Paperless Reporting: How to Satisfy FDA

As the world's most powerful food and drug regulator, the US Food and Drug Administration (FDA) is rolling out its electronic data recording/reporting protocols for the food and drug industries. Paperless processing in compliance with the most exacting standards is a challenge for the global process control sector.

The fervent interest in quality control in the food and drug industries has never been higher. As part of today's highly regulated drug and food safety litigation- rich business environment, minute quality control that is tangible, continuous and traceable is an essential requirement; and no organization is more quality/traceability-minded than FDA.

No pharmaceutical can be sold in the US without FDA's approval. The achievement by a third party in achieving FDA acceptance of its electronic data is a prize indeed as it allows the recipient to proceed in the confidence of the regulator. Its processing is FDA approved and FDA compatible. Process control specialists worldwide are developing new additions to their software ranges to allow their industrial customers to obtain paperless approval from FDA for approved drug batch processing, authenticated by the processor.

It was clear right from the industry's introduction of software-specific, paperless systems that a key requirement would be recording and validation; processors have made great efforts to enable installations to comply with 21 CFR Part 11, including the Guidance for Industry Part 11, Electronic Records, and Electronic Signatures — Scope and Application. Process control innovators must, from now on, focus diligently on compliance and functionality. This is true in the pharma sector, where Part 11 applies today, particularly in such high-profile activities as clinical trials and the food sector, where authenticated paperless reporting is imminent.

21 CFR Part 11

There is no doubt that paperless systems are hugely beneficial in terms of efficiency, productivity and reliability. Above all, record keeping has been given a level of micro accurate, contemporary traceability that has been the greatest benefit of the new technology. It was clear to industry, particularly US pharma, that there was an urgent need for an industry standard, acceptable to FDA, that businesses could strive for under a uniform approach with the security of knowing that the final standard would be universally accepted. The result was a set of standards prepared by the regulator in the form of a final rule — 21 CFR Part 11, which took effect in August 1997.

Part 11 establishes the criteria under which electronic records and electronic signatures are deemed to be equivalent to paper records and handwritten signatures executed on paper. Included are electronic records that are created, modified, maintained, archived, retrieved or transmitted under any records requirements set forth in FDA regulations and/or submitted to FDA. The type of submission the agency accepts in electronic form is identified in Public Docket 92S-0251, and includes, for example, individual case safety reports, new drug applications, and food and colour additive petitions.

For process operators to comply with Part 11 there are stringent requirements concerning the authenticity, integrity and confidentiality of the electronic records and signatures. Computer systems must be validated according to generally accepted industry standards associated with an established software system life cycle to ensure its accuracy, reliability, consistent intended performance and ability to identify invalid or altered records. Software validation is defined by FDA as: "confirmation by examination and provision of objective evidence that software specifications conform to user needs and intended uses, and that the particular requirements implemented through software can be consistently fulfilled" (FDA General Principles of Software Validation; Final Guidance for Industry and Staff). Systems are required to offer output as readable text in addition to electronic means. FDA also requires system checks to enforce sequencing of events, authority checks to enforce limited access and device checks to enforce limited input facilities.

In August 2003, FDA issued a revised current good manufacturing practice (cGMP) document for pharmaceutical products that emphasizes its intention to "exercise enforcement discretion with regard to Part 11 requirements for validation, audit trail, record retention and record copying," and highlights the following Part 11 enforcement provisions fundamental to the agency's rules:

• Limiting system access to authorized individuals; controlling levels of access; characterization of individuals; minimum levels of education, training and experience in those individuals.
• Use of operational system checks.
• Use of authority checks.
• Use of device checks.
• Determination that persons who develop, maintain or use electronic systems have the education, training and experience to perform their assigned tasks.
• Establishment of and adherence to written policies that hold individuals accountable for actions initiated under their electronic signatures.
• Appropriate controls over systems documentation.

The document lists the four classes of electronic records that fall within the scope of Part 11. They are:

• Records maintained electronically in place of paper format and are required to be maintained by predicate rules.
• Records maintained electronically in addition to paper format and are relied on to perform regulated activities.
• Electronic signatures that are intended to be the equivalent of handwritten signatures, initials and other general signings required by predicate rules.
• Electronic records that will be submitted to FDA, even if they are not specifically required by agency regulations to be submitted.

It is vital that these provisions are adhered to. To achieve the electronic procedures included above, Part 11 provides for a set of electronic protocols on which the procedures rely namely on the following:

• Biometrics: reliance on an individual's physical feature(s) for electronic identification, for example, iris recognition.
• Closed system: an environment in which system access is controlled by a closed set of identified, responsible individuals (private network).
• Digital signature: cryptographic validation of identity.
• Electronic signature: use of symbols to substitute written signature.
• Electronic record: any combination of text, graphics, data, audio, pictorial or other information in digital form.

Security and functionality

Clearly, these considerations are focussed on the security of the resulting data and reports. This involves not only the physical security of the application, but also the inherent security in the hardware and software. In addition, the keyboards and other input devices of the human machine interface must be capable of "locking" both in the sense of having the unique biometric keys referred to above, but also enabling lock-out of unwanted/illegal individuals or inaccurate/untimely data or instructions.

High levels of security are made more difficult by data collection networks that are extensive and perhaps located in a multiplicity of plants. There is also an inherent flaw in the new systems; that is their very apparent precision and accuracy. Old style paper records were slow, cumbersome and open to abuse. Today, the clean report and analysis sheets that are compressed into electronic files or memory cards no bigger than a credit card, appear untouchable, and that is a danger.

It is the contemporary nature, as each entry is real-time, date-stamped and electronically signed, that gives the data its integrity. That integrity must be underwritten by hardware, software, security locks and best practice procedures that guarantee its origins and accuracy. Traceability, security, integrity and identity are the keys to successful electronic data recording and Part 11 is the standard that all must meet.

Whereas security is paramount, the data processing environment is also vital, providing the manufacturer with business information that not only maximizes their security, but also business efficiency. World-class plant management systems today must provide both, not only compliance with standards and regulations including detailed procedural control and inherent due diligence, but also reduced decision making time; improved efficiency; increased productivity and performance; reduced cost and increased profit; minimized legal liability; and increased quality.

Not only can new systems help towards batch standard SS88 and Part 11 compliance, but they can also promote timely decision support, long-term trend analysis, filtering, alarm and events, continuous improvement analysis, and plant-wide information integration. These are the management execution systems (MES) and operational excellence solutions (OES) of the future.

How can world-class process control help?

Plant operators who wish to simultaneously acquire a world-class batch-configured plant information management system (PIMS), together with FDA compliance at minimal cost and inconvenience, for the universal acceptance of their products, can achieve these aims with modern MES/OES batch recording/reporting programmes. Plan operators must positively implement the policies, procedures and best practices of paperless reporting if seeking to achieve maximum compliance within FDA-regulated environments.

Plant managers anxious to acquire a process management system that is acceptable, robust, scalable and future-proof should look for key features in the systems they install. Proposed systems should include an open database connectivity compliant, batch-configured PIMS that is compliant with fieldbus/object linking and embedding for process control foundations open standards and high security closed systems. For best security and functionality, the system should be located within a virtual private network, providing a broad range of key features for batch reporting, key performance indicators and analysis, delivering tangible benefits and low total cost of ownership, while delivering e-business solutions, from a provider with thorough process knowledge, best-in-class technology and strategic foresight.

High performance should be deliverable in an intelligent electronic batch recording SS88-based information environment, providing analysis and reporting facilities; collecting, storing and displaying current and historical data from batch production, equipment and recipe sources; facilitating user access to batch information for decision support; production planning; production scheduling; analysis; process improvement; quality; and legislative compliance via detailed audit trails, and electronic record and signature management capabilities.

New systems should deliver business benefits that include reduced time-to-market; minimized set-up time; increased productivity and plant utilization; reduced material/feedstock costs; data-based decision making; fast data analysis; quick reporting; and rapid batch approval. Above all, state-of-the-art PIMSs provide user-contextual, long-term, time-lined collection and analysis of data from the automated control systems on which they depend. They do this by providing an intelligent link from production level systems to manufacturing execution systems, enterprise resource planning and manufacturing resource planning systems to create enterprise wide solutions.

The combination of these features, together with Part 11 compliance capability providing traceability through electronic record/electronic signature functionality, is the ideal business solution for modern plant best practice, achieving a comprehensive batch information management system that is the solution to plant recording, reporting and validation demands. Operators who are building from new, or refurbishing, can all benefit from the cutting-edge management and industry standards acceptance that such a system can provide.