Regulatory Updates Including Method Validation ... Updates Including Method Validation, Convergence of GAMP & USP , Data Integrity & Paper versus Electronic Raw Data

Regulatory Updates Including Method Validation,

Convergence of GAMP & USP <1058>, Data Integrity &

Paper versus Electronic Raw Data

Bob McDowall McDowall Consulting

©McDowall Consulting 2014 www.rdmcdowall.com 1

Contents


EU GMP Current Status


http://ec.europa.eu/health/documents/eudralex/vol-4/index_en.htm

Laboratory Regulatory Updates • Impact of ICH Q10:

Pharmaceutical Quality Systems – EU GMP Chapter 1: PQS,

effective Jan 2013 – ISO 9000 QMS: move

from reactive to proactive active approach

– Senior management responsible for QMS & GMP

– Continual improvement

• Outsourcing: CMOs and contract labs: – EU GMP Chapter 7 on

Outsourcing, effective Jan 2013

– Draft FDA guidance on Quality Agreements, May 2013 – specific discussion on contract labs

– See Focus on Quality September 2013


EU GMP Annex 15: Qualification & Validation

• Draft Annex 15 released for discussion February 2014

• Main topics: – Validation Master Plan – Equipment Qualification – Process Validation


Welcome to the 21st Century!

• EU GMP non - compliance reports are now available on-line: – Summary reports from all European

regulatory agencies – http://eudragmdp.ema.europa.eu/inspections/

gmpc/searchGMPNonCompliance.do


http://eudragmdp.ema.europa.eu/inspections/gmpc/searchGMPNonCompliance.do

http://eudragmdp.ema.europa.eu/inspections/gmpc/searchGMPNonCompliance.do

Contents


Regulatory Update for Laboratories

• Data integrity inspection issues – CPG 7346.832 Pre-approval inspections –

effective May 2012 – FDA Inspector data integrity training 2011 – 2012 – MHRA expectation for internal audits Dec 2013



CPG Objective 3: Data Integrity Audit

• Audit the raw data, hardcopy or electronic, to authenticate the data submitted in the CMC section of the application. Verify that all relevant data (e.g., stability, biobatch data) were submitted in the CMC section such that CDER product reviewers can rely on the submitted data as complete and accurate. – Generally, data on finished product stability,

dissolution, content uniformity, and API impurity are good candidates for this audit (page 20 of 35)


Inspector Training in Data Integrity

• FDA are training their inspectors to investigate data integrity: – Compare raw data, hardcopy or electronic, such as

chromatograms, spectrograms, laboratory analyst notebooks, and additional information from the laboratory with summary data filed in the CMC section.

– Raw data files should support a conclusion that the data/information in the application is complete….

– Lack of contextual integrity include the failure by the applicant to scientifically justify non-submission of relevant data, such as aberrant test results or absences in a submitted chromatographic sequence

– See Paul’s WL presentation for the impact of this approach

MHRA Expectation Regarding Self Inspection & Data Integrity

• The MHRA is setting an expectation that pharmaceutical manufacturers, importers and contract laboratories, as part of their self-inspection programme must review the effectiveness of their governance systems to ensure data integrity and traceability.

• This aspect will be covered during inspections from the start of 2014, when reviewing the adequacy of self inspection programmes in accordance with Chapter 9 of EU GMP.

• It is also expected that in addition to having their own governance systems, companies outsourcing activities should verify the adequacy of comparable systems at the contract acceptor.

• The MHRA invites companies that identify data integrity issues to contact: [email protected]

• 16 December 2013

• Unknown – the situation in other EU inspectorates


mailto:[email protected]

Contents


USP Method Validation

• United States Pharmacopoeia (USP) – Revision of general chapters 2010-2015 cycle – Method development and validation and

impact on ICH Q2(R1) <1224>, <1225> and <1226>


Method Development, Validation & Transfer

• USP three general chapters: – <1224>: Analytical

Method Verification validation

– <1225> Analytical Method Validation

– <1226> Method transfer • ICH Q2 (R1) outdated

and incomplete

• Stimulus to review process published Pharm Forum, Sep 2013 – Impact of ICH Q10 and ICH

Q9: quality by design • Replacement by:

– <220>: Basic requirements for validation

– <1220>: Lifecycle Management of Analytical Procedures


USP Method Validation Now


QbD: Life Cycle of Analytical Procedures


Lifecycle Management of Analytical Procedures: Method Development, Procedure Performance Qualification, and Procedure Performance Verification USP Expert Panel for Validation and Verification Stimulus to the Revision Process, Martin et al, Pharmacopoeial Forum, Sept-Oct 2013

Proposed USP Changes • Stage 1: Method design development and

understanding – Analytical Target Profile (ATP) – defines need – Identify analytical variables and design space – Experimentation and refining design space – Robustness studies – Analytical procedure – Input of changes for redevelopment or revalidation


Proposed USP Changes • Stage 2: Procedure Performance Qualification

(PPQ) – PPQ Protocol – Experiments to verify fitness for purpose – PPQ Report – Local Analytical Control Strategy including formal

procedure


Proposed USP Changes • Stage 3: Procedure Performance Verification

(PPV) – Routine monitoring of procedure – Changes within procedure design space made

and documented – Issues that arise: trigger for investigation – Risk assessment: continual improvement &

unacceptable common cause variation – input to redevelop or revalidate procedure


FDA Release Draft Guidance: Feb 2014 • Analytical procedures and methods validation

for drugs and biologics – Replaces existing draft guidance from 2000 – Poor coverage of method development vs USP

No consideration of design space – Focus on method validation

Parameters to validate (in previous draft guidance) – Life cycle management of analytical procedures

Does not consider method development – Statistical analysis and models for validation data

Not covered in USP stimulus paper ©McDowall Consulting 2014 www.rdmcdowall.com 20

Contents


Lab Qualification & Validation

The System • Software

– Cannot validate the application without the instrument

– Software qualified by supplier – Validation of software awaits

specialists

• Instrument – Cannot qualify the instrument

without the application – Qualify the instrument – Wait until software validated

before using system


Integrated Analytical Instrument Qualification and Computerised System Validation is Essential to Avoid Duplication of Effort

Lab Qualification & Validation

The System • Software

– GAMP focusses on software – Does not consider instrument

• Instrument – USP<1058> AIQ – risk based

instrument qualification: Groups A, B and C

– Naïve software validation approach


Integrated Analytical Instrument Qualification and Computerised System Validation is Essential to Avoid Duplication of Effort

GAMP GPG Validation of Laboratory Computerised Systems

• First Edition, 2005 – Based on GAMP 4 but diverged substantially – Simplified life cycle – good – Validates everything – ignores qualification – Lab specific classification – separate from the

rest of the organisation – Over complex and confusing risk assessment



<Software Validation: Group B Firmware • Firmware for basic instrument operation in <1058>

– Test implicitly as part of AIQ – Pragmatic approach and consistent with GAMP 1-4 (not 5)

• Firmware with calculations - omitted from <1058> – Check calculations where used e.g. content uniformity with

balance to comply with GMP §211.68(b) • Firmware that can be parameterised / programmed –

omitted from <1058> – Typically done after OQ of instrument – YOU need to define and test the parameters as part of OQ – Programs / routines need to be defined, controlled,

documented and tested by YOU.


Group C: Failure to Validate Software Adequately

• Separate PC with software to operate the instrument and acquire, process and report data – Data system needs to be validated at the same time the

instrument is qualified – Terminology between AIQ and computerised system

validation (CSV) is different • <1058> approach to software validation is naïve:

– Relies on the vendor to do all the validation work – BUT the system owner is responsible


General Principles of Software Validation

• FDA Guidance for Industry from 2002 – Guidance does not use 4Qs model – Written by CDRH for medical devices where

software is used “as is” and not changed – Does not cover configuration of software

(GAMP software category 4) – Does not cover customisation of software

(GAMP software category 5)


<1058> Software Validation • <1058> is deficient for CSV: too simplistic and naïve

– Manufacturer validates the software and provide users with a summary of validation

– User site: holistic qualification of the system implicitly tests the software

– OK for very simple systems – BUT deficient for complex ones as it omits:

Configuration of security and access control Configuration of software to change the operation of the system 21 CFR 11 functions Custom reports Macros written by the users

GAMP 5:

• Flexible approach to computerised system validation – Focus on software only – equipment ignored – Not one size fits all as for GAMP 1 – 4 – Different life cycle models for different

software categories – Risk management – Demise of Category 2 software – see later


GAMP GPG for Lab Computerised Systems

• Second Edition, 2012 – Aligned with GAMP 5 – risk based approach – Alignment to USP <1058> as much as possible

GAMP SIG collaboration with Burgess and McDowall

– Focus on mostly on software • Harmonisation paper from SIG core group

mapping GAMP and <1058> published – Pharmaceutical Engineering January 2014


USP <1058> Timeline


USP <1058> Revision Process

• Jan 2012: PF Stimulus to Revision Process – An Integrated and Harmonised Approach to

Analytical Instrument Qualification (AIQ) and Computerised System Validation (CSV) – A Proposal for an Extension of USP <1058>

– C Burgess and R D McDowall



<1058> Analytical Instruments and Systems: Software Options

• Majority of instruments and systems (groups B & C) use software

• Software options: – Firmware for basic instrument operation (B) – Firmware for operation plus calculations (B) – Firmware that is user programmable (B) – Data systems built into the instrument (B > C) – Separate PC with software to operate the instrument and

acquire and process data and report results (C)

It’s Just a Pipette?

Enhance your VIAFLO pipetting experience with exciting features: • Manage your pipettes in the lab • Maintain a service history of your pipettes • Create complex custom programs in no time • Save and share custom programs in the program library • Personalize your VIAFLO pipettes with start up screens • Upgrade the pipette's firmware to enjoy more features Risk assessment essential


Proposed Data Quality Triangle


USP <1058> Risk Classification • Group A: Apparatus • Group B: Instruments

– Type 1: Firmware – Type 2: Firmware plus built in calculations – Type 3: Firmware plus user defined programs

• Group C: Systems – Type 1 – Low complexity system - instrument plus non-configured

software – Type 2: Medium complexity system - instrument plus configured

software – Type 3: High complexity system - Instrument plus configured

software & macros


<1058> Risk Assessment


<1058> risk assessment Burgess and McDowall Detailed paper published with additions Spectroscopy Nov 2013

Mapping USP <1058> v GAMP


Contents


Contents


FDA Focus on Data Integrity

• CPG 7346.832: laboratory data audit focusses on laboratory data integrity

• FDA inspectors have received data integrity training

• Increased number of warning letters with data integrity and lack of “complete data”

• “Complete data” is a facet of data integrity


GAMP Data Integrity SIG • SIG Established late

2013 • Leaders: Mike

Rutherford, Lorrie Schuessler, Mark Newton, Christopher White & Nigel Price

• Kick off TC meeting in Jan 2014: >70 people attended

• Next meeting due in April

• Questions: • What do you want? • What would help you?


Laboratory “Complete Data”

• 21 CFR 194 (a) – Laboratory control records should include complete data

derived from all tests conducted to ensure compliance with established specifications and standard, including examinations and assays, as follows…

• Definitions: – complete: having every necessary part or entire – data: a series of observations, measurements, or facts. – I.e. Data integrity!


Criteria for Data Integrity: Applies to Paper, Hybrid & eRecords

• Attributable • Legible • Contemporaneous • Original • Accurate • Complete • Consistent • Enduring • Available

• ALCOA is FDA’s interpretation of data integrity

• Remaining criteria from the EMA concept paper on GCP electronic source data 2007 or ALCOA+



Criteria for Data Integrity Attributable

Who acquired the data or performed an action and when?

Legible

Can you read the data and any laboratory notebook entries?

Contemporaneous

Documented at the time of the activity

Original

Written printout or observation or a certified copy thereof

Accurate

No errors or editing without documented amendments

Complete

All data including any repeat or reanalysis performed on the sample

Consistent

All records of the analysis are date and time stamped in the expected sequence

Enduring

Recorded on controlled sheets, laboratory notebooks or electronic media

Available

Accessed for review and audit or inspection over the lifetime of the record


Paper: Lab Notebook / Sheets

• Integrity: notebook pages numbered or controlled sheets with accountability

• Time sequence enforced by order of entries • Entries written down • Signed by analyst • Reviewed by second person (four eyes

principle) – WL RPG: Worksheets deliberately back dated

Hybrid Systems

• Paper records – Handle outputs as

discussed in previous section

• Electronic records – Handle as discussed

in the next section


BUT


Hybrid System • Paper Records

– Work recorded in laboratory notebook

– Signed paper printouts from IT system

– Identifies the user who did the analysis

– Identifies the files created – Identifies the library used

• Electronic Records – Time and date stamp

accurate – User uniquely identified – Analysis files uniquely

identified – Files backed up – Comparison with library

correct – Library maintained

correctly – Audit trail entries

RPG Life Sciences WL May 2013 • For HPLC analysis there were no raw data

related to sample weights and sample solution preparations.

• Chromatographic analysis involved the use of “trial” runs which were not used to calculate the reportable results if the results were outside of the specification.


Big problem: Record Synchronisation

• Hybrid system – synchronising electronic records and signed paper printouts – Generate e-records and interpret – Analyst prints out records and sign by tester – Supervisor reviews data and requires changes – Analyst reinterprets, reprints and signs – Supervisor agrees and signs print outs – Batch released and both sets of records

archived – Complaint results in checking original data –

reinterpretation and reprinting

• Hybrid is the default option in most labs …….

Original Printout

Updated Printout 1

Updated Printout 2



Electronic System e.g. CDS

• Validated system: workflow and calculations • Users uniquely identified with appropriate

access privileges • File creation and management via CDS • Signed electronic report and records • Minimal paper printouts (e-signed report) • Audit trail entries reviewed • Time and date stamp accurate

USV Warning Letter – Feb 2014



EU GMP Chapter 4: Records • Provide evidence of various actions taken to

demonstrate compliance with instructions, e.g. activities, events, investigations, and in the case of manufactured batches a history of each batch of product, including its distribution.

• Records include the raw data which is used to generate other records.

• For electronic records regulated users should define which data are to be used as raw data.

• At least, all data on which quality decisions are based should be defined as raw data


Generation and Control of Documents • 4.1 All types of document should be defined and

adhered to. – The requirements apply equally to all forms of document

media types. – Complex systems need to be understood, well documented,

validated, and adequate controls should be in place. – Many documents (instructions and/or records) may exist

in hybrid forms, i.e. some elements as electronic and others as paper based.

– ….. Etc.


4.1 Further Discussion

• Many documents (instructions and/or records) may exist in hybrid forms, i.e. some elements as electronic and others as paper based. – All records covered: paper, electronic and hybrid – Define relationships between records – Define control mechanisms for records – Define the means to ensure data integrity – Equivalent to Part 11


Impact of Chapter 4

• Must define raw data: – However “electronic records” are not defined by

chapter 4 in any detail – unlike Part 11 – Must include e-records that produce the paper if a

heterogeneous system is used


FDA Question and Answer 2010

• Questions and Answers on Current Good Manufacturing Practices, Good Guidance Practices, Level 2 Guidance - Records and Reports – 3. How do the Part 11 regulations and "predicate rule

requirements" (in 21 CFR Part 211) apply to the electronic records created by computerized laboratory systems and the associated printed chromatograms that are used in drug manufacturing and testing?

– FDA thinks industry is misinterpreting Part 11


FDA Q&A • 21 CFR 211.180(d) requires records to be retained

– “either as original records or true copies such as photocopies, microfilm, microfiche, or other accurate reproductions of the original records.”

• 21 CFR 211.68 further states that: – “Hard copy or alternative systems, such as duplicates,

tapes, or microfilm, designed to assure that backup data are exact and complete and that it is secure from alteration, inadvertent erasures, or loss shall be maintained”


FDA Q&A: BUT…… • The printed paper copy of the chromatogram would not be

considered a “true copy” of the entire electronic raw data used to create that chromatogram, as required by 21 CFR 211.180(d).

• The printed chromatogram would also not be considered an “exact and complete” copy of the electronic raw data used to create the chromatogram, as required by 21 CFR 211.68.

• The chromatogram does not generally include, for example, the injection sequence, instrument method, integration method, or the audit trail, of which all were used to create the chromatogram or are associated with its validity.


Dead as a Dodo: Paper Records are My Raw Data

• Regardless of how a laboratory system is used it will generate electronic records – System falls under 21

CFR 11 and Chapter 4 • Discussion now moves: is

the system hybrid or electronic?

Contents
