Henrik Johanning is CEO and specialist, Genau & Co, Denmark. He is also a member of Pharmaceutical Technology Europe’s Editorial Advisory Board.

Henrik Johanning

Quality management of computer systems (hardware and software) is a central part of the overall quality management system in the pharmaceutical industry. In addition, quality management of electronic signatures and electronic records (1) (i.e., data generated by computer systems) is also part of the overall quality management system. Computer systems must comply with cGMP requirements, when used in these regulated environments. As continuous technology advancements, cloud computing, virtualized process control systems and manufacturing networks, including security, converge into a technology-driven, ever-adapting industry, so does the potential risk of non-compliance with both internal instructions as well as regulatory governance. 

Users responsible for computer systems in pharmaceutical environments have raised legitimate questions con-cerning perspectives, validation strategy, scope, and methods when validating these systems. Validation of computer systems is a task often regarded as abstract and rather complex. Because of this attitude, users may rely too heavily upon vendor-supplied information and validation data to support their system validation. Relying on vendor-supplied data could compromise the intended use of the software, and therefore, compromise the validation. Guidelines, recommendations, hands-on frameworks and templates, including the extent of validation and the type of documentation required to support validation, are unclear (2-8). Furthermore, it is difficult to delineate vendor and user responsibilities, when validating vendor-supplied computer systems, even those systems regarded as mature and rather relatively simple systems (e.g., MS Excel, certain enterprise resource planning software). In contrast, several risk-averse pharmaceutical companies choose to validate, in-depth, vendor-supplied pre-validated “standard” software.

IVT’s 6th Annual        Validation Week EU


Intended use is defined as, “…facilitate operations for its intended use and for its cleaning and maintenance…” (1). This term has shown to be a good and pragmatic guideline. Users of computer systems can use the same term for computer systems. This rather simple notion proves useful as it simplifies an initial complex and, for some users, volatile concept.

From an internal-external perspective, verification practices (e.g., validation strategy, proper risk assessment, establishment of design, user requirements, and subsequent verification of requirements) must be processed and reported internally to verify the intended use of the software. The software’s intended use must be implemented, and personnel training in everyday operations must be conducted. The company must ensure that user requirements, specifications, and instructions match the intended use. From an external perspective respectively, the proper level of regulatory compliance of the intended use and the continuous quality control of the computer system has to be ensured and maintained. 

 illustrates the typical lifecycle of computer systems, with intended use as a pivot point. This strict consensus is vital to avoid non-compliance with the intended use going from software requirement and designed functionality to operation.


  The validation strategy, and thus the extent of the validation activities, depends ultimately on the maturity and complexity of the computer software component(s) implied in ISPE GAMP5 and partly FDA 21 

 211.68(b) (6, 1). Computer software, as part of the computer system, dictates the hardware on which to be executed. The software categorization typology in GAMP5 ranges from infrastructure “used-by-millions” software  (category 1) such as antivirus software, operating systems (e.g., Windows, Linux, Unix, etc.), and databases (e.g., MS SQL, Oracle), to non-configured software with a large user base (category 3) such as firmware and MS Office applications, to customized software (category 5) (i.e., software characterized as being one of a kind such as most process controllers, scripts, macros, and data interfaces). 

 illustrates software category and validation/verification activities depicted using the traditional validation-model.


  The following is a checklist of step-by-step recommendations for performing computer system validation:

Validation strategy and verification activities depend on the software category (maturity as implied in user base, and complexity). Use the typology and (almost industry standard) as outlined in ISPE GAMP5 (6).

Recruit and involve users from identified functional areas (e.g., IT, quality assurance, vendor/supplier, and manufacturing) as early as possible. This early involvement makes specification and subsequent verification of ‘intended use’ easier. EU, Eudralex Volume 4. Annex 11 specifies the scope and extent of the functional-operational qualification to be done by the process owner, system owner, quality assurance (QA) and IT, respectively (2). From an operational perspective, it is recommended that the user group include system users. These users know how to establish test plans, test schemes, and test scenarios, not least in the subsequent performance qualification.

Bridge project and operation by using an audit trail between the original requirement, its functional specification, the verification, and the standard operating procedure (SOP). A reverse audit trail, for example, could be used: Read the SOP, operate the designed computer system, and check the user requirements. Is the ‘intended use’ still valid?  


From a strategic point of view, validating computer systems is an ever-increasing activity in the pharmaceutical industry as technology continuously automates former manual and paper-based processes. As technology increases, so does risk for non-intended use and ultimately non-compliance. Regulatory focus is primarily on raw data, data integrity, and SOPs (i.e., procedures not compromising the inteded use and, ultimately, the raw data). The pharmaceutical company is obliged to identify all raw data associated with GMP decisions (e.g., batch release) and determine which format (paper or electronic) to maintain data in. The integrity of the electronic record must be assured if raw data are to be maintained in electronic format. FDA issued warning letters in 2012 due to lack of documentation of intended use. Fortunately, top management, quality executives, and engineers are becoming more aware of potential regulatory pitfalls and breaches as the industry becomes familiar with computer systems and generated data.


  1.	FDA, 21 CFR 11, Electronic Records; Electronic Signatures
  2.	European Commission, 

EudraLex, Volume 4, Good Manufacturing Practices

, Annex 11 Computerized Systems (January 2011).
  3.	European Commission, 

EudraLex, Volume 4, Good Manufacturing Practices, Part II--Basic Requirements for Active Substances used as Starting Materials

 Manufacturing, Processing, Packaging, or Holding of Drugs
  5.	FDA, 

, Finished Pharmaceuticals
  6.	ISPE, GAMP5 (Good Automated Manufacturing Practice, ISPE term)
  7.	ICH, Q7 

Good Manufacturing Practice Guide For Active Pharmaceutical Ingredients

is CEO and senior partner, Genau & More; 

 is executive director, PharmaNet Inc., former FDA Investigator; 

Articles

Non-compliance issues show that users find dealing with computer systems challenging.

Checklist for Computer Software Validation

In the pharmaceutical industry, a change and deviation management system (CMS) is a central part of the overall quality management system for drug product manufacture — often referred to as the pharmaceutical quality system. In accordance with the ICH Q10 guideline, also supported by the FDA, CMS is one of the four key elements that make up a pharmaceutical quality system (the remaining three elements include process performance and product quality monitoring system; corrective action and preventive action (CAPA) system; management review of process performance and product quality). 

According to the FDA and International Conference on Harmonisation (ICH), a formal CMS should be established to evaluate all changes that could affect the production and control of the drug product, intermediate or API in a pharmaceutical manufacturing company. In addition, some level of CMS is also expected by the FDA for the production of clinical supplies; any changes in the production process and product formulation after the production of the phase III clinical batch must be tightly controlled and carefully evaluated from a product equivalency perspective. Significant process, formulation or equipment changes after the production and use of the phase III clinical batch could result in the performance of lengthy and costly bioequivalency and safety studies, and cause a delay in FDA product approval.  

Although the cGMP regulation for drug products (21 CFR 211) has no direct reference to change control, change control is implied in 211.100(a) and 211.160(a). 211.100(a) requires that changes in production procedures and process controls be reviewed and approved by the appropriate organisation units and the quality control unit. This was a major component of Warning Letters issued by the FDA between 2007 and 2009. 211.160(a) requires a similar review and approval for changes related to laboratory controls, sampling plans, specifications, and analytical test methods. 

The FDA considers change control a very critical GMP compliance issue; therefore it has been one of the main criteria used by the agency in determining their drug inspection depth and coverage, and their decision for follow-up regulatory actions (e.g., Warning Letter issuance). The FDA's strategy for drug inspection and follow-up is evidenced in their systems inspection programme introduced in 2002 for drug product inspection, and in 2006 for API inspection. The FDA compliance programme for drug product inspection (CP7356.002) instructs the FDA investigator to select the comprehensive inspection option when changes have been made that could impact cross-contamination control, or when there had been changes in technology, new facilities or equipment. The FDA compliance programme for API inspection (CP7356.002F) has the same requirements for the performance of a comprehensive inspection, along with additional criteria for changes related to starting materials, intermediates, equipment, facilities, support systems, processing steps, packaging materials or computer software. Both compliance programmes instruct the FDA district office to recommend regulatory actions when there is a pattern of the failure to establish or to follow a CMS. 

Typical major GMP deficiencies related to CMS include: 					

The failure to evaluate FDA filing requirements; i.e., whether to file for a prior approval or changes being effected, or to report the change in the next annual report.

The failure to file changes with the FDA.

The failure to evaluate and/or justify whether equipment/system requalification is needed to support an equipment/system change, and whether process revalidation, stability studies or equivalency studies are required to support a process and/or processing parameter change.

The inadequate review and approval of the change by the quality control unit.

The FDA expects the intimate involvement of the quality control unit in the change control review and approval process, and usually holds the quality control unit responsible for deficiencies regarding change control, which again can be evidenced in several Warning Letters issued in the past years. One example of this FDA expectation was documented in a Warning Letter issued by the FDA in 2003. A company performed a routine replacement of the filling pump pistons, without filing a change request because it was a "like to like" replacement (which has been a typical industry practice). Although the replacement pistons had the same part number as the original pistons, they were slightly longer. This longer dimension caused the pistons to come into contact with the bottom of the filling blocks, resulting in the generation of metal particles, which contaminated the product batches. This metal contamination resulted in the recall of several product batches and the FDA's issuance of a Warning Letter. The Warning Letter stated that: "Prior to changing the filling line pump parts on the…line, the quality control unit failed to properly assess the impact that the change may have on the product. It is the quality control unit's responsibility to review any change to your manufacturing process and to assure the change will not adversely affect the drug product".

When researching the subjects and the number of FDA Warning Letters issued, the pharmaceutical industry has, in the past decade, learned how to comply with change management and change control. Opportunity for improvement though still exists as Warning Letters as described above are still issued on this implied GMP requirement. No specific CMS guidance is mandated for pharmaceutical or clinical supplies companies, which leaves these companies to experiment with various approaches and systems; recent studies reveal that change is still tackled on a plant-specific and even projectbyproject basis, a relatively resourceintensive and impractical approach.

  In addition, change management processes are often still controlled manually, i.e., paperbased, or by a combination of both paperbased and digital CMS (i.e., hybrid) and with a decentralised solution compared with an enterprise-wide, centralised solution. This makes control, visibility and quality control unit action on change control and deviations rigid, if not impossible. 

Paper-based quality management systems are fairly common especially in mid-sized FDA-regulated pharmaceutical companies as well as the clinical supplies industry. While such systems can successfully manage product and process quality, they can significantly increase the risk of GxP and especially GMP non-compliance. They also impede a pharmaceutical manufacturer's ability to implement continuous improvement initiatives in process and products. Finally, paper-based systems can potentially become a bottleneck to fast growth and capitalising on investments. 

Overall, the pharmaceutical and clinical supplies industries still have difficulty in planning and executing GxP, and especially GMP-based change management practices according to their quality manual or equivalent documentation approach. In our opinion, depending on type and size, the number of changes in a pharmaceutical facility can range between 30 and 175 a month; these numbers stress the need for efficient management if randomness is to be removed. Randomness and lack of control exists, which causes non-compliance; approximately 40% of regulatory issues, including warning letters, regulatory inspection observations or compliance observations (CAPA etc.) are attributed to changes.

To properly evaluate, approve and implement changes, pharmaceutical and clinical supplies companies (after the production of the phase III clinical batch) should have an effective CMS that ensures continual improvements are undertaken in a timely, prioritised and effective manner while providing a high degree of assurance that no unintended consequences of the change exists (In the absence of FDA guidance on CMS, however, valuable inspiration can be found at a rather untraditional federal agency — The US Occupational Health and Safety Administration using 29 CFR 1910.119, Process Safety Management, a section that offers a useful model for pharmaceutical companies for managing change). 

Table 1: Application of CMS throughout product lifecycle.

The CMS should include the following as appropriate for the stage of the product lifecycle (

Quality risk management should be used to evaluate proposed changes (e.g., using ICH Q9

 ). The level of effort and formality of the evaluation should be commensurate with the level of risk and there should be an assessment to determine whether a change to the regulatory filing is required under regional requirements.

All changes should be properly evaluated. Proposed changes should be evaluated relative to the marketing authorisation, including design space, where established, and/or current product and process understanding. As stated in ICH Q8, movement within the design space is not considered a change (from a regulatory filing perspective). However, from a pharmaceutical quality system standpoint, all changes should be evaluated by a company's CMS.

Proposed changes should be evaluated by expert teams contributing the appropriate expertise and knowledge from relevant areas (e.g., pharmaceutical development, manufacturing, quality, regulatory affairs and medical) to ensure the change is technically justified. Prospective evaluation criteria for a proposed change should be set.

After implementation, an evaluation of the change should be undertaken to confirm the change objectives were achieved and that there was no deleterious impact on product quality.

Regional regulatory submission/approval requirements should be assessed for a proposed change to a marketed product.

The CMS should ensure that the level of documentation and effort is matched to the level of risk associated with the change. Specifically, companies should ensure that the CMS:

is linked (and thus fully integrated) to other quality systems such as CAPA, customer complaints, validation, etc.

includes criteria to evaluate whether changes affect a regulatory filing

includes evaluation criteria for determining if changes are technically justified

contains procedures for confirming and validating that the change has occurred, the objectives were achieved and that there were no unintended consequences

develops a change management tracking system to facilitate effective change control, e.g. on training (training is often not integrated with change).

Significant organisational and cultural barriers should also be addressed. Teams should meet often instead of once a quarter or less, and these teams should use an appropriate set of metrics to track changes and drive process improvements.  

To effectively deal with these basic CMS requirements, life science companies need to be more agile and, as such, have a well-organised, enterprise-wide response to change. Ideally, effective management and structuring of product- and processengineering change can lead to reduced cycle times, quick responses to changing market conditions and increased rates of product innovation. Companies applying an integrated approach to managing change can innovate more quickly, promote compliance with global and regional regulations and better support a profitable, enterprisewide response to innovative and effective production processes as well as customer demand. 

A new paradigm for managing change in an ideal environment is electronic-based CMS; a solution that smoothly complies with the above mentioned requirements and provides a means of bypassing potential barriers and obstacles. 

Digitise and centralise information so that associates can find the organised information they need, when they need it. It should also manage almost any type of file required throughout any of the GxP processes.

Automatically route documents, seek the appropriate approvals/electronic signatures, have incorporated notification and escalation procedures, search for documents and retrieve them.

Provide revision control that is automatic and centralised so that once submitted, documents can be routed and approved quickly and effectively. Change tracking will also be automatic. This will enable annual compliance reviews (CR-cases closed, logbooks reviewed, all complaints properly managed, internal audit reports closed etc.) to be done by a notification report.

Professionals should look for a solution that is customisable to a company's needs and that requires form explanations for changes that are being made.

There has been a significant improvement in change management in the pharmaceutical industry over the last decade. The industry is on the right track and performs relatively better than it did up to 5 years ago when ineffective change management was responsible for the issuance of a significant portion of FDA Warning Letters. 

From a strategic point of view, however, there is still an opportunity for improvement. Fortunately, the changing dynamics of the pharmaceutical industry now reveal a trend towards a new strategic paradigm in favour of electronic, automated and, where applicable, enterprisewide change management systems. The trend is also forecasted for the clinical supplies industry. This approach provides top management, quality executives and engineers with instant access to the status of any change request, i.e., realtime transparency on trivial but formerly timeconsuming details (e.g., who has reviewed the revised document, who is sitting on the approval request and needs to be prompted, and who else needs to review it). The cycle time of review is therefore significantly reduced once the process is automated. Using this new approach also enables outofspecification problems, nonconformance issues and corrective actions to be tracked automatically, allowing users to have full access to details relating to nonconformance issues that have not been resolved or corrective actions that are waiting to be implemented. 

A formal CMS should be established to evaluate changes that affect production and control of a drug product, intermediate or API.

The FDA considers change control a very critical GMP compliance issue, but no specific CMS guidance is mandated for pharmaceutical or clinical supplies companies.

Companies should have an effective CMS that ensures that continual improvements are undertaken quickly, while also providing assurance that no unintended consequences of the change exist.

Though the pharma industry has improved its change management processes, there are still opportunities for improvement.

Change management: common failures and a checklist for improvement

It is becoming evident that quality risk management within regulated, life sciences environments is a valuable component of an effective quality management system (QMS). A QMS provides a proactive and systematic means to identify, analyse, evaluate and control potential process and product quality issues during development, manufacturing, distribution and marketing throughout the entire product life cycle. 

Medicinal products are required to be safe for patient use, but safety does not mean zero risk. There are only a few examples of the integrated and systematic use of quality risk management systems in manufacturing facilities, whereas the use of principles is effectively utilized in pharmacovigilance and by regulating agencies. 

To further exemplify this obsolescent situation, GMP environments have lagged behind related industries in adopting risk management standards and guidance. For instance, industries manufacturing medical devices have deployed ISO 14971:200x, while food industries implement Hazard Analysis and Critical Control Points (HACCP). It is commonly agreed amongst pharmaceutical practitioners and industry stakeholders that risk management can appear both impractical and complicated; it may fail to generate value and even fail to mitigate risks. These opinions are supported by a lack of practical, harmonized guidance, and again it's an overall trade-off between reasonable risk, benefits and alternative options. When embarking on quality risk management within GMP environments, such as traditional pharma, there are useful lessons to be learned from the medical devices sector. 

Before illustrating best concepts and practices from the medical devices sector using business-specific examples from the multinational company Coloplast A/S (which has an extensive product range within ostomy, urology and continence, and wound and skin care), it is worthwhile to address the question: 'Why quality risk management?' The answer:  

Huge amounts of data — data availability.

Research/clinical data in separate, diverse systems

Advantages of a risk-based QMS include:  

Scientific and data-driven processes that reduce subjectivity.

The ability to prioritize risks according to fundamental patient safety and efficacy criteria.

Improved, consistent and traceable decisions with a focus on high–medium risk areas.

Improved transparency that builds reliability and trust with regulators and other stake holders.

With reference to the advantages mentioned above, ICH has stated the two primary principles of quality risk management as:  

The evaluation of the risk to quality should be based on scientific knowledge and, ultimately, link to the protection of the patient.

The level of effort, formality and documentation of the quality risk management process should be commensurate with the level of risk.

Overall, it complies with the FDA 21st century GMP initiative, which seeks to integrate quality systems and risk management approaches into existing programs to ensure that risk-based scrutiny is related to the level of scientific understanding and the capability of process control strategies to prevent or mitigate the risk of producing a poor quality product. 

Consistent interpretation and terminology

Interpretation and operational difficulties exist because of different life sciences verticals, as well as different standards and guidelines. A fundamental and first instance should be to use unambiguous, consistent terminology to ensure practical risk management, and risk management should also be the starting point of every project (change request, deviation). A well-defined, consistent approach to quality risk management (i.e., assessment, control and evaluation) is essential when defining practical and justifiable options in GMP environments. 

To be able to effectively use quality risk management as a practical (and value-adding) business tool, pharmaceutical professionals must become familiar with assessing harm to patients and acting accordingly. Experience from a large number of IT projects demonstrates that a relative assessment of risk is a better approach than a qualitative or quantitative assessment. Tables 1 and 2 list the relative concept and subsequent company-specific interpretation. 

Table 2 Example of company-specific definitions and abbreviations of risk assessment. 

A quality risk management system should be integrated into existing operations and documented appropriately. A scientific and risk-based, case-by-case (scalable) approach should be encouraged within GMP environments, including the derivation of scientific-based acceptance criteria. An example of a risk assessment protocol from an IT project covering the user requirement specifications (URSs) is illustrated in Table 2, and Table 3 uses a qualified analysis of potential hazards to the final product. 

Table 3 Example of company-specific risk assessment of requirements. 

Quality risk management should not be used to over-complicate validation and documentation efforts; for instance, by deploying unnecessary complex and detailed risk assessments. Reducing the amount of validation by using mature, standard technology and a risk-based QMS means that the life sciences actor should: 

Use vendor standard validation/qualification.

Ensure expert knowledge of products, processes and procedures are present (operational level, site, department).

Pharmaceutical quality risk management is worth the effort, and best practices and experiences clearly state that a low, pragmatic approach towards a rather academic concept is worthwhile, both in terms of compliancy and return of investment. Spin-off risk management means that the company clearly identifies, manages and controls risk, rather then focusing solely on trivial areas of good documentation disciplines. The focus is 

 on critical areas that could potentially compromise products, processes and even patient safety. Lessons are clearly to be learned from the medical devices sector. 

GAMP 4 Guide for Validation of Automated Systems,

3. International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use, ICH Harmonised Tripartite Guideline, Q9: Quality Risk Management, Version 4, 2005. 

4. ISO 14971:2000 Application of Risk Management to Medical Devices, 2007. 

is director and executive advisor at QAtor A/S (Denmark), and a member of 

is corporate quality development manager at Coloplast A/S (Denmark).

It is becoming evident that quality risk management within regulated, life sciences environments is a valuable component of an effective quality management system (QMS). A QMS provides a proactive and systematic means to identify, analyse, evaluate and control potential process and product quality issues during development, manufacturing, distribution and marketing throughout the entire product life cycle.

Does quality risk management add value?

Life science organizations face corporate governance, enterprise risk management, legal, and internal policy mandates that are increasing in frequency and cost. How life science organizations face product and process compliance issues affects not only the risk of noncompliance, but also their operational viability and, ultimately, their competitive advantage. 

Commonly acknowledged problems with paper-based compliance procedures commonly used by the life science industry, including Big Pharma, are: 								

 Lack of compliance, consistency and accountability in processes. 

 High resource requirements for quality assurance (QA) in critical and noncritical processes. 

 Suspicious audit trails and low reuse of knowledge across the enterprises and industry. 

 No electronic signatures or electronic submissions. 

 Uncertainties over the correct enterprise, product and process compliancy level. When is it lean? 

All pharma manufacturing processes and related IT systems must be validated and documented according to compliance with the FDA cGMP, ISPE GAMP 4 Guidance, ISO 17025, Eudralex Legislation and GxP Guidelines. As most validation processes are paper-based, life science companies spend a lot of skills and resources on preparing, controlling, approving and archiving validation documents and records throughout the entire product life cycle (Figure 1). 

Business operational risk and regulatory compliance place an increasing burden on life science companies for the following reasons:

 Regulations apply across the entire product life cycle in the life sciences.  After securing compliance with the previously mentioned regulatory policies and guidelines, new legal compliance issues are constantly being added. 

 International operations and markets increase complexity.

 Life science companies that produce drugs are some of the world's largest and most globally distributed firms. They must control far-ranging operations and navigate a complex set of local restrictions on promotional and sales activities, which vary across markets. Global standards are also becoming an imperative. 

 Multifaceted partner relationships dominate.

 Worldwide drug supply chains include a complex network of manufacturers, wholesalers, secondary distributors and retailers, all with independent risk mitigation issues. 

 Mergers and acquisitions complicate business operations.

 During the past 7 years, the life science industry has seen record merger and acquisition (M&A) activity in both number (650 M&As in 2005) and size. Rapid M&A activity creates broken and inefficient processes as companies struggle to integrate new operations while maintaining regulatory validation. The operational landscape is further complicated by the industry's growing use of outsourced or offshore vendors to supplement internal resources for clinical trial data management, application development and IT system management. 

These key business drivers force life sciences to move from paper-based compliance environments towards applying new information and communication technologies; that is, electronic compliance, which ultimately should demonstrate patient safety and product efficacy as demanded by legal authorities. From an enterprise perspective this transformation should also result in: 					

 Faster marketplace introduction and, therefore, longer patent utilization. This results in significant financial and competitive advantages, and shorter pathways to patients.

The overall conclusion is that life science companies need governance, risk and compliance software platforms (GRC) to drive sustainability, efficiency and consistency in managing enterprise risk and compliance. The GRC software platform market has grown from $85 million (€62 million) in 2002 to $590 million (€434 million) in 2006. Forrester projects that the GRC market will expand to $1.3 billion (approximately €0.95 billion) by 2011; that is, an annual average growth on $142 million (approximately €104 million) in this 5-year period (i.e., 24% annual growth rate).

 In particular, GRC platforms based on an object-based validation methodology, compared with traditional document-based GRC software platforms, are expected to experience a high growth rate because several immediate advantages and cost-savings are achieved.  

In object-based validation, an object should be considered a well-defined entity or collection of records. This could be fields, sections, documents, tests, results, test plans or requirements. Object-based validation defines and uses entities for validation purposes. This provides better traceability (and thus transparancy), learning and reuses previous object validation, making it more efficient and economic. Validating an object using this method eases the validation of that object used elsewhere. What object-oriented programming did for software development, object-based validation will do the same for validation.  

GRC platforms enable life science companies to establish a platform that maintains a single and consistent system of objects for enterprise risk and compliance while managing the intricacies and relationships of risk and compliance. They feature four types of capabilities: 					

 Policy, procedure and control documentation. 

 Loss, event and investigations management. 

Traditional GRC software platforms and test management systems with these capabilities exist so that life science companies can cope electronically with some of the business and environmental drivers mentioned previously.

However, no tradition GRC software has: 								

 An object-based validation-approach meaning that specific content 'within' and 'across' validation documents can be linked and re-used in subsequent change requests (CR's) and deviations (e.g., the user requirement specification document [URS]) and all related specifications, designs and reports. 

 No traditional GRC software supports the entire life cycle validation process via a single platform. 

Object-based systems process information in a database rather than in free-format documents. The user is allowed to produce the same types of documents as in the document-based approach, but the documents are collections of specific data (database reports) rather than traditional documents. Moving from the document-based approach to the respective object-based approach, it is possible to link different records so that a particular URS can be directly linked to functional specifications, risk assessment, design records, commissioning and validation. This allows the documentation to be reused. Also, requirements that in an earlier CR resulted in deviations can be alerted as probable future deviations and handled and modified accordingly. The object-based approach is depicted in Figure 2, illustrating the key difference between traditional document-based GRC systems and a respective object-based system. 

Figure 2 illustrates how multiple records can simultaneously constitute both documents and records. The "!" symbolizes a deviation, which is related to the respective record and allows for active feedback. 

Overall, object-based validation will enable life sciences to: 								

 Reuse records and benefit from earlier project knowledge. 

 Reuse templates and forms, and conveniently reproduce records in printed documents. 

 Link and trace records with different, subsequent validation records. 

 Have multiple authors and privileged users. 

 Improve reliability (transparency and access to earlier project knowledge and deviations). 

 Provide a 360-degree view from risk assessment implementation in CRM when receiving and reporting on a customer complaint to back-end life cycle stages. 

 Proactively monitor and control projects. 

Intelligent use of information communication technology manifesting itself in a web-based thin client/thick server solution, including an object-based validation methodology in GRC applications, will ensure true electronic record compliance with regulations, and full traceability across and within structured documents instead of managing documents in a traditional document management system. 

While the advantages of using an electronic object-based validation methodology are obvious, it requires that any company introducing such a system has full control of its own processes. It is impossible to introduce such a system without a specific idea of what processes and procedures it has to follow, the roles of each user, and which templates to follow. Without this, no electronic system will be successful. 

An object-based system may, however, be the exact push that the organization needs to succeed with its validation processes, and the only way to ensure true compliance because no paper-documented process can ever be performed without errors in relations, violation of written procedures or basic errors in GMP. 

Transformation towards electronic validation using web-based technologies securing global standards, coupled with the benefits of an object-based validation methodology demonstrate performance increases available to life science companies as they continue to use and maintain this new paradigm throughout product life cycles. This is because of extensive reuse of earlier documentation and project knowledge (including deviations), monitoring, project transparency and reporting facilities. A document-based, validation process however, whether paper-based or electronic, is predicted to limit life science companies in their efforts effectively minimizing documentation costs and resources.

1. M. Rasmussen, "The Forrester Wave: Governance, Risk, And Compliance Platforms, Q1 2006," Forrester, March 2006. 

2. US Department of Health and Human Services, Food and Drug Administration, "Guidance for Industry, Fast Track Drug Development Programs — Designation, Development and Application Review," (January 2006). 

3. M. Rasmussen, "Will The Real Risk And Compliance Vendor Please Step Forward? Defining The Risk And Compliance Market Landscape," Forrester, November 2005. 

4. IBM Business Consulting Services, "The Metamorphorsis of Manufacturing," IBM (2005). 

 is director and executive advisor at QAtor A/S (Denmark), and a member of Pharmaceutical Technology Europe's editorial advisory board. 

An electronic object-based approach towards validation is forecasted to be the upcoming validation paradigm supported by reliable web-based technology, organizational focus on risk management and overall enterprise effectiveness.

Optimizing resources and minimizing risk

This column provides a practical perspective and recommendations for applying a risk-based approach within the guidance-regulated biotechnology industry, an approach that can affect time-to-market. Focusing on the implementation of a risk management strategy encompassing the regulatory framework is not at all new, at least not to pharma manufacturing. The operationalization of the strategy and subsequent deployment is difficult, however. In particular the biotechnology industry has first seat in the value chain, or what FDA has defined as the critical path for new drug development. 

Table 1 Three dimensions of the critical path.			

To further enhance understanding, the column focuses entirely on regulation and biotechnology. This is a rather simplistic and academic approach, as other stake holders of course engage in this collaborative work. Furthermore, it has a sole focus on validation and documentation only, even though it is noted that in the very early stages of discovery and development, to a certain extent these compliance activities are optional and not enforced as in pharma. This transformation should result in earlier trial completion, earlier regulatory approval, earlier marketplace introduction and thus longer patent utilization — resulting in significant financial and competitive advantages. 

From a biotechnology industry perspective, the definition and deployment of the traditional legal interpretation of risk-assessment is particularly timely. It is required for a variety of reasons, but primarily because this era's new business paradigm forces the integration of new approaches and technologies to secure compliance with regulations and fast-track initiatives. This means validation and documentation resources need to be prioritized. The biotechnology industry's own challenges and the legal challenges of how to secure safe and efficient new drugs faster are intimately connected. 

The science-based regulatory framework for development of new drugs is dynamic in that public health objectives may change in response to patient needs and society's interests. In this column no distinction is made between traditional chemically synthesized drugs and respective biological drugs derived from living sources (such as humans, animals and micro-organisms). Most biologics are complex mixtures that are not easily identified or characterized and many are manufactured using biotechnology. FDA has traditionally regulated biologics and traditional drugs in different centres, but this separation is being rapidly accentuated by organizational changes. 

Given the dynamic character of these factors and also the fact that the process involves many different parties — pharmaceutical sponsors, the scientific and healthcare communities, the government and society at large — a potential synergy exists where these parties could collaborate to improve methods, approaches and technologies for development of new drugs. And it all begins with biotech (Figure 1). 

Figure 1 Cooperation, interdependency and individualisation demands new approaches and technologies			

Most of the contemporary debate on regulatory topics is in fact old news presented in more modern vocabulary. Controversies are inevitable. From an industry perspective, revision of the regulatory context under FDA is challenged more so today than at any time since the 1962 amendments to the Food, Drug and Cosmetic Act recreated FDA by mandating it to require proof of efficacy as well as safety when approving new drugs.

One main 'safety' criticism is that FDA favours the pharma industry by placing too little focus and weight on safety when approving new drugs and monitoring them afterwards, a chief criticism mainly grown upon Merck's withdrawals of Vioxx September, 2004 and Pfizer's withdrawal of Bextra in April, 2005. Alternatively, academic medical communities (also great supporters) have criticized the agency for being too slow to approve new drugs or too quick to remove them. 

FDA balances risks and benefits for the intended population and the drug's intended use as it decides that a drug is sufficiently safe and effective for marketing, and obviously the stringency of FDA approval standards ultimately has an effect on the pace with which new molecular entities (NMEs) are developed (Figure 2, Table 1). 

Figure 2 The critical path value chain.			

Rapid advances in basic and applied science pose a great challenge for FDA. Of course, the same logic applies to good manufacturing practice (cGMP) regulation as pharma manufacturing has become increasingly obsolete even as the advent of biotechnology cries out for radical changes. Despite technological progress and the adoption of new technologies in high-tech industries, such as petrochemical, software, hardware, communication etc. this industry routinely accedes to requirements that have become obsolete because of the costs for obtaining regulatory approval for changes. 

In March 2004, FDA published the report "Innovation or Stagnation? — Challenge and Opportunity on the Critical Path to New Medical Products", which examines the critical path needed to bring therapeutic products to fruition. It highlights how FDA can collaborate in the process from laboratory to end-use, to make medical breakthroughs available to those in need as quickly as possible.

  This report analyses the "pipeline problem", that is, the slowdown in innovative medical therapies reaching patients as a result of the current new drug development path becoming increasingly challenging, inefficient and costly, and this has manifested itself in a lower number of new drug approvals and biologic applications (Table 1). 

Only scientific and technical dimensions are included in the table, and all three dimensions are interdependent and none guarantee success. In January 2006, FDA published the Exploratory IND3 Studies.

  The guidance is to build in line with the critical path initiative and will facilitate very early exploratory scientific studies in people before the standard safety studies (Phase 1) begin, though limited to drug and certain well-characterized therapeutic biological products. One of the biggest barriers research and academic institutions face is the ability to get discoveries made in the lab into clinical testing. Because only small amounts of drugs are used in these early studies, they represent fewer potential risks for people in these trials. FDA makes recommendations about safety testing, manufacturing and clinical approaches that can be used in these very early studies. 

The guidance explains how medical researchers can take full advantage of the flexibility built into existing regulations in the amount of data needed when asking FDA's permission to proceed with such a study, enabling more rapid delivery of innovative products to patients. 

FDA has previously articulated its commitment to ensuring the appropriate flexibility is applied when patients with a serious disease and no satisfactory alternative therapies are enrolled in a trial with therapeutic intent.

It is expected that all preclinical safety studies supporting the safety of an exploratory investigation new drug (IND) application will be performed in a manner consistent with good laboratory practices (GLP) (21 CFR Part 58).

  The GLP provisions apply to a broad variety of studies, test articles, and test systems.  

In related draft guidance, INDs — Approaches to Complying with CGMP During Phase 1, FDA outlines a suggested approach to complying with current good manufacturing practice (cGMP) requirements for drugs intended for use solely in Phase 1 studies.

With this new guidance and an accompanying regulation, FDA formally recognizes specific standards for the manufacture of small amounts of drug product for Phase 1 studies and formulates an approach to cGMP compliance that is appropriate for the particular stage of drug development. 

Taking FDA initiatives even further from a regulatory perspective, the deployment of a risk-based, process-oriented approach would allow biotechnology to analyse and monitor their processes and implement appropriate controls to mitigate GxP risks. 

In that sense, following a four-step model that covers both the scope and selection of appropriate, supporting new technologies and controls, can be deployed: 				

Define overall responsibility for project team, i.e., system, business, quality assurance (QA). 

Define and identify critical GLP, good clinical practice (GCP) and good manufacturing GMP. 

GLP/GCP/GMP processes that could potentially compromise product safety, efficacy and quality 

Categorize all validation activities (Priority Plan). 

Non-critical processes (GLP/GCP/GMP) should be carefully analysed, and non-valuable adding processes (ideally) eliminated. 

Implement controls commensurate with the risk identified. These controls should be documented and justified with reference to the identified risks. 

This top-down and very pragmatic, public-acknowledged approach needs to be transformed to operational, intuitive measures easily deployable in the biotech environments.  

In operational terms this means a strong focus on failure investigation (falsification, fabrication, compromise to subject protection) and the documentation, monitoring and reporting to authorities. In other terms, this means traceability and classification of deviations: 			

Overall, the risk-based approach should be implemented in processes as follows: 				

clinical research methodologies, including protocols and regulatory compliance (documentation) 

assessment and evaluation of safety/toxicity and efficacy. 

Development of the necessary information to document safety, efficacy and utility involves a highly complex set of scientific and QA activities not commonly used in biotech, at least when entering fast-track programmes and partnering with pharma companies. For the biotechnology regulatory executive selecting the right compliance levels and systems supported by new technology (electronic record-keeping) is in today's collaborative environment essential, not least in the effort of securing a shorter cycle time. In fact one could argue, that GMP actually also yields significant benefit for biotech. Early implementation and education in compliance issues scaled and supported by using a risk-based approach towards this vital issue is resulting in synergism for all actors in the value chain, ultimately the patient and society. 

Furthermore, with the deployment of new technologies (knowledge-sharing based), for example, electronic documentation, biotech companies will comply with the requirements for electronic applications that will become mandatory in the EC in 2009, as is already the case in Belgium, The Netherlands and the UK 

is the director and co-founder of QAtor A/S, Denmark. 

1. S. Peltzman (1974), "Regulation of Pharmaceutical Innovation: The 1962 Amendments". Evaluative Studies. Washington: American Enterprise Institute for Public Policy Research. 

2. FDA (2004, March), "Innovation or Stagnation, Challenge and Opportunity on the Critical Path to New Medical Products", US Department of Health and Human Services. 

3. FDA (2006, January), "Guidance for Industry, Investigators, and Reviewers. Exploratory IND Studies". US Department of Health and Human Services, CDER. 

4. FDA (2006, January, rev. 2), "Guidance for Industry. Fast Track Drug Development Programs — Designation, Development, and Application Review" US Department of Health and Human Services, CDER and CBER. 

5. FDA (2006, January),"Guidance for Industry, Investigators, and Reviewers. Exploratory IND Studies". US Department of Health and Human Services, CDER. 

6. FDA (2006, January), "Guidance for Industry. INDs — Approaches to Complying with CGMP During Phase 1". US Department of Health and Human Services, CDER and CBER.

One of the biggest barriers research and academic institutions face is the ability to get discoveries made in the lab into clinical testing. Because only small amounts of drugs are used in these early studies, they represent fewer potential risks for people in these trials.