Principles of Computerized System Validation · –A system for logging and tracking documents and document requests –Staging room – (war room) ... Supplier Preparation for an

FDA Expectationsfor Supplier Quality

Martin BrowningPresident and Co-Founder

EduQuest

2014

FDA Expectations for Supplier Quality

OMTEC® 2014 The 10th Annual Orthopaedic Manufacturing & Technology

Exposition and Conference

© 2014 EduQuest, Inc. 2

Topics

• Setting the scene

• Regulatory Requirements and Expectations

• Protecting your company

– Contracts and Service Level Agreements (SLAs)

– Selecting Partners

– Supplier Preparation for an FDA Visit

– Pitfalls and Critical Issues

– Consequences

• Summary

3

The Drive to Outsource

“What can be outsourced?

Everything, except responsibility.”

“By agreeing to supply, the vendor assumes a

whole new level of additional responsibility”

© 2014 EduQuest, Inc.

4

The Drive to Outsource

Why outsource?

• Cost reduction

• Better focus on “core” business

• Reduce or control personnel “overhead”

• Improve organizational performance


Regulatory Interest in Supply Chain

Management

• FDA’s Published Goals for 2011 – 2015

– Advance Regulatory Science and Innovation

– Strengthen the Safety and Integrity of the Global

Supply Chain

– Strengthen Compliance and Enforcement Activities to

Support Public Health

– Expand Efforts to Meet the Needs of Special Populations

– Advance Medical Countermeasures and Emergency

Preparedness


Goal 2: Strengthen the Safety and Integrity of the

Global Supply Chain

• The border must be viewed as a final checkpoint for

preventive controls, rather than the primary line of

defense against unsafe imports.

• FDA must require more (and better) information

about product supply chains and monitor this

information throughout the product life cycle

• Regulatory standards must foster corporate

responsibility to identify, protect, and control risks


Goal 2: Strengthen the Safety and Integrity of the

Global Supply Chain

• Updated compliance and enforcement tools, a

greater global safety net that includes a global

alliance of regulators,

• Coordination of activities with international

capacity-building and standards-setting

organizations, adequate funding to allow for

inspections, examinations and sample collections

and analysis, and updated systems, including IT

support, to assist with the increased workload. © 2014 EduQuest, Inc. 7

8

Regulatory Requirements and Expectations

• The regulated entity, is responsible for

compliance with all of the applicable regulatory

requirements. If you outsource, you are

responsible for the performance of your

outsourcing partners.




• “Do unto your suppliers as FDA does unto you”

– Requires a robust quality organization for audit,

oversight, etc. (note that this also can be outsourced)

– Your company’s management (and not just Quality)

must have processes for evaluating and effectively

managing potential partners

10


• If you outsource you are still responsible for

assuring that all required activities are performed

and documented. Monitoring is critical, so

typically a more robust quality organization is

needed for audit, oversight, etc. (note that this

also can be outsourced)


11

FDA Seeks Civil Penalties

from California Device Maker

The U.S. Food and Drug Administration (FDA)

announced it is seeking a $2.2 million penalty against

a California device manufacturer for violations of

federal law, including manufacturing standards

violations and the failure to notify the FDA of a

change in an outside supplier or vendor, which may

have exposed recipients of the devices to

unnecessary health risks.


12

FDA Seeks Civil Penalties

from California Device Maker

The alleged GMP violations include the failure to

sufficiently evaluate and select a new vendor as the

supplier of a critical device component and the

failure to adequately validate the continued safety

and effectiveness of the device by testing lots under

actual or simulated use when the unapproved

vendor's component was used


13

FDA Warning Issued for Contract

Manufacturer – Related Violations

• An FDA warning letter was issued to a medical

device manufacturer for several problems related to

its use of a contract manufacturer

– The unsigned purchasing procedure, written during the

inspection, does not require an evaluation of potential

suppliers, contractors and consultants

– The firm does not maintain a list of purchasing data or

documents describing product requirements, specifications

and quality expectations for its devices being manufactured

at contract facilities © 2014 EduQuest, Inc.

14

FDA Warning Issued for Contract

Manufacturer – Related Violations

– The manufacturer did not document the results of its

evaluation of its contract manufacturing facilities’

ability to meet its requirements

– The firm also did not establish quality-system

procedures outlining the responsibilities and

manufacturing operations for each of its contract

manufacturing facilities before receiving its first

production lot from the manufacturer, packager and

sterilizer


15

Janet Woodcock to the US Senate

“All parties throughout the supply chain

from the production of the API and the

ingredients, through brokers, distributors,

importers to finished product manufacturers

must be held responsible,”


16

Janet Woodcock to the US Senate

“They (manufacturers) are the ones that must

be held responsible for assuring the quality and

the integrity of the products they produce.

FDA or any other worldwide regulator can not

test quality into products and we can not

inspect quality into products. FDA must have

the tools to hold all these parties accountable.”


17

Senator’s Comments

• Companies should be required to know more

about the firms from which they obtain their

ingredients and device components, and audit

them for ongoing compliance. Reputable

companies do so already.

• Manufacturers must also use better tests of their

own to detect nonconformities and contaminants.


18

Protecting Both Companies

• Contracts and Service Level Agreements (SLAs)

should include sections on –

– Definitions

– Scope

– Conditions and limitations

– Key contacts (responsibilities)

– Reporting and documentation requirements

– Change management


19


• Contracts and SLAs (cont’d.)

– Property

– Secrecy

– Duration

– Arbitration

– Agreement

– Infrastructure


20



– Service delivery

– Support

– Quality processes

– Management processes

– Regulatory requirements


21



– Validation requirements and expectations

– Delivery of documentation

– Business continuity

– Etc.


Key Outsourcing Controls

• The outsourcer must have established and clearly

defined:

– Company quality and integrity standards

– Quality policy

– Management responsibilities

– Quality responsibilities

– Vendor and supplier management processes

22 © 2014 EduQuest, Inc.

Potential Outsourcing Partners

• Should have already defined their own quality and

integrity standards and these must be a good “fit” with

the outsourcer

• Must understand and be willing (and able) to fully

comply with the regulatory requirements

• Must understand and recognize their own exposure to

regulatory enforcement risks


Selecting Partners

• Company management (and not just Quality)

must have processes for evaluating and

effectively managing potential partners

– Survey, audit, selection process

– CAPA processes

– Clearly defined regulatory compliance processes

– Clearly defined risk analysis


Selecting Partners

• When is the most effective time to evaluate a

potential outsourcing partner?

– Before a deal is made or a contract is signed

– After that, the attention you get and the

leverage you have can be greatly diminished


A Critical Part of Supply Chain

Management – Handling Nonconformance

• OOS results, recalls, complaints:

– Responsibilities and processes must be

established for handling nonconformance

– Must establish who, how, and when for initial

investigations, root cause analysis, follow-up,

CAPA, etc.

– Issue closure must be clearly defined and

assured 26 © 2014 EduQuest, Inc.


Management – Risk Management

• Supplier Management is only a portion of

overall Supply Chain Management

• Regulatory concerns stem from Risk and Risk

Priorities – Patient

– Product

– Process



Management – Risk Management

• As we outsource our opportunities to impact

patient, product, and process quality become

fewer and more critical.

• A comprehensive supplier management program

is required by law to protect the contractor.


Supplier Preparation for an FDA Visit

• One of our primary goals is to MANAGE the

inspection from start to finish by:

– Understanding the FDA’s expectations

– Preparing the supplier site

– Generating documented evidence of compliance with

FDA regulations

– Managing the inspection process

– Interacting appropriately with FDA inspectors



• The pre-identified Escort (inspection coordinator)

greets inspectors and brings them to the Audit

Room

• Notification of arrival is communicated to

remaining management and appropriate

individuals (usually best for the receptionist to do

this after the Investigators leave with their Escort)



• Prior to the inspection identify:

– Inspection team

– Subject matter experts – Area experts

– Scribes, escorts and runners

– A system for logging and tracking documents and document requests

– Staging room – (war room)

– A dedicated conference room

• Train all employees especially for the above responsibilities




• Assure that you have policies and procedures

for process development, validation, and

operations

• Assure that procedures are followed

• Assure that the records are kept and

consistent with the procedures

• Assure you and any vendors have a Quality

Assurance Program that is followed



• Know answers to obvious questions

– How are policies and procedures documented and controlled?

– How are records kept?

– What records show policies and procedures were followed?

– Who are the subject matter experts to answer questions?


• Have the key documents readily available

• Know what is in the documents

• Maintain up-to-date records

• Maintain validation documentation

• Assure training and training records are up to

date and complete



• Inspectors will request to speak to the individuals

responsible for making decisions

• Subject Matter Experts (SMEs) should…

– Be knowledgeable in product and study(ies) being

inspected

– Answer only questions being asked (but be complete)

– Request support from Escort or additional SME’s as

needed



• Maintain notes of all discussions that take place in

the audit room (scribe notes)

– The Scribe should…

• Keep detailed notes (typed or handwritten)

• Keep the staging room informed of all inspector

requests

• Have a separate person (Runner) performing this task

(or an electronic process for this communication)



• Pre-stage documents that FDA will likely want to

see

– Study records, quality records, manufacturing records,

verification records, etc.

– SOPs and Quality System documents (Management

Controls, CAPA, Complaints, etc.)

• Ensure timely fulfillment of inspector requests or set

expectations for fulfillment


Auditor’s Rule of Thumb

If it is not documented

It was not done!!!!!


Purpose of Documents, Records and

Change Controls

• To assure that specifications and procedures are

adequate

• To assure only current documents are used

• To assure maintenance of documents for

required length of time


Purpose of Documents, Records and

Change Controls

• To assure appropriate review and approval by

responsible personnel

• To assure changes are reviewed, approved and

incorporated into documents by the same

people in the same function or organization

that performed the original review and

approval, unless specifically designated

otherwise


Elements of Data Quality

• Electronic and paper records must provide the same

degree of confidence and reliability and must be

– Attributable

– Legible

– Contemporaneous

– Original

– Accurate


Common Outsourcing Pitfalls

• Your partner changes processes, personnel,

locations, ownership, etc., without telling you

• If it’s not in the contract . . .

• The service, system, software, product, etc.,

doesn’t really exist yet

• Your partner has your data . . . now what?


Avoiding the Pitfalls

• Make sure it is in writing (assume nothing!)

• Retain clear leverage (management attention)

• Train them on your requirements, regulatory

requirements, and retrain as necessary

• Diligent audits and rigorous follow-up

• Diligent monitoring – review the data

• Constantly measure compliance


What Should Not be Outsourced

• Any activities:

– Where your company holds the technical

expertise and does not want to give up control

– That you cannot effectively monitor

– That are related to a specific commitment to

FDA or other government Agencies


A Few Critical Issues

• There is a need for:

– Strong, inclusive contracts and quality agreements

– Diligent audits

– More diligent monitoring

– Better review of routine data

– Better documentation of actions

– Better training of suppliers on your requirements and regulatory requirements (retrain as necessary)

– Constantly measuring compliance


46


• Maintain a Healthy Relationship

• Monitor and Trend

– Monitor based upon defined processes and defined risk

– Collect key process data on performance (control

points)

– Trend past, current, and plan future performance relative

to expectations and quality goals


47


• Both the Contractor and Supplier must decide

and act based upon:

– Clearly defined roles and responsibilities

– Clearly defined methods for detecting problems

– Clearly defined and well documented CAPA system

• Corrections

• Corrective actions

• Preventive actions


48


• Continuous Improvement

– Actions based upon defined risks

• Reevaluate risks

• Reevaluate processes

– Predefined mitigations

• Measure effectiveness

• Refine mitigations



Consequences of Non-Compliance

• Possible regulatory enforcement actions

– Disqualification of a nonclinical laboratory

– Clinical hold or termination

– Delay in approval of new products or facilities

– Rejection of application data (e.g., clinical trials)




– Disqualification of clinical investigators

– Initiation of the Application Integrity Policy

– Warning Letter (including sanctions)

– Withholding approval of Certificates for

Foreign Government (CFGs) used for exports




– Product seizure

– Import restrictions

– Consent Decree

– Criminal prosecution

– Debarment

Summary

• Regulators have and will have an increased focus on

supplier management

• Heightened manufacturer oversight (more regulatory

inspections)

• Better local and national coordination of inspection

strategy

• More international inspections

(Higher Risks)


Q U E S T I O N S ?

Contact: EduQuest, Inc.

1896 Urbana Pike, Suite 14

Hyattstown, MD 20871

+1 (301) 874-6031

[email protected]

www.EduQuest.net


mailto:[email protected]

http://www.eduquest.net/

View additionalOMTEC 2014

speaker presentations.

www.OMTECexpo.com

2014

www.OMTECexpo.com