Focused on GMP in production of Active Pharmaceutical ... · Annex 2 Introduction 04 BBackground...

Regional GMP Strengthening Workshop for

Indian Pharmaceutical Manufacturers

and State Regulators




Focused on GMP in production of Active Pharmaceutical

Ingredients and Oral Solid Dosage Forms

Organized in co-operation with WHO

and MHRA expert support

Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMP




Focused on GMP in production of Active Pharmaceutical

Ingredients and Oral Solid Dosage Forms

Organized in co-operation with WHO

and MHRA expert support


a. WHO Good Manufacturing Practices For Pharmaceutical Products: Main Principles, Annex 2, 02-64

WHO Expert Committee on Specifications for Pharmaceutical Preparations Forty-eighth

report: WHO Technical Report Series No. 986, 2014

b. WHO Prequalification Team: Points to consider Regarding Documentation and Data 65-78

Management Practices and Excerpts from existing WHO Quality Assurance Guidance,

January 2014

c. Medicines and Healthcare Products Regulatory Agency (MHRA) GMP Data Integrity 79-94

Definitions and Guidance for Industry January 2015

d. EU Commission - EudraLex: The Rules Governing Medicinal Products in the European Union, 95-106

Volume 4, Good Manufacturing Practice, Medicinal Products for Human and Veterinary Use,

Chapter 4: Documentation, 2010

e. EU Commission - EudraLex: The Rules Governing Medicinal Products in the European Union, 107-114

Volume 4, Good Manufacturing Practice, Medicinal Products for Human and Veterinary Use,

Annex 11: Computerized Systems, 2010

f. Pharmaceutical Inspection Convention/ Pharmaceutical Inspection Co-Operation Scheme 115-168

(PIC/S): Good practices for Computerized Systems in regulated “GXP” environments,

September 2007

g. Pharmaceutical Inspection Convention/ Pharmaceutical Inspection Co-Operation Scheme 169-211

(PIC/S): Guide to Good Manufacturing Practice for medicinal products: Part I, March 2014

TABLE OF CONTENTS

Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPWHO Good Manufacturing Practices For Pharmaceutical Products: Main Principles, Annex 2, WHO Expert Committee on Specifications for

Pharmaceutical Preparations Forty-eighth report: WHO Technical Report Series No. 986, 2014

CHAPTER 1

Table of Contents

02 Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMP

Introduction 04

General considerations 05

Glossary 06

Quality management in the medicines industry: philosophy and essential elements 10

1. Pharmaceutical quality system 11

Quality risk management 13

Product quality review 13

2. Good manufacturing practices for pharmaceutical products 15

3. Sanitation and hygiene 17

4. Qualification and validation 18

5. Complaints 19

6. Product recalls 20

7. Contract production, analysis and other activities 21

General 21

The contract giver 21

The contract acceptor 22

The contract 22

8. Self-inspection, quality audits and suppliers’ audits and approval 24

Items for self-inspection 24

Self-inspection team 25

Frequency of self-inspection 25

Self-inspection report 25

Follow-up action 25

Quality audit 25

Suppliers’ audits and approval 26

9. Personnel 27

General 27

Key personnel 27


10. Training 32

11. Personal hygiene 33

12. Premises 34

General 34

Ancillary areas 35

Storage areas 35

Weighing areas 36

Production areas 36

Quality control areas 37

13. Equipment 38

14. Materials 39

General 39

Starting materials 39

Packaging materials 40

Intermediate and bulk products 41

Finished products 41

Rejected, recovered, reprocessed and reworked materials 41

Recalled products 42

Returned goods 42

Reagents and culture media 42

Reference standards 42

Waste materials 43

Miscellaneous 43

15. Documentation 44

General 44

Documents required 45

16. Good practices in production 54

General 54

Prevention of cross-contamination and bacterial contamination during production 55

Processing operations 56

Packaging operations 56

17. Good practices in quality control 59

Control of starting materials and intermediate, bulk and finished products 60

Test requirements 61

Batch record review 63

Stability studies 63

References 64

Annex 2

Introduction


The first WHO draft text on good manufacturing practices (GMP) was prepared in 1967 by a group of

consultants at the request of the Twentieth World Health Assembly (resolution WHA20.34). It was

subsequently submitted to the Twenty- first World Health Assembly under the title Draft requirements for

good manufacturing practice in the manufacture and quality control of medicines and pharmaceutical

specialities and was accepted.

The revised text was discussed by the WHO Expert Committee on Specifications for Pharmaceutical

Preparations in 1968 and published as an annex to its twenty-second report. The text was then reproduced

(with some revisions) in 1971 in the Supplement to the second edition of The International Pharmacopoeia.

In 1969, when the World Health Assembly recommended the first version of the WHO Certification Scheme on

the quality of pharmaceutical products moving in international commerce in resolution WHA22.50, it

accepted at the same time the GMP text as an integral part of the Scheme. Revised versions of both the

Certification Scheme and the GMP text were adopted in 1975 by resolution WHA28.65. Since then, the

Certification Scheme has been extended to include the certification of:

– veterinary products administered to food-producing animals;

– starting materials for use in dosage forms, when they are subject to control by legislation in both the

exporting Member State and the importing Member State;

– information on safety and efficacy (resolution WHA41.18, 1988).

In 1992, the revised draft requirements for GMP were presented in three parts, of which only parts 1 and 2 are

reproduced in this document (1). “Quality management in the medicines industry: philosophy and essential

elements”, outlines the general concepts of quality assurance (QA) as well as the principal components or

subsystems of GMP, which are joint responsibilities of top management and of production and quality control

management. These include hygiene, validation, self-inspection, personnel, premises, equipment,

materials and documentation.

“Good practices in production and quality control”, provides guidance on actions to be taken separately by

production and by quality control personnel for the implementation of the general principles of QA.

These two parts were subsequently supplemented by further guidelines which are integral parts of these GMP

for pharmaceutical products. All these texts are available on the Medicines web page

(http.www.who.int/medicines/ organization/qsm/activities/qualityassurance/gmp/gmpcover. html).

Annex 2


Considerable developments in GMP have taken place in the intervening years, and important national and

international documents, including new revisions, have appeared (2–5). Thus there is a necessity to revise

the main principles and incorporate the concept of validation.

Among other items of feedback discussed during the consultation on WHO guidelines for medicines quality

assurance, quality control (QC) laboratories and transfer of technology on 27–31 July 2009, the need was

identified to incorporate a new section on “Product quality review” under Chapter 1: “Quality assurance”.

In addition, several updates were suggested to further enhance the guidelines. These included the concept of

risk management, replacing “drugs” by the term “medicines” and introducing the concept of a “quality unit”.

During 2012 the Secretariat was made aware that the current Good manufacturing practices (GMP) for

pharmaceutical products: main principles, published as Annex 3 in the WHO Technical Report Series, No. 961,

2011, would need updating (http://www.who.int/medicines/areas/quality_safety/quality_

assurance/production/en/index.html - Quality assurance of pharmaceuticals: a compendium of guidelines

and related materials).

The WHO Expert Committee on Specifications for Pharmaceutical Preparations discussed the need for an

update during its forty-seventh meeting and agreed to pursue the matter accordingly.

The following sections were updated in the newly revised version and, after the usual consultation process,

were presented to the forty-eighth Expert Committee for adoption:

Section: Pharmaceutical quality system

Section 2: 2. Good manufacturing practices for pharmaceutical products

Section 7: Contract production, analysis and other activities

Section 17: 17. Good practices in quality control

General considerations

Licensed pharmaceutical products (marketing authorization) should be manufactured only by licensed

manufacturers (holders of a manufacturing authorization) whose activities are regularly inspected by

competent national authorities. This guide to GMP shall be used as a standard to justify GMP status, which

constitutes one of the elements of the WHO Certification Scheme on the quality of pharmaceutical products

moving in international commerce, through the assessment of applications for manufacturing

authorizations and as a basis for the inspection of manufacturing facilities. It may also be used as training

material for government medicines inspectors, as well as for production, QC and QA personnel in the

industry.

Annex 2


The guide is applicable to operations for the manufacture of medicines in their finished dosage forms,

including large-scale processes in hospitals and the preparation of supplies for use in clinical trials.

2The good practices outlined below are to be considered general guides, and they may be adapted to meet

individual needs. The equivalence of alternative approaches to QA, however, should be validated. The guide

as a whole does not cover safety aspects for the personnel engaged in manufacture, or environmental

protection: these are normally governed by national legislation. A new concept of hazard analysis related to

the risks in production and personnel safety has also been recently recommended (WHO Technical Report

Series, No. 961, Annex 7). The manufacturer should assure the safety of workers and take the necessary

measures to prevent pollution of the external environment.

International Nonproprietary Names (INN) for pharmaceutical substances designated by WHO should be

used when available, together with other designated names.

The definitions given below apply to the terms used in this guide. They may have different meanings in other

contexts.

Active pharmaceutical ingredient (API). Any substance or mixture of substances intended to be used in the

manufacture of a pharmaceutical dosage form and that, when so used, becomes an active ingredient of that

pharmaceutical dosage form. Such substances are intended to furnish pharmacological activity or other

direct effect in the diagnosis, cure, mitigation, treatment, or prevention of disease or to affect the structure

and function of the body.

Airlock. An enclosed space with two or more doors, which is interposed between two or more rooms, e.g. of

differing classes of cleanliness, for the purpose of controlling the airflow between those rooms when they

need to be entered. An airlock is designed for use either by people or for goods and/or equipment.

Authorized person. The person recognized by the national regulatory authority as having the responsibility

for ensuring that each batch of finished product has been manufactured, tested and approved for release in

compliance with the laws and regulations in force in that country.

Batch (or lot). A defined quantity of starting material, packaging material, or product processed in a single

process or series of processes so that it is expected to be homogeneous. It may sometimes be necessary to

divide a batch into a number of sub-batches, which are later brought together to form a final homogeneous

batch. In the case of terminal sterilization, the batch size is determined by the capacity of the autoclave. In

continuous manufacture, the batch must correspond to a defined fraction of the production, characterized

by its intended homogeneity. The batch size can be defined either as a fixed quantity or as the amount

produced in a fixed time interval.

Glossary

2The word “should” in the text means a strong recommendation.

Annex 2


batch number (or lot number). A distinctive combination of numbers and/or letters which uniquely

identifies a batch on the labels, its batch records and corresponding certificates of analysis, etc.

batch records. All documents associated with the manufacture of a batch of bulk product or finished product.

They provide a history of each batch of product and of all circumstances pertinent to the quality of the final

product.

bulk product. Any product that has completed all processing stages up to, but not including, final packaging.

calibration. The set of operations that establish, under specified conditions, the relationship between

values indicated by an instrument or system for measuring (especially weighing), recording, and controlling,

or the values represented by a material measure, and the corresponding known values of a reference

standard. Limits for acceptance of the results of measuring should be established.

clean area. An area with defined environmental control of particulate and microbial contamination,

constructed and used in such a way as to reduce the introduction, generation, and retention of contaminants

within the area.

consignment (or delivery). The quantity of a pharmaceutical or pharmaceuticals, made by one

manufacturer and supplied at one time in response to a particular request or order. A consignment may

comprise one or more packages or containers and may include material belonging to more than one batch.

contamination. The undesired introduction of impurities of a chemical or microbiological nature, or of

foreign matter, into or on to a starting material or intermediate during production, sampling, packaging or

repackaging, storage or transport.

critical operation. An operation in the manufacturing process that may cause variation in the quality of the

pharmaceutical product.

cross-contamination. Contamination of a starting material, intermediate product or finished product with

another starting material or product during production.

finished product. A finished dosage form that has undergone all stages of manufacture, including

packaging in its final container and labelling.

in-process control. Checks performed during production in order to monitor and, if necessary, to adjust the

process to ensure that the product conforms to its specifications. The control of the environment or

equipment may also be regarded as a part of in-process control.

intermediate product. Partly processed product that must undergo further manufacturing steps before it

becomes a bulk product.

large-volume parenterals. Sterile solutions intended for parenteral application with a volume of 100 ml or

more in one container of the finished dosage form.

08

manufacture. All operations of purchase of materials and products, production, quality control (QC),

release, storage and distribution of pharmaceutical products, and the related controls.

manufacturer. A company that carries out operations such as production, packaging, repackaging, labelling

and relabelling of pharmaceuticals.

marketing authorization (product licence, registration certificate). A legal document issued by the

competent medicines regulatory authority that establishes the detailed composition and formulation of the

product and the pharmacopoeial or other recognized specifications of its ingredients and of the final product

itself, and includes details of packaging, labelling and shelf-life.

master formula. A document or set of documents specifying the starting materials with their quantities and

the packaging materials, together with a description of the procedures and precautions required to produce

a specified quantity of a finished product as well as the processing instructions, including the in-process

controls.

master record. A document or set of documents that serve as a basis for the batch documentation (blank

batch record).

packaging. All operations, including filling and labelling, that a bulk product has to undergo in order to

become a finished product. Filling of a sterile product under aseptic conditions or a product intended to be

terminally sterilized, would not normally be regarded as part of packaging.

packaging material. Any material, including printed material, employed in the packaging of a

pharmaceutical, but excluding any outer packaging used for transportation or shipment. Packaging

materials are referred to as primary or secondary according to whether or not they are intended to be in direct

contact with the product.

pharmaceutical product. Any material or product intended for human or veterinary use presented in its

finished dosage form, or as a starting material for use in such a dosage form, that is subject to control by

pharmaceutical legislation in the exporting state and/or the importing state.

production. All operations involved in the preparation of a pharmaceutical product, from receipt of

materials, through processing, packaging and repackaging, labelling and relabelling, to completion of the

finished product.

qualification. Action of proving that any premises, systems and items of equipment work correctly and

actually lead to the expected results. The meaning of the word “validation” is sometimes extended to

incorporate the concept of qualification.

quality assurance. See Part 1 (6).

quality control. See Part 1 (6).

Annex 2


09

quality unit(s). An organizational unit independent of production which fulfils both quality assurance (QA)

and quality control (QC) responsibilities. This can be in the form of separate QA and QC units or a single

individual or group, depending upon the size and structure of the organization.

quarantine. The status of starting or packaging materials, intermediates, or bulk or finished products

isolated physically or by other effective means while a decision is awaited on their release, rejection or

reprocessing.

reconciliation. A comparison between the theoretical quantity and the actual quantity.

recovery. The introduction of all or part of previous batches (or of redistilled solvents and similar products) of

the required quality into another batch at a defined stage of manufacture. It includes the removal of

impurities from waste to obtain a pure substance or the recovery of used materials for a separate use.

reprocessing. Subjecting all or part of a batch or lot of an in-process medicine, bulk process intermediate

(final biological bulk intermediate) or bulk product of a single batch or lot to a previous step in the validated

manufacturing process due to failure to meet predetermined specifications. Reprocessing procedures are

foreseen as occasionally necessary for biological medicines and, in such cases, are validated and pre-

approved as part of the marketing authorization.

reworking. Subjecting an in-process or bulk process intermediate (final biological bulk intermediate) or

final product of a single batch to an alternate manufacturing process due to a failure to meet predetermined

specifications. Reworking is an unexpected occurrence and is not pre-approved as part of the marketing

authorization.

self-contained area. Premises which provide complete and total separation of all aspects of an operation,

including personnel and equipment movement, with well established procedures, controls and monitoring.

This includes physical barriers as well as separate air-handling systems, but does not necessarily imply two

distinct and separate buildings.

specification. A list of detailed requirements with which the products or materials used or obtained during

manufacture have to conform. They serve as a basis for quality evaluation.

standard operating procedure (SOP). An authorized written procedure giving instructions for performing

operations not necessarily specific to a given product or material (e.g. equipment operation, maintenance

and cleaning; validation; cleaning of premises and environmental control; sampling and inspection). Certain

SOPs may be used to supplement product-specific master and batch production documentation.

starting material. Any substance of a defined quality used in the production of a pharmaceutical product,

but excluding packaging materials.

validation. Action of proving, in accordance with the principles of GMP, that any procedure, process,

equipment, material, activity or system actually leads to the expected results (see also qualification).

Annex 2


10

Quality management in the medicines industry: philosophy and essential 3elements

In the medicines industry at large, quality management is usually defined as the aspect of the management

function that determines and implements the “quality policy”, i.e. the overall intention and direction of an

organization regarding quality, as formally expressed and authorized by top management. The basic

elements of quality management are:

– an appropriate infrastructure or “quality system”, encompassing the organizational structure,

procedures, processes and resources;

– systematic actions necessary to ensure adequate confidence that a product (or service) will satisfy

given requirements for quality.

The totality of these actions is termed “QA”. Within an organization, QA serves as a management tool. In

contractual situations, QA also serves to generate confidence in the supplier. The concepts of QA, GMP, QC and

quality risk management (QRM) are interrelated aspects of quality management and should be the

responsibility of all personnel. They are described here in order to emphasize their relationship and their

fundamental importance to the production and control of pharmaceutical products.

Annex 2


3Good manufacturing practices for pharmaceutical products, Part One. In: WHO Expert Committee on Specifications for Pharmaceutical Preparations. Thirty-second report. Geneva, World Health Organization, 1992, Annex 1 (WHO Technical Report Series, No. 823); and in: Quality assurance of pharmaceuticals. A compendium of guidelines and related materials. Volume 2, 2nd updated edition. Good manufacturing practices and inspection. Geneva, World Health Organization, 2007; and in: Quality assurance of pharmaceuticals. A compendium of guidelines and related materials. Geneva, World Health Organization, 2010 (CD-ROM).

11

1.1 Principle. The manufacturer must assume responsibility for the quality of the pharmaceutical products to

ensure that they are fit for their intended use, comply with the requirements of the marketing

authorization and do not place patients at risk due to inadequate safety, quality or efficacy.

The attainment of this quality objective is the responsibility of senior management and requires the

participation and commitment of staff in many different departments and at all levels within the

company, the company's suppliers and the distributors. To achieve this quality objective reliably

there must be a comprehensively designed and correctly implemented pharmaceutical quality system

(PQS) incorporating GMP and QRM

1.2 Senior management has the ultimate responsibility to ensure an effective PQS is in place, is adequately

resourced, and that roles, responsibilities, and authorities are defined, communicated and implemented

throughout the organization. Senior management's leadership and active participation in the PQS is

essential. This leadership should ensure the support and commitment of staff at all levels and sites

within the organization to the PQS.

1.3 Quality management is a wide-ranging concept covering all matters that individually or collectively

influence the quality of a product. It is the totality of the arrangements made with the object of ensuring

that pharmaceutical products are of the quality required for their intended use. Quality management,

therefore, incorporates GMP and other factors, including those outside the scope of this guide, such as

product design and development.

1.4 GMP applies to the life-cycle stages from the manufacture of investigational medicinal products,

technology transfer, and commercial manufacturing, through to product discontinuation. The PQS

can extend to the pharmaceutical development life-cycle stage and should facilitate innovation and

continual improvement and strengthen the link between pharmaceutical development and

manufacturing activities. All parts of the PQS should be adequately resourced and maintained,

including being provided with sufficient competent personnel, suitable premises, equipment and

facilities.

1.5 The PQS appropriate to the manufacture of pharmaceutical products should ensure that:

a) product realization is achieved by designing, qualifying, planning, implementing, maintaining and

continuously improving a system that allows the consistent delivery of products with appropriate

quality attributes;

Annex 2


1. Pharmaceutical quality system

12

b) product and process knowledge is managed throughout all life- cycle stages;

c) pharmaceutical products are designed and developed in a way that takes account of the

requirements of GMP and other associated codes such as those of good laboratory practice (GLP) and

good clinical practice (GCP);

d) production and control operations are clearly specified in a written form and GMP requirements are

adopted;

e) managerial responsibilities are clearly specified in job descriptions;

f ) arrangements are made for the manufacture, supply and use of the correct starting and packaging

materials, the selection and monitoring of suppliers and for verifying that each delivery is the

correct material from the approved supply chain;

g) all necessary controls on starting materials, intermediate products, and bulk products and other in-

process controls, calibrations and validations are carried out;

h) the finished product is correctly processed and checked, according to the defined procedures;

i) pharmaceutical products are not sold or supplied before the authorized persons (see also sections

9.11 and 9.12) have certified that each production batch has been produced and controlled in

accordance with the requirements of the marketing authorization and any other regulations

relevant to the production, control and release of pharmaceutical products;

j) processes are in place to assure the management of outsourced activities;

k) satisfactory arrangements exist to ensure, as far as possible, that the pharmaceutical products are

stored, distributed and subsequently handled so that quality is maintained throughout their shelf-

life;

l) there is a procedure for self-inspection and/or quality audit that regularly appraises the

effectiveness and applicability of the PQS;

m) product and processes are monitored and the results taken into account in batch release, in the

investigation of deviations and, with a view to taking preventive action to avoid potential deviations

occurring in the future;

n) arrangements are in place for the prospective evaluation and approval of planned changes and their

approval prior to implementation taking into account regulatory notification and approval where

required. After implementation of any change, an evaluation is undertaken to confirm that the

quality objectives were achieved and that there was no unintended adverse impact on product

quality;

Annex 2


13

o) regular reviews of the quality of pharmaceutical products are conducted with the objective of

verifying the consistency of the process and identifying where there is a need for improvement;

p) a state of control is established and maintained by developing and using effective monitoring and

control systems for process performance and product quality;

q) continual improvement is facilitated through the implementation of quality improvements

appropriate to the current level of process and product knowledge;

r) there is a system for QRM;

s) deviations, suspected product defects and other problems are reported, investigated and recorded.

An appropriate level of root cause analysis is applied during such investigations. The most likely root

cause(s) should be identified and appropriate corrective actions and/or preventive actions (CAPAs)

should be identified and taken. The effectiveness of CAPAs should be monitored.

1.6 There should be periodic management reviews, with the involvement of senior management, of the

operation of the PQS to identify opportunities for continual improvement of products, processes and the

system itself. Unless otherwise justified, such reviews should be conducted at least annually.

1.7 The PQS should be defined and documented. A quality manual or equivalent documentation should be

established and should contain a description of the quality management system including management

responsibilities.

1.8 QRM is a systematic process for the assessment, control, communication and review of risks to the quality

of the medicinal product. It can be applied both proactively and retrospectively.

1.9 QRM should ensure that:

– the evaluation of the risk to quality is based on scientific knowledge, experience with the process

and ultimately links to the protection of the patient;

– the level of effort, formality and documentation of the QRM process is commensurate with the level

of risk.

1.10 Regular, periodic or rolling quality reviews of all pharmaceutical products, including export-only

products, should be conducted with the objective of verifying the consistency of the existing process

and the appropriateness of current specifications for both starting materials and finished product, to

highlight any trends and to identify product and process improvements.

Quality risk management

Product quality review

Annex 2


14

Such reviews should normally be conducted and documented annually, taking into account previous

reviews, and should include at least:

a) review of starting materials and packaging materials used for the product, especially those from new

sources and in particular the review of supply chain traceability of active substances;

b) a review of critical in-process controls, and finished product results;

c) a review of all batches that failed to meet established specification(s) and their investigation;

d) a review of all significant deviations or non-conformances, the related investigations and the

effectiveness of resultant CAPAs taken;

e) a review of all changes made to the processes or analytical methods;

f ) a review of dossier variations submitted, granted or refused;

g) a review of the results of the stability monitoring programme and any adverse trends;

h) a review of all quality-related returns, complaints and recalls and the investigations performed at

the time;

i) a review of adequacy of any other previous corrective actions on product processes or equipment;

j) post-marketing commitments for new dossiers and variations to the dossiers;

k) the qualification status of relevant equipment and utilities, e.g. heating, ventilation and air-

conditioning (HVAC), water or compressed gases and a review of the results of monitoring the output

of such equipment and utilities;

l) a review of technical agreements to ensure that they are up to date.

The manufacturer and, where different, marketing authorization holder, should evaluate the results of the

review and an assessment should be made as to whether CAPA or any revalidation should be undertaken,

under the PQS. CAPAs should be completed in a timely and effective manner, according to documented

procedures. There should be procedures for the ongoing management and review of these actions, and the

effectiveness of these procedures should be verified during self-inspection. Quality reviews may be grouped

by product type, e.g. solid dosage forms, liquid dosage forms, or sterile products, where scientifically

justified. Where the marketing authorization holder is not the manufacturer, there should be a technical

agreement in place between the various parties that defines their respective responsibilities in producing

the quality review. The authorized person responsible for final batch certification, together with the

marketing authorization holder, should ensure that the quality review is performed in a timely manner and is

accurate.

Annex 2


15

2.1 GMP is that part of quality management which ensures that products are consistently produced and

controlled according to the quality standards appropriate to their intended use and as required by

the marketing authorization, clinical trial authorization or product specification. GMP is concerned

with both production and QC. GMP is aimed primarily at managing and minimizing the risks inherent in

pharmaceutical manufacture to ensure the quality, safety and efficacy of products. Under GMP:

a) all manufacturing processes are clearly defined, systematically reviewed for associated risks in the

light of scientific knowledge and experience, and shown to be capable of consistently

manufacturing pharmaceutical products of the required quality that comply with their

specifications;

b) qualification and validation are performed;

c) all necessary resources are provided, including:

(i) sufficient and appropriately qualified and trained personnel,

(ii) adequate premises and space,

(iii) suitable equipment and services,

(iv) appropriate materials, containers and labels,

(v) approved procedures and instructions,

(vi) suitable storage and transport,

(vii) adequate personnel, laboratories and equipment for in-process controls;

d) instructions and procedures are written in clear and unambiguous language, specifically applicable

to the facilities provided;

e) procedures are carried out correctly and personnel are trained to do so;

f ) records are made (manually and/or by recording instruments) during manufacture to show that all


Annex 2

2. Good manufacturing practices for pharmaceutical products

16

the steps required by the defined procedures and instructions have in fact been taken and that the

quantity and quality of the product are as expected. Any significant deviations are fully recorded and

investigated with the objective of determining the root cause and appropriate corrective and

preventive action is implemented;

g) records covering manufacture and distribution, which enable the complete history of a batch to be

traced, are retained in a comprehensible and accessible form;

h) the proper storage and distribution of the products minimizes any risk to their quality and takes

account of good distribution practices (GDP);

i) a system is available to recall any batch of product from sale or supply;

j) complaints about marketed products are examined, the causes of quality defects investigated and

appropriate measures taken in respect of the defective products to prevent recurrence.

Annex 2


17

3.1 A high level of sanitation and hygiene should be practised in every aspect of the manufacture of

medicines. The scope of sanitation and hygiene covers personnel, premises, equipment and apparatus,

production materials and containers, products for cleaning and disinfection, and anything that could

become a source of contamination to the product. Potential sources of contamination should be

eliminated through an integrated comprehensive programme of sanitation and hygiene. (For Personal

hygiene see section 11, and for sanitation see section 12, “Premises”.)

Annex 2


Sanitation and hygiene

18

4.1 In accordance with GMP, each pharmaceutical company should identify what qualification and

validation work is required to prove that the critical aspects of their particular operation are controlled.

4.2 The key elements of a qualification and validation programme of a company should be clearly defined

and documented in a validation master plan.

4.3 Qualification and validation should establish and provide documentary evidence that:

a) the premises, supporting utilities, equipment and processes have been designed in accordance with

the requirements for GMP (design qualification or DQ);

b) the premises, supporting utilities and equipment have been built and installed in compliance with

their design specifications (installation qualification or IQ);

c) the premises, supporting utilities and equipment operate in accordance with their design

specifications (operational qualification or OQ);

d) a specific process will consistently produce a product meeting its predetermined specifications and

quality attributes (process validation or PV, also called performance qualification or PQ).

4.4 Any aspect of operation, including significant changes to the premises, facilities, equipment or

processes, which may affect the quality of the product, directly or indirectly, should be qualified and

validated.

4.5 Qualification and validation should not be considered as one-off exercises. An ongoing programme

should follow their first implementation and should be based on an annual review.

4.6 The commitment to maintain continued validation status should be stated in the relevant company

documentation, such as the quality manual or validation master plan.

4.7 The responsibility for performing validation should be clearly defined.

4.8 Validation studies are an essential part of GMP and should be conducted in accordance with predefined

and approved protocols.

4.9 A written report summarizing the results recorded and the conclusions reached should be prepared and

stored.

4.10 Processes and procedures should be established on the basis of the results of the validation performed.

4.11 Particular attention should be paid to the validation of analytical test methods, automated systems

and cleaning procedures.

Annex 2


4. Qualification and validation

5.1 Principle. All complaints and other information concerning potentially defective products should be

carefully reviewed according to written procedures and the corrective action should be taken.

5.2 A person responsible for handling the complaints and deciding the measures to be taken should

be designated, together with sufficient supporting staff to assist him or her. If this person is different

from the authorized person, the latter should be made aware of any complaint, investigation or recall.

5.3 There should be written procedures describing the action to be taken, including the need to consider a

recall, in the case of a complaint concerning a possible product defect.

5.4 Special attention should be given to establishing that the product that gave rise to a complaint was

defective.

5.5 Any complaint concerning a product defect should be recorded with all the original details and

thoroughly investigated. The person responsible for QC should normally be involved in the review of

such investigations.

5.6 If a product defect is discovered or suspected in a batch, consideration should be given to whether other

batches should be checked in order to determine whether they are also affected. In particular, other

batches that may contain reprocessed product from the defective batch should be investigated.

5.7 Where necessary, appropriate follow-up action, possibly including product recall, should be taken after

investigation and evaluation of the complaint.

5.8 All decisions made and measures taken as a result of a complaint should be recorded and referenced to

the corresponding batch records.

5.9 Complaints records should be regularly reviewed for any indication of specific or recurring problems

that require attention and might justify the recall of marketed products.

5.10 The competent authorities should be informed if a manufacturer is considering action following

possibly faulty manufacture, product deterioration, a suspect product or any other serious quality

problems with a product.

19

Annex 2


5. Complaints

20

6.1 Principle. There should be a system to recall from the market, promptly and effectively, products known

or suspected to be defective.

6.2 The authorized person should be responsible for the execution and coordination of recalls. He or

she should have sufficient staff to handle all aspects of the recalls with the appropriate degree of

urgency.

6.3 There should be established written procedures, which are regularly reviewed and updated, for the

organization of any recall activity. Recall operations should be capable of being initiated promptly down

to the required level in the distribution chain.

6.4 An instruction should be included in the written procedures to store recalled products in a secure

segregated area while their fate is decided.

6.5 All competent authorities of all countries to which a given product has been distributed should be

promptly informed of any intention to recall the product because it is, or is suspected of being,

defective.

6.6 The distribution records should be readily available to the authorized person, and they should contain

sufficient information on wholesalers and directly supplied customers (including, for exported

products, those who have received samples for clinical tests and medical samples) to permit an effective

recall.

6.7 The progress of the recall process should be monitored and recorded. Records should include the

disposition of the product. A final report should be issued, including a reconciliation between the

delivered and recovered quantities of the products.

6.8 The effectiveness of the arrangements for recalls should be tested and evaluated from time to time.

Annex 2


6. Product recalls

21

7.1 Principle. Contract production, analysis and any other activity covered by GMP must be correctly

defined, agreed and controlled in order to avoid misunderstandings that could result in a product, or

work or analysis, of unsatisfactory quality.

7.2 All arrangements for contract production and analysis, including technology transfer and any

proposed changes in technical or other arrangements, should be in accordance with the marketing

authorization for the product concerned.

7.3 The contract should permit the contract giver to audit the facilities and activities of the contract acceptor

or mutually agreed subcontractors.

7.4 In the case of contract analysis, the final approval for release must be given by the authorized person

in accordance with GMP and the marketing authorization as specified in the contract.

7.5 The PQS of the contract giver should include the control and review of any outsourced activities. The

contract giver is responsible for assessing the legality, suitability and competence of the contract

acceptor to successfully carry out the work or tests required, for approval for contract activities, and for

ensuring by means of the contract that the principles of GMP incorporating QRM principles are

followed.

7.6 The contract giver should provide the contract acceptor with all the information necessary to carry

out the contracted operations correctly in accordance with the marketing authorization and any

other legal requirements. The contract giver should ensure that the contract acceptor is fully aware of

any hazards associated with the product, work or tests that might pose a risk to premises, equipment,

personnel, other materials or other products.

7.7 The contract giver should review and assess the records and results related to the outsourced activities.

The contract giver should ensure that all products and materials delivered by the contract acceptor have

been processed in accordance with GMP and the marketing authorization; comply with their

specifications and that the product has been released by the authorized person in accordance with

GMP and the marketing authorization.

General

The contract giver

Annex 2


7. Contract production, analysis and other activities

22

7.8 The contract giver should monitor and review the performance of the contract acceptor including the

implementation of any needed improvements and their effectiveness.

7.9 The contract giver is responsible for ensuring that the contract acceptor understands that his or her

activities may be subject to inspection by competent authorities.

7.10 The contract acceptor must have adequate premises, equipment, knowledge, experience and

competent personnel to satisfactorily carry out the work ordered by the contract giver. Contract

manufacture may be undertaken only by a manufacturer who holds a valid manufacturing

authorization.

7.11 The contract acceptor should not pass to a third party any of the work entrusted to him or her under the

contract without the contract giver’s prior evaluation and approval of the arrangements. Arrangements

made between the contract acceptor and any third party should ensure that information and

knowledge, including that from assessments of the suitability of the third party, are made available in

the same way as between the original contract giver and contract acceptor.

7.12 The contract acceptor should refrain from any activity (including unauthorized changes outside

the terms of the contract) that may adversely affect the quality of the product manufactured and/or

analysed for the contract giver.

7.13 There must be a written contract between the contract giver and the contract acceptor which clearly

establishes the responsibilities of each party, covering the outsourced activities, the products or

operations to which they are related, communication processes relating to the outsourced activities

and any technical arrangements made in connection with it.

7.14 The contract must clearly state the way in which the authorized person, in releasing each batch of

product for sale or issuing the certificate of analysis, exercises his or her full responsibility and ensures

that each batch has been manufactured in, and checked for, compliance with the requirements of the

marketing authorization.

7.15 Technical aspects of the contract should be drawn up by competent persons with suitable knowledge

of pharmaceutical technology, analysis and GMP.

7.16 All arrangements for production and analysis must be in accordance with the marketing authorization

and agreed by both parties.

7.17 The contract should clearly describe who is responsible for contracted activities, e.g. knowledge

management, technology transfer, supply chain, subcontracting, testing and releasing materials and

The contract acceptor

The contract

Annex 2


23

undertaking production and QC, including in-process controls, and who has responsibility for

sampling and analysis. In the case of contract analysis, the contract should state whether or not the

contract acceptor should take samples at the premises of the manufacturer.

7.18 Manufacturing, analytical and distribution records, and reference samples, should be kept by, or be

available to, the contract giver. Any records relevant to assessing the quality of a product in the event of

complaints or a suspected defect, or to investigating in the case of a suspected falsified product or

laboratory fraud, must be accessible and specified in the procedures of the contract giver.

7.19 The contract should describe the handling of starting materials, intermediate, bulk and finished

products, if they are rejected. It should also describe the procedure to be followed if the contract

analysis shows that the tested product must be rejected.

Annex 2


Annex 2

8. Self-inspection, quality audits and suppliers' audits and approval

24

8.1 Principle. The purpose of self-inspection is to evaluate the manufacturer's compliance with GMP in all

aspects of production and QC. The self- inspection programme should be designed to detect any

shortcomings in the implementation of GMP and to recommend the necessary corrective actions. Self-

inspections should be performed routinely, and may be, in addition, performed on special occasions,

e.g. in the case of product recalls or repeated rejections, or when an inspection by the health authorities

is announced. The team responsible for self-inspection should consist of personnel who can evaluate

the implementation of GMP objectively. All recommendations for corrective action should be

implemented. The procedure for self-inspection should be documented, and there should be an effective

follow-up programme.

8.2 Written instructions for self-inspection should be established to provide a minimum and uniform

standard of requirements. These may include questionnaires on GMP requirements covering at least the

following items:

(a) personnel;

(b) premises including personnel facilities;

(c) maintenance of buildings and equipment;

(d) storage of starting materials and finished products;

(e) equipment;

(f ) production and in-process controls;

(g) QC;

(h) documentation;

(i) sanitation and hygiene;

(j) validation and revalidation programmes;

Items for self-inspection


25

(k) calibration of instruments or measurement systems;

(l) recall procedures;

(m) complaints management;

(n) labels control;

(o) results of previous self-inspections and any corrective steps taken.

8.3 Management should appoint a self-inspection team consisting of experts in their respective fields who

are familiar with GMP. The members of the team may be appointed from inside or outside the company.

8.4 The frequency with which self-inspections are conducted may depend on company requirements but

should preferably be at least once a year. The frequency should be stated in the procedure.

8.5 A report should be made at the completion of a self-inspection. The report should include:

(a) self-inspection results;

(b) evaluation and conclusions;

(c) recommended corrective actions.

8.6 There should be an effective follow-up programme. The company management should evaluate

both the self-inspection report and the corrective actions as necessary.

8.7 It may be useful to supplement self-inspections with a quality audit. A quality audit consists of an

examination and assessment of all or part of a quality system with the specific purpose of improving it. A

quality audit is usually conducted by outside or independent specialists or a team designated by the

management for this purpose. Such audits may also be extended to suppliers and contractors (see

section 7, “Contract production and analysis”).

Self-inspection team

Frequency of self-inspection

Self-inspection report

Follow-up action

Quality audit

Annex 2


26

Suppliers' audits and approval

8.8 The person responsible for QC should have responsibility, together with other relevant departments, for

approving suppliers who can reliably supply starting and packaging materials that meet established

specifications.

8.9 Before suppliers are approved and included in the approved suppliers' list or specifications, they should

be evaluated. The evaluation should take into account a supplier's history and the nature of the

materials to be supplied. If an audit is required, it should determine the supplier's ability to conform with

GMP standards.

Annex 2


27

9.1 Principle. The establishment and maintenance of a satisfactory system of QA and the correct manufacture

and control of pharmaceutical products and active ingredients rely upon people. For this reason there

must be sufficient qualified personnel to carry out all the tasks for which the manufacturer is

responsible. Individual responsibilities should be clearly defined and understood by the persons

concerned and recorded as written descriptions.

9.2 The manufacturer should have an adequate number of personnel with the necessary qualifications and

practical experience. The responsibilities placed on any one individual should not be so extensive as to

present any risk to quality.

9.3 Responsible staff should have its specific duties recorded in written descriptions and adequate

authority to carry out its responsibilities. Its duties may be delegated to designated deputies with a

satisfactory level of qualifications. There should be no gaps or unexplained overlaps in the

responsibilities of personnel concerned with the application of GMP. The manufacturer should have an

organization chart.

9.4 All personnel should be aware of the principles of GMP that affect them and receive initial and continuing

training, including hygiene instruction, relevant to their needs. All personnel should be motivated to

support the establishment and maintenance of high quality standards.

9.5 Steps should be taken to prevent unauthorized people from entering production, storage and QC

areas. Personnel who do not work in these areas should not use them as a passageway.

9.6 Key personnel include the heads of production, the head(s) of quality unit(s) and the authorized person.

The quality unit(s) typically comprise the quality assurance and quality control functions. In some cases,

these could be combined in one department. The authorized person may also be responsible for one or

more of these quality unit(s). Normally, key posts should be occupied by full-time personnel. The heads

of production and quality unit(s) should be independent of each other. In large organizations, it may be

necessary to delegate some of the functions; however, the responsibility cannot be delegated.

9.7 Key personnel responsible for supervising the production and quality unit(s) for pharmaceutical

products should possess the qualifications of a scientific education and practical experience required by

national legislation. Their education should include the study of an appropriate combination of:

General

Key personnel

Annex 2


9. Personnel

28

(a) chemistry (analytical or organic) or biochemistry;

(b) chemical engineering;

(c) microbiology;

(d) pharmaceutical sciences and technology;

(e) pharmacology and toxicology;

(f ) physiology;

(g) other related sciences.

They should also have adequate practical experience in the manufacture and QA of pharmaceutical

products. In order to gain such experience, a preparatory period may be required, during which they

should perform their duties under professional guidance. The scientific education and practical

experience of experts should be such as to enable them to exercise independent professional judgement,

based on the application of scientific principles and understanding to the practical problems encountered in

the manufacture and QC of pharmaceutical products.

9.8 The heads of the production and the quality unit(s) generally have some shared, or jointly exercised,

responsibilities relating to quality. These may include, depending on national regulations:

(a) authorization of written procedures and other documents, including amendments;

(b) monitoring and control of the manufacturing environment;

(c) plant hygiene;

(d) process validation and calibration of analytical apparatus;

(e) training, including the application and principles of QA;

(f ) approval and monitoring of suppliers of materials;

(g) approval and monitoring of contract manufacturers;

(h) designation and monitoring of storage conditions for materials and products;

(i) performance and evaluation of in-process controls;

(j) retention of records;

Annex 2


29

(k) monitoring of compliance with GMP requirements;

(l) inspection, investigation and taking of samples in order to monitor factors that may affect product

quality.

9.9 The head of production generally has the following responsibilities:

(a) to ensure that products are produced and stored in accordance with the appropriate documentation

in order to obtain the required quality;

(b) to approve the instructions relating to production operations, including the in-process controls, and

to ensure their strict implementation;

(c) to ensure that the production records are evaluated and signed by a designated person;

(d) to check the maintenance of the department, premises and equipment;

(e) to ensure that the appropriate process validations and calibrations of control equipment are

performed and recorded and the reports made available;

(f ) to ensure that the required initial and continuing training of production personnel is carried out and

adapted according to need.

9.10 The head(s) of the quality unit(s) generally have the following responsibilities:

(a) to approve or reject starting materials, packaging materials, and intermediate, bulk and finished

products in relation to their specifications;

(b) to evaluate batch records;

(c) to ensure that all necessary testing is carried out;

(d) to approve sampling instructions, specifications, test methods and other QC procedures;

(e) to approve and monitor analyses carried out under contract

(f ) to check the maintenance of the department, premises and equipment; (g) to ensure that the

appropriate validations, including those of analytical procedures, and calibrations of control

equipment are carried out;

(h) to ensure that the required initial and continuing training of quality unit personnel is carried out and

adapted according to need;

Annex 2


30

(i) establishment, implementation and maintenance of the quality system;

(j) supervision of the regular internal audits or self-inspections;

(k) participation in external audit (vendor audit);

(l) participation in validation programmes.

Other duties of QC are summarized in sections 17.3 and 17.4.

9.11 The authorized person is responsible for compliance with technical or regulatory requirements related

to the quality of finished products and the approval of the release of the finished product for sale or

supply.

9.12 Assessment of finished products should embrace all relevant factors, including the production

conditions, the results of in-process testing, the manufacturing (including packaging)

documentation, compliance with the specification for the finished product, and an examination of the

finished pack.

9.13 No batch of product is to be released for sale or supply prior to certification by the authorized person(s).

In certain countries, by law, the batch release is a task of the authorized person from production

together with the authorized person from QC.

9.14 The authorized person responsible for approving a batch for release should always ensure that the

following requirements have been met:

(a) the marketing authorization and the manufacturing authorization requirements for the product

have been met for the batch concerned;

(b) the principles and guidelines of GMP, as laid down in the guidelines published by WHO, have been

followed;

(c) the principal manufacturing and testing processes have been validated;

(d) all the necessary checks and tests have been performed and account taken of the production

conditions and manufacturing records;

(e) any planned changes or deviations in manufacturing or QC have been notified in accordance with a

well-defined reporting system before any product is released. Such changes may need notification

to, and approval by, the medicines regulatory authority;

(f ) any additional sampling, inspection, tests and checks have been carried out or initiated, as

appropriate, to cover planned changes and deviations;

Annex 2


31

(g) all necessary production and QC documentation has been completed and endorsed by supervisors

trained in appropriate disciplines;

(h) appropriate audits, self-inspections and spot-checks are carried out by experienced and trained

staff;

(i) approval has been given by the head of QC;

(j) all relevant factors have been considered, including any not specifically associated with the output

batch directly under review (e.g. subdivision of output batches from a common input, factors

associated with continuous production runs).

9.15 The function of the approval of the release of a finished batch or a product can be delegated to a

designated person with appropriate qualifications and experience who will release the product in

accordance with an approved procedure. This is normally done by QA by means of batch review.

Annex 2


32

10.1 The manufacturer should provide training in accordance with a written programme for all personnel

whose duties take them into manufacturing areas or into control laboratories (including the technical,

maintenance and cleaning personnel) and for other personnel as required.

10.2 Besides basic training on the theory and practice of GMP, newly recruited personnel should receive

training appropriate to the duties assigned to them. Continuing training should also be given, and its

practical effectiveness periodically assessed. Approved training programmes should be available.

Training records should be kept.

10.3 Personnel working in areas where contamination is a hazard, e.g. clean areas or areas where highly

active, toxic, infectious or sensitizing materials are handled, should be given specific training.

10.4 The concept of QA and all the measures which aid its understanding and implementation should be fully

discussed during the training sessions.

10.5 Visitors or untrained personnel should preferably not be taken into the production and QC areas. If this

is unavoidable, they should be given relevant information in advance (particularly about personal

hygiene) and the prescribed protective clothing. They should be closely supervised.

10.6 Consultant and contract staff should be qualified for the services they provide. Evidence of this

should be included in the training records.

Annex 2


10. Training

33

11.1 All personnel, prior to and during employment, as appropriate, should undergo health

examinations. Personnel conducting visual inspections should also undergo periodic eye

examinations.

11.2 All personnel should be trained in the practices of personal hygiene. A high level of personal hygiene

should be observed by all those concerned with manufacturing processes. In particular, personnel

should be instructed to wash their hands before entering production areas. Signs to this effect should

be posted and instructions complied with.

11.3 Any person shown at any time to have an apparent illness or open lesions that may adversely affect the

quality of products should not be allowed to handle starting materials, packaging materials, in-process

materials or medicines until the condition is no longer judged to be a risk.

11.4 All employees should be instructed and encouraged to report to their immediate supervisor any

conditions (relating to plant, equipment or personnel) that they consider may adversely affect the

products.

11.5 Direct contact should be avoided between the operator's hands and starting materials, primary

packaging materials and intermediate or bulk product.

11.6 To ensure protection of the product from contamination, personnel should wear clean body coverings

appropriate to the duties they perform, including appropriate hair covering. Used clothes, if reusable,

should be stored in separate closed containers until properly laundered and, if necessary,

disinfected or sterilized.

11.7 Smoking, eating, drinking, chewing, and keeping plants, food, drink, smoking material and

personal medicines should not be permitted in production, laboratory and storage areas, or in any

other areas where they might adversely influence product quality.

11.8 Personal hygiene procedures, including the wearing of protective clothing, should apply to all persons

entering production areas, whether they are temporary or full-time employees or non-employees,

e.g. contractors' employees, visitors, senior managers and inspectors.

Annex 2


11. Personal hygiene

34

12.1 Principle. Premises must be located, designed, constructed, adapted and maintained to suit the

operations to be carried out.

12.2 The layout and design of premises must aim to minimize the risk of errors and permit effective cleaning

and maintenance in order to avoid cross- contamination, build-up of dust or dirt, and in general, any

adverse effect on the quality of products.

12.3 Where dust is generated (e.g. during sampling, weighing, mixing and processing operations, or

packaging of powder), measures should be taken to avoid cross-contamination and facilitate

cleaning.

12.4 Premises should be situated in an environment that, when considered together with measures to

protect the manufacturing process, presents minimum risk of causing any contamination of materials

or products.

12.5 Premises used for the manufacture of finished products should be suitably designed and constructed to

facilitate good sanitation.

12.6 Premises should be carefully maintained, and it should be ensured that repair and maintenance

operations do not present any hazard to the quality of products.

12.7 Premises should be cleaned and, where applicable, disinfected according to detailed written

procedures. Records should be maintained.

12.8 Electrical supply, lighting, temperature, humidity and ventilation should be appropriate and such

that they do not adversely affect, directly or indirectly, either the pharmaceutical products during

their manufacture and storage, or the accurate functioning of equipment.

12.9 Premises should be designed and equipped so as to afford maximum protection against the entry of

insects, birds or other animals. There should be a procedure for rodent and pest control.

12.10 Premises should be designed to ensure the logical flow of materials and personnel.

General


Annex 2

12. Premises

35

Ancillary areas

Storage areas

12.11 Rest and refreshment rooms should be separate from manufacturing and control areas.

12.12 Facilities for changing and storing clothes and for washing and toilet purposes should be easily

accessible and appropriate for the number of users. Toilets should not communicate directly with

production or storage areas.

12.13 Maintenance workshops should if possible be separated from production areas. Whenever parts and

tools are stored in the production area, they should be kept in rooms or lockers reserved for that use.

12.14 Animal houses should be well isolated from other areas, with separate entrance (animal access) and

air-handling facilities.

12.15 Storage areas should be of sufficient capacity to allow orderly storage of the various categories of

materials and products with proper separation and segregation: starting and packaging materials,

intermediates, bulk and finished products, products in quarantine, and released, rejected, returned or

recalled products.

12.16 Storage areas should be designed or adapted to ensure good storage conditions. In particular, they

should be clean, dry, sufficiently lit and maintained within acceptable temperature limits. Where

special storage conditions are required (e.g. temperature, humidity) these should be provided,

controlled, monitored and recorded where appropriate.

12.17 Receiving and dispatch bays should be separated and should protect materials and products from

the weather. Receiving areas should be designed and equipped to allow containers of incoming

materials to be cleaned, if necessary, before storage.

12.18 Where quarantine status is ensured by storage in separate areas, these areas must be clearly marked

and their access restricted to authorized personnel. Any system replacing the physical quarantine

should give equivalent security.

12.19 Segregation should be provided for the storage of rejected, recalled, or returned materials or products.

12.20 Highly active and radioactive materials, narcotics, other dangerous medicines, and substances

presenting special risks of abuse, fire or explosion should be stored in safe and secure areas.

12.21 Printed packaging materials are considered critical to the conformity of the pharmaceutical product to

its labelling and special attention should be paid to sampling and the safe and secure storage of these

materials.

Annex 2


36

12.22 There should normally be a separate sampling area for starting materials. (If sampling is performed in

the storage area, it should be conducted in such a way as to prevent contamination or cross-

contamination.)

12.23 The weighing of starting materials and the estimation of yield by weighing should be carried out in

separate weighing areas designed for that use, for example, with provisions for dust control. Such

areas may be part of either storage or production areas.

12.24 In order to minimize the risk of a serious medical hazard due to cross- contamination, dedicated and

self-contained facilities must be available for the production of particular pharmaceutical products,

such as highly sensitizing materials (e.g. penicillins) or biological preparations (e.g. live

microorganisms). The production of certain other highly active products, such as some antibiotics,

hormones, cytotoxic substances and certain non-pharmaceutical products, should not be conducted

in the same facilities. In exceptional cases, the principle of campaign working in the same facilities can

be accepted provided that specific precautions are taken and the necessary validations (including

cleaning validation) are made. The manufacture of technical poisons, such as pesticides and

herbicides, should not be allowed in premises used for the manufacture of pharmaceutical products.

12.25 Premises should preferably be laid out in such a way as to allow the production to take place in

areas connected in a logical order corresponding to the sequence of the operations and to the

requisite cleanliness levels.

12.26 The adequacy of the working and in-process storage space should permit the orderly and logical

positioning of equipment and materials so as to minimize the risk of confusion between different

pharmaceutical products or their components, to avoid cross-contamination, and to minimize the risk

of omission or wrong application of any of the manufacturing or control steps.

12.27 Where starting and primary packaging materials and intermediate or bulk products are exposed to the

environment, interior surfaces (walls, floors and ceilings) should be smooth and free from cracks and

open joints, should not shed particulate matter, and should permit easy and effective cleaning and, if

necessary, disinfection.

12.28 Pipework, light fittings, ventilation points and other services should be designed and sited to avoid

the creation of recesses that are difficult to clean. As far as possible, for maintenance purposes, they

should be accessible from outside the manufacturing areas.

12.29 Drains should be of adequate size and designed and equipped to prevent back-flow. Open channels

should be avoided where possible, but if they are necessary they should be shallow to facilitate

cleaning and disinfection.

Weighing areas

Production areas

Annex 2


37

12.30 Production areas should be effectively ventilated, with air-control facilities (including filtration of air

to a sufficient level to prevent contamination and cross-contamination, as well as control of

temperature and, where necessary, humidity) appropriate to the products handled, to the operations

undertaken and to the external environment. These areas should be regularly monitored during

both production and non-production periods to ensure compliance with their design specifications.

12.31 Premises for the packaging of pharmaceutical products should be specifically designed and laid

out so as to avoid mix ups, contamination or cross-contamination.

12.32 Production areas should be well lit, particularly where visual online controls are carried out.

12.33 QC laboratories should be separated from production areas. Areas where biological, microbiological or

radioisotope test methods are employed should be separated from each other.

12.34 QC laboratories should be designed to suit the operations to be carried out in them. Sufficient space

should be given to avoid mix ups and cross- contamination. There should be adequate suitable

storage space for samples, reference standards (if necessary, with cooling), solvents, reagents and

records.

12.35 The design of the laboratories should take into account the suitability of construction materials,

prevention of fumes, and ventilation. There should be separate air supply to laboratories and

production areas. Separate air-handling units and other provisions are needed for biological,

microbiological and radioisotope laboratories.

12.36 A separate room may be needed for instruments to protect them against electrical interference,

vibration, contact with excessive moisture and other external factors, or where it is necessary to

isolate the instruments.

Quality control areas

Annex 2


38

13.1 Equipment must be located, designed, constructed, adapted and maintained to suit the operations to

be carried out. The layout and design of equipment must aim to minimize the risk of errors and permit

effective cleaning and maintenance in order to avoid cross-contamination, build-up of dust or dirt,

and, in general, any adverse effect on the quality of products.

13.2 Equipment should be installed in such a way as to minimize any risk of error or of contamination.

13.3 Fixed pipework should be clearly labelled to indicate the contents and, where applicable, the direction

of flow.

13.4 All service pipework and devices should be adequately marked and special attention paid to the

provision of non-interchangeable connections or adaptors for dangerous gases and liquids.

13.5 Balances and other measuring equipment of an appropriate range and precision should be available

for production and control operations and should be calibrated according to a fixed schedule.

13.6 Production equipment should be thoroughly cleaned according to a fixed schedule.

13.7 Laboratory equipment and instruments should be suited to the testing procedures undertaken.

13.8 Washing, cleaning and drying equipment should be chosen and used so as not to be a source of

contamination.

13.9 Production equipment should not present any hazard to the products. The parts of the production

equipment that come into contact with the product must not be reactive, additive, or absorptive to an

extent that would affect the quality of the product.

13.10 Defective equipment should be removed from production and QC areas. If this is not possible, it should

be clearly labelled as defective to prevent use.

13.11 Closed equipment should be used whenever appropriate. Where open equipment is used or equipment

is opened, precautions should be taken to minimize contamination.

13.12 Non-dedicated equipment should be cleaned according to validated cleaning procedures between

being used for production of different pharmaceutical products to prevent cross-contamination.

13.13 Current drawings of critical equipment and support systems should be maintained.


Annex 2

13. Equipment

14.1 Principle. The main objective of a pharmaceutical plant is to produce finished products for patients'

use from a combination of materials (starting and packaging).

14.2 Materials include starting materials, packaging materials, gases, solvents, process aids, reagents and

labelling materials.

14.3 No materials used for operations such as cleaning, lubrication of equipment and pest control

should come into direct contact with the product. Where possible, such materials should be of a

suitable grade (e.g. food grade) to minimize health risks.

14.4 All incoming materials and finished products should be quarantined immediately after receipt or

processing, until they are released for use or distribution.

14.5 All materials and products should be stored under the appropriate conditions established by the

manufacturer, and in an orderly fashion, to permit batch segregation and stock rotation by a first-

expire, first-out rule.

14.6 Water used in the manufacture of pharmaceutical products should be suitable for its intended use.

14.7 The purchase of starting materials is an important operation that should involve staff who have a

particular and thorough knowledge of the products and suppliers.

14.8 Starting materials should be purchased only from approved suppliers and, where possible, directly

from the producer. It is also recommended that the specifications established by the manufacturer for

the starting materials be discussed with the suppliers. It is beneficial for all critical aspects of the

production and control of the starting material in question, including handling, labelling and

packaging requirements as well as complaints and rejection procedures, to be contractually agreed

between the manufacturer and the supplier.

14.9 For each consignment, at a minimum, the containers should be checked at least for integrity of package

and seal and for correspondence between the order, the delivery note, and the supplier's labels.

General

Starting materials

39

Annex 2


14. Materials

40

14.10 All incoming materials should be checked to ensure that the consignment corresponds to the order.

Containers should be cleaned where necessary and labelled, if required, with the prescribed

information. Where additional labels are attached to containers, the original information should not

be lost.

14.11 Damage to containers and any other problem that might adversely affect the quality of a material

should be recorded and reported to the QC department and investigated.

14.12 If one delivery of material is made up of different batches, each batch must be considered as separate

for sampling, testing and release.

14.13 Starting materials in the storage area should be appropriately labelled. Labels should bear at least the

following information:

(a) the designated name of the product and the internal code reference where applicable;

(b) the batch number given by the supplier and, on receipt, the control or batch number given by the

manufacturer, if any, documented so as to ensure traceability;

(c) the status of the contents (e.g. in quarantine, on test, released, rejected, returned, recalled);

(d) where appropriate, an expiry date or a date beyond which retesting is necessary. When fully

validated computerized storage systems are used, not all of the above information need be in a

legible form on the label.

14.14 There should be appropriate procedures or measures to ensure the identity of the contents of each

container of starting material. Bulk containers from which samples have been drawn should be

identified.

14.15 Only starting materials released by the QC department and within their shelf-life should be used.

14.16 Starting materials should be dispensed only by designated persons, following a written

procedure, to ensure that the correct materials are accurately weighed or measured into clean and

properly labelled containers.

14.17 Each dispensed material and its weight or volume should be independently checked and the check

recorded.

14.18 Materials dispensed for each batch of the final product should be kept together and conspicuously

labelled as such.

14.19 The purchase, handling and control of primary and printed packaging materials should be as for

starting materials.

Packaging materials

Annex 2


41

14.20 Particular attention should be paid to printed packaging materials. They should be stored in secure

conditions so as to exclude the possibility of unauthorized access. Roll feed labels should be used

wherever possible. Cut labels and other loose printed materials should be stored and transported in

separate closed containers so as to avoid mix ups. Packaging materials should be issued for use only

by designated personnel following an approved and documented procedure.

14.21 Each delivery or batch of printed or primary packaging material should be given a specific reference

number or identification mark.

14.22 Outdated or obsolete primary packaging material or printed packaging material should be destroyed

and its disposal recorded.

14.23 All products and packaging materials to be used should be checked on delivery to the packaging

department for quantity, identity and conformity with the packaging instructions.

14.24 Intermediate and bulk products should be kept under appropriate conditions.

14.25 Intermediate and bulk products purchased as such should be handled on receipt as though they were

starting materials.

14.26 Finished products should be held in quarantine until their final release, after which they should be

stored as usable stock under conditions established by the manufacturer.

14.27 The evaluation of finished products and the documentation necessary for release of a product for sale

are described in section 17, “Good practices in quality control”.

14.28 Rejected materials and products should be clearly marked as such and stored separately in restricted

areas. They should either be returned to the suppliers or, where appropriate, reprocessed or destroyed

in a timely manner. Whatever action is taken should be approved by authorized personnel and

recorded.

14.29 The reworking or recovery of rejected products should be exceptional. It is permitted only if the quality

of the final product is not affected, if the specifications are met, and if it is done in accordance with a

defined and authorized procedure after evaluation of the risks involved. A record should be kept of the

reworking or recovery. A reworked batch should be given a new batch number.

Intermediate and bulk products

Finished products

Rejected, recovered, reprocessed and reworked materials

Annex 2


42

14.30 The introduction of all or part of earlier batches, conforming to the required quality standards, into a

batch of the same product at a defined stage of manufacture should be authorized beforehand. This

recovery should be carried out in accordance with a defined procedure after evaluation of the

risks involved, including any possible effect on shelf-life. The recovery should be recorded.

14.31 The need for additional testing of any finished product that has been reprocessed, reworked or into

which a recovered product has been incorporated, should be considered by the QC department.

14.32 Recalled products should be identified and stored separately in a secure area until a decision is taken

on their fate. This decision should be made as soon as possible.

14.33 Products returned from the market should be destroyed unless it is certain that their quality is

satisfactory; in such cases they may be considered for resale or relabelling, or alternative action taken

only after they have been critically assessed by the QC function in accordance with a written procedure.

The nature of the product, any special storage conditions it requires, its condition and history, and

the time elapsed since it was issued should all be taken into account in this assessment. Where any

doubt arises over the quality of the product, it should not be considered suitable for reissue or reuse.

Any action taken should be appropriately recorded.

14.34 There should be records for the receipt and preparation of reagents and culture media.

14.35 Reagents made up in the laboratory should be prepared according to written procedures and

appropriately labelled. The label should indicate the concentration, standardization factor, shelf-

life, the date when re- standardization is due, and the storage conditions. The label should be signed

and dated by the person preparing the reagent.

14.36 Both positive and negative controls should be applied to verify the suitability of culture media each

time they are prepared and used. The size of the inoculum used in positive controls should be

appropriate to the sensitivity required.

14.37 Whenever official reference standards exist, these should preferably be used.

14.38 Official reference standards should be used only for the purpose described in the appropriate

monograph.

Recalled products

Returned goods

Reagents and culture media

Reference standards

Annex 2


43

14.39 Reference standards prepared by the producer should be tested, released and stored in the same way as

official standards. They should be kept under the responsibility of a designated person in a secure area.

14.40 Secondary or working standards may be established by the application of appropriate tests and checks

at regular intervals to ensure standardization.

14.41 Reference standards should be properly labelled with at least the following information:

(a) name of the material;

(b) batch or lot number and control number;

(c) date of preparation;

(d) shelf-life;

(e) potency;

(f ) storage conditions.

14.42 All in-house reference standards should be standardized against an official reference standard,

when available, initially and at regular intervals thereafter.

14.43 All reference standards should be stored and used in a manner that will not adversely affect their

quality.

14.44 Provision should be made for the proper and safe storage of waste materials awaiting disposal.

Toxic substances and flammable materials should be stored in suitably designed, separate, enclosed

cupboards, as required by national legislation.

14.45 Waste material should not be allowed to accumulate. It should be collected in suitable receptacles for

removal to collection points outside the buildings and disposed of safely and in a sanitary manner at

regular and frequent intervals.

14.46 Rodenticides, insecticides, fumigating agents and sanitizing materials should not be permitted to

contaminate equipment, starting materials, packaging materials, in-process materials or finished

products.

Waste materials

Miscellaneous

Annex 2


15.1 Principle. Good documentation is an essential part of the quality assurance system and, as such, should

exist for all aspects of GMP. Its aims are to define the specifications and procedures for all materials

and methods of manufacture and control; to ensure that all personnel concerned with

manufacture know what to do and when to do it; to ensure that authorized persons have all the

information necessary to decide whether or not to release a batch of a medicine for sale; to ensure the

existence of documented evidence, traceability, and to provide records and an audit trail that will

permit investigation. It ensures the availability of the data needed for validation, review and

statistical analysis. The design and use of documents depend upon the manufacturer. In some cases

some or all of the documents described below may be brought together, but they will usually be

separate.

15.2 Documents should be designed, prepared, reviewed and distributed with care. They should comply

with the relevant parts of the manufacturing and marketing authorizations.

15.3 Documents should be approved, signed and dated by the appropriate responsible persons. No

document should be changed without authorization and approval.

15.4 Documents should have unambiguous contents: the title, nature and purpose should be clearly

stated. They should be laid out in an orderly fashion and be easy to check. Reproduced documents

should be clear and legible. The reproduction of working documents from master documents must

not allow any error to be introduced through the reproduction process.

15.5 Documents should be regularly reviewed and kept up to date. When a document has been revised, a

system should exist to prevent inadvertent use of the superseded version. Superseded documents

should be retained for a specific period of time.

15.6 Where documents require the entry of data, these entries should be clear, legible and indelible.

Sufficient space should be provided for such entries.

15.7 Any alteration made to a document should be signed and dated; the alteration should be done in such a

way as to permit the reading of the original information. Where appropriate, the reason for the

alteration should be recorded.

General


Annex 2

15. Documentation

45

Annex 2


15.8 Records should be made or completed when any action is taken and in such a way that all significant

activities concerning the manufacture of pharmaceutical products are traceable. Records should be

retained for at least one year after the expiry date of the finished product.

15.9 Data (and records for storage) may be recorded by electronic data- processing systems or by

photographic or other reliable means. Master formulae and detailed SOPs relating to the system in use

should be available and the accuracy of the records should be checked. If documentation is handled by

electronic data-processing methods, only authorized persons should be able to enter or modify data in

the computer system, and there should be a record of changes and deletions; access should be

restricted by passwords or other means and the entry of critical data should be independently

checked. Batch records stored electronically should be protected by back-up transfer on magnetic

tape, microfilm, electronic discs, paper printouts or other means. It is particularly important that,

during the period of retention, the data are readily available.

15.10 Labels applied to containers, equipment or premises should be clear, unambiguous and in the

company’s agreed format. It is often helpful in addition to the wording on the labels to use colours to

indicate status (e.g. quarantined, accepted, rejected, clean).

15.11 All finished medicines should be identified by labelling, as required by the national legislation,

bearing at least the following information:

(a) the name of the medicines;

(b) a list of the active ingredients (if applicable, with the INN), showing the amount of each present

and a statement of the net contents (e.g. number of dosage units, weight, volume);

(c) the batch number assigned by the manufacturer; (d) the expiry date in an uncoded form;

(e) any special storage conditions or handling precautions that may be necessary;

(f ) directions for use, and warnings and precautions that may be necessary;

(g) the name and address of the manufacturer or the company or the person responsible for placing

the product on the market.

15.12 For reference standards, the label and/or accompanying document should indicate potency or

concentration, date of manufacture, expiry date, date the closure is first opened, storage conditions

and control number, as appropriate.

Documents required

Labels

46

Specifications and testing procedures

Specifications for starting and packaging materials

15.13 Testing procedures described in documents should be validated in the context of available facilities

and equipment before they are adopted for routine testing.

15.14 There should be appropriately authorized and dated specifications, including tests on identity,

content, purity and quality, for starting and packaging materials and for finished products; where

appropriate, they should also be available for intermediate or bulk products. Specifications for water,

solvents and reagents (e.g. acids and bases) used in production should be included.

15.15 Each specification should be approved, signed and dated, and maintained by the QC or QA units.

Specifications for starting materials, intermediates, bulk, finished products and packaging materials

are referred to in sections 15.18–15.21.

15.16 Periodic revisions of the specifications may be necessary to comply with new editions of the national

pharmacopoeia or other official compendia.

15.17 Pharmacopoeias, reference standards, reference spectra and other reference materials should be

available in the QC laboratory.

15.18 Specifications for starting, primary and printed packaging materials should provide, if applicable, a

description of the materials, including:

(a) the designated name (if applicable, the INN) and internal code reference;

(b) the reference, if any, to a pharmacopoeial monograph;

(c) qualitative and quantitative requirements with acceptance limits.

Depending on the company’s practice other data may be added to the specification, such as:

(a) the supplier and the original producer of the materials;

(b) a specimen of printed materials;

(c) directions for sampling and testing, or a reference to procedures;

(d) storage conditions and precautions;

(e) the maximum period of storage before reexamination.

Annex 2


47

Packaging material should conform to specifications, and should be compatible with the material and/or

with the medicines it contains. The material should be examined for compliance with the specification, and

for defects as well as for the correctness of identity markings.

15.19 Documents describing testing procedures should state the required frequency for re-assaying each

starting material, as determined by its stability.

15.20 Specifications for intermediate and bulk products should be available.The specifications should be

similar to specifications for starting materials or for finished products, as appropriate.

15.21 Specifications for finished products should include:

(a) the designated name of the product and the code reference, where applicable;

(b) the designated name(s) of the active ingredient(s) (if applicable, with the INN(s));

(c) the formula or a reference to the formula;

(d) a description of the dosage form and package details;

(e) directions for sampling and testing or a reference to procedures;

(f ) the qualitative and quantitative requirements, with acceptance limits;

(g) the storage conditions and precautions, where applicable;

(h) the shelf-life.

15.22 A formally authorized master formula should exist for each product and batch size to be manufactured.

15.23 The master formula should include:

(a) the name of the product, with a product reference code relating to its specification;

(b) a description of the dosage form, strength of the product and batch size;

Specifications for intermediate and bulk products

Specifications for finished products

Master formulae

Annex 2


48

(c) a list of all starting materials to be used (if applicable with the INNs), with the amount of each,

described using the designated name and a reference that is unique to that material (mention

should be made of any substance that may disappear in the course of processing);

(d) a statement of the expected final yield with the acceptable limits, and of relevant intermediate

yields, where applicable;

(e) a statement of the processing location and the principal equipment to be used;

(f ) the methods, or reference to the methods, to be used for preparing and operating the critical

equipment, e.g. cleaning (especially after a change in product), assembling, calibrating,

sterilizing, use;

(g) detailed step-wise processing instructions (e.g. checks on materials, pretreatments, sequence for

adding materials, mixing times, temperatures);

(h) the instructions for any in-process controls with their limits;

(i) where necessary, the requirements for storage of the products, including the container, the

labelling, and any special storage conditions;

(j) any special precautions to be observed.

15.24 Formally authorized packaging instructions should exist for each product, pack size and type. These

should normally include, or make reference to:

(a) the name of the product;

(b) a description of its pharmaceutical form, strength and, where applicable, method of application;

(c) the pack size expressed in terms of the number, weight or volume of the product in the final

container;

(d) a complete list of all the packaging materials required for a standard batch size, including

quantities, sizes and types, with the code or reference number relating to the specifications for

each packaging material;

(e) where appropriate, an example or reproduction of the relevant printed packaging materials and

specimens, indicating where the batch number and expiry date of the product have been marked;

(f ) special precautions to be observed, including a careful examination of the packaging area and

equipment in order to ascertain the line clearance before and after packaging operations;

Packaging instructions

Annex 2


49

(g) a description of the packaging operation, including any significant subsidiary operations, and

equipment to be used;

(h) details of in-process controls with instructions for sampling and acceptance limits.

15.25 A batch processing record should be kept for each batch processed. It should be based on the relevant

parts of the currently approved specifications on the record. The method of preparation of such records

should be designed to avoid errors. (Copying or validated computer programs are recommended.

Transcribing from approved documents should be avoided.)

15.26 Before any processing begins a check should be made that the equipment and work station are clear of

previous products, documents, or materials not required for the planned process, and that the

equipment is clean and suitable for use. This check should be recorded.

15.27 During processing, the following information should be recorded at the time each action is taken, and

after completion the record should be dated and signed by the person responsible for the processing

operations:

(a) the name of the product;

(b) the number of the batch being manufactured;

(c) dates and times of commencement, of significant intermediate stages, and of completion of

production;

(d) the name of the person responsible for each stage of production;

(e) the initials of the operator(s) of different significant steps of

(e) the initials of the operator(s) of different significant steps of production and, where appropriate,

of the person(s) who checked each of these operations (e.g. weighing);

(f ) the batch number and/or analytical control number and the quantity of each starting material

actually weighed (including the batch number and amount of any recovered or reprocessed

material added);

(g) any relevant processing operation or event and the major equipment used;

(h) the in-process controls performed, the initials of the person(s) carrying them out, and the results

obtained;

Batch processing records

Annex 2


50

(i) the amount of product obtained at different and pertinent stages of manufacture (yield), together

with comments or explanations for significant deviations from the expected yield;

(j) notes on special problems including details, with signed authorization for any deviation from the

master formula.

15.28 A batch packaging record should be kept for each batch or part batch processed. It should be based on

the relevant parts of the approved packaging instructions, and the method of preparing such

records should be designed to avoid errors. (Copying or validated computer programs are

recommended. Transcribing from approved documents should be avoided.)

15.29 Before any packaging operation begins, checks should be made that the equipment and work station

are clear of previous products, documents or materials not required for the planned packaging

operations, and that equipment is clean and suitable for use. These checks should be recorded.

15.30 The following information should be recorded at the time each action is taken, and the date and the

person responsible should be clearly identified by signature or electronic password:

(a) the name of the product, the batch number and the quantity of bulk product to be packed, as well

as the batch number and the planned quantity of finished product that will be obtained, the

quantity actually obtained and the reconciliation;

(b) the date(s) and time(s) of the packaging operations;

(c) the name of the responsible person carrying out the packaging operation;

(d) the initials of the operators of the different significant steps;

(e) the checks made for identity and conformity with the packaging instructions, including the results

of in-process controls;

(f ) details of the packaging operations carried out, including references to equipment and the

packaging lines used, and, when necessary, the instructions for keeping the product if it is

unpacked or a record of returning product that has not been packaged to the storage area;

(g) whenever possible, samples of the printed packaging materials used, including specimens

bearing the approval for the printing of and regular check (where appropriate) of the batch

number, expiry date, and any additional overprinting;

(h) notes on any special problems, including details of any deviation from the packaging instructions,

with written authorization by an appropriate person;

Batch packaging records

Annex 2


51

(i) the quantities and reference number or identification of all printed packaging materials and bulk

product issued, used, destroyed or returned to stock and the quantities of product obtained to

permit an adequate reconciliation.

15.31 SOPs and associated records of actions taken or, where appropriate, conclusions reached should be

available for:

(a) equipment assembly and validation;

(b) analytical apparatus and calibration;

(c) maintenance, cleaning and sanitization;

(d) personnel matters including qualification, training, clothing and hygiene;

(e) environmental monitoring;

(f ) pest control;

(g) complaints;

(h) recalls;

(i) returns.

15.32 There should be SOPs and records for the receipt of each delivery of starting material and primary and

printed packaging material.

15.33 The records of the receipts should include:

(a) the name of the material on the delivery note and the containers;

(b) the “in-house” name and/or code of material if different from (a);

(c) the date of receipt;

(d) the supplier’s name and, if possible, manufacturer’s name;

(e) the manufacturer’s batch or reference number;

(f ) the total quantity, and number of containers received;

Standard operating procedures and records

Annex 2


52

(g) the batch number assigned after receipt;

(h) any relevant comment (e.g. state of the containers).

15.34 There should be SOPs for the internal labelling, quarantine and storage of starting materials,

packaging materials and other materials, as appropriate.

15.35 SOPs should be available for each instrument and piece of equipment (e.g. use, calibration, cleaning,

maintenance) and placed in close proximity to the equipment.

15.36 There should be SOPs for sampling, which specify the person(s) authorized to take samples.

15.37 The sampling instructions should include:

(a) the method of sampling and the sampling plan;

(b) the equipment to be used;

(c) any precautions to be observed to avoid contamination of the material or any deterioration in its

quality;

(d) the amount(s) of sample(s) to be taken;

(e) instructions for any required subdivision of the sample;

(f ) the type of sample container(s) to be used, and whether they are for aseptic sampling or for

normal sampling, and labelling;

(g) any specific precautions to be observed, especially in regard to the sampling of sterile or noxious

material.

15.38 There should be an SOP describing the details of the batch (lot) numbering system, with the objective

of ensuring that each batch of intermediate, bulk or finished product is identified with a specific batch

number.

15.39 The SOPs for batch numbering that are applied to the processing stage and to the respective packaging

stage should be related to each other.

15.40 The SOP for batch numbering should ensure that the same batch numbers will not be used repeatedly;

this applies also to reprocessing.

15.41 Batch-number allocation should be immediately recorded, e.g. in a logbook. The record should

include at least the date of allocation, product identity and size of batch.

Annex 2


53

15.42 There should be written procedures for testing materials and products at different stages of

manufacture, describing the methods and equipment to be used. The tests performed should be

recorded.

15.43 Analysis records should include at least the following data:

(a) the name of the material or product and, where applicable, dosage form;

(b) the batch number and, where appropriate, the manufacturer and/or supplier;

(c) references to the relevant specifications and testing procedures;

(d) test results, including observations and calculations, and reference to any specifications (limits);

(e) date(s) and reference number(s) of testing;

(f ) the initials of the persons who performed the testing;

(g) the date and initials of the persons who verified the testing and the calculations, where

appropriate;

(h) a clear statement of release or rejection (or other status decision) and the dated signature of the

designated responsible person.

15.44 Written release and rejection procedures should be available for materials and products, and in

particular for the release for sale of the finished product by an authorized person.

15.45 Records should be maintained of the distribution of each batch of a product in order, for example, to

facilitate the recall of the batch if necessary.

15.46 Records should be kept for major and critical equipment, as appropriate, of any validations,

calibrations, maintenance, cleaning or repair operations, including dates and the identity of the

people who carried out these operations.

15.47 The use of major and critical equipment and the areas where products have been processed should be

appropriately recorded in chronological order.

15.48 There should be written procedures assigning responsibility for cleaning and sanitation and describing

in sufficient detail the cleaning schedules, methods, equipment and materials to be used and facilities

and equipment to be cleaned. Such written procedures should be followed.

Annex 2



Annex 2

16. Good practices in production

16.1 Principle. Production operations must follow clearly defined procedures in accordance with

manufacturing and marketing authorizations, with the objective of obtaining products of the requisite

quality.

16.2 All handling of materials and products, such as receipt and cleaning, quarantine, sampling,

storage, labelling, dispensing, processing, packaging and distribution should be done in accordance

with written procedures or instructions and, where necessary, recorded.

16.3 Deviation from instructions or procedures should be avoided as far as possible. If deviations

occur, they should be in accordance with an approved procedure. The authorization of the

deviation should be approved in writing by a designated person, with the involvement of the QC

department, when appropriate.

16.4 Checks on yields and reconciliation of quantities should be carried out as necessary to ensure that

there are no discrepancies outside acceptable limits.

16.5 Operations on different products should not be carried out simultaneously or consecutively in the

same room or area unless there is no risk of mix up or cross-contamination.

16.6 At all times during processing, all materials, bulk containers, major items of equipment, and, where

appropriate, the rooms and packaging lines being used, should be labelled or otherwise identified

with an indication of the product or material being processed, its strength (where applicable) and the

batch number. Where applicable, this indication should also mention the stage of production. In some

cases it may be useful to also record the name of the previous product that has been processed.

16.7 Access to production premises should be restricted to authorized personnel.

16.8 Normally, non-medicinal products should not be produced in areas or with equipment destined for the

production of pharmaceutical products.

16.9 In-process controls are usually performed within the production area. The performance of such in-

process controls should not have any negative effect on the quality of the product or another product

(e.g. cross-contamination or mix up).

General

55

Prevention of cross-contamination and bacterial contamination during production

16.10 When dry materials and products are used in production, special precautions should be taken to

prevent the generation and dissemination of dust. Provision should be made for proper air control

(e.g. supply and extraction of air of suitable quality).

16.11 Contamination of a starting material or of a product by another material or product must be avoided.

This risk of accidental cross-contamination arises from the uncontrolled release of dust, gases,

particles, vapours, sprays or organisms from materials and products in process, from residues on

equipment, from intruding insects, and from operators’ clothing, skin, etc. The significance of this risk

varies with the type of contaminant and of the product being contaminated. Among the most

hazardous contaminants are highly sensitizing materials, biological preparations such as living

organisms, certain hormones, cytotoxic substances, and other highly active materials. Products in

which contamination is likely to be most significant are those administered by injection or applied to

open wounds and those given in large doses and/or over a long time.

16.12 Cross-contamination should be avoided by taking appropriate technical or organizational measures,

for example:

(a) carrying out production in dedicated and self-contained areas (which may be required for products

such as penicillins, live vaccines, live bacterial preparations and certain other biologicals);

(b) conducting campaign production (separation in time) followed by appropriate cleaning in

accordance with a validated cleaning procedure;

(c) providing appropriately designed airlocks, pressure differentials, and air supply and extraction

systems;

(d) minimizing the risk of contamination caused by recirculation or reentry of untreated or

insufficiently treated air;

(e) wearing protective clothing where products or materials are handled;

(f ) using cleaning and decontamination procedures of known effectiveness;

(g) using a “closed system” in production;

(h) testing for residues;

(i) using cleanliness status labels on equipment.

16.13 Measures to prevent cross-contamination and their effectiveness should be checked periodically

according to SOPs.

Annex 2


56

16.14 Production areas where susceptible products are processed should undergo periodic environmental

monitoring (e.g. for microbiological and particulate matter, where appropriate).

16.15 Before any processing operation is started, steps should be taken to ensure that the work area and

equipment are clean and free from any starting materials, products, product residues, labels or

documents not required for the current operation.

16.16 Any necessary in-process controls and environmental controls should be carried out and recorded.

16.17 Means should be instituted of indicating failures of equipment or of services (e.g. water, gas) to

equipment. Defective equipment should be withdrawn from use until the defect has been rectified.

After use, production equipment should be cleaned without delay according to detailed written

procedures and stored under clean and dry conditions in a separate area or in a manner that will

prevent contamination.

16.18 Time limits for storage of equipment after cleaning and before use should be stated and based on

relevant data.

16.19 Containers for filling should be cleaned before filling. Attention should be given to avoiding and

removing any contaminants such as glass fragments and metal particles.

16.20 Any significant deviation from the expected yield should be recorded and investigated.

16.21 Checks should be carried out to ensure that pipelines and other pieces of equipment used for the

transportation of products from one area to another are connected in the correct manner.

16.22 Pipes used for conveying distilled or deionized water and, where appropriate, other water pipes

should be sanitized and stored according to written procedures that detail the action limits for

microbiological contamination and the measures to be taken.

16.23 Measuring, weighing, recording, and control equipment and instruments should be serviced and

calibrated at prespecified intervals and records maintained. To ensure satisfactory functioning,

instruments should be checked daily or prior to use for performing analytical tests. The date of

calibration and servicing and the date when recalibration is due should be clearly indicated on a label

attached to the instrument.

16.24 Repair and maintenance operations should not present any hazard to the quality of the products.

16.25 When the programme for packaging operations is being set up, particular attention should be given to

minimizing the risk of cross-contamination, mix ups or substitutions. Different products should not

be packaged in close proximity unless there is physical segregation or an alternative system that will

provide equal assurance.

Processing operations

Packaging operations

Annex 2


57

16.26 Before packaging operations are begun, steps should be taken to ensure that the work area,

packaging lines, printing machines and other equipment are clean and free from any products,

materials or documents used previously and which are not required for the current operation. The line

clearance should be performed according to an appropriate procedure and checklist, and recorded.

16.27 The name and batch number of the product being handled should be displayed at each packaging

station or line.

16.28 Normally, filling and sealing should be followed as quickly as possible by labelling. If labelling is

delayed, appropriate procedures should be applied to ensure that no mix ups or mislabelling can occur.

16.29 The correct performance of any printing (e.g. of code numbers or expiry dates) done separately or in

the course of the packaging should be checked and recorded. Attention should be paid to printing by

hand, which should be rechecked at regular intervals.

16.30 Special care should be taken when cut labels are used and when overprinting is carried out off-

line, and in hand-packaging operations. Roll-feed labels are normally preferable to cut labels in

helping to avoid mix ups. Online verification of all labels by automated electronic means can be helpful

in preventing mix ups, but checks should be made to ensure that any electronic code readers, label

counters, or similar devices are operating correctly. When labels are attached manually, in-process

control checks should be performed more frequently.

16.31 Printed and embossed information on packaging materials should be distinct and resistant to

fading or erasing.

16.32 Regular online control of the product during packaging should include at a minimum checks on:

(a) the general appearance of the packages;

(b) whether the packages are complete;

(c) whether the correct products and packaging materials are used; (d) whether any overprinting is

correct;

(e) the correct functioning of line monitors.

16.33 Products that have been involved in an unusual event during packaging should be reintroduced into

the process only after special inspection, investigation and approval by authorized personnel. A

detailed record should be kept of this operation.

16.34 Any significant or unusual discrepancy observed during reconciliation of the amount of bulk product

and printed packaging materials and the number of units produced should be investigated,

satisfactorily accounted for, and recorded before release.

Samples taken away from the packaging line should not be returned.

Annex 2


58

16.35 Upon completion of a packaging operation, any unused batch-coded packaging materials should be

destroyed and the destruction recorded. A documented procedure requiring checks to be performed

before returning unused materials should be followed if uncoded printed materials are returned to

stock.

16.36 Production records should be reviewed as part of the approval process of batch release before transfer

to the authorized person. Any divergence or failure of a batch to meet production specifications should

be thoroughly investigated. The investigation should, if necessary, extend to other batches of the

same product and other products that may have been associated with the specific failure or

discrepancy. A written record of the investigation should be made and should include the conclusion

and follow-up action.

Annex 2


59

17.1 QC is the part of GMP concerned with sampling, specifications and testing, and with the organization

and documentation which ensure that the necessary and relevant tests are actually carried out and

that materials are not released for use, nor products released for sale or supply, until their quality has

been judged to be compliant with the requirements. QC is not confined to laboratory operations, but

may be involved in many decisions concerning the quality of the product.

17.2 The independence of QC from production is considered fundamental.

17.3 Each manufacturer should have a QC function. The QC function should be independent of other

departments and under the authority of a person with appropriate qualifications and experience.

Adequate resources must be available to ensure that all the QC arrangements are effectively and

reliably carried out. The basic requirements for QC are as follows:

(a) adequate facilities, trained personnel and approved procedures must be available for sampling,

inspecting, and testing starting materials, packaging materials, and intermediate, bulk, and

finished products, and where appropriate for monitoring environmental conditions for GMP

purposes;

(b) samples of starting materials, packaging materials, intermediate products, bulk products and

finished products must be taken by methods and personnel approved by the QC department;

(c) qualification and validation;

(d) records must be made (manually and/or by recording instruments) demonstrating that all the

required sampling, inspecting and testing procedures have actually been carried out and that any

deviations have been fully recorded and investigated;

(e) the finished products must contain ingredients complying with the qualitative and quantitative

composition of the product described in the marketing authorization; the ingredients must be of

the required purity, in their proper container and correctly labelled;

(f ) records must be made of the results of inspecting and testing the materials and intermediate, bulk

and finished products against specifications; product assessment must include a review and

evaluation of the relevant production documentation and an assessment of deviations from

specified procedures;

Annex 2


17. Good practices in quality control

60

(g) sufficient samples of starting materials and products must be retained to permit future

examination of the product if necessary; the retained product must be kept for the appropriate

time in its final pack unless the pack is exceptionally large, in which case one that is equivalent to

the marketed packaging system may be used.

17.4 Other QC responsibilities include:

(a) establishing, validating and implementing all QC procedures;

(b) evaluating, maintaining and storing reference standards for substances;

(c) ensuring the correct labelling of containers of materials and products;

(d) ensuring that the stability of the active pharmaceutical ingredients and products is monitored;

(e) participating in the investigation of complaints related to the quality of the product;

(f ) participating in environmental monitoring;

(g) participation in QRM programmes.

These activities should be carried out in accordance with written procedures and, where necessary,

recorded.

17.5 QC personnel must have access to production areas for sampling and investigation as appropriate.

17.6 All tests should follow the instructions given in the relevant written test procedure for each material or

product. The result should be checked by the supervisor before the material or product is released or

rejected.

17.7 Samples should be representative of the batches of material from which they are taken in accordance

with the approved written procedure.

17.8 Sampling should be carried out so as to avoid contamination or other adverse effects on quality. The

containers that have been sampled should be marked accordingly and carefully resealed after

sampling.

17.9 Care should be taken during sampling to guard against contamination or mix up of, or by, the material

being sampled. All sampling equipment that comes into contact with the material should be clean.

Some particularly hazardous or potent materials may require special precautions.

17.10 Sampling equipment should be cleaned and, if necessary, sterilized before and after each use and

stored separately from other laboratory equipment.

Control of starting materials and intermediate, bulk and finished products

Annex 2


61

17.11 Each sample container should bear a label indicating:

(a) the name of the sampled material;

(b) the batch or lot number;

(c) the number of the container from which the sample has been taken; (d) the number of the sample;

(e) the signature of the person who has taken the sample;

(f ) the date of sampling.

17.12 Out-of-specification results obtained during testing of materials or products should be

investigated in accordance with an approved procedure. Records should be maintained.

17.13 Before releasing a starting or packaging material for use, the QC manager should ensure that the

materials have been tested for conformity with specifications for identity, strength, purity and other

quality parameters.

17.14 An identity test should be conducted on a sample from each container of starting material (see also

section 14.14). It is permissible to sample only a proportion of the containers where a validated

procedure has been established to ensure that no single container of starting material has been

incorrectly labelled. This validation should take account of at least the following aspects:

– the nature and status of the manufacturer and of the supplier and their understanding of the GMP

requirements;

– the QA system of the manufacturer of the starting material;

– the manufacturing conditions under which the starting material is produced and controlled;

– the nature of the starting material and the medicinal products in which it will be used.

Under such a system it is possible that a validated procedure for exemption from the requirement for identity

testing of each incoming container of starting material could be accepted for the following:

– starting materials coming from a single product manufacturer or plant; or

– starting materials coming directly from a manufacturer, or in the manufacturer’s sealed container

Test requirements

Starting and packaging materials

Annex 2


62

where there is a history of reliability, and regular audits of the manufacturer’s QA system are

conducted by the purchaser (the manufacturer of the medicinal product) or by an officially

accredited body.

It is improbable that such a procedure could be satisfactorily validated for either:

– starting materials supplied by intermediaries, such as brokers, where the source of manufacture is

unknown or not audited; or

– starting materials for use in parenteral products.

17.15 Each batch (lot) of printed packaging materials must be examined following receipt.

17.16 In lieu of full testing by the manufacturer, a certificate of analysis may be accepted from the supplier,

provided that the manufacturer establishes the reliability of the supplier’s analysis through

appropriate periodic validation of the supplier’s test results (see sections 8.8 and 8.9) and through

on-site audits of the supplier’s capabilities. (This does not affect section 17.15.) Certificates must be

originals (not photocopies) or otherwise have their authenticity assured. Certificates must contain

at least the following information (7):

(a) identification (name and address) of the issuing supplier;

(b) signature of the competent official, and statement of his or her qualifications;

(c) the name of the material tested;

(d) the batch number of the material tested;

(e) the specifications and methods used;

(f ) the test results obtained;

(g) the date of testing.

17.17 In-process control records should be maintained and form a part of the batch records (see section

15.25).

17.18 For each batch of medicines, there should be an appropriate laboratory determination of

satisfactory conformity to its finished product specification prior to release.

In-process control

Finished products

Annex 2


63

17.19 Products failing to meet the established specifications or any other relevant quality criteria should be

rejected.

17.20 QC records should be reviewed as part of the approval process of batch release before transfer to the

authorized person. Any divergence or failure of a batch to meet its specifications should be

thoroughly investigated. The investigation should, if necessary, extend to other batches of the same

product and other products that may have been associated with the specific failure or discrepancy. A

written record of the investigation should be made and should include the conclusion and follow-up

action.

17.21 Retention samples from each batch of finished product should be kept for at least one year after the

expiry date. Finished products should usually be kept in their final packaging and stored under the

recommended conditions. If exceptionally large packages are produced, smaller samples might be

stored in appropriate containers. Samples of active starting materials should be retained for at

least one year beyond the expiry date of the corresponding finished product. Other starting materials

(other than solvents, gases and water) should be retained for a minimum of two years if their stability

allows. Retention samples of materials and products should be of a size sufficient to permit at least

two full reexaminations.

17.22 QC should evaluate the quality and stability of finished pharmaceutical products and, when

necessary, of starting materials and intermediate products.

17.23 QC should establish expiry dates and shelf-life specifications on the basis of stability tests related to

storage conditions.

17.24 A written programme for ongoing stability determination should be developed and implemented

to include elements such as:

(a) a complete description of the medicine involved in the study;

(b) the complete set of testing parameters and methods, describing all tests for potency, purity,

and physical characteristics and documented evidence that these tests indicate stability;

(c) provision for the inclusion of a sufficient number of batches;

(d) the testing schedule for each medicine;

(e) provision for special storage conditions;

(f ) provision for adequate sample retention;

Batch record review

Stability studies

Annex 2


64

(g) a summary of all the data generated, including the evaluation and the conclusions of the study.

17.25 Stability should be determined prior to marketing and following any significant changes, for

example, in processes, equipment or packaging materials.

1. Good manufacturing practices for pharmaceutical products. In: WHO Expert Committee on

Specifications for Pharmaceutical Preparations. Thirty-seventh report. Geneva, World Health

Organization, 2003 (WHO Technical Report Series, No. 908), Annex 4.

2. Validation of analytical procedures used in the examination of pharmaceutical materials. In: WHO Expert

Committee on Specifications for Pharmaceutical Preparations. Thirty-second report. Geneva, World Health

Organization, 1992 (WHO Technical Report Series, No. 823), Annex 5.

3. EudraLex – Volume 4. Good manufacturing practice (GMP) Guidelines. European Commission.

(http://ec.europa.eu/health/documents/eudralex/vol-4/ index_en.htm).

4. Pharmaceutical Inspection Convention, Pharmaceutical Inspection Co-operation Scheme (PIC/S). In:

Guide to good manufacturing practice for medicinal plants. Geneva, PIC/S Secretariat, 2000.

5. Quality assurance of pharmaceuticals. WHO guidelines, related guidance and GXP training modules.

Geneva, World Health Organization, 2013 (CD-ROM).

6. Good manufacturing practices for pharmaceutical products, Part one. In: WHO Expert Committee on

Specifications for Pharmaceutical Preparations. Thirty-second report. Geneva, World Health

Organization, 1992 (WHO Technical Report Series, No. 823), Annex 1; and in: Quality assurance of

pharmaceuticals. A compendium of guidelines and related materials. Vol. 2, 2nd updated edition. Good

manufacturing practices and Inspection. Geneva, World Health Organization, 2007; and in: Quality

assurance of pharmaceuticals. WHO guidelines, related guidance and GXP training modules. Geneva, World

Health Organization, 2013 (CD-ROM).

7. Model certificate of analysis. In: WHO Expert Committee on Specifications for Pharmaceutical

Preparations. Thirty-sixth report. Geneva, World Health Organization, 2002 (WHO Technical Report

Series, No. 902), Annex 10.

References

Annex 2


Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPWHO Prequalification Team: Points to consider Regarding Documentation and Data Management Practices and Excerpts from existing WHO Quality

Assurance Guidance, January 2014

CHAPTER 2


Regulatory systems worldwide depend upon the trust between the regulator and the regulated, that the

documentation and data submitted in dossiers and used in day-to-day decision-making, such as the

release of product to market, is comprehensive, complete, accurate and true. The quality of a study or

report supporting a regulatory application or decision cannot be assured unless data is true and fair. It is

clear that the entire regulatory system is based upon the integrity of the data being considered.

In recent years, however the number of citations made regarding good data management practices during

good manufacturing practices (GMP), good clinical practice (GCP) and good laboratory practices (GLP)

inspections by several stringent regulatory authorities (SRA) inspectorates as well as by the WHO

Prequalification Team (PQT) Inspection Services has been increasing. Although certain geographical

regions have been the focus of media interest and scrutiny in recent times it must be stressed that this is

not a problem unique to these regions, it is a world-wide problem with examples from USA and European

manufacturers as well as those from those manufacturers located in developing and middle income

markets.

These are not new expectations, nor is data and record integrity a new problem. Nor is this a problem

restricted to pharmaceutical and healthcare product development, manufacture and its regulation.

What types of data inconsistency and data integrity challenges might be present and detected seen?

• Sources of variation in the data itself

o how robust is the analytical method really and the process by which the product is made?

o how well is an organisation controlling its sources of variation

• Uncontrolled and inadequately documented, controlled and authorised changes that might be

scientifically justifiable

• Accidental loss of data or corruption of data because of poor systems

• Human errors

• Selection of good or passing results and exclusion of bad without their being any justification or

investigation

• Intentionally hidden or falsified data

• Manipulation of electronic and other data

Introduction and background


Why might these data integrity issues and data integrity challenges arise?

Auditors of systems, internal, external and regulatory, should all be on the lookout for all of the above

during their assessments. There should be policies in place evidence that organisations adequately

manage these issues. The root cause of the instances should be identified and eliminated where possible

and mitigated and monitored where they cannot.

Failures in data integrity management can arise both because of poor systematic control of the systems

for data management due to a lack of knowledge and human error, as well intentionally hidden or falsified

data or the use of selective data to mislead. Recently there has been a high level of focus on the small but

disturbing and increasing number of US-FDA warning letters and WHO Notices of Concern (NOC) and EU

Statements of Non-compliance where false or misleading information has been identified during

inspection leading to regulatory actions and even criminal prosecution, but it should be emphasized that

many of the citations in routine inspections result from poor systems rather than a proven intention to

mislead. This especially includes the failures by organizations to apply robust systems that inhibit

integrity failures, improve the detection of situations when integrity is lost, or robustly investigate the

root cause of the failures that are detected.

The reasons for this increased level of citations are undoubtedly multifactorial and include a number of

factors including amongst others:

• an increase in the use of computerized systems in development, manufacturing, control and

analysis of pharmaceutical products and APIs and especially in electronic records superseding

traditional records;

• an increased awareness of the trails left in electronic records that facilitate detection of

occasions when data has been changed, compared to traditional records and therefore the

detection of unexplained or unjustified changes. Generally electronic data is much more

secure than paper data and much more difficult to manipulate without leaving a trail other

than paper – changes are much easier to detect than paper;

• improved training of inspectors of how such changes can be detected;

• failures of companies to robustly apply comprehensive policies and systems for data

(including electronic)

• A lack of familiarity in the regulated community in expectations is clearly part of the problem,

and whilst much high- and mid-level guidance already exists, it can be argued that this is

spread over several sources and there is no single comprehensive guidance document that

brings these expectations together. Additionally, there is little regulatory guidance as to

what these high-level requirements mean in practice and what should be implemented to

achieve compliance.

In these respects, there is clearly a need for further guidance and especially in the area of implementation

standards of the GMP principles. For this reason proposals have been made concerning the development

of such guidance.


What are the “essentials of any good GXP record” exist and that documentation and data records (be

their paper or electronic) are reliable and trust worthy i.e.

o Maintained within their original context

• Paper prints do not meet the predicate rule

o Accurate

• Not amended without documentation and authorized justification

o Complete

• All data included e.g. initial test injections, repeat and reanalysis

o Intact

• i.e. Enduring

o Available

\ • Including the audit trails where they exist

o Attributable

• Who? Where? When was the record made?

• If it is changed then by who, when and why?

o Legible

• Permanent, durable and readable and recoverable

o Contemporaneous

• Record made in real time?

o Consistent

• Date time stamps in order no unexplained gaps?

How might an organisation demonstrate that it has a robust and documented governance system for

data and records management? Indicators would include that there are systems are in place for:

• Clear requirements on organisation to have effective policies and procedures that assure data

integrity

• Definition of and overview of the importance of good data management

• That responsibility of organisations and their members to ensure that data is not false or

misleading are defined.

• The responsibilities of corporate leadership and senior management in the above respects are

understood throughout the organisation.

• The drivers and psychology for falsification or omission with an intent to deceive or mislead

are minimized

o Opportunity is controlled and wherever possible eliminated


• Poor and open systems are eliminated and in legacy systems mitigated robustly until they

are replaced.

o Motive is not encouraged by organisational or management cultures

• Financial

• Fear of retribution

o Peer acceptance is unacceptable and dealt with robustly

• It will do no harm really

• My boss expects it

• System designs to secure and store and back up data exist

o A policy and SOPs are in place covering:

• User rights admin

• Security tools and audits

• User access controls and access records

• Audit trails

• Records management systems

• Version control on reanalysed data

• Defined work flows

• Review of raw data (define what and when)

o Links between data and records must be immutable

o Audit and Risk assessment of data management problems (if found) are performed

• Performing a risk assessment on the suspected corrupted data

• Documentation and dissemination of risk assessment outcomes

• Procedures for reporting of issues to the regulator and dissemination of information:

• Sharing of information with: NMRAs, WHO customers, manufacturers, other countries and the

public.

• Clear strategies are in place for recovering the confidence of stakeholders

WHO good manufacturing practices for Pharmaceutical products: main principles

The general texts of the main principles state that (inter alia):

2.1 (f) records are made (manually and/or by recording instruments) during manufacture to show

that all the steps required by the defined procedures and instructions have in fact been taken

Appendix - Current relevant guidance on data integrity and related matters


and there should be a record of changes and deletions; access should be restricted by

passwords or other means and the entry of critical data should be independently checked.

Batch records stored electronically should be protected by back-up transfer on magnetic

tape, microfilm, paper print-outs or other means. It is particularly important that, during the

period of retention, the data are readily available.

15.43 Analysis records should include at least the following data:

15.43 (d) test results, including observations and calculations, and reference to any specifications

(limits);

15.43 (e) date(s) and reference number(s) of testing;

15.43 (f) the initials of the persons who performed the testing;

15.43 (g) the date and initials of the persons who verified the testing and the calculations, where

appropriate;

15.43 (h) a clear statement of release or rejection (or other status decision) and the dated signature of

the designated responsible person.

16.3 Any deviation from instructions or procedures should be avoided as far as possible. If

deviations occur, they should be done in accordance with an approved procedure. The

authorization of the deviation should be approved in writing by a designated person, with the

involvement of the QC department, when appropriate.

17.3 Each manufacturer should have a QC function. The QC function should be independent of

other departments and under the authority of a person with appropriate qualifications and

experience, who has one or several control laboratories at his or her disposal. Adequate

resources must be available to ensure that all the QC arrangements are effectively and reliably

carried out. The basic requirements for QC are as follows:

17.3 (d) records must be made (manually and/or by recording instruments) demonstrating that all the

required sampling, inspecting and testing procedures have actually been carried out and that

any deviations have been fully recorded and investigated;

17.3 (f) records must be made of the results of inspecting and testing the materials and intermediate,

bulk and finished products against specifications; product assessment must include a review

and evaluation of the relevant production documentation and an assessment of deviations

from specified procedures;

17.6 All tests should follow the instructions given in the relevant written test procedure for each

material or product. The result should be checked by the supervisor before the material or

product is released or rejected.


17.12 Out-of-specification results obtained during testing of materials or products should be

investigated in accordance with an approved procedure. Records should be maintained.

WHO Good manufacturing practices for active pharmaceutical ingredients, Annex 2

5.4 Computerized systems

5.40 GMP-related computerized systems should be validated. The depth and scope of validation

depends on the diversity, complexity and criticality of the computerized application.

5.41 Appropriate installation qualification and operational qualification should demonstrate the

suitability of computer hardware and software to perform assigned tasks.

5.42 Commercially available software that has been qualified does not require the same level of

testing. If an existing system was not validated at the time of installation, a retrospective

validation could be conducted if appropriate documentation is available.

5.43 Computerized systems should have sufficient controls to prevent unauthorized access or

changes to data. There should be controls to prevent omissions in data (e.g the system being

turned off and data not captured). There should be a record of any data change made, the

previous entry, the person who made the change and when the change was made.

5.44 Written procedures should be available for the operation and maintenance of computerized

systems.

5.45 Where critical data are being entered manually, there should be an additional check on the

accuracy of the data entered. This can be done by a second operator or by the system itself.

5.46 Incidents related to computerized systems that could affect the quality of intermediates or

APIs or the reliability of records or test results should be recorded and investigated.

5.47 Changes to the computerized system should be made according to a change procedure and

should be formally authorized, documented and tested. Records should be kept of all

changes, including modifications and enhancements made to the hardware, software and any

other critical component of the system. These records should demonstrate that the system is

maintained in a validated state.

5.48 If system breakdowns or failures will result in the permanent loss of records, a back-up

system should be provided. A means of ensuring data protection should be established for all

computerized systems.

5.49 Data can be recorded by a second means in addition to the computer system.

WHO Technical Report Series, No. 957, 2010


WHO Technical Report Series, No. 937 (Annex 4),

WHO Technical Report Series, No. 957, 2010

Supplementary guidelines on good manufacturing practices: validation.

4.2 Data should be entered or amended only by persons authorized to do so. Suitable security

systems should be in place to prevent unauthorized entry or manipulation of data. The

activity of entering data, changing or amending incorrect entries and creating back-ups

should all be done in accordance with written, approved standard operating procedures

(SOPs).

4.3 The security procedures should be in writing. Security should also extend to devices used to

store programmes, such as tapes, disks and magnetic strip cards. Access to these devices

should be controlled.

4.4 Traceability is of particular importance and it should be able to identify the persons who

made entries/changes, released material, or performed other critical steps in manufacture or

control.

5.1 Regular back-ups of all files and data should be made and stored in a secure location to

prevent intentional or accidental damage.

7.2.2 Records are considered as software; focus is placed on accuracy, security, access, retention of

records, review, double checks, documentation and accuracy of reproduction.

7.2.3 The company should identify the following key computer programmes: language, name,

function (purpose of the programme), input (determine inputs), output (determine outputs),

fixed set point (process variable that cannot be changed by the operator), variable set point

(entered by the operator), edits (reject input/output that does not conform to limits and

minimize errors, e.g. four- or five-character number entry), input manipulation (and

equations) and programme overrides (e.g. to stop a mixer before time).

7.2.4 The personnel who have the ability and/or are authorized to write, alter or have access to

programmes should be identified.

WHO good practices for pharmaceutical quality control laboratories

2.3 The laboratory should establish, implement and maintain authorized written SOPs including,

but not limited to, administrative and technical operations, such as:

2.3 (m) the testing of samples with descriptions of the methods and equipment used;

2.3 (n) atypical and OOS results;


4.2 All original observations, including calculations and derived data, calibration, validation and

verification records and final results, should be retained on record for an appropriate period

of time in accordance with national regulations and, if applicable, contractual arrangements,

whichever is longer. The records should include the data recorded in the analytical worksheet

by the technician or analyst on consecutively numbered pages with references to the

appendices containing the relevant recordings, e.g. chromatograms and spectra.

The records for each test should contain sufficient information to permit the tests to be

repeated and/or the results to be recalculated, if necessary. The records should include the

identity of the personnel involved in the sampling, preparation and testing of the samples.

The records of samples to be used in legal proceedings should be kept according to the legal

requirements applicable to them.

4.3 All quality and technical/scientific records (including analytical test reports, certificates of

analysis and analytical worksheets) should be legible, readily retrievable, stored and

retained within facilities that provide a suitable environment that will prevent modification,

damage or deterioration and/or loss. The conditions under which all original records are

stored should be such as to ensure their security and confidentiality and access to them

should be restricted to authorized personnel. Electronic storage and signatures may also be

employed but with restricted access and in conformance with requirements for electronic

records (12–16).

5.2 For computers, automated tests or calibration equipment, and the collection, processing,

recording, reporting, storage or retrieval of test and/or calibration data, the laboratory

should ensure that:

5.2 (a) computer software developed by the user is documented in sufficient detail and

appropriately validated or verified as being suitable for use;

5.2 (b) procedures are established and implemented for protecting the integrity of data. Such

procedures should include, but are not limited to, measures to ensure the integrity and

confidentiality of data entry or collection and the storage, transmission and processing of

data. In particular, electronic data should be protected from unauthorized access and an

audit trail of any amendments should be maintained;

5.2 (c) computers and automated equipment are maintained so as to function properly and are

provided with the environmental and operating conditions necessary to ensure the integrity

of test and calibration data;

5.2 (d) procedures are established and implemented for making, documenting and controlling

changes to information stored in computerized systems; and

5.2 (e) electronic data should be backed up at appropriate regular intervals according to a

documented procedure. Backed-up data should be retrievable and stored in such a manner as

to prevent data loss.


Note: For further guidance on validation of data-processing equipment, refer to documents

published by the International Society for Pharmaceutical Engineering (13, 14), US Food and

Drug Administration (15), European Commission (16) and the Official Medicines Control

Laboratories Network of the Council of Europe (17).

15.1 The analytical worksheet is an internal document to be used by the analyst for recording

information about the sample, the test procedure, calculations and the results of testing. It is

to be complemented by the raw data obtained in the analysis.

15.5 The analytical worksheet should provide the following information:

15.5 (l) the results obtained;

15.5 (m) the interpretation of the results and the final conclusions (whether or not the sample was

found to comply with the specifications), approved and signed by the supervisor; and

15.5 (n) any further comments, for example, for internal information (see Part three, section 17.1), or

detailed notes on the specifications selected and the methods of assessment used (see Part

three, section 15.9), or any deviation from the prescribed procedure, which should be

approved and reported, or whether and when portions of the sample were forwarded to other

units for special tests and the date on which the results were received.

15.6 All values obtained from each test, including blank results, should immediately be entered on

the analytical worksheet and all graphical data, whether obtained from recording

instruments or plotted by hand, should be attached or be traceable to an electronic record fi

le or document where the data are available.

18.1 Test results should be reviewed and, where appropriate, evaluated statistically after

completion of all the tests to determine whether they are mutually consistent and if they

meet the specifications used.

The evaluation should take into consideration the results of all the tests (all test data).

Whenever doubtful (atypical) results are obtained they should be investigated. The complete

testing procedure needs to be checked according to the internal quality management system

(see also Part one, section 2).

18.2 When a doubtful result (suspected OOS result) has been identified, a review of the different

procedures applied during the testing process is to be undertaken by the supervisor with the

analyst or technician before retesting is permitted. The following steps should be followed:

18.2 (a) confirm with the analyst or technician that the appropriate procedure(s) was (were) applied

and followed correctly;

18.2 (b) examine the raw data to identify possible discrepancies;

18.2 (c) check all calculations;


18.2 (d) checks that the equipment used was qualified and calibrated, and that system suitability

tests were performed and were acceptable;

18.2 (e) ensure that the appropriate reagents, solvents and reference substances were used;

18.2 (f) confirm that the correct glassware was used; and

18.2 (g) ensure that original sample preparations are not discarded until the investigation is

complete.

18.3 The identification of an error which caused an aberrant result will invalidate the result and a

retest of the sample will be necessary. Doubtful results can be rejected only if they are clearly

due to an identif ied error. Sometimes the outcome of the investigation is

inconclusive — no obvious cause can be identified — in which case a confirmatory

determination is to be performed by another analyst who should be at least as experienced

and competent in the analytical procedure as the original analyst. A similar value would

indicate an OOS result. However, further confirmation using another method, if available,

may be advised.

18.4 An SOP should be in place for the conduct of an investigation of an OOS test result. The SOP

should give clear guidance on the number of retests allowed (based on sound statistical

principles). All investigations and their conclusions should be recorded. In the event of an

error, any corrective action taken and any preventive measure introduced should be recorded

and implemented.

18.5 All individual results (all test data) with acceptance criteria should be reported.

18.6 All conclusions should be entered on the analytical worksheet (see Part three, section 15) by

the analyst and signed by the supervisor. Note: Further guidance on evaluation and reporting

of test results is available in the following:

• Guideline elaborated by the US Food and Drug Administration (5);

• Guideline elaborated by the European Network of Official Medicines Control Laboratories

(OMCL) (28).

References cited in the Lab Guidelines

a) Supplementary guidelines in good manufacturing practice: validation. Qualification of systems

and equipment. In: WHO Expert Committee on Specifications for Pharmaceutical Preparations.

Fortieth report. Geneva, World Health Organization, 2006, Annex 4, Appendix 6 (WHO

Technical Report Series, No. 937).

b) Supplementary guidelines in good manufacturing practice: validation. Validation of

computerized systems. In: WHO Expert Committee on Specifications for Pharmaceutical

Preparations. Fortieth report. Geneva, World Health Organization, 2006, Annex 4, Appendix 5

(WHO Technical Report Series, No. 937).

Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPMedicines and Healthcare Products Regulatory Agency (MHRA) GMP Data Integrity Definitions and Guidance for Industry, January 2015

CHAPTER 3

Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPEU Commission - EudraLex: The Rules Governing Medicinal Products in the European Union, Volume 4, Good Manufacturing Practice, Medicinal Products

for Human and Veterinary Use, Chapter 4: Documentation, 2010

CHAPTER 4

Chapter 4: Documentation


Principle 98

Required GMP Documentation 98

Generation and Control of Documentation 99

Good Documentation Practices 100

Retention of Documents 100

Specifications 100

Manufacturing Formula and Processing Instructions 101

Procedures and records 104

Table of Contents

96


Legal basis for publishing the detailed guidelines: Article 47 of Directive 2001/83/EC on the Community

code relating to medicinal products for human use and Article 51 of Directive 2001/82/EC on the

Community code relating to veterinary medicinal products. This document provides guidance for the

interpretation of the principles and guidelines of good manufacturing practice (GMP) for

medicinal products as laid down in Directive 2003/94/EC for medicinal products for human use and

Directive 91/412/EEC for veterinary use.

Status of the document: revision 1

Reasons for changes: the sections on "generation and control of documentation" and "retention of

documents" have been revised, in the light of the increasing use of electronic documents within the GMP

environment.

Deadline for coming into operation: 30 June 2011

Commission Européenne, B-1049 Bruxelles / Europese Commissie,

B-1049 Brussel - Belgium

Telephone: (32-2) 299 11 11

EU Commission - EudraLex: The Rules Governing Medicinal Products in the European Union, Volume 4, Good Manufacturing Practice, Medicinal Products for Human and Veterinary Use, Chapter 4: Documentation, 2010


Principle

Required GMP documentation (by type):

Good documentation constitutes an essential part of the quality assurance system and is key to operating

in compliance with GMP requirements. The various types of documents and media used should be fully

defined in the manufacturer's Quality Management System. Documentation may exist in a variety

of forms, including paper-based, electronic or photographic media. The main objective of the system of

documentation utilized must be to establish, control, monitor and record all activities which directly or

indirectly impact on all aspects of the quality of medicinal products. The Quality Management System

should include sufficient instructional detail to facilitate a common understanding of the requirements,

in addition to providing for sufficient recording of the various processes and evaluation of any

observations, so that ongoing application of the requirements may be demonstrated.

There are two primary types of documentation used to manage and record GMP compliance:

instructions (directions, requirements) and records/reports. Appropriate good documentation practice

should be applied with respect to the type of document.

Suitable controls should be implemented to ensure the accuracy, integrity, availability and legibility of

documents. Instruction documents should be free from errors and available in writing. The term ‘written’

means recorded, or documented on media from which data may be rendered in a human readable form.

Site Master File: A document describing the GMP related activities of the manufacturer.

Instructions (directions, or requirements) type:

Specifications Describe in detail the requirements with which the products or materials used or

obtained during manufacture have to conform. They serve as a basis for quality evaluation.

Manufacturing Formulae, Processing, Packaging and Testing Instructions: Provide detail all

the starting materials, equipment and computerised systems (if any) to be used and specify all

processing, packaging, sampling and testing instructions. In- process controls and process

analytical technologies to be employed should be specified where relevant, together with

acceptance criteria.

Procedures: (Otherwise known as Standard Operating Procedures, or SOPs), give directions for

performing certain operations.

Protocols: Give instructions for performing and recording certain discreet operations.

Technical Agreements: Are agreed between contract givers and acceptors for outsourced activities.

Record/Report type:

Records: Provide evidence of various actions taken to demonstrate compliance with instructions,

e.g. activities, events, investigations, and in the case of manufactured batches a history of each


batch of product, including its distribution. Records include the raw data which is used to generate

other records. For electronic records regulated users should define which data are to be used as raw

data. At least, all data on which quality decisions are based should be defined as raw data

1Certificates of Analysis: Provide a summary of testing results on samples of products or materials

together with the evaluation for compliance to a stated specification.

Reports: Document the conduct of particular exercises, projects or investigations, together with

results, conclusions and recommendations.

4.1 All types of document should be defined and adhered to. The requirements apply equally to all

forms of document media types. Complex systems need to be understood, well documented,

validated, and adequate controls should be in place. Many documents (instructions and/or

records) may exist in hybrid forms, i.e. some elements as electronic and others as paper based.

Relationships and control measures for master documents, official copies, data handling and

records need to be stated for both hybrid and homogenous systems. Appropriate controls for

electronic documents such as templates, forms, and master documents should be implemented.

Appropriate controls should be in place to ensure the integrity of the record throughout the

retention period.

4.2 Documents should be designed, prepared, reviewed, and distributed with care. They should comply

with the relevant parts of Product Specification Files, Manufacturing and Marketing Authorisation

dossiers, as appropriate. The reproduction of working documents from master documents should


4.3 Documents containing instructions should be approved, signed and dated by appropriate and

authorised persons. Documents should have unambiguous contents and be uniquely identifiable.

The effective date should be defined.

4.4 Documents containing instructions should be laid out in an orderly fashion and be easy to check.

The style and language of documents should fit with their intended use. Standard Operating

Procedures, Work Instructions and Methods should be written in an imperative mandatory style.

4.5 Documents within the Quality Management System should be regularly reviewed and kept up-to-

date.

4.6 Documents should not be hand-written; although, where documents require the entry of data,

sufficient space should be provided for such entries.

Generation and Control of Documentation

1Alternatively the certification may be based, in-whole or in-part, on the assessment of real time data (summaries and exception reports) from batch related process analytical technology (PAT), parameters or metrics as per the approved marketing authorisation dossier.


Good Documentation Practices

Retention of Documents

Specifications

4.7 Handwritten entries should be made in clear, legible, indelible way.

4.8 Records should be made or completed at the time each action is taken and in such a way that all

significant activities concerning the manufacture of medicinal products are traceable.

4.9 Any alteration made to the entry on a document should be signed and dated; the alteration should

permit the reading of the original information. Where appropriate, the reason for the alteration

should be recorded.

4.10 It should be clearly defined which record is related to each manufacturing activity and where this

record is located. Secure controls must be in place to ensure the integrity of the record throughout

the retention period and validated where appropriate.

4.11 Specific requirements apply to batch documentation which must be kept for one year after expiry of

the batch to which it relates or at least five years after certification of the batch by the Qualified

Person, whichever is the longer. For investigational medicinal products, the batch documentation

must be kept for at least five years after the completion or formal discontinuation of the last

clinical trial in which the batch was used. Other requirements for retention of documentation may

be described in legislation in relation to specific types of product (e.g. Advanced Therapy

Medicinal Products) and specify that longer retention periods be applied to certain documents.

4.12 For other types of documentation, the retention period will depend on the business activity which

the documentation supports. Critical documentation, including raw data (for example relating to

validation or stability), which supports information in the Marketing Authorisation should be

retained whilst the authorization remains in force. It may be considered acceptable to retire

certain documentation (e.g. raw data supporting validation reports or stability reports) where the

data has been superseded by a full set of new data. Justification for this should be documented

and should take into account the requirements for retention of batch documentation; for example,

in the case of process validation data, the accompanying raw data should be retained for a period

at least as long as the records for all batches whose release has been supported on the basis of that

validation exercise.

The following section gives some examples of required documents. The quality management system

should describe all documents required to ensure product quality and patient safety.

4.13 There should be appropriately authorised and dated specifications for starting and packaging

materials, and finished products.

101




Manufacturing Formula and Processing Instructions

4.14 Specifications for starting and primary or printed packaging materials should include or provide

reference to, if applicable:

a) A description of the materials, including:

- The designated name and the internal code reference;

- The reference, if any, to a pharmacopoeial monograph;

- The approved suppliers and, if reasonable, the original producer of the material;

- A specimen of printed materials;

b) Directions for sampling and testing;

c) Qualitative and quantitative requirements with acceptance limits;

d) Storage conditions and precautions;

e) The maximum period of storage before re-examination.

4.15 Specifications for intermediate and bulk products should be available for critical steps or if these

are purchased or dispatched. The specifications should be similar to specifications for starting

materials or for finished products, as appropriate.

4.16 Specifications for finished products should include or provide reference to:

a) The designated name of the product and the code reference where applicable;

b) The formula;

c) A description of the pharmaceutical form and package details;

d) Directions for sampling and testing

e) The qualitative and quantitative requirements, with the acceptance limits;

f) The storage conditions and any special handling precautions, where applicable;

g) The shelf-life.

Approved, written Manufacturing Formula and Processing Instructions should exist for each product and

batch size to be manufactured.

4.17 The Manufacturing Formula should include:

a) The name of the product, with a product reference code relating to its specification;

b) A description of the pharmaceutical form, strength of the product and batch size;

c) A list of all starting materials to be used, with the amount of each, described; mention

should be made of any substance that may disappear in the course of processing;


102

d) A statement of the expected final yield with the acceptable limits, and of relevant

intermediate yields, where applicable

4.18 The Processing Instructions should include:

a) A statement of the processing location and the principal equipment to be used;

b) The methods, or reference to the methods, to be used for preparing the critical equipment

(e.g. cleaning, assembling, calibrating, sterilising);

c) Checks that the equipment and work station are clear of previous products, documents

or materials not required for the planned process, and that equipment is clean and suitable

for use;

d) Detailed stepwise processing instructions [e.g. checks on materials, pre-treatments,

sequence for adding materials, critical process parameters (time, temp etc)];

e) The instructions for any in-process controls with their limits;

f) Where necessary, the requirements for bulk storage of the products; including the container,

labeling and special storage conditions where applicable;

g) Any special precautions to be observed.

4.19 Approved Packaging Instructions for each product, pack size and type should exist. These should

include, or have a reference to, the following:

a) Name of the product; including the batch number of bulk and finished product b) Description of

its pharmaceutical form, and strength where applicable;

c) The pack size expressed in terms of the number, weight or volume of the product in the final

container;

d) A complete list of all the packaging materials required, including quantities, sizes and types,

with the code or reference number relating to the specifications of each packaging

material;

e) Where appropriate, an example or reproduction of the relevant printed packaging materials,

and specimens indicating where to apply batch number references, and shelf life of the product;

f) Checks that the equipment and work station are clear of previous products, documents or

materials not required for the planned packaging operations (line clearance), and that

equipment is clean and suitable for use.

g) Special precautions to be observed, including a careful examination of the area and equipment

in order to ascertain the line clearance before operations begin;

h) A description of the packaging operation, including any significant subsidiary operations,

and equipment to be used;

Packaging Instructions


103

i) Details of in-process controls with instructions for sampling and acceptance limits.

4.20 A Batch Processing Record should be kept for each batch processed. It should be based on the

relevant parts of the currently approved Manufacturing Formula and Processing Instructions, and

should contain the following information:

a) The name and batch number of the product;

b) Dates and times of commencement, of significant intermediate stages and of completion of

production;

c) Identification (initials) of the operator(s) who performed each significant step of the process

and, where appropriate, the name of any person who checked these operations;

d) The batch number and/or analytical control number as well as the quantities of each starting

material actually weighed (including the batch number and amount of any recovered or

reprocessed material added);

e) Any relevant processing operation or event and major equipment used;

f) A record of the in-process controls and the initials of the person(s) carrying them out, and the

results obtained;

g) The product yield obtained at different and pertinent stages of manufacture;

h) Notes on special problems including details, with signed authorisation for any deviation

from the Manufacturing Formula and Processing Instructions;

i) Approval by the person responsible for the processing operations.

Note: Where a validated process is continuously monitored and controlled, then automatically

generated reports may be limited to compliance summaries and exception/ out-of-

specification (OOS) data reports.

4.21 A Batch Packaging Record should be kept for each batch or part batch processed. It should be based

on the relevant parts of the Packaging Instructions.

The batch packaging record should contain the following information:

a) The name and batch number of the product,

b) The date(s) and times of the packaging operations;



d) Records of checks for identity and conformity with the packaging instructions, including the

results of in-process controls;

Batch Processing Record

Batch Packaging Record


104

e) Details of the packaging operations carried out, including references to equipment and the

packaging lines used;

f) Whenever possible, samples of printed packaging materials used, including specimens of

the batch coding, expiry dating and any additional overprinting;

g) Notes on any special problems or unusual events including details, with signed authorisation for

any deviation from the Packaging Instructions;

h) The quantities and reference number or identification of all printed packaging materials and

bulk product issued, used, destroyed or returned to stock and the quantities of obtained

product, in order to provide for an adequate reconciliation. Where there are there are robust

electronic controls in place during packaging there may be justification for not including this

information

i) Approval by the person responsible for the packaging operations

Receipt

4.22 There should be written procedures and records for the receipt of each delivery of each starting

material, (including bulk, intermediate or finished goods), primary, secondary and printed

packaging materials.


a) The name of the material on the delivery note and the containers; b) The "in-house" name

and/or code of material (if different from a); c) Date of receipt;

d) Supplier’s name and, manufacturer’s name;

e) Manufacturer’s batch or reference number;

f) Total quantity and number of containers received;

g) The batch number assigned after receipt;

h) Any relevant comment.

4.24 There should be written procedures for the internal labeling, quarantine and storage of starting

materials, packaging materials and other materials, as appropriate.

4.25 There should be written procedures for sampling, which include the methods and equipment

to be used, the amounts to be taken and any precautions to be observed to avoid contamination of

the material or any deterioration in its quality.

Procedures and records

Sampling


105

Testing

Other



recorded.


particular for the certification for sale of the finished product by the Qualified Person(s). All

records should be available to the Qualified Person. A system should be in place to indicate special

observations and any changes to critical data.

4.28 Records should be maintained for the distribution of each batch of a product in order to facilitate

recall of any batch, if necessary.

4.29 There should be written policies, procedures, protocols, reports and the associated records of

actions taken or conclusions reached, where appropriate, for the following examples:

- Validation and qualification of processes, equipment and systems;

- Equipment assembly and calibration;

- Technology transfer;

- Maintenance, cleaning and sanitation;

- Personnel matters including signature lists, training in GMP and technical matters, clothing and

hygiene and verification of the effectiveness of training.

- Environmental monitoring;

- Pest control;

- Complaints;

- Recalls;

- Returns;

- Change control;

- Investigations into deviations and non-conformances;

- Internal quality/GMP compliance audits;

- Summaries of records where appropriate (e.g. product quality review);

- Supplier audits.

4.30 Clear operating procedures should be available for major items of manufacturing and test

equipment.

4.31 Logbooks should be kept for major or critical analytical testing, production equipment, and areas

where product has been processed. They should be used to record in chronological order, as

appropriate, any use of the area, equipment/method, calibrations, maintenance, cleaning or

repair operations, including the dates and identity of people who carried these operations out.

4.32 An inventory of documents within the Quality Management System should be maintained.


Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPEU Commission - EudraLex: The Rules Governing Medicinal Products in the European Union, Volume 4, Good Manufacturing Practice, Medicinal Products

for Human and Veterinary Use, Annex 11: Computerized Systems, 2010

CHAPTER 5


Legal basis for publishing the detailed guidelines: Article 47 of Directive 2001/83/EC on the Community

code relating to medicinal products for human use and Article 51 of Directive 2001/82/EC on the

Community code relating to veterinary medicinal products. This document provides guidance for the

interpretation of the principles and guidelines of good manufacturing practice (GMP) for medicinal

products as laid down in Directive 2003/94/EC for medicinal products for human use and Directive

91/412/EEC for veterinary use.

Status of the document: revision 1

Reasons for changes: the Annex has been revised in response to the increased use of computerised

systems and the increased complexity of these systems. Consequential amendments are also proposed for

Chapter 4 of the GMP Guide.

Deadline for coming into operation: 30 June 2011

Commission Européenne, B-1049 Bruxelles / Europese Commissie,

B-1049 Brussel - Belgium

Telephone: (32-2) 299 11 11

EU Commission - EudraLex: The Rules Governing Medicinal Products in the European Union, Volume 4, Good Manufacturing Practice, Medicinal Products for Human and Veterinary Use, Annex 11: Computerized Systems, 2010


Principle

General

This annex applies to all forms of computerised systems used as part of a GMP regulated activities. A

computerised system is a set of software and hardware components which together fulfill certain

functionalities.

The application should be validated; IT infrastructure should be qualified.

Where a computerised system replaces a manual operation, there should be no resultant decrease in

product quality, process control or quality assurance. There should be no increase in the overall risk of the

process.

1. Risk Management

Risk management should be applied throughout the lifecycle of the computerised system taking into

account patient safety, data integrity and product quality. As part of a risk management system,

decisions on the extent of validation and data integrity controls should be based on a justified and

documented risk assessment of the computerised system.

2. Personnel

There should be close cooperation between all relevant personnel such as Process Owner, System

Owner, Qualified Persons and IT. All personnel should have appropriate qualifications, level of access

and defined responsibilities to carry out their assigned duties.

3. Suppliers and Service Providers

3.1 When third parties (e.g. suppliers, service providers) are used e.g. to provide, install, configure,

integrate, validate, maintain (e.g. via remote access), modify or retain a computerised system or

related service or for data processing, formal agreements must exist between the manufacturer and

any third parties, and these agreements should include clear statements of the responsibilities of the

third party. IT-departments should be considered analogous.

3.2 The competence and reliability of a supplier are key factors when selecting a product or service

provider. The need for an audit should be based on a risk assessment.

3.3 Documentation supplied with commercial off-the-shelf products should be reviewed by regulated

users to check that user requirements are fulfilled.

3.4 Quality system and audit information relating to suppliers or developers of software and

implemented systems should be made available to inspectors on request.


Project Phase

Operational Phase

4. Validation

4.1 The validation documentation and reports should cover the relevant steps of the life cycle.

Manufacturers should be able to justify their standards, protocols, acceptance criteria, procedures

and records based on their risk assessment.

4.2 Validation documentation should include change control records (if applicable) and reports on any

deviations observed during the validation process.

4.3 An up to date listing of all relevant systems and their GMP functionality (inventory) should be

available.

For critical systems an up to date system description detailing the physical and logical

arrangements, data flows and interfaces with other systems or processes, any hardware and software

pre-requisites, and security measures should be available.

4.4 User Requirements Specifications should describe the required functions of the computerised system

and be based on documented risk assessment and GMP impact. User requirements should be

traceable throughout the life-cycle.

4.5 The regulated user should take all reasonable steps, to ensure that the system has been developed in

accordance with an appropriate quality management system. The supplier should be assessed

appropriately.

4.6 For the validation of bespoke or customised computerised systems there should be a process in place

that ensures the formal assessment and reporting of quality and performance measures for all the

life-cycle stages of the system.

4.7 Evidence of appropriate test methods and test scenarios should be demonstrated. Particularly,

system (process) parameter limits, data limits and error handling should be considered. Automated

testing tools and test environments should have documented assessments for their adequacy.

4.8 If data are transferred to another data format or system, validation should include checks that data

are not altered in value and/or meaning during this migration process.

5. Data

Computerised systems exchanging data electronically with other systems should include appropriate

built-in checks for the correct and secure entry and processing of data, in order to minimize the

risks.


6. Accuracy Checks

For critical data entered manually, there should be an additional check on the accuracy of the data.

This check may be done by a second operator or by validated electronic means. The criticality and the

potential consequences of erroneous or incorrectly entered data to a system should be covered by

risk management.

7. Data Storage

7.1 Data should be secured by both physical and electronic means against damage. Stored data should

be checked for accessibility, readability and accuracy. Access to data should be ensured throughout

the retention period.

7.2 Regular back-ups of all relevant data should be done. Integrity and accuracy of back- up data and the

ability to restore the data should be checked during validation and monitored periodically.

8. Printouts

8.1 It should be possible to obtain clear printed copies of electronically stored data.

8.2 For records supporting batch release it should be possible to generate printouts indicating if any of

the data has been changed since the original entry.

9. Audit Trails

Consideration should be given, based on a risk assessment, to building into the system the creation

of a record of all GMP-relevant changes and deletions (a system generated "audit trail"). For change

or deletion of GMP-relevant data the reason should be documented. Audit trails need to be available

and convertible to a generally intelligible form and regularly reviewed.

10. Change and Configuration Management

Any changes to a computerised system including system configurations should only be made in a

controlled manner in accordance with a defined procedure.

11. Periodic evaluation

Computerised systems should be periodically evaluated to confirm that they remain in a valid state

and are compliant with GMP. Such evaluations should include, where appropriate, the current range

of functionality, deviation records, incidents, problems, upgrade history, performance, reliability,

security and validation status reports.

12. Security

12.1 Physical and/or logical controls should be in place to restrict access to computerised system to

authorised persons. Suitable methods of preventing unauthorised entry to the system may include

112

the use of keys, pass cards, personal codes with passwords, biometrics, restricted access to computer

equipment and data storage areas.

12.2 The extent of security controls depends on the criticality of the computerised system.

12.3 Creation, change, and cancellation of access authorisations should be recorded.

12.4 Management systems for data and for documents should be designed to record the identity of

operators entering, changing, confirming or deleting data including date and time.

13. Incident Management

All incidents, not only system failures and data errors, should be reported and assessed. The root

cause of a critical incident should be identified and should form the basis of corrective and

preventive actions.

14. Electronic Signature

Electronic records may be signed electronically. Electronic signatures are expected to:

a. have the same impact as hand-written signatures within the boundaries of the company,

b. be permanently linked to their respective record,

c. include the time and date that they were applied.

15. Batch release

When a computerised system is used for recording certification and batch release, the system should

allow only Qualified Persons to certify the release of the batches and it should clearly identify and

record the person releasing or certifying the batches. This should be performed using an electronic

signature.

16. Business Continuity

For the availability of computerised systems supporting critical processes, provisions should be made

to ensure continuity of support for those processes in the event of a system breakdown (e.g. a

manual or alternative system). The time required to bring the alternative arrangements into use

should be based on risk and appropriate for a particular system and the business process it supports.

These arrangements should be adequately documented and tested.

17. Archiving

Data may be archived. This data should be checked for accessibility, readability and integrity. If

relevant changes are to be made to the system (e.g. computer equipment or programs), then the

ability to retrieve the data should be ensured and tested.


113

Glossary

Application: Software installed on a defined platform/hardware providing specific functionality

Bespoke/Customized computerised system: A computerised system individually designed to suit a

specific business process

Commercial of the shelf software: Software commercially available, whose fitness for use is

demonstrated by a broad spectrum of users.

IT Infrastructure: The hardware and software such as networking software and operation systems, which

makes it possible for the application to function.

Life cycle: All phases in the life of the system from initial requirements until retirement

including design, specification, programming, testing, installation, operation, and maintenance.

Process owner: The person responsible for the business process.

System owner: The person responsible for the availability, and maintenance of a computerised system

and for the security of the data residing on that system.

Third Party: Parties not directly managed by the holder of the manufacturing and/or import

authorisation.


Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPPharmaceutical Inspection Convention/ Pharmaceutical Inspection Co-Operation Scheme (PIC/S): Good practices for Computerized Systems in

regulated “GXP” environments, September 2007

CHAPTER 6



1. Document history 118

PART ONE - PREAMBLE 118

2. Purpose 118

3. Scope 119

4. Introduction 120

PART TWO - IMPLEMENTATION OF SYSTEM 123

5. Implementation of computerised systems 123

6. The structure and functions of the computer system(s) 124

7. Planning and life-cycle management 126

8. Management and responsibilities 126

9. User requirement specifications (URS) 128

10. Functional specifications (FS) 129

11. Suppliers, software developers and quality management 130

12. Important QMS and software standards attributes 131

13. Testing 132

14. Validation strategies and priorities 133

15. GAMP validation approach based on different categories of software products 135

16. Retrospective validation 136

PART THREE - SYSTEM OPERATION / INSPECTION / REFERENCES 137

17. Change management 137

18. Change control and error report system 138

19. System security, including back-up 139

20. Data changes - audit trail/critical data entry 141

Table of Contents

116

21. Electronic records and electronic signatures 142

22. Personnel 146

23. Inspection considerations 147

24. Checklists and aide memoires 150

25. References for relevant standards and GMP guides / codes 156

26. Suggested further reading 158

27. Glossary of terms 159

28. Abbreviations used in the document 166

29. Revision history 166


CHAPTER 1


1. DOCUMENT HISTORY

PART ONE - PREAMBLE

2. PURPOSE

Adoption by PIC/S Committee 2-3 June 2003

Entry into force 1 September 2003

2.1 The PIC/S Guide to Good Manufacturing Practices is the basis for GMP inspections. In particular its

Annex 11, ‘Computerised Systems’ is used when inspecting such systems.

2.2 The purpose of this document is to provide recommendations and background information

concerning computerised systems that will be of assistance to inspectors for training purposes and

during the inspection of computerised systems. The document will be of assistance to all ‘Good

Practice’ Inspectors responsible for inspecting applications in the regulated pharmaceutical 1

sector ; hence the use of the acronym ‘GxP’ in the title. It is recognised that not all companies

subjected to GLP inspections are linked to the regulated pharmaceutical sector. However, it is

considered that the guidance contained within this PIC/S document may also be beneficial to

companies subjected to other regulatory frameworks and GLP inspection.

2.3 GDP defines the scope of compliance requirements for wholesaling and distribution practice.

Where automated systems and electronic records are used for such applications then inspectors

will expect such regulated users to have in place the sorts of controls and disciplines outlined in

this document, or a best practice alternative. Vertically integrated companies (R&D,

manufacturing and distribution) will already apply such controls and compliance measures.

2.4 International regulatory agencies have collaborated to produce this harmonised guidance for the

implementation, management and operation of computerised systems. It is intended as a

reference for regulated users, including their suppliers, in addition to regulatory inspectors and

investigators.

2.5 This guidance document is intended to provide a logical explanation of the basic requirements for

the implementation, validation and operation of computerised systems. Additionally, the

GOOD PRACTICES FOR COMPUTERISED SYSTEMS IN REGULATED “GXP” ENVIRONMENTS

25 September 2007

1Throughout this document the 'users' (owners of the good practice computerised systems being inspected) are collectively

referred to as 'regulated users' for clarity.

CHAPTER 1


document may be adapted to identify the criteria that would be expected to be considered if a

regulated user, or a regulatory agency, were to conduct an inspection of the implemented

computerised system(s),against GxP compliance requirements and/or perceived risks.

2.6 This guidance document provides details of good practices, which should support new technology

and technical innovations.

2.7 It should be noted that it is important for national legislation to be referred to when determining

the extent to which the provisions laid down in this document may be applicable.

2.8 An auditor or an inspector may wish to consider evidence for compliance as indicated in italicised

text throughout this document.

2.9 It is to be hoped that the PIC/S Expert Circle on Computerised Systems will build on this consensus

reference document, to deliver simplified training and aide memoires for the inspection of

common GxP systems, as well as sector specific applications. As technology continues its relentless

advance the Expert Circle could also provide interpretation of GxP and recommend changes, if

appropriate. Such materials could provide further sub-set appendices to Section 24 (‘Inspection

tabulated checklists and aide memoires’).

2.10 Some repetition is inevitable in a document that has evolved over many years and through various

working party multinational iterations. It is not intended that this document is read from cover to

cover, but should be ‘dipped into’ as a reference source when needed and for that reason some

sections have to stand-alone.

3.1 It is acknowledged that the field of computer technology continues to develop at a considerable

speed and the regulated user has to ensure that the software and systems have been developed to

best engineering practices in a quality assured manner. It will be for regulated users to define

relevant applications, impacted business units and corresponding deliverables for such

applications. This document sheds some light on the techniques and controls required for this.

3.2 At the time of issue this document reflected the current state of the art. It is not intended to be a

barrier to technical innovation or the pursuit of excellence. The advice in this Guidance is not

mandatory for industry. However, industry should consider these recommendations as

appropriate.

3.3 For hardware, peripherals, integrated process links and system functionality in general, the

controls and testing arrangements are by comparison to software, fairly mature, logically more

visible and the failure modes more predictable.

3.4 As a result, we have tried to keep the contents of this document practical and principle-oriented,

to ensure that it retains relevance for as long as possible. However, value judgements and

consensus between parties can be difficult to achieve at times in this complicated field.

3. SCOPE

3.5 The scope of the document is broad, covering necessary steps and the documentation needed for

the implementation and validation of a computerised system. Management of such projects 2

requires the linking of important aspects of management policies, documentation and record

systems embracing the respective professional disciplines involved in the development and use of

the computerised system.

3.6 Of necessity this guidance contains some ‘how to’ achieve GxP compliance advice for suppliers and

developers of software and automated systems, in addition to guidance for the regulated users.

This is because of the iterative nature of software development and the requirement for quality and

functionality to be built into the software in a disciplined manner, to ensure structural integrity,

consistency, robustness and reliability. This will often be outside of the direct control of the

regulated user (as purchaser/customer). There will normally be a need to manage and control the

split responsibilities of contracted suppliers (whether in-house or external party) and regulated

user businesses (customers), for project management, product specifications, quality assurance

standards and performance.

3.7 This document also identifies the important aspects of validation of computerised systems.

Descriptions of strategies that may be used for different categories of computer systems are

described as well as identifying the approach that might be taken for the retrospective validation

of legacy (old) systems. (see in particular Sections 4.5 and 6.2 (Figure:1) and 16 of this

document).

3.8 PIC/S considers that adoption of the principles, guidance, reporting and life cycle documentation

best practices, outlined in this document, will enable users of computerised systems to establish

quality assurance systems and records capable of demonstrating compliance with current GxP

requirements and related guidance.

4.1 The structure of the document is designed to identify discrete subsections and their

interrelationship within the principal topics concerning the implementation, validation and

operation of computerised systems. A reference section, together with a glossary of terms

commonly used in this industry sector will be found at the end of this document. Section 26

'Further Reading' suggests a number of textbooks, technical reports and guidelines that amplify

the science, technology and practices underpinning this guideline. The 1994 publication by Stokes

et al (Further Reading Ref: 1) provides insight into the requirements for computerised systems in

GCP, GLP and GMP, together with a historical perspective on validation and international regulatory

requirements.

4.2 In recent years there has been an increasing trend to integrate electronic record and business

management systems across all operational areas. In the future it is expected that our reliance on

computer systems will continue to grow, rather than diminish. The use of validated, effective, GxP

4. INTRODUCTION


CHAPTER 1

2For successful project management these links should be established between the supplier(s) [developer(s) and producer(s) of

individual components or complete computerised system] and the regulated user [purchaser and user of the computerised

system].

controlled computerised systems should provide enhancements in the quality assurance of

regulated materials/products and associated data/information management. The extent of the

validation effort and control arrangements should not be underestimated and a harmonised

approach by industry and regulators is beneficial.

4.3 Commercial 'off the shelf', 'standard', or proprietary systems can be particularly difficult to

assess from a quality and performance point of view. For GxP regulated applications it is essential

for the regulated user to define a requirement specification prior to selection and to carry out a

properly documented supplier assessment and risk analysis for the various system options.

Information for such exercises may come from supplier audits and research into the supplier's

product versions in the user community and literature. This risk-based approach is one way for a

firm to demonstrate that they have applied a controlled methodology, to determine the degree of

assurance that a computerised system is fit for purpose. It will certainly be useful evidence for

consideration by an inspector. (Note: What constitutes a 'critical application' may vary

considerably, depending on the situation – perhaps more so in GLP than in other disciplines).

4.4 Whilst much of the detailed industry guidance relates to 'bespoke' and configured applications

there are a number of tools and assessment techniques recommended for commercial packages and

standard automated equipment. Complex automated state of the art processing equipment (such

as high output tabletting machinery with in-process monitoring and feedback control

functionality), or complex analytical instrumentation, for example, is difficult to assess without

the supplier's help. The co-operation of the supplier is essential and it is important for suppliers to

anticipate the needs of regulated user's for relevant product development life cycle quality and

validation information. Such an approach also provides added value for the automated products.

The QA and validation aspects for large automation aspects will inevitably be complex and may be

subsumed in major engineering projects activated by the potential regulated user. Inspectors will

be interested in the evidence relating to the firm's assessment of the supplier's critical automated

features as well as the traditional engineering, qualification and process performance aspects. Much

of the guidance given in the GAMP Guide (Ref: 4), for example, is scaleable to complex projects and

equipment with sub-contracted features. (Note: The risk assessment described in '4.3' above should

identify critical features and functions for both the project team and the inspector).

4.5 When a GxP inspector has to assess an installed computerised system at a regulated user's site,

s/he may consider some, or all, of the elements shown in Figure 1: “Computerised system”, (viz.:

the controlling system and the controlled process in an operating environment). The inspector will

consider the potential risks, from the automated system to product/material quality or data integrity,

as identified and documented by the regulated user, in order to assess the fitness for purpose of

the particular system(s). The company's risk assessment records may also be referred to as part of this

process. The inspector's assessment may also involve a consideration of system life cycle, quality

assurance measures, validation and operational control evidence for the controlling system, as well as

validation and operational experience with the controlled process.

4.6 The validation documentation should cover all the steps of the life-cycle with appropriate methods for


measurement and reporting, (e.g. assessment reports and details of quality and test measures), as

required. Regulated users should be able to justify and defend their standards, protocols, acceptance

criteria, procedures and records in the light of their own documented risk and complexity

assessments, aimed at ensuring fitness for purpose and regulatory compliance.

4.7 The Pharmaceutical Industry Systems Validation Forum in the UK developed the Good Automated

Manufacturing Practice (GAMP) Supplier Guide to assist software suppliers in implementing an

appropriate quality management system. The GAMP Guide (and appendices) has evolved largely to

define best practices in specifying, designing, building, testing, qualifying and documenting these

systems to a rigorous validation management scheme, largely for the controlling system. GAMP

Forum is now sponsored by ISPE and has international membership and participation, including

'GAMP Americas'. (Websites: www.gamp.org and www.ispe.org)

4.8 Apart from user acceptance testing (OQ) versus the functional specification, which may include

'Factory Acceptance Testing' (FAT), for example, at the supplier, the regulated user also has

responsibility for the (PQ) performance qualification of the system. In this context the PQ user

acceptance test of the system is in its operating environment3, and will again be against a User

Requirements Specification (URS) that will include protocols and criteria for the performance and

quality acceptance, not only for the controlling system but also for the controlled (pharmaceutical

related) process application. Cross- references to any related, relevant process validation

documentation should be clearly stated in respect of the latter. The GAMP Guide and PDA technical

report No 18 (Further Reading Ref:6) provide good practice guidance to drafting and using a URS,

whereas pharmaceutical process validation guidance is given elsewhere (see PIC/S PI 006 and related

EU/USFDA documents).

4.9 Computerised systems may simplistically be considered to exist as three main application types,

i.e.: process control systems, data processing systems, (including data collection/capture) and

data record/ storage systems. There may be links between these three types of system, described

as 'interfaces'. For critical systems, the inspector should study the user's specifications, reports,

data, acceptance criteria and other documentation for various phases of the project. The regulated

user should be able to demonstrate through the validation evidence that they have a high level of

confidence in the integrity of both the processes executed within the controlling computer system

and in those processes controlled by the computer system within the prescribed operating

environment.

4.10 The simplification of application system types may at first sight seem to be misleading for some

readers. For GCP, examples of specific clinical systems have been described in 'Computer Systems

Validation in Clinical Research' Section 9 (Further Reading Ref: 12). It can be seen that many of

these systems have much in common with requirements for other GxP sectors, (e.g. Electronic

transfer of data and/or software systems, (clinical) database management systems, statistical

systems, derived data systems, electronic document management systems, electronic records and

electronic signatures).


3Large enterprise or MRP-II systems may be tested in a pilot mode environment initially, followed by controlled ‘roll-out’ to the

user environment.

4.11 The regulated users of the system have the ultimate responsibility for ensuring that documented

validation evidence is available to GxP inspectors for review.

4.12 In addition to the validation considerations, the inspector will also be concerned with assessing

the basic operational controls, quality system and security features for these systems, as indicated in

the PIC/S GMP Annex 11 and amplified in the APV Guidance, q.v. For a copy of the APV Guidance,

see GAMP 4 Appendix 09 (Further Reading Ref: 15).

5.1 The assurance of the reliability of a Supplier's software products is attributable to the quality of

the software engineering processes followed during development. This should include design,

coding, verification testing, integration, and change control features of the development life

cycle, (including after sales support). In order for customers to have confidence in the reliability of

the products, they should evaluate the quality methodology of the supplier for the design, 4

construction, supply and maintenance of the software . A formal, extensive review of the history of

the Supply Company and the software package may be an option to consider where an additional

degree of assurance of the reliability of the software is needed. This should be documented in a 5

Supplier Audit Report . Prospective purchasers should consider any known limitations and

problems for particular software packages or versions and the adequacy of any corrective

actions by the Supplier. Appropriate, comprehensive documented customer acceptance testing

should support the final selection of the software package. Errors often come to light after

implementation and it is important for the Supplier to advise/assist the Customer concerning any

problems and modifications to resolve errors. For so called 'standard software packages' and COTS

(as referenced in the GAMP guide and commercial literature), it is important that purchasers are

vigilant in maintaining reliable systems. This may include documented reviews of their own

experiences, (e.g. log books and error reporting and resolution), from reading relevant literature or

from interacting with application 'User Groups' to identify and resolve any serious problems.

Conclusions and recommendations from such activities should be recorded.

5.2 Where the reliability and structural integrity of complex software products cannot be directly

assessed, or completely evaluated, then it is even more important to assure that a good

construction process has been used and has been properly documented. It is recognised that

complex commercial proprietary applications can be extremely difficult to assess due to 6

commercial secrecy and rivalry between suppliers, competing for market share . Market research 7

plus focused quality system and product specific audits of the suppliers by the regulated user (or

PART TWO - IMPLEMENTATION OF SYSTEM

5. IMPLEMENTATION OF COMPUTERISED SYSTEMS


4Refer also to ISO15504 (1998) 'Information Technology Software Process Assessment' and see GAMP 4 Appendix M2 'Guideline

for Supplier Audit'.

5A minority of suppliers are not responsive to requests for an audit. The need to perform a supplier audit should be linked to the

regulated user's risk assessment and quality assurance standards.

6The UK Government's Interdepartmental Committee on Software Engineering (ICSE) and the Real Time Engineering Group, have

referred to such software as SOUP ('Software of Uncertain Pedigree') (1999).

by an accredited third party auditor) may be beneficial here. The business/GxP criticality and risks

relating to the application will determine the nature and extent of any assessment of suppliers and

software products. GAMP Forum and PDA have provided advice and guidance in the GxP field on

these matters.

5.3 At all times there is a need for complete and accurate documentation and records to cover all aspects

of the design phase, implementation & validation of the computerised system(s). Operating and

reporting requirements for the important phases of the Software development Life Cycle related

qualifications and testing exercises and commissioning should be covered by comprehensive Standard

Operating Procedures or quality plans. The need for control and documentation of the development,

implementation and operation of computer systems is extremely important for the validation of the

system. There needs to be a strong emphasis on quality assurance in the development stages. It is

fundamental for system life cycle documents to be controlled and maintained (version, audit trails as

appropriate), within a quality assured document management system and available for inspection, if

necessary. Regulated users may choose to implement these requirements using either robust paper,

electronic or hybrid systems.

86.1 A recent USFDA document identifies three premises that constitute the basic principles of quality

assurance, which apply to software engineering:

• Quality, safety and effectiveness must be designed and built into the software.

• Quality cannot be inspected or tested into the finished software.

• Each phase of the development process must be controlled to maximise the probability that the

finished software meets all quality and design specifications.

6.2 A computerised system is composed of the computer system and the controlled function or

process. The computer system is composed of all computer hardware, firmware, installed devices,

and software controlling the operation of the computer. The controlled function may be composed 9

of equipment to be controlled and operating procedures that define the function of such

equipment, or it may be an operation, which does not require equipment other than the hardware

in the computer system. Interfaces and networked functions through LAN and WAN are aspects of

the computerised system and operating environment potentially linking a multitude of computers

and applications. A firm's GxP system environment, functionality and interactions with other

system(s) needs to be clearly defined and controlled in respect of GMP Annex 11 (4). It may be

necessary to equip personal PC applications and Internet/ e- mail/ personal data filing/ etc., with

appropriate security and design measures to protect GxP systems whilst permitting authorised

6. THE STRUCTURE AND FUNCTIONS OF THE COMPUTER SYSTEM(S)


7Audits are not mandatory but are considered 'good practice', and it is for the regulated user to determine any auditing needs,

scope and standards.

8'Final Guidance for Industry and FDA Staff: General Principles of Software Validation', CDRH, January 2002 (Further Reading Ref.

5).

9e.g. automated equipment and laboratory or process related instrumentation.

users to control the personal applications on their desktop PCs.

Figure 1 Schematic (below) identifies the relationship of the various components of a computerised

system in its operating environment.


SOFTWARE

HARDW ARE

Firmware

OPERATING PROCEDURES AND PEOPLE

COMPUTER SYSTEM (Controlling System)

CONTROLLED FUNCTION OR PROCESS

EQUIPMENT

COMPUTERISED SYSTEM

OPERATING ENVIRONMENT(including other networked, or standalone computerised systems, other systems, media,

people, equipment and procedures)

6.3 A large variety of computer systems are used in regulated user organisations. These range from the

simple standalone to large integrated and complex systems. For example, a significant proportion

of programmable electronic systems and proprietary automated equipment for manufacturing,

laboratory or clinical use, contains 'firmware' with embedded software in place (for further details

on firmware and embedded software refer to the glossary. Also, see Section 15.1 of this document

for approaches to be taken with different systems. Firmware and operating systems are usually

qualified for the intended use (including version, release or related criteria) as part of

performance qualification/process validation. Regulated users should have an inventory of all their

computerised systems, ownership, supplier/developer, functionality, links and validation status. A

policy and validation master plan for computerised systems should also be available for inspection.

7. PLANNING AND LIFE-CYCLE MANAGEMENT

8. MANAGEMENT AND RESPONSIBILITIES

7.1 A high level of assurance of quality and reliability cannot be attributed to a computerised system

based simply on a series of tests solely designed to confirm the correct function of the software

and its interaction with hardware. There needs to be a formal planned approach by the developer to

assure that quality is built into the product. ISO 9001 provides a quality system model for quality

assurance in design, development, production, installation and servicing. The objective of testing

during software development at the supplier should be to try to break the structural integrity of

the software and find any weaknesses through a rigorous testing regime. Audits of suppliers

conducted by or on behalf of regulated users should cover these issues when project related risk

analyses deem it to be necessary.

7.2 ISO/IEC 12207:1995 provides guidance on acceptable practices for Information Technology -

Software life cycle processes and ISO 9004, ISO 10005 and ISO 10007 provide guidance on Quality

Management and system elements, including quality plans and configuration management. IEEE

1298 is specific and prescriptive on what should be addressed in planning. ISO 9126 concerns

software quality and defines the quality attributes for critical applications. The GAMP Guide also

provides relevant guidance for the pharmaceutical sector.

107.3 It would be expected that the regulated user’s Validation Policy or Validation Master Plan (VMP)

should identify the company’s approach to validation and its overall philosophy with respect to 11

computerised systems. The VMP should:

• Identify which computerised systems are subject to validation.

• Provide brief descriptions of the validation strategies for different categories of computerised

systems as well as other validation activities.

• Outline protocols and related test procedures for all validation activities including computer

systems.

• Define reporting requirements to document validation exercises and related results.

• Identify key personnel and their responsibilities as part of the Validation Program.

8.1 It is important for a regulated user to have in place a comprehensive policy and procedures for the

specification, purchase, development and implementation of computerised systems. Ideally these

procedures would cover all computerised systems; this PIC/S document will only concern itself with

those systems that have an impact on GxP requirements.

8.2 The organisation should regard disciplines related to the introduction of a computerised system as

in accord with the basic principles of project management. Achieving the quality, performance and


10Refer to GMP Annex 15 for more details concerning the VMP requirements.

11It may be appropriate to refer to established policies, SOPs or individual validation plans to meet these requirements.

reliability objectives for any project requires competence in engineering and design. Where

regulated users do not have the resources for engineering and design within their own

organisation, there is a heavy reliance on the supplying company’s resources.

8.3 To satisfy the quality, performance and reliability objectives, the regulated user needs to assure

that the supplier’s management policies; systems and related procedures will achieve the desired

objectives. Enlightened suppliers should provide such evidence and added value to all customers,

whether large or small, through the recognition of industry standards from GAMP Forum, Supplier

Forum, PDA, ISPE, etc., and also through shared audits, user groups, and product certification

arrangements.

8.4 It is important to acknowledge that the scope and level of documentation and records n e e d e d

to formalise and satisfy basic project management requirements for critical systems will be dependent

upon:

• the complexity of the system and variables relating to quality and performance;

• the need to ensure data integrity;

• the level of risk associated with its operation;

• the GxP impact areas involved.

8.5 Within the regulated user organisation there should be clearly defined responsibilities for the 12

management of all ICT products, computerised systems and projects. Management should cover

the full spectrum, from simple input/output devices and programmable logic controllers (PLCs)

through to integrated supervisory or information systems and business management levels. These

responsibilities should involve development and administration of policies on purchase of IT

products, as well as the introduction, commissioning and maintenance of IT products. The

responsibilities should extend to development and implementation of formal monitoring, auditing

and servicing of each system and designate the related documentation and records for such

activities.

8.6 BS 7799: 1999, (13), is issued in two parts (Part 1: Code of practice for information security

management, and Part 2: Specification for information security management systems) and provides

recommended guidance on a comprehensive set of controls comprising best practices in information 13

security . These controls and measures (or the equivalent) are recommended for adoption within this

PIC/S guidance. They will assist in drafting the internal control standards and procedures to be

implemented by IT management and administration departments.


12ICT = Information and Communications Technology

13Relevant recent guidance is also provided in ISO/IEC17799:2000 on Information Technology – “Code of practice for information

security management” and also in the pre-amble to FDA's 21 CFR Part 11.

9. USER REQUIREMENT SPECIFICATIONS (URS)

9.1 When utilising a computerised system within a regulated environment it is appropriate to establish 14

system control documentation or a system description, [e.g. as required by GMP Annex 11(4)],15

giving a written detailed description of the system, also covering development and maintenance.

This system control document may include a record of, or a reference to, the documented ‘User

Requirement Specifications’ (URS), or other life-cycle documents. It should also be the definitive

statement of what the system must or must not do. This document is also important for legacy 16

systems and those systems under development.

9.2 When properly documented, the URS should be complete, realistic, definitive and testable.

Establishment and agreement to the requirements for the software is of paramount importance.

Requirements also need to define non-software (e.g. SOPs) and hardware.

9.3 “User Requirement Specifications”, (URS), requirements should satisfy the following criteria:

• Each requirement document should be reviewed, authorised and uniquely catalogued.

• There should be no conflict between requirements.

• Each requirement, particularly those to be met to satisfy GxP expectations, should be specified in

a manner such that compliance with the requirements is capable of being verified objectively by

an authorised method, e.g. inspection, analysis or test.

• The URS, although independent of the supplier should be understood and agreed by both user and 17

supplier . There should be a clear distinction between mandatory regulatory requirements and

optional features.

• The URS should contain functional and non-functional requirements: functionality, effectiveness, 18

maintainability, usability, etc. Requirements should be objectively verifiable.

9.4 Evaluation of the URS and the functional specifications should allow identification of the GxP

requirements covered by the system. Additionally the URS will provide information as to where

there are important interfaces between the system and manual operations. The URS should also

form the basis for a risk assessment of the system for GxP compliance requirements, in addition to


14Linked, approved system life-cycle records may very well meet the requirements for the system control documentation/system

description.

15Development and maintenance information may often be held in separate (referenced)

documents for large complex systems.

16Risk assessment in the URS phase also needs to be addressed.

17Note: This is straightforward for a bespoke system. However, for marketed proprietary systems or configurable packages then it

is for prospective users, integrators and suppliers to discuss and review proposed user requirements, versus package

functionality. It is essential to determine the 'degree of fit' and then control any necessary configuration work, modification,

coding, testing and validation requirements in line with this guidance.

18When choosing a 'standard product' or component, the URS may be developed compiling required features from the supplier's

specifications.

other risks such as safety. The risk analysis may be based on the FS, which is related to the URS, (e.g.

for bespoke systems). The risk assessment and the results including the reasons for the ranking as 19

either: ‘critical’ or ‘not critical’ should be documented. The nature of any GxP risks should be clearly

stated.

9.5 All computerised systems should have been subjected to documented prospective validation or

qualification. Readers should refer to Section 15 of this document for validation strategies for

different categories of software and systems. However, as user’s systems evolve through

modification, enhancement or integration and in response to additional regulatory requirements,

it may be necessary to conduct additional re-qualification and revalidation work on the existing

systems. The URS and ‘System Description’ document should be correspondingly updated as

validation life cycle evidence.

Figure 2 (see Section 11 below) shows the relationship between URS and performance qualification

(PQ).

10.1 From the URS, the supplier (this would include in-house developer) of the software would be able

to develop the functional specifications (in the case of bespoke programs) or clearly identify the

functional specifications for selection and purchase of off-the-shelf systems. The functional

specifications should define a system to meet the URS, i.e. the customer's needs.

10.2 The functional specifications should provide a precise and detailed description of each of the

essential requirements for the computer system and external interfaces. This means descriptions

of functions, performances and where applicable, design constraints and attributes.

10.3 For particular types and levels of systems it may be appropriate to have a combined URS and FS.

Section 14 of this document gives further details of validation strategies for the five different

categories for computer software as identified in the GAMP Guide.

10.4 The regulated user should be able to provide documentation describing the computer system(s) to

include logic flow or block diagrams where practical, also giving an indication of hardware layout,

networks and interaction. These basic schematics should align with the functional specification and

be traceable to the URS. Within the EU it is logical for this information to be held within the controlled

‘System Description’ document, required by GMP Annex 11 (4).

10. FUNCTIONAL SPECIFICATIONS (FS)


19Risk assessments and analyses can be useful at various stages during the entire system life-cycle and not just for the FS or URS,

(see also GAMP 4 'M3').

11. SUPPLIERS, SOFTWARE DEVELOPERS AND QUALITY MANAGEMENT

Figure 2 below maps the relationships between the key specification and qualification elements as the

system is specified, designed, built and tested.


USER REQUIREMENTS

SPECIFICATIONPQ

FUNCTIONAL

SPECIFICATIONOQ

VerifiesIQ

SYSTEM BUILD

Verifies

DESIGN

SPECIFICATIONS

Verifies

20 Figure 2. Basic framework for specification and qualification (based on Figure 6.2 of GAMP-4)

11.1 The quality controls and quality assurance procedures, documentation and records related to the

development and production of the software and hardware for computer systems are of critical

importance. There are a number of accepted models for software development, e.g. the spiral

model of development, the waterfall model and the life cycle model. All models have their own

special attributes. As an example the GAMP guide adopts, but does not mandate a “V” framework

(see figure 2 above). (Note: The URS and FS may be combined for smaller projects. These are

related to the OQ.)

11.2 Supplier and developer reputations and trading histories for the software product provide some

guidance to the level of reliability that may be assigned to the product supplied. The

pharmaceutical regulated user therefore should have in place procedures and records that indicated

how and on what basis suppliers were selected.

11.3 Compliance with a recognised Quality Management System (QMS) may provide the regulated user

and regulatory agencies with the desired confidence in the structural integrity, operational

reliability and on-going support for software and hardware products utilised in the system. The

20This is an example only. Regulated users would be expected to comment on their own particular model. They should also

interpret and define the relationships between various life-cycle elements as appropriate.


accreditation assessment schedule and scope of certification needs to be relevant to the nature of

the proposed application. Structural integrity and the application of good software and hardware

engineering practices are important for critical systems.

11.4 Confidence in the structural integrity may be based to some extent on the recognition of relevant

certification of a company’s software and hardware development methodology and QMS to ISO

9001 standard, such as (for example) TickIT certification and utilisation of ISO 9000 related

guidance. However, it is essential that the assessment scope and schedules applied by the

certifying auditors for these schemes should cover the engineering quality standards, actual

practices, controls and records in place including non- conforming product (error feedback from

the market), corrective actions, change management and so forth for particular products and

versions. These can be very useful benchmarks for the design engineering, replication and

maintenance standards in place at suppliers of large proprietary packages and can assist

pharmaceutical clients with short listing and selection criteria.

11.5 However, an assessment of the supplier’s QMS and recognised certification alone is unlikely to be

the final arbiter for critical systems. The certification may very well be inadequate, or

inappropriate. In such cases, the regulated user may wish to consider additional means of assessing

fitness for purpose against predetermined requirements, specifications and anticipated risks.

Techniques such as supplier questionnaires, (shared) supplier audits and interaction with user and

sector focus groups can be helpful. This may also include the specific conformity assessment of

existing, as well as bespoke software and hardware products. GAMP and PDA guideline documents

identify a need to audit suppliers for systems carrying a high risk and have detailed guidance on

supplier auditing procedures/ options.

11.6 Appendix O9 of the GAMP 4 Guide incorporates an independent commentary on PIC/S GMP Annex

11 and provides specific advice on quality and operational matters to help ensure compliance with

the PIC/S and EU GMP. Users and suppliers need to ensure that software, hardware and systems

are:

• quality assured;

• fit for their intended purpose; and

• supported by appropriate documentation for quality and validation traceability.

12.1 The Standards ISO 9001, ISO 9126 & IEEE 1298 have a number of important features that can be

summarised in the following points:

• They are structured around a QMS approach to the development, testing and documentation

for software design, production and installation.

• Compliance with the standard requires formal systems for control, traceability and

accountability of product(s) and personnel.

12. IMPORTANT QMS AND SOFTWARE STANDARDS ATTRIBUTES


• The standard outlines the features and requirements of a life cycle approach to software

production (“manufacture”), with emphasis on the importance of a change control procedure.

• The need for, and importance of, testing of software product/s is identified by the standard as

it requires a tiered approach to testing and identifies three levels of testing for software:

• Unit code testing;

• Integrated module testing; and

• Customer acceptance testing.

• The GAMP Guide is also widely used as an industry standard of relevance here.

12.2 There are a number of advantages in organisations utilising a QMS approach for development and

changes to software product. It would be expected that this approach if utilised by developers and

producers of software should ensure (within the limitations of the quality management system

approach) the following:

• Management commitment to quality and design control by instituting systems for quality

control, documentation and quality assurance.

• Development, production and installation based on quality plans, verified by quality records.

The QMS requires development, testing and programming standards.

• Adherence to quality assurance disciplines such as internal audits of the processes, corrective

& preventative action procedures and control of non-conforming product.

• QMS methodology to establish requirements for purchased (subcontracted) software product.

13.1 Assurance of reliability of software is achieved by execution of quality plans and testing during the

software development process. This involves unit code testing and integration testing in

accordance with the principles of ISO 12207, IEEE 1298 and IEEE 829 ‘Software Test 21

Documentation’ . See also the corresponding sections in the GAMP Guide. The development and

testing of hardware and software should be done under a quality assurance system, documented and

formally agreed between the various parties. This can ultimately provide evidence in support of GxP

quality compliance (e.g. Annex 11(5)). Locations and responsibilities for testing (depending on the

category of the software and system) are outlined in the GAMP Guide, qv.

13.2 One of the most critical aspects of development of software is the integration testing phase where

individual elements of software code (and hardware, where applicable), are combined and tested

during or prior to this stage until the entire system has been integrated. Extra benefits may be

achieved by code walk- throughs including evaluation of critical algorithms and/or routines, prior

13. TESTING

21This testing is defined as verification of the software element. Verification is defined as the process of determining whether or

not the products of a given phase of the software development cycle fulfil the requirements established during the previous

phase.

to testing. Errors found at the integration testing phase are much cheaper to correct than errors

found at a later stage of testing. Code review (walk-through) is best done as early in the process as

possible, preferably before submitting a module to test. Code reviews are best performed before

formal unit code testing (i.e. before a unit or module is frozen and enters formal testing).

13.3 For some simpler GxP systems, for example certain PLCs and systems based on basic algorithms or

logic sets, the functional testing may provide adequate assurance of reliability of the computerised

system. For critical and/or more complex systems the verification testing that is conducted at the

IQ, OQ & PQ stages provides only a limited level of assurance that the system does what it purports

to do, reliably. This level of testing provides only limited assurance of the operation and reliability

of hidden functions and code. For complex systems there should also be a high level of assurance

that the development of the software has ensured delivery and operation of a quality product that

is structurally sound, clearly defined and controlled.

13.4 Test scripts should be developed, formally documented and used to demonstrate that the system has

been installed, and is operating and performing satisfactorily. These test scripts should be related to

the User Requirements Specifications and the Functional specifications for the system. This schedule 22

of testing should be specifically aimed at demonstrating the validation of the system . In software

engineering terms satisfactory results obtained from the testing should confirm design validation.

13.5 Any processing equipment and activities related to or controlled by the computer system would

require additional IQ, OQ and PQ testing regimes. It may be appropriate to combine test phases and

test scopes for a group of equipment or activities, and this should be defined in a test plan or

strategy.

13.6 Regulated Users should be able to demonstrate formal acceptance of systems after testing and

controlled transfer into the live operational environment.

14.1 Regulated users need to be able to provide evidence for their computerised systems to

demonstrate their range, complexity, functionality, control and validation status.

14.2 For the validation of computerised systems there should be a system in place that assures the

formal assessment and reporting of quality and performance measures for all the life-cycle stages

of software and system development, its implementation, qualification and acceptance, operation, 23

modification, re- qualification, maintenance and retirement . This should enable both the

regulated user, and competent authority, to have a high level of confidence in the integrity of both

the processes executed within the controlling computer system(s) and in those processes

14. VALIDATION STRATEGIES AND PRIORITIES


22The supplier/developer should draft test scripts according to the project quality plan to verify performance to the functional

specifications. The scripts should stress test the structural integrity, critical algorithms and 'boundary value' aspects of the

integrated software. The test scripts related to the user requirements specification are the responsibility of the regulated users.

23Tools and controls within the QMS, such as audits, change controls, configuration management and continuous improvement

programmes may feature here.

controlled by and/or linked to the computer system(s), with in the prescribed operation 24

environment(s). (See also Section ‘4.6’)

14.3 The regulated user’s range of computerised systems needs to be formally listed in an inventory 25

and the scope/extent of validation for each detailed in a consolidated written Validation programme .

Validation scope should include GxP compliance criteria, ranked for product/process quality and data

integrity risk criticality, should the system fail or malfunction. This process represents one of the

most important pre-requisites of Validation Master Planning (see PIC/S doc. PI 006), in that it is

essential to assign priorities and attention to those systems (and features within systems) that

represent the highest potential for disaster, should they malfunction or becomeinoperative. The

risk analyses and the results, together with reasoning for critical or non-critical classifications,

should be documented. Risks potentially impacting on GxP compliance should be clearly identified.

There are a number of techniques to help identify and analyse risks and to select risk reduction and

control measures. For further information refer to the GAMP Guide appendix and the GAMP Forum

special interest group paper on ‘Functional Risk Assessment’.

26 14.4 GxP compliance evidence is essential for the following aspects and activities related to

computerised systems:

• data input (capture and integrity), data filing, data-processing, networks, process control and

monitoring, electronic records, archiving, retrieval, printing, access, change management,

audit trails and decisions associated with any automated GxP related activity;

• in this context, examples of GxP related activities might include: regulatory submissions, R&D,

clinical trials, procurement, dispensing/weighing, manufacturing, assembly, testing, quality

control, quality assurance, inventory control, storage and distribution, training, calibration,

maintenance, contracts/technical agreements and associated records and reports.

14.5 Historically, these systems have relied on manual systems, some electro- mechanical controls and

paper based documentation. The introduction of computerised systems does not diminish the need

for compliance with GxP requirements and guidelines.

14.6 The current Good Automated Manufacturing Practice (GAMP) Supplier Guide provides essential

guidance to suppliers of software to the Industry. The guide also provides a concise explanation of

the interrelationship between various stages of software development and the requirements for

Installation, Operational & Performance Qualification. The GAMP Guide identifies five different

categories of software.


24The italicised-bold part of this definition should be interpreted as requiring controlled documented methodology and records

based on best compliance practices. This is to ensure that firms have generated documented evidence (electronic and/ or paper

based), that gives a high level of assurance that both the computer system and the computerised system, will consistently

perform as specified, designed, implemented and validated. Related validation dossiers for complex integrated projects should be

clearly cross-linked for audit purposes.

25The scope or extent of validation for each system can be detailed in individual validation plans. A hierarchy of linked validation

plans may be appropriate as outlined in GAMP 4 guidance Appendix M1: 'Guideline for validation planning'.

26These examples are intended to be illustrative, not exhaustive.

15. GAMP VALIDATION APPROACH BASED ON DIFFERENT CATEGORIES OF SOFTWARE PRODUCTS

15.1 The GAMP Guide may be referred to as appropriate for detailed guidance both in the core project

management section, the quality narrative and the specific appendices. The following are category

summaries from GAMP 4:

Reproduced from the GAMP 4 Guide (with permission) Appendix M4

Table 2.1: Summary of Software Categories


Category Software Type Validation Approach

1 Operating System Record version (including service pack). The Operating System

will be challenged indirectly by the functional testing of the

application.

2 Firmware For non-configurable firmware record version. Calibrate

instruments as necessary. Verify operation against user

requirements.

For configurable firmware record version and configuration.

Calibrate instruments as necessary and verify operation against

user requirements.

Manage custom (bespoke) firmware as Category

5 software.

3 Standard Software

Packages

Record version (and configuration of environment) and verify

operation against user requirements.

Consider auditing the supplier for critical and complex

applications.

4 Configurable

Software Packages

Record version and configuration, and verify operation against

user requirements.

Normally audit the supplier for critical and complex applications.

Manage any custom (bespoke) programming as

Category 5.

5Custom (Bespoke)

Software

Audit supplier and validate complete system.

15.2 However, this pre-defined category approach may be difficult to apply to complex integrated

computerised systems where different GAMP category ‘levels’ are effectively combined. Many

systems span the category levels. For all critical systems a holistic risk-based approach is

necessary. This should consider the risks from the entire pharmaceutical application. Quality

assurance controls, qualification work and risk reduction measures can cascade from this to

consider each of the elements comprising the computerised system. GAMP guidance is considered

to be scaleable for large, medium and small, complex and simple systems. Where software and

systems do not appear to fit readily into this category system then it is for users to apply

judgement in determining particular quality measures, validation strategies and acceptance

criteria. For instance, under particular circumstances the operating system configuration may

contribute to the overall risk of the system and the level of validation should reflect this.

Inspectors will be interested in the company’s approach to identifying GxP risks and the criteria for

assessing the fitness for purpose of the system application.

15.3 There are a number of additional important aspects that would be required in the documentation

and records necessary to support a validation exercise. These aspects relate to on-going evaluation

and system maintenance. As a result the documentation and records for validation of a computer

system would also require information and records for the following aspects of system control:

• Evaluation records to demonstrate that the system works as described in the URS (verification

stage and on-going monitoring).

• Records of operator training (introduction and on-going training).

• Procedure for on-going monitoring, this procedure would interlink the error report system and the

deviation reports system with the change control procedure.

• Maintenance of user manuals and SOPs for all systems.

16.1 Retrospective validation is not equivalent to prospective validation and is not an option for new

systems. Firms will be required to justify the continued use of existing computerised systems that

have been inadequately documented for validation purposes. Some of this may be based on

historical evidence but much will be concerned with re-defining, documenting, re-qualifying,

prospectively validating applications and introducing GxP related life-cycle controls. Reference

should also be made to GAMP Forum’s forthcoming guidance on ‘Legacy Systems’. Inspectors may

be interested in seeing whether ‘system descriptions’ are available and that documented evidence

exists that the system has been checked/tested against URS and other specifications. Risk and

criticality analysis and assessment of supplier may also be relevant. A documented evaluation of

system history i.e. error logs, changes made, evaluation of user manuals and SOPs would also be

expected to provide some of the documentation relating to the ‘controlled system’ in place of formal

validation evidence.

16.2 A significant number of legacy systems may operate satisfactorily and reliably, however, this does

not preclude them from a requirement for validation. The approach to be taken is to provide data

and information to support the retrospective documentation of the system to provide validation

and re- qualification evidence. GxPs have required the validation of computerised systems for

many years. It should therefore be noted that a lack of prospective validation evidence for

computerised systems would increasingly be seen as a serious deviation from GxPs by a number of

16. RETROSPECTIVE VALIDATION


27Compared with 10 to 20 years ago, when GxP related applications were often rudimentary and 'standalone', there are now many

more integrated, 'infrastructure' computer systems to consider, especially when regulated users are striving to achieve 'so-

called' paperless systems. Some specific national GxP compliance regulations, such as the US FDA's 21 CFR Part 11: 'Electronic

Records and Electronic Signatures' have set specific requirements in this field. For legacy systems, firms often have to consider

retrospective validation, upgrading or replacement.

27regulatory authorities . However retrospective validation might be justified if a non-GxP system is

newly classified as a GxP system.

16.3 The principles identified above for computer systems validation should be addressed where a

retrospective validation approach has been undertaken for a legacy system. For legacy systems,

because of their age and unique characteristics, the system development documentation and

records appropriate for validation may not be available. As a result the approach taken to establish

and document system reliability and on-going assurance based on the “build-in-quality” concept

for software development would, of necessity, be different to a current system.

16.4 Nevertheless, the validation strategy would be consistent with the principles established for

classic retrospective validation where the assurances are established, based on compilation and

formal review of the history of use, maintenance, error report and change control system records

and risk assessment of the system and its functions. These activities should be based on 28

documented URS’s . If historical data do not encompass the current range of operating

parameters, or if there have been significant changes between past and current practices, then

retrospective data would not of itself support validation of the current system.

16.5 The validation exercise for on-going evaluation of legacy systems should entail inclusion of the

systems under all the documentation, records and procedural requirements associated with a current

system. For example, change control, audit trail(s), (where appropriate), data & system security, 29

additional development or modification of software under a QMS, maintenance of data integrity,

system back up requirements, operator (user) training and on-going evaluation of the system

operations.

16.6 Ultimately, regulated users have to be able to demonstrate:

• Defined requirements

• System description, or equivalent

• Verification evidence that the system has been qualified and accepted and that GxP requirements

are met

16.7 In the absence of adequate ‘retrospective qualification or validation’ evidence this could be a

reason to suspend, discontinue or turn-off any legacy system(s).

17.1 It is important for proper control that a comprehensive change management system is instituted.

This may take two forms in that during the Design phase it may only be necessary to keep records

pertaining to the project up-to-date without formal “sign-off” approvals for all changes. However,

PART THREE - SYSTEM OPERATION / INSPECTION / REFERENCES

17. CHANGE MANAGEMENT


28'Experience reports' supported by additional testing have reportedly been used to retrospectively derive a URS.

29QMS = Quality Management System

once the project reaches a point where specifications are under development and conceptual

aspects have been finalised, then a formal change control procedure should be established which

will require clear, prescriptive and accurate documentation and records. It is important for the

responsibilities of participants in the change control procedure to be carefully defined.

17.2 As discussed previously, it is appropriate for regulated users to have a system control document or

some other record system to achieve a documented baseline record for the description of the

computerised system. The system control documentation should be the definitive statement of

what the system must do. The control document should also provide a record of the User

Requirement Specifications. The change control procedure for the computerised system “project”

should be integrated with the Master change control procedure for the regulated user 30

organisation . The change control procedure will need to take account of the corresponding

procedures and records used by suppliers, integrators and other parties contracted to support the

particular system and applications. Validated decentralised arrangements for change control may

be a feature in large complex regulated user companies.

17.3 Common IT infrastructure features may need to be controlled centrally by IT systems and security

management. Key roles, responsibilities and procedures need to be clearly documented in relevant

internal and external Service Level Agreements, (SLAs), or equivalent documents.

18.1 The formal change control procedure should outline the necessary information and records for the

following areas:

• Records of details of proposed change(s) with reasoning.

• System status and controls impact prior to implementing change(s).

• Review and change authorisation methods (also see 12.5).

• Records of change reviews and sentencing (approval or rejection).

• Method of indicating ‘change’ status of documentation.

• Method(s) of assessing the full impact of change(s), including regression analysis and regression

testing, as appropriate (IEEE).

• Interface of change control procedure with configuration management system.

18.2 The procedure should accommodate any changes that may come from enhancement of the system, i.e.

a change to the user requirements specifications not identified at the start of the project. Or

alternatively a change may be made in response to an error, deviation or problem identified during

use of the system. The procedure should define the circumstances and the documentation

requirements for emergency changes (“hot-fixes”). Each error and the authorised actions taken

should be fully documented. The records should be either paper based or electronically filed.

18. CHANGE CONTROL AND ERROR REPORT SYSTEM


30It is important for regulated users to ensure that change control management is in place during all system life cycle phases, i.e.

from design and development through operation, maintenance, modification and retirement. The arrangements should be

described in the validation plans for the project. Records should be kept with the project files.

18.3 Computer systems seldom remain static in their development and use. For documentation and

computer system control it should be recognised that there are several areas that would initiate

change or a review for change. These are:

a deviation report;

• an error report; or

• a request for enhancement of the computer system;

• hardware and software updates.

18.4 The results of periodic reviews may be helpful, e.g. in indicating process drifts and the need for

change. Quality systems procedures should ensure that the changes are clearly documented and

closed out after actions have been completed. The change control procedure should complement and

link with the deviation and errors report system. Various GAMP 4 ‘Operation’ appendices include

guidance in these areas.

18.5 The supplier of the software should have its own change control system in place and there should be

clear and agreed procedures covering the interrelationship of the suppliers and users change control

system. Where changes are made then the modifications of software should be undertaken following

formal QMS documentation, records and procedural requirements.

18.6 Any changes to the validated computerised system should not be undertaken without review and

authorisation on behalf of all stakeholders responsible for the current user requirements. It may be

appropriate for this to be undertaken by the system owner and QA representative. Test scripts,

determined by the project plan, q.v., (of defined test type and extent of tests), should be used to

verify the acceptability of the software element developed in response to a change request. 31

Integration testing may also be necessary before release of the new software version .

19.1 The security of the system and security of the data is very important and the procedures and

records pertaining to these aspects should be based on the IT policies of the regulated user and in

conformance with the relevant regulatory requirements. The use of a computerised system does

not reduce the requirements that would be expected for a manual system of data control and

security. ‘System owner’s’ responsibilities will include the management of access to their systems

and for important systems the controls will be implemented through an Information Security

Management System (ISMS).

19.2 It is very important for the regulated user to maintain the procedures and records related to the

access to the system(s). There should be clearly defined responsibilities for system security

management, suitable for both small and complex systems, including:

• The implementation of the security strategy and delegation

•

19. SYSTEM SECURITY, INCLUDING BACK-UP


31It may be necessary to regard proposed changes to infrastructure as a special case and define a set of stakeholders.

The management and assignment of privileges

• Levels of access for users

• Levels of access for infrastructure (firewall, backup, re-booter, etc.).

19.3 The examination of the procedures and records should assure that the following basic requirements

are satisfied:

• Access rights for all operators are clearly defined and controlled, including physical and logical

access.

• Basic rules exist and are documented to ensure security related to personal passwords or pass

cards and related system/data security requirements are not reduced or negated.

• Correct authority and responsibilities are assigned to the correct organisational level.

• Procedures are in place to ensure that identification code and password issuance are periodically

checked, recalled or revised.

• Loss management procedures exist to electronically invalidate lost, stolen or potentially

compromised passwords. The system should be capable of enforcing regular changes of

passwords. Precise change rates to be justified within the ISMS.

• Procedures identify prohibited passwords.

• An audit log of breaches of password security should be kept and measures should be in place to

address breaches of password security.

• The system should enforce revoking of access after a specified number of unsuccessful logon

attempts.

• Measures are needed to ensure the validated recovery of original information and data following

back up, media transfer, transcription, archiving, or system failure.

• Attempted breaches of security safeguards should be recorded and investigated.

• Some equipment, such as standalone computerised systems and dedicated operator equipment

interfaces and instruments may lack logical (password etc.) capabilities. These should be listed,

justified and subjected to other procedural controls.

19.4 It should be realised that when absolutely necessary Inspectorates of the national competent

authorities may need to be able to access a firm’s encrypted GxP data. In such circumstances,

either keys for decryption would need to be made readily available to the Inspectors working for

the competent authorities, or decryption would have to take place under the inspector’s

supervision.

19.5 The validated back-up procedure including storage facilities and media should assure data integrity.

The frequency of back up is dependent on the computer system functions and the risk assessment

of a loss of data. In order to guarantee the availability of stored data, back-up copies should be

made of such data that are required to re-construct all GxP-relevant documentation (including

audit trail records).

•


19.6 There should be written procedures for recovery of the system following a breakdown; these

procedures should include documentation and record requirements to assure retrieval and

maintenance of GxP information. The examination of the procedures and records should assure that

the following basic back up and disaster recovery requirements are satisfied:

• There should be procedures to assure routine back-up of data to a safe storage location,

adequately separated from the primary storage location, and at a frequency based on an analysis

of risk to GxP data.

• The back-up procedure including storage facilities and media used should assure data integrity.

There should be a log of backed up data with references to the media used for storage. Media used

should be documented and justified for reliability.

• All GxP related data, including audit trails should be backed-up.

• Procedure for regular testing, including a test plan, for back up and disaster recovery procedures

should be in place.

• A log of back up testing including date of testing and results should be kept. A record of

rectification of any errors should be kept.

19.7 The physical security of the system should also be adequate to minimise the possibility of

unauthorised access, wilful or accidental damage by personnel or loss of data.

20.1 Where applicable, the audit trail for the data integrity may need to include functions such as

authorised user, creations, links, embedded comments, deletions, modifications/corrections,

authorities, privileges, time and date, inter- alia. All linked components are to be immutably32

linked in an IT system security controlled audit trail. All original data records and masters and any

subsequent alterations, additions, deletions or modifications are to be retained accurately and

comprehensively within the retrievable audit trail. The nature and context of transactions logged in

the audit trail to be deducible from and in agreement with, the firm’s approved Standard Operating

Procedures for information security management for the particular computerised applications and 33

user’s authorities . Firms will need clearly documented policies, standard operating procedures,

validation reports and training records covering such system controls. Information Security 34

Management standards such as ISO/IEC 17799:2000 may be of assistance with the design,

implementation and control of such systems.

20.2 Where applicable, there should be special procedures for critical data entry requiring a second

check, for example the data entry and check for a manufacturing formula or the keying in of 35

laboratory data and results from paper records . A second authorised person with logged name

20. DATA CHANGES - AUDIT TRAIL/CRITICAL DATA ENTRY


32Penguin English Dictionary: 'Immutable [imewtab'l] adj unchangeable; without variation- immutably adv.

33The systematic contextual 'labelling' of transactions in the electronic audit trail log is recommended as it can have automated

functional feedback control links with security validation features.

34Information Technology - – “Code of practice for information security management” BSI/DISC and national standards bodies.

Other guidance will be found in the guidelines supporting FDA's 21 CFR Part 11.

35This is an established compliance requirement in the GMP discipline.

and identification, with time and date, may verify data entry via the keyboard. For other

automated systems featuring direct data capture linked to other databases and intelligent

peripherals then the second check may be part of validated system functionality (e.g. in a

dispensary). Special access, system control features and/or special devices such as identification

code bars, and the inclusion and use of an audit trail to capture the diversity of changes possibly

impacting the data may facilitate this check.

20.3 The records pertaining to the audit trail events should be documented, ideally as features of the

operating system, database management system (DBMS), document management system (DMS)

and other major applications. Time- linked audit trail records should be available, if required, in a 36

human readable form as required by the inspector . GxP Inspectors may see evidence for different

forms of audit trail depending on the regulations prevailing in the intended regulated markets for the

products or data.

20.4 It is expected that appropriate controls will exist such as the maintenance of a register of

authorised users, identification codes, scope of authorised actions, in support of GxP electronic

records and electronic signatures.

20.5 There should be records of checks that the data/control/monitoring interface(s) between the

system and equipment ensure correct input and output transmission.

21.1 EC Directive 91/356 sets out the legal requirements for EU GMP. The GMP obligations include a 37

requirement to maintain a system of documentation, (Article 9) . The main requirements here

being that the regulated user has validated the system by proving that the system is able to store

the data for the required time, that the data is made readily available in legible form and that the

data is protected against loss or damage.

21.2 The guidelines relating to documentation in the GMP Guide are in Chapter 4 and there is no

requirement here that documents be in writing. Indeed in paragraph 4.9 the section amplifies

Article 9.2 (see above). It references electronic data processing (EDP) systems and implies a

number of good practice measures that should be in place to protect the data:

• access by authorised personnel only

• use of passwords

• creation of backup copies

• independent checking of critical data

21. ELECTRONIC RECORDS AND ELECTRONIC SIGNATURES


36It should be noted that for the USA market it may be a requirement in for audit trails to be available in electronic form, not just

paper, but the implementation and enforcement of compliance with 21 CFR Part 11 is under review by FDA in 2003, (see Ref. 11).

37The main requirements in Article 9.1 are that documents are clear, legible and up to date, that the system of documentation

makes it possible to trace the history of manufacture (and testing) of each batch and that the records are retained for the

required time. Article 9.2 envisages that this documentation may be electronic, photographic or in the form of another data

processing system, rather than written.

safe storage of data for the required time

Such systems also require evidence to demonstrate:

• (fundamental) the use of validated, secure computerised systems

• the systematic use of an accurate, secure, audit trail, (where appropriate)

21.3 The central consideration here as in Directive 91/356, is that records are accurately made and

protected against loss or damage or unauthorised alteration so that there is a clear and accurate audit

trail throughout the manufacturing process available to the licensing authority for the appropriate

time.

21.4 The situation for an authorised wholesale distributor is similar for records covering 38

purchases/sales invoices, (on paper or on computer, or any other form) . The requirements for

records are clear: “Records should be made… in such a way that all significant activities or events are

traceable… and are clear and readily available”.

21.5 Regulated user companies generally have a choice as to whether to use electronic records or electronic

signatures instead of paper based records. When regulated users elect to use electronic records for GxP

applications then it will be necessary for the companies to identify the particular regulations being

applied and whether they are to be considered legally binding and equivalent to their paper-based

counterparts. Regulations applicable to particular GxP disciplines may impose specific rules e.g. when

electronic records and electronic signatures are used as a primary source of data, records and/or

evidence.

It is for the regulated user to explain and justify the technologies and controls in place.

39 40An appropriate form of Electronic signature or authentication / identification should be applied

where

• external access can be made to a computerised GxP system

• the system electronically generates GxP regulatory records, or

• key decisions and actions are able to be undertaken through an electronic interface.

21.6 Generally there is no requirement for records and documents created and maintained, as part of 41

GxP, to be in ‘writing’, and validated, secure electronic versions are permitted. In the absence of

•


38The relevant EC directive being 92/25, Article 6(e), as amplified in the GDP guidelines (94/C 63/03). Article 8 of 92/25 requires

that the documentation system makes it possible to trace the distribution path for every product.

39It has been proposed via industry comments that a signature should be unique to the owner of that signature but not necessarily

unique to the system. It has also been argued that it may be desirable to issue and maintain only one signature across a multitude

of systems. Regulated users may need to explain and justify such arrangements, controls and logic.

40The regulated user is expected to justify the choice of methods to be used to ensure compliance with regulations and GxP, (see

glossary 'Advanced Electronic Signature',

'Electronic Signature (3)' etc.

41In this context 'writing' meaning 'written by hand and/or signed by hand' on paper media.

provisions to the contrary this will arguably extend to “electronic signatures”. Certainly, where

regulated users have elected to use electronic records in place of paper-based media, then it

can be argued, (from the forgoing requirements) that for accurate, authorised, secure electronic

record systems these systems would logically require an attached immutable audit trail identifying

person, time and date and linking to particular transactions. However, some systems may utilise a

combination of human actions together with other automated functions and a variety of media for

GxP data processing, records and information. Such systems may be described as ‘hybrid’ and in such

cases documented procedural controls with recorded links, by reference and signatures may have to

be used to complete the audit trail across, for example, a mixture of paper based records42 and

electronic files.

4321.7 Whilst EC Directive 2001/83 requires a Qualified Person to “certify” in a ‘register’ that batches for

release meet the required condition we are not aware of any provisions that would restrict this

activity to paper based media and a handwritten certifying signature. Validate0d and secure

electronic data processing systems may therefore be used in this context.

21.8 The key aspects of infrastructure, system and specific application to be controlled and managed are:

• the authorised user log-on for a specific application

• a unique combination of user ID and password called for by the computerised system and linked

to the user’s authorised account for the use of a specific application

• permitted task functionality for that user

• the system to have defined time zone(s) and date standard referencing with relative transaction

linking, (complex systems may span several time zones)

44 • the audit trail

• other physical and logical system information security infrastructure control features.

21.9 Issues to consider when assessing GxP compliance in the use of electronic signatures include that

• Documentary evidence of compliance exists for all aspects of infrastructure, system and specific

application.

Where risk assessment concludes that the use of a digital signature may be necessary (e.g.

Certification to a third party or in GCP field data collection and transmission) that adequate

security measures exist to protect the key to a digital signature. The level of security that is

appropriate depends on the sensitivity of the transaction and the possible impact of the


42Including printouts from computerised systems.

43Superseding 75/319 Article 22 following codification.

44See previous Section ('20.1').


unauthorised use of the key. Public Key Infrastructure (PKI) may be appropriate where risk

assessment indicates that a high level of security is required.

A register of entities that are authorised is being maintained.

• There are procedures that ensure that entities authorised to use electronic signatures are aware

of their responsibilities for actions initiated under their electronic signatures.

• Personnel administering the systems have appropriate security clearances, training, skills and

knowledge.

• Procedures are in place to record the printed name, or ‘identity’, of the signer, the date and

time when the signature was executed and the meaning associated with the signature.

• Procedures exist to try to detect the unauthorised use of an electronic signature or

compromised ID password combinations.

21.10 Issues to consider where electronic records are used to retain GxP data:

• Documentary evidence of compliance exists

• Archiving procedures are provided and records of use exist

• Procedures exist to ensure accuracy, reliability and consistency in accordance with the

validation exercise reported for the electronic record system

• System controls and detection measures (supported by procedures) exist to enable the

identification, quarantining and reporting of invalid or altered records

• Procedures exist to enable the retrieval of records throughout the retention period

• The ability exists to generate accurate and complete copies of records in both human readable

and electronic form

• Access to records is limited to authorised individuals

• Secure, computer-generated, time-stamped audit trails to independently record GxP related 45

actions following access to the system are used .

21.11 Procedures exist to ensure that change-control and revision (additions, modifications, deletions)

transactions are documented in the audit trail.

4621.12 Issues to consider when the GxP system has a provision for external access :

• The system has a method of ensuring that external access and inputs come only from

authorised clients and that they come in the correct format, for example as encrypted, digitally

•

45A database management system (DBMS) will have this included as an optional feature, but for other systems it may be necessary

to ensure that it is an added function. Regulated users will then need to ensure that it is left 'switched' on.

46Sometimes referred to as 'open' systems


signed mail or data packets. A mechanism must exist to quarantine external inputs where

security conditions are not met. The information security management arrangements need to

cover the quarantine, notification and the final sentencing of such inputs.

• Mechanisms are in place to ensure that all external access can be tracked. Each element of the

processing stage should incorporate logging and monitoring facilities. However, inspectors may

expect to see less onerous tracking for ‘read only’ access to a suitably secure and protected

system.

• The capacity should exist to keep copies of data and to re-send them from one stage to another if

they get “lost” or corrupted at a later stage of processing.

21.13 Additional security arrangements and controls will be needed for GxP computerised systems which

electronically generate regulatory records, allow external access, or enable key decisions and actions

to be undertaken through electronic interfaces. These requirements are being determined largely by 47

international initiatives to establish electronic commerce . However, where firms are interfacing

such open system (external access) functionality, in whole or in part, with their GxP systems, then

the security, control and validation information will need to be documented and available to GxP

inspectors.

48Note: 22.1 to 22.7 is based largely on the APV Guideline , q.v., with judicious editing where

necessary to fit the context of this document.

22.1 There should be sufficient, qualified staff with the relevant experience to carry out tasks for which

the regulated user is responsible in connection with the planning, introduction, application

(operation), application consultancy on, and regular monitoring of, computerised systems.

22.2 Ideally staff qualifications should be assessed on the basis of professional training, education and

experience in handling and developing computerised systems. The field of work in which the staff

will be operating should determine qualification requirements. Staff should only be deployed in

areas suited to their skills and training.

22.3 The individual areas of responsibility should be laid down in writing and be clearly understandable to

every member of staff. The fact that computerised systems may take over decision-making

functions does not affect the legally prescribed responsibilities of the persons in key positions.

22. PERSONNEL

47Including 21 CFR Part 11. Title 21 Code of Federal Regulations Part 11 (21 CFR Part 11), which was issued by the US FDA in 1997

and provides criteria under which that agency considers electronic records and electronic signatures to be equivalent to paper

records and hand-written signatures. In Europe EC Directive 1999/93/EC (December 1999) on a community framework for

electronic signatures and EC Directive

2000/31/EC (May 2000) on electronic commerce in the internal market are important. These directives were implemented during

2001. It is not the purpose of GxP guides to reproduce such business and commerce requirements.

48Section 22.4 has been substantially re-worded compared with the original (English language version) APV guidance, for clarity.


22.4 Prior to converting a process from manual to automated control (or the introduction of a new

automated operation) it is important that project staff consider any quality assurance and safety

issues as part of an impact assessment of risks. Risk reduction measures may need to be 49

incorporated into the systems design and operation . (Additional risks to the quality of GxP

related products/materials should not be introduced as a result of reducing the manual

involvement in the process).

22.5 The regulated user is responsible for ensuring all staff who have to perform tasks in connection

with computerised systems are given the requisite training and relevant guidelines on computerised

systems. That should also apply to system developers, maintenance and repair staff and staff

whose work could affect the documented operability of the systems.

22.6 Apart from a basic training in computerised systems, newly recruited staff should also be trained in

the tasks assigned to them personally. Furthermore, ongoing/awareness training should also be

undertaken according to standard training programs and the effectiveness of the training assessed

periodically following implementation, (through testing).

22.7 In connection with training, the GxP and life-cycle concept and all measures to improve

understanding and application of the concept should be explained. Training measures and

qualifications should be documented and stored as part of the life cycle documentation. (Training

records may be stored in accordance with regulated user procedures)

23.1 The attention paid by inspectors to the assessment of the GxP implications of computerised

systems on a site (and between sites), will be determined to some extent by the overall site history

and risk assessment carried out by the inspector in preparing for the inspection. Information

computer technology management arrangements for the procurement and validation of software

and systems may be centralised at the regulated user’s headquarter site rather than at the site of

inspection. In such circumstances the controls, SOPs and records in place to ensure GxP

compliance at inspection sites will need to be made available on site. In some circumstances it may

also be necessary to consider an inspection at the HQ site.

23.2 Clearly where a site has a lot of automation and integrated computerised systems - and

manufactures a range of sterile products - (for example), then the potential risks from a GxP

failure, (whether computer related or otherwise) for the patient are high. However, where such

automated systems are well designed, implemented, managed and controlled, then potential risks

to product quality (and to patients) may be considerably reduced, compared with labour intensive

operations, as the latter carry inherent risks from human variability and errors. Inspectors have to

come to a judgement on this by studying the firm's evidence not just in relation to the technology 50

aspects (through the application of GAMP etc.) but also the GxP risks identified (through PQ reports

and such-like).

23. INSPECTION CONSIDERATIONS


49“Account should be taken of the risk of certain aspects of the previous procedures such as quality or safety being lost as a result

of reduced operator involvement following the introduction of a computerised system.”(to quote the APV document)

50PQ = Performance Qualification

23.3 Humans design, build, test, implement and change these complex systems and there is

opportunity for critical error with automated systems at any stage in the life-cycle unless properly

managed. The GAMP Guide provides relevant guidance on these aspects.

23.4 It is not intended that this guidance should be used as a 'blunt instrument' for all on-site

inspections but inspectors should use it selectively to build up a clear picture of a company's scale

and complexity of on-site computerization (or automation) and investigate selectively the critical

systems and risks. As stated in ‘2.7’ of this PIC/S guidance, inspectors may wish to consider

evidence for compliance with GxP as indicated by italicised text throughout the document. Table 1

(page 34) immediately following this section provides a suggested checklist for information to be 51

considered prior to inspection .

23.5 Where little is known about computerization on a site, then it may be necessary to use a pre-

inspection questionnaire to amplify the Site Master File details.

23.6 Inspectors should select the GxP critical computerised systems from the information provided and

consider firstly the validation evidence for the selected system(s) and then the routine operational

controls for maintaining a valid system that is accurate and reliable. Inspectors may find that

different departments in pharmaceutical companies will have responsibility for GxP aspects of

commercial, or business (IT systems) and lower level process control systems. Look for evidence of

inconsistency, or muddled standards.

23.7 GxP critical computerised systems are those that can affect product quality and patient safety,

either directly (e.g. control systems) or the integrity of product related information (e.g.

data/information systems relating to coding, randomisation, distribution, product recalls, clinical

measures, patient records, donation sources, laboratory data, etc.). This is not intended as an

exhaustive list.

23.8 It is essential that firms have a computerised systems validation policy together with linked SOPs

and plans, including a listing, or inventory, of all their computerised systems - classified as to their

use, criticality and validation status. For long standing systems, validation may have been carried

out retrospectively and for systems purchased or implemented in the last few years, the validation

should have been carried out (and recorded) prospectively. Firms should have plans to complete

any outstanding retrospective validation of GxP related computer systems within a reasonable time

period depending on the risks and complexity of the systems. The continued use of critical systems

that are unsupportable by suppliers and cannot be validated must be justified by regulated users,

supported by alternative fail-safe arrangements and considered for urgent phased replacement.

23.9 The firm's validation approach should follow a life-cycle methodology, with management controls

and documentation as outlined in this guidance, which contains consensus best practice

guidelines.


51An electronic keyword search of GxP documents will reveal specific compliance requirements to assist in preparing for particular

topic inspections. Keywords such as: ‘document’, ‘specification’, ‘formula’, ‘procedure’, ‘record’, ‘data’, ‘log book’, ‘instruction’, ‘written’, ‘sign’, ‘approve’, ‘writing’, ‘signature’ are particularly helpful for records, data, documentation, authorisation and signature issues.

5223.10 Inspectors should review the firm's Validation Summary Report , (VSR) for the selected system

and refer as necessary to the System Acceptance Test Specification and lower level documents.

They should look for evidence that the qualification testing has been linked with the relevant

specification's acceptance criteria, viz:

• PQ versus URS.53

• OQ versus FS54

• IQ versus DS or DR

• Supplier audit reports

• Validation and *quality plans. e.g. Validation Master Plan, (VMP) or Policy.

(*For big projects there should be a project quality plan and a QMS for the documentation. For

smaller projects established SOPs may suffice)

23.11 Inspectors should look for the traceability of actions, tests and the resolution of errors and deviations

in selected documents. If the firm has not got proper change and version controls over its system life-

cycle and validation documents, then the validation status is suspect.

23.12 Inspectors should consider all parts of PIC/S GMP Annex 11 for relevance to particular validation

projects and in particular, the 'Principle' and items 1, 2, 3, 4, 5 and 7.

23.13 The lack of a written detailed description of each system, (kept up-to-date with controls over

changes), its functions, security and interactions (A11.4); a lack of evidence for the quality

assurance of the software development process (A11.5), coupled with a lack of adequate

validation evidence to support the use of GMP related automated systems may very well be

either a critical or a major deficiency. The ranking will depend on the inspector's risk

assessment judgement for particular cases. (NB. Since 1983, the GMPs have called for validated

electronic data-processing systems and since 1992 for the validation of all GMP related

computer systems).

23.14 If satisfied with the validation evidence, inspectors should then study the system when it is being

used and calling for printouts of reports from the system and archives as relevant. All points in Annex

11 (6, 8-19) may be relevant to this part of the assessment. Look for correlation with validation work,

evidence of change control, configuration management, accuracy and reliability. Security, access

controls and data integrity will be relevant to many of the systems particularly EDP (i.e.: Electronic

Data Processing) systems.

23.15 Consider also PIC/S GMP 4.9 and EC Directive 91/356/EEC Article 9(2) for EDP systems. Guidance on

the common industry interpretation of Annex 11 is given in the GAMP Guide, from the German APV.

23.16 Deficiency ratings applied by Inspectors will be based on the relative risk of the application and

their judgement of risk criticality.


52VSR=A best practice high level report, summarising the validation exercise, results and conclusions, linking via cross referencing

to lower level project records, detailed reports and protocols. This is useful for briefing both senior managers, in regulated user organisations and for reference by auditors/ inspectors.53

OQ = Operational Qualification; FS = Functional Specification54

IQ = Installation Qualification; DS= Design Specification; DR = Design Review

24. CHECKLISTS AND AIDE MEMOIRES

Table 1

Table 13.5 in the publication 'Good Computer Validation Practices', (Suggested Further Reading Ref.1),

provided a summary of typical information to be made available to an inspector as part of preparation

work. As it is still largely relevant, it is reproduced in updated form below, with the author's permission,

for information:


INSPECTORS - PREPARING FOR AN INSPECTION

1. Details of the organisation and management of IT/Computer Services and Project Engineering on

Site.

2. The regulated user’s policies on procurement of hardware, software and systems for use in GxP

areas.

3. The regulated user’s policy on the validation of GxP computerised systems

4. A list of IT/Computer Services Standards and SOPs.

5. The project management standards and procedures that have been applied to the development of

the various applications.

6. Identify work contracted out routinely for systems support and maintenance.

7. A list, or inventory, of all Computerised Systems on site by name and application for business,

management, information and automation levels. The list should also indicate validation status and

risk ranking. (Include basic schematics of installed hardware and networks).

8. Identify and list those systems, sub-systems, modules and/or programs that are relevant to GxP and

product quality. Cross-refer to the lists provided for ‘6’ above.

9. For the GxP significant elements and systems identified in ‘7’ please provide additional information

as below:

10. Details of disaster-recovery, back up, change-controls, information security, and configuration

management.

11. A summary of documentation that generally exists to provide up-to-date descriptions of the

systems and to show physical arrangements, data flows, interactions with other systems and life

cycle and validation records. The summary should indicate whether all of these systems have been

fully documented and validated and confirm the existence of controlled system description

documents as required by EU GMP A11 (4).

12. A statement on the qualifications and training background of personnel engaged in design, coding,

testing, validation, installation and operation of computerised systems, including consultants and

sub-contractors, (specifications, job descriptions, training logs).

13. State the firm’s approach to assessing potential suppliers of hardware, software and systems.

14. Specify how the firm determines whether purchased or “in-house” software has been produced in

accordance with a system of QA and how validation work is undertaken.


INSPECTORS - PREPARING FOR AN INSPECTION

15. Document the approach that is taken to the validation and documentation of older systems where

original records are inadequate.

16. Summarise the significant computer system changes made since the last inspection and plans for

future developments.

17. Ensure that records relating to the various systems are readily available, well organised, and key

staff are prepared to present, discuss and review the detail, as necessary.

Table 2 Software Related - Inspector's Aide Memoir55

Life Cycle Stage Evidence for Review

1. Development URS/FS/DS Documents

1. Development Test plan and test scripts

Same kind of review of evidence. If the

program is purchased, then validation

proof needs to have been assessed by

regulated user.

55Some of the details below are not relevant for COTS but it is necessary to have clearly defined the requirements for intended use

and to have assessed the application's fitness for purpose.56

Under some circumstances, access to source code cannot be guaranteed. Regulated users are expected to have assessed the business risks and put in place contingency measures in the event of the business failure of the supplier.

1. Development Written document describing how

testing should be documented.

2. Implementing Document recording programming

choices

2. Implementing Documented source code with

comments; explanation of function; in-

data and expected out data for each

structured module.How modules

influence each other. If program is

purchased, how is access to source code 56

guaran-teed?

3. Testing (Modules) Sample reports from testing if possible.

Has testing covered boundaries of limits

and also the input of invalid data? Have

all tests been documented? Have all

errors/failures been followed up?

Testing (Integrated

Modules).

Project Stage Activity

Develop URS/FS/DS

Plan Testing

Same type of tests but applied

after integrating the modules.

Plan documentation of Testing

Select programming language

and tools

Write/create software program.

Make sure each module only

accepts allowed in-data and

gives only allowed out-data.

Testing should discover

incorrect data and logic errors.

Life Cycle Stage Project Stage Activity Evidence for Review

4. Maintenance Correct errors, update versions

when needed.

Formal routines and records for

configuration management and change

control. Regression testing and periodic

evaluation (as a system goes through

multiple changes over time)


5. Documentation System documentation (inclu-

dingsoftware) correct and

updated.

User handbook, supporting SOPs, correct

versions.

6. Re-validation. Re-validate when changes are

made to the program.

Changes are reviewed and decisions

documented. Routines and records are

in-place, scoped dependent on the

size/complexity of the changes

7. Other matters Alternative routines are put in

place for system failure and

training includes this.

The alternative routines are documented,

including training records.

Table 3 Computer System Validation Related – Inspector's Aide Memoir

Number Control Measure Checks

1. Is the system defined? What should it do? Is there a

written validation plan? Are there full

specifications? Are there written protocols?

(Including acceptance criteria).

2. Do the test records show that ‘in’ and ‘out’ data

meets the specifications?

3. Are the results complete and documented?

4. Are data and documentation correct and complete?

Have these been verified by the regulated user?

5. Have competent responsible personnel carried out

the validation and review work? Is this all

documented?

6. Are conclusions complete, meaningful and based on

results? Are acceptance criteria fulfilled? Are there

any conditional conclusions?

Element

Define

Testing

Documented results

Verify correctness

Compare with Accept ance

Criteria

Conclusions

Table 4: Annex 11 – Inspector's Checklist

Point

Personnel (1)

Personnel (1)

Validation (2)

System (3)

(4)

(5)

(6)

(7)

(8)

(9)

(10)

(11)

(12)

(13) and GMP 4.9

(14)

Requirement

Key personnel/computer specialists co- operate.

Project and user personnel are trained and any necessary

experts are involved.

Life-cycle model; formal policy and procedures in place.

Influence of environment

There is a written, up to date, detailed description of the

system.

Software has been produced according to a quality

assured system.

Checks of data and calculations built in.

System tested and validated. Verified against previous/or

manual system being replaced.

Data entry and change only by authorised personnel.

Password / security management.

Critical data (GXP data) verified by a 2nd person, or by a

validated electronic method.

Audit trail for data entry and processing.

Alterations to system and programs subjected to rigorous

change controls, including re-validation and approvals.

Printed copies of electronically stored data available if

needed?

Physical and logical protection of data. Information

security management and change management.

Data back up procedures; separate and secure media and

locations.

Inspector's Check/Comment

Number Element Control Measure Checks

7. Approval Has approval been formally recorded? Was there any

QA/QC involvement at the regulated user?

8. On-going evaluation What is the procedure to ensure on-going

evaluation of the system? What are the change

control procedures?


Table 4: Annex 11 – Inspector's Checklist

Point

(14)

(15)

(16)

(17)

(18)

(19)

Requirement

Data back up procedures; separate and secure media and

locations.

Alternative routine arrangements established in the

event of system failure.

Validated alternative arrangements (15) defined and

documented. Records of failures and remediation exist.

Records show the analysis of errors and corrective actions

taken.

Service level agreements or contracts in place for services

provided by outside agencies for computerised systems at

regulated user's sites.

Responsibilities in chain of release of batches defined

and linked to QP.

Inspector's Check/Comment

Table 5: General Points for Inspectors To Consider On Inspection

Number

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

Area

Personnel

Organisation

Organisation

Data system

Data system

Validation

Security

Maintenance

Control of System

Self-inspections

Remember

Is there only one key person? (Dependence on only one person may be

catastrophic).

Is management involved?

Is the Quality organisation involved?

Early during the inspection, ask for a complete overview of the

system(s) including flow of data.

The use of 'parallel' systems may indicate 'grey' areas and potential

system weaknesses.

Has terminology actually been defined? Is it used correctly?

How is access controlled? Information Security Management?

Is there a maintenance manual of each system detailing what to do on

a periodic basis? (Daily, weekly, monthly etc). Are there corresponding

records of compliance?

Routines for configuration management, and change control in place?

Are self-inspection routines in place?



57Table 6: Overview of User Responsibilities (from GAMP 4 Table 7.1)

Step

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

11.

12.

13.

Task

Identify system

Produce URS

Determine validation strategy

• Risk Assessment

• Assessment of system

components

• Supplier assessment

Produce Validation Plan

Review and approve

specifications, including the

system description

Monitor development of

system

Review source code

Review and approve test

specifications

Perform testing

Review and approve test

reports

Produce Validation Report

Maintain System

System Retirement

Description

Each automated system should be assessed and GxP regulated systems

identified.

The URS should define clearly and precisely what the user wants the

system to do, state any constraints, and define regulatory and

documentation requirements.

An initial Risk Assessment should be carried out during validation

planning. Further assessments should be performed as specifications are

developed.

System components should be assessed and categorized to determine

the validation approach required. The output from this assessment will

feed into the Validation Plan.

Suppliers should be formally assessed as part of the process of selecting a

supplier and planning for validation. The decision whether to perform a

Supplier Audit should be documented and based on a Risk Assessment

and categorization of the system components.

The Validation Plan should define the activities, procedures, and

responsibilities for establishing the adequacy of the system. It typically

defines what Risk Assessments are to be performed.

The user should review and approve specifications produced by the

supplier.

The user should monitor development and configuration activities

against an agreed plan.

The user should ensure that source code is adequately reviewed during

system development.

The user should review and approve test specifications prior to formal

testing.

The user may be involved in testing, as a witness during test execution, or

as a reviewer of test results.

The user should approve the test reports and associated test results.

The Validation Report should summarize all deliverables and activities

and provides evidence that the system is validated.

Once the system has been accepted, the user should establish

adequate system management and operational procedures.

The user should manage the replacement or withdrawal of the automated

system from use.

57 Refer also to Section 15 for context (validation strategy for different systems).


25. REFERENCES FOR RELEVANT STANDARDS AND GMP GUIDES / CODES

(1) EU Annex 11 to the EU guidelines of Good Manufacturing Practice for Medicinal Products.

(2) Annex 11 to PIC/S Guide to Good Manufacturing Practice for Medicinal Products, Document PH

1/97 (Rev. 3), PIC/S Secretariat, 9-11 rue de Varembé, CH-1211 Geneva 20

(3) GAMP Guide for Validation of Automated Systems, GAMP4 (ISPE (GAMP Forum), 2001)

(4) Australian Code of GMP for Medicinal Products, August 2002.

(5) WHO Guideline for GMP for Manufacture of Pharmaceutical Products.

(6) Relevant CFR sections of the USFDA Register:

Hardware

21 CFR 211.63,

67, 68

21 CFR Part 11 Electronic Records: Electronic Signatures

Software

21 CFR 211.68,

180, 188, 192

21 CFR Part11 Electronic Records: Electronic Signatures

Quality System

21 CFR 820 Quality system regulation

GLP

21 CFR 58 Good laboratory practice for non-clinical laboratory studies

(7) ISO standards:

Quality management and quality assurance

ISO 9000-1 Part 1: Guidelines for selection and use.

ISO 9000-3 Part 3: Guidelines for the application of ISO9001:1994 to the

development, supply, installation and maintenance of

computer software. See also current Tick-IT Guide for

construction, software engineering, assessment and

certification (see ref. 12 re:BSI DISC London)

Quality Management and quality system elements

ISO 9004-1 Part 1: Guidelines.

ISO 9004-2 Part 2: Guidelines for Services .

ISO 9004-4 Part 4: Guidelines for quality improvement.

ISO 10005: 1995 Quality management - Guidelines for quality plans.

ISO 10007: 1995 Q u a l i t y m a n a g e m e n t - G u i d e l i n e s f o r

Configuration Management

Life cycle management

ISO/IEC 12207:1995 Information Technology - Software Life Cycle processes

ISO/IEC 17799:2000 (BS 7799-1:2000) Information technology – Code of practice for

information security management.

(8) IEEE Publications:

IEEE 729 Glossary of Software Engineering Terminology

IEEE 730 Quality Assurance Plan

IEEE 828 Software Configuration Management Plans

IEEE 829 Software Test Documentation

IEEE 830 Guide to Software Requirements Specification

IEEE 983 Guide to Software Quality Assurance Planning

IEEE 1012 Software Verification Plans

IEEE 1298 Software Quality Management System Part 1: Requirements

(9) British Standards:

BS 7799: 1999 “Information Security Management”, BSI DISC 389

Chiswick High Road, London W4 4AL (Tel:+44181 995 7799

Fax:+44 181 996 6411 http://www.bsi.org.uk/disc)

BS 7799: 2000 Information technology – Code of practice for information

management

(10) DISC BSI Guides

DISC PD 5000 series of ‘Codes for Electronic Documents and e-Commerce Transactions as Legally

Admissible Evidence’ (including DISC PD 0008:1999 in Pt 1):

Pt 1 Information Stored Electronically

Pt 2 Electronic Communication and e-mail policy

Pt 3 Identity Signature and Copyright

Pt 4 Using Certification Authorities

Pt 5 Using trusted Third Party Archives

DISC PD 3002 Guide to BS 7799 Ris Assessment and Risk Management

(ISBN 0 580 29551 6)

DISC PD 3005 Guide on the selection of BS 7799 controls

(ISBN 0 580 33011 7)


(11) ‘Guidance for Industry, Part 11, Electronic Records; Electronic Signatures – Scope and Application’,

US Dept. of Health and Human Services and all FDA Centers/ Offices, February 2003.

(\\CDS029\CDERGUID\5505dft.doc) – draft guidance for comment.

1. Good Computer Validation Practices – Common Sense Implementation [Stokes, Branning,

Chapman, Hambloch & Trill. Interpharm Press, USA: ISBN: 0-935184-55-4]

2. Computer Systems Validation for the Pharmaceutical and Medical Device Industries

[Chamberlain. ISBN 0-9631489-0-8].

3. Validating Automated Manufacturing and Laboratory Applications, [Wingate et al., Interpharm

Press, USA: ISBN 1-57491-037-X]

4. Validation of Computerized Analytical Systems, Interpharm Press, L. Huber, ISBN: 0-935184-

75-9, 1995

5. General Principles of Software Validation - Final Guidance for Industry and FDA Staff (FDA,

CDRH, January 2002)

6. PDA Technical Report No 18, “Validation of Computer-Related Systems”, PDA Journal of

Pharmaceutical Science and Technology, 1995 Supplement, Vol. 49, No.S1

7. PDA Technical Report No. 32, “Report on the Auditing of Suppliers providing Computer

Products and Services for Regulated Pharmaceutical Operations” (PDA, 1999)

8. ‘Validation of Process Control Systems: a Guideline by GMA & NAMUR’, in Section 5 of GAMP-3

(1998) Vol. 2, Best Practice for Users and Suppliers.

9. PDA Technical Report No. 31: “Validation and Qualification of Computerised Laboratory Data

Acquisition Systems”, PDA Journal of Pharmaceutical Science and Technology, 1999

Supplement, Vol. 53, No.4

10. Guidance for Industry - ‘Computerized systems used in Clinical Trials’, US FDA, April 1999

11. GLP Consensus Document ‘The Application of the Principles of GLP to Computerised Systems’,

1995, OECD/ OCDE/GD (95) 115 (Environment Monograph No.116)

12. Computer Systems Validation in Clinical Research, 1997, ACDM/ PSI Working Party. (ACDM, PO

Box 129, Macclesfield, Cheshire SK11 8FG England)

13. ICHTopic E6: ‘Guideline for Good Clinical Practice’. (ICH GCP/CPMP/ICH/135/95)

14. EU GMP Guide Annex 15,‘Qualification and Validation’, European Commission, July 2001,

(based on PIC/S recommendations)

15. APV Guidance, Appendix 9 to GAMP4 ‘Guide for Validation of Automated Systems’, ISPE (GAMP

Forum), 2001

26. SUGGESTED FURTHER READING


27. GLOSSARY OF TERMS

This glossary has been extracted predominantly from the (1) EU GMP Annex 15, Qualification and

Validation document, [see ‘Further Reading Ref:14]; (2) the GAMP Guide; and (3) the PDA Technical Report

No 18. The list of definitions has been compiled to reflect the current terminology generally accepted

internationally. Inspectors may have to correlate or adapt the terms in the light of internal policies,

standards and guidelines used by regulated user’s companies and relevant SDLC methodologies. The

sources of each of the definitions have been identified in the following manner:

• EU GMP Annex 15 PIC/S document definitions are recorded as (1);

• GAMP definitions are recorded as (2);

• PDA technical report no. 18 definitions are recorded as (3);

• EC Directive 1999/93/EC on a Community framework for electronic signature, (Official Journal

of the European Communities, 19.1.2000), (4);

• Definitions elaborated in this PIC/S document do not carry a suffix number.

Advanced Electronic Signature

(EU) means an electronic signature, which meets the following requirements:

(a) it is uniquely linked to the signatory;

(b) it is capable of identifying the signatory;

(c) it is created using means that the signatory can maintain under his control; and

(d) it is linked to the data to which it relates in such a manner that any change of the data is

detectable. (4)

Application-Specific Software

A software program developed or adapted to the specific requirements of the application. (3)

Automated System

Term used to cover a broad range of systems, including automated manufacturing equipment, control

systems, automated laboratory systems manufacturing execution systems and computers running

laboratory or manufacturing database systems. The automated system consists of the hardware, software

and network components, together with the controlled functions and associated documentation.

Automated systems are sometimes referred to as computerised systems; in this Guide the two terms are

synonymous. (2) (GAMP 4 (3) ‘Scope’ page 14)

Bespoke

A system produced for a customer, specifically to order, to meet a defined set of user requirements. (2)


Bug

A manifestation of an error in software (a fault). (2)

Change Control

A formal system by which qualified representatives of appropriate disciplines review proposed or actual

changes that might affect a validated status of facilities, systems, equipment or processes. The intent is

to determine the need for action that would ensure that the system is maintained in a validated state. (1)

[Authors note: FDA may specifically require evidence of pre and post implementation reviews of changes.

The latter to detect any unauthorised changes that may have been made despite established procedures.

These are quality assurance activities.]

Commercial off-the-shelf (COTS)

Configurable Programs- Stock programs that can be configured to specific user applications by “filling in

the blanks”, without (COTS) altering the basic program. (3)

Computer Hardware

Various pieces of equipment in the computer system, including the central processing unit, the printer,

the modem, the cathode ray tube (CRT), and other related apparatus. (3) (See also Figure 1, page 8, of

this document).

Computer System

Computer hardware components assembled to perform in conjunction with a set of software programs,

which are collectively designed to perform a specific function or group of functions. (3) (See also Figure 1,

page 8, of this document).

Computerised System

A computer system plus the controlled function that it operates. (3)

[Authors note: Today this may be considered to be rather a narrow definition, especially in the context of

integrated computers. The definition should therefore include all outside influences that interface with

the computer system in its operating environment. These may typically include monitoring and network

links, (to/from other systems or instruments), manual (keypad inputs), links to different media, manual

procedures and automation. The term also covers automated instruments and systems. See also the

definition for ‘automated systems’ in this section and Section 26, Reference 11, the GLP OECD consensus

document. PIC/S GMP Annex 11(4) is relevant here regarding documenting the scope and interaction of

systems.]


Configuration

The documented physical and functional characteristics of a particular item, or system, e.g. software,

computerised system, hardware, firmware and operating system. A change converts one configuration

into a new one.

Configuration Management

The process of identifying and defining the configuration items in a system, controlling the release and

change of these items throughout the system life cycle, recording and reporting the status of

configuration items and change requests, and verifying the completeness and correctness of

configuration items. (2)

Debugging (IEEE)

The process of locating, analysing, and correcting suspected faults. (2)

Electronic Signature

An electronic measure that can be substituted for a handwritten signature or initials for the purpose of

signifying approval, authorisation or verification of specific data entries.

See also definition for ‘Advanced Electronic Signature’, above.

Electronic Signature (FDA)

21 CFR Part11 defines this as: The computer data compilation of any symbol or series of symbols executed,

adopted, or authorised by an individual to be the legally binding equivalent of the individual’s hand-

written signature.

Electronic Signature (EU)

1999/93/EC states: ‘electronic signature’ means data in electronic form which are attached to or logically

associated with other electronic data and which serve as a method of authentication. (See also ‘Advanced

Electronic Signature’) (4)

Embedded System

A system, usually microprocessor or PLC based, whose sole purpose is to control a particular piece of

automated equipment. This is contrasted with a standalone computer system. (2)

Executive Program (ANSI/IEEE/ASO)

A computer program, usually part of the operating system, that controls the execution of other computer

programs and regulates the flow of work in a data processing system. (2)

6161 Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPBackground Documents and Guidelines on GMPBackground Documents and Guidelines on GMP

Firmware

A software program permanently recorded in a hardware device, such as an EPROM. (3) (Note: EPROM

stands for ‘Erasable Programmable Read Only Memory’)

Functional Requirements (ANSI/IEEE)

Statements that describe functions a computer-related system must be capable of performing. (3)

Functional Specifications

Statements of how the computerised system will satisfy functional requirements of the computer-related

system. (3)

Functional Testing

A process for verifying that software, a system, or a system component performs its intended functions.

(3)

Hardware Acceptance Test Specification

Statements for the testing of all key aspects of hardware installation to assure adherence to appropriate

codes and approved design intentions and that the recommendations of the regulated user have been

suitably considered. (2)

Hardware Design Specification (APV)

Description of the hardware on which the software resides and how it is to be connected to any system or

equipment. (2)

Hybrid Systems

Refer to Section ‘21.6’ of this document

Integration testing (IEEE)

An orderly progression of testing in which software elements, hardware elements, or both are combined

and tested until the entire system has been integrated. (2)

Interface (ANSI/IEEE)

A shared boundary. To interact or communicate with another system component. (2)

Legacy Computerised Systems

These are regarded as systems that have been established and in use for some considerable time. For a


variety of reasons, they may be generally characterised by lack of adequate GMP compliance related

documentation and records pertaining to the development and commissioning stage of the system.

Additionally, because of their age there may be no records of a formal approach to validation of the

system.

Life Cycle Concept

An approach to computer system development that begins with (PMA CSVC) identification of the user’s

requirements, continues through design, integration, qualification, user validation, control and

maintenance, and ends only when commercial use of the system is discontinued. (2)

Loop Testing

Checking the installed combination of elements characterising each type of input/output loop. (2)

Network (ANSI/IEEE & GAMP)

(a) An interconnected, or interrelated group of nodes.

(b) An interconnected communications facility. A Local Area Network (LAN) is a high bandwidth

(allowing a high data transfer rate) computer network operating over a small area such as an

office or group of offices. (2)

Operating Environment

Those conditions and activities interfacing directly or indirectly with the system of concern, control of

which can affect the system’s validated state. (3)

Operating System

A set of software programs provided with a computer that function as the interface between the hardware

and the applications program. (3)

Public Key Infrastructure

Public Key Infrastructure (PKI) provides a framework for secure communication, using a combination

of public-key cryptography and Digital Certificates.

PKIs can exist within many different domains but essentially there are two types:

A Private PKI is deployed by a corporation for the benefit of its business and any related parties (e.g.

customers, suppliers).

Public PKIs (using ‘Trusted Third Parties’) are deployed on open systems, such as the Internet and

facilitate security between previously unrelated parties.


58Raw Data

Any work-sheets, records, memoranda, notes, or exact copies thereof, that are the result of original

observations and activities and which are necessary for the reconstruction and evaluation of a work

project, process or study report, etc. Raw data may be hard/paper copy or electronic but must be known

and defined in system procedures. (2)

Regulated User

The regulated Good Practice entity, that is responsible for the operation of a computerised system and the

applications, files and data held thereon. (See also ‘User’)

Revalidation

Repetition of the validation process or a specific portion of it. (2)

Security (IEEE)

The protection of computer hardware and software from accidental or malicious access, use, modification,

destruction or disclosure. Security also pertains to personnel, data, communications and the physical

protection of computer installations. (2)

Source Code (PMA CSVC)

An original computer program expressed in human-readable form (programming language), which must

be translated into machine-readable form before it can be executed by the computer. (2)

Standalone System

A self-contained computer system, which provides data processing, monitoring or control functions but

which is not embedded within automated equipment. This is contrasted with an embedded system, the

sole purpose of which is to control a particular piece of automated equipment. (2)

Structural Integrity (Software)

Software attributes reflecting the degree to which source code satisfies specified software requirements

and conforms to contemporary software development practices and standards. (3)

Structural Testing

Examining the internal structure of the source code. Includes low-level and high-level code review, path

analysis, auditing of programming procedures and standards actually used, inspection for extraneous

“dead code”, boundary analysis and other techniques. Requires specific computer science and


58PIC/S Author’s Note on ‘Raw Data’- For information: FDA’s 21 CFR Part 11 requires the retention of electronic records in

electronic form (thus including raw data electronically captured or recorded). Also, for all good practice disciplines regulated by competent authorities it must be possible to reconstruct studies and reports from raw data and the electronic records may be needed to support any paper printouts.

programming expertise. (2)

Structural Verification

An activity intended to produce documented assurance that software has appropriate structural integrity.

(3)

System Acceptance Test Specification (2)

The system acceptance test specification is a description of those tests to be carried out to permit

acceptance of the system by the user. Typically it should address the following:

• System functionality

• System performance

• Critical parameters

• Operating procedures

The tests should ensure that the product operates as indicated in the functional specification and meets

the user requirements as defined in the URS. The tests typically include limit, alarms and boundary

testing.

The System Acceptance Test Specification is a contractual document and, as such, should be approved by

both the supplier/ developer/ integrator and the end user.

An example procedure for producing a System Acceptance Test Specification is given in a GAMP Guide

Appendix.

System Software

Software designed to facilitate the operation and maintenance of a computer system and its associated

programs, such as operating systems, assemblers, utilities, network software and executive programs.

System software is generally independent of the specific application. (3)

System Specifications (PMA CSVC)

Describe how the system will meet the functional requirements. (2)

59Unplanned (Emergency) Change (PMA CSVC)

An unanticipated necessary change to a validated system requiring rapid implementation, also known as a

“hot-fix”. (2)


59 This can be very risky. ‘Fix’ testing/ implementation work should ideally not be carried out initially in the live environment. All

changes to the live validated system(s) must be subjected to the firm’s change control, configuration management and validation procedural controls, to ensure compliance with GMP and the maintenance of a validated state.

User

The company or group responsible for the operation of a system. (3) (see also

‘Regulated User’). The GxP customer, or user organisation, contracting a supplier to provide a product. In

the context of this document it is, therefore, not intended to apply only to individuals who use the

system, and is synonymous with ‘Customer’. (2)

Utility Software (ANSI/IEEE)

Computer programs or routines designed to perform some general support function required by other

application software, by the operating system, or by system users. (2)

Validation of Computerised Systems

See text Section ’14.2’ for definition.

ANSI: American National Standards Institute

APV: Arbeitsgemeinschaft für Pharmazeutische Verfahrenstechnik E.V.

BSI: British Standards Institute

DCS: Distributed Control System

DR: Design Review

DS: Design Specification

DQ: Design Qualification

EDP: Electronic Data Processing

EU: European Union

FDA: US Food and Drug Administration

FS: Functional Specification

GAMP: Good Automated Manufacturing Practice

GCP: Good Clinical Practice

GDP Good Distribution Practice

GLP: Good Laboratory Practice

GMP: Good Manufacturing Practice

GxP: Compliance requirements for all good practice disciplines in the regulated pharmaceutical

sector supply chain from discovery to post marketing.

IEC: International Electrical Commission

28. ABBREVIATIONS USED IN THE DOCUMENT


IEEE; Institute of Electrical and Electronics Engineers, Inc.

IQ: Installation Qualification

ISMS Information Security Management System

ISO: International Standards Organisation

ISPE International Society for Pharmaceutical Engineering

LIMS: Laboratory Information Management System

LAN: Local Area Network

MRP: Materials Requirements Planning MRP-II: Manufacturing Resource Planning

OQ: Operational Qualification

PDA: Parenteral Drug Association

PIC/S: Pharmaceutical Inspection Co-operation Scheme

PKI Public Key Infrastructure

PLC: Programmable Logic Controller

PQ: Performance Qualification

QMS: Quality Management System

R&D: Research and Development

SCADA: Supervisory Control And Data Acquisition

SLA: Service Level Agreement

SOPs: Standard Operating Procedures

URS: User Requirements Specification

VSR: Validation Summary Report (see footnote to Section ‘23.10’)

WAN: Wide Area Network

29. REVISION HISTORY


Date

1 July 2004

25 September 2007

Version Number

PI 011-2

PI 011-3

Reasons for revision

Added Revision History Changed

Editor’s co-ordinates

Changed Editor’s co-ordinates

Background Documents and Guidelines on GMPBackground Documents and Guidelines on GMPPharmaceutical Inspection Convention/ Pharmaceutical Inspection Co-Operation Scheme (PIC/S): Guide to Good Manufacturing Practice for

medicinal products: Part I, March 2014

CHAPTER 7



CHAPTER 1 - QUALITY MANAGEMENT 172

Principle 172

Quality Assurance 172

Good Manufacturing Practice for Medicinal products (GMP) 173

Quality Control 174

Product Quality Review 175

Quality Risk Management 176

CHAPTER 2 - PERSONNEL 177

Principle 177

General 177

Key Personnel 177

Training 179

Personal Hygiene 179

CHAPTER 3 - PREMISES AND EQUIPMENT 181

Principle 181

Premises 181

General 181

Production Area 181

Storage Areas 182

Quality Control Areas 183

Ancillary Areas 183

Equipment 184

CHAPTER 4 - DOCUMENTATION 185

Principle 185

Required GMP Documentation (by type) 185

Generation and Control of Documentation 186

Good Documentation Practices 187

Retention of Documents 187

Specifications 187

Specifications for starting and packaging materials 188

Specifications for intermediate and bulk products 188

Specifications for finished products 188

Manufacturing Formula and Processing Instructions 188

Packaging Instructions 189

Table of Contents

170

Batch Processing Records 190

Batch Packaging Records 190

Procedures and Records 191

Receipt 191

Sampling 191

Testing 192

Other 192

CHAPTER 5 - PRODUCTION 194

Principle 194

General 194

Prevention of cross-contamination in production 195

Validation 195

Starting materials 196

Processing operations - Intermediate and bulk products 197

Packaging materials 198

Packaging operations 198

Finished products 199

Rejected, recovered and returned materials 199

CHAPTER 6 - QUALITY CONTROL 201

Principle 201

General 201

Good Quality Control Laboratory Practice 201

Documentation 202

Sampling 202

Testing 203

On-going Stability Programme 204

CHAPTER 7 - CONTRACT MANUFACTURE AND ANALYSIS 207

Principle 207

General 207

The Contract Giver 207

The Contract Acceptor 208

The Contract 208

CHAPTER 8 - COMPLAINTS AND PRODUCT RECALL 209

Principle 209

Complaints 209

Recalls 210

CHAPTER 9 - SELF INSPECTION 211

Principle 211


CHAPTER 1


PRINCIPLE

QUALITY ASSURANCE

The holder of a manufacturing authorisation must manufacture medicinal products so as to ensure that

they are fit for their intended use, comply with the requirements of the Marketing Authorisation and do

not place patients at risk due to inadequate safety, quality or efficacy. The attainment of this quality

objective is the responsibility of senior management and requires the participation and commitment by

staff in many different departments and at all levels within the company, by the company’s suppliers and

by the distributors. To achieve the quality objective reliably there must be a comprehensively designed

and correctly implemented system of Quality Assurance Incorporating Good Manufacturing Practice, and

thus Quality Control and Quality Risk Management. It should be fully documented and its effectiveness

monitored. All parts of the Quality Assurance systems should be adequately resourced with competent

personnel, and suitable and sufficient premises, equipment and facilities. There are additional legal

responsibilities for the holder of the manufacturing authorisation and for the authorised person(s).

The basic concepts of Quality Assurance, Good Manufacturing Practice, Quality Control and Quality Risk

Management are inter-related. They are described here in order to emphasise their relationships and their

fundamental importance to the production and control of medicinal products.

1.1 Quality Assurance is a wide-ranging concept, which covers all matters, which individually or

collectively influence the quality of a product. It is the sum total of the organised arrangements

made with the objective of ensuring that medicinal products are of the quality required for their

intended use. Quality Assurance therefore incorporates Good Manufacturing Practice plus other

factors outside the scope of this Guide.

The system of Quality Assurance appropriate for the manufacture of medicinal products should

ensure that:

i. medicinal products are designed and developed in a way that takes account of the

requirements of Good Manufacturing Practice ;

ii. production and control operations are clearly specified and Good Manufacturing Practice

adopted;

iii. managerial responsibilities are clearly specified;

iv. arrangements are made for the manufacture, supply and use of the correct starting and

packaging materials;

QUALITY MANAGEMENT

CHAPTER 1


v. all necessary controls on intermediate products, and any other in- process controls and

validations are carried out;

vi. the finished product is correctly processed and checked, according to the defined procedures;

vii. medicinal products are not sold or supplied before an authorised person has certified that

each production batch has been produced and controlled in accordance with the requirements

of the marketing authorisation and any other regulations relevant to the production, control

and release of medicinal products;

viii. satisfactory arrangements exist to ensure, as far as possible, that the medicinal products are

stored, distributed and subsequently handled so that quality is maintained throughout their

shelf life;

ix. there is a procedure for self-inspection and/or quality audit, which regularly appraises the

effectiveness and applicability of the quality assurance system.

1.2 Good Manufacturing Practice is that part of Quality Assurance which ensures that Medicinal

products are consistently produced and controlled to the quality standards appropriate to their

intended use and as required by the marketing authorisation or product specification.

Good Manufacturing Practice is concerned with both production and quality control. The basic

requirements of GMP are that:

i. all manufacturing processes are clearly defined, systematically reviewed in the light of

experience and shown to be capable of consistently manufacturing medicinal products of the

required quality and complying with their specifications;

ii. critical steps of manufacturing processes and significant changes to the process are validated;

iii. all necessary facilities for GMP are provided including:

a. appropriately qualified and trained personnel;

b. adequate premises and space;

c. suitable equipment and services;

d. correct materials, containers and labels;

e. approved procedures and instructions;

f. suitable storage and transport;

iv. instructions and procedures are written in an instructional form in clear and unambiguous

language, specifically applicable to the facilities provided;

v. operators are trained to carry out procedures correctly;

vi. records are made, manually and/or by recording instruments, during manufacture which

demonstrate that all the steps required by the defined procedures and instructions were in fact

taken and that the quantity and quality of the product was as expected. Any significant

deviations are fully recorded and investigated;

GOOD MANUFACTURING PRACTICE FOR MEDICINAL PRODUCTS (GMP)


vii. records of manufacture including distribution which enable the complete history of a batch to

be traced, are retained in a comprehensible and accessible form;

viii. the distribution (wholesaling) of the products minimises any risk to their quality;

ix. a system is available to recall any batch of product, from sale or supply;

x. complaints about marketed products are examined, the causes of quality defects investigated

and appropriate measures taken in respect of the defective products and to prevent re-

occurrence.

1.3 Quality Control is that part of Good Manufacturing Practice which is concerned with

sampling, specifications and testing, and with the organisation, documentation and release

procedures which ensure that the necessary and relevant tests are actually carried out and that

materials are not released for use, nor products released for sale or supply, until their quality has

been judged to be satisfactory.

The basic requirements of Quality Control are that:

i. adequate facilities, trained personnel and approved procedures are available for sampling,

inspecting and testing starting materials, packaging materials, intermediate, bulk, and finished

products, and where appropriate for monitoring environmental conditions for GMP purposes;

ii. samples of starting materials, packaging materials, intermediate products, bulk products and

finished products are taken by personnel and by methods approved by Quality Control;

iii. test methods are validated;

iv. records are made, manually and/or by recording instruments, which demonstrate that all the

required sampling, inspecting and testing procedures were actually carried out. Any deviations

are fully recorded and investigated;

v. the finished products contain active ingredients complying with the qualitative and quantitative

composition of the marketing authorisation, are of the purity required, and are enclosed within

their proper containers and correctly labelled;

vi. records are made of the results of inspection and that testing of materials, intermediate, bulk,

and finished products is formally assessed against specification. Product assessment includes a

review and evaluation of relevant production documentation and an assessment of deviations

from specified procedures;

vii. no batch of product is released for sale or supply prior to certification by an authorised person

that it is in accordance with the requirements of the relevant authorisations;

QUALITY CONTROL

CHAPTER 1


viii. sufficient reference samples of starting materials and products are retained to permit future

examination of the product if necessary and that the product is retained in its final pack unless

exceptionally large packs are produced.

1.4 Regular periodic or rolling quality reviews of all licensed medicinal products, including export only

products, should be conducted with the objective of verifying the consistency of the existing

process, the appropriateness of current specifications for both starting materials and finished

product to highlight any trends and to identify product and process improvements. Such reviews

should normally be conducted and documented annually, taking into account previous reviews, and

should include at least:

i. A review of starting materials including packaging materials used in the product, especially

those from new sources.

ii. A review of critical in-process controls and finished product results.

iii. A review of all batches that failed to meet established specification(s) and their investigation.

iv. A review of all significant deviations or non-conformances, their related investigations, and the

effectiveness of resultant corrective and preventative actions taken.

v. A review of all changes carried out to the processes or analytical methods.

vi. A review of Marketing Authorisation variations submitted/granted/ refused, including those for

third country (export only) dossiers.

vii. A review of the results of the stability monitoring programme and any adverse trends.

viii. A review of all quality-related returns, complaints and recalls and the investigations performed

at the time.

ix. A review of adequacy of any other previous product process or equipment corrective actions.

x. For new marketing authorisations and variations to marketing authorisations, a review of post-

marketing commitments.

xi. The qualification status of relevant equipment and utilities, e.g. HVAC, water, compressed gases,

etc.

xii. A review of any contractual arrangements as defined in Chapter 7 to ensure that they are up to

date.

The manufacturer and marketing authorisation holder should evaluate the results of this review and an

assessment made of whether corrective and preventative action or any revalidation should be undertaken.

Reasons for such corrective actions should be documented. Agreed corrective and preventative actions

should be completed in a timely and effective manner. There should be management procedures for the

ongoing management and review of these actions and the effectiveness of these procedures verified

during self- inspection. Quality reviews may be grouped by product type, e.g. solid dosage forms, liquid

dosage forms, sterile products, etc. where scientifically justified.

PRODUCT QUALITY REVIEW

CHAPTER 1

176

Where the marketing authorisation holder is not the manufacturer, there should be a technical agreement

in place between the various parties that defines their respective responsibilities in producing the quality

review. The authorised person responsible for final batch certification together with the marketing

authorisation holder should ensure that the quality review is performed in a timely manner and is

accurate.

1.5 Quality risk management is a systematic process for the assessment, control, communication and

review of risks to the quality of the medicinal product. It can be applied both proactively and

retrospectively.

1.6 The quality risk management system should ensure that:

- the evaluation of the risk to quality is based on scientific knowledge, experience with the

process and ultimately links to the protection of the patient;

- the level of effort, formality and documentation of the quality risk management process is

commensurate with the level of risk.

Examples of the processes and applications of quality risk management can be found inter alia in Annex

20.

QUALITY RISK MANAGEMENT


CHAPTER 1

CHAPTER 2


PRINCIPLE

GENERAL

KEY PERSONNEL

The establishment and maintenance of a satisfactory system of quality assurance and the correct

manufacture of medicinal products relies upon people. For this reason there must be sufficient qualified

personnel to carry out all the tasks which are the responsibility of the manufacturer. Individual

responsibilities should be clearly understood by the individuals and recorded. All personnel should be

aware of the principles of Good Manufacturing Practice that affect them and receive initial and continuing

training, including hygiene instructions, relevant to their needs.

2.1. The manufacturer should have an adequate number of personnel with the necessary qualifications

and practical experience. The responsibilities placed on any one individual should not be so

extensive as to present any risk to quality.

2.2. The manufacturer must have an organisation chart. People in responsible positions should have

specific duties recorded in written job descriptions and adequate authority to carry out their

responsibilities. Their duties may be delegated to designated deputies of a satisfactory qualification

level. There should be no gaps or unexplained overlaps in the responsibilities of those personnel

concerned with the application of Good Manufacturing Practice.

2.3. Key Personnel includes the head of Production, the head of Quality Control, and if at least one of

these persons is not responsible for the release of products the authorised person(s) designated for

the purpose. Normally key posts should be occupied by full-time personnel. The heads of Production

and Quality Control must be independent from each other. In large organisations, it may be

necessary to delegate some of the functions listed in 2.5., 2.6. and 2.7.

2.4. ...

2.5. The head of the Production Department generallyhas the following responsibilities:

i. to ensure that products are produced and stored according to the appropriate documentation

in order to obtain the required quality;

ii. to approve the instructions relating to production operations and to ensure their strict

implementation;

PERSONNEL


iii. to ensure that the production records are evaluated and signed by an authorised person before

they are sent to the Quality Control Department;

iv. to check the maintenance of his department, premises and equipment;

v. to ensure that the appropriate validations are done;

vi. to ensure that the required initial and continuing training of his department personnel is

carried out and adapted according to need.

2.6. The head of the Quality Control Department generally has the following responsibilities:

i. to approve or reject, as he sees fit, starting materials, packaging materials, and intermediate,

bulk and finished products;

ii. to evaluate batch records;

iii. to ensure that all necessary testing is carried out;

iv. to approve specifications, sampling instructions, test methods and other Quality Control

procedures;

v. to approve and monitor any contract analysts;

vi. to check the maintenance of his department, premises and equipment;

vii. to ensure that the appropriate validations are done;

viii. to ensure that the required initial and continuing training of his department personnel is

carried out and adapted according to need.

Other duties of the Quality Control Department are summarised in Chapter 6.

2.7. The heads of Production and Quality Control generally have some shared, or jointly exercised,

responsibilities relating to quality. These may include, subject to any national regulations:

• the authorisation of written procedures and other documents, including amendments;

• the monitoring and control of the manufacturing environment;

• plant hygiene;

• process validation;

• training;

• the approval and monitoring of suppliers of materials;

• the approval and monitoring of contract manufacturers;

• the designation and monitoring of storage conditions for materials and products;

CHAPTER 2


• the retention of records;

• the monitoring of compliance with the requirements of GMP;

• the inspection, investigation, and taking of samples, in order to monitor factors which may

affect product quality.

2.8. The manufacturer should provide training for all the personnel whose duties take them into

production areas or into control laboratories (including the technical, maintenance and cleaning

personnel), and for other personnel whose activities could affect the quality of the product.

2.9. Beside the basic training on the theory and practice of Good Manufacturing Practice, newly

recruited personnel should receive training appropriate to the duties assigned to them. Continuing

training should also be given, and its practical effectiveness should be periodically assessed.

Training programmes should be available, approved by either the head of Production or the head of

Quality Control, as appropriate. Training records should be kept.

2.10. Personnel working in areas where contamination is a hazard, e.g. clean areas or areas where highly

active, toxic, infectious or sensitising materials are handled, should be given specific training.

2.11. Visitors or untrained personnel should, preferably, not be taken into the production and Quality

Control areas. If this is unavoidable, they should be given information in advance, particularly

about personal hygiene and the prescribed protective clothing. They should be closely supervised.

2.12. The concept of Quality Assurance and all the measures capable of improving its understanding and

implementation should be fully discussed during the training sessions.

2.13. Detailed hygiene programmes should be established and adapted to the different needs within the

factory. They should include procedures relating to the health, hygiene practices and clothing of

personnel. These procedures should be understood and followed in a very strict way by every

person whose duties take him into the production and control areas. Hygiene programmes should

be promoted by management and widely discussed during training sessions.

2.14. All personnel should receive medical examination upon recruitment. It must be the manufacturer's

responsibility that there are instructions ensuring that health conditions that can be of relevance

to the quality of products come to the manufacturer's knowledge. After the first medical

examination, examinations should be carried out when necessary for the work and personal

health.

2.15. Steps should be taken to ensure as far as is practicable that no person affected by an infectious

disease or having open lesions on the exposed surface of the body is engaged in the manufacture

of medicinal products.

TRAINING

PERSONNEL HYGIENE

CHAPTER 2


2.16. Every person entering the manufacturing areas should wear protective garments appropriate to

the operations to be carried out.

2.17. Eating, drinking, chewing or smoking, or the storage of food, drink, smoking materials or personal

medication in the production and storage areas should be prohibited. In general, any unhygienic

practice within the manufacturing areas or in any other area where the product might be adversely

affected, should be forbidden.

2.18. Direct contact should be avoided between the operator's hands and the exposed product as well as

with any part of the equipment that comes into contact with the products.

2.19. Personnel should be instructed to use the hand-washing facilities.

2.20. Any specific requirements for the manufacture of special groups of products, for example sterile

preparations, are covered in the Supplementary Guidelines.

CHAPTER 2

CHAPTER 3


PRINCIPLE

PREMISES

Premises and equipment must be located, designed, constructed, adapted and maintained to suit the

operations to be carried out. Their layout and design must aim to minimise the risk of errors and permit

effective cleaning and maintenance in order to avoid cross-contamination, build up of dust or dirt and, in

general, any adverse effect on the quality of products.

General

3.1. Premises should be situated in an environment which, when considered together with measures to

protect the manufacture, presents minimal risk of causing contamination of materials or products.

3.2. Premises should be carefully maintained, ensuring that repair and maintenance operations do not

present any hazard to the quality of products. They should be cleaned and, where applicable,

disinfected according to detailed written procedures.

3.3. Lighting, temperature, humidity and ventilation should be appropriate and such that they do not

adversely affect, directly or indirectly, either the medicinal products during their manufacture and

storage, or the accurate functioning of equipment.

3.4. Premises should be designed and equipped so as to afford maximum protection against the entry

of insects or other animals.

3.5. Steps should be taken in order to prevent the entry of unauthorised people. Production, storage

and quality control areas should not be used as a right of way by personnel who do not work in

them.

Production Area

3.6. In order to minimise the risk of a serious medical hazard due to cross- contamination, dedicated

and self-contained facilities must be available for the production of particular medicinal products,

such as highly sensitising materials (e.g. penicillins) or biological preparations (e.g. from live

micro-organisms). The production of certain additional products, such as certain antibiotics,

certain hormones, certain cytotoxics, certain highly active drugs and non-medicinal products

should not be conducted in the same facilities. For those products, in exceptional cases, the

principle of campaign working in the same facilities can be accepted provided that specific

precautions are taken and the necessary validations are made. The manufacture of technical

PREMISES AND EQUIPMENT


poisons, such as pesticides and herbicides, should not be allowed in premises used for the

manufacture of medicinal products.

3.7. Premises should preferably be laid out in such a way as to allow the production to take place in

areas connected in a logical order corresponding to the sequence of the operations and to the

requisite cleanliness levels.

3.8. The adequacy of the working and in-process storage space should permit the orderly and logical

positioning of equipment and materials so as to minimise the risk of confusion between different

medicinal products or their components, to avoid cross-contamination and to minimise the risk of

omission or wrong application of any of the manufacturing or control steps.

3.9. Where starting and primary packaging materials, intermediate or bulk products are exposed to the

environment, interior surfaces (walls, floors and ceilings) should be smooth, free from cracks and

open joints, and should not shed particulate matter and should permit easy and effective cleaning

and, if necessary, disinfection.

3.10. Pipe work, light fittings, ventilation points and other services should be designed and sited to

avoid the creation of recesses which are difficult to clean. As far as possible, for maintenance

purposes, they should be accessible from outside the manufacturing areas.

3.11. Drains should be of adequate size, and have trapped gullies. Open channels should be avoided

where possible, but if necessary, they should be shallow to facilitate cleaning and disinfection.

3.12. Production areas should be effectively ventilated, with air control facilities (including temperature

and, where necessary, humidity and filtration) appropriate both to the products handled, to the

operations undertaken within them and to the external environment.

3.13. Weighing of starting materials usually should be carried out in a separate weighing room designed

for that use.

3.14. In cases where dust is generated (e.g. during sampling, weighing, mixing and processing

operations, packaging of dry products), specific provisions should be taken to avoid cross-

contamination and facilitate cleaning.

3.15. Premises for the packaging of medicinal products should be specifically designed and laid out so as

to avoid mix-ups or cross-contamination.

3.16. Productions areas should be well lit, particularly where visual on-line controls are carried out.

3.17. In-process controls may be carried out within the production area provided they do not carry any

risk for the production.

Storage Areas

3.18. Storage areas should be of sufficient capacity to allow orderly storage of the various categories of

materials and products: starting and packaging materials, intermediate, bulk and finished

products, products in quarantine, released, rejected, returned or recalled.

CHAPTER 3


3.19. Storage areas should be designed or adapted to ensure good storage conditions. In particular, they

should be clean and dry and maintained within acceptable temperature limits. Where special

storage conditions are required (e.g. temperature, humidity) these should be provided, checked

and monitored.

3.20. Receiving and dispatch bays should protect materials and products from the weather.

Receptions areas should be designed and equipped to allow containers of incoming materials to be

cleaned where necessary before storage.

3.21. Where quarantine status is ensured by storage in separate areas, these areas must be clearly

marked and their access restricted to authorised personnel. Any system replacing the physical

quarantine should give equivalent security.

3.22. There should normally be a separate sampling area for starting materials. If sampling is performed

in the storage area, it should be conducted in such a way as to prevent contamination or cross-

contamination.

3.23. Segregated areas should be provided for the storage of rejected, recalled or returned materials or

products.

3.24. Highly active materials or products should be stored in safe and secure areas.

3.25. Printed packaging materials are considered critical to the conformity of the medicinal products

and special attention should be paid to the safe and secure storage of these materials.

Quality Control Areas

3.26. Normally, Quality Control laboratories should be separated from production areas. This is

particularly important for laboratories for the control of biologicals, microbiologicals and

radioisotopes, which should also be separated from each other.

3.27. Control laboratories should be designed to suit the operations to be carried out in them.

Sufficient space should be given to avoid mix-ups and cross- contamination. There should be

adequate suitable storage space for samples and records.

3.28. Separate rooms may be necessary to protect sensitive instruments from vibration, electrical

interference, humidity, etc.

3.29. Special requirements are needed in laboratories handling particular substances, such as biological

or radioactive samples.

Ancillary Areas

3.30. Rest and refreshment rooms should be separate from other areas.

3.31. Facilities for changing clothes, and for washing and toilet purposes should be easily accessible and

appropriate for the number of users. Toilets should not directly communicate with production or

storage areas.

CHAPTER 3


3.32. Maintenance workshops should as far as possible be separated from production areas. Whenever

parts and tools are stored in the production area, they should be kept in rooms or lockers reserved

for that use.

3.33. Animal houses should be well isolated from other areas, with separate entrance (animal access)

and air handling facilities.

3.34. Manufacturing equipment should be designed, located and maintained to suit its intended

purpose.

3.35. Repair and maintenance operations should not present any hazard to the quality of the products.

3.36. Manufacturing equipment should be designed so that it can be easily and thoroughly cleaned. It

should be cleaned according to detailed and written procedures and stored only in a clean and dry

condition.

3.37. Washing and cleaning equipment should be chosen and used in order not to be a source of

contamination.

3.38. Equipment should be installed in such a way as to prevent any risk of error or of contamination.

3.39. Production equipment should not present any hazard to the products. The parts of the production

equipment that come into contact with the product must not be reactive, additive or absorptive to

such an extent that it will affect the quality of the product and thus present any hazard.

3.40. Balances and measuring equipment of an appropriate range and precision should be available for

production and control operations.

3.41. Measuring, weighing, recording and control equipment should be calibrated and checked at

defined intervals by appropriate methods. Adequate records of such tests should be maintained.

3.42. Fixed pipework should be clearly labelled to indicate the contents and, where applicable, the

direction of flow.

3.43. Distilled, deionized and, where appropriate, other water pipes should be sanitised according to

written procedures that detail the action limits for microbiological contamination and the

measures to be taken.

3.44. Defective equipment should, if possible, be removed from production and quality control areas, or

at least be clearly labelled as defective.

EQUIPMENT

CHAPTER 3

CHAPTER 4


PRINCIPLE

REQUIRED GMP DOCUMENTATION (BY TYPE)

Good documentation constitutes an essential part of the quality assurance system and is key to operating

in compliance with GMP requirements. The various types of documents and media used should be fully

defined in the manufacturer's Quality Management System. Documentation may exist in a variety of

forms, including paper-based, electronic or photographic media. The main objective of the system of

documentation utilised must be to establish, control, monitor and record all activities which directly or

indirectly impact on all aspects of the quality of medicinal products. The Quality Management System

should include sufficient instructional detail to facilitate a common understanding of the requirements,

in addition to providing for sufficient recording of the various processes and evaluation of any

observations, so that ongoing application of the requirements may be demonstrated.

There are two primary types of documentation used to manage and record GMP compliance: instructions

(directions, requirements) and records/reports. Appropriate good documentation practice should be

applied with respect to the type of document.

Suitable controls should be implemented to ensure the accuracy, integrity, availability and legibility of

documents. Instruction documents should be free from errors and available in writing. The term 'written'

means recorded, or documented on media from which data may be rendered in a human readable form.

Site Master File: A document describing the GMP related activities of the manufacturer.

Instructions (directions, or requirements) type:

Specifications: Describe in detail the requirements with which the products or materials used or obtained

during manufacture have to conform. They serve as a basis for quality evaluation.

Manufacturing Formulae, Processing, Packaging and Testing Instructions: Provide detail all the

starting materials, equipment and computerised systems (if any) to be used and specify all processing,

packaging, sampling and testing instructions. In-process controls and process analytical technologies to

be employed should be specified where relevant, together with acceptance criteria.

Procedures: (Otherwise known as Standard Operating Procedures, or SOPs), give directions for

performing certain operations.

Protocols: Give instructions for performing and recording certain discreet operations.

Technical Agreements: Are agreed between contract givers and acceptors for outsourced activities.

DOCUMENTATION


Record/Report type:

GENERATION AND CONTROL OF DOCUMENTATION

Records: Provide evidence of various actions taken to demonstrate compliance with instructions, e.g.

activities, events, investigations, and in the case of manufactured batches a history of each batch of

product, including its distribution. Records include the raw data which is used to generate other records.

For electronic records regulated users should define which data are to be used as raw data. At least, all

data on which quality decisions are based should be defined as raw data.

1Certificates of Analysis: Provide a summary of testing results on samples of products or materials

together with the evaluation for compliance to a stated specification.

Reports: Document the conduct of particular exercises, projects or investigations, together with results,

conclusions and recommendations.

4.1 All types of document should be defined and adhered to. The requirements apply equally to all

forms of document media types. Complex systems need to be understood, well documented,

validated, and adequate controls should be in place. Many documents (instructions and/or

records) may exist in hybrid forms, i.e. some elements as electronic and others as paper based.

Relationships and control measures for master documents, official copies, data handling and

records need to be stated for both hybrid and homogenous systems. Appropriate controls for

electronic documents such as templates, forms, and master documents should be implemented.

Appropriate controls should be in place to ensure the integrity of the record throughout the

retention period.

4.2 Documents should be designed, prepared, reviewed, and distributed with care. They should comply

with the relevant parts of Product Specification Files, Manufacturing and Marketing Authorisation

dossiers, as appropriate. The reproduction of working documents from master documents should


4.3 Documents containing instructions should be approved, signed and dated by appropriate and

authorised persons. Documents should have unambiguous contents and be uniquely identifiable.

The effective date should be defined.

4.4 Documents containing instructions should be laid out in an orderly fashion and be easy to check.

The style and language of documents should fit with their intended use. Standard Operating

Procedures, Work Instructions and Methods should be written in an imperative mandatory style.

4.5 Documents within the Quality Management System should be regularly reviewed and kept up-to-

date. When a document has been revised, systems should be operated to prevent inadvertent use

of superseded documents.

4.6 Documents should not be hand-written; although, where documents require the entry of data,

CHAPTER 4

1Alternatively the certification may be based, in-whole or in-part, on the assessment of real time data (summaries and exception reports) from batch related process analytical technology (PAT), parameters or metrics as per the approved marketing authorisation dossier.


sufficient space should be provided for such entries.

4.7 Handwritten entries should be made in clear, legible, indelible way.

4.8 Records should be made or completed at the time each action is taken and in such a way that all

significant activities concerning the manufacture of medicinal products are traceable.

4.9 Any alteration made to the entry on a document should be signed and dated; the alteration should

permit the reading of the original information. Where appropriate, the reason for the alteration

should be recorded.

4.10 It should be clearly defined which record is related to each manufacturing activity and where this

record is located. Secure controls must be in place to ensure the integrity of the record throughout

the retention period and validated where appropriate.

4.11 Specific requirements apply to batch documentation which must be kept for one year after expiry

of the batch to which it relates or at least five years after certification of the batch by the

Authorised Person, whichever is the longer. For investigational medicinal products, the batch

documentation must be kept for at least five years after the completion or formal discontinuation

of the last clinical trial in which the batch was used. Other requirements for retention of

documentation may be described in legislation in relation to specific types of product (e.g.

Advanced Therapy Medicinal Products) and specify that longer retention periods be applied to

certain documents.

4.12 For other types of documentation, the retention period will depend on the business activity which

the documentation supports. Critical documentation, including raw data (for example relating to

validation or stability), which supports information in the Marketing Authorisation should be

retained whilst the authorisation remains in force. It may be considered acceptable to retire

certain documentation (e.g. raw data supporting validation reports or stability reports) where the

data has been superseded by a full set of new data. Justification for this should be documented

and should take into account the requirements for retention of batch documentation; for example,

in the case of process validation data, the accompanying raw data should be retained for a period

at least as long as the records for all batches whose release has been supported on the basis of that

validation exercise.

The following section gives some examples of required documents. The quality management system

should describe all documents required to ensure product quality and patient safety.

4.13 There should be appropriately authorised and dated specifications for starting and packaging

materials, and finished products.

GOOD DOCUMENTATION PRACTICES

RETENTION OF DOCUMENTS

SPECIFICATIONS

CHAPTER 4



4.14 Specifications for starting and primary or printed packaging materials should include or provide

reference to, if applicable:

a) A description of the materials, including:

- The designated name and the internal code reference;

- The reference, if any, to a pharmacopoeial monograph;

- The approved suppliers and, if reasonable, the original producer of the material;

- A specimen of printed materials;

b) Directions for sampling and testing;

c) Qualitative and quantitative requirements with acceptance limits;

d) Storage conditions and precautions;

e) The maximum period of storage before re-examination.


4.15 Specifications for intermediate and bulk products should be available for critical steps or if these

are purchased or dispatched. The specifications should be similar to specifications for starting

materials or for finished products, as appropriate.


4.16 Specifications for finished products should include or provide reference to:

a) The designated name of the product and the code reference where applicable;

b) The formula;

c) A description of the pharmaceutical form and package details;

d) Directions for sampling and testing;

e) The qualitative and quantitative requirements, with the acceptance limits;

f) The storage conditions and any special handling precautions, where applicable;

g) The shelf-life.

Approved, written Manufacturing Formula and Processing Instructions should exist for each

product and batch size to be manufactured.

4.17 The Manufacturing Formula should include:

a) The name of the product, with a product reference code relating to its specification;

b) A description of the pharmaceutical form, strength of the product and batch size;

MANUFACTURING FORMULA AND PROCESSING INSTRUCTIONS

CHAPTER 4


c) A list of all starting materials to be used, with the amount of each, described; mention should

be made of any substance that may disappear in the course of processing;

d) A statement of the expected final yield with the acceptable limits, and of relevant intermediate

yields, where applicable.

4.18 The Processing Instructions should include:

a) A statement of the processing location and the principal equipment to be used;

b) The methods, or reference to the methods, to be used for preparing the critical equipment

(e.g. cleaning, assembling, calibrating, sterilising);

c) Checks that the equipment and work station are clear of previous products, documents or

materials not required for the planned process, and that equipment is clean and suitable for

use;

d) Detailed stepwise processing instructions [e.g. checks on materials, pretreatments, sequence

for adding materials, critical process parameters (time, temp etc)];

e) The instructions for any in-process controls with their limits;

f) Where necessary, the requirements for bulk storage of the products; including the container,

labeling and special storage conditions where applicable;

g) Any special precautions to be observed.

Packaging Instructions

4.19 Approved Packaging Instructions for each product, pack size and type should exist. These should

include, or have a reference to, the following:

a) Name of the product; including the batch number of bulk and finished product;

b) Description of its pharmaceutical form, and strength where applicable;

c) The pack size expressed in terms of the number, weight or volume of the product in the final

container;

d) A complete list of all the packaging materials required, including quantities, sizes and types,

with the code or reference number relating to the specifications of each packaging material;

e) Where appropriate, an example or reproduction of the relevant printed packaging materials,

and specimens indicating where to apply batch number references, and shelf life of the

product;

f) Checks that the equipment and work station are clear of previous products, documents or

materials not required for the planned packaging operations (line clearance), and that

equipment is clean and suitable for use;

g) Special precautions to be observed, including a careful examination of the area and equipment

in order to ascertain the line clearance before operations begin;

h) A description of the packaging operation, including any significant subsidiary operations, and

CHAPTER 4


equipment to be used;

i) Details of in-process controls with instructions for sampling and acceptance limits.

Batch Processing Record

4.20 A Batch Processing Record should be kept for each batch processed. It should be based on the

relevant parts of the currently approved Manufacturing Formula and Processing Instructions, and

should contain the following information:


b) Dates and times of commencement, of significant intermediate stages and of completion of

production;



d) The batch number and/or analytical control number as well as the quantities of each starting

material actually weighed (including the batch number and amount of any recovered or

reprocessed material added);

e) Any relevant processing operation or event and major equipment used;

f) A record of the in-process controls and the initials of the person(s) carrying them out, and the

results obtained;

g) The product yield obtained at different and pertinent stages of manufacture;

h) Notes on special problems including details, with signed authorisation for any deviation from

the Manufacturing Formula and Processing Instructions;

i) Approval by the person responsible for the processing operations.

Note: Where a validated process is continuously monitored and controlled, then automatically

generated reports may be limited to compliance summaries and exception / out-of-specification

(OOS) data reports.

Batch Packaging Record

4.21 A Batch Packaging Record should be kept for each batch or part batch processed. It should be

based on the relevant parts of the Packaging Instructions.

The batch packaging record should contain the following information:


b) The date(s) and times of the packaging operations;



d) Records of checks for identity and conformity with the packaging instructions, including the

CHAPTER 4


results of in-process controls;

e) Details of the packaging operations carried out, including references to equipment and the

packaging lines used;

f) Whenever possible, samples of printed packaging materials used, including specimens of the

batch coding, expiry dating and any additional overprinting;

g) Notes on any special problems or unusual events including details, with signed authorisation

for any deviation from the Packaging Instructions;

h) The quantities and reference number or identification of all printed packaging materials and

bulk product issued, used, destroyed or returned to stock and the quantities of obtained

product, in order to provide for an adequate reconciliation. Where there are there are robust

electronic controls in place during packaging there may be justification for not including this

information;

i) Approval by the person responsible for the packaging operations.

Receipt

4.22 There should be written procedures and records for the receipt of each delivery of each starting

material, (including bulk, intermediate or finished goods), primary, secondary and printed

packaging materials.


a) The name of the material on the delivery note and the containers; b) The "in-house" name

and/or code of material (if different from a); c) Date of receipt;

d) Supplier’s name and manufacturer’s name;

e) Manufacturer’s batch or reference number;

f) Total quantity and number of containers received;

g) The batch number assigned after receipt;

h) Any relevant comment.

4.24 There should be written procedures for the internal labeling, quarantine and storage of starting

materials, packaging materials and other materials, as appropriate.

Sampling

4.25 There should be written procedures for sampling, which include the methods and equipment to be

used, the amounts to be taken and any precautions to be observed to avoid contamination of the

material or any deterioration in its quality.

PROCEDURES AND RECORDS

CHAPTER 4


Testing



recorded.

Other


particular for the certification for sale of the finished product by the Authorised Person(s). All

records should be available to the Authorised Person. A system should be in place to indicate

special observations and any changes to critical data.

4.28 Records should be maintained for the distribution of each batch of a product in order to facilitate

recall of any batch, if necessary.

4.29 There should be written policies, procedures, protocols, reports and the associated records of

actions taken or conclusions reached, where appropriate, for the following examples:

- Validation and qualification of processes, equipment and systems;

- Equipment assembly and calibration;

- Technology transfer;

- Maintenance, cleaning and sanitation;

- Personnel matters including signature lists, training in GMP and technical matters, clothing

and hygiene and verification of the effectiveness of training;

- Environmental monitoring;

- Pest control;

- Complaints;

- Recalls;

- Returns;

- Change control;

- Investigations into deviations and non-conformances;

- Internal quality/GMP compliance audits;

- Summaries of records where appropriate (e.g. product quality review);

- Supplier audits.

4.30 Clear operating procedures should be available for major items of manufacturing and test

equipment.

CHAPTER 4


4.31 Logbooks should be kept for major or critical analytical testing, production equipment, and areas

where product has been processed. They should be used to record in chronological order, as

appropriate, any use of the area, equipment/method, calibrations, maintenance, cleaning or

repair operations, including the dates and identity of people who carried these operations out.

4.32 An inventory of documents within the Quality Management System should be maintained.

CHAPTER 4

CHAPTER 5


PRINCIPLE

GENERAL

Production operations must follow clearly defined procedures; they must comply with the principles of

Good Manufacturing Practice in order to obtain products of the requisite quality and be in accordance with

the relevant manufacturing and marketing authorisations.

5.1. Production should be performed and supervised by competent people.

5.2. All handling of materials and products, such as receipt and quarantine, sampling, storage,

labelling, dispensing, processing, packaging and distribution should be done in accordance with

written procedures or instructions and, where necessary, recorded.

5.3. All incoming materials should be checked to ensure that the consignment corresponds to the

order. Containers should be cleaned where necessary and labelled with the prescribed data.

5.4. Damage to containers and any other problem which might adversely affect the quality of a material

should be investigated, recorded and reported to the Quality Control Department.

5.5. Incoming materials and finished products should be physically or administratively quarantined

immediately after receipt or processing, until they have been released for use or distribution.

5.6. Intermediate and bulk products purchased as such should be handled on receipt as though they

were starting materials.

5.7. All materials and products should be stored under the appropriate conditions established by the

manufacturer and in an orderly fashion to permit batch segregation and stock rotation.

5.8. Checks on yields, and reconciliation of quantities, should be carried out as necessary to ensure

that there are no discrepancies outside acceptable limits.

5.9. Operations on different products should not be carried out simultaneously or consecutively in the

same room unless there is no risk of mix-up or cross- contamination.

5.10. At every stage of processing, products and materials should be protected from microbial and other

contamination.

PRODUCTION


5.11. When working with dry materials and products, special precautions should be taken to prevent the

generation and dissemination of dust. This applies particularly to the handling of highly active or

sensitising materials.

5.12. At all times during processing, all materials, bulk containers, major items of equipment and where

appropriate rooms used should be labelled or otherwise identified with an indication of the

product or material being processed, its strength (where applicable) and batch number. Where

applicable, this indication should also mention the stage of production.

5.13. Labels applied to containers, equipment or premises should be clear, unambiguous and in the

company's agreed format. It is often helpful in addition to the wording on the labels to use colours

to indicate status (for example, quarantined, accepted, rejected, clean, ...).

5.14. Checks should be carried out to ensure that pipelines and other pieces of equipment used for the

transportation of products from one area to another are connected in a correct manner.

5.15. Any deviation from instructions or procedures should be avoided as far as possible. If a deviation

occur, it should be approved in writing by a competent person, with the involvement of the Quality

Control Department when appropriate.

5.16. Access to production premises should be restricted to authorised personnel.

5.17. Normally, the production of non-medicinal products should be avoided in areas and with the

equipment destined for the production of medicinal products.

5.18. Contamination of a starting material or of a product by another material or product must be

avoided. This risk of accidental cross-contamination arises from the uncontrolled release of dust,

gases, vapours, sprays or organisms from materials and products in process, from residues on

equipment, and from operators' clothing. The significance of this risk varies with the type of

contaminant and of product being contaminated. Amongst the most hazardous contaminants are

highly sensitising materials, biological preparations containing living organisms, certain

hormones, cytotoxics, and other highly active materials. Products in which contamination is likely

to be most significant are those administered by injection, those given in large doses and/or over a

long time.

5.19. Cross-contamination should be avoided by appropriate technical or organisational measures, for

example:

a) production in segregated areas (required for products such as penicillins, live vaccines, live

bacterial preparations and some other biologicals), or by campaign (separation in time)

followed by appropriate cleaning;

b) providing appropriate air-locks and air extraction;

c) minimising the risk of contamination caused by recirculation or re-entry of untreated or

insufficiently treated air;

PREVENTION OF CROSS-CONTAMINATION IN PRODUCTION

CHAPTER 5


d) keeping protective clothing inside areas where products with special risk of cross-

contamination are processed;

e) using cleaning and decontamination procedures of known effectiveness, as ineffective

cleaning of equipment is a common source of cross- contamination;

f) using "closed systems" of production;

g) testing for residues and use of cleaning status labels on equipment.

5.20. Measures to prevent cross-contamination and their effectiveness should be checked periodically

according to set procedures.

5.21. Validation studies should reinforce Good Manufacturing Practice and be conducted in accordance

with defined procedures. Results and conclusions should be recorded.

5.22. When any new manufacturing formula or method of preparation is adopted, steps should be taken

to demonstrate its suitability for routine processing. The defined process, using the materials and

equipment specified, should be shown to yield a product consistently of the required quality.

5.23. Significant amendments to the manufacturing process, including any change in equipment or

materials, which may affect product quality and/or the reproducibility of the process should be

validated.

5.24. Processes and procedures should undergo periodic critical revalidation to ensure that they remain

capable of achieving the intended results.

5.25. The purchase of starting materials is an important operation which should involve staff who have a

particular and thorough knowledge of the suppliers.

5.26. Starting materials should only be purchased from approved suppliers named in the relevant

specification and, where possible, directly from the producer. It is recommended that the

specifications established by the manufacturer for the starting materials be discussed with the

suppliers. It is of benefit that all aspects of the production and control of the starting material in

question, including handling, labelling and packaging requirements, as well as complaints and

rejection procedures are discussed with the manufacturer and the supplier.

5.27. For each delivery, the containers should be checked for integrity of package and seal and for

correspondence between the delivery note and the supplier's labels.

5.28. If one material delivery is made up of different batches, each batch must be considered as separate

for sampling, testing and release.

VALIDATION

STARTING MATERIALS

CHAPTER 5


5.29. Starting materials in the storage area should be appropriately labelled (see Chapter 5, Item 13).

Labels should bear at least the following information:

• the designated name of the product and the internal code reference where applicable;

• a batch number given at receipt;

• where appropriate, the status of the contents (e.g. in quarantine, on test, released, rejected);

• where appropriate, an expiry date or a date beyond which retesting is necessary.

When fully computerised storage systems are used, all the above information should not

necessarily be in a legible form on the label.

5.30. There should be appropriate procedures or measures to assure the identity of the contents of each

container of starting material. Bulk containers from which samples have been drawn should be

identified (see Chapter 6, Item 13).

5.31. Only starting materials which have been released by the Quality Control

Department and which are within their shelf-life should be used.

5.32. Starting materials should only be dispensed by designated persons, following a written procedure,

to ensure that the correct materials are accurately weighed or measured into clean and properly

labelled containers.

5.33. Each dispensed material and its weight or volume should be independently checked and the check

recorded.

5.34. Materials dispensed for each batch should be kept together and conspicuously labelled as such.

5.35. Before any processing operation is started, steps should be taken to ensure that the work area and

equipment are clean and free from any starting materials, products, product residues or documents

not required for the current operation.

5.36. Intermediate and bulk products should be kept under appropriate conditions.

5.37. Critical processes should be validated (see "VALIDATION" in this Chapter).

5.38. Any necessary in-process controls and environmental controls should be carried out and recorded.

5.39. Any significant deviation from the expected yield should be recorded and investigated.

PROCESSING OPERATIONS - INTERMEDIATE AND BULK PRODUCTS

CHAPTER 5


PACKAGING MATERIALS

PACKAGING OPERATIONS

5.40. The purchase, handling and control of primary and printed packaging materials should be

accorded attention similar to that given to starting materials.

5.41. Particular attention should be paid to printed materials. They should be stored in adequately

secure conditions such as to exclude unauthorised access. Cut labels and other loose printed

materials should be stored and transported in separate closed containers so as to avoid mix-ups.

Packaging materials should be issued for use only by authorised personnel following an approved

and documented procedure.

5.42. Each delivery or batch of printed or primary packaging material should be given a specific

reference number or identification mark.

5.43. Outdated or obsolete primary packaging material or printed packaging material should be

destroyed and this disposal recorded.

5.44. When setting up a programme for the packaging operations, particular attention should be given

to minimising the risk of cross-contamination, mix-ups or substitutions. Different products should

not be packaged in close proximity unless there is physical segregation.

5.45. Before packaging operations are begun, steps should be taken to ensure that the work area,

packaging lines, printing machines and other equipment are clean and free from any products,

materials or documents previously used, if these are not required for the current operation. The

line-clearance should be performed according to an appropriate check-list.

5.46. The name and batch number of the product being handled should be displayed at each packaging

station or line.

5.47. All products and packaging materials to be used should be checked on delivery to the packaging

department for quantity, identity and conformity with the Packaging Instructions.

5.48. Containers for filling should be clean before filling. Attention should be given to avoiding and

removing any contaminants such as glass fragments and metal particles.

5.49. Normally, filling and sealing should be followed as quickly as possible by labelling. If it is not the

case, appropriate procedures should be applied to ensure that no mix-ups or mislabelling can

occur.

5.50. The correct performance of any printing operation (for example code numbers, expiry dates) to be

done separately or in the course of the packaging should be checked and recorded. Attention

should be paid to printing by hand which should be re-checked at regular intervals.

5.51. Special care should be taken when using cut-labels and when over-printing is carried out off-line.

Roll-feed labels are normally preferable to cut-labels, in helping to avoid mix-ups.

CHAPTER 5


5.52. Checks should be made to ensure that any electronic code readers, label counters or similar devices

are operating correctly.

5.53. Printed and embossed information on packaging materials should be distinct and resistant to

fading or erasing.

5.54. On-line control of the product during packaging should include at least checking the following:

a) general appearance of the packages;

b) whether the packages are complete;

c) whether the correct products and packaging materials are used;

d) whether any over-printing is correct;

e) correct functioning of line monitors.

Samples taken away from the packaging line should not be returned.

5.55. Products which have been involved in an unusual event should only be reintroduced into the

process after special inspection, investigation and approval by authorised personnel.

Detailed record should be kept of this operation.

5.56. Any significant or unusual discrepancy observed during reconciliation of the amount of bulk

product and printed packaging materials and the number of units produced should be investigated

and satisfactorily accounted for before release.

5.57. Upon completion of a packaging operation, any unused batch-coded packaging materials should

be destroyed and the destruction recorded. A documented procedure should be followed if uncoded

printed materials are returned to stock.

5.58. Finished products should be held in quarantine until their final release under conditions

established by the manufacturer.

5.59. The evaluation of finished products and documentation which is necessary before release of

product for sale are described in Chapter 6 (Quality Control).

5.60. After release, finished products should be stored as usable stock under conditions established by

the manufacturer.

5.61. Rejected materials and products should be clearly marked as such and stored separately in

restricted areas. They should either be returned to the suppliers or, where appropriate,

reprocessed or destroyed. Whatever action is taken should be approved and recorded by authorised

personnel.

FINISHED PRODUCTS

REJECTED, RECOVERED AND RETURNED MATERIALS

CHAPTER 5


5.62. The reprocessing of rejected products should be exceptional. It is only permitted if the quality of

the final product is not affected, if the specifications are met and if it is done in accordance with a

defined and authorised procedure after evaluation of the risks involved. Record should be kept of

the reprocessing.

5.63. The recovery of all or part of earlier batches, which conform to the required quality by

incorporation into a batch of the same product at a defined stage of manufacture should be

authorised beforehand. This recovery should be carried out in accordance with a defined procedure

after evaluation of the risks involved, including any possible effect on shelf life. The recovery

should be recorded.

5.64. The need for additional testing of any finished product which has been reprocessed, or into which a

recovered product has been incorporated, should be considered by the Quality Control Department.

5.65. Products returned from the market and which have left the control of the manufacturer should be

destroyed unless without doubt their quality is satisfactory; they may be considered for re-sale, re-

labelling or recovery with a subsequent batch only after they have been critically assessed by the

Quality Control Department in accordance with a written procedure. The nature of the product, any

special storage conditions it requires, its condition and history, and the time elapsed since it was

issued should all be taken into account in this assessment. Where any doubt arises over the quality

of the product, it should not be considered suitable for re-issue or re-use, although basic chemical

reprocessing to recover active ingredients may be possible. Any action taken should be

appropriately recorded.

CHAPTER 5

CHAPTER 6


PRINCIPLE

GENERAL

GOOD QUALITY CONTROL LABORATORY PRACTICE

Quality Control is concerned with sampling, specifications and testing as well as the organisation,

documentation and release procedures which ensure that the necessary and relevant tests are carried out,

and that materials are not released for use, nor products released for sale or supply, until their quality has

been judged satisfactory. Quality Control is not confined to laboratory operations, but must be involved

in all decisions which may concern the quality of the product. The independence of Quality Control from

Production is considered fundamental to the satisfactory operation of Quality Control (see also Chapter

1).

6.1. Each holder of a manufacturing authorisation should have a Quality Control Department. This

department should be independent from other departments, and under the authority of a person

with appropriate qualifications and experience, who has one or several control laboratories at his

disposal. Adequate resources must be available to ensure that all the Quality Control arrangements

are effectively and reliably carried out.

6.2. The principal duties of the head of Quality Control are summarised in Chapter 2. The Quality Control

Department as a whole will also have other duties, such as to establish, validate and implement all

quality control procedures, keep the reference samples of materials and products, ensure the

correct labelling of containers of materials and products, ensure the monitoring of the stability of

the products, participate in the investigation of complaints related to the quality of the product,

etc. All these operations should be carried out in accordance with written procedures and, where

necessary, recorded.

6.3. Finished product assessment should embrace all relevant factors, including production conditions,

results of in-process testing, a review of manufacturing (including packaging) documentation,

compliance with Finished Product Specification and examination of the final finished pack.

6.4. Quality Control personnel should have access to production areas for sampling and investigation as

appropriate.

6.5. Control Laboratory premises and equipment should meet the general and specific requirements for

Quality Control areas given in Chapter 3.

QUALITY CONTROL


6.6. The personnel, premises, and equipment in the laboratories should be appropriate to the tasks

imposed by the nature and the scale of the manufacturing operations. The use of outside

laboratories, in conformity with the principles detailed in Chapter 7, Contract Analysis, can be

accepted for particular reasons, but this should be stated in the Quality Control records.

6.7. Laboratory documentation should follow the principles given in Chapter 4. An important part of

this documentation deals with Quality Control and the following details should be readily available

to the Quality Control Department:

• specifications;

• sampling procedures;

• testing procedures and records (including analytical worksheets and/or laboratory

notebooks);

• analytical reports and/or certificates;

• data from environmental monitoring, where required;

• validation records of test methods, where applicable;

• procedures for and records of the calibration of instruments and maintenance of

equipment.

6.8. Any Quality Control documentation relating to a batch record should be retained for one year after

the expiry date of the batch.

6.9. For some kinds of data (e.g. analytical tests results, yields, environmental controls, ...) it is

recommended that records in a manner permitting trend evaluation be kept.

6.10. In addition to the information which is part of the batch record, other original data such as

laboratory notebooks and/or records should be retained and readily available.

6.11. The sample taking should be done in accordance with approved written procedures that describe:

• the method of sampling;

• the equipment to be used;

• the amount of the sample to be taken;

• instructions for any required sub-division of the sample;

• the type and condition of the sample container to be used;

• the identification of containers sampled;

DOCUMENTATION

SAMPLING

CHAPTER 6


• any special precautions to be observed, especially with regard to the sampling of sterile or

noxious materials;

• the storage conditions;

• instructions for the cleaning and storage of sampling equipment.

6.12. Reference samples should be representative of the batch of materials or products from which they

are taken. Other samples may also be taken to monitor the most stressed part of a process (e.g.

beginning or end of a process).

6.13. Sample containers should bear a label indicating the contents, with the batch number, the date of

sampling and the containers from which samples have been drawn.

6.14. Reference samples from each batch of finished products should be retained till one year after the

expiry date. Finished products should usually be kept in their final packaging and stored under the

recommended conditions. Samples of starting materials (other than solvents, gases and water)

should be retained for at least two years after the release of the product if their stability allows.

This period may be shortened if their stability, as mentioned in the relevant specification, is

shorter. Reference samples of materials and products should be of a size sufficient to permit at

least a full re-examination.

6.15. Analytical methods should be validated. All testing operations described in the marketing

authorisation should be carried out according to the approved methods.

6.16. The results obtained should be recorded and checked to make sure that they are consistent with

each other. Any calculations should be critically examined.

6.17. The tests performed should be recorded and the records should include at least the following data:

a) name of the material or product and, where applicable, dosage form;

b) batch number and, where appropriate, the manufacturer and/or supplier;

c) references to the relevant specifications and testing procedures;

d) test results, including observations and calculations, and reference to any certificates of

analysis;

e) dates of testing;

f) initials of the persons who performed the testing;

g) initials of the persons who verified the testing and the calculations, where appropriate;

h) a clear statement of release or rejection (or other status decision) and the dated signature of

the designated responsible person.

TESTING

CHAPTER 6


6.18. All the in-process controls, including those made in the production area by production personnel,

should be performed according to methods approved by Quality Control and the results recorded.

6.19. Special attention should be given to the quality of laboratory reagents, volumetric glassware and

solutions, reference standards and culture media. They should be prepared in accordance with

written procedures.

6.20. Laboratory reagents intended for prolonged use should be marked with the preparation date and

the signature of the person who prepared them. The expiry date of unstable reagents and culture

media should be indicated on the label, together with specific storage conditions. In addition, for

volumetric solutions, the last date of standardisation and the last current factor should be

indicated.

6.21. Where necessary, the date of receipt of any substance used for testing operations (e.g. reagents

and reference standards) should be indicated on the container. Instructions for use and storage

should be followed. In certain cases it may be necessary to carry out an identification test and/or

other testing of reagent materials upon receipt or before use.

6.22. Animals used for testing components, materials or products, should, where appropriate, be

quarantined before use. They should be maintained and controlled in a manner that assures their

suitability for the intended use. They should be identified, and adequate records should be

maintained, showing the history of their use.

6.23. After marketing, the stability of the medicinal product should be monitored according to a

continuous appropriate programme that will permit the detection of any stability issue (e.g.

changes in levels of impurities, or dissolution profile) associated with the formulation in the

marketed package.

6.24. The purpose of the on-going stability programme is to monitor the product over its shelf life and to

determine that the product remains, and can be expected to remain, within specifications under

the labelled storage conditions.

6.25. This mainly applies to the medicinal product in the package in which it is sold, but consideration

should also be given to the inclusion in the programme of bulk product. For example, when the

bulk product is stored for a long period before being packaged and/or shipped from a

manufacturing site to a packaging site, the impact on the stability of the packaged product should

be evaluated and studied under ambient conditions. In addition, consideration should be given to

intermediates that are stored and used over prolonged periods. Stability studies on reconstituted

product are performed during product development and need not be monitored on an on-going

basis. However, when relevant, the stability of reconstituted product can also be monitored.

6.26. The on-going stability programme should be described in a written protocol following the general

rules of Chapter 4 and results formalised as a report. The equipment used for the on-going stability

ON-GOING STABILITY PROGRAMME

CHAPTER 6


programme (stability chambers among others) should be qualified and maintained following the

general rules of Chapter 3 and annex 15.

6.27. The protocol for an on-going stability programme should extend to the end of the shelf life period

and should include, but not be limited to, the following parameters:

• number of batch(es) per strength and different batch sizes, if applicable

• relevant physical, chemical, microbiological and biological test methods

• acceptance criteria

• reference to test methods

• description of the container closure system(s)

• testing intervals (time points)

• description of the conditions of storage (standardised ICH conditions for long term testing,

consistent with the product labelling, should be used)

• other applicable parameters specific to the medicinal product.

6.28. The protocol for the on-going stability programme can be different from that of the initial long-

term stability study as submitted in the marketing authorisation dossier provided that this is

justified and documented in the protocol (for example the frequency of testing, or when updating

to ICH recommendations).

6.29. The number of batches and frequency of testing should provide a sufficient amount of data to allow

for trend analysis. Unless otherwise justified, at least one batch per year of product manufactured

in every strength and every primary packaging type, if relevant, should be included in the stability

programme (unless none are produced during that year). For products where on-going stability

monitoring would normally require testing using animals and no appropriate alternative,

validated techniques are available, the frequency of testing may take account of a risk-benefit

approach. The principle of bracketing and matrixing designs may be applied if scientifically

justified in the protocol.

6.30. In certain situations, additional batches should be included in the on-going stability programme.

For example, an on-going stability study should be conducted after any significant change or

significant deviation to the process or package. Any reworking, reprocessing or recovery operation

should also be considered for inclusion.

6.31. Results of on-going stability studies should be made available to key personnel and, in particular,

to the Authorised Person(s). Where on-going stability studies are carried out at a site other than

the site of manufacture of the bulk or finished product, there should be a written agreement

between the parties concerned.

Results of on-going stability studies should be available at the site of manufacture for review by

the competent authority.

CHAPTER 6


6.32. Out of specification or significant atypical trends should be investigated. Any confirmed out of

specification result, or significant negative trend, should be reported to the relevant competent

authorities. The possible impact on batches on the market should be considered in accordance with

chapter 8 of the GMP Guide and in consultation with the relevant competent authorities.

6.33. A summary of all the data generated, including any interim conclusions on the programme, should

be written and maintained. This summary should be subjected to periodic review.

CHAPTER 6

CHAPTER 7


PRINCIPLE

GENERAL

THE CONTRACT GIVER

Contract manufacture and analysis must be correctly defined, agreed and controlled in order to avoid

misunderstandings which could result in a product or work of unsatisfactory quality. There must be a

written contract between the Contract Giver and the Contract Acceptor which clearly establishes the

duties of each party. The contract must clearly state the way in which the authorised person releasing

each batch of product for sale exercises his full responsibility.

Note: This Chapter deals with the responsibilities of manufacturers towards the Component Authorities of

the Participating Authorities with respect to the granting of marketing and manufacturing

authorisations. It is not intended in any way to affect the respective liability of contract acceptors and

contract givers to consumers.

7.1. There should be a written contract covering the manufacture and/or analysis arranged under

contract and any technical arrangements made in connection with it.

7.2. All arrangements for contract manufacture and analysis including any proposed changes in

technical or other arrangements should be in accordance with the marketing authorisation for the

product concerned.

7.3. The Contract Giver is responsible for assessing the competence of the Contract Acceptor to carry

out successfully the work required and for ensuring by means of the contract that the principles

and Guidelines of GMP as interpreted in this Guide are followed.

7.4. The Contract Giver should provide the Contract Acceptor with all the information necessary to carry

out the contracted operations correctly in accordance with the marketing authorisation and any

other legal requirements. The Contract Giver should ensure that the Contract Acceptor is fully

aware of any problems associated with the product or the work which might pose a hazard to his

premises, equipment, personnel, other materials or other products.

7.5. The Contract Giver should ensure that all processed products and materials delivered to him by the

Contract Acceptor comply with their specifications or that the products have been released by an

authorised person.

CONTRACT MANUFACTURE AND ANALYSIS


THE CONTRACT ACCEPTOR

THE CONTRACT

7.6. The Contract Acceptor must have adequate premises and equipment, knowledge and experience,

and competent personnel to carry out satisfactorily the work ordered by the Contract Giver.

Contract manufacture may be undertaken only by a manufacturer who is the holder of a

manufacturing authorisation.

7.7. The Contract Acceptor should ensure that all products or materials delivered to him are suitable for

their intended purpose.

7.8. The Contract Acceptor should not pass to a third party any of the work entrusted to him under the

contract without the Contract Giver's prior evaluation and approval of the arrangements.

Arrangements made between the Contract Acceptor and any third party should ensure that the

manufacturing and analytical information is made available in the same way as between the

original Contract Giver and Contract Acceptor.

7.9. The Contract Acceptor should refrain from any activity which may adversely affect the quality of the

product manufactured and/or analysed for the Contract Giver.

7.10. A contract should be drawn up between the Contract Giver and the Contract Acceptor which

specifies their respective responsibilities relating to the manufacture and control of the product.

Technical aspects of the contract should be drawn up by competent persons suitably

knowledgeable in pharmaceutical technology, analysis and Good Manufacturing Practice. All

arrangements for manufacture and analysis must be in accordance with the marketing

authorisation and agreed by both parties.

7.11. The contract should specify the way in which the authorised person releasing the batch for sale

ensures that each batch has been manufactured and checked for compliance with the requirements

of Marketing Authorisation.

7.12. The contract should describe clearly who is responsible for purchasing materials, testing and

releasing materials, undertaking production and quality controls, including in-process controls,

and who has responsibility for sampling and analysis. In the case of contract analysis, the contract

should state whether or not the Contract Acceptor should take samples at the premises of the

manufacturer.

7.13. Manufacturing, analytical and distribution records, and reference samples should be kept by, or be

available to, the Contract Giver. Any records relevant to assessing the quality of a product in the

event of complaints or a suspected defect must be accessible and specified in the defect/recall

procedures of the Contract Giver.

7.14. The contract should permit the Contract Giver to visit the facilities of the Contract Acceptor.

7.15. In case of contract analysis, the Contract Acceptor should understand that he is subject to

inspection by the competent Authorities.

CHAPTER 7

CHAPTER 8


PRINCIPLE

COMPLAINTS

All complaints and other information concerning potentially defective products must be carefully reviewed

according to written procedures. In order to provide for all contingencies, a system should be designed to

recall, if necessary, promptly and effectively products known or suspected to be defective from the

market.

8.1. A person should be designated responsible for handling the complaints and deciding the measures

to be taken together with sufficient supporting staff to assist him. If this person is not the

authorised person, the latter should be made aware of any complaint, investigation or recall.

8.2. There should be written procedures describing the action to be taken, including the need to

consider a recall, in the case of a complaint concerning a possible product defect.

8.3. Any complaint concerning a product defect should be recorded with all the original details and

thoroughly investigated. The person responsible for Quality Control should normally be involved in

the study of such problems.

8.4. If a product defect is discovered or suspected in a batch, consideration should be given to checking

other batches in order to determine whether they are also affected. In particular, other batches

which may contain reworks of the defective batch should be investigated.

8.5. All the decisions and measures taken as a result of a complaint should be recorded and referenced

to the corresponding batch records.

8.6. Complaints records should be reviewed regularly for any indication of specific or recurring

problems requiring attention and possibly the recall of marketed products.

8.7. Special attention should be given to establishing whether a complaint was caused because of

counterfeiting.

8.8. The Competent Authorities should be informed if a manufacturer is considering action following

possibly faulty manufacture, product deterioration, detection of counterfeiting or any other

serious quality problems with a product.

COMPLAINTS AND PRODUCT RECALL


RECALLS

8.9. A person should be designated as responsible for execution and co-ordination of recalls and should

be supported by sufficient staff to handle all the aspects of the recalls with the appropriate degree

of urgency. This responsible person should normally be independent of the sales and marketing

organisation. If this person is not the authorised person, the latter should be made aware of any

recall operation.

8.10. There should be established written procedures, regularly checked and updated when necessary, in

order to organise any recall activity.

8.11. Recall operations should be capable of being initiated promptly and at any time.

8.12. All Competent Authorities of all countries to which products may have been distributed should be

informed promptly if products are intended to be recalled because they are, or are suspected of,

being defective.

8.13. The distribution records should be readily available to the person(s) responsible for recalls, and

should contain sufficient information on wholesalers and directly supplied customers (with

addresses, phone and/or fax numbers inside and outside working hours, batches and amounts

delivered), including those for exported products and medical samples.

8.14. Recalled products should be identified and stored separately in a secure area while awaiting a

decision on their fate.

8.15. The progress of the recall process should be recorded and a final report issued, including a

reconciliation between the delivered and recovered quantities of the products.

8.16. The effectiveness of the arrangements for recalls should be evaluated regularly.

CHAPTER 8

CHAPTER 9


PRINCIPLE

Self inspections should be conducted in order to monitor the implementation and compliance wit Good

Manufacturing Practice principles and to propose necessary corrective measures.

9.1. Personnel matters, premises, equipment, documentation, production, quality control, distribution

of the medicinal products, arrangements for dealing with complaints and recalls, and self

inspection, should be examined at intervals following a pre-arranged programme in order to verify

their conformity with the principles of Quality Assurance.

9.2. Self inspections should be conducted in an independent and detailed way by designated competent

person(s) from the company. Independent audits by external experts may also be useful.

9.3. All self inspections should be recorded. Reports should contain all the observations made during

the inspections and, where applicable, proposals for corrective measures. Statements on the

actions subsequently taken should also be recorded.

SELF INSPECTION

The Department of Pharmaceuticals was created on 1st July 2008 to be a focused Department of Government of India for fostering growth of the Indian Pharmaceutical Industry. The Department has been assigned several functions including inter-alia promotion of Research, Education and Training, Public Private Partnership, international Cooperation, Inter- Sectoral cooperation, Industrial Cooperation, Environment and Hazard Management and Pricing and Availability of Medicines. The Department of Pharmaceuticals discharges their functions through active consultations with stakeholders to formulate new schemes/ proposals/ strategies for promoting growth of the Pharmaceutical Industry

Established in 1927, FICCI is the largest and oldest apex business organisation in India. Its history is closely interwoven with India’s struggle for independence, its industrialization, and its emergence as one of the most rapidly growing global economies. FICCI has contributed to this historical process by encouraging debate, articulating the private sector’s views and influencing policy.

A non-government, not-for-profit organisation, FICCI is the voice of India’s business and industry.

FICCI draws its membership from the corporate sector, both private and public, including SMEs and MNCs; FICCI enjoys an indirect membership of over 2,50,000 companies from various regional chambers of commerce.

FICCI provides a platform for sector specific consensus building and networking and as the first port of call for Indian industry and the international business community.

Our Vision: To be the thought leader for industry, its voice for policy change and its guardian for effective implementation.

Our Mission: To carry forward our initiatives in support of rapid, inclusive and sustainable growth that encompass health, education, livelihood, governance and skill development.

To enhance efficiency and global competitiveness of Indian industry and to expand business opportunities both in domestic and foreign markets through a range of specialised services and global linkages.

World Health Organization is the United Nations' specialized technical agency for Health. It is an inter-governmental organization and works in collaboration with its member states. WHO's objective is the attainment by all people of the highest possible level of health. Equitable access to essential medicines for priority diseases is one of the requirements for fulfilling the fundamental right to health. WHO's Medicines' Strategy is based on four key objectives: strengthening national medicines policy, improving access to essential medicines, the quality & safety of medicines, and rational use of medicines.

WHO India Country Office collaborates with the Government of India and relevant stakeholders within the framework of the collaborative Country Cooperation Strategy (CCS), to actively support the development and implementation of national health policies, strategies and plans in the area of Essential Medicines & Pharmaceuticals, including access, quality and safety of medicines and impact of intellectual property rights on public health.

About Organizers

Mr. Kawaljeet Singh

Deputy Director

FICCI Federation House Tansen Marg,

New Delhi – 110001

Email: [email protected]

Telephone: 011-23487355

Dr. Madhur Gupta

Technical Officer-Pharmaceuticals WHO Country Office for India

RK Khanna Tennis Stadium, Safdarjung Enclave

New Delhi – 110029

Email: [email protected]

Telephone: 011-66564800 (23274/23255)

For More Details Contact:

Focused on GMP in production of Active Pharmaceutical ... · Annex 2 Introduction 04 BBackground...

Documents

Transcript of Focused on GMP in production of Active Pharmaceutical ... · Annex 2 Introduction 04 BBackground...