GMP critical tasks and include this information in their succession planning.

Escalation of quality decisions. 21 CFR 211.22 requires that the "quality control unit" (usually, QA) has the authority to make several critical quality and compliance decisions. Nevertheless, it is common for issues that are in dispute to be elevated, often involving senior executives in the final decision. Companies must carefully manage escalation when it takes place. The final decision must be fully justified, and the record must reflect who actually made the decision. If a senior executive overrules a quality unit decision, he or she must take responsibility for that on the record.

Using materials review boards or other interdisciplinary teams to make quality decisions also should be carefully managed. Such decisions must always be reviewed and agreed upon by the quality control unit.

Internal audits. 21 CFR 211 contains no specific requirement for internal audits, but this system is present in every well- managed company. Without a robust internal audit system, the company is at the mercy of regulators and, increasingly, customers to discover GMP deviations which the company should have known about and addressed. Even if the audit system is in place, the findings are sometimes ignored, disputed, or not recognized as adding value. Ignoring a well-founded audit finding is like ignoring a fire alarm—do so at your own peril!

A good internal audit group not only will point out problems, but also will affirm which actions are working well. Many companies are reluctant to have the audit group play a consultative role, fearing that conflicts of interest may develop. It can be very beneficial to have auditors assist in the development of a corrective actions plan, provided that the accountability for correction rests with the unit that is audited and not the auditor.

Conclusion

Management controls are critically important to achieving and maintaining of a state of compliance. The wise use of management controls will not only ensure compliance, but also will protect the company's and its executive managers' regulatory risk. At the same time, it will advance business objectives by ensuring timely regulatory approvals.

General management controls, not just those required by GMP regulations, can either help or hinder compliance depending on how they are structured and used. Executives and their teams should carefully consider the effect of resourcing, workload prioritization, performance management, and other general management activities on the company's ability to maintain a state of GMP compliance.

David L. Chesney is the vice-president of PAREXEL Consulting, 195 West St., Waltham, MA 02451, tel. 781.

434.4841, fax 781.487.9926, Dave.Chesney@PAREXEL.com.

References

1. US Food and Drug Administration,

Guidance for Industry: Quality Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations, Draft Guidance

(FDA, Rockville, MD, 2004).

2. United States v. Alpha Therapeutic Corporationet al., Consent Decree of Permanent Injunction, Civil No. 98-0664, US District Court for the Central District of California, February 1998.

3. Code of Federal Regulations, Title 21, Food and Drugs, "Current Good Manufacturing Practice for Finished Pharmaceuticals" (General Services Administration, Washington, DC, revised March 2005), Parts 210 and 211.

4. Code of Federal Regulations, Title 21, Food and Drugs, "Quality System Regulation" (General Services Administration, Washington, DC, revised March 2005), Part 820.20.

5. Federal Food, Drug, and Cosmetic Act, 21 USC 301, revised March 2005.

6. United States v. Dotterweich, 320 US 277, 64 Supreme Court, 134 (1943).

7. United States v. John R. Park, 421 US 658, 95 Supreme Court, 1903 (1975)

8. FDA, "Human and Veterinary Drugs, Good Manufacturing Practices Proposed Exemptions for Certain OTC Products," Federal Register, 43 (190), 4503–4336 (29 September 1978).