A. The short answer is yes, you have a compliance risk. You probably also have a data integrity issue and a quality culture issue to accompany your compliance risk. There is no time element associated with conducting an internal investigation. Thirty days is an arbitrary number pharmaceutical companies impose on themselves. There are very specific deadlines associated with an FDA investigation you need to pay close attention to.
The US Code of Federal Regulations states
“… if errors have occurred, that they have been fully investigated” (1), and “Any unexplained discrepancy … shall be thoroughly investigated, whether or not the batch has already been distributed”
Europe’s EudraLex also addresses investigations by stating,
“An appropriate level of root cause analysis should be applied during the investigation of deviations …”.
None of these citations indicate a time for completion of an investigation. What they do imply is that investigations need to be thorough and determine root cause. In some cases, the investigation and root cause can be easily determined in the defined SOP time frame of 30 days.
In other cases, the investigation may be more complicated and could exceed the time frame requirement of 30 days. To address this potential discrepancy, your SOP should allow for FDA investigation extensions if possible. The length of the extension request should be made based on the complexity of the investigation.
FDA Pharma Regulations
When an investigation is rushed, the organization leaves itself vulnerable. Suppose, for example, you have a second shift manufacturing operator who continually forgets to sign a step in the batch record for a specific product. This operator is the only one who seems to have this issue. Your initial investigation into the first occurrence of the issue determines a root cause of human error.
Because the operator works on the second shift, it is inconvenient to interview him directly, so you rely on the word of his supervisor that this was just a case of human error. You decide to retrain the operator on the proper use of filling out the form and skip the operator interview in order to complete the investigation and perform the retraining in the allotted 30-day time frame.
A few weeks later, the same operator makes the same mistake. You review the previous investigation, arrive at the same conclusion, and perform the retraining of the operator emphasizing the importance of correctly filling out the batch record. This scenario repeats itself 10 times over the course of four months. You finally decide to question the ability of the operator to do the job correctly and bring your concerns to management that this behavior could lead to an FDA observation.
Your boss asks if anyone has interviewed the operator directly to find out why he is having this issue with the batch record. You say no, that you have relied on the opinion of the supervisor. The boss recommends you interview the operator before demoting him.
When you talk to the operator, he informs you that in order to sign the batch record when it needs to be signed, he needs to exit the aseptic core, degown, sign the batch record, and regown, leaving the product unattended during that time.
The operator tells you he chose to stay with the product and sign the batch record later but sometimes forgot after the manufacturing run. In this simple exchange with the operator you realize that the root cause of the repeat deviation is not a result of human error but a result of poor process flow. These are the kind of mistakes an FDA investigator will definitely find during an FDA audit of a pharmaceutical manufacturer.
The question you need to address now is how were other operators handling the situation? Only by understanding how widespread the issue is can you conduct an accurate gap assessment. By not taking the time to perform the initial investigation thoroughly, you have created a data integrity nightmare because you now need to review all the batch records completed by the other operators to determine if the product is still acceptable.
Admittedly, this is a simplistic example, but it certainly exemplifies the importance of opting to perform a complete and thorough investigation over meeting an artificially imposed time frame. Explaining to an inspector during an audit that you didn’t perform a thorough investigation because you needed to meet an arbitrary time frame is not a position you want your company to be in. You also don’t want to explain why you closed an investigation to meet the time frame and then felt compelled to reopen it after the batch was released because you had concerns about its conclusions.
The other element that needs to be addressed is that of the prevalent culture existing in the organization. It is good to set a time goal for FDA compliance activities performing investigation, thus ensuring their timely completion. It is not acceptable to have the time frame be the driving force behind the investigation.
Management needs to emphasize their commitment to having thorough investigations as opposed to incomplete investigations that meet the self-imposed time frame. It is ideal when an investigation is completed and a true root cause identified in the specified time frame but, if that is not achievable, management needs to be clear that they prefer the identification of the true root cause over the rushed investigation that merely checks the box for completion in a timely manner. Without this management commitment, the premature closing of investigations will likely continue.
Good Manufacturing Practices
Investigations need to focus on determining root cause in a timely manner. The length of time it takes to complete an investigation depends on the complexity of the investigation. The primary driver for avoiding compliance and data integrity risks concerning investigations is arriving at a root cause in a timely manner. This allows you to be confident in presenting your investigations during inspection and avoiding unnecessary scrutiny when the investigation is rushed and a conclusion is reached prematurely.
Volume 42, Issue 12, pg 50, 49
Regulatory Compliance Associates® (RCA) provides worldwide services to the following industries for resolution of compliance and regulatory challenges:
We understand the complexities of running a life science business and possess areas of expertise that include every facet of R&D, operations, regulatory affairs, quality, and manufacturing. We are used to working on the front lines and thriving in the scrutiny of FDA-and globally-regulated companies. As your partners, we can negotiate the potential minefield of regulatory compliance and private equity due diligence with insight, hindsight, and the clear advantage of our unique expertise and experience.
- Founded in 2000
- Headquartered in Wisconsin (USA)
- Regional offices in Florida, Colorado and Europe
- Expertise backed by over 500 industry subject matter experts
- Acquired by Sotera Health in 2021