Risk-Based Thinking in Process Validation

Validation has been practiced within the global healthcare industry since the early 1970s. While its exact origins are a matter of contention, during its evolution and unquestioned expansion into other areas, one element has remained unchanged during the past 40 years: an expectation of three performance-qualification runs. This practice was not always universal; before the US Food and Drug Administration issued its Guideline on General Principles of Process Validation in 1987, practice was somewhat more diverse (1). Interesting developments that emerged during the drafting and review of the original document have contemporary relevance to the 2008 draft revision of that guidance (2).

When the initial draft of the guideline appeared in the mid-1980s, it included an expectation for three performance-qualification runs as evidence of process control. When this document was issued for public comment, the organization that later became the Pharmaceutical Research and Manufacturers of America coordinated the development of a consolidated industry response. Some firms requested that the three-test requirement be reduced to two based on the premise that one replicate was sufficient to demonstrate process reproducibility. In an effort to accommodate all concerned, the responsible industry committee members developed a draft recommendation that the three-lot requirement be replaced with "a statistically significant number of batches." An almost immediate uproar came from companies that were performing three or more lots in their validation efforts. Although three trials were more than two, they certainly were not "statistically significant." When the organization realized this point, its members rapidly achieved a consensus on the three-trial expectation, and the comments that the group submitted on FDA's draft never mentioned the number of trials. Members acknowledged during those discussions that while "a statistically significant number of batches" would be more appropriate scientifically, the implications of such an approach were daunting.

This situation has now repeated itself, with the roles reversed. In its 2008 draft, FDA held that the "rule of three" is no longer appropriate and implied that more batches must be evaluated to provide the statistical confidence that is a central focus of the entire document. The difficulties inherent in expectations of statistical confidence in the 1980s are unchanged today. At a basic level, when the sample population is large, a sample size of 30 units generally is considered statistically appropriate. This output volume is actually quite substantial. During the author's 20 years of working in three large pharmaceutical firms, he encountered only six products (two parenterals, two active pharmaceutical ingredients, and two oral solid dosage forms) where more than 30 lots had to be produced in a single year. It should be immediately apparent that the initial validation of even relatively large-volume products cannot be accomplished using "a statistically significant number of batches." The time required to make the number of batches would be significant, and, in most instances, the material costs would be staggering. Validation efforts that extend for more than a few weeks are impractical from a logistical perspective, given the cost of drug-product manufacturing and the amount of inventory that must be held pending the completion of the exercise.

At the other end of the spectrum are low-volume products. These products are far more common than one might believe—not every product is a commercial blockbuster. The limited production volumes of these products may entail the manufacture of a single lot every 18 months or so. Validating low-volume products in a statistically meaningful fashion thus would require a 45-year period. Considering that future care might entail customized medications intended for a single patient, the total production of those products might consist of only a single lot. Clearly, using statistics to determine an appropriate number of commercial-scale lots to satisfy validation requirements is impractical.

A risk-based proposal

What is to be done with respect to the extent of the initial validation under FDA's new guidance? FDA's Risk-Based Compliance initiative of 2004 incorporates some general precepts about how firms should use risk in defining and controlling their operations (3). Risk-based thinking has perhaps the greatest potential influence on validation. Performance-qualification protocols, especially as they relate to sampling size, sample location, and acceptance criteria, incorporate risk decisions throughout. The number of lots required for validation should be established through a risk-based approach to determining the number of trials required. Table I includes an example of a risk-based methodology applied to production processes for the completion of FDA's Stage II validation evaluation.

Although three or more batches are preferred for initial release, the distribution of products is permitted for any product after the successful production of a single batch. For processes that are new to the producer or heavily modified, extensive design of experiments (DOE) support is required in preparation for concurrent release.

The numbers listed in Table I are based on the following assumptions:

• These numbers are minimum requirements that could be increased when production demands and inventory charges permit.

• Relevant analytical methods are validated for all raw materials, solvents, excipients, in-process tests, and finished goods before process validation.

• Critical parameters for each process are predefined and controllable at scale-up.

• Phase I DOE experiments have been completed successfully for all critical parameters.

• Specifications and key characteristics are established and in compliance for all materials.

• All equipment is in a state of current qualification.

• Interim reports should be prepared for all materials released concurrently during the overall validation exercise.

• A single batch can be concurrently released with adequate prior development.

• In-process and finished-goods specifications are established based on documented experience rather than preconceived or arbitrary expectations.

The choices of specific numbers in Table I are arbitrary and based on the author's nearly 40 years of pharmaceutical-industry experience, which embraced all of these processes. In selecting the number of studies to perform in each instance, the author drew upon diverse sources for basic direction.

First, the process (i.e., process validation) and product are inseparably linked (4, 5). The process consists of the equipment chosen, the sequence of activities, the choice of materials, and the operating parameters. These items can be chosen independently to obtain the desired result. The result of the process is a product with unique characteristics (e.g., potency, uniformity, impurities, and moisture content). The product attributes depend on the process parameters used to make the product. The products' characteristics are the result of the process. If the process is altered in a meaningful way, the product key attributes also will be changed. Thus, the better defined the process, the more reproducible the result.

When a firm uses a process repeatedly, a substantial amount of useful data can be gathered for use when that same process is applied to different materials to produce a different product. For example, experience with tablet coating can be used for multiple products because the operating principles will remain constant, though the exact process parameters will differ. The amount of experience that a firm has with a particular process should be a factor in determining the number of Stage II validation batches necessary to demonstrate their capabilities.

Second, as is evident throughout the draft revision of the process-validation guideline, FDA expects manufacturers to acquire knowledge regarding the interaction between the independent process variables and the dependent product-quality attributes. The expectations for quality by design (QbD) are for the acquisition of knowledge regarding these relationships. The goal of the knowledge building is a minimization of risk in the commercial production that follows the developmental effort. Although this goal was stated explicitly in the guidance, an even clearer picture was provided in FDA's first presentations about process analytical technologies, and later in presentations about the QbD initiative (see Figure 1) (6).

Figure 1: Process understanding and risk. (FIGURE IS COURTESY OF THE AUTHOR)

Third, the draft guidance appropriately emphasizes the importance of sound development during Phase I as the basis for a validated commercial process. Although QbD has become increasingly common, it would be safe to say that the majority of current products and processes have not been developed in a rigorous manner. When Stage I is performed as described, the scale-up and commercial demonstration exercise that follows in Stage II of the guidance entails an expectation that the exercise is more likely to be successful because of the increased process understanding and product knowledge the firm has gleaned from its developmental efforts. Under those circumstances, an extended Stage II demonstration with numerous lots might be of less benefit than it would when the development effort was weaker. Under the draft guidance, fewer Stage II batches are required because the process is more fully defined.

Fourth, the draft guidance has adopted a life-cycle approach to process validation in which the exercise is no longer considered an isolated activity, but one that is fully integrated into the development and commercial life of the product. This shift in thinking mandates a changed perspective on how validation is implemented and used in an environment in compliance with current good manufacturing practice (CGMP). The requirement for an annual review of product performance is a 21 CFR 211 expectation (7). In the author's experience, that activity was rarely linked to process validation in any meaningful way. Annual reports were largely isolated from the individual release decisions for a particular lot.

One means to address FDA's draft Stage III recommendations for continued process verification is to implement near real-time evaluation of results for commercial materials. With the increasingly available electronic tools of laboratory information-management systems, system control and data acquisition, among others, the results of testing for any lot can be rapidly compared with prior results for evidence of a shift in performance. This capability and expectation can substantially reduce the importance of the Stage II data. Although Stage II is important as part of the initial scale-up, it merely suggests future performance rather than predicting it. Release decisions in Stage III are made according to an even larger body of evidence, of which the Stage II results are only one part.

Fifth, when the 1987 process-validation guidance was issued there was an implied understanding that analytical methods should be validated. Methods and principles for that validation were not widely accepted, however, and the analysis was often labor-intensive. The ability to analyze samples in large numbers often was limited by the number of analysts available.* Process automation first appeared on the manufacturing floor, and is now found throughout the facility, including nearly all laboratories. Present-day laboratories are increasingly automated, which allows for the accommodation of larger sample sizes, higher throughput, and more timely and reliable results. Processes and products can be more effectively and expeditiously evaluated than ever before, and confidence in the results is substantially higher. As a consequence, Stage II lots can be characterized better than ever before, and added lots to build knowledge of process capability are not needed as much.

*The author has encountered numerous instances where the number of validation exercises that could be performed was limited by the laboratories' ability to analyze the validation samples in a timely manner. This was complicated by the sample numbers taken for purposes of validation that were many times the number used for routine release. These situations are far less common with today's automated analytical laboratories.

Last, and perhaps most importantly, Stage III of the validation life cycle lasts longer than any other, and the number of batches needed to make the transition from Stage 2 to Stage 3 is really not a significant factor. Maintaining a process in a validated state over its commercial life requires several supportive controls defined under CGMP regulations. The essential elements to support a product or process over its life cycle are change control (i.e., materials, procedures, test methods, and equipment), calibration, preventive maintenance, and personnel training. These mechanisms support the acceptability of the product or process for the longest period, and the number of successful Stage II batches completed is largely irrelevant.

Recommendations for Stage II

Considering the points that this article has examined, it would be inappropriate for the author not to take a definitive stance on the number of batches that should be required. The author believes that although cogent arguments for more batches exist in some instances for complex processes, perhaps equally good reasons indicate that increasing the expected number of batches across the board would create an unnecessary (and perhaps superfluous) burden in other instances. The author believes that essentially no change in historical practices is warranted. Three batches have served industry, FDA, and the patient well for more than 20 years. The suggested approach in Table I provides a risk-based approach that gives adequate consideration to the technical, commercial, and regulatory risks. The new guidance addresses that approach by requiring that firms develop a fuller understanding of their product and process and be thus able to support its adequacy without resorting to large numbers of Stage II studies.

Table I: Phase II validation batch expectations.

Validation as the scorekeeper

Personnel often blame the validation exercise when a process fails to meet its specified requirements. That blame is completely misplaced. Inadequacies in process-validation exercises are not associated with an inadequate number of batches as much as they are associated with inadequate science behind the process. Validation by itself is nothing more than an independent assessment of the inherent capability of the process. Just as one cannot test quality into a product, one cannot validate it in, either. FDA's draft guidance outlines a means for product quality and process reliability through reliance on sound science during process development. To the extent that Stage I is properly executed, process robustness is largely assured. The development activity seeks to gain knowledge about the product that will ensure its success in the clinic, and about the process that will ensure its suitability for that purpose. The later stages of the guidance outline means to transfer that knowledge initially into a commercial manufacturing environment and then support it throughout its time in the market. When firms fail to gain adequate knowledge initially and maintain it over time, they are likely to encounter quality difficulties. The validation approach outlined in the guidance is intended to remedy that problem by mandating increased process understanding. Applying rigorous validation acceptance criteria or defining success criteria without adequate knowledge of the process or product capability misses the point entirely.

The premise of this article (and FDA's draft) is that as the firm gains process knowledge and applies it appropriately, the level of risk is reduced. Although QbD activities could be construed to be required to determine the independent parameter–dependent attribute relationship, the QbD exercise does not start with elemental science. Individuals will draw upon their educational backgrounds, and firms will rely on their prior efforts as the foundation upon which the new process and product is built. When that knowledge is extensive, the amount of new work required in the QbD exercise, and later in the commercial demonstration, should be reduced. Similarly, when the core process is simple, such as in the preparation of a solution, the amount of QbD or commercial-scale redemonstration of it should also be executed with less effort. The more knowledge a firm possesses, regardless how it has been acquired, should reduce the amount of new effort necessary in QbD or commercial-scale manufacturing. A well understood underlying process can serve to reduce the QbD and commercial-scale activities. Greater knowledge should lead to reduced risk.

The intent of this effort is to foster a dialog between industry and regulators that results in a shared understanding of regulatory expectations. The adoption of any specific value is not the intent of this proposal: the goal is to initiate communication that results in common ground on this subject, basing it on a risk-based model.

Additional risk considerations

Validation of processes extends well beyond the direct production processes used for drug substances and drug products. The application of risk-based thinking in those activities makes sense for much the same reasons as it does for production processes. Extending the performance qualification for these processes beyond what already appears to be fully validated processes, however, has little apparent merit. For example, increasing sterilization validation, which is clearly an essential and critical process, beyond the current three-study expectation would not provide much benefit. The absence of validation-related problems with respect to sterilization across the industry suggests that added studies are not required. This result is in large part due to the robustness of the science applied to sterilization and the certainty of the operational controls. Considering the spectrum of nonproduction processes that require validation, those with greater risk are those with substantial quality implications where the underlying science is limited or process controls are less effective. At the other end of the spectrum are processes with minimal impact or with well defined and robust process controls. Thus, nonproduction validated processes might fall into three major risk categories (see Table 2).*

Table II: Risk categories for nonproduction processes.

*The categories of risk are associated with both patient safety considerations and process robustness (e,g., sterilization processes are high risk to the patient, but predominantly easily and reliably validated).

The number of validation studies, the validation approach (i.e., concurrent or prospective), and, perhaps most importantly, the number of supportive background controls should all be dictated by the level of risk associated with the particular process. The author's suggestions are intended to provoke interaction rather than serve as definitive positions on the subjects.

One further concern relative to nonproduction processes bears repeating. FDA's draft guidance made no distinction between the direct and indirect processes within our industry. Although process validation may have derived from sterilization issues in the 1970s, the thrust of the 2008 draft guidance is heavily skewed towards direct production processes, and the document scarcely mentions the supportive processes, however important they might be. FDA should take a definite stance on the inclusion or exclusion of these supportive processes and system with respect to their final guidance (8). These processes would benefit from the same type of risk analysis outlined in Table I. The diversity of processes, however, would make consensus examples impractical, given the uniqueness of the individual processes.

Conclusion

Validation is an essential and extremely useful activity within our industry (9). Its benefits may have been understood poorly, and thus understated for years. Nevertheless, interpreting or applying the guidance too restrictively can certainly result in a new wave of complaints regarding its proper role in pharmaceutical operations. One could easily assert that properly performed validation with good attention to scientific and engineering detail has always embodied the concepts of risk assessment and QbD since its inception. The FDA draft suggests that the "rule of three" will no longer suffice for future validation demonstrations at commercial scale, but the number of studies required should not be excessive.

Statistics certainly will play a large role in future validation studies. They should not define the number of studies required, however, lest they cause interminable delays and excessive cost. Validation, as redefined in the guidance, offers a means towards optimization and process economy, thus justifying the greater developmental effort required to achieve the desired state. Imposing excessive validation requirements on industry to attain that state on a commercial scale may not always serve a useful purpose. Given the renewed emphasis FDA is placing on process validation, it is essential that programs designed to meet it be fully compliant, and yet realistic with respect to the extent of the effort required. The adoption of a risk-based approach, as described in this article, affords perhaps a unique opportunity to accomplish both objectives at the same time.

Acknowledgments

This paper was profoundly influenced by Phil DeSantis, Sr., director of engineering compliance at Merck Global Engineering Services; James Akers, president of Akers, Kennedy, and Associates; and Russell Madsen, president of the Williamsburg Group, each of whom played a substantial role in refining the author's opinions and developing this article.

James Agalloco is the president of Agalloco and Associates, PO Box 899, Belle Mead, NJ 08502, tel. 908.874.7558, jagalloco@aol.com. He also is a member of Pharmaceutical Technology's editorial advisory board.

References

1. FDA, Guideline on General Principles of Process Validation (Rockville, MD, May 1987).

2. FDA, Draft Guideline on General Principles of Process Validation (Rockville, MD, Nov. 2008).

3. FDA, Risk Based Compliance (Rockville, MD, Sept. 2004).

4. J. Agalloco, PDA J. Pharm. Sci. Technol. 49 (4), 175–179 (1995).

5. J. Agalloco, Pharm. Technol. 32 (7), 70–78 (2008).

6. A. Hussain, DIA Annual Meeting (Washington, DC, 2004).

7. Code of Federal Regulations, Title 21, Food and Drugs (Government Printing Office, Washington, DC), part 211.180 (e)

8. J. Agalloco, Pharm. Technol. 33 (5) supp., s22–s27 (2009).

9. J. Agalloco, J. Parenter. Sci. Technol. 40 (6), 251–252 (1986).