Part 2: Responding to FDA483 Observations and Fulfilling Commitments

Part 2: Organizing to Get the Work Done

Responding to FDA483 observations was my focus in Part 1 of this series. Responses lead to commitments, and commitments lead to changes that are intended to prevent recurrence of the underlying problem that led to the observation.

In Part 2, I share my views on getting the work done to fulfill the FDA commitments. The following have become benchmarks from those who are the best at getting the job done in a sustainable way and getting the problems behind them:

• Form teams. This might seem obvious, but forming cross functional teams representing stakeholders is often overlooked. The solution will very likely involve creating different ways of working that cross functional lines. It is a rookie mistake to think that the fix is something for the Quality Department to do on its own, or just an editorial change to a procedure. Depending on the problem, the team may need to be dedicated to allow focus, particularly if accelerated timelines are involved. Include subject-matter-experts that have the scientific, technical, and cGMP backgrounds to provide appropriate guidance.

• Use consultants judiciously. Consultants can provide valuable additional support. They should bring relevant industry experience that can help scope the project and give practical advice that keeps the project moving toward the solution. The best consultants are good listeners who can help you design the right solution that works for you. But, if the only team members that show up to meetings are the consultants, something is terribly wrong. Do not outsource your responsibility to consultants. Let them help you, but it's your company and you own the results.

• Determine the deliverables. Many teams go off the rails because they fail to determine the tangible deliverables that address the problem. You cannot grasps the degree of effort, determine the resource needs, or estimate the timeline until there is a clear vision of what "done" looks like. If you cannot describe "done," then you do not know the problem well enough.

•  Solve the problem, not just the Commitment. Make a careful assessment of what it will take to prevent recurrence of the observation, not just satisfy the specific commitment. The FDA always states in the FDA483 that the observations are just examples and are not all-inclusive. Companies are expected to determine all that is necessary to permanently resolve the problem that underlies the observation wherever it applies. Perform a root cause analysis and ensure that the solutions are operational and sustainable. That invariably involves more work that the narrow view of a specific example cited in an observation or the response given.

• Determine how you will know the problem is solved. In true fashion of a CAPA, determine how you will measure effectiveness. What will tell you that the solution worked? What will be your first sign that it did not work? Consider whether this is yet another attempt at solving the same old problem. Remember that recurring observations lead to increased levels of enforcement. Be sure you know the problem is truly solved.

• Avoid Information Technology (IT) Solutions. This may sound a bit strange, but in my personal experience, nearly every commitment made in a FDA483 response that involved an IT solution missed the commitment date by light-years. I know that it should not have to be that way. I'm just saying that in my 20 years of consulting experience, that has always been the case. Consider applying an IT solution as a later improvement, not within the commitment time line if at all possible.

• Use Project Management Principles and Tools. Quality System development work is not like a capital project where much of what is needed to estimate the time and cost is known upfront. Quality system and compliance projects are more often like exploratory surgery where a lot is learned once you open it up the patient. You may discover that multiple linking systems are affected after you start looking at the problem more deeply.  Recognize that plans will need to be adjusted along the way. Do not confuse progressive revelation with scope creep. Be adaptable. Establish plans and reports based on the work and target dates, not subjective feel-good dashboards with perpetual dates that slip. Anticipate problems with hitting the date and mitigate them before failure is a foregone conclusion. When you see that the timeline is slipping, ask for help and consider first what it will take to get back on track. Don't just keep moving the target date back as the default solution.

• Provide Infrastructure Support. Remediating compliance problems often require new ways of thinking, not just new ways of working. Compliance problems frequently go hand-in-hand with company culture problems. Progressive companies that recognize the business value of an effective Quality Management System also recognize the opportunity that regulatory inspections provide to examine its culture and values. Change management coaches can help a company adapt to the changes required to support a quality and regulatory compliance culture. Recurring compliance problems are frequently a culture problem that discounts the value of an effective Quality Management System and regulatory compliance to the business. 

• Provide Management Support. Ensure that each project team has a sponsor who is the best fit based on the functional owner of the process being remediated. Clearly identify the role of the sponsor and ensure that it includes removing obstacles such as lack of organization alignment, stalled decisions, team dysfunction, and inadequate budget. Sponsors are the champions who are willing to delve into the level of the working team to provide visible support, rather than sit on the management team and undermine their own folks at project update meetings. Being sponsors of quality system remediation projects provides a unique opportunity for function heads to understand dependent processes across functional lines.

• Establish Governance Oversight. The work associated with fulfilling commitments is tightly connected to managing risk. Thus, it is important to keep site governance councils frequently updated with progress and informed about unacceptable risks. These risks always include the risk of meeting a commitment date made to the FDA. Take commitment dates seriously. Other unacceptable conditions uncovered along the way should also be communicated to the governance body. Establish clear lines of communication and escalation between the team that actually does the work and governance. Learn how to escalate and resolve potential problems quickly. Nothing consumes the timeline as much as reluctant escalation and indecision.

• Verify that Deliverables Solve the Problem. Take an independent look to ensure the work is completed and that the tangible deliverables are in-place and in-use. This is a good role for an independent consultant. It is far better to find out for yourself that the mark was missed than for the FDA to call it to your attention as a repeated observation. Be a healthy skeptic and ask, "How do we know for sure the problem is permanently solved?"

• Revisit Commitments. Although you may have verified that the solution is in-place and in-use, revisit the problem at an appropriate time interval to ensure that the organization has not reverted to the old ways of working.

How have you managed regulatory commitments? What are your success stories? What have been epic failures, and why?

The QA Pharm

Part 1: Responding to FDA483 Observations and Fulfilling Commitments

Part 1: The FDA483 Response

In this two-part series will discuss responding to the FDA483 and getting the work done to fulfill the commitments in a sustainable way.

Unlike a Warning Letter, a response is not required--but highly advisable. It is standard industry practice to respond to FDA483 observations. Responsible companies that want to have a good relationship with the FDA respond to each observation by saying exactly how problems will be addressed.

There is plenty advice available, even from the FDA, on what constitutes a good response. For certain, the difference between a good and a poor response may differentiate how you are viewed by the FDA.

From my experience, the following are points to consider that have worked well when forming a response:

• Do you agree with the response? Stating up front that you either agree or disagree, in part or on the whole, stages the rest of the response. Think twice before you say you completely disagree especially with everything-- because the FDA will always have the regulations, industry good practice, and the facts on their side. But it is quite possible that the FDA investigator got the facts wrong or drew the wrong conclusion. This is why a close-out meeting with investigators at the conclusion of the inspection is important. It is better to straighten out the record at the close-out meeting than in the FDA483 response.

• Defend what you are doing right. The examples of violations cited in observation are just a snapshot in time. Although you may not be proud of what was found, the finding may not be representative of the current state of control. The example may pre-date significant improvements that you have made on your own initiative, although they may be in progress and not fully implemented. Be sure to give yourself credit for such improvements. The last thing you want to do is give the impression that the FDA was the first to call a problem to your attention.

• Take product lot numbers seriously. When the FDA mentions specific lot numbers associated with a problem, it immediately puts you in the position of having to defend why those lots are still on the market, and why you have not shut down manufacturing associated with that product, process, or facility. Put your best minds and writers to work to lay out the defense of your release decision and the state of control. Be objective and use data. If you come to the conclusion, albeit late in the game, that the product should be recalled, seriously consider the right thing to do. Also take into account causing a critical drug shortage, because the FDA will work with you to avoid a shortage while you resolve inspection-related problems.

• Defend State of Control. Some types of observations paint a picture of being out of control, particularly when it is associated with validation, sterility assurance, potency, content uniformity--you know--the SISPQ issues. Also, taken collectively, observations that run the gamut of the quality system can indicate a precarious state of control. Take your best, realistic, honest shot at how you know you are manufacturing and distributing a safe, quality product. And, for goodness sake, do not--I repeat--do not anchor your defense that there have been no complaints or dead bodies in the street. Meeting all end product specifications may be the best defense you have if statistically treated, but be aware that a "final product spec" defense will always peg you as a 1970s time traveler.

• Commit to Action. Address the specific issues that were called to your attention, but do not stop there. Carefully determine the root causes of the issues cited in the observations. There will not always be a one-to-one relationship of root cause to observation. Nonetheless, run the problem to ground and understand what is behind the problem. Determine the action required to prevent the reoccurrence of the problem cited. Undoubtedly, the solution will require changes in multiple areas at the system level. Be sure to convey that you are taking system-level action, not just addressing the superficial, specific examples. Remember, observations are just examples. Indicate the action you promise to take and target completion date. Be clear in advance what "done" looks like and the specific deliverables that will provide the evidence of successful completion.

• Commit to Developing Appropriate Action. If you do not know exactly what all is necessary to fix the problem, it is completely acceptable to indicate that the scope of activities and target dates will be established in a plan to be provided later. But state in the response when the plan will be completed and provided. Major milestones and target month are usually acceptable in a follow-up communication.

• Recognize the Minimalism. Very likely you have taken a minimum essential approach to the commitment. By the time all the internal reviewers have edited the response, you have pared down the work to something manageable for normal business. However, the work associated with FDA inspection observations is not normal business. The scope of the actual work required to prevent recurrence of the observation may be more than expected when you actually delve into the root cause and prevent recurrence through systemic changes. 

• Provide Realistic Target Dates. There is always a balance between showing responsiveness with aggressive target dates and over committing to unrealistic dates. When dealing with operational and quality system problems, there may be more work involved than meets the eye. Some problems may require engineering studies or process development in order to understand the right approach to take when solving a problem. Take time to really think through all that is involved in order to provide realistic target dates. You don't want to go back to the FDA--at least not too often--to revise target dates. Do inform the FDA of changes in completion dates. Don't let a broken promise be a surprise when they return to reinspect. It's far better to inform them in advance.

• Engage Your Internal Associates. I cannot tell you how often I discover the situation where commitments and target dates were given to the FDA in very well written responses, but those who carry out the work were not involved--even totally clueless. It's best to involve those who have to fulfill the commitments in the actual writing of the response. Time is of the essence when preparing a response, but cutting out those who actually do the work will always uncover significant execution issues at the worse possible time.

• Take FDA Suggestions. When the FDA makes a suggestion about retaining a GMP consultant to assess your overall quality system and help you to improve--take the suggestion. This recommendation usually comes in Warning Letters where the FDA has come to the conclusion from the breadth of problems and recurring problems that there is no confidence in your Quality Unit or Management Oversight. Consider such a recommendation as a direct hit and taking on water, not just a shot across the bow. So be responsive and act accordingly.

What is your experience with preparing regulatory observation responses? What has worked well? What has not worked well?

In Part 2 I will talk about organizing to get the work done to fulfill commitments.

The QA Pharm

The Top Ten Warning Letter Observations about the Pharmaceutical Quality Unit

The responsibilities of the Pharmaceutical Quality Unit are defined in the CGMPs and practices clarified in guidance documents. (See The QA Pharm, August 7, 2011.)

Just as it is with any legal matter, case histories help us understand how the law is applied in specific situations. That’s the reason it is a good practice to regularly review Warning Letters on the FDA website.

Here’s my condensed list of issues the FDA has had with the Quality Unit as seen in Warning letter observations.

This is the list you don’t want to be on.

1.    QU failed to establish a system to ensure that…[fill in the blank for anything that went wrong]

2.    QU failed to document the responsibilities applicable to the quality control unit in procedures, and fully perform these responsibilities.

3.    The personnel performing laboratory tests… were not trained.

4.    QU failed to approve or reject all components, drug product containers, closures, in-process materials, packaging material, labeling, and drug products.

5.    QU failed to fully perform and/or document the review of batch production records to determine compliance with all established, approved written procedures before a batch is released or distributed.

6.    QU failed to ensure that all tests are in conformance with the established specifications and that these are met prior to the release of drug products for distribution.

7.    QU did not review production records to assure that no errors had occurred or, if errors had occurred, that they had been fully investigated, conclusions made and followed-up.

8.    QU failed to investigate complaints involving the possible failure of a drug product to meet any of its specifications.

9.    Failure to submit NDA-Field Alert Reports (FARs) within three (3) working days of receipt of information concerning any bacteriological contamination, or any significant chemical, physical, or other change or deterioration in the distributed drug products

10.  And my personal favorite…a designated QU has not been established.

The QA Pharm

Are Commitments Made to FDA to be taken Seriously?

Responses to FD483’s and Warning Letters are usually fully of commitments. They involve “what” will be done to correct compliance problems, and “when” it will be done. FDA has even started to ask “how” they will be done, meaning—Do you have the resources to do the work?

If these questions are not fully addressed in the FD483, then FDA will say so in the subsequent Warning Letter in the part where they acknowledge receipt of the firm’s FD483 response—and the inadequacy of it.

My first point is that there is no excuse for an inadequate response to an FD483 or a Warning Letter.

There are plenty of Warning Letters on the FDA website that provide examples of poor responses and what the FDA thinks about them. There’s no excuse for not knowing how to respond. (Also see The QA Pharm, October 10, 2010.)

Reasons for poor responses are:

·       Arrogance (What problem? Let me explain why we have no problem.)

·       Bad advice from house counsel (Dance around the edges, but never admit having a problem.)

·       Minimalism (Commit as little as possible and don’t look for other problems.)

·       Being far removed from the problem (Responses are so bad that it makes your technical insiders embarrassed.)

·       No root cause (Doing lots of stuff, but very little directed toward the real problem.)

·       Poor writing skills. (Difficult to follow the story line, because you have no idea what you want to say.)

My second point is never, ever miss a commitment date.

If anyone were to ask the leadership of any company under FDA enforcement action whether FDA commitments should be taken seriously, the response would be a resounding “Of course.”

Yet actions say differently.

It continues to amaze me how many companies miss commitment dates. And even more amazing—the senior management had no clue they had missed them. This is totally unconscionable and an indicator why the company has compliance trouble in the first place.

Reasons for missing commitment dates are:

·       No system to track responses and commitments

·       Responses and commitments are buried with hundreds of other TrackWise records, most of which are also overdue

·       Overly project managed until there is more planning than action

·       Lack of visibility as a standing agenda item in the management boardroom

·       No accountability at any level for results

·       Agency responses are kept a secret, or not sufficiently distributed to employees

·       Those responsible for doing the work had no idea that a commitment was made

The best way to think about the seriousness of a commitment to the FDA is to remember that the FDA already suspects a noncompliant firm to be untrustworthy—or at best they are neutral about their credibility. To not deliver on a commitment date just confirms their suspicion and puts the relationship between the firm and FDA on shaky ground.

Not providing an adequate response simply indicates being out of the mainstream of pharmaceutical industry know-how. And missing commitment

dates is nothing less that breaking a promise.

How would you feel if you were not taken seriously?

The QA Pharm

FDA Calls for Corporate Commitment and Leadership at PolyCarbon Industries

Just when you think that the FDA has to stick to the script by quoting chapter and verse of CGMPs, they get very progressive and offer straight talk about corporate commitment and leadership.

We have reported before that the FDA expects corporate oversight of the Quality Management System. (The QA Pharm 4/17/11.) The Johnson & Johnson debacle is just one recent example where the FDA cited the corporate folks for taking their eye off McNeil where Tylenol is manufactured.

But the Warning Letter to PolyCarbon Industries recently posted on the FDA website has an added dimension—a call for commitment and leadership. The Warning Letter dated December 2, 2010, reads as follows:

“It is essential that your firm establish and maintain a corporate commitment to an effective pharmaceutical quality system. Your firm’s management should demonstrate leadership and ultimate responsibility by participating in the design, implementation, and monitoring for quality throughout the company. Management should establish policies that describes your firm’s overall approach to ensuring drug quality and communicates your expectation of compliance with all requirements of applicable federal law and FDA regulations.”

There’s a lot of insight packed into this paragraph. The most important aspect is what commitment and leadership behaviors look like from an FDA perspective.

So, let’s do a little behavior analysis:

1.    Does your corporate group participate in the design, implementation and monitoring of quality at your company?

The best example of this that I have seen was a corporate group that facilitated a focused discussion of internal and external experts that led to the creation and deployment of company compliance policies.

The worst example was a company that hired a consultant to write the corporate policies. The policies appeared one day on the company intranet with the edict that they be deployed within six months. The old “right click on properties” revealed that the consultant had used the same policies for another client. The only thing different was the logo.

2.    Does your corporate group establish and communicate policies regarding regulations and compliance requirements?

The best example of this that I have seen was a company that deployed the policies with the business message that compliance was important to patients and the ability to compete. Compliance was to be valued and the operating norm.

The worst example was a company that couched the compliance message in terms of FDA inspections getting tougher, and that—right or wrong—the bar was being raised. “We just have to face reality.”

Regulatory compliance is no different than any other area of the company that requires commitment and leadership. Frankly speaking, when there is little leadership in this area, I find little leadership in other areas too.

So to our friends at the FDA, I say: “Spot on.”

Sometime what needs to be said can’t be referenced to the Code of Federal Regulations, but is truly at the heart of the problem.

The QA Pharm

The Qualitative Message of FDA483s

One of the first questions I ask a pharmaceutical executive is how he or she gets information to know that their quality management system is effective. On one occasion and after a slight hesitation, I had to re-phrase my question. The conversation went something like this:

“What I mean is: How do you know that your product quality assurance/ GMP compliance program is working well?”

“Oh, well—quality is a priority for me. I pay a lot of personal attention to our quality program. We have a lot of quality projects at this site.” He motioned out the window to the Six Sigma flag in the courtyard. “I’d love to give you a tour. We have posters of all our projects in the cafeteria.”

That wasn’t exactly the answer to my question, so I tried another approach. “How do you decide the projects to work on?”

Proudly, he replied, “We have self-directed work teams here. They are empowered to select their own projects that make their areas more efficient.”

“That sounds really special.” I tried to sound sincere. But now I was starting to worry. After all, the reason for my visit was to help him prepare for an FDA District meeting regarding his most recent FDA483.

I tried again, “How do you think you fared through your last inspection?”

“Well, that’s why I asked you here.” He pointed for me to take a seat. “Our FDA inspections have continuously improved.” He passed a trend chart to me and continued, “Our corporate risk management group keeps a rolling average of the number of 483 observations. We only had six observations this time—greatly reduced number compared to the last time. That brought down our average.”

I pointed to a dotted line running across the chart. “What’s this?”

“Oh, that’s the norm for our entire global network. These last inspection results brought us well below the corporate norm. So we’re looking good from a corporate perspective.”

“So this is how you get a picture of how well you’re quality management system is working?” I asked trying to keep the tone of my voice flat.

“Sure,” he replied confidently. “But it’s the damndest thing.” I let the comment hang a moment as I waited for him to complete his thought. “The FDA inspector was rather hostile. So I thought we’d better go pay a visit to smooth things over. Six—just six observations! The inspection was over in two days! It wasn’t but two years ago that the FDA camped out here for three weeks and gave us nineteen observations! That’s continuous improvement, isn’t it?”

I didn’t answer his question right away. Instead, I took a few minutes to review the FDA483’s from their previous inspections. It became abundantly clear what was going on between this company and his FDA district office.

The inspector went only as far as he needed to go to document that the same issues remained—then he simply quit and went home.

Management was high-fiving each other in the corridor at the relatively few observations calling the one-pager “a light one.” Evidently the FDA inspector left with a different impression.

Although this is the year 2010, the kind of thinking depicted in this dialog dating to the Paleozoic era is still around.

Here’s what I say to such fossilized specimens:

First, numbers of observations cannot be statistically treated. You can neither average them, nor calculate a relative standard deviation because the number of observations is not derived from a single, predictable, defined process. Inspectors differ; the scope of inspections differs; the length of inspection differs. So, you cannot pool the data and statistically treat to make any kind of meaningful inference. In this case, fewer definitely was not better.

Second, the absence of a negative comment does not mean agreement. For example, just because an inspector walked through the warehouse that was not temperature and humidity controlled to get to the receiving inspection area, does not imply concurrence with operating an uncontrolled warehouse.

Third, inspection results are a seriously lagging performance indicator—if not lethargic. Much like the company stock price, by the time serious lack of compliance has had its dastardly effect—it’s too late to stop the shareholder lawsuits. Additionally, inspectors do not look favorably upon their observations being the measure of compliance—or the impetus for a quality plan. In fact, boilerplate language in Warning Letters points out that the list is not intended to be an all-inclusive list of deficiencies. The expectation is for company management to know for themselves the state of control though established internal review processes.

Fourth, efficiency “projects” may not address, but rather cause compliance issues. Efficiency and compliance are two different things. Efficiency deals with the most economical way of working. Compliance deals with a consistent way of working that meets regulatory requirements. For example, a self-conducted survey by an active ingredient supplier of its own operation is very cost effective, but inadequate for meeting the requirement for you to know their capability of consistently meeting your specifications.

More important than the number of 483 observations is the qualitative message. Taken collectively, the qualitative themes in this example were: (a) inadequate management control, (b) inability to sustain compliance, (c) failure of the quality control unit to establish an effective quality system, and—what we are seeing more of lately—(d) lack of corporate oversight and action.

An appropriate response to the qualitative message should be considerably different than the quantitative one. The qualitative response reads more like an organization overhaul—organization transformation, while the quantitative response appears more technical.

Heed the qualitative message of regulatory inspection observations; don’t average them.