Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q: We have been tasked by management to improve our processes and to enhance compliance. To achieve this goal, we intend to significantly increase the use of automated systems, replacing manual paper-based processes. It is a well-known fact that IT projects can easily end up in disasters as an Internet search will tell you. We want to be diligent. Can you share some best practices that can help us prevent or at least mitigate automation project failures?

A: Some things still need to be done by hand, such as typing the answer to your question. But automation is a necessity in a regulated healthcare environment, not merely for business optimization reasons, but also for being able to operate in a compliant manner. The keyword here is data integrity. For example, every time someone performs a manual transcription of data (e.g., typing a measurement into a form), there is a chance of a typing error. Even when you check and double check, you will never be able to reduce the error rate to zero. That alone is reason enough to eliminate manual entries, wherever possible.

The following are some suggestions that can help you on your road to success when automating processes.

Benefit from others’ experience and expertise. Well-known and widely used methodologies include COBIT (Control Objectives for Information and Related Technology) (www.isaca.org/resources/cobit), ITIL–The IT Infrastructure Library for IT Service Management (ITSM) (www.itsmf.co.uk/), and Good Automated Manufacturing Practice (GAMP) (https://ispe.org/initiatives/regulatory/what-gamp), to name but a few. In simplest terms, make sure you have a well-structured, carefully planned, and professionally executed project.

Always have a plan B. In IT terms this could be a roll-back option (i.e., you restore the status as it was before). It will be better to continue working the old ways than not being able to work at all.

One should avoid transposing a manual paper-based process “as is” into an automated process flow. This will not really deliver an improvement. If we take the example of signing documents, then a piece of paper can only be signed by one person at a time. An automated process on the other hand should allow simultaneous signing by several signatories, using electronic signatures.

Automated systems almost always offer transactions that cannot be (easily) performed manually. Therefore, find out what the automated system will let you do that you could not have done on paper.

Avoid going live “big bang” style (i.e., stop any old process or system and use the new system only from day one). Yes, you will have tested the system and you have done dry runs, but the chances of things going wrong, users getting frustrated, clients becoming irate, and management being displeased are to be expected. So don’t do it. Use a phased approach; sometimes it is possible to switch on one module after another; use one site or one department as the trial site. This approach will limit the fallout from any system failures.

Avoid having user acceptance testing performed by the vendor or someone from the IT department, instead of the actual users. Invariably, users will do something totally unexpected and will stress test the system in ways that those who are experts in the system could never imagine. I vividly remember situations where I was told by IT “but this has never happened before”. The clue is in the expression ‘user acceptance testing’.

Don’t buy the sales pitch (“this is the all-singing, all-dancing system”), when all you actually need is one tool to handle one very specific process. Overly complex systems will only mean that users will find ways and means to bypass the system, and the benefits of having an automated system will be lost.

Of course, these are only a few suggestions, and there will be many more that can be found online and through other channels, such as industry organizations. Good luck with your endeavors.

Siegfried Schmitt is vice president, Technical at Parexel.


Vol. 45, No. 9
September 2021
Pages: 62,61

When referring to this article, please cite it as S. Schmitt, “Improve Automation, but Beware of the Pitfalls,” 

Articles

Siegfried Schmitt, vice president, Technical at Parexel, provides best practices for switching from paper-based to automated processes.

Improve Automation, but Beware of the Pitfalls

Q. We are a US-based start-up company, and we are about to put our quality management system in place. One of our consultants advised us to review Form 483 and warning letters issued by FDA. We looked at some of them but are unsure what we are expected to find or what to do with the information in these documents. Do you have any advice?

A. At the end of an FDA inspection, the inspectors will document observations of deviations from the codified regulations on Form FDA 483 (1). This document contains only the inspector’s most significant observations. Other observations may be communicated to the company verbally during the inspection. Importantly, FDA does not classify its inspection findings (e.g., as critical, major, or minor).

The inspector(s) submits his or her report to a district office. The district office classifies an inspection in one of three ways:

Official action indicated (OAI), which means that the inspection was unsatisfactory, and the district advises enforcement actions.

Voluntary action indicated (VAI), which means that deficiencies were identified, but these can be resolved by the company without the need for enforcement action.

No action indicated (NAI), which means that no problems (or only very minor ones) were identified.

The district office will either issue an establishment inspection report (EIR) or, if advised, will take further action, such as issuing a warning letter. Warning letters are just one tool at FDA’s disposal to alert a firm to the fact its products are considered a risk to human health; therefore, authorities may take drastic action to safeguard patients (2). All warning letters are posted on FDA’s website and are visible to anyone interested, particularly the competition and customers. Making inspection reports easily accessible to the public is a peculiarity of FDA.

Redacted Form FDA 483s are available from FDA under Freedom of Information Act (FOIA) requests. Some commercial providers specialize in providing these at a fee.

What is the benefit of reviewing these documents, and what can you do with the information found? The rules and regulations (e.g., 21 Code of Federal Regulations Parts 210 and 211) describe the requirements a company must comply with. There are, however, many aspects that are not described in much detail, such as how to perform complaints investigations, how to respond to inspection observations in an acceptable manner, and much more. What you can glean from Form 483s and warning letters is basically an interpretation of the regulations (i.e., the agency’s thinking and expectations).

Of course, you need to filter the information and only review what may be relevant to your line of business. Still, there will be plenty of information that can help you avoid making costly mistakes. Bear in mind that the reported observation only tells part of the whole story, and there is much information, such as the actual product involved, that is confidential and thus not reported (i.e., redacted). As the observations on Form 483 are not classified, companies should take them all seriously. Not doing so could result in a warning letter, and that definitely would mean that the company is in trouble.

Making mistakes is human, repeating mistakes others made, and which have been reported in 483s or warning letters, is just plain careless and bad management. Unlike other regulatory agencies, FDA provides these valuable resources to anyone who cares to read them. It is a great opportunity for you to make good use of them.

,” www.fda.gov, accessed June 9, 2021.
2. FDA, “

When referring to this article, please cite it as S. Schmitt, “The Value of FDA 483s and Warning Letters” 

Regulatory inspection reports can be a valuable resource for quality management, according to Siegfried Schmitt, vice president, Technical at Parexel.

The Value of FDA 483s and Warning Letters

Q. Some 10 years ago, we implemented an electronic quality management system. Over the years, we have added some modules (e.g., for change control and deviation management). The system documentation was amended as changes happened. In a recent audit, we were given an observation: “Your system description does not meet regulatory expectations.” We are still unsure what is expected from us as we presented the system description given to us by the vendor, plus the validation documentation.

A. The regulatory authorities understand the importance of computerized systems in a modern pharmaceutical environment. They also understand the complexity of such systems and that these systems are likely to change over time. For that reason, companies must maintain an inventory of their automated systems, detail whether these systems are GxP-relevant, and if so, if these are validated. This is the very basis expected by the regulators. To understand the intended use of each system, a system description is also required. Your auditors found your system description deficient. You mention that you provided the system description written by the system manufacturer. This, I believe, is the key issue of concern.

Annex 11 of the European Union’s regulations state in paragraph 4.3: “An up-to-date listing of all relevant systems and their [good manufacturing practice] GMP functionality (inventory) should be available. For critical systems an up-to-date system description detailing the physical and logical arrangements, data flows and interfaces with other systems or processes, any hardware and software pre-requisites, and security measures should be available” (1).

Every company using the system will have different physical and logical arrangements, for example:

You may have 50 users, whereas another company may have 5000 users.

You may not have implemented any interfaces to other systems, whereas other users may have linked their system to other software packages.

You may use the system for GxP relevant documentation, whereas another company may only use it for non-GxP purposes.

Therefore, each company’s system description will be unique. The manufacturer can only provide a generic description, which can of course be the basis for your individual one.

You also mention that you do have additional pieces of information about the system, which can be found in the validation documents. That may be so, but these pieces of information are not consolidated, interlinked, or otherwise logically connected to fulfill the requirements of the regulations, which call for an up-to-date system description for critical systems. Your system is obviously critical as you use it for GxP-critical processes.

It doesn’t mean that you should copy/paste all the information that can be found in your validation documentation or elsewhere, into a document called ‘system description’. It is perfectly acceptable to provide the relevant links. A system description could therefore be structured like this:

System description. In a few sentences describe the name, origin, and intended use of the system (e.g., by installed system module [in your case documentation, change, and deviation management])

System history. Describe the key milestones in the lifecycle of this automated system.

Technical information and system validation. In a few sentences describe what system version is installed where and when it was last validated.

References. Here you provide the links to all the relevant documentation.

Following this advice, you should be able to prepare your system description, and I hope you will also find it a useful exercise as it will help you find all relevant information faster in future.

 EudraLex Vol 4, Annex 11 “Computerised Systems”

Siegfried Schmitt is Vice President, Technical at Parexel.

When referring to this article, please cite it as S. Schmitt, "Computerized System Descriptions–How Hard Can It Be?," 

System documentation should include a system description, history, validation information, and references, according to Siegfried Schmitt, Vice President, Technical at Parexel.

Computerized System Descriptions–How Hard Can It Be?

We have updated our vendor audit program for 2021, and the list includes several companies that perform transport and warehousing services for us. This is a new area for us, and given the continued travel restrictions, we are not certain how best to audit these companies. Can you give us some direction?

A: Good distribution practices (GDPs) are required by regulators in most regions. The United States is different from all other agencies as there are no separate GDP regulations in place. FDA covers violations of storage and distribution under good manufacturing practice (GMP) violations (1). The European Union has codified GDP in two directives (i.e., community law, which has been transposed into member states law) (2–4). In China, GDP is the law, they call it Good Supply Practice (5–6).

Service providers for the storage and transport of goods will have to comply with different regulations, based on their location and the specific type of services they provide. Generally, these companies will have to comply with GDPs. This means that it is essential to have a clear and unambiguous understanding and documentation of the precise nature of the services.

Let us look at an example for illustration: company A (headquartered in Germany) performs the road transport of drug substance and drug product from your warehouse in Switzerland to company A’s warehouse in Germany, where the goods are relabeled, picked, and packed for distribution to wholesalers in the European Union. Based on these activities, which include wholesaler activities, such as importation, storage, and transport, company A must hold a respective licence from the German authorities.

If you cannot audit on site, you have the possibility to perform a virtual audit via videoconference instead. Irrespective of the mode of audit, preparation is essential. This includes a detailed audit agenda, which in this case may look something like this:

Personnel qualification and training program

Subcontractor management including quality agreements

Shipping route validation, including security and risk management

Cold chain and ambient temperature shipping management processes, including vehicle qualification.

The three items in bold letters are those you may wish to focus on particularly, because the vast majority of service providers subcontract all transport. Subcontractors merely performing transport may not even have to comply with the GDP regulations by law. They may not even have a quality system, yet they are transporting your goods. You really want to make sure that company A, with which you have your contract, has a good system of subcontractor oversight. Such oversight may have to include training of the transport company’s staff in aspects of security and documentation (particularly with regards to temperature records).

In fact, the best way to understand who performs what activity in a supply chain is to follow it step by step. Request supporting documented evidence for each step. This way you will be able to fully understand who is involved, which procedures govern these activities, and how these are documented.

The previous example may not necessarily apply to your situation, but the principles are the same for any other supply chain scenario. Yes, the applicable GDP regulations differ from one jurisdiction to another and from one country to the next. One goal, however, is common to all, namely the protection of the patient from products that are adulterated, be it from inappropriate storage or transport conditions, or from falsified products entering the supply chain. Your audits need to evaluate if your service providers have everything necessary in place to assure that goal. Their licences will support that assertion but it will be your audit that proves it.

 Guidelines of 5 November 2013 on Good Distribution Practice of Medicinal Products for Human Use

 (Text with EEA relevance) (2013/C 343/01)
3. European Commission, 

Guidelines of 19 March 2015 on Principles of Good Distribution Practice of Active Substances for Medicinal Products for Human Use

 (Text with EEA relevance) (2015/C 95/01).
4. European Commission, 

EudraLex Volume 4, Good Manufacturing Practice Guidelines


5. CFDA, Good Supply Practice for Pharmaceutical Products (China Food and Drug Administration Decree No. 13) Issued on July 1, 2015.
6. CFDA, Announcement on the Revision of 5 Appendixes to Drug Good Supply Practice (GSP) Dec. 29, 2016.

Siegfried Schmitt is vice president, Technical at PAREXEL.

When referring to this article, please cite it as S. Schmitt, "Auditing for Good Distribution Practices," Pharmaceutical Technology 45 (3) 2021.

Auditing distribution suppliers provides understanding and documentation of the services performed, says Siegfried Schmitt, vice president, Technical at Parexel.  