Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q: Various presenters at recent conferences have mentioned the concept of ‘Quality Culture,’ yet we cannot find this term in the applicable regulations and guidances. Can you tell us more?

A: The subject of a quality culture and how to measure its maturity has been discussed and published about for years, perhaps most notably through the cooperation of FDA with the University of St. Gallen, Switzerland (1). Quality is, of course, fundamental for achieving compliance with the laws and regulations governing healthcare products. Thus, companies need to have the organization, the processes, procedures, facilities, and systems in place that will assure quality of their products and services.

The argument by some is that this should include a culture of quality. The debate is still ongoing, and there is at present no agreement amongst the stakeholders (i.e., industry and regulators) about this concept; particularly how it could be measured or enforced.

That said, there are plenty of examples of how quality can be measured every day in any pharmaceutical company. The following are just some examples that show a lack of quality culture.

In a particular company, all staff are trained at least annually in good manufacturing practice, which includes good housekeeping and good documentation practice. Staff in the manufacturing area follow the instructions and the training, as do the operators in the analytical laboratories. Warehouse staff on the other hand, regularly fail to document activities (such as sampling), do not perform checks (e.g., if wooden pallets are heat treated) yet document them as being done, and place goods in aisles and corridors instead of the allocated storage locations. Why is one group behaving so differently from the others? Rumors have it that the warehouse team is resistant to change. A cultural thing? Possibly.

A manufacturing site had been manufacturing for the local market for many years without any issues with the local regulators. As part of an initiative to manufacture for a wider market, consultants were asked to perform a compliance assessment against regulations of specific overseas markets. This assessment identified a number of non-conformances and, therefore, the need to improve and upgrade the facility. The effort was estimated to cost several million US dollars. The site management team listened to the recommendations and dismissed them as being unreasonable. Their argument was that what is good for our people will be good enough for others. A question of culture? Very likely.

An international company manufactures a product in two locations. The process is the same, yet the batch records are 50 pages on one site and 500 pages on the other. Despite a global quality system and well-trained staff in either location, there is this significant difference in detail in the operating instructions. Could that be culture-driven? Potentially.

As professionals in the industry, we all assume that we know what is right when it comes to quality, but can we be as certain when it comes to culture? If it were easy, the regulators would certainly have codified this in the laws and regulations by now.

. www.unisg.ch/en/ (accessed April 10, 2023).

Siegfried Schmitt is vice president, Technical at Parexel.

When referring to this article, please cite it as Schmitt, S. Measuring Quality in a Culture. 

Articles

The concept of quality culture and how to enforce it are being debated by 
regulators and industry, says Siegfried Schmitt, vice president, Technical at Parexel.


Measuring Quality in a Culture

Q. We are a manufacturer of pharmaceutical drug substances and drug products. We understand that good manufacturing practices (GMP) apply, but we have now been informed that the good distribution practices (GDP) apply too. Can you explain why?

A. It is correct that GDP applies to your operations as GDP covers the transport and storage (in transit) of raw materials, intermediates, excipients, drug substances (DS), and drug products (DP). Even if you are not the responsible party for shipping your DS and DP (perhaps because you are a contract manufacturer), you will most certainly receive raw materials, intermediates, or excipients from your suppliers. It is your responsibility to assure these have been shipped and stored in accordance with the specifications, such as temperature and humidity.

You may ask: when were the GDP regulations put in place, given that the GMP regulations were published decades ago? They were already part of the GMP regulations under the title of holding and distribution of DS and DP. However, the regulators realized securing the supply chain required more specific regulatory guidance and oversight (e.g., US Food and Drug Administration’s Safety and Innovation Act [FDASIA] of 2012) (1).

The aims of GDP go beyond assurance of appropriate physical storage and distribution; they also cover supply chain security (i.e., the prevention of theft or the introduction of falsified [counterfeit] medicines). For that reason, you need to be familiar with and adhere to the requirements of the relevant regulations applicable to you. In Europe, this is Directive 2011/62/EC, the “Falsified Medicines Directive” published in 2011 (2). In 2016, Commission Delegated Regulation (EU) 2016/161 was published, laying down detailed rules for DP safety features, particularly serialization (3).

As a purchaser of goods that impact the quality of the DS or DP, or as the party responsible for shipping DS or DP, you need to assure compliance with the GDP regulations. That means that you need to have technical/quality agreements in place with your suppliers and that you need to have appropriate oversight, including supplier audits. Such oversight can include the review of dataloggers from the shipment, checks that seals on the vehicles are undamaged, to name some of the routine activities. Much more detail on goods receipt verification can be found in Good Distribution Practice: A Handbook for Healthcare Manufacturers and Suppliers (4). To determine what type of audit will be required, you need to assess the criticality of the shipment (i.e., the material shipped [e.g., its value]), the shipping route (e.g., wide temperature variations), the transport company (e.g., specialized in pharmaceutical shipments or not), and the logistics provider. The resulting audit requirements can range from performing a search of publicly available information to an on-site audit.

The GDP regulations are often so embedded in the regulatory framework of a jurisdiction that the term GMDP for Good Manufacturing and Distribution Practices has become commonplace, as in the European Union’s GMDP database (5).

Food and Drug Administration Safety and Innovation Act (FDASIA). FDA.gov

Directive 2011/62/EU of The European Parliament and of the Council. 

Regulations Commission Delegated Regulation (EU) 2016/161 Of 2 October 2015. 

PDA. Good Distribution Practice: A Handbook for Healthcare Manufacturers and Suppliers, ed. Schmitt, S. 2019, www.pda.org.

Human Regulatory. EudraGMDP Database. ema.europa.eu

Siegfried Schmitt is vice president, Technical, at Parexel.

When referring to this article, please cite it as Schmitt, S. Securing the Supply Chain with Good Distribution Practices. 

Good distribution practices ensure appropriate physical storage, distribution, and supply chain security, says Siegfried Schmitt, vice president, Technical, at Parexel.

Securing the Supply Chain with Good Distribution Practices

Q. Creating a contamination control strategy (CCS) is now a requirement defined in Annex 1 of the European good manufacturing practice regulations (1). The document does not describe how to create such a strategy. Can you provide us with some best practice information?

A. Any company that must comply with that regulation have until Aug. 25, 2023 to be compliant. Several industry associations are working on or have already issued some best practice documentation to their members. Therefore, it may be beneficial to become a member of such an organization.

In the meantime, the following are some best practices:

Define the CCS scope, which should encompass sterile products, and any products or ingredients requiring bioburden control. Identify all contaminants, including those that impact quality, sterility, or efficacy.

Position the CCS, which means developing the CCS relative to process and facility design. The CCS will be related to the site master file and the site’s pharmaceutical quality system (PQS), as well as the life cycles for the products manufactured on site.

Establish the CCS structure, which is typically a Site Master CCS that is an overarching approach to contamination control document. The Site Master CCS links the detailed area CCS documents together, which address the area specifics and product specific information.

A CCS is a holistic approach to contamination control that will take into account all existing measures in place. These are likely to include (in no particular order) housekeeping, materials storage and management, personnel and material flows, facility and equipment design, process design and controls, heating, ventilation, and air conditioning (HVAC) and utilities, preventive maintenance, corrective and preventive actions, training, cleaning and disinfection, outsourced activities, continuous improvement, and quality by design.

The control measures in these will comprise:

Technical control measures based on science and knowledge of process, product, and risks

Organizational/procedural control measures defined in the PQS based on quality risk management principles.

The goal of the CCS is to document detailed process knowledge and all associated potential contamination sources, and how the company assures appropriate controls to manage the risks at an acceptable level. Furthermore, the CCS documents the interrelation of the various control measures. As mentioned, many control measures are in place, but it may not be clear if there are any gaps (i.e., lack of a comprehensive overview).

This may still sound abstract, so here is an example. For a cleanroom suite, a company has gowning and operating procedures in place, HVAC installed, and is monitoring differential pressure, room temperature and relative humidity, amongst other measures. That is considered good practice and addresses regulatory requirements. However, it does not describe what the gowning procedure is achieving, (i.e., whether the gowning is reducing the shedding of particles, or whether the gowns are of the appropriate material and size). It also does not address whether this gowning regime is appropriate in relation to the contamination in the rooms, as controlled by the HVAC system and as measured by the room monitoring system. Only if this is reviewed, assessed, and documented as part of a CCS, will it be known if the technical and procedural controls are balanced and represent compliant controls.

Hopefully, this shows that a CCS is not merely a regulatory requirement, but provides significant benefits to the industry, not least to help understand the controls holistically

EC. Annex 1 : Manufacture of Sterile Medicinal Products. EudraLex, The Rules Governing Medicinal Products in the European Union, 

Volume 4 EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use. 

When referring to this article, please cite it as S. Schmitt.Creating a Contamination Control Strategy. 

A CCS provides significant benefits to the industry and helps with holistically understanding contamination controls, says Siegfried Schmitt, vice president, Technical at Parexel. 

Creating a Contamination Control Strategy

Q: We are a newly established small company, and we would like to understand the principles of equipment qualification. Can you give us some essential guidance?

A: Equipment must be fit for use, and to prove this within the realm of your quality system, you need to qualify the equipment. Equipment may consist of mechanical parts or it may be a system that is made up of mechanical parts and automation (software).

It all starts with your user requirement specification. Unless you describe what you want (need) and how you want to use the system, it will be impossible to perform qualification. Let us take the example of a mixer. At what speeds and temperatures and for what length of time do you intend to use the mixer? Do you require preset programs, alarms, power supply of a specific voltage, polished stainless steel surfaces, specific dimensions of the mixing paddle, etc.?

Once you know what you need, you can prepare the qualification plans and protocols (these can be one document). These documents describe what you want to test, who will perform the testing, how the tests have to be performed and how results have to be documented. The mixer may come with 50 pre-installed mixing programs. It is probably unnecessary to test them all, and sometimes it is not possible to test 100%. In these cases, you describe your rationale for selecting a limited number of test cases. Do you need to test at all? In principle yes, because with any delivery and installation, something can go wrong, such as missing connections, incorrect software version, wrong version of the user manual, etc.

If your test plans contain tests that have no related user requirement (perhaps you verify the color of the mixer), you can certainly document these items; but remember, you cannot pass or fail the result. It just is what it is.

Crucial to qualification is documentation (i.e., documented evidence). An example of insufficient evidence would be if the test checks that the mixer can be run for 60 minutes without overheating and all you document is:

Test: ‘Verify that the mixer does not overheat after 60 minutes of mixing at full load.’

You need to also document the type of load (e.g., sugar syrup with a viscosity of xyz), the mixing speed (e.g., 10 rpm setting on the mixer), how the time was measured (e.g., stopwatch), and how it was proven that the mixer did not overheat (e.g., alarm 12 ‘overheating’ did not show and stop the mixer). That will then be documented evidence that satisfies the regulators.

This is of course just a very high-level summary of qualification basics, but it should give you something to start with.


Volume 46, Number 11
November 2022
Page:

When referring to this article, please cite it as S. Schmitt, “Principles of Equipment Qualification,” 

Documentation is crucial to equipment qualification, says Siegfried Schmitt, vice president, Technical at Parexel.

Principles of Equipment Qualification

Q. During the periodic review of our ‘Third-Party Auditing’ standard operating procedure (SOP), the quality and the operational teams could not agree on the contents. Some wanted more detail, others less. What best practices can you recommend?

A. Quality systems evolve, and this evolution brings changes to the contents of the documents, such as SOPs. The regulations do not demand effective and efficient systems and instructions, but this of course is in the interest of any company. They do, however, require that activities that must comply with the laws and regulations are documented. Before starting to write any text, please remember:

All activities that form part of a quality system can be described as processes.

All processes can be described in a process flow diagram.

The description of the activities, roles and responsibilities, and associated data and documents are associated with specific process steps.

Best practices take this into account. Thus, a SOP shall be based on an agreed process flow. Unfortunately, all too often process flows are an afterthought when the SOP has already been written. It is rarely easy or even possible to create a process diagram based on existing text. The opposite, however, is straightforward.

Let us therefore look at the example of your third-party auditing SOP. First, you need to prepare a process flow diagram. A generic example is given in 

 Process flow diagram for a third-party auditing standard operating procedure. Figure courtesy of the author.

Based on this process flow, you can now start writing, detailing the activities. As you can see, the steps are numbered. This numbering establishes a connection between the text and the graphic; allowing anyone to quickly find the information either in the process diagram
or the instructions.

Regarding the question,how much or how little text is required—there is no simple answer. It depends on many factors, such as the size of your organization, how you structure your quality system, or the expertise of your personnel. A company with a staff count of five requires a different level of detail and amount of text than a company with thousands of staff in multiple locations.

If you structure your quality system such that the SOPs contain the “what to do” and the Work Instructions (WI) the “how to do” information, then the description for step 1 in the SOP can be as short as:

Company quality and operational management identify the need for an audit and request the company audit cadre to prepare for the audit.

Open the request in the audit management application following WI eyfds.

The audit preparation by the company audit cadre follows WI xyzzy.

Note: Typically, the need is identified as part of a supplier assessment or as part of a deviation

Note: The right to perform an audit should be documented in the quality/technical agreement with the third party

Note: The audit can be an on-site or a remote (virtual or paper) audit

If, however, you pack the “what to do” and the “how to do” all into one document, then this will become a large and more cumbersome-to-use document.

It is quite easy to change the structure of your current SOPs into this best practice one, every time you need to revise an existing SOP. This allows your staff to become continually more familiar with the new design and layout. And it should, iteratively, help achieve consensus between your departments as to the amount of detail required.

Siegfried Schmitt is VP Technical at Parexel.


Volume 46, Number 9
September 2022
Pages: 58, 57

When referring to this article, please cite it as S. Schmitt, "Best Practices for Developing a Third-Party Auditing SOP," 

A process flow diagram can help create an agreed-upon process flow for a third-party standard operating procedure, says Siegfried Schmitt, VP Technical at Parexel. 

Best Practices for Developing a Third-Party Auditing SOP

Q. In a recent audit, we received an observation because we do not have a standard operating procedure (SOP) for the archiving of electronic records. We keep our electronic data and records on our live systems. Why would we need such a procedure?

A. The short answer is because the regulations stipulate this. “For new systems, a Validation Summary Report for each computerized system should be in place and state (or provide reference to) at least the following procedure for data archiving (processes and responsibilities), including procedures for accessing and reading archived data” (1). It is, however, sensible to look at the reasons behind this requirement and why it is also good business sense to have such a SOP in place. Data and records that are governed by the healthcare regulations must be retained and be available throughout the mandated retention periods for the respective records. In the case of clinical data, this can be 25 or more years, and for manufacturing records (paper or electronic), this is typically five or more years.

Over such a period of time, almost every computerized system undergoes modifications for a variety of reasons. These include patching the system (e.g., for security), installation of new software modules (e.g., for enhanced usability), system upgrades, system retirement, or system replacement. Any of these changes may or will affect the electronic records in the system. Depending on the impact, it can or will be necessary to remove the records from the system and store them in an archive.

Despite best intentions and good planning, there is always the possibility of an unexpected need to archive electronic records. That could be because of an unforeseen system failure or because the system performance falls below acceptable levels. It is not acceptable to wait until such an event occurs to write a procedure for the archiving of records and data; instead, it is essential to prepare the SOP well in advance.

Archiving electronic records is rarely trivial. Simply printing out the records is unlikely to either assure the entire record is captured or to be compliant with the regulations (paragraph 7.7.2 in reference 2). Archiving must take into consideration the regulations for automated systems and the guidance on data integrity. Especially:

If data are transferred to another data format or system, validation should include checks that data are not altered in value and/or meaning during this migration process (2)

Data may be archived. These data should be checked for accessibility, readability, and integrity (2).

Practical guidance has been published by various regulatory authorities (3,4) and industry associations (e.g., Appendix O1: Retention, Archiving, and Migration in reference 5).

In summary, having an electronic-records archiving SOP in place is not only a regulatory requirement, but it also makes sense from a business perspective. After all, you want to be sure that you can access your data and records throughout their lifespan and to be certain that the values and information therein is still correct and complete. Writing the SOP, however, is only a first step, implementing the process and validating it are the necessary and logical next steps.

 Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments 

Data Integrity and Compliance With Drug CGMP

Questions and Answers, Guidance for Industry

‘GXP’ Data Integrity Guidance and Definitions

When referring to this article, please cite it as S. Schmitt, “The Difference between Electronic Records Retention and Archiving,” 

An SOP for electronic-records archiving is a regulatory requirement and good for business, says Siegfried Schmitt, vice president, Technical at Parexel. 