Archives: Published Articles

Medical Device Cybersecurity

For medical device manufacturers, technology can be a double-edged sword. The technologies that elevate the quality of life for patients can be used by cybersecurity bad actors to potentially harm patients or undermine the organization using the device as well as the device itself. RCA’s medical device consultants have seen the vast interconnectivity of medical devices widen the attack surface of the public health sector. Intrusions and breaches are possible because of weaknesses in a medical device’s cybersecurity design.

 

Medical device vulnerabilities that are not identified and remediated before the device goes to market can serve as access points for entry into a health care facility’s network, which leads to compromising data confidentiality and integrity as well as potential patient safety.

 

That said, security now needs a seat at the design table, accompanied by its own list of requirements. Many cybersecurity weaknesses are a result of poor design choices and lack of clear requirements. Having a security expert who is familiar with medical device cybersecurity and device development should review the requirements. Many RCA medical device consultants can uncover architecture security vulnerabilities, which can be mitigated during development long before the product goes into manufacturing.

 

The strongest cybersecurity risk control is to use secure by design principles to eliminate the vulnerabilities. The next strongest risk control category is a protective system where the security threat can be detected, responded to, and recovered, so the risk does not materialize. The weakest cybersecurity risk controls are labelling and instructions. All three of these categories of risk controls can be used to manage cybersecurity risks in medical devices.

 

Effective security by design depends on the ability to understand and stay on top of cybersecurity issues to maintain the safety and security of devices, data, and users. One of the biggest challenges with medical device development is infrastructure diversity. Devices are designed, manufactured, configured, and deployed using various programming languages, operating systems, databases, networks, and hardware platforms. This means vulnerabilities can be anywhere.

 

One common issue that can lead to vulnerabilities is when devices still use legacy operating systems that are no longer supported by the companies that developed them. Health care organizations can mitigate these vulnerabilities by restricting access and monitoring for threats on the network where the device is connected.

 

It is not possible to have a completely secure device. But with a well-planned design along with full visibility of product development and the supply chain, companies can strengthen their device’s security posture. Also, cybersecurity must be monitored and maintained throughout the device’s life cycle. As new vulnerabilities are discovered, the device will require cybersecurity patches and updates. Just because something is not exploitable today does not mean it will not be exploitable in the future.

 

The following resources identify specific areas to focus cybersecurity efforts throughout the product’s life cycle.

 

International Medical Device Regulators Forum (IMDRF)

 

The IMDRF published the guidance “Principles and Practices for Medical Device Cybersecurity.” The document provides recommendations to help all stakeholders minimize cybersecurity risks across the product’s total life cycle. According to the guidance, medical device cybersecurity is a shared responsibility among all stakeholders, including the manufacturer, health care providers, users, and regulators. All stakeholders must understand their responsibilities and work closely with one another to continuously monitor, assess, mitigate, communicate, and respond to potential cybersecurity risks and threats throughout the life cycle of the medical device.

 

Technical Information Report 57 (TIR57) and TIR97

 

TIR57 is a cybersecurity standard for medical devices. The guidance, titled “Principles for Medical Device Security—Risk Management,” was published by the Association for the Advancement of Medical Instrumentation (AAMI). It provides recommendations on integrating cybersecurity risk management into the overall development of the device. TIR57 is closely modeled after ISO 14971 for safety risk management, which specifies the terminology, principles, and processes for risk management of medical devices.

 

TIR57 also works in conjunction with TIR97, which provides guidance for addressing postmarket security risk management within the risk management framework defined by ANSI/AAMI/ISO 14971. Both TIR57 and 14971 touch on the postmarket phase at a high level. TIR97 expands on the foundation established in TIR57 and focuses on establishing security risk management for the postmarket phase of the product’s life cycle.

 

Recognizing the need for protection of medical devices in an increasingly digitized world, the U.S. Food and Drug Administration (FDA) added TIR57 to its list of recognized consensus standards. Device manufacturers who implement it can expect to have all the information expected by the FDA in place for premarket submissions.

 

NIST Framework for Improving Critical Infrastructure Cybersecurity

 

The National Institute of Standards and Technology (NIST) is an agency within the Department of Commerce that promotes innovation for enhancing science, business, technology, and economic security. The organization produced a document called the “Framework for Improving Critical Infrastructure Cybersecurity,” which assists companies in improving the security of their infrastructure.

 

The framework is useful for any organization no matter what type or level of cybersecurity it currently employs. The framework is not intended to replace a company’s current cybersecurity strategy. Instead, it advises organizations on identifying their current cybersecurity posture, determining a target state for cybersecurity efforts, and developing a plan for progressing toward the target state.

 

Open Web Application Security Project (OWASP)

 

OWASP is a nonprofit organization that works to improve the security of software. The OWASP Top 10 is a standard awareness document for developers that provides information about the most current critical security risks to web applications. As part of their approach to security, companies can incorporate the OWASP findings and recommendations into their security practices. The OWASP list is routinely updated to stay up to date with the ongoing advances in technology.

 

FDA Cybersecurity Recommendations

 

According to the FDA’s guidance on premarket submissions for cybersecurity, a trustworthy medical device:

 

  • Contains hardware, software, and/or programmable logic that is reasonably secure from cybersecurity intrusion and misuse.
  • Provides a reasonable level of availability, reliability, and correct operation.
  • Is reasonably suited to performing its intended functions.
  • Adheres to generally accepted security procedures.

 

The agency’s Quality System Regulation (QSR) suggests that software device manufacturers employ a risk-based approach to the design and development of medical devices, which includes setting up appropriate cybersecurity protections. Using this approach, the FDA encourages device manufacturers to:

 

  • Identify assets, threats, and vulnerabilities.
  • Assess the impact of threats and vulnerabilities on the device’s functionality, end users, and patients.
  • Assess the likelihood of a threat as well as the likelihood of a vulnerability being exploited.
  • Determine risk levels and suitable mitigation strategies.
  • Evaluate residual risk and risk acceptance criteria.

 

Implementing these design controls improves the likelihood that the FDA will find your device meets its applicable statutory standard for premarket review.

 

To effectively combat the ongoing cybersecurity threats, companies should have a clear definition of responsibilities for all relevant stakeholders regarding infrastructure, policy development, and communication. To achieve this, regulatory agencies along with cybersecurity experts strongly advocate effective and unified collaboration across the enterprise. Using a platform-based quality management system (QMS), companies easily manage design control, risk, changes, suppliers, etc. from a single platform. This way, all stakeholders can have an appreciable impact on the transformation of the product throughout its design, development, and postmarket life cycle.

 

Follow the link to read the full article where we go over specific areas to focus cybersecurity efforts throughout the product’s life cycle as well as FDA Cybersecurity Recommendations.

FDA 483 Trends

Introduction

 

The intent of this cGMP article is to stimulate more conversation and catalyze more improvement across our industry relating to the repeat problems we have seen for literally decades. During research for the article the author discovered the top 10 FDA Form 483 observations have mostly remained unchanged over the last 23 years. However, they likely have been the same going back further in time, but FDA 483 trend presentations could only be found going back to 2000.

 

The main questions to consider when reading this article are:

 

  1. Why are the top 10 FDA Form 483 issues mostly the same the past twenty-three years? What is/are the cause(s)?
  2. How can we, as an industry (regulators and regulated), solve these systemic repeat observations?

 

Methods

 

The data and thoughts detailed in this article were derived from the following four areas:

 

1. Data utilized and presented during the Parenteral Drug Association’s Annual meeting. The data was obtained from RCA’s partner, Redica Systems, and was mined for the top 483 observations between 2018 to 2021.

 

  • Information was compiled by utilizing Redica’s Annual Trend Report with the following search criteria: Year range = 2018 to 2022 + Human Drugs/GMP + Form 483 + All Firms Globally

 

2. Research, data compilation and analysis on 483 trend presentations given by the FDA going back to 2000.

 

  • Information was compiled based on internet searches for prior FDA presentations on FDA Form 483 observational trends (aka Top 10 observations within the specific year).

 

3. A highly informal, anonymous survey of 30 industry professionals. The individuals selected were known to the author and had to fit the following criteria:

 

  • They were ex-FDA employees who worked in the pharmaceutical CGMP program within the Center for Drug Evaluation and Research (CDER) and/or the Office of Regulatory Affairs (ORA – FDA’s inspectorate). They had to have worked for more than two pharmaceutical companies (after FDA) and have over 20 years of professional experience, OR
  • They are current industry quality and/or operational professionals who have worked for more than two pharmaceutical companies and have over 20 years of professional experience.

 

4. The author’s tacit knowledge gained from working as an executive at the FDA and an executive at both generic and brand pharmaceutical firms, as well as a consultant to dozens of firms.

 

Discussion

 

What and Why

 

Please do not get caught up in the numbers. They are important, but the important takeaway from this article is our collective industry continues to be cited by the FDA for the same observations year after year. The same 10 observations pop up again and again going back to at least 1999, over 23 years. In those 23 years, we’ve seen a rapid increase in knowledge; better equipment; systems; processes; therapies; and technologies to name a few.

 

It’s definitely been a volatile, uncertain, complex, and ambiguous (VUCA) world we’ve been living in and will continue to be. With all the rapid advancements in processes, products, and services how are we still seeing the same CGMP observations in our facilities year over year? What can we do as an industry to change these repeat observations?

 

Background

 

FDA’s 2006 Guidance for Industry, Quality Systems Approach to Pharmaceutical CGMP Regulations” details a six-system inspection model. The six systems (1. The Quality System; 2. Production System; 3. Packaging and Labeling System; 4. Laboratory Controls System; 5. Facilities and Equipment System; and 6. Materials System) are all interconnected.

 

In fact, FDA states in the guidance: “the quality system provides the foundation for the manufacturing systems that are linked and function within it. The quality system model described in this guidance does not consider the five manufacturing systems as discrete entities, but instead integrates them into appropriate sections of the model.” The data presented below will be divided into six systems for ease of presentation.

 

cGMP

 

Data Analysis

 

During the PDA Annual Meeting, the author gave a presentation entitled “Analyzing Global FDA 483 Observational Trends 2018-2021. In the presentation top observations within each of the six systems were detailed. Table 1 below details the total 483 observations by category/system from 2018-2021. 

 

cGMP

 

The data shows the Production System accounted for the largest percentage of total observations (27.4%) during the reporting period. However, the Quality System and Laboratory System are close runners-up at 26.2% and 19.4%, respectively.

 

Table 2 depicts the top observational issues (i.e., what were the top observations within the different systems) across all systems for the same time period.

 

The table lists the System (i.e., one of the six systems) then the secondary category of each observation, and then the tertiary category (if available). For example, the top issue lies in the quality system, with the secondary category of inadequate deviations and tertiary breakdown to inadequate investigations.

 

Each of the Six Systems is further detailed in Tables 3-9.

 

These graphs only depict the past four years. During the research for the article internet searches for FDA presentations on the Top 10 483’s per annum were compiled and analyzed. The data showed the same top 483 observations remained mostly unchanged over the past 23 years.

 

For example, in 1999 an FDA official from the San Juan District Office gave a presentation entitled “Current 483 Issues”.3 Within the presentation the official noted the top 483 observations were laboratory controls, investigations, stability issues, calibration issues, environmental controls, records, procedural deficiencies, equipment and NDA Field Alert Reporting. Fast forward close to 23 years later and the observations have largely remained the same, as depicted in the PDA presentation.

 

Another FDA officer gave a presentation in 2015 detailing, among other things, the top observations from 2004 to 2014 (Table 9) mostly remain the same.

 

cGMP

 

cGMP

 

Table 10 below displays the top common observations over the past 23 years. The rankings (i.e., 1 to 10) are not important year over year because, while the top 10 observations may change from one ranking to another, these common observations routinely remain in the top 10.

 

Potential Causes and Call to Action

 

In April 2014 Harvard Business Review (HBR) published an article entitled Creating a Culture of Quality. In the article, the authors detailed the results of their study which included 60 multinational corporations, an extensive review of research, and a survey of more than 850 employees. The quality culture study garnered a great deal of attention in our industry upon publishing.

 

Subject matter experts prominently displayed some of the key cGMP study quotes such as “A company with a highly developed culture of quality spends, on average, $350 million less annually fixing mistakes than a company with a poorly developed one.”

 

cGMP

 

cGMP

 

cGMP

 

cGMP

 

cGMP

 

cGMP

 

In addition to this captivating statistic the HBR authors outlined four (4) essentials that drive quality in organizations:

 

  • Leadership Emphasis – Managers are told that quality is a leadership priority and walk the talk.
  • Message Credibility – Messaging is delivered by respected sources, is appealing to associates, and is easy to understand.
  • Peer Involvement – peers routinely raise quality as a team topic of discussion and hold each other accountable (i.e., a speak up and accountable culture).
  • Employee Ownership – Associates understand how quality fits with the job and are empowered to make quality decisions (ex: anybody can raise a deviation) and are comfortable (non-punitive) raising issues. Do you think you are following these cGMP concepts at your organization? What about the industry as a whole?

 

Informal Survey

 

To try and make sense of this problem, a very informal and anonymous survey was sent to thirty different colleagues. The colleagues were known to the author and were a mix of ex-FDA employees and industry. They also had to have worked at no less than two different pharmaceutical/ biotech companies (not including FDA) and have no less than 20 years of experience in quality, compliance, and/or inspections or audits.

 

cGMP

 

cGMP

 

cGMP

 

cGMP

 

The survey posed the same two questions noted at the beginning of this article, specifically:

 

  • Why have the top 10 FDA Form 483 issues mostly the same for the past twenty-three years? What is/are the cause(s)?
  • How can we, as an industry (regulators and regulated), solve these systemic repeat observations?

 

The results were telling and seemed to point to a deeper systemic issue, both at the line level of the firm, within the quality units, laboratories, operations and most importantly in the C-Suite. A sampling of the cGMP results is listed in the table below. You be the judge.

 

Conclusion

 

I do not profess to have the answer(s) to this problem. During my 25+ year career, I’ve seen a lot of very good CGMP programs and a lot of not-so-good CGMP programs. To be honest, I do not think one person, one firm, one trade organization, or one consultancy has the solution. It could be argued that the solution lies in our collective knowledge and experience.

 

I’ll leave you with one additional parting thought: In May 2007, FDA/ CDER Center Director, at the time, Dr. Janet Woodcock posted an update and message on the Agency’s Pharmaceutical Quality for the 21st Century,6 which kicked off in 2002. In Dr. Woodcock’s opening message, she astutely pointed out:

 

“As you know, FDA cannot meet the goals of the Initiative alone. The success of the Initiative has been predicated on active participation and input from experts in industry, academia, government, and consumer groups…. The journey has just begun. There is still much to learn and innovations to incorporate into all our processes. We, in the agency, will continue to emphasize the importance of the Initiative and look forward to many more improvements in our regulatory processes for ensuring product quality.” 

 

This initiative started 20 years ago. The Top 10 483 observations have not changed in this same timeframe. Have we stagnated, improved or fell behind? This is something for the regulator and regulated to ponder and address – together.

 

References

  1. Guidance for Industry (fda.gov) QS Guidance
  2. FDA QS Guidance, pg. 7
  3. Current 483 Issues Diana Amador, Director, Science Branch San Juan District Office 1999
  4. Microbiological Inspections, Regulatory Investigator Update, Sharon Thoma, ORA National Expert Pharmaceutical Inspections, 2014 9th Annual Global Conference on Pharmaceutical Microbiology
  5. Srinivasan, Ashwin and Kurey, Bryan, Creating a Culture of Quality, Harvard Business Review, April 2014
  6. Pharmaceutical Quality for the 21st Century A Risk-Based Approach Progress Report | FDA

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

Technology Transfer Pharmaceutical

Q: My company is preparing to transfer in a new product to one of our manufacturing facilities. Previous technology transfer pharmaceutical projects have not always gone smoothly for us. How can I ensure that this transfer goes well?

 

A: This is a great question and frequently asked. It is important to understand the requirements for a successful technology transfer. These concepts are used when transferring product from a research environment to clinical trial manufacturing, a clinical-trial manufacturer to a commercial-product manufacturer, between company facilities, and/or to a contract manufacturer.

 

Let’s say that Company A wants to outsource the manufacturing of product to Company B, a contract manufacturer. Company B cannot perform all of the necessary testing associated with the product manufacturing and release, and they need to contract out some of the testing to Company C. In this case, the technology transfer would involve three parties who will need to be included in the technology-transfer process.

 

Tech Transfer

 

The questions to answer for a successful product transfer become:

 

  • Who needs to know what to have a successful transfer?
  • How do we maintain open lines of communication between all the involved parties?
  • How does this all get managed?

It is important for all parties to be engaged in the technology-transfer process, and because technology transfer can mean different things to different people, one of the first steps in the process should be to establish a common understanding of terms and definitions between all the parties involved. Without a common understanding and/or language, the technical-transfer activity can become confusing, frustrating, and ultimately, unsuccessful.

 

Tech Transfer Pharmaceutical

 

The Pharmaceutical Research and Manufactures of America’s Quality Technical Committee developed a good definition for technology transfer in 2003. They defined technology transfer as, “The body of knowledge available for a specific product and process, including critical-to-quality product attributes and process parameters, process capability, manufacturing and process control technologies, and quality systems infrastructure”. The objective of the transfer is to impart knowledge that will allow for smooth, continuous manufacturing of the product regardless of its stage in the product lifecycle. This knowledge includes not only what works but also what hasn’t worked.

 

Once a common understanding is established, the best way to ensure that you have a successful technology transfer is to maintain open lines of communication and develop a timeline that defines when crucial steps in the transfer will be performed. When any of the parties stop communicating or cease to share information, then the technology transfer will fail. It is important for all parties to maintain open communications through the technology-transfer activity.

 

Technology Transfer Examples

 

The following six technology transfer examples should be kept in mind as best practices:

 

  • Robust information exchange. Without a robust and transparent exchange of information the technology-transfer activity has the potential to be frustrating and delayed while people try to find a common understanding and locate necessary information crucial to the success of the activity.

 

  • Planning and project management. By having a good plan and project management tools, the technology transfer is more likely to be completed on time. Establishing realistic deadlines and scheduling the work to meet those deadlines will, again, contribute to a successful technology transfer experience.

 

  • Transfer of analytical assays. It is important to make sure all analytical methods are transferred and that the methods are validated. This helps ensure that the transfer was done correctly and that the site receiving the information can produce the product and analyze it without significant problems arising.

 

  • Small-scale verification at the receiving site. This activity helps keep the project on track. If the small-scale verification can be performed successfully, it is an indicator that the scale-up will go smoothly.

 

  • Pre-GMP engineering runs are desirable. These are not necessary but are desirable because they assure that the equipment being used is functioning properly.

 

  • GMP runs. This is the final step in the process validation and is necessary to confirm that the technology transfer was successful.

 

Technology Transfer Pharmaceutical

 

Many regulatory authorities reference the concepts of tech transfer in their respective regulatory frameworks. Volume 4 of the European Union’s Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use makes multiple references to technology transfer.

 

In section 1.2, it states that GMPs apply to technology-transfer activities. Chapter 4 of the EU guidelines requires:

 

“… written policies, procedures, protocols, reports and the associated records of actions taken or conclusions reached, where appropriate, for the following examples … Technology transfer …”

 

Chapter 6 of Volume 4 has a section devoted to the technology transfer of testing methods. The last section of EudraLex Volume 4 that deals with technology transfer is Chapter 7 on Outsourced Activities. This section clearly states that there needs to be written material around transfer.

 

FDA Contract Manufacturing

 

FDA has chosen to address the issue of tech transfer in their guidance titled Contract Manufacturing Arrangements for Drugs: Quality Agreements. This guidance states that:

 

“A comprehensive Quality Agreement will provide specific terms related to the particular product or products involved” and “the Quality Agreement should include product/component specifications; defined manufacturing operations, including batch numbering processes; responsibilities for expiration/retest dating, storage and shipment, and lot disposition; responsibilities for process validation, including design, qualification, and ongoing verification and monitoring…”

 

The bottom line is that to have successful transfer you need to have a common understanding and language, a way to manage the various steps and information that are crucial to the product, and you need to maintain open communications between all the parties involved in the process.

 

Article Details

 

technology transfer

 

Pharmaceutical Technology
Vol. 40, No. 4
Pages: 92–94

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

CAPA Systems

Q. I work for a contract manufacturer, and I think we have robust CAPA systems. Sometimes we close our CAPAs before we have completed our effectiveness check due to the timeline needed to implement and measure the effectiveness of the preventive action. Occasionally, we fail our effectiveness checks, requiring us to reopen our CAPA. This creates a lot of concern during audits. Is there something I can do to prevent this from happening?

 

A. The key to CAPA systems lies in the thoroughness and quality of the investigation. Based on the limited information, it sounds like you are having trouble recognizing the root cause(s) identified during the investigation. The investigation process should make use of root-cause analysis tools designed to examine the impact of the equipment, process, people, materials, environment, and management on the identified non-conformance.

 

The investigation process should review each possible root cause; the investigators should either eliminate it or it should become part of the preventative action. As the elimination process progresses, the investigation will naturally and logically hone in on the root cause(s) of the non-conformance.

 

Any potential CAPA quality root cause that can’t be eliminated needs to be remediated. Most companies make the mistake of stopping too soon and not pursuing all the possible root causes that can’t be eliminated in the investigation stage

 

CAPA Records

It might help if we look at a situation where a probable root cause was identified but not pursued as part of the preventive action. The incident involved the detection of a discolored vial during inspection of lyophilized vials. The vials inspectors discovered several green-hued vials before the packaging phase of the operation.

 

What seemed to be a simple issue isolated to one batch grew and ultimately affected more than 28 batches produced over a two-month period. Several green-hued vials were discovered during inspection of a lyophilized batch of product that was produced on a 20-year-old automated line.

 

FDA Inspection

 

The inspectors that discover the vials immediately informed the quality department and an investigation was opened. The lot was put on quality assurance (QA) hold, and the vials were sent out for analysis. Manufacturing on the line was continued while the investigation was being CAPA systems were being updated.

 

The results of the analysis indicated the green color in the vial was due to the presence of copper. The firm was unable to determine the source of copper in their operation and concluded the copper was most probably due to contamination of the vial at the vial manufacturer and the investigation was closed.

 

CAPA Manufacturing

 

Seven days after the detection of the first green vials during the manufacturing of a different lyophilized product, the same issue occurred. The original investigation was re-opened and a for-cause audit was performed at the vial manufacturer. The results of the for-cause audit were inconclusive with no definitive source of the copper identified. During the investigation into the vial manufacturer, the company continued to manufacturer other products and implemented a 100% inspection of incoming vials before use.

 

Seven days later, a line operator noticed a vial exiting the depyrogenation tunnel that contained a green, gel-like blob in it. The manufacturing run was stopped, and the vial was retrieved and sent for analysis. The green gel was identified as containing copper. The company was still convinced that the contamination was due to poor quality control on the part of the vial manufacturer and continued operations and working with the vial manufacturer to determine the source of the copper.

 

Manufacturing Audit

 

To help facilitate the investigation, the firm hired a consultant to go to the glass manufacturer and perform a facility audit. The auditor could not identify the source of the copper at the vial manufacturer and recommended that the company reevaluate their operations for the presence of copper. The company continued to manufacture product but agreed to reevaluate the facility for potential sources of copper.

 

This time the facilities and maintenance personnel opened up the line as they would during a routine maintenance shut down. When they opened the depyrogenation tunnel, they discovered the presence of copper on the top of the HEPA filters as well as a coating of green on the side doors to the tunnel. Manufacturing was finally halted on the line until the in-depth evaluation could be performed and CAPA systems updated.

 

Manufacturing Root Cause

 

The root cause of the problem was determined to be a faulty cooling valve in the depyrogenation tunnel, which was identified as a potential root cause but ultimately not pursued because it was at the bottom of the probability list and rated as possible but highly unlikely. The tunnel in question was 20 years old and was built with copper piping above the line and the HEPA filters.

 

Although the line was routinely maintained and checked, there was no alarm associated with the cooling valves to indicate a failure. The failing valve caused liquid to condense on the copper lines and drip onto the HEPA filters. As more and more liquid collected on the filters. the stress caused the filters to breach, relieving the pressure. This breaching happened on a predictable seven-day cycle.

 

Inspection Process

 

Ultimately, the incident involved the investigation of lots manufactured on the line over a sixth-month period, which was the last time the cooling valve was inspected and determined to be functioning to standards. Once the problem was properly identified, the effective corrective action could be taken; however, by that time, 28 lots of product manufactured for several different clients during the two-month period were rejected because of the presence of green vials intermittently detected during the inspection process.

 

CAPA in QA

 

If the site had conducted a thorough QA assessment and investigation, it would have cleared their equipment, personnel, etc., before jumping to the conclusion the vial manufacturer was at fault. This CAPA corrective action will now stop manufacturing going forward and correct the problem before the loss of lots of product.

 

The bottom line is there are many perspectives on what constitutes a good CAPA system, but the reality is the quality and thoroughness of the investigations ultimately drive the effectiveness of the CAPA. When conducting the investigation, it is important not to jump to conclusions on what caused the non-conformance.

 

CAPA Corrective Summary

 

Each CAPA investigation should use root-cause analysis tools and should address why potential areas are either eliminated as the root cause or are a potential cause of the non-conformance. If you can conduct a complete investigation, you will ultimately have CAPA systems with robust data and documentation.

 

regulatory compliance

 

Pharmaceutical Technology
Volume 40, Issue 2
Pages: 52–54
 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

Internal Audit

Q: I am in charge of the internal audit program at my company and am wondering if you have any suggestions on how I can make this activity more valuable for my company?

 

A:  Internal audits are part of management responsibilities (1–3) and can provide valuable information and offer many benefits to an organization. The information obtained during the audit can be used in many ways to help your organization grow and continually improve its operations. How you approach the internal audit function will help the organization understand the advantages of supporting an effective, well-run internal audit program.

 

Internal Audit Design

 

If designed and implemented appropriately, internal audits can provide valuable information that can be used to prevent issues before they become compliance concerns during a regulatory inspection.

 

Issues can be identified and corrected before the regulatory authorities or current/potential clients identify them. If these issues can’t be completely remediated before an external audit, a plan to correct them can be established and action taken to mitigate them.

 

Corrective Action

 

Having corrective actions in place before others identify the issue may lessen the impact of the observation and instill confidence that your quality system is under control and there is a process in place for continuous improvement. In addition, the internal audit can be used for training staff and communicating valuable information to the organization.

 

Internal Audit Strategy

 

The strategy behind an internal audit is not to pretend to be the regulatory authority and show up unannounced but rather to work in cooperation with your colleagues to identify and solve potential issues. An effective program establishes a partnership between the audit function and the departments being audited. The ideal tone for an internal audit should be a team-oriented activity that is instructive, informative, open, honest, and inclusive.

 

Audit Schedule

 

There are several factors that help contribute to establishing this tone. One way to set the proper tone is to publish the audit schedule in advance and make sure the functional areas are informed of the schedule. The audit itself should be forward thinking and unlimited in scope. The auditors should work with the functional area and talk with as many employees as possible to identify the issues of concern.

 

Internal Audit Process

 

Individuals who are responsible for performing the day-to-day activities often have the best insight as to what is working and what needs to be improved. Excluding them from participating in the audit process might result in overlooking a serious issue that could come up during a regulatory inspection. To be able to get the most valuable information about the potential compliance issues facing the organization, internal audits should not be judgmental or antagonistic, or have a ‘check the box’ mentality in execution. They should also avoid looking retrospectively in lieu of looking forward.

 

Certified Lead Auditor

 

The behavior of the auditors during the audit is also important to obtaining valuable information. Auditors should be direct and avoid asking questions designed to stump people. The auditors should take this opportunity to teach by explaining why they are asking particular questions and providing the regulatory citation for the inquiry.

 

Audit Procedures

 

One of the most important audit procedures must be followed by the mock inspector. It is important their behavior includes the ability to listen to the answers to the questions and refrain from judging. The auditor should adopt a proactive approach to the audit and look at items that are infrequently assessed. Above all else, the auditor needs to be friendly.

 

Internal Auditor

 

The exact same behavior defined for the auditor should also be the exact same behavior displayed by the auditees. Auditees should be direct and avoid deflecting or obfuscating answers. They also need to be instructive and take the time to explain why they do things the way they do them.

 

Audit Committees

 

Leadership needs to listen to the auditor’s concerns and not overreact to the question being asked. They should be proactive and point out things of concern and seek advice on how to remediate them. Both parties need to remember they are not the enemies, rather they are the partners.

 

Audit Control

 

Internal audits are a valuable tool for identifying issues before others identify them. The information obtained during the audit can be used to improve your processes, and the audit process itself can be another tool to help train employees.

 

If you consider the internal audit as a gap analysis for your processes and set a tone of partnership and cooperation, you will find that the audit program and the information obtained from it will become a valuable resource for the organization rather than an unwanted intrusion into operations.

 

 

internal audit

 

Article Details

Pharmaceutical Technology
Vol. 41, No. 4
Page: 74

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].

Pharmaceutical Drug Manufacturing

regulatory complianceEverything you do in pharma manufacturing catches up to you eventually. And just like the state of your complexion, pharmaceutical equipment loses its pep over time and cracks around the edges. Of course, these breakdowns are not only cosmetic. Without proper pharmaceutical manufacturing upgrades over time, old and faulty pharma equipment can increase the risk of contamination, which can trigger recalls and quality-related disruptions in production that don’t just slow down work at one pharmaceutical plant — they can also be a major contributor to U.S. drug shortages.

 

In pharma plants, age definitely matters.

 

Ironically, there’s no shortage of new equipment that biotech manufacturers can purchase to replace their older machines. Walk the floor of any HIPAA industry trade show and you can easily get lost in the sea of snazzy new isolators, tablet presses, packaging robots, fill and finish machines — the list goes on. But in a pharma manufacturing plant, this is much more complicated than replacing machinery and plugging in new units out of the box.  In fact, the process can be a regulatory quagmire that companies aren’t likely to emerge from for at least a few years. 

 
 

Manufacturing equipment is also a major investment. It’s no wonder pharmaceutical companies want to put off replacing them to get as much mileage out of their equipment as they can. On top of that, there can be uncertainty involved in trying a new kind of equipment and a learning curve that could lead to production disruptions. Overall, this slow timeline for regulatory approvals and a fear of the unknown creates an environment that makes pharma companies wary of change.

 

 

“When it comes to new Big Pharma tech, no one wants to be the first to implement it — but everybody wants to be the fastest second,” says Maik Jornitz, president and CEO of G-Con Manufacturing, and co-chair of the Parenteral Drug Association’s (PDA) former Aging Facilities Task Force.

 

Yet, there are plenty of compelling reasons to give your aging facilities a needed facelift. Although the regulatory challenges biotech is facing are very real, they’re not insurmountable and can be conquered in a way that’s faster to realize. Also, putting off the process only delays the inevitable breakdown or a regulatory citation that’s likely to be more costly in the long run than an upgrade would have been.

 

Here, we’ll explore the critical link between these manufacturing issues and widespread drug shortages, provide real-world tips on how companies can improve quality control in aging plants, and explain why it pays to update older facilities.

 

Pharma Tech & Drug Shortages

 

The number of drugs and medical supplies in short supply is certainly not a new issue — in the past, the U.S. Food and Drug Administration launched a Drug Shortage Program to help conjure up solutions for keeping a healthy supply of the country’s high-demand medicines. Yet, the problem continues to vex regulators and the industry.

 

Manufacturing technology hiccups that hamper product quality have been shown to be a much bigger culprit of supply problems. The issue is particularly acute in aging facilities where the use of legacy equipment instead of automation often leads to higher rates of contamination.

 

A recent survey conducted by the American Society of Health-System Pharmacists (ASHP) asked pharma manufacturers to identify the cause of shortages, the most-cited known reason was “manufacturing” issues (30 percent). The FDA has also estimated that over half of injectable drug shortages are due to quality problems such as particulate contamination. According to ASHP, the rate of shortages is increasing and “severely impacting patient care and pharmacy operations.”

 

Medicine Manufacturing Compliance

 

Of course, biotechnology companies take calculated measures to remove any deviations that lead to contaminated products. But unfortunately, the economics of producing some types of drugs doesn’t provide incentives for making the needed investments that could help avoid problems with impurities.

 

The product on the FDA’s drug shortage list include a wide range of treatments. They often are the most basic elements for everyday patient care in a health care system (e.g. sterile water, lidocaine, saline, and bupivacaine). These high-demand, older products tend to sku lower on the profit margin scale — making investments into production lines for the drugs less attractive.

 

Pharmaceutical Manufacturing Age

 

There’s no easy way to define what makes a pharma plant officially over the hill. Some experts have estimated that most pharma facilities are designed to run well for about 20 to 25 years. And because all plants are in various states of aging — in regards to both equipment and the facility — it’s difficult to get a handle on how many plants in the U.S. have passed the 20-year mark. But Sue Schniepp, a distinguished fellow with Regulatory Compliance Associates, has seen plenty of first-hand evidence that operations in some plants look like they’re from a bygone era.

 

“The oldest line I’ve seen was about 50 years old,” she explains. “The company had a completely open line, and the only protection was a shower curtain.”

 

 

According to Jornitz, lines that are operating with frequent interventions, such as those susceptible to glass breakage, are at the highest risk of contamination.

 

“It’s important to take the human factor out of the equation,” he says.

 

Jornitz says that the fill lines are often the most vulnerable to contamination issues, but that older utilities, such as outdated water systems, can also put products at risk. Schniepp agrees that contamination risks go beyond equipment.

 

“It’s also in the floors if they’re not state-of-the-art,” she says. “You have to also look at the ceilings — anywhere you’re bringing the walls and ceiling together there’s a gap that could harbor microbes. It’s one thing to put in a restricted access barrier system (RABS). But if there is microbial growth in some of the plant’s older joints, what good have you really done?”

 

Anti-aging for pharma plants

 

Naturally, regular maintenance and upgrades can go a long way in preventing some of these problems.

 

“All facilities are aging,” Jornitz says. “However, when the company is reinvesting funds into the facility and have rigid maintenance or technology improvement cycles, the facility can age much slower.”

 

One of the challenges, however, is that companies are often reluctant or unable to shut down their line to perform maintenance updates.

 

API for Pharma

 

Per the FDA, all APIs are subject to Section 501(a)(2)(B), which requires all drugs to be manufactured in conformance with CGMP. 

 

“When you’re a contract manufacturer especially, sometimes you’re running around the clock,” Schniepp says. “But you have to shut it down to see what’s wearing, what’s tearing — and jump on it before it becomes a problem.”

 

Despite the one-week shutdown that’s typically required for a maintenance check on a company’s line, Schniepp points out that it’s better to spot cracks in the system when it’s down because when it’s running, operations can start to “go awry.”

 

“Look at the line holistically and make sure the equipment is working together,” she says.

 

Jornitz also recommends that companies use predictive maintenance to proactively improve the most important parts of the process steps. Additionally, he says that companies often neglect the importance of their equipment supplier relationships and don’t keep track of the availability of spare parts for their machines.

 

“It’s very important to get early warnings from the supplier that one of their equipment pieces is turning obsolete, so the end-user can act accordingly,” he explains.

 

Pharmaceutical Product Development

 

And putting off these kinds of assessments is likely to haunt pharmaceutical manufacturing companies in the end. Ronald Berk, chief technology officer and principal consultant at Hyde Engineering + Consulting, says that about half of the companies he’s worked with on updating aging facilities are in some kind of regulatory trouble.

 

“We worked for a company that constructed their pharmaceutical manufacturing facility in the late 90s, and the drug they produced was in such high demand that there was a capacity shortage, and they never upgraded the facility,” he recalls.

 

According to Berk, the company didn’t want to slow down production of the drug, so it “hit the snooze button for 20 years,” and never stopped to maintain and improve quality at the facility. Then, after the FDA inspected the facility, the company ended up in a consent decree situation (where the company enters an agreement with the FDA to improve parts of their line that are in violation of regulations). It’s exactly this kind of regulatory scrutiny that should motivate companies to upgrade.

 

Pharmaceutical Manufacturing Success

 

One of the major challenges companies face when dealing with aging facilities is navigating the landscape of regulatory requirements. In particular, companies are reluctant to install new equipment that the FDA could consider a major process modification under its Post Approval Change (PAC) rules. When this occurs, companies often have to revalidate their line, or go through all the tests needed for completing a prior-approval supplement (PAS), which can take as long as four years.

 

In the past, the FDA set out to address this major regulatory hurdle by offering alternative avenues to updating technology. Now, the agency will allow companies to make updates to their operations without a PAS if the new technology is considered a “like for like” change with the older equipment. It’s this route that Schniepp used to completely overhaul the line of one CMO where she worked — a major process she was able to get to the finish line in about two years.

 

“By doing ‘like for like’ you still have to do media fills and qualifications of the line, but you can do it without going through the PAS — as long as you don’t change the footprint of the line,” Schniepp explains. “It would be like upgrading the vanity in your bathroom.”

 

Quality Culture 

 

Here are the major challenges Schniepp faced and how she worked with the QA team to overcome them:

 

Culture and communication: While working as the vice president of Quality for the CMO, Schniepp was tasked with updating a line that was the workhorse of the company, about 30 years old and produced 75 percent of its products. But in the depyrogenation tunnel, the cooling piping was above the products, which was causing fluid to sometimes drip into the vials. The contamination had cost the company approximately $28 million in lost products and triggered an FDA inspection. Yet, Schniepp still faced resistance to change.

 

“When you’re a CMO, your culture is to please the client,” Schniepp says. “When we wanted to upgrade the line, we had to coordinate between about 15 clients that had products on the line and get them all to agree on one approach.”

 

According to Schniepp, not all of the clients thought the “like for like” approach would work. While some were worried about the downtime involved in undergoing a potential PAS, others believed the changes could possibly be communicated to the FDA on an annual reportable. To get everyone on the same page, Schniepp made sure that she wasn’t just talking to the quality department of every pharmaceutical manufacturing client. She also brought each company’s regulatory head into the discussions to get their input and help company leaders feel confident in her plan.

 

Schniepp also ran her plan past the FDA to make sure the agency didn’t have any major concerns with the approach

 

“What regulators really want to see is: Have you thought this out? Can you defend your case? And is your product going to be as safe and effective as it was before? That’s how you win this game,” she says.

 

Working in stages: Once it was time to implement the upgrades, Schniepp says it was all about planning ahead to make sure the company had adequate supplies of its products to offset downtime in operations. The company worked to replace the entire line during a four month period using the comparability protocol specifying before-and-after results for the product requirements for the manufacturing line being replaced.

 

Pharmaceutical Manufacturing QA Training

 

All told, Schniepp says it took a total of two years to update the aging pharmaceutical manufacturing line. Although the company had to deal with about four months of downtime during the process, it was much less of a burden to operations than it would have been to change the entire line under the PAS paradigm.

 

Training: Importantly, Schniepp says the company made sure to adequately train employees with the new equipment so that they could hit the ground running.

 

“We set up the line in a warehouse so the operators could work with it without making any products, because it was so different,” she explains. “They had to learn how to clean the RABS and change out the parts. All of that was going on while we were developing the comparability protocol for shutting down and restarting the line.”

 

Pharmaceutical Manufacturing QA Process

 

Just like when you’re making updates in your home, Berk says that pharma companies often fail to plan for unexpected bumps in the road when revamping their processes and procedures.

 

“One thing that gets underestimated is that if you have an old facility and you start trying to fix things, you might discover other things that need to be fixed or some equipment might break,” he says. “So some kind contingency plan for that is good.”

 

According to Berk, pharmaceutical manufacturing companies also often overlook the life expectancy of their automation and control systems, which can be much shorter than mechanical systems. Changeover to a new control system can also be more challenging than companies realize.

 

“The reality is that you need to spend quite some time testing and qualifying your control system, which can be very time consuming, and inevitably leads to a long downtime,” he explains. “I’ve been at sites where clients wanted to switch overnight. But the process can take up to a month — or half a year if it’s a large facility.”

 

Pharma Tech Outlook

 

There is hope on the horizon in the form of the industry’s newest technologies, if pharma manufacturing companies are willing to adopt them. The rise of automation and single-use equipment, for example, could help lower contamination rates. These advanced technologies allow companies to forgo much of the water utility systems needed to clean stainless steel parts.

 

There could also be changes on the regulatory front and the FDA has demonstrated a commitment to helping companies make needed upgrades.

 

PDA disbanded its Aging Facilities Task Force years ago, but the organization has since launched a new task force aimed at addressing the challenges of Post-Approval Changes. One of the group’s main efforts is to encourage the harmonization of the global regulatory approach to PACs so that companies don’t have to undergo separate approval processes for upgrades in different countries. If other countries accepted an FDA approval, for example, it could shave years off of the process.

 

“The No. 1 question is: How can new, robust technology be implemented faster?” Jornitz explains. “But also, how can we help harmonize global regulations?”

 

Continuous Improvement

 

But for too long, Jornitz says that the industry has used this regulatory hurdle as an excuse for not updating their facilities.

 

“Ultimately, running assets until they break down will cost much more than continuous improvements,” Jornitz argues. And when it comes to dealing with the red tape, Jornitz says that companies that are updating aging tech have a strong case to make with regulators. If they can show that new technology improves patient safety and avoids drug shortages, I think regulators will listen,” he says.

 

To begin the Regulatory Compliance Associates scoping process today, please enter your information in the blue form below and click the submit button at the bottom of the webpage. You may also email us at [email protected].