Standardized Excipient GMP

The forthcoming American National Standard for GMP for pharmaceutical excipients, NSF 363, utilizes quality risk-management principles to ensure that the implementation of this standard provides appropriate controls in manufacturing to produce excipients that are safe, of appropriate quality, and of consistent composition (1). (See "The American National Standard for Excipient GMP" in this issue for background details). The need to apply risk-management principles to excipient manufacture and use was born out of the challenge of defining a clear and auditable standard that can be applied across the vast diversity of excipient manufacturing processes, their raw-material sources, their chemical and physical properties, and their many end users in different types of drug products. Attempts to define requirements in such areas as personnel hygiene, infrastructure, or work environment, inevitably lead to clauses that may be appropriate for one excipient but not for others (e.g., indoor operations versus outdoor multiacre facilities, multiuse facilities versus dedicated production lines).

(THOMAS NORTHCUT/GETTY IMAGES)

The Joint International Pharmaceutical Excipient Council and Pharmaceutical Quality Group (IPEC–PQG) GMP Guide for Pharmaceutical Excipients was used to develop NSF 363 (2). The standard addresses the aforementioned industry differences by discussing various points for consideration during excipient manufacture as well as calling for a risk assessment. The American National Standard Institute (ANSI) is expected to review and approve NSF 363 this year. This article provides guidance for industry on how to comply with NSF 363 upon its pending approval, with a focus on risk assessment as part of excipient GMP.

Table I: NSF 363 sections requiring a risk assessment (Ref 1).

The need for risk assessment

NSF 363 requires risk assessments to support decisions and implement controls (see Tables I–IV). For example, Section 4.2.1 on Documentation requires incorporating quality risk-management principles into changes to the quality-management system (1). The International Conference on Harmonization (ICH) Q9 Quality Risk Management guideline, a reference document for NSF 363, gives two primary principles: "The evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient" and "the level of effort, formality, and documentation of the quality risk management process should be commensurate with the level of risk" (3).

Table II: NSF 363 sections requiring justification (Ref. 1).

These principles can help to frame a company's thought process when conducting and documenting risk assessment by focusing the activity on the overall goal of protecting the patient. The principles direct the industry to use science when determining the significance "of the probability of occurrence of harm and the severity of that harm" (1). It is also pointed out that not all risks are equal, and therefore, each documented risk assessment may or may not provide the same level of detail or supporting data.

Table III: NSF 363 sections requiring decisions based on risk assessment (Ref. 1).

NSF 363 adopts the same definition for risk assessment as found in ICH Q9, namely: "a systematic process of organizing information to support a risk decision to be made within a risk management process. It consists of the identification of hazards and the analysis and evaluation of risks associated with exposure to those hazards" (3). In Q9, a hazard is a potential source of harm and harm is "damage to health, including the damage that can occur from loss of product quality or availability" (3). This definition highlights the difference between risk assessment for excipients and hazard analysis for food ingredients. In Hazard Analysis and Critical Control Points (HACCP) plans used throughout the food industry, the focus lies on preventing microbiological, chemical, or physical contamination that is reasonably likely to cause illness or injury. No consideration is given to consistency of composition or functionality of the ingredient. Excipient manufacturers must assess the impact of a change to excipient composition on its functionality and performance in the drug product, but only the user of the excipient can adequately make this assessment. The excipient manufacturer understands the range of variability, in chemical composition and physical properties, of its product and may communicate this to the user during qualification. The excipient manufacturer is expected to use risk assessment to prevent deviations in the stated range of variability. For this reason, the excipient manufacturer's documentation of its product's composition and variability provides crucial information for conducting an adequate risk assessment. This information is also a requirement of NSF 363 Section 8.2.4.6 on Excipient Composition (1).

Table IV: NSF 363 sections requiring risk controls as a result of risk assessment (Ref. 1).

Documenting a risk assessment

Risk assessment consists of risk identification, risk analysis, and risk evaluation with the output forming the basis for determining appropriate risk control. The sections of NSF 363 requiring risk assessment preload the process by defining the scope or risk question, providing the nature of hazards to be considered, and pointing to risk controls that should be implemented. The documentation necessary to demonstrate conformance to the standard should facilitate assessment of the results in terms of the risks to be controlled, the reasoning and facts leading to the conclusions, understanding the risks that were considered, and provides evidence that competent people equipped with adequate information followed a process that ensured a complete assessment. The actual process for conducting a risk assessment may vary depending on the scope of the exercise but the documentation, except where risk are either obvious or cannot possibly exist, should include (4):

• Objective and scope of assessment

• Team members and their supporting qualifications (e.g., technical expertise and/or training in conducting risk assessment)

• Description, diagram, or flow chart of what was included

• Supporting references and information relating to the assessment, including policies and procedures

• Assessment methodology

• Risk identification results

• Data, assumptions, and their sources and validation

• Risk analysis results and evaluation

• Risk criteria applied and justification

• Limitations, assumptions, and justification of hypotheses

• Critical assumptions and other factors which need to be monitored

• Discussion of results

• Conclusions and recommendations or reference to resulting controls.

As with all records, this documentation should be maintained and be available for audit as well as for use in periodic review of the assessment to ensure its continuing validity and suitability in the presence of new information. Including a summary and reference to the risk assessment reports in the quality manual helps describe the quality management system and aids in understanding the basis for controls included as part of the GMPs. To prevent the loss of a company's knowledge base, training and familiarization with the content of the risk-assessment documents should be included as part of succession planning, personnel development or job descriptions for key positions where appropriate.

Conducting a risk assessment

Conducting and documenting a risk assessment of the manufacturing process as directed in the NSF 363 Section 6 6.2.3 on Hygienic Practices, 6.3.1 on Buildings and Facilities, 6.3.3 on Utilities, and 6.4 on Work Environment can be combined into a common exercise and risk-assessment report. The report may begin with a summary of the risk-assessment results and supporting arguments. The common supporting documentation would be included in the body or an appendix. Supporting documentation includes items such as a description of the product with background information such as:

• Support for excipient stability

• Susceptibility for growth of microorganism and other characteristics

• Product's intended use

• Description of the process and a flow diagram showing all unit operations, inputs, and recycle streams

• List of team members participating in the risk assessment with a description of their qualifications to perform such a task.

A clear statement supporting the excipients unique chemical and physical characteristics and any unique processing conditions or equipment will help justify the exclusion or inclusion of potential hazards. For example, a low pH can be used to justify the absence for specific controls to prevent microbiological contamination.

Documentation should demonstrate that the risk assessments required in NSF 363 Section 6 were performed for all unit operations. A matrix table can be included documenting the process flow, unit operations, and production and storage areas in rows with columns listing potential hazards and the justification for suitable controls (or controls being unnecessary) to protect against such risks as: contamination from personnel and/or their activities; contamination or mix-ups due to deficiencies in buildings or facilities; deterioration of excipient quality from contact with utilities; and contamination from exposure to the work environment. Reference to the supporting documentation (including a statement of how the process flow was verified for accuracy and inclusion of all operations) should accompany the table.

The risk-assessment process for determining significant change as a part of change control is discussed in the IPEC–Americas Significant Change Guide (5). A key point from this guide is that, "Any change by the manufacturer of an excipient that [may] alter an excipient physical or chemical property outside the limits of normal variability, or that is likely to alter the excipient performance in the dosage form is considered significant." The level of significance depends on the type of change and is evaluated according to seven criteria:

1. Will there be a change in the chemical properties of the excipient as a result of the change?

2. Will there be a change in the physical properties of the excipient as a result of the change?

3. Will there be a change in the impurity (composition) profile for the excipient as a result of the change?

4. Will there be a change in the functionality of the excipient as a result of the change?

5. Where applicable, will the moisture level changed?

6. Where applicable, will the bioburden changed?

7. Will there be a change in the origin of any raw materials or contact packaging?

These criteria can be used in a change-control program and should be referenced in the documentation to comply with NSF 363 Section 4.3 on Change Control.

The requirements to perform documented risk assessments in support of GMP controls are not entirely new. Section 8.3.2 of the IPEC–PQG GMP guide states (2): "An activity that is not a normal part of the manufacturing process (reworking) should only be conducted following a documented review of risk to excipient quality and approval by the quality unit. As appropriate, when performing the risk assessment, consideration should be given to....."

The procedures and controls associated with the IPEC–PQG GMPs have always been the output of risk- assessment exercises. NSF 363 takes this concept further to justify the thought process used to support and document controls are. Such documentation facilitates better understanding of GMP controls across excipient manufacture.

Dale Carter is chair of the International Pharmaceutical Excipient Council of the Americas (IPEC–Americas).

References

1. NSF Joint Committee, Draft Good Manufacturing Practices (GMP) for Pharmaceutical Excipients (2012).

2. IPEC–PQG, Joint IPEC–QG Good Manufacturing Practices Guide for Pharmaceutical Excipients (2006).

3. ICH, Q9 Quality Risk Management (2006).

4. IEC/ISO 31010, Section 5.5, Risk Management–Risk Assessment Techniques, 1.0 (2009-2011).

5. IPEC–Americas, Significant Change Guide for Bulk Pharmaceutical Excipients (2009).