Regulatory Compliance Review

A regulatory compliance review is a program designed to find discrepancies in registered filings, correct them, and identify the underlying systemic failures that caused noncompliance. This type of review differs from a good manufacturing practices (GMP) audit (see Figure 1) in that it compares the filing with master process records (e.g., master batch records, quality standards) instead of comparing actual files with master production documents. In general, discrepancies between a master production record and the actual practice in a factory or laboratory is considered a GMP compliance issue.

Photodisc

A regulatory compliance review is beneficial in many situations:

• When filing a supplement or a variation to a file, the manufacturer unearths a significant deficiency that might have regulatory effects.

• A product launch is delayed because of filing deficiencies in another, unrelated product.

• The manufacturer receives adverse regulatory action (e.g., US Food and Drug Administration 483 observations, warning letters) because of discrepancies in the registered filing.

• Plans to relocate a process are hindered because of deficiencies in the registered filing.

• During the due diligence process before an acquisition, a manufacturer discovers that the company or product it is buying may not be in compliance with its registered filing.

• An FDA investigator enters the manufacturing site with a copy of the chemistry, manufacturing, and controls (CMC) file.

Figure 1: A regulatory compliance review differs from a good manufacturing practices audit in that it compares the filing with master process records (e.g., master batch records, quality standards).

In reviewing this list, one must realize that allowing a regulatory agency to identify these deficiencies might initiate a long, troublesome, conflict-ridden relationship with the regulators, which will make working with them and operating the company difficult. By initiating a regulatory compliance review, a manufacturer sends the message that adhering to the registered filing is of great importance to the safety and efficacy of a product, to the health of patients, and to the credibility of the company.

In assessing the resources required and the attendant costs of a compliance audit, one must take into account the risk of delaying a new product launch by one month because of a compliance problem. Figure 2 shows an example of a product's annual sales. The graph's shape and starting and ending points are almost infinitely variable. Nonetheless, one point is fixed: the date when product sales begin to decline because a better, cheaper competitor product has come to market. If a product will ultimately reach $100-million in annual sales and the filing is delayed by one month, arithmetic calculations show that the delay has cost the manufacturer $8 million, which is one month's sales at maximum sales.

Figure 2: An example of a product´s annual sales. The star indicates the day a better product comes to market.

These factors and other similar considerations have caused many pharmaceutical companies to initiate a systematic review of their registered filings.

Establishing a regulatory compliance assessment program

Select a team. The first step in establishing a regulatory compliance assessment program is to identify the appropriate team of personnel with specific expertise for recognizing discrepancies between regulatory filings and the master production documentation. The team initiating the program must have expertise in manufacturing processes, analytical methods, and product development. Because the personnel who manufacture the product will be most familiar with current product specifications and current production documentation, it is important to include personnel from the manufacturing site on the assessment team.

The assessment team should include personnel who can read and review documentation in the various languages used in current master production documents and submission documents such as labeling submissions. Team members should be chosen not only for their technical expertise, but also for the depth of their experience and the maturity of their judgment.

In addition to this technical expertise, the team must have a regulatory affairs expert and a lawyer. Various legal and ethical considerations will be presented later in this article.

Determine project scope and priorities. Having decided to initiate such a project, a manufacturer will realize that the entire task cannot be tackled at once. Therefore, one must decide how to prioritize assessment activities. Consideration should be given to tasks such as categorizing products according to patient risk (exposure) or product age. If management systems have improved and older products that have large patient bases are a greater concern, then these product assessments are a higher priority. The priority also should also take into account processes with known compliance risks (based on past audits). For example, data may indicate that certain processes (e.g., active ingredient manufacturing) are less likely to be out of compliance. One can prioritize projects by first evaluating parameters that require a Type II variation or a prior approval supplement (PAS) if they are not in compliance.

The manufacturer also may consider whether the objective of the project is to correct errors in existing files or to bring older filings up to more recent standards (i.e., to conform to the common technical document format and content). This process will help minimize due diligence issues and will facilitate resubmission in Europe as required (every five years).

Notify regulatory agencies. As a manufacturer enters into an audit, an inevitable question will arise: Should the company tell the regulatory agency about the program it is about to begin? Some manufacturers have had deficiencies in their filings noted by the regulators. These companies voluntarily initiated regulatory compliance review programs to examine all of their products. Regulators were told about the plan as part of the remedial action agreed upon with the agency.

In other cases, no prior notification was made. Rather, the company noted in a supplement or variation to the common technical document that it submitted such paperwork because registered product information was reviewed against current practice in the manufacturing plant(s). The authors know of no cases for which an appropriately supported supplement was rejected by the agencies. Regulators are well aware of the difficulties that a company faces in managing the complexities of its international filings and will be favorably disposed to projects aimed at identifying errors and correcting the systemic problems leading to them.

Notify licensees. Another consideration in initiating a regulatory compliance assessment program is how to notify licensees of any product deficiencies found. The company may have contractual agreements with other organizations that manufacture and sell the product in their own name using its process technology. Manufacturers must consider how and when to notify such organizations of any deficiencies that are found. The route by which a licensee should be notified and the timing of such notification should be defined in the contract.

Consider legal and ethical issues. As the manufacturer contemplates the need for a regulatory compliance assessment, the following ethical questions may arise:

• If the team finds and confirms a deviation, should it stop the release of a product made with this process?

• If information about the audit becomes too widely known, could it breech confidentiality?

• Once a deviation is identified, how should the company respond and how rapidly?

• If part of the assessment team is based at the site being reviewed, can it provide an unbiased assessment?

• What is the best way to prevent personnel from correcting deviations before the team has confirmed the facts, understood the root causes, and developed an appropriate corrective action plan?

When considering these questions, it may be helpful to take the advice of counsel because the laws and regulatory expectations may differ from country to country. During deliberations, one should keep in mind the following:

• An initial deviation could later be found to be incorrect based on further investigation. Therefore, manufacturers must be cautious about making a decision too rapidly. A corrective action, taken without proper investigation and planning, may be wholly inappropriate in that it may not address the systemic problem. The investigative process can take from several weeks to a few months to complete.

• The exact findings may be kept confidential until investigations are complete.

• A timepoint should be defined after which the company officially "knows" a deviation exists and after which it must respond in a timely fashion. For example, the project team might report to a senior executive committee. When the committee receives a formal report from the team about its findings, it may be deemed that the company knows all the facts at this point.

• All team members should recognize that their responsibility is to the patients, the company, and the team. All team members must conduct their reviews in a nonbiased and independent manner. Any findings that may be controversial should be communicated to management in a timely manner so that appropriate action can be planned.

• Every effort must be made to avoid making scapegoats of those who are perceived to have caused the problem. Blaming others will severely affect the company's ability to conduct an adequate investigation and will make the systems analysis less effective. This topic will be discussed in greater detail later in this article.

• Remember that the advice and assistance of counsel throughout the process is very important to confirm that all appropriate decisions are made.

Methodology

The next step is to lay out a precise methodology for the audit. In doing so, one must consider the following factors.

Probe study. When starting to form the methodology for the process, one does not know the extent of the problems that may be unearthed or whether the methodology will work. It may be helpful to conduct an initial probe study on a single product such as one for which only a modest level of noncompliance is anticipated. Such a study will help the manufacturer determine whether the methodology chosen is sound and will help settle any problems that may arise.

Finding a deviation. Before finding a deviation, the assessment team should address several questions.

• How will you react if you find that you apply different test methods and specifications than those that are registered?

• When is a difference in the processing equipment significant?

• What will you do if a critical quality attribute of a critical process parameter has not been registered?

Advance discussion of these issues will lead to a common understanding among team members and consistency in the way they are handled. A discussion of deviations and suggestions for how to address them will be presented later in this article.

Trivial issues. The team should agree on what problems are trivial and not to worry about minor issues. Sometimes, an investigation may identify small differences between a registered and a practiced analytical method. For example:

• differences in high-performance liquid chromatography (HPLC) mobile-phase flow rate and composition, column temperatures, and so forth;

• a standard solution for a validated assay is registered as 0.024 mg/mL, but in practice, the concentration is 0.0222 mg/mL;

• a sample preparation for a HPLC assay is registered as 0.5 mg/mL, but the actual practice is to use a solution with a concentration of 0.1 mg/mL and the validated range is 0.05–0.15 mg/mL.

Consider Figure 3 when deciding on a remedial action.

Figure 3: An example of how to decide on remedial action.

Another example is when a critical quality attribute (CQA) (i.e., a measurable characteristic of a product that affects its suitability for its intended purpose) or a critical process parameter (CPP) (i.e., a processing parameter that can affect the CQAs) is not registered. This situation does not create a compliance deviation, but it should be noted. If data are available to support whether the characteristic is a CPP or CQA, then these data should be filed at an appropriate time.

Site issues. It is not possible to identify all potential issues that may arise, but it may be helpful to consider a few actual occurrences that happened at three companies (referred to as Companies X, Y, and Z in this article).

Company X had a medically necessary drug for which it was the sole supplier. Because of a corporate merger, the product was supplied from a European site that did not fully conform to the process filed with FDA. The product was on the market when Company X discovered this discrepancy. The company contacted FDA, which agreed to leave the product on the market for a specific time period while a prior approval supplement was filed. Company X then provided FDA with sufficient data to assure the agency that the product was well controlled.

Company Y found itself in a similar situation with an anti-histamine that had no significant advantage over its competitors. FDA required that a prior approval supplement be submitted, but did not require recall because the company could show that the product complied with CGMP regulations and was not a health hazard. Nonetheless, further distribution was stopped until the supplement was approved.

Under the same circumstances (see above), Company Z, however, did not have validation data or analysis of adverse events or bioavailability to show that the change did not adversely affect critical quality attributes. The product was recalled and the company was fined $25,000,000.

Composition issues. Significant deviations that might affect product composition or fillage will be the most worrisome because, in the worst-case scenario, they might invalidate the entire NDA. As the number of global product filings increases, the opportunity for the differences to arise increases. In such cases, companies may need technical support staff to revisit the rationale for the formulation (e.g., what stability and vial hold-up data was used to support each filing, how the data has changed, and what data was used to support any changes to a solid oral dosage form's composition).

Analytical methods. The following questions arise when deviations are found:

• Can one revert to the registered method?

• Is the registered method adequate?

• What are the advantages of alternative methodologies?

Compliance with the patient package inserts and the summary of product characteristics also must be considered because raw material quality may be implied or stated therein.

The preferred decision when making such a finding is to revert to the registered method unless it is flawed (i.e., it is not validatable to current standards or uses equipment that is no longer available).

If the registered method is not flawed but an alternative method is superior (e.g., it is more efficient or has greater specificity), the appropriate analytical experts on the staff should evaluate the method's advantages and file a supplement or variation. The company must decide on a reasonable time frame within which to accomplish this task and it must act expeditiously because noncompliance has been discovered and confirmed.

If reverting to the registered method requires the same parameter to be measured using two different techniques (e.g., sulfated ash by European Pharmacopeia [EP] and US Pharmacopeia [USP] methods), consider showing equivalence and then applying the EP method because the USP approach accepts alternatives.

Test deleted. The preferred solution to the questions raised is to reinstate the test. Nonetheless, a technical review of the information underlying the decision to delete a test should be completed. Questions such as those that follow should be answered before a final decision is rendered:

• Was the test deleted because it yielded failing results?

• Can the material meet the filed specifications?

• Can another test void the need for this test?

• From a compliance perspective, it is not necessary to conduct all pharmacopoeial tests. Is it necessary to conduct this test?

• Is relevant equipment to conduct the test available?

Pending the answers to these questions, a supplement or variation should be submitted.

Labeling. One may find that the labeled storage temperature is higher than the temperature at which stability testing is conducted. In this case, the manufacturer must determine whether data are available to show whether product quality or the expiry period is adversely affected at the labeled storage temperature. The matter should be discussed with the appropriate group within the company to determine whether a field alert* (see endnotes) is warranted. The group also should address the temperature's potential effect on products already on the market and consider the need to change the label and patient insert.

Process control. If the company controls an additional process parameter that is not registered, this is not, by definition, a compliance concern because no deviation against what is filed exists. If the test is known** (see endnotes) to measure a critical process parameter, however, then it should be noted for potential inclusion in the registered file later. If it is not critical or not known to be critical, then no regulatory action is required. Before concluding that a specification or parameter is not critical, one should check records to ensure that existing limits were not established as a result of previous product failures.

If a test has been externally imposed (e.g., by a foreign pharmacopoeia)† (see endnotes) but is not based on your evaluation of the raw material, product, or process needs, it is a secondary quality attribute. In such cases it should remain in the testing regimen but should not be filed.

Rework and add-back. Add-back, the planned addition of material from a previous batch into a subsequent formulation of the same product, has previously been an accepted pharmaceutical rework procedure for oral solid dosage forms. Nonetheless, regulatory expectations have added significant constraints to the use of this procedure and it should be included in the approved regulatory filing. File a prior approval supplement for any unregistered add-back.

Additional process step. One may find that an additional process step has been added to beyond those in the registered process. If the step does not change the meaning or intent of the process and is consistent with it, consult with the regulatory affairs and pharmaceutical technology staff; the addition may only need clarification in a subsequent annual review. If the step is not consistent with the registered information, it requires a prior approval statement or Type II variation in Europe.

Process operating outside registered range. If the new range is validated and data from three lots show no affect on product quality, file a changes-being-effected (CBE) CBE-30 supplement with stability data in the annual report. If the new range is not validated, validate it and file a CBE-30 with stability data in the annual report.

The examples may be helpful in planning for and responding to the findings of a regulatory compliance assessment.

Recognize the need for a tracking system. As your team identifies potential deviations, each variation will require investigation and follow-up. Consider the need for a simple database that can track the status of each deviation. Discuss, in advance of the assessment, how findings can be documented within the company's existing corrective and preventive action programs. For example, if a system exists for documenting corrective actions by issuing corrective action reports, determine whether or not such reports will be issued to address the regulatory compliance assessment deviations.

Recognize that findings may generate conflict. It should be made clear from the beginning of the project that its intent is to identify and rectify any errors that might exist through appropriate filing, if necessary, with the regulatory agency. If a potential deviation is found, one must also be aware that it may take considerable time before an investigation can be completed to ensure the accuracy of its findings. In the interim, the company may wish to consider conducting a confidential self-audit which allows only limited access to the information, until it can confirm the deviations and assess their impact and significance.

Be prepared to handle a large volume of data. In preparing to handle large amounts of data, a manufacturer should consider how it might use the data in the future and what part data might play in managing future operations. Some companies use computer-based management systems while others use paper records. Large quantities of data are better managed with computer programs but the deflection of resources into the creation of such software can be substantial and must be considered carefully.

System analysis

The objective during this stage of the project is to build a system that will provide sustainable compliance in the years ahead and thereby prevent the need for an ongoing compliance project such as those discussed previously. The investigations during this project will give organizations good information about systems that have failed (e.g., systems for managing change and for filing supplements), thus resulting in regulatory compliance deficiencies. These data and the insight of those who manage the systems are valuable tools for recommending and implementing the necessary systemic corrective actions.

The manufacturer will likely find the root cause of many problems during the original filing. For example, excessive detail may have been included in the original common technical document. As the level of detail in the original filing increases, so too does the chance for having deviations in the future. Unfortunately, when a company is ready to file a new product, there is extreme pressure on those responsible for orchestrating the process. Understandably, they are inclined to file a large amount of data to avoid questions from the regulatory authorities that inevitably result in a delayed product launch.

One must remember that:

It is in the interest of both the applicant and the regulatory authorities to avoid unnecessary applications for variations. Very detailed descriptions of the manufacturing process, apparatus and in-process controls should therefore be avoided (1).

The precise level of detail that should be filed, of course, is always open to interpretation by those directly involved. For API processes, one might consider registering a process description that is based on molar quantities and including the detailed batch documentation only as an example. Thus, changes in equipment and batch size will not necessitate a supplement in future years. In the United States, changes in scale do not need to be submitted to the agency. A change to new equipment need not be submitted to the agency, even when equipment is specified in the approved application (2).

Another causative factor that may arise is that as the complexity of the business enlarges and the number of countries involved and employees increase, there is a greater ignorance among staff members about the company's needs for its various management systems. When people lose sight of the purpose behind certain systems (e.g., change control procedures), they fail to apply them correctly and changes are made without asking those who are best qualified to guide them in such changes. This causes the master documentation at company headquarters to be outdated. As a consequence, these documents are filed incorrectly in other markets and the problems perpetuate themselves.

Endnotes

* CFR 314.81(b)(1)(i) requires that FDA be notified within 3 working days of any incident that causes the drug product or its labeling to be mistaken for, or applied to, another article.

** A parameter is known to be a critical quality attribute or a critical process parameter only when supported by appropriate data.

† In the United States, any active ingredient that is listed in the USP is assumed to conform to it and all tests listed therein should be regarded as registered. Such tests should remain in the testing regimen and a company may include it in the next FDA annual report.

Ray O'Donnell, PhD,* is the managing director of Elsinore Pharma Consulting LLC, Annandale, NJ, tel. 908.238.9688, fax 908.238.1345, ray@elsinorepharma.com Before retirement, John Taylor, PhD, worked for the US Food and Drug Administration and in the regulatory affairs departments of several pharmaceutical companies.

*To whom all correspondence should be addressed.

Submitted: Mar. 21, 2005. Accepted: June 14, 2005.

References

1. European Agency for the Evualtion of Medicinal Products (EMEA), Manufacture Of The Finished Dosage Form (CPMP/QWP/486/95), (EMEA, London, UK, 1996).

2. US Food and Drug Administration, Guidance for Industry BACPAC I: Intermediates in Drug Substance Synthesis (FDA, Rockville, MD, 2001).