In September 2004, the US Food and Drug Administration issued a new draft document entitled, "Guidance for Industry: Quality
Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations." This document represents the latest step
in FDA's efforts to encourage the pharmaceutical and biotechnology industry to adopt "...modern quality systems and risk management
approaches..." to management of GMP compliance (1). This article examines how a system of management controls can serve to
support and maintain a company's GMP compliance status. The establishment of management controls is a concept that is embodied
in the draft FDA guidance and has also been advanced by FDA in other contexts in recent years.
Why should companies implement management controls?
FDA's shift to a quality system approach to inspection and enforcement has also been seen in several recent warning letters
to pharmaceutical companies citing weaknesses in quality assurance and quality control (QA/QC) operations. At least one consent
decree of permanent injunction mandated an audit of QA/QC "management controls" by an expert consultant, followed by quarterly
updates for an indefinite period of time (2). Although pharmaceutical good manufacturing practices (GMP) regulations do not
specifically address the topic of management controls (3), they are critical to a continued compliance with such regulations.
The Code of Federal Regulations provides further insight into FDA's expectations for management controls (4).
The Federal Food, Drug, and Cosmetic Act (5) is a strict liability statute and is a premise supported by two significant Supreme
Court cases (6, 7). In the words of the Court, managers who "stand in a responsible relationship" to acts of the corporation
and who have the "duty and the power to prevent, detect, and correct" violations of the Act can be held personally liable
for violations, even if they did not intend for them to occur. For this reason, almost all FDA consent decrees name individual
executives as defendants in addition to the naming company. FDA also can criminally prosecute responsible managers for violations
of the Act. Therefore, it is incumbent upon management of all FDA-regulated firms to be proactive in how they manage their
company's compliance status.
This article presents examples of management controls that affect GMP compliance but are not specifically required by GMP
regulations. In the experience of the author, these areas often contribute to GMP-compliance problems and therefore deserve
attention. Companies should be aware of the need for management controls and the effect that those controls—not just those
specifically required by GMPs—can have on a company's compliance status.
Management controls defined
Certain management-control activities are designed specifically to address GMP issues such as the establishment of policies
that communicate management's intentions or the establishment of a periodic, systematic review of quality data trends. Other
management controls, however, are not specifically required by GMP regulations, but can have a significant effect on compliance.
Examples include organizational structure, resourcing, prioritization, and performance management and incentive systems.
The pharmaceutical and biotechnology industries can gain valuable insight into FDA expectations for management controls by
studying the "Management Responsibility" section of 21 CFR's Quality System Regulation (4). Although this regulation only applies to medical devices, the principles it establishes are valuable for all FDA-regulated
Discussion of management controls
Mission, vision, and corporate quality policy. Executive management must establish a clear vision that pharmaceutical manufacturing quality and compliance system is important.
Without a solid philosophical foundation, the overall quality and compliance program will lack the support it needs to succeed.