Managing CMOs through SLAs

The preselection assessment verifies that the CMO properly maintains electronic records related to the manufacturing batches and controls and has adequate IT infrastructure, systems, and communications in place. Once the preselection assessment is completed and a CMO is selected, the sponsor should establish SLAs for ongoing monitoring and improvement and negotiate the final contract.

Developing SLA-based contracts is the most critical and valuable work that a sponsor will conduct during the outsourcing engagement. SLA-based contracts are the only way to ensure that the sponsor and the service provider (CMO) have a clear understanding of the services required and being provided.

The failure to properly maintain the required records is a major source of regulatory noncompliance. IT good practices and standards can increase the effectiveness of the CMO's automated systems and applications and reduce compliance risks associated with records creation, maintenance, and retention. Therefore, the sponsor can reduce its risk by including several IT-related requirements as part of an SLA-based contract.

The sponsor can require the CMO to establish a plan and timeline for the remediation of substandard systems that pose a compliance risk and substandard practices that do not meet industry or regulatory expectations.

The sponsor can require the CMO to ensure that its IT infrastructure supporting business areas is qualified to meet industry and regulatory expectations. Meeting expectations includes the establishment of related IT procedures or work instructions to install, maintain, and support the infrastructure components.

The sponsor can require the CMO to ensure adequate management of change to the automation and systems configurations that have been agreed to at the initiation of the contract. Management can be demonstrated by establishing documented procedures for the management of:

• Formal requesting of a change
• Approval of a requested change by appropriate representatives of the sponsor and the CMO
• Documented evidence of the implementation and testing or verification of the change
• Tracking of all changes applied over the life of the contractual agreement.

Through periodic audits by a representative, the sponsor can monitor the CMO's continuous-improvement and compliance efforts. Areas to be monitored may include the following:

• Status of CAPA plans and activities related to required remediations
• Number or percent of CAPA items closed since the last audit or in a specified period of time
• Number or percent of remediation projects that are tracking to schedule
• Percent of qualified IT infrastructure
• Percent of CMO employees trained in good IT practices, GXP awareness, good documentation practices, and applicable CMO policies and SOPs.

Table II: Recommended procedures for the support of qualification and validation.

The sponsor may also require the CMO to establish a business-continuity plan and to agree on financial penalties it will pay for failed FDA audits.

The contract should provide for periodic, unannounced audits by the sponsor for the life of the agreement. In addition, the sponsor should insist on timing regular audits before specific milestones such as regulatory submissions or product launches. SLAs should establish that the CMO will maintain adequate product supplies to ensure that clinical-trial or other batch quantities are sufficient.

SLAs should establish detailed descriptions of the type and frequency of electronic data, records, and reports that will be provided to the sponsor. The failure to establish the timing of these reports in the SLA up-front often results in the sponsors paying extra for electronic reports that should have been part of the basic agreement or receiving electronic files that are incompatible with the sponsor's IT systems.

Conclusion

Pharmaceutical and biopharmaceutical companies will continue to take advantage of the economic benefits of outsourcing the manufacturing of their clinical supplies and commercialized products. The goal of the contract manufacturing organization selection process is to find a stable business partner that manufactures the sponsor's product according to specifications, satisfies regulatory requirements for product manufacturing and control, and provides the sponsor with the information, data, and records needed to sustain the business relationship.

A thorough information technology assessment of the CMO candidates should be considered part of the standard project management for the CMO-candidate identification and selection process. Early identification of the CMO's IT capabilities and practices will enable the sponsor to avoid common problems such as erratic availability and retention of electronic data and batch-related information, incompatibility of CMO and sponsor information systems and data, hidden costs for upgrades of CMO technology components, and failure to meet regulatory expectations.

Working with a CMO business partner that has implemented and uses industry good practices for IT processes and controls will reduce the sponsor's compliance risks, provide the sponsor with the data and information they need, and allow the sponsor to focus on the core business functions that the sponsor has chosen to pursue.

Kathleen A. Pelley* is head of the life-sciences quality practice, and John Postle is head of the life-sciences enterprise practice at Court Square Group, 1350 Main St., 5th floor, Springfield, MA 01103, tel. 215.340.5779, pelley@courtsquaregroup.com
.

*To whom all correspondence should be addressed.

References:

1. FDA, General Principles of Software Validation; Final Guidance for Industry and FDA Staff (Rockville, MD, 2002).

2. FDA, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach (Rockville, MD, 2002).

3. International Organization for Standardization, "ISO–IEC 20000-1:2005 IT Service Management: Specification for Service Management" (Geneva, 2005).

4. ISO, "ISO–IEC 20000-2:2005 IT Service Management: Code of Practice for Service Management" (Geneva, 2005).

5. ISO, "ISO 9001:2000 Quality Management Systems—Requirements" (Geneva, 2000).

6. Information Systems Audit and Control Association, "COBIT 4.1 Control Objectives for Information and Related Technology" (Rolling Meadows, IL, 2007).

7. FDA, "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General," 21 CFR Part 210 (Rockville, MD, 2007).

8. FDA, "Current Good Manufacturing Practice for Finished Pharmaceuticals," 21 CFR Part 211 (Rockville, MD, 2007).

9. FDA, "Good Laboratory Practice for Nonclinical Laboratory Studies," 21 CFR Part 58 (Rockville, MD, 2007).

10. FDA, "Electronic Records; Electronic Signatures; Final Rule," 21 CFR Part 11 (Rockville, MD, 2007).

11. FDA, "Electronic Records; Electronic Signatures—Scope and Application," Guidance for Industry, Part 11 (Rockville, MD, 2003).