|Email Newsletters from Pharmaceutical Technology and Pharmaceutical Technology Europe|
News from Europe's pharmaceutical manufacturing industry coupled with upcoming events, and exclusive articles and interviews from industry experts.
Information-Technology Criteria in CMO Selection and Management
Pharmaceutical companies that seek to hire a contract manufacturing organization (CMO) must consider information technology (IT) concerns when they evaluate service providers. A sponsor company must investigate the manufacturing automation and systems, laboratory automation and systems, IT infrastructure, and business applications of each potential CMO. The authors describe the criteria that help pharmaceutical companies hire the appropriate CMO for their project.
A sponsor evaluates potential CMOs on the basis of their proposals, management experience, references, manufacturing capabilities, and record of compliance with good manufacturing practices (GMPs). The initial evaluation involves an assessment of a CMO's manufacturing facilities, processes, and supporting systems. A further assessment of the CMO candidates' quality and IT systems is crucial because these systems provide the sponsor with regulatory evidence, information and electronic reports, actionable data, and communications capabilities to monitor and manage the CMO. For example, the CMO's IT systems must be able to collect and report data on material-handling processes, laboratory results for active pharmaceutical ingredients, excipients, and finished products, as well as the manufacturing process controls (e.g., cleaning, sterilization, labeling, packaging) and the transport of the finished product.
Preselection IT assessment
Evaluating automated support and control systems as part of the due-diligence process in CMO selection is critical for identifying weak technology and business processes that will create risk for the sponsor. Depending on the size of the project to be outsourced, a preselection IT assessment of infrastructure, select systems and data, and communications capabilities should take between two to four days. A preselection IT assessment should include an evaluation of manufacturing automation and systems, laboratory automation and systems, the IT environment, and IT processes and controls.
Manufacturing automation and systems
The CMO should have records documenting the installation (installation qualification) of the equipment. These records will include the specifications and verification of materials, piping, wiring, vacuum, air supplies, and other equipment components as applicable. Records should also include functional and design specifications for automated equipment control. Often called programmable logic controls (PLCs), these computer systems are specifically designed to interface with certain types of manufacturing or packaging equipment. These computers' programs should be subjected to unit-level testing to confirm that they function correctly before they are integrated with the equipment. The connections and wiring between the automation or computer and the equipment should also be documented in wiring diagrams and verified as part of the qualification activities.
The CMO should have documented evidence that the integrated equipment and automation have been tested together and shown to function correctly according to the given specifications. This evidence is often called installation qualification (IQ) and operational qualification (OQ) of the integrated unit. A final check should determine whether the CMO has documented procedures for the ongoing operation, maintenance, and change control of these integrated equipment units. If the CMO has performed these activities and retained the specifications and records, the sponsor can be confident that the CMO's automated equipment is qualified and ready to execute the manufacturing or packaging processes required to produce the sponsor's product.
If the CMO candidate cannot produce the documentation discussed above, the sponsor could be at risk for increased costs. These qualifications will need to be performed to ensure that the sponsor's product will meet specifications and that the records will satisfy regulatory expectations.
A CMO may also use various manufacturing systems that help execute the manufacturing business processes but do not control or interact directly with the manufacturing equipment. These types of systems include manufacturing execution systems (MES), inventory-control and materials-management systems, warehouse-management systems, and electronic-batch-record (EBR) systems. Because these systems are used to perform GMP activities, they should be validated. The US Food and Drug Administration provides its expectations for validation in General Principles of Software Validation; Final Guidance for Industry and FDA Staff (1).
Evidence for validation of these types of applications includes a validation plan, requirements specifications, functional specifications, design specifications, configuration specifications, development-level testing, IQ protocols and results, OQ protocols and results, and either user-acceptance testing or performance qualification (PQ) protocols and results. An overview of the mapping between the specifications and testing should be presented in a traceability matrix. Standard operating procedures (SOPs) should exist for the ongoing use, maintenance, and control of these systems. Finally, a summary of the validation activities and evidence created should be presented in a validation summary report.
As it did for the manufacturing-automation assessment, the sponsor should ask the CMO to provide evidence that it has defined processes for validating a manufacturing operation business application system. If the CMO can share with the sponsor a risk-based method for qualification or validation, it will demonstrate that it has achieved a high level of compliance sophistication (2). If the CMO has no documented processes for qualification, validation or ongoing control, this omission may be a source of compliance risk to the sponsor. A CMO with uncontrolled automated manufacturing equipment or systems can jeopardize the acceptance of a clinical study or the approval of a new drug application (NDA) or cause the recall of a commercialized batch of product.
A final, subjective assessment of the manufacturing automation or systems area can be made by simply touring the CMO's manufacturing
facility and observing its equipment, automation, and practices. The sponsor can look for some of the following indicators
that may be warning signs of regulatory noncompliance, CMO financial instability, or inability of the CMO to meet contractual
agreements with the sponsor:
The subjective observation criteria can also be applied to the assessment of a CMO's quality-control laboratory, automated laboratory instrumentation, and laboratory systems.
Laboratory automation and systems
Laboratory instrumentation is considered differently than manufacturing equipment because the automation portion of the laboratory instrument is normally embedded into the instrument by the vendor. Thus, the analytical instrument and its embedded computer controls are installed as a single unit. The CMO should have functional and design specifications for the automated laboratory instrumentation and records documenting the installation (IQ) of the automated analytical instrument. These records may include the instrumentation specifications or installation instructions provided by the vendor. In the case of automated laboratory instruments, parameters will often be set or configured according to the intended use of the instrument. The CMO should retain a record of these configuration settings.
A laboratory-instrument application software package often provides the functional interface between the automated instrument and the laboratory technician. At a minimum, functional requirements or specifications should document the functionality of the application. The CMO should also have documented evidence that this application software, and any associated computer hardware, has been installed according to the manufacturer's specification and the CMO QC laboratory configuration requirements (IQ). The CMO should also verify that the application communicates correctly with the automated instrument.
Once these activities have been completed, the CMO should provide evidence that the integrated application and laboratory instrument have been tested together and shown to function correctly according to the given specifications. This is often referred to as OQ.
As with manufacturing systems, a final check should determine whether the CMO has documented procedures for the ongoing operation, maintenance, and change control for this automated laboratory instrumentation and associated systems. If the CMO has performed these activities and retained the specifications and records, the sponsor can be confident that the CMO's automated laboratory instruments are qualified and ready to execute the analytical methods that the sponsor requires. The sponsor will specify the analytical methods that must be performed by the CMO's QC laboratory. The CMO will be responsible for validating the analytical method on its automated instrumentation and within its laboratory environment.
If the CMO candidate cannot produce the documentation discussed above, the sponsor could be at risk for incorporating unacceptable materials into product, clearing unacceptable product for release, or maintaining inadequate specifications and records for regulatory purposes.
The CMO may also use various laboratory or quality systems that help execute the QC laboratory business processes but do not interact directly with automated instrumentation. These types of systems include laboratory information management systems, laboratory-chemicals inventory management, material-safety data sheets management, and deviation-reporting systems. These systems may be governed by select sections of 21 CFR 210 and 211, 21 CFR Part 58 (Good Laboratory Practice for Nonclinical Laboratory Studies), and 21 CFR Part 11 (Electronic Records; Electronic Signatures). The need for system validation depends on the system's intended use and the applicable regulations. If validation is required, the CMO should use a process similar to the one described in the manufacturing section. The sponsor should require the CMO to have similar documentation for this validation.
During the preselection IT assessment process, early identification of weaknesses and risks in the IT infrastructure, applications, or data-management areas enables the sponsor to avoid hidden costs and compliance failures.
IT infrastructure. The following areas of the CMO's IT infrastructure should be evaluated: network and communications capabilities, servers, data-storage devices, and the facilities that house these primary infrastructure components.
The facilities that house the infrastructure components should be inspected to determine whether they are adequately secure. Security can be provided by physical locks, password- or code-enabled locks, identification-card readers, or biometric sensors. The sponsor should also look for physical elements that ensure the safe, continued operation of the equipment within the facility or data center. Fire-extinguishing systems, heating and air-conditioning systems, uninterruptable power supplies and power-conditioning units, battery backup, and power generators protect the equipment and the data or records they hold.
The CMO's networks provide the communications capabilities within the CMO's own organization and between the CMO and the sponsor. During the preselection assessment, the sponsor should ask the CMO candidate for an explanation of the networks and communications capabilities. This overview will help determine how the CMO approaches network design in the manufacturing, laboratory, and administrative or corporate areas. The sponsor should look for network design elements that provide the appropriate level of isolation, security, and performance for the functioning of the specific area. Isolated proprietary shop floor or laboratory networks are often used to protect the data and equipment or instrument controls from the day-to-day business or administrative operations and data. The CMO should have processes and controls in place for securing their internal network through user identification and passwords.
Firewalls should be in place to provide additional security between the CMO's internal IT environment and the outside world. The network components that provide data exchange between the CMO and the sponsor should have the capacity and speed the sponsor requires. If electronic data exchange is a critical concern and requirement for the sponsor, actual transmission tests can confirm the connectivity and transmission speed between the CMO and the sponsor.
The CMO should be able to pre-sent evidence to the sponsor that the network has been qualified accor-ding to industry good practices. The evidence should show that the CMO understands the current network configuration, knows that it is functioning properly, and has controls in place for the ongoing support and control of the network.
The CMO should be able to present evidence that its computer servers have been properly installed and qualified. The evidence should include an inventory of all servers, configuration information for each server (e.g., vendor, model, major components, processor model, amount of memory), amount and type of other internal server storage, operating system and utility software installed along with the version and patch level, communications addresses, and identification of any application software (version and patch level) installed on each server. Controls should be in place for the ongoing operation, support, and control of the servers.
If the CMO uses mass data-storage devices that are external to the computer servers, then it should show evidence that the data-storage devices were properly installed and qualified and that adequate strategies are in place for their ongoing operation, support, and control. Basic configuration information should be available.
During the preselection assessment, the sponsor should determine which business processes the CMO candidate performs with
the assistance of computerized applications. The sponsor's quality unit can provide an initial determination of the applicability
of federal good practices regulations (GXP) for the computerized applications. This determination will allow the sponsor to
focus on systems that have high GXP visibility. Regulatory inspectors tend to focus on systems that:
In addition to investigating the compliance of the CMO's GXP-related applications, the sponsor should use the preselection assessment as an opportunity to identify the application systems that support the CMO candidates' business operations such as procurement, financials (e.g., accounts payable and accounts receivable), human resources (e.g., hiring, training, and termination), document management, production and capacity planning, equipment inventory and asset management, corrective and preventive action (CAPA), deviation tracking, project management, management of customer change orders, and desktop operations. Compiling a list of the CMO candidates' applications and their installed version of the application enables the sponsor to evaluate the compatibility of its own applications with those of the CMO candidates. If sponsor applications are different from those of the CMO candidates, then the sponsor's IT support staff can advise the sponsor about the efforts and costs that will be required to establish application compatibility, create a custom interface to a CMO system, or implement a manual solution for the incompatibility problems. Having this information before selecting the CMO will help to develop an accurate cost estimate for doing business with the particular CMO candidate.
Data and records. A crucial element of the preselection assessment is the determination of how the CMO proposes to produce, store, and transfer critical manufacturing records (i.e., actual manufacturing-batch records), regulatory data (e.g., lot and batch traceability, certificates of analysis for raw materials and sponsor product), and data or records that may be critical for the sponsor's business (e.g., finished-product inventory, locations, and QC status) (see Figure 6). These data and records flow from the CMO to the sponsor.
The sponsor should identify whether the CMO candidate will create paper-based records or electronic records and which records will be available to the sponsor. For example, the CMO may produce a paper-based manufacturing-batch record or an EBR. If the CMO can only provide paper records, the sponsor must determine whether the records will suit the sponsor's business processes. If they will not, the sponsor must identify alternative solutions and the costs for converting the paper record into an electronic format. If the manufacturing-batch record is only available in paper form, then the sponsor can estimate the cost of scanning the paper record into an PDF-file format and programming a function to link searchable metadata to that PDF file. This estimate is valuable information to have when the sponsor is ready to negotiate the SLA-based contract with the selected CMO. This exercise can be done for each type of critical record.
The final item of note in Figure 6 is the two-way flow of data and information between the CMO's and the sponsor's IT systems. The sponsor should look for compatibility between the CMO's and the sponsor's systems. Compatibility can be facilitated when the CMO uses systems that are based on open-standards products such as UNIX operating systems and SQL-compliant databases or products that have the flexibility to produce output in different standard file formats (e.g., ASCII format and PDF format).
Some additional items should be explored during the preselection assessment of the CMO candidate's IT environment. The CMO
should provide the sponsor with an overview of how it can provide data and record security. At a minimum, the CMO should address
the following areas:
IT processes and controls
During the preselection assessment, the sponsor can interview key CMO IT personnel. It is recommended that the sponsor interview
a diverse sample of representatives in the CMO's IT department (e.g., IT application manager, computer-room operator, network
engineer, programmer, technical engineer, and help-desk and support personnel). The interviews should yield an overall impression
of the processes, practices, standards, and procedures that exist within the CMO candidate's IT area. A complete review of
all IT processes is not practical at this point of the CMO selection process, but the sponsor should look for indicators of
the following good practices:
Good project-management practices are key to the successful development, implementation, delivery, and maintenance of systems or services. During the preselection assessment, the sponsor should look for evidence of good project-management practices such as clear definition of roles and responsibilities and clear identification of deliverables, milestones, and dependencies. Metrics for tracking progress, cost, and resource utilization should be clearly defined and appropriate. Reporting mechanisms should be efficient and timely. These project-management practices can be successfully applied to all areas of the CMO's operations.
Managing CMOs through SLAs
The preselection assessment verifies that the CMO properly maintains electronic records related to the manufacturing batches and controls and has adequate IT infrastructure, systems, and communications in place. Once the preselection assessment is completed and a CMO is selected, the sponsor should establish SLAs for ongoing monitoring and improvement and negotiate the final contract.
Developing SLA-based contracts is the most critical and valuable work that a sponsor will conduct during the outsourcing engagement. SLA-based contracts are the only way to ensure that the sponsor and the service provider (CMO) have a clear understanding of the services required and being provided.
In the manufacturing, QC, and IT areas, record requirements are specified within the following regulations:
The failure to properly maintain the required records is a major source of regulatory noncompliance. IT good practices and standards can increase the effectiveness of the CMO's automated systems and applications and reduce compliance risks associated with records creation, maintenance, and retention. Therefore, the sponsor can reduce its risk by including several IT-related requirements as part of an SLA-based contract.
The sponsor can require the CMO to establish a plan and timeline for the remediation of substandard systems that pose a compliance risk and substandard practices that do not meet industry or regulatory expectations.
The sponsor can require the CMO to ensure that its IT infrastructure supporting business areas is qualified to meet industry and regulatory expectations. Meeting expectations includes the establishment of related IT procedures or work instructions to install, maintain, and support the infrastructure components.
The sponsor can require the CMO to ensure adequate management of change to the automation and systems configurations that
have been agreed to at the initiation of the contract. Management can be demonstrated by establishing documented procedures
for the management of:
Through periodic audits by a representative, the sponsor can monitor the CMO's continuous-improvement and compliance efforts.
Areas to be monitored may include the following:
The sponsor may also require the CMO to establish a business-continuity plan and to agree on financial penalties it will pay for failed FDA audits.
The contract should provide for periodic, unannounced audits by the sponsor for the life of the agreement. In addition, the sponsor should insist on timing regular audits before specific milestones such as regulatory submissions or product launches. SLAs should establish that the CMO will maintain adequate product supplies to ensure that clinical-trial or other batch quantities are sufficient.
SLAs should establish detailed descriptions of the type and frequency of electronic data, records, and reports that will be provided to the sponsor. The failure to establish the timing of these reports in the SLA up-front often results in the sponsors paying extra for electronic reports that should have been part of the basic agreement or receiving electronic files that are incompatible with the sponsor's IT systems.
Pharmaceutical and biopharmaceutical companies will continue to take advantage of the economic benefits of outsourcing the manufacturing of their clinical supplies and commercialized products. The goal of the contract manufacturing organization selection process is to find a stable business partner that manufactures the sponsor's product according to specifications, satisfies regulatory requirements for product manufacturing and control, and provides the sponsor with the information, data, and records needed to sustain the business relationship.
A thorough information technology assessment of the CMO candidates should be considered part of the standard project management for the CMO-candidate identification and selection process. Early identification of the CMO's IT capabilities and practices will enable the sponsor to avoid common problems such as erratic availability and retention of electronic data and batch-related information, incompatibility of CMO and sponsor information systems and data, hidden costs for upgrades of CMO technology components, and failure to meet regulatory expectations.
Working with a CMO business partner that has implemented and uses industry good practices for IT processes and controls will reduce the sponsor's compliance risks, provide the sponsor with the data and information they need, and allow the sponsor to focus on the core business functions that the sponsor has chosen to pursue.
Kathleen A. Pelley* is head of the life-sciences quality practice, and John Postle is head of the life-sciences enterprise practice at Court Square Group, 1350 Main St., 5th floor, Springfield, MA 01103,
tel. 215.340.5779, email@example.com
*To whom all correspondence should be addressed.
1. FDA, General Principles of Software Validation; Final Guidance for Industry and FDA Staff (Rockville, MD, 2002).
2. FDA, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach (Rockville, MD, 2002).
3. International Organization for Standardization, "ISO–IEC 20000-1:2005 IT Service Management: Specification for Service Management" (Geneva, 2005).
4. ISO, "ISO–IEC 20000-2:2005 IT Service Management: Code of Practice for Service Management" (Geneva, 2005).
5. ISO, "ISO 9001:2000 Quality Management Systems—Requirements" (Geneva, 2000).
6. Information Systems Audit and Control Association, "COBIT 4.1 Control Objectives for Information and Related Technology" (Rolling Meadows, IL, 2007).
7. FDA, "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General," 21 CFR Part 210 (Rockville, MD, 2007).
8. FDA, "Current Good Manufacturing Practice for Finished Pharmaceuticals," 21 CFR Part 211 (Rockville, MD, 2007).
9. FDA, "Good Laboratory Practice for Nonclinical Laboratory Studies," 21 CFR Part 58 (Rockville, MD, 2007).
10. FDA, "Electronic Records; Electronic Signatures; Final Rule," 21 CFR Part 11 (Rockville, MD, 2007).
11. FDA, "Electronic Records; Electronic Signatures—Scope and Application," Guidance for Industry, Part 11 (Rockville, MD, 2003).