Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Question mark background | Image Credit: © Leigh-Prather - © Leigh Prather - stock.adobe.com

Q. Inspection readiness is a key performance indicator as part of our quality system. How can we make the best use of inspection information from regulatory agencies, such as FDA?

A. This is a very timely question, as FDA have just updated their Inspection Observation website (1). These are observations listed on an FDA Form 483 (commonly referred to as 483s) compiled into spreadsheets. The spreadsheets are available by fiscal year (FY) and the latest addition is the one for FY2023. Within the spreadsheets, the information is sorted by product and program areas (e.g., Biologics) on separate tabs, and further sorted within the tabs (e.g., by the cited regulation, and importantly, the frequency of the citation within 483s).

These spreadsheets provide a plethora of information and are of tangible benefit to industry for several reasons. Only a few Form 483s are published by FDA. Thus, access to the information as is presented here is almost impossible to attain any other way. Furthermore, FDA kindly provides the frequency of specific citations, which in turn is an indicator where FDA sees the most compliance lapses. FDA inspectors will thus pay particular attention to precisely these. Maybe unsurprisingly, the top spots held in the Biologics tab are failure to “Establish, maintain and follow manufacturing SOPs [standard operating procedures]” and failure to perform “thorough investigations”. It is not possible to know the precise circumstances that led to such an observation on a Form 483, but that is no hindrance to understanding the context of the observation as was discussed in a previous article (2).

The information from the spreadsheets should be used when preparing internal inspections, which in turn should form part of a firm’s inspection readiness program. Of course, caution is advised as every company is different and the circumstances, challenges, and compliance issues are unique. The data provided by FDA are, therefore, just indicators, and do not necessarily comprise all compliance/
non-conformities encountered.

Whereas not all Forms 483 get published on FDA’s website, Warning Letters are published (3). Paying attention to these is even more important, as they provide context not just to the observation (why FDA considered it a non-conformance with the laws and regulations), but also why FDA was not content with the response by the firm to the Form 483. It is not sufficient to understand what deficiencies have been encountered by FDA inspectors; it is essential to also understand how to remediate such deficiencies, and to remediate to the satisfaction of the agency.

These two sources on FDA’s website should provide you with lots of inspiration for testing your company’s inspection readiness. It would be really foolish if you failed to comply with any of those items at the top of FDA’s lists, as you know perfectly well that FDA will scrutinize these, and you have been warned.

Schmitt, S. The Inspection Result: Warning Letters and Form 483s. 

Siegfried Schmitt is vice president, Technical at Parexel.

®
Volume 48, Number 1
January 2024
Page: 34

When referring to this article, please cite it as Schmitt, S. Are You Ready for Inspection? 

Articles

Reviewing regulatory documents, such as 483 forms and Warning Letters, can aid in determining a facility’s inspection readiness, says Siegfried Schmitt, vice president, Technical at Parexel.

Are You Ready for Inspection?

Q: According to our standard operating procedure (SOP), we perform supplier audits during the selection process and as part of ongoing oversight. Although we try to perform as many of these audits ourselves, we do need to rely on third parties to manage the volume of good manufacturing practice (GMP) audits. Is there an international standard for third-party GMP audits?

A: Interestingly, there isn’t such a standard. There are a large number of articles and presentations freely available on the subject, but these may give you conflicting advice, leaving you perhaps confused. This lack of standardized approach has been realized, and a working group (VDI EE 6306, 3rd Party GMP-Audits) under the auspices of The Association of German Engineers (VDI) was formally established in 2023, with the aim of establishing precisely such a standard. That work has already progressed well, and the document is currently under review by regulators and other interested parties. Its publication in German and English is just a matter of time.

Meanwhile, you could verify that your SOP covers all the key elements relating to audits performed by your third parties, namely:

Contractual agreement: each audit should be covered by a legal contract and a quality agreement (these can be combined in one document). The scope of the audit and the deliverables should be unambiguously described. Very likely, confidential disclosure agreements between all parties will be required.

Auditor qualifications: the competency of the auditor or auditors are decisive for reaching the goals of the audit. The competency assessment should address the technical/scientific knowledge and the social competence (e.g., cultural awareness) of the auditors. Additional requirements apply to audit team leaders. Anyone involved in the audit should certify that they have no conflict of interest.

Types of audits: third parties could be used for on-site, remote, or hybrid audits. Each type should be addressed in the SOP.

Audit preparation: as audits are typically of a very short duration, planning them is of utmost importance. The aims and the scopes of the audits should be fully aligned with the audit approach, the available resources, and the time available for the audit. The agenda should be agreed between all involved parties.

Conducting the audit: most audits follow a standard sequence of opening meeting, site tour, and documentation review, followed by a close-out meeting. Provisions should be made if it becomes necessary to deviate from the agenda for whatever reason.

Audit follow-up: as soon as possible, the third party should provide an update on the audit outcome, whether certain information is still outstanding or if anything else is pending.

Preparing audit reports: Invariably, an audit report is required, and it should follow the style of the contract giver’s documents to achieve consistency.

Audit close-out: in all cases (i.e., whether there were observations during the audit that require follow-up or not), there should be formal close-out of the audit. It has to be clear up to what point in this process the third party has to be involved.

The actual standard will of course provide much more detail on each of these aspects, and it will hopefully provide you with exactly what you need.

Siegfried Schmitt is vice president, Technical, at Parexel.


Vol. 47, Number 11
November 2023
Pages: 42

When referring Schmitt, S. Using a Third Party to Perform Audits. 

There are key elements that should be covered when dealing with third-party auditors, according to Siegfried Schmitt, vice president, Technical, at Parexel. 

Using a Third Party to Perform Audits

Q: We are confused when it comes to audit and inspection terminology. The European regulations refer to self-inspection (1). FDA refers to audits and inspections (2), and the International Council for Harmonisation (ICH) refers to regulatory inspections and findings, audits, and other assessments (3). Can you provide some clarity?

A: As you noted, there is no harmonized terminology in the regulations. There is, however, a general understanding in industry that inspections generally mean inspections by regulatory or official bodies and audits mean assessments or investigations by firms or individuals from industry.

Is this merely a play of words or is there some fundamental difference between audits and inspections? They all serve the same purpose, namely for an independent person or persons to establish within a relatively short period of time whether particular requirements and commitments have been fulfilled, and importantly, whether documented proof of evidence is available.

From a regulatory authority perspective, an inspection assists in verifying whether a company adheres to the applicable laws, rules, and regulations, and to confirm that data and information supplied to the regulators are truthful and complete. This is, for example, the situation in case of clinical trial applications and marketing authorization applications (i.e., drug applications). As the situation at a company changes (e.g., new products) or the legislation changes, the authorities may need to conduct further inspections. As a company, you should have procedures in place that detail how you will host and support inspections by official bodies.

Clients (typically the licence holders) of contract manufacturing organizations (CMOs) may wish or have to perform audits of the CMO’s operations, either because they need to establish the CMO as a bona fide supplier or as part of an ongoing relationship assessment. Professional bodies may need to audit manufacturing facilities as part of a certification exercise (e.g., for ISO or EXCiPACT certification). Though there are many similarities with inspections by regulators, each audit type here warrants a focused, specific procedure, not least because it may involve different members of staff, a different routine, and likely a different set of documents to review.

And lastly, you need to perform your own audits. This involves audits of your suppliers, perhaps due diligence audits in case of an acquisition, and your internal audits (i.e., audits of your operations and your quality system). Each warrants its own procedure as you may have different persons involved in these different types of audits, and of course their intention differs. In the case of an internal audit (or self-inspection to use the European terminology), you will have full transparency and disclosure, whereas you will not have this with any other audit or inspection.

In summary, it really doesn’t matter how you call it, audit or inspection. Whichever terminology you prefer, you need to document this in your quality system. This can be done in a glossary, as and when used in
documentation, or in any other suitable place within your documentation. Just make sure it is clear to anyone within your company who is working under your quality system.

FDA. Sec. 130.300 FDA Access to Results of Quality Assurance Program Audits and Inspections. 

When referring to this article, please cite it as Schmitt, S. Clearing Up Confusion in Inspection Terminology. 

Audits and inspections both assure that requirements have been fulfilled and whether documented proof is available, says Siegfried Schmitt, vice president, Technical at Parexel.

Clearing Up Confusion in Inspection Terminology

Question mark background | Image Credit: © Leigh-Prather - Leigh Prather - stock.adobe.com

Q: FDA publishes redacted Warning Letters and Form 483s with inspection observations on their website. What can we learn from these, and where do we need to be cautious?

A: Such information can be considered compliance intelligence (i.e., it forms part of the pool of information a company relies on to build an appropriate quality management system, design its systems and operations in such a way that they adhere to the regulations and deliver a product that meets its predetermined quality attributes, and to build and staff their organization adequately). Regulations and laws are limited in their comprehensiveness, which means that there are many possible ways for companies to achieve compliance. Sometimes, the appropriateness is challenged or found defective in inspections by regulators, and this will lead to observations on FDA’s Form 483. In cases where FDA finds that the shortcomings are not addressed sufficiently and completely, the agency may issue a Warning Letter (WL). These are meant to be a last warning (1,2).

Clearly, any company can learn from mistakes made by others, helping them to prevent making the same mistakes. To understand the benefits and limitations of the learnings from WLs and form 483s, we need to look at what information they contain, or not. An observation on Form 483 may read like this: “Your media fills failed to accurately simulate commercial operations. Our inspection found the aseptic operations simulated during your media fills were not sufficiently representative of commercial aseptic manufacturing operations for (b)(4). For example, the type and frequency of manual interventions was not representative.” What we can learn from this is that media fills must be as similar as possible to normal aseptic operations.

However, there are many things that we do not know, such as:

Did the company apply a risk-based approach that was not acceptable to the inspectors, or was it simply that the company decided to do less during the media fills?

Were the operators following the protocol or did they deviate?

Did the protocol provide sufficient clarity and detail or did the company rely on the experience of the operators?

Is there an appropriate quality culture in that company?

Were operators and managers insufficiently trained or aware of the regulations, or were they knowingly ignorant?

Was there adequate quality oversight or not?

Was this the first time, the company performed media fills?

Does the operation require many different manual interventions or only a few?

Did this happen throughout the media fill or perhaps only during start-up, or perhaps only one of the shifts, or perhaps only with some of the media fills?

It is very unlikely that a reader of the FDA observation will have the answers to these questions. Yet, this is not necessary. It is important to understand the context of the observation and appreciate its seriousness. Then you need to ask the above questions about your operations, about your media fills. That is the real value that you will gain from these regulatory observations.

When referring to this article, please cite it as Schmitt, S. The Inspection Result: Warning Letters and Form 483s. 

FDA Warning Letters and Form 483s can offer a path to better compliance, says Siegfried Schmitt, vice president, Technical, at Parexel.

The Inspection Result: Warning Letters and Form 483s

Q: Various presenters at recent conferences have mentioned the concept of ‘Quality Culture,’ yet we cannot find this term in the applicable regulations and guidances. Can you tell us more?

A: The subject of a quality culture and how to measure its maturity has been discussed and published about for years, perhaps most notably through the cooperation of FDA with the University of St. Gallen, Switzerland (1). Quality is, of course, fundamental for achieving compliance with the laws and regulations governing healthcare products. Thus, companies need to have the organization, the processes, procedures, facilities, and systems in place that will assure quality of their products and services.

The argument by some is that this should include a culture of quality. The debate is still ongoing, and there is at present no agreement amongst the stakeholders (i.e., industry and regulators) about this concept; particularly how it could be measured or enforced.

That said, there are plenty of examples of how quality can be measured every day in any pharmaceutical company. The following are just some examples that show a lack of quality culture.

In a particular company, all staff are trained at least annually in good manufacturing practice, which includes good housekeeping and good documentation practice. Staff in the manufacturing area follow the instructions and the training, as do the operators in the analytical laboratories. Warehouse staff on the other hand, regularly fail to document activities (such as sampling), do not perform checks (e.g., if wooden pallets are heat treated) yet document them as being done, and place goods in aisles and corridors instead of the allocated storage locations. Why is one group behaving so differently from the others? Rumors have it that the warehouse team is resistant to change. A cultural thing? Possibly.

A manufacturing site had been manufacturing for the local market for many years without any issues with the local regulators. As part of an initiative to manufacture for a wider market, consultants were asked to perform a compliance assessment against regulations of specific overseas markets. This assessment identified a number of non-conformances and, therefore, the need to improve and upgrade the facility. The effort was estimated to cost several million US dollars. The site management team listened to the recommendations and dismissed them as being unreasonable. Their argument was that what is good for our people will be good enough for others. A question of culture? Very likely.

An international company manufactures a product in two locations. The process is the same, yet the batch records are 50 pages on one site and 500 pages on the other. Despite a global quality system and well-trained staff in either location, there is this significant difference in detail in the operating instructions. Could that be culture-driven? Potentially.

As professionals in the industry, we all assume that we know what is right when it comes to quality, but can we be as certain when it comes to culture? If it were easy, the regulators would certainly have codified this in the laws and regulations by now.

. www.unisg.ch/en/ (accessed April 10, 2023).

When referring to this article, please cite it as Schmitt, S. Measuring Quality in a Culture. 

The concept of quality culture and how to enforce it are being debated by 
regulators and industry, says Siegfried Schmitt, vice president, Technical at Parexel.


Measuring Quality in a Culture

Q. We are a manufacturer of pharmaceutical drug substances and drug products. We understand that good manufacturing practices (GMP) apply, but we have now been informed that the good distribution practices (GDP) apply too. Can you explain why?

A. It is correct that GDP applies to your operations as GDP covers the transport and storage (in transit) of raw materials, intermediates, excipients, drug substances (DS), and drug products (DP). Even if you are not the responsible party for shipping your DS and DP (perhaps because you are a contract manufacturer), you will most certainly receive raw materials, intermediates, or excipients from your suppliers. It is your responsibility to assure these have been shipped and stored in accordance with the specifications, such as temperature and humidity.

You may ask: when were the GDP regulations put in place, given that the GMP regulations were published decades ago? They were already part of the GMP regulations under the title of holding and distribution of DS and DP. However, the regulators realized securing the supply chain required more specific regulatory guidance and oversight (e.g., US Food and Drug Administration’s Safety and Innovation Act [FDASIA] of 2012) (1).

The aims of GDP go beyond assurance of appropriate physical storage and distribution; they also cover supply chain security (i.e., the prevention of theft or the introduction of falsified [counterfeit] medicines). For that reason, you need to be familiar with and adhere to the requirements of the relevant regulations applicable to you. In Europe, this is Directive 2011/62/EC, the “Falsified Medicines Directive” published in 2011 (2). In 2016, Commission Delegated Regulation (EU) 2016/161 was published, laying down detailed rules for DP safety features, particularly serialization (3).

As a purchaser of goods that impact the quality of the DS or DP, or as the party responsible for shipping DS or DP, you need to assure compliance with the GDP regulations. That means that you need to have technical/quality agreements in place with your suppliers and that you need to have appropriate oversight, including supplier audits. Such oversight can include the review of dataloggers from the shipment, checks that seals on the vehicles are undamaged, to name some of the routine activities. Much more detail on goods receipt verification can be found in Good Distribution Practice: A Handbook for Healthcare Manufacturers and Suppliers (4). To determine what type of audit will be required, you need to assess the criticality of the shipment (i.e., the material shipped [e.g., its value]), the shipping route (e.g., wide temperature variations), the transport company (e.g., specialized in pharmaceutical shipments or not), and the logistics provider. The resulting audit requirements can range from performing a search of publicly available information to an on-site audit.

The GDP regulations are often so embedded in the regulatory framework of a jurisdiction that the term GMDP for Good Manufacturing and Distribution Practices has become commonplace, as in the European Union’s GMDP database (5).

Food and Drug Administration Safety and Innovation Act (FDASIA). FDA.gov

Directive 2011/62/EU of The European Parliament and of the Council. 

Regulations Commission Delegated Regulation (EU) 2016/161 Of 2 October 2015. 

PDA. Good Distribution Practice: A Handbook for Healthcare Manufacturers and Suppliers, ed. Schmitt, S. 2019, www.pda.org.

Human Regulatory. EudraGMDP Database. ema.europa.eu

When referring to this article, please cite it as Schmitt, S. Securing the Supply Chain with Good Distribution Practices. 

Good distribution practices ensure appropriate physical storage, distribution, and supply chain security, says Siegfried Schmitt, vice president, Technical, at Parexel.