Compliance Updates

Paul Smith paul_smith@agilent.com

Spain May 2014

CAG EMEAI FY14 | Agilent Restricted | Page 2

Contents

• EU GMP – A Tale of Change (Vs. CFR)……………………………………….....

• FDA Warning Letters – Data Gathering…………………..…

• Instrument Qualification - GAMP / <1058> ……….…

• Quality by Design………………………………………………..……………….

• Data Integrity……………………………………………………..………………………

• FDA Warning Letters – a Deeper Dive………………………..

• How Do You Know ?..............................................................................

• Questions……………………………………………………………………………………….

• Appendix – More FDA Warning Letters………………………………………..

CAG EMEAI FY14 | Agilent Restricted | Page 3

EU GMP – Current Update Status (Vs. CFR Vs. FDA Guidance)

Section Title Issue Date Current Proposed

http://ec.europa.eu/health/documents/eudralex/vol-4/index_en.htm

FDA Warning Letters

CAG EMEAI FY14 | Agilent Restricted | Page 5

EudraGMDP – European Non-Compliance

http://eudragmdp.ema.europa.eu/inspections/gmpc/searchGMPNonCompliance.do

1 Listed for Spain:

CAG EMEAI FY14 | Agilent Restricted | Page 6

FDA Warning Letter Page – Recent Warning Letters

A B

C

D E

F G

H

I J

http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/default.htm

Recent FDA Warning Letters

CAG EMEAI FY14 | Agilent Restricted | Page 7

What an FDA Warning Letter Might Contain

Unique Reference – e.g. “ucm1048179”

Audit Dates

Location

References to 21 CFR and / or USP requirements

Common Words:

Adulterated Misbranded Acknowledgement of Response:

We acknowledge receipt of your reply, but….. Lacks sufficient detail / corrective actions Was not considered as > 15 days from WL

Details of non-conformance

Expression of audit / response concerns

Expression of WL response requirements:

Risk-Assessment for US distributed products Copies of anything promised (procedures, validation) Counter arguments (if difference of opinion)

A “ucm” number is assigned to each FDA web page…. Google will “find” it, if “links broken”.

How many audit days (but not how many people), days to WL

Auditors Carry GPS

Look Up [+ EIR Data]

FD&C Adulterated Drug Definition (Chapter 9, section 351)

FD&C Misbranded Drug Definition (Chapter 9, section 352)

Often Basic Errors…….

Analysis of………

“Tone” of response……

Consequences of what they found, how you responded, what you promised…..

CAG EMEAI FY14 | Agilent Restricted | Page 8

Example Warning Letter – “ucm1048179”

“…a live rodent that you brushed off your Shoulder onto the floor, and then kicked under a pallet….”

Audit Days

[ 15 “Working” Days ] Days to Issue

[ 74 Days, 53 “Working Days” ]

CFR Look Up

[ “Google CFR” ]

“Tone”

Non-Conformance

CAG EMEAI FY14 | Agilent Restricted | Page 9

FDA Warning Letter Trends

725

535 538

471

445 474

673

1720

0

200

400

600

800

1000

1200

1400

1600

1800

2000

2004 2005 2006 2007 2008 2009 2010 2011 2012 2013

?

Trend Downwards – In Terms of Number of Warning Letters

Trend Upwards !

Margaret Hamburg Joined FDA

( 21st Commissioner, May 18th 2009 )

http://www.fda.gov/ICECI/EnforcementActions/ucm247813.htm

?

725 535 538 471 445 474 673

1720

4882

6760

0

1000

2000

3000

4000

5000

6000

7000

8000

2004 2005 2006 2007 2008 2009 2010 2011 2012 2013

FDA Audits: 97 % of US Facilities [pharmaceutical, every 2 years]

FDA Audits: 7 % of Non US Facilities [pharmaceutical every year]

[Source: Journal of Validation Technology; D. W. Vincent, Winter 2012 edition]

US Audits: Down 40 %

Overseas Audits: Up 30 %

Mutual Recognition Audits [Tougher “National” Audits]

Move From “Fixed” Time Triggers To RISK Based Triggers…… Whistle Blowers…. [other regulators – UK MHRA…… ]

976 [2013] down to 591 [2014]

604 [2013] up to 843 [2014]

Source: Pharmaceutical Manufacturing.com

> 10 Times Increase

CAG EMEAI FY14 | Agilent Restricted | Page 10

How Many ? How Many Times are Techniques Cited ?

CAG EMEAI FY14 | Agilent Restricted | Page 11

FDA Warning Letters – A Valuable Resource / Tool…

Country Number Austria 6 Belgium 15 China 143 Denmark 16 France 31 Germany 75 Hungary 2 India 48 Ireland 12 Israel 14 Italy 42 Netherlands 13 Spain 23 Switzerland 27 United Kingdom 58

By Country

Warning Letters by Country

Updated: 31/Mar./2014

0

20

40

60

80

100

120

140

160

6 15

143

16

31

75

2

48

12 14

42

13 23 28

58

CAG EMEAI FY14 | Agilent Restricted | Page 12

FDA Warning Letters – 5 Year Trend…

By Country

0

5

10

15

20

25

30

35

40

3

6 2

3

20132012201120102009

Warning Letters by Country – Last 5 Years

CAG EMEAI FY14 | Agilent Restricted | Page 13

2012 – Last Full Year, Warning Letters as % of FDA Drug Audits

0

10

20

30

40

50

60

70

0 0

61

42

23 19

33

3

14

0

21

50

40

8

24

Spain = 6 Warning Letters, 15 Drug Inspections (= 40 % !)

Drug Audits

How Good Are Pharmaceutical Companies in Spain ?

Instrument Qualification USP <1058> and GAMP

CAG EMEAI FY14 | Agilent Restricted | Page 15

All instruments contain some level of software (unless only electro-mechanical / mechanical)

All instruments and Software must be suitable for intended use – in GXP work

Qualify the Instrument

Validate the Software

• For Simple Instruments – these are combined

• For Complex Systems – these are independent

• For Simple Instruments – calibrate (e.g. pH Meter)

• For Complex Instruments– qualify (e.g. HPLC)

• For Complex Systems – validate (e.g. CDS)

Qualify the Instrument Can’t qualify without software control.

USP <1058>

Validate the Software Can’t validate the software without the instrument.

GAMP

Hardware & Software

CAG EMEAI FY14 | Agilent Restricted | Page 16

USP <1058> - Implemented in August 2008

Risk Based Categorisation: A, B, C:

A – Verify by Observation (e.g. Stirrer) - No calibration or Measurement

B – Verify by Calibration - Calibrate by SOP / Document (e.g. pH Meter)

C – Qualify (e.g. HPLC) - Complex Systems - Verify by Full Qualification

Strength of <1058>

Addressed in <1058> Update

CAG EMEAI FY14 | Agilent Restricted | Page 17

Summary of USP <1058>

Components of Data Quality / Integrity - Principles Apply to All Labs.

Definitions • Roles:

• User • QA • Supplier

• Responsibilities • DQ / IQ / OQ / PQ

Flexibility • What is done in OQ / PQ

Risk Management by • Categorisation: A / B / C

Areas of <1058>

Simplification of the Life Cycle Process:

A B C Examples…

Observe Calibrate Qualify

CAG EMEAI FY14 | Agilent Restricted | Page 18

GAMP – Software Categories

GAMP Defines Different Software Categories:

1

3

4

5

Infrastructure

From PIC/S Guidance

Non-Configured Software

Configured Software (COTS)

Bespoke Software

GAMP Good Practice Guide

A Risk-Based Approach to GxP Compliant Laboratory Computerized Systems

USP <1058> Analytical Instrument Qualification

Firmware – Group B

GAMP 5

CAG EMEAI FY14 | Agilent Restricted | Page 19

GAMP GPG – Risk-Based Approach to GXP Compliant Laboratory Computerized Systems

Appendices: 1. Determining System Impact 2. Testing Priorities 3. Supplier Assessment Scheme Glossary References

Appendices: 1. Categories of Software 2. System Description 3. Data Integrity 4. Simple Systems 5. Medium Systems 6. Complex Systems 7. System Interface Considerations 8. Robotic Systems 9. Defining Electronic Records and Raw Data 10. Security Management for Laboratory Computerized Systems 11. Supplier Documentation and Services

Aligned With GAMP 4 Risk Management by Instrument Categorisation.

Aligned With GAMP 5 Risk Assessment...... No Formal Categorisation ! (Fixed Categories VS. Risk Based Thinking)

Expansion and Examples....

7 Categories Examples:

• A - Sonicator • B - pH Meter • C - Key Pad HPLC • D - PC HPLC • E - NMR • F - Spread sheet • G - Bespoke

Available From ISPE

Contents: 19 Sections - Process Based Approach (Table of Contents Available on Line)

Contents: 7 Sections - Risk Based Model (Table of Contents Available on Line)

GPG Edition 2

GPG Edition 1

CAG EMEAI FY14 | Agilent Restricted | Page 20

Common Goals Good Evolution

• GAMP 5 for Lab.

• Worked Examples

• Inclusion of <1058> Principles

• Life Cycle Mgt.

• Harmonisation

• Draft New <1058> With USP Panel

• Integrates <1058> & GAMP

GAMP 5 - 2008

AIQ <1058> - 2008

ISPE

USP

May 1987

FDA Process

Validation Guide Lines

• Simplify Process

• Risk by Categorisation - Software (GAMP) - Hardware (<1058>)

• Roles and Responsibilities

• Maximise use of Supplier Documentation

• 5 pages !

• Easy to Follow

• A and B Simple

• Flexible

• Very Comprehensive

• Great For Custom Software

GAMP 4 - 2001

GAMP 5 Good Practice

Guide

AIQ <1058> Draft 2013

GAMP and USP <1058>

CAG EMEAI FY14 | Agilent Restricted | Page 21

Pharmaceutical Engineering Publication

CAG EMEAI FY14 | Agilent Restricted | Page 22

Proposed <1058> Classification – Awaiting Feedback

Bob McDowall & Chris Burgess Publication

Quality by Design

CAG EMEAI FY14 | Agilent Restricted | Page 24

Example – Laboratory Lean Sigma Application How Many Days to Test

Product Batches of Material Before

Mean Workflow Optimisation

After

Mean

Impressive Results:

• 50 % Reduction In Tests Times are “Common” • Improved Testing Control

Moderately Robust HPLC Method

• Sample Based Testing

• Product Team [analysts perform all tests]

• Optimised for Control / Speed

Less-Robust HPLC Method

• Test Based Testing

• HPLC Team [HPLC “specialists”]

• Designed to Reduce Problems

CAG EMEAI FY14 | Agilent Restricted | Page 25

What is Quality By Design ?

Pharmaceutical Manufacturing

Process

Inputs

Variable Quality Raw Materials

• Variable Process • Validated Design • Registered

Fixed Output

QbD

Design Space

Historical Pharmaceutical

Process Validation

Quality by Design Pharmaceutical

Process Validation

Inputs

Pharmaceutical Manufacturing

Process

Output

• Fixed Process • Validated • Registered • Can’t be Changed

Variable Quality Raw Materials

Variable Quality Drugs

Specification

Pharmaceutical Manufacturing 2.5

• Can Change – Within Design Space

CAG EMEAI FY14 | Agilent Restricted | Page 26

Wider Application of QbD Principles…..

Application of QbD To Analytical Method Development & Validation

Pharmacopeia Forum

<1224> Analytical Method Transfer <1225> Analytical Method Validation <1226> Analytical Method Verification

<220> Basic Requirements for Validation

<1220> Lifecycle Management of Analytical Procedures

CAG EMEAI FY14 | Agilent Restricted | Page 27

Example – Why QbD is Needed…

Significant QC Problems With Method Variable “Resolution”

CAG EMEAI FY14 | Agilent Restricted | Page 28

3D Graph Called Response Surface

Example - Why Analytical QbD is Needed….. Method Conditions Mobile Phase pH 4.5 Column Oven Temp. 35oC

For This Method: • Temperature – Minimal Effect • pH – Critical Effect – on Resolution

Change Method Conditions pH & Temperature

Measure Effect

Here QbD used in Problem Solving If Can’t Change Method CONTROL pH

With QbD Design A DIFFERENT pH Would Have been Used pH – 3 [flat part of response]

CAG EMEAI FY14 | Agilent Restricted | Page 29

Range of Use…………(Best Practice to Qualify Range of Use)

Wavelength (nm)

Oven Temperature (oC)

Flow Rate (mL/Min.)

245 nm

45 oC 1 mL/min.

Min. Flow

Max. Flow

Low

est

Wav

elen

gth

Hig

hest

W

avel

engt

h

Highest Temp.

Lowest Temp.

Range of Use

Qualification should “bracket” THE RANGE OF USE (good science & easier to “defend” users may have to do extra qualification……)

Why Range of Use is Important ?

1 ml/min. (Pump)

45 oC (Oven)

245 nm (Detector)

Customer HPLC Method

Qualification Space

CAG EMEAI FY14 | Agilent Restricted | Page 30

Design Space = Qualification Space

EQP (Equipment Qualification Plan)

Instrument Qualification

Analytical Instrument

(Range of Use)

QTPP = Quality Target Product Profile ATP = Analytical Target Profile MODR = Method Operable Design Region EQP = Equipment Qualification Plan EQR = Equipment Qualification Report

Pharmaceutical QbD

Analytical QbD

(Process Operability)

Sharmista Chatterjee Jan. 2013

CAG EMEAI FY14 | Agilent Restricted | Page 31

Example – Range of Use Warning Letter The qualification – MUST BE – representative, of how the instrument is used…..

Failure of your quality control unit/laboratory to ensure that analytical instrumentation and test equipment used to assure the quality of your APIs has been appropriately qualified and calibrated for their intended use.

Specifically, your firm has failed to conduct adequate qualifications of your analytical instruments and test equipment. For example, the residual solvent method used to test (b)(4) API has an initial starting gas chromatograph (GC) oven temperature of (b)(4). Your firm’s current qualification of the GC oven temperature does not include temperatures below 100˚C. http://www.fda.gov/ICECI/EnforcementActions/WarningLetters/2010/ucm236841.htm

Qualify the Range of Use

Data Integrity

CAG EMEAI FY14 | Agilent Restricted | Page 33

What Triggered The Current FDA Focus ?

• Scientific “Validity” • ICH Q9, Q10, Q11 support

• FDA Part 11 “Add On” Audits • Jan. 2011

• Data Integrity has always been an FDA focus.

• 1997 Implementation • 2003 Guidance

Science Based GMP Decisions (e.g. cGMP for 21st Century)

Fundamental Data Integrity

21 CFR Part 11

Part 11 Add on Audits

FDA DATA

INTEGRITY

FOCUS • PAI

• Consent Decree • Data Integrity Training…

CAG EMEAI FY14 | Agilent Restricted | Page 34

So, What is Data Integrity ? “The Degree to which a collection of data is complete, consistent and accurate” * *(FDA Glossary of Computer System Software Development Terminology (9/95)

Data: (Collins Complete and Unabridged English Dictionary)

PLURAL NOUN, a series of observations, measurements, facts, information.

Integrity: (Collins Complete and Unabridged English Dictionary)

NOUN, adherence to moral principles, honesty; or the quality of being unimpaired; soundness, or unity; wholeness

The definition can influence the SCOPE that people Interpret Data Integrity:

Narrow:- Specific to 21 CFR Part 11

Wide:- Anything that causes a concern with the validity of the data

This means there is risk of confusion and poor preparation for defending YOUR Data Integrity in an audit…… (…effects your audit preparation)

THE FDA will base their audit on what they find – NOT YOUR DEFINITION !

CAG EMEAI FY14 | Agilent Restricted | Page 35

One Slide History – Data Integrity FDA Warning Letters: HPLC & GC warning letters show high level of

Data Integrity related issues (so not new)

History of Generic Drug Issues

2 Key Areas to Note: Generic Drug scandal in the late 80’s, early 90’s (falsified data, bribes to FDA .. Etc.).

Food Drug & Cosmetics Act Amended by: - Generic Drug Enforcement Act (GDEA)

Debarment – of Individuals and Companies

Clinical ANDA Data – Clinical Data Investigations……

mcahilly@gmqa.net

ISPE Conference on Risk-Based Systems Validation - New Jersey, USA, 12-13th September 2011

FDA Data Integrity Auditing Training…… (AGILENT) - Dublin, Ireland, 9-10th July 2012 Train the Trainer Data Integrity Auditing - Dublin, Ireland, 14-15th May 2014

Monica Cahilly (Now Trained ALL FDA Auditors – in Data Investigations)

Reference Publication [Hyperlink]

CPG 7346.832 [Hyperlink]

FDA PAI – 3 Focus Areas: - Objective 3, Data Integrity Audit

CAG EMEAI FY14 | Agilent Restricted | Page 36

Is Paper Good Enough ?

Reference Publication [Hyperlink]

http://www.pharmtech.com/pharmtech/IT/Data-Integrity-in-the-Analytical-Laboratory/ArticleStandard/Article/detail/842036

• Paper • Hybrid • Electronic

Need to implement data integrity improvements strategically, as many laboratories:

• Still define paper as raw data • Use Excel to calculate results • May have “imbedded” compliance risks – Data Mapping / Flow / Fish Bone

CAG EMEAI FY14 | Agilent Restricted | Page 37

Who Next ?

The UK MHRA is setting an expectation that pharmaceutical manufacturers, importers and contract laboratories, as part of their self-inspection programme must review the effectiveness of their governance systems to ensure data integrity and traceability.

This aspect will be covered during inspections from the start of 2014, when reviewing the adequacy of self inspection programmes in accordance with Chapter 9 of EU GMP.

It is also expected that in addition to having their own governance systems, companies outsourcing activities should verify the adequacy of comparable systems at the contract acceptor.

The MHRA invites companies that identify data integrity issues to contact: GMPInspectorate@mhra.gsi.gov.uk

16 December 2013

Unknown – the situation in other EU inspectorates – Spain ?

FDA Warning Letters HPLC and GC

CAG EMEAI FY14 | Agilent Restricted | Page 39

Examples – Search on “HPLC” - 68

A B C D

1. Enter Search Criteria (e.g. HPLC)

2. Select Sort By (Default is Alphabetical)

3. Select Sort Criteria (e.g. Descending)

4. Select Go

5. Select ALL

6. Select Warning Letter (to open)

Use “Ctrl F” to FIND KEY WORDS

(Copy & Paste into Excel)

CAG EMEAI FY14 | Agilent Restricted | Page 40

FDA “HPLC” Warning Letters…

0

1

2

3

4

5

6

7

8

9

10

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

6

10

6

9

5 5

4

3

2

3

4

5 5

13 years on FDA Warning Letter Page: 46 % - last 4 Years

Key Points: • HPLC has the Highest FDA Focus of ANY Analytical Technique • High focus area in recent years

CAG EMEAI FY14 | Agilent Restricted | Page 41

FDA – Takes 10 x Longer

To Issue Warning Letters

Than Companies Have to Respond

FDA Warning Letters That Mention HPLC or GC Days to Issue Warning Letter [ 84 ]

Days to Issue Warning Letter [HPLC Only]

Audit Duration [ (HPLC & GC) = 84 ]

CAG EMEAI FY14 | Agilent Restricted | Page 42

0 1 2 3 4 5 6 7

Data Integrity

Calibration

Method

N/A

No GC

7

4

2

3

1

Review of FDA Warning Letters About GC Most of these categories cause concern over the validity of the analytical results….

Read Evaluate Categorise Knowledge

GC Methods

Calibration

Data Integrity: Now Biggest Category

Capability of the Method

Would trust this data ?

GC in Name, GC in SOP…..

GC Warning Letters – Most are relatively Recent !

CAG EMEAI FY14 | Agilent Restricted | Page 43

Primary Cause – HPLC Warning Letters

Calibration: Biggest Single Category

Decisions & Justification

Using the Method

Data Integrity

Capability of the Method Poor HPLC Use / Training

HPLC Methods

Would trust this data ?

0 2 4 6 8 10 12

Calibration Defeciency

No Calibration

N/A

OOS Problems

Problems With System Suitability

Chromatography - Unknown Peak

HPLC Method Validation

Defecient HPLC Method

Data Integrity - Data Deletion

Data Integrity - Incomplete Data

Data Integrity - Security

Data Integrity - Fraud

Stability Testing

Sterlity

Impact of Instrument Repair / Failure

9

8

8

7

2

2

11

5

1

3

4

3

1

1

1

HPLC Methods

Would trust this data ?

Poor HPLC Use / Training

CAG EMEAI FY14 | Agilent Restricted | Page 44

Your Equipment - How DO You Know ? How Do You Know If Your Equipment Is Set up Correctly ?

How Do You Know If Your Equipment Is Working Correctly ?

Measure How it Is Setup……

Mechanical Qualification

USP Performance Verification

Test

ASTM – E2503-07 FDA – DPA-LOP.002

USP – <711>

Use a method sensitive to Variation in the instrument performance……

Dissolution Problems are one of the Top 10 reasons for Pharmaceutical Product Recall ! (Cindy Bhuse, FDA, AAPS, 2011)

CAG EMEAI FY14 | Agilent Restricted | Page 45

Dissolution and Hydrodynamics

Dissolution Vessel (In the….)

Dissolution Medium (Which contains….)

Paddle (Rotates)

Drug Product (Particles)

Drug Particle

Dissolution Medium - Sweeping past particles

Anything that influences the flow in the vessel will Change the results !

• Scratches – on paddle or vessel • Seams – if not certified vessel • Vibration • Air bubbles (if not degassed) • Bent shaft / Wobble…….. • …….Etc.

To PASS the PVT – The Instrument Must be Working Well !

CAG EMEAI FY14 | Agilent Restricted | Page 46

Dissolution “Snapshot”….

Dissolution Qualification

49% - USP PVT

29 % - Both (PVT + MQ)

20 % - MQ Only (FDA / ASTM)

2 % - In House Methods

http://www.dissolutiontech.com/DTresour/201105Articles/DT201105_A06.pdf May 2011

CAG EMEAI FY14 | Agilent Restricted | Page 47

Questions ?

Appendix

Additional Information

Word Warning - Deeper Dive

Additional Information

CAG EMEAI FY14 | Agilent Restricted | Page 50

HPLC Analysis – % Included in Warning Letter

71 % of HPLC letters Include Reference to Stability Testing

0 10 20 30 40 50 60 70 80

Calibration

Training

OOS

SSC

Method Validation

Defecient Methods

Data Integrity - Security

Data Integrity - Data Deletion

Data Integrity - Incomplete Records

Reaccurance

External Consultant Required

Data Review

Complete Data

Poor Response / CAPA

Stability

41

27

51

27

43

17

27

13

43

30

16

27

43

43

71

CAG EMEAI FY14 | Agilent Restricted | Page 51

Detailed Analysis – HPLC Warning Letters - Stability

Solution Stability

Not Stability Indicating

Storage Temperature

Storage Excursion

Validation of

Deficiencies

Deviations

Specification Failure

Storage Not Supported

Calculation of Results

Stability Testing

Facilities

Protocol

Stability Results

37 %

16 %

38 %

38 %

17 %

78 %

50 %

50 %

40 %

67 %

21 %

54 %

29 %

21 %

71 % of HPLC warning letters

Include Reference to Stability

CAG EMEAI FY14 | Agilent Restricted | Page 52

GC Analysis – % Included in Warning Letter

79 % of GC letters Include Reference to aspect of Data Integrity

0 10 20 30 40 50 60 70 80

Calibration

Training

OOS

SSC

Methods

Data Integrity

Reaccurance

External Consultant Required

Complete Data

Poor Response / CAPA

Stability

50

21

36

29

43

79

30

7

36

79

36

0 20 40 60 80

Data Integrity

Security

Manufacturing

Data Change

Data Deletion

Incomplete Records

Audit Trail

79

21

21

7

7

50

14

GC Data Integrity Review (%)

CAG EMEAI FY14 | Agilent Restricted | Page 53

Proposed <1058> Sub Classification (McDowall & Burgess)

Group A: Apparatus Group B: Instruments • Type 1: Firmware

• Type 2: Firmware plus built in calculations

• Type 3: Firmware plus user defined programs

Group C: Systems • Type 1: Low complexity system - instrument plus non-configured software

• Type 2: Medium complexity system - instrument plus configured software

• Type 3: High complexity system - Instrument plus configured software & macros