Responding to FDA CAPA Requests

When FDA oversight detects violations of current good manufacturing practices (CGMPs) at a drug manufacturing facility, the owner is expected to respond with a corrective and preventive actions (CAPA) plan outlining steps to remedy the problem. The timeliness and thoroughness of this response—as well as implementation, documentation, verification, and monitoring to remedy the problem—are crucial to ongoing production and the safety of the drug product.

A key component of an effective quality system, a CAPA plan should identify and investigate product and quality problems and indicate actions needed to correct and/or prevent those problems from reoccurring. Delayed, rushed, or incomplete responses can doom initial remedial actions, leading to a succession of ongoing, unresolved problems, and additional scrutiny from FDA.

Understand the situation

When FDA identifies a CGMP violation and calls for a CAPA, the facility owner should have two primary concerns: responding to the agency and identifying actions to ensure product quality and safety. Aloka Srinivasan, principal and managing partner, Raaha LLC, recommends companies first acknowledge the agency’s request in writing and commit to a timeframe for providing the CAPA plan. Then, says Chris Moreton, partner, FinnBrit Consulting, companies should invest time to fully understand the request and the situation and determine the cause of the deficiency and necessary actions to resolve the problem.

“Make sure the citation is understood, and have a teleconference with [the] regulatory body, if necessary, to fully understand the citation and any expectations of a desired corrective action,” says Heath Coats, principal consultant, Regulatory Consulting Services, Parexel. A robust solution to manufacturing problems instead of a quick fix is important, says Coats. “Depending on the activities required, a long-term plan may need to be created with ongoing updates provided to the regulators.”

To further understand the situation, Steve Lynn, vice-president of Pharmaceuticals, Regulatory Compliance Associates, suggests that companies conduct their own investigation into the cited deficiency and follow the problem management system defined in the company’s quality management system (QMS). “Further I’d suggest that when defining the problem statement that the company think breadth, as well as depth. Don’t just fix what is right in front of you. Think critically about what else may have a problem and how far back you need to dig to adequately bracket off whatever the problem may be. The CAPA/compliance/improvement plan should indicate all the areas that are deemed out of compliance and should address the immediate action the company will take to correct the violation and identify the plans they are developing to prevent the violations from happening in the future,” says Lynn.

An internal investigation should determine which product batches are impacted and if any additional products are also affected, notes Srinivasan. “Depending on the degree of severity of deficiency, take appropriate measures to quarantine/segregate affected batches as needed. If distributed batches are impacted, assess and determine if a field alert is to be filed with [an FDA] District Office. Conduct a health hazard analysis to determine if there is an impact to patient safety and/or effectiveness,” she suggests.

Understanding the impact of all factors on products is essential to determine how the CAPA plan will be developed, says Linda Evans O’Connor, vice-president, chief of staff, Lachman Consultant Services, Inc. “How are you going to assess product that might already have been manufactured, tested, submitted, and/or released, and could this potentially be a systemic issue, and if so, how will you address the issue across products, equipment, systems, facilities, sites, etc.?” says O’Connor. “Even if one or more elements is not applicable, it may be important to state why they are not applicable. What interim controls are you going to put in place if the actions are not immediate?”

Gathering the CAPA team

Quality consultants recommend that the CAPA plan be developed by members of the department directly associated with the CGMP deficiency, as well as quality departments and other related departments, according to O’Connor. One person with overall responsibility for the plan should manage the process and “orchestrate” interrelated CAPAs.

The quality team should always be involved with CAPA plans, agrees Coats. “When CAPAs are created for operational groups within a company, an owner of the CAPA within the operational group should be identified. Any support groups that will play a role in execution of the plan should be involved at least from a resource planning standpoint. Regulatory affairs personnel may need to be involved if, for example, updates on a long-term CAPA need to be submitted to regulatory bodies.”

The nature of the CAPA may determine the personnel involved, says Srinivasan, with quality, manufacturing, regulatory, engineering/maintenance, validation, technical services, and project management teams typically participating. “However, a company should be flexible regarding who should be part of the CAPA planning depending on the nature of the preventive action anticipated,” she says.

Some experts suggest a wider scope of participation is important. “A good CAPA/compliance plan needs to be developed by the employees involved in the process and systems that are under scrutiny so they understand the issues and the appropriate changes can be implemented. The more employees understand the compliance concerns, the more effective the plan will be when it is being implemented,” says Susan J. Schniepp, Distinguished Fellow at Regulatory Compliance Associates.

Developing the CAPA plan

Once the deviation has been internally investigated and a team assembled, the CAPA plan can be developed. The development of the plan should not be rushed, and the CAPA should be broad and fully address the problem, says O’Connor.

A key decision is if more than one CAPA is needed to address the problem. One overarching CAPA plan with multiple CAPA subsections; or each problem may have its own CAPA, which are then tied together under one compliance plan, says Seyed Khorashahi, executive vice president, Regulatory Compliance Associates. “Either way the important issue is that the changes are linked together and monitored so the company has a full understanding of the overall compliance of their processes/systems,” he says.

“In my experience I’ve seen firms handle this both as one CAPA—one action or multiple actions captured on one CAPA. When using a system involving multiple actions per single CAPA, will all actions need to be completed before the CAPA can be closed? How will the multiple actions be managed and linked to the CAPA? These are topics to be considered as a company develops its CAPA policy,” says Coats.

Moreton advises that different manufacturing processes may require different approaches to developing the CAPA. “Retraining of the operators will be a common theme, but all processes are different, and there will be difference between API manufacture and product manufacture, and between sterile products and non-sterile products,” he says.Certain areas of consideration may be impacted by different processes, says Srinivasan, and some processes such as sterilization may need a closer look to see if requalification is required or there is potential impact on other product batches or manufacturing processes.

While different manufacturing processes may require different changes, the basic CAPA elements should be consistent throughout systems and process, says Lynn. “For example, if your CAPA changes a standardized process for one manufacturing process, you need to ensure it doesn’t cause issues with other manufacturing processes. There are many perspectives on what constitutes a good CAPA system, but the reality is the quality and thoroughness of the investigations ultimately drive the effectiveness of the CAPA. Thinking through the issue from beginning to end and detailing what other processes may be affected, then documenting your rationale for changing or not changing something will help you make the right decisions,” Lynn says.

Schniepp recommends a three-phased approach to developing a CAPA. “Phase one would be evaluating/remediating and implementing changes to fix the issue. Phase two should define how the changes implemented will be monitored and improved, and phase three should define what the mature state of the system will offer in the way of continuous process improvements,” she says.

A CAPA plan should include the following elements, according to Coats:

• A statement of the problem to be addressed
• A development plan of actions to be taken, such as risk assessments
• A list of resources and operational groups involved in performing corrective actions
• A timeline for the corrective actions
• A list of documentation that will be developed during corrective actions
• Criteria for measuring the CAPA’s effectiveness
• A list of preventive activities to ensure the event does not reoccur.

Khorashahi adds that tools that will be used to investigate root cause of the problem should be defined, and critical thinking should be used to develop potential changes to processes. “The company should include the measurements or metrics they will use to continually monitor the processes and systems to make sure they are maintained in a state of compliance. A really well-written CAPA plan will also include some discussion on continuous process improvements as the processes and systems mature,” says Khorashahi.

Implementing the CAPA plan

Correcting CGMP deficiencies in a timely manner is important, but the time it takes to implement a CAPA depends on a variety of variables including the type of CAPA and the deficiency itself. Writing and revising standard operating procedures and retraining staff are also factors, says Moreton.

The complexity of the problem also plays a role, according to Lynn. Corrective actions, such as adding an additional signature line to an existing verification document, may take little time to carry out. “Other changes are more complex and may take additional time to implement. Keep in mind that a seemingly simple change in an SOP [standard operating procedure] with a long CAPA date also raises a flag and could yield questions on why it’s taking so long to do a simple task. If the task isn’t as simple as it appears, it is highly suggested that the rationale for the timing be recorded in the CAPA,” says Lynn.

If the CAPA requires new equipment or facilities, implementation will take longer than just updating a procedure, says O’Connor. “This is where interim controls come into to play. It is not uncommon for very large CAPAs to take a year or more, but if the company is continuing to produce for the US market, then there needs to be other controls in place,” she says.

While the time to complete a CAPA is dependent on the depth and extensiveness of corrective actions and can vary significantly from a few days to several months, companies should avoid setting unrealistic timelines for the CAPA that cannot be met or close a CAPA to meet a due date, says Srinivasan. And commitments should not be provided to FDA that are not vetted or are not feasible for commercial production, she recommends. Time frames that are too short and are impossible to meet—as well as those that take too long—are not acceptable to regulatory authorities, note multiple experts; missing a CAPA commitment date is a sign that the remediation is not going well.

Time is not the only concern when it comes to CAPAs. The effectiveness of a CAPA plan should be verified and monitored with effectiveness checks, which assure the issue has been addressed.“Let’s say a change is implemented to fix an observation that there were too many repeat deviations generated from one specific process step. Once the intended change to fix the process is implemented, the deviation system should be monitored to see if the repeat deviation has been remediated,” says Khorashahi. “This monitoring should be done over a period of time. In essence, the company is performing real-time effectiveness checks and continuously monitoring the process. This is a desired state for maintaining compliance.”

“It is often useful as well to have an independent party assess the CAPAs and the effectiveness at a point in time after the CAPAs have been implemented,” says O’Connor.

Companies should thoroughly follow through with a CAPA, says Srinivasan, and a solution should be confirmed through verification and close-out of the CAPA. Opening another CAPA to continue an uncompleted CAPA should also be avoided, says Coats.

Changes to the plan

If new information about the deviation or process is discovered after a CAPA is developed and sent to FDA, the plan should be revised. “Any CAPA plan that is carved in stone will only result in the company continuing to get observations of non-compliance,” says Lynn.

“CAPAs can be flexible, but it is crucially important to update the agency as soon as you have made a decision to change the CAPA, with an explanation for why it changed. The explanation should be reasonable and scientifically based, and the new CAPA needs to at least address the original observation,” says O’Connor.

“[CAPA] plans should be living documents and change as needed depending on new information discovered during the CAPA process. If the company had committed to ongoing updates to the regulatory agency as part of the original response, then the changes should certainly be communicated,” says Coats. “The bigger issue is to ensure the company’s quality system has a mechanism to introduce, review, and approve the change to a CAPA plan. Therapeutic efficacy and patient safety should always dictate whether a change to a CAPA plan would be required,” says Coats.

A company’s quality system should include processes—management review, internal audits, periodic procedural reviews, annual product reviews, and environmental monitoring—to review and adjust the CAPA on an ongoing basis.

Assuring compliance

Effective CAPA plans assure regulators that the company has corrected deviations and prevented future occurrences, and the agency expects a timely response to citations such as Form 483 reports.

“If an extensive corrective action is planned, the firm should acknowledge the CAPA requirement in the initial Form 483 response, indicate the CAPA is under development, and provide a commitment to submit the proposed CAPA in a follow-up response within a reasonable time (i.e., no more than two weeks later),” says Srinivasan. “Any initial CAPA submitted should include milestones (timeline) for providing progress reports to the Agency, the timing of which depends on the actions needed.”

As the CAPA implementation process progresses, routine updates should be provided to FDA, according to Schniepp, including completed commitments, those still in progress, and changes that may be needed to the original plan. “Providing data that demonstrates that the completed commitments remediated the problem should be provided as direct evidence the process/system was effectively remediated,” says Schniepp.

“The verification portion of a CAPA provides the assurance the CAPA is working, and the periodic milestone reports submitted to the agency provides the reporting required. There is a possibility that FDA will revisit to assure the CAPAs are being followed,” says Srinivasan. “The amount of vigilance on part of FDA depends on the severity of the deficiencies noted. The agency may make a special return visit to verify implementation of specific CAPAs. In most cases, FDA will wait until the next GMP inspection to review the CAPA progress.But be assured the agency investigators will have the CAPAs in hand to double check the information a company provided during their visit.”

About the author

Susan Haigney is managing editor of Pharmaceutical Technology.

Article Details

Pharmaceutical Technology
Vol. 45, No. 5
May 2021
Pages: 52-57

Citation

When referring to this article, please cite it as S. Haigney, “Responding to FDA CAPA Requests,” Pharmaceutical Technology 45 (5) 2021.