Management Responsibility for GMP Oversight and Control: A Review of Requirements

Supreme Court Cases

Historically, the FDA has cited the Supreme Court decisions of  United States v. Dotterweich (1943) and United States v. Park (1975) as FDCA legal cases that establish that the manager of a corporation can be prosecuted under the Federal FDCA, even if there is no affirmation of wrong-doing of the corporation manager individually.

In the Dotterweich case, the jury found Dotterweich, the president and general manager of a drug repackaging company, guilty on two counts for shipping misbranded drugs in interstate commerce, and a third for shipping an adulterated drug. One dissenting judge of the Circuit Court of Appeals reversed the decision on the grounds that only the corporation was the “person” subject to prosecution, thus protecting the president personally. But the Supreme Court reversed the decision thus holding Dotterweich individually responsible, not just the manufacturer. Justice Frankfurter delivered the opinion of the Court, “... under § 301 a corporation may commit an offense and all persons who aid and abet its commission are equally guilty….”

In the Park case, the chief executive officer was found guilty on all counts involving food held in a building accessible to rodents and being exposed to contamination by rodents, resulting in the adulteration of the food within the meaning of the Federal Food, Drug, and Cosmetic Act (FDCA). Park’s defense was that he had an organizational structure responsible for certain functions to handle such matters. However, evidence from inspections of multiple locations indicated the same problems and inadequate system for which he had overall responsibility. Chief Justice Burger delivered the opinion of the Court, “... by reason of his position in the corporation, responsibility and authority either to prevent in the first instance, or promptly to correct, the violation complained of, and that he failed to do so... the imposition of this duty, and the scope of the duty, provide the measure of culpability...”

FDASIA

More recently, Public Law 112-144 (July 9, 2012) called the Food and Drug Administration Safety and Innovation Act (FDASIA) added to the definition of CGMP in the Food and Drug Cosmetic Act (Section 501, 21 U.S.C. 351) to explicitly include management oversight of manufacturing to ensure quality. Section 711 of FDASIA states:

• For the purpose of paragraph (a)(2)(B), the term “current good manufacturing practice” includes the implementation of oversight and controls over the manufacturing of drugs to ensure quality, including managing the risk of and establishing the safety of raw materials, materials used in the manufacturing of drugs, and finished drug products.

The addition of oversight and controls to the definition of CGMP has strengthened the FDA position with specific language for management’s responsibility for oversight and control as a requirement in the Act. The question remains how to practically and operationally to perform this responsibility. The following model describes essential elements of a CGMP Management System for oversight and control.

Management System 

The implication of the impact of CGMP noncompliance on the business is not theoretical. There are ample examples in the pharmaceutical industry where ineffective implementation of CGMP systems resulted in the loss of control that materially affected product quality, which, in turn, affected inventory and patient supply. Establishing a Pharmaceutical Quality System (PQS) that effectively implements the CGMPs is the means for maintaining a state of control—the fundamental intent of these regulations.

Management does not assume positions of responsibility with the intent of neglecting CGMP compliance. However, management may not enter the top position fully equipped to assume responsibility for CGMPs in a practical way. Management may delegate all CGMP matters to the Quality Department and take a hands-off approach and rely on this function to bring matters to its attention at their discretion. Such passivity leads to hearing only the bad news when it is far too late to contain and resolve the problem in the most cost-effective way with least risk to public safety.

Likewise, some Quality Departments may not be adequately equipped to bridge the space between top management and daily operations with effective structures and processes that enable management to exercise its responsibility for CGMP oversight. Too often the default position is to rely upon the outcome of regulatory inspections. But as one might expect, a good outcome can give a false sense of security, and a poor outcome can be viewed as the exhaustive list of problems. As in any area of the business where risks must be managed, there is no better approach than having an intentional management system in place that provides actionable data to know internally where your daily operation stands at any given moment.

Assess, Improve, and Implement--and Perform

For nearly 20 years, John Snyder and Company has served the pharma industry to assess, improve, and implement the Pharmaceutical Quality System (PQS). Our Management Triad Model will help you to assess and develop the crucial structures, systems, and processes for Management Oversight and Control for monitoring your state-of-control and to become an anticipating organization.

Please contact me at john@john-snyder.com. I want to partner with you.

The QA Pharm

12 Ways to Improve Procedures

At the risk of sounding like a pharmaceutical quality assurance heretic, standard operating procedures (SOPs) often do not work as intended. In fact, they can do more harm than good by giving a false sense of security: "We must be okay; we have procedures for that."

Having procedures is certainly important. FDA cites the absence or inadequacy of procedures as  a compliance problem. Industry spends a lot of money on staff and infrastructure to put procedures in place. And ironically, more money is spent on validating a document management system than ensuring the SOPs that flow through the system are effective.

Procedures are often more form than function. Words on a page do not necessarily make things happen as intended. I have observed the general neglect of procedures for many years and have concluded that there are common reasons why procedures don't work.

Let me turn the problems around and list these 12 ways to improve the effectiveness of procedures:

1. State the purpose of procedures.

Without a clear understanding of why we place such a high value on procedures in our industry, we can easily end up with a random collection of documents that vary in quality and content as much as the differences among authors who create them.

The purpose of procedures is to declare how the firm will operate in compliance with applicable laws and regulations, as well as how the business chooses to operate within its own norms. This purpose acknowledges that ad libbing is not acceptable in the pharmaceutical manufacturing industry. Thus, the second purpose is to control the human variable and ensure operational consistency.

With these purposes in mind, the author of a procedure takes on a significant responsibility to apply the regulations to the business, as well as understand the operation where procedures are used.

2. Make process flow the backbone of procedures.

Since procedures declare "how" an activity is intentionally performed, then they should read in a logical, straightforward manner that is followable. Nothing is more frustrating than being accountable for performing an activity in a compliant manner with SOP that are disjointed and nearly impossible to tell who does what, when, where and how. If we want people to follow procedures, then we need to write procedures that people can follow.

A good practice is to start with a process flow diagram that depicts a technically correct (compliant), and operationally efficient sequence of activities. The traditional SIPOC flow diagram is in everyone's toolbox, and this is also an effective tool for writing procedures. Process flow diagrams help to develop a common understanding of the process, and it establishes the sequential steps needed to write an orderly procedure. If you can't make a process flow diagram, then you probably do not know the process well enough to write a procedure.

A procedure that is based on a good process flow diagram practically writes itself, because a procedure is the text that surrounds a process flow.

3. Seek input from the procedure users.

A process flow diagram is only as useful as the informed input that goes into writing it. Certainly this means including functional experts with technical and compliance knowledge. But active engagement by the users is essential. Review and approval of procedures by users' management is no substitute for thorough participation by actual procedure users.

Users know the obstacles and inefficiencies to the existing processes and are eager to remove the pain from their daily lives. The depth of knowledge, experience, and willingness of users to participate should not be underestimated. They will be the first to identify better ways of working that will promote compliance to procedures and efficiency.

It is a double bind to insist on strict compliance with procedures but not to create procedures that reflect the realities of the user. Ineffective procedures written in a vacuum invite work-arounds, which might--in the end--have been the more efficient process.

4. Promote clear writing of procedures.

Procedures should be straightforward and easy to follow. If you have ever assembled a do-it-yourself piece of furniture, you know how important clear instructions are. Too often procedures lack detail to perform an activity consistently, or the detail is scattered throughout the procedure.

There is a difference between clear writing and technical writing. Improving procedures is more often a communication problem, not a technical problem. We need to recognize that writing instructions for another person to follow is a high-level skill, and not everyone is qualified. We make the mistake of assuming that anyone is capable of authoring a set of instructions if they are the subject-matter expert.

Identify your clearest writers. Have them edit procedures for clarity, not just technical content. It should not be too much to ask for procedures to have clear and logical steps to follow.

5. Establish a style guide for authors of procedures.

Editorial style is a distinctive manner that makes a set of procedures belong together. Style is notably missing when procedures are significantly different and disorderly. One author may improperly write user process instruction in the responsibilities section; another author may carelessly refer to a form or other procedure that does not exist; another author might redundantly give the title "Procedure for..." when it is obvious that you are holding a procedure.

A style guide is useful for authors. A style guide not only standardizes the content of procedures, but it helps a procedure to make sense from a reader's perspective. Much like Instructions for Authors in a professional journal, a style guide helps procedures to be a document type that belongs together and has a common purpose.

Setting style expectations helps authors to write effectively and gives a body of procedures the level of professionalism that reflects the significance of the work being performed. It also shows respect for the user.

6. Ensure procedures are part of a document architecture.

Architecture is the overall organization and relationship of all pharmaceutical document types. But there is also architecture for procedures as a specific document type. The randomness of the table of contents for standard operating procedures often reveals lack of architecture. This is usually a symptom of an unstructured pharmaceutical quality management system.

The architecture of procedures typically reflects elements of a pharmaceutical quality management system such as Product Development, Manufacturing Controls, Engineering and Maintenance, Laboratory Operation--sub-groups of the pharmaceutical quality management system with related procedures that belong together.

Establishing an architecture for procedures elevates procedures to that of a pharmaceutical library that contains a wealth of operational knowledge and the best, compliant practices. Like any library, you know how its organized and where to go for the information you need.

7. Link processes between procedures.

Procedures connect to one another because inputs may come from one process, and the output may be received by another process. The linkage between these off-page connectors must be present and adequate for processes to be fluid across procedures. Short circuits are created when there is a reference to a process outside the scope of a procedure, but a procedure for that off-page process does not exist, or it is an informal practice.

When new procedures are created, or existing procedures changed or deleted, the effect on all other procedures within the pharmaceutical quality management system must be assessed. Maintaining working interrelationships between procedures is a challenge, but essential. Whether making seemingly innocuous editorial changes to undertaking a major quality system improvement initiative, the impact on other procedures must be addressed.

The pharmaceutical quality management system is like an ecosystem. Rarely can a change be made that does not have an impact somewhere else. Effective procedures not only make reference to other procedures where essential linkages exit, but the processes are also seamlessly stitched together.

8. Exercise control over procedures.

Procedural control takes many forms. The most obvious is a mechanism to ensure that only approved and effective procedures are accessible. Less obvious is understanding when historical revisions were in effect and what significant changes were made. Also, with various practices for procedure lifecycle milestones such as approval date, training date, mastered date, issue date, and effective date, the most important dates can be lost: When was the procedure approved by QA? When was the procedure made effective?

An unintended consequence of control is having a document management system that is bureaucratic and cumbersome. When the view is taken that manufacturing operations is central to the organizational purpose, then it is incumbent upon a service organization to provide an appropriate service level. Likewise, an understanding and elimination of the root cause for excessive changes is just as important to help to reduce the volatility of the pharmaceutical quality management system.

There is a balance between central control and responsiveness to the needs of the operation. The most effective companies find the sweet spot while providing the value add of maintaining the integrity of procedures, document architecture, and the pharmaceutical quality management system as a whole.

9. Identify procedure (system) owners and ownership behaviors.

Having an owner for set of procedures related to a given quality system is essential for accountability. That accountability includes being the most knowledgeable person internally about the system, the most informed person with respect to industry practice and regulatory enforcement trends, the point person for reporting the health of the system, and the one who ensures the system is continually effective for a dynamic business environment.

But ownership of procedures is often like a game of hot potato: you don't want to be caught holding it. But lack of ownership opens the door for anyone and any opinion to infiltrate procedures. The most problematic procedures are the result of lack of ownership and investment in the owners to become industry experts in the CGMP requirements and application of the requirements to the dynamic business. Identifying owners also establishes a network across business units for best practices and harmonization.

Selection of system (family of procedures) ownership should be thoughtfully made with the owner being the most responsible manager closest to the use of the system in daily operations. While there are high expectations for the owner, there should also be high rewards and priority given to invest in their training to keep current in CGMPs and industry practices.

10. Demonstrate respect for procedures.

Behaviors of immediate supervisors and top management define the boundaries of allowable practices. If procedures are just considered guidelines that are selectively followed, then there is no expectation for defined ways of working with predictable outcomes. When there is a disregard for procedures, there may be a company culture problem, or there may actually be problems with procedures. It's okay to say, "I can't follow this procedure, but I know how to make it better."

Procedures are made for man, not man for procedures. When procedures are well written and effective, there is comfort in knowing variation is controlled and the outcome is predictable. Supervisors must model respect for procedures not only by following them and expecting others to follow them, but to be actively engaged to ensure that procedures are as best they can be for their operation. No one should be the victim of poorly written procedures.

Nothing will sabotage regulatory compliance or quality system improvement more quickly and lastingly than lack of respect for procedures.

11. Train on procedures.

We say that we provide training on procedures. But do we really teach the purpose and importance of procedures, how they fit into the architecture, or how a given procedure contributes to the state of control and value to the patients we serve? Unfortunately, the common default is Read and Understand, check the box and then go on to the daily work.

The training effort is magnified for companies that undergo a lot of change either through voluntary quality system improvement, or involuntary regulatory enforcement action. There can be a false sense of security when the training statistics are published and high training percentages achieved. The reality is that such statistics are not a measure of learning. And when a nonconformance is detected, or a procedure is not followed, we compound the problem by requiring retraining as the corrective action.

Procedures are the primary content for training, and not all content is best learned by a Read and Understand approach. The training system should establish a gradient of training approaches that takes into account the subject matter along with a learning assessment.

12. Manage the change.

The field of Change Management has entered the CGMP compliance world. During my forty years helping companies to establish and improve pharmaceutical quality management systems, I have come to understand that CGMP compliance remediation and improvement is just as much about company transformation as it is system design and procedures.

Procedures are words on a page. They can be the best and clearest words on a page. They can even be the most respected words on a page. In the end, they are just words on a page, and words on a page do not necessarily make anything happen. Sometimes procedures and changes to procedures are difficult to embrace with the best of intentions. Some changes may be simply editorial, but there are some changes may go entirely against the way things were done before. Thus the behavioral sciences enter the technical world of pharmaceutics and CGMP.

Done thoughtfully with facilitation by change management professionals with experience in pharmaceutical manufacturing and CGMPs, change can be embraced and results sustained.

What are your experiences and recommendation?

Please share your thoughts with The QA Pharm community. Your participation is valued and appreciated.


The QA Pharm

4 Reasons Companies Come Under a Consent Decree

When you peel back the layers of causes leading to serious FDA enforcement action, it comes down to a handful of fundamental reasons.

1. Management does not know what is required.

Executive and senior management may not have regulatory experience. MBA programs may offer courses on Quality, but it is more about the popular concepts of Lean Manufacturing, not the Food and Drug Cosmetic Act or the Code of Federal Regulations and CGMPs. Some may go as far as to think that if you are doing Six Sigma, you have a quality program. If you have a quality program, you have the FDA base covered. There is a mental disconnect with CGMPs as legal requirements. It just so happens that CGMPs are also a business enabler that drives reliable processes, product quality, and uninterrupted patient supply. And management must acknowledge and embrace these legal requirements just as much as it does SEC, EPA, EEOC, and other business laws.

2. The Quality Unit lacks the capability to detect problems and report to management.

Management may have regular status updates on how well the market is responding in Europe to a new product launch, or how the new ad campaign is affecting the Southeast Sales Region. But management often flies blind when it comes to knowing at any moment whether the operation is in a state-of-control. That knowledge is thought to come with regulatory inspections. You deal with the FDA483 when it comes, and that buys you time until the next inspection. The Quality unit often buys-in to this reactive mode of problem detection since this is when resources are most likely to be justified. The Quality Unit must develop the systems and the capability to detect unacceptable trends and be empowered to report problems directly to management. Such a mindset is essential to move from a reactive to an anticipating organizational culture.

3. The organization cannot plan and execute permanent solutions.

It’s one thing to know about a problem and something entirely different to do something about it. The best position to be in prior to a regulatory inspection is to be able to say, “There’s nothing you will find that we don’t already know about. Not only do we have a plan to address these problem, but also our plan is on schedule.” But all too often projects to prevent failure move to the bottom of the priority list for resources. If they do get funded, the projects are not directed toward a permanent solution, or managed to a verifiable conclusion. Not only must compliance projects must be resourced and managed, they also require oversight and governance to ensure that the projects are supported and completed on time.

4. Lack of integrity.

Then we have the phenomenon of doing whatever it takes for self-preservation over the health and welfare of the patients we serve. No degree of knowledge of the requirements or the presence of highly effective detection and escalation systems can prevent dishonest individuals from violating public trust. What we can do is have a zero-tolerance Integrity Policy that is part of every employee’s training curriculum, and to make it safe for someone to voice his or her concern should they witness a violation. In addition, training on Good Documentation practices will help to standardize record entries and how to document correction of errors. This will counter the perception of fraud for honest mistakes. The dishonest ones—well, that’s another matter.

Opinion Survey:  Reasons Companies Come Under Consent Decrees

When the FDA starts moving against your company is not the time for introspection. Take this quick survey and use the results in an internally facilitated discussion. Now is the best time.

How would you rate your company? What are the implications for your collective results? Most of all—take action.

5 = Strongly Agree

4 = Agree

3 = Not sure

2 = Disagree

1 = Strongly Disagree

_____ a. Our management demonstrates visible support for CGMP projects to ensure our compliance position is strong.

_____ b. Our Quality Unit has robust processes that provide management the means to know the state-of-control and to take decisive action.

_____ c. We have a good history of directing teams toward potential compliance problems and finishing on time.

_____ d. We have an Integrity Policy and everyone knows how to confidentially report a potential violation.

The QA Pharm

6 Methods for CAPA Effectiveness Verification

Verifying the effectiveness of corrective and preventive actions closes the loop between identifying a problem and completing the actions to solve a problem. It seems reasonable to expect that if a problem is worth solving, it is also worth verifying that the problem is actually solved. But, determining the best verification approach and deciding when to conduct the verification for the wide range of problems that could occur can be elusive.

Before we discuss CAPA effectiveness, we need to look at a few of the reasons why performing this check is often a challenge.

Why is it so difficult to determine an appropriate CAPA Effectiveness Verification method? Here are a few reasons:

• The problem is not well defined. Sometime breaking the mental logjam is as simple as asking "What problem were we trying to solve?" That sounds like an easy question, but when the answer is not well defined or stated simply, measuring success is not easy to grasp.

• The root cause is not determined. This is a natural consequence of the first reason. It is next to impossible to  determine the root cause for a fuzzy problem, or one that seems too complicated to explain. Those who try also get a fuzzy root cause.

• It's not really a CAPA. It is ever my experience that the CAPA system has become a quality work order system (a.k.a. dumping ground) because the common data managements systems utilized, such as Trackwise, provide project management structure and visibility. But without a stated problem or the determination of a root cause, it is not a CAPA. It's just a project.

• CAPA Effectiveness Verification is used for everything. CAPA Effectiveness Verification can be too much of a good thing when it is expected for every possible CAPA. This usually occurs from the cascading problem of a CAPA being required for every deviation, and a deviation being required for every conceivable blip. Soon you become a drowning victim of your own making.

• We overthink it. Rather than allowing reason to prevail, there are those who tend to complicate just about everything. Determining and applying the effectiveness method is no exception. Yes, we operate in a scientific environment, but not every method of verifying effectiveness has to be labor intensive. Major processes need not be applied to minor problems.

• It's considered not important. There are those who believe that living with an ongoing problem is the path of least resistance when compared to conducting the same boilerplate investigation (same problem different day) and getting on with production. Having a low tolerance for recurring problems is truly the root cause for many who are trending water in a deviation-swirling tide pool. 

Assuming that we have a real CAPA where an investigation was conducted on a well defined problem to determine the root cause and product impact, we can turn to the regulatory requirements and business obligation to evaluate how well we spent our resources to permanently eliminate the problem. This brings us to options for methods for verifying CAPA effectiveness.

What are some examples of CAPA Effectiveness Verification Methods? Here are 6 examples:

• Audit Method is used when the solution involves changes to a system where a determination is made whether changes are in-place procedurally and in-use behaviorally. An example is an audit of a new line clearance checklist to demonstrate effective implementation of the new line clearance checklist.

• Spot Check is used for random observations of performance or review of records provide immediate, but limited feedback. An example is a spot-check of batch records to ensure that the pH step was performed correctly after training on the new procedure.

• Sampling is used for observations of variables or attributes per defined sampling plan. An example of sampling is when a statistical sample is randomly drawn from lot XYZ123 post implementation of process improvement to confirm the absence of defect.

• Monitoring is used for real-time observations over a defined period. An example of monitoring is the real time observation of to verify that changes to operator owning practices were implemented.

• Trend Analysis is the retrospective review of data to verify that expected results were achieved. An example of trend analysis is the review of environmental monitoring (EM) data for the period covering the last 30 batches to show the downward trend in EM excursions due to process improvements.

• Periodic Product Review is a retrospective review at least annually of trends of multiple parameters to confirm the state of control. An example of periodic product review is the review of data after major changes were made to the facility and equipment as part of a process technology upgrade post recall.

Now that we have a real CAPA and selected a method to verify the effectiveness, we need to determine an appropriate timeframe to perform the verification. Timeframes are subjective, but there needs to be a basis for the decision. This brings us to points to consider when determining an appropriate timeframe for the CAPA Effectiveness Verification.

How do we select an appropriate CAPA Effectiveness Verification timeframe? Here are points to consider:

• Less Time. Allow relatively less time after implementing the solution when:

• Higher opportunity for occurrence / observation
• Higher probability of detection
• Engineered solution
• Fewer observations needed for high degree of confidence

• More Time. Allow relatively more time after implementing the solution when:
• Lower opportunity for occurrence/ observation
• Lower probability of detection
• Behavioral/ training solution
• More observations needed for high degree of confidence

The following are several fictitious examples of CAPAs that require an Effectiveness Verification. What CAPA Verification Effectiveness method would you recommend?
What timeframe do you recommend?

Example 1.

Problem:
There are widespread errors in selecting an appropriate effectiveness verification and timeframe in the Trackwise fields when compared to the requirement in the new procedure.
Root Cause:
There is a general lack of understanding of acceptable CAPA Effectiveness Review methods that would satisfy the procedural requirement.
CAPA:
Develop and deliver targeted training on CAPA Effectiveness Verification methods to CAPA system users who have the responsibility to make this determination.

Example 2.

Problem:
Transcription errors are being made when copying information from sample ID labels to laboratory notebooks.
Root Cause:
Labels made on the current label printer (make/ model) are frequently unreadable.
CAPA:
Replace the current label printer with one that produces legible labels.

Example 3.

Problem:
The incorrect number of microbiological plates as required by SOP XYZ123, were delivered to the lab of two separate occasions by a newly trained operator after routine sanitization of Room A.

Root Cause:
The instructions in SOP XYZ123 are more interpretive than intended, which can mislead inexperienced operators to place the correct number of plates in Room A.

CAPA:
Revise SOP XYZ123 to add the specificity required for the correct number and specific placement of micro plates in Room A.

Example 4.

Problem:
Increased bioburden levels were noted in the microfiltration process train A.

Root Cause:
The phosphate buffered saline (PBS) delivery piping system upstream of the microfilter exhibited high bioburden levels.

CAPA:
Revise the cleaning procedure to incorporate a water for injection fish to remove residual harvest material from the process piping and provide training on the flushing process.

Example 5.

Problem:
A statistically significant trend was observed in assay X results for 6 lots of the 25mg vial manufactured at site A, but not the 10mg vial manufactured at site B for the same period.

Root Cause:
There was a difference in sample preparation techniques between the two sites.

CAPA:
Revise the sample preparation of the test method for consistency between sites and provide training on revised test method.

Please share your experiences with CAPA Effectiveness Verification in the comment section below.


The QA Pharm