Gordon Johnston is president of VelQuest?s European operations, The Heath Business and Technical Park, Runcorn WA7 4QF, UK. Tel. +44 1928 513 813 Fax +44 1928 513 822 Gordon.Johnston@velquest.com

Gordon Johnston

The US Food and Drug Administration initiative, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach, focusses on pharmaceutical processes that present the highest risk to product quality. This article examines automated compliance; that is, utilizing innovative technologies and building quality into the compliance infrastructure. This includes standard operating procedures, work instructions, analytical methods, data sheets, batch records and more. Compliance-based activities can be automated, minimizing compliance risk and maximizing productivity and quality.

In an interview earlier this year (Bio-IT World, April 2003), Janet Woodcock, director of the Center for Drug Evaluation and Research (CDER), stated that "The original intent of the rule (21 CFR Part 11) was to facilitate the introduction of electronic technology to the process of the US Food and Drug Administration (FDA) submissions, as well as manufacturing and production. Part 11 was created to provide common-sense guidelines on how to do in the electronic world what was previously done on paper. During the last 5 years, however, confusion regarding what is included in the regulation and how to enforce it was impeding the introduction of new technology. The rule had created exactly the opposite of what was intended."	

Leading pharmaceutical companies show strong agreement regarding compliance trends. FDA's initiative, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach, is seen to make much sense, as does merging 21 CFR Part 11 into this policy. In every regulatory area, a lot of time can be spent discussing subtle interpretations of regulatory boundary conditions. Recent FDA guidance allows more discretion at the boundaries, but maintains a clear focus on the centre. And, it is not complicated.				

To assess events to date, two important factors must be understood:	

In the current paper-based environment, FDA is challenged to review and audit the entire regulatory spectrum to the most rigid compliance interpretation. The agency has been unable to comprehensively audit all facilities subject to good manufacturing practices (GMPs) biannually. It is clear that the public interest is better served through consistent audit and enforcement of critical products and processes. Risk-based assessment is simply the agency's prioritization to best serve the public's interest and safety.

Electronic data automation is critical to accelerating reviews and audits while ensuring compliance and quality. Part 11, therefore, plays a key role in moving forward. The intent of Part 11 is to stimulate innovative technology and facilitate the growing use of electronic records. Today, superior and cost-effective technology is available to enable the industry to comply with the rule.

Part 11 will now be reviewed in the process of GxP audits of critical products and processes. By focussing enforcement on predicate rules, the industry is able to focus on compliance and remediation. In the pharmaceutical industry, the most critical procedures and data are part of new drug applications (NDAs) and support the release and stability of marketed products. 	

Some organizations may choose to minimally comply because of a lack of regulatory clarity. The consequence, however, is that they will have less time available to achieve full compliance once the deadlines are firmly set. Most leading companies clearly understand the regulatory direction and are proceeding steadily toward fully compliant operations before final deadlines are set and enforced.		

Figure 1 Compliance and quality define process and procedural standards that must be met for approval to market a drug or other regulated product.			

Much of the current debate regarding compliance and enforcement assumes the historical paradigm that compliance is expensive, resource-intensive and time-consuming. This need not be the case. Rapidly improving, innovative technologies are available that enable better compliance and increased productivity than ever before - not higher costs. Automated compliance provides increased efficiency and is not an additional burden. Technology will transform compliance, just as HPLC technology transformed separation, and mass spectrometry transformed detection.	

FDA has reassigned responsibility for Part 11 to CDER and will review the regulation in conjunction with its cGMP re-examination initiative. FDA withdrew its prior guidance for industry and issued a temporary draft guidance on 20 February 2003, which was issued requesting comments during the following 60 days. The agency then indicated that new guidelines would be issued during July.				

The cGMP re-examination is referred to as "risk-based," therefore,  the interpretation and enforcement will also presumably be risk-based. The first step will be to define and focus on the areas that present the highest risk to product quality. Plant HVAC systems, for example, are likely be considered 'low risk,' even if temperature data comprise part of the record. Analytical data to release products or supporting clinical supplies are almost certainly to be considered 'high risk.'	

Part 11, however, has not been rescinded. The temporary guideline introduces several clear positions and then proceeds to state 	

FDA will more narrowly interpret Part 11 applicability, enabling it to focus on critical areas.

FDA will use discretion in enforcing Part 11. By focussing industry's efforts, it can rapidly address critical systems. FDA can prioritize inspecting critical systems.

The temporary guidance clarifies the definition of electronic records. It states: "Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any records requirements set forth in Agency regulations. Part 11 also applies to electronic records submitted to the agency under the ... (various acts) even if such records are not specifically identified in Agency regulations. The underlying requirements set forth in (the acts) other than Part 11 are referred to as predicate rules."	

The list of predicate rules is extensive and includes 21 CFR 58, 210, 211, 310, 312, 314, 510, 511 and 514. Whereas FDA claims it will apply risk-based enforcement, the industry is now faced with risk-based compliance. Predicate rules will provide the context in which all compliance is assessed. In terms of Part 11, the question is no longer: "Is it an electronic record?" but: "Is the record covered by a predicate rule and what is the risk assessment of the record?"	

Examining FDA's initiative, it is clear that an 'automated compliance platform' is in alignment with future FDA direction. Some important comments and observations from an FDA press release include			

Figure 2 Electronic data review with compliance flags.						

"Using state-of-the-art approaches in FDA's many critical review and inspection activities will encourage innovation and continuous improvement in drug manufacturing to minimize production problems and that will make it easier to get safe, high quality medications to patients who need them," said Mark B. McClelland, FDA commissioner.

The initiative was designed to evaluate and improve FDA's approach to reviews and inspections regarding the manufacturing of human and animal drugs and biologics.

FDA believes the revision to the Part 11 guidance is part of this movement.

The initiative will include additional intermediate and long-term steps, and its major goals include	

ensuring that state-of-the-art pharmaceutical science is utilized in the regulatory review and inspection policies

encouraging the adoption of new technological advances in high quality and efficient manufacturing by the pharmaceutical industry

assessing the applicable cGMP requirements relative to best quality management practices

enhancing the consistency and co-ordination of FDA's drug quality oversight activities.

It is important to note that FDA planned to complete and publish a comprehensive implementation plan for this cGMP initiative by mid-year. Clearly, predicate rules will be a priority for FDA and records subject to predicate rules will be examined regarding Part 11 and risk.	

There is strong consensus among leading pharmaceutical companies that critical electronic laboratory data will be subject to Part 11 requirements. Low risk, non-critical computer use will be subject to Part 11's narrower interpretation and discretionary enforcement. Legacy systems put in service prior to 20 August 1997 are Part 11 exempt. This may be a moot point because the exemption relates to Part 11 and not predicate rules. If records cannot satisfy Part 11 requirements, it is unlikely they can be considered valid to support predicate rules. 				

In specific uses, companies may state that computers were incidental to creating valid (cGMP) paper doc-uments. This requires them to maintain the resource-intensive administrative controls and blocks the use of the electronic source data in their longer- term paperless initiatives. Although this may enable a more orderly transition to full technical Part 11 compliance, it delays adoption of electronic filings, reviews and audits	

Requirements for a Part 11 technical remediation solution in analytical laboratories

The purpose of Part 11 is to ensure that records maintained in electronic form on behalf of FDA as a consequence of predicate regulations are controlled and tested in a sufficiently rigorous manner to ensure their accuracy and integrity. There is no requirement that records be maintained electronically for FDA; however, if such records are maintained electronically, the records, systems and manner that control their creation and maintenance are subject to Part 11. For any comprehensive technical remediation solution to meet the requirements of Part 11, the following issues must be addressed: 				

the ability to create accurate and complete copies of records in both human readable and electronic form

protection of records to enable their accurate and ready retrieval 

secure, computer-generated, time-stamped audit trails for any file change

authority checks to ensure only authorized individuals can use the system and electronically alter and sign a record 

determine that persons who develop, maintain or use electronic record/signature systems are trained and are authorized to perform their assigned tasks

To satisfy these requirements, a practical solution should be expected to provide	

complete security and access control ensuring that only authorized individuals can use the system (centrally administered)

granular eligibilities for people, applications, computers and files ensuring compliance

immediate security of a record upon creation, providing physical as well as logical security

consistent record storage with state-of-the-art security.

These features are important not just in meeting Part 11 requirements, but are also the foundations of valid GxP e-records.	

Articles

 In an interview earlier this year (Bio-IT World, April 2003), Janet Woodcock, director of the Center for Drug Evaluation and Research (CDER), stated that "The original intent of the rule (21 CFR Part 11) was to facilitate the introduction of electronic technology to the process of the US Food and Drug Administration (FDA) submissions, as well as manufacturing and production. Part 11 was created to provide common-sense guidelines on how to do in the electronic world what was previously done on paper. During the last 5 years, however, confusion regarding what is included in the regulation and how to enforce it was impeding the introduction of new technology. The rule had created exactly the opposite of what was intended." 