Siegfried Schmitt, PhD, is principal consultant withÂ PAREXEL, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q. We are a manufacturer of prescription pharmaceuticals, and we experienced many disruptions to our operations because of the COVID-19 restrictions. This made it difficult to fully comply with current good manufacturing practices (CGMPs). Is there a regulatory agency expectation by when we need to be back in compliance?

A. During the current pandemic, manufacturers have encountered difficulties in continuing operations while staying in compliance with regulations. Although there is a lot of talk about the “new normal”, when it comes to CGMP, there is no such thing, because the regulations have not changed, nor were they suspended. So, the question is not when you need to be back in compliance, but when you can resume normal operations in compliance.

Guidance for Industry, Resuming Normal Drug and Biologics Manufacturing Operations During the COVID-19 Public Health Emergency

 (1), in which FDA acknowledges that deviations from established CGMP activities have likely happened and provides guidance on how to address these issues. FDA writes, “This guidance describes how to evaluate and prioritize the remediation of CGMP activities that were necessarily delayed, reduced, or otherwise modified during the public health emergency in order to maintain production and the drug supply” (1).

A risk-based approach to remediating is necessary, as resources are strained, be it for employee illness and absenteeism, travel restrictions, site closures, social distancing measures, or supply chain disruptions (including services). Despite these difficulties, FDA reminds industry of their obligation to provide necessary medicines to patients and to maintain compliance with the regulations (i.e., to prevent disruptions to the supply chain, especially of medically necessary products) (2), or the release of products that would be considered adulterated. FDA emphasizes that, “CGMP requirements remain in effect during the COVID-19 public health emergency” (1).

With the COVID-19 pandemic, the supply of any type of drug, not just medically necessary drug products, is at risk. FDA therefore requests that, “A drug manufacturer whose manufacturing operations have been disrupted by the COVID-19 public health emergency should 

when there is a reasonable expectation that normal operations will be maintainable for an extended period of time

” [emphasis added by author] (1). In other words, companies must have a plan (e.g., based on a business continuity plan) on how to get back to normal operations on a continuous basis.

Before companies reach that situation, they may have departed from established CGMP activities. FDA requests that in these circumstances drug manufacturers perform the following (1):

Identify these deviations and any necessary remediation actions.

Evaluate these actions as part of their risk management approach.

Prioritize resumption activities based on the results of the evaluation.

FDA explains that, “Where critical CGMP activities were delayed, interrupted, or reduced in frequency, the batch should be quarantined and the decision to approve the batch delayed until remediation activities ensuring drug quality are completed. Such activities include, for example, critical quality attribute testing, investigations of critical deviations, and evaluation of unapproved changes to critical operations or materials. Drugs not manufactured in a manner that ensures their quality must not be distributed” (1).

The guidance document includes examples of areas where remediation may be needed. This section reminds drug manufacturers to be extra vigilant with regards to the supply chain (e.g., look out for economically motivated adulteration or changes to established logistics or transportation systems).

FDA points out in the guidance that a resumption plan, preferably in conjunction with an emergency plan, requires management leadership for successful execution and that such a plan should be based on a risk management approach. The concern must be the patient (i.e., the assurance of supply of drugs of the right quality). To come back to your question, this guidance document provides a wealth of information for manufacturers like yourself and you are well-advised to study it carefully.

Guidance for Industry, Planning for the Effects of High Absenteeism to Ensure Availability of Medically Necessary Drug Products

Siegfried Schmitt is vice president, Technical at Parexel.


Volume 44, Number 11
November 2020
Page: 58

When referring to this article, please cite it as S. Schmitt, "Resuming Operations During a Pandemic,"

Articles

Siegfried Schmitt, vice president, Technical at Parexel, offers insight into FDA’s guidance on performing operations during COVID-19.

Resuming Operations During a Pandemic

Q. We recently performed a detailed assessment of our computer systems for compliance with the applicable regulations, especially 21 Code of Federal Regulations Part 11 (1). The aim was to remedy critical systems first, if any gaps were found. However, almost all systems ended up in the critical category and many of these have compliance gaps. We do not have the resources to address all of these now, so how can we prioritize?

 Your approach to perform a review and apply a risk assessment (RA) is commendable and correct. As you did not provide details about the criteria in your RA and how you weigh them, my answer has to be generic as this is a common issue when it comes to computer systems.

The principles of computer systems validation (CSV) are not dissimilar to process validation. To validate a process, you need to have qualified equipment. Similarly, for CSV, you need to have a qualified infrastructure. Once this is in place, you can then validate software for business purposes. This allows you to focus your compliance assessment on the software.

The next step is to perform a straightforward triage (see

Next comes the risk assessment, and in order to do this logically and compliant, we should follow regulatory guidance. FDA guidance states, “The extent of validation studies should be commensurate with the risk posed by the automated system” (2). Guidance from the Medicines and Healthcare products Regulatory Agency (MHRA) in the United Kingdom states, “Validation effort increases with complexity and risk (determined by software functionality, configuration, the opportunity for user intervention and data lifecycle considerations)” (3). The key word here is complexity. When you look through your inventory of computerized systems, you should be able to at least make a distinction between simple and complex systems, such as a Karl Fischer titrator and a chromatography data management system.

The regulations demand that your validation is for the intended use of the computerized system. The intended use should be documented or referenced in the system inventory. All too often, companies fail to document the intended (i.e., actual) use of the system. For example, an electronic quality management system may have many modules, but you may only be using the documentation management and the training module. When you assess your system for compliance, make sure that you assess these modules specifically, instead of a whole range of installed, yet not used, modules.

Now you should have been able to identify the critical systems and the gaps in compliance based on intended use. It is generally possible to categorize the remediation effort for eliminating these gaps into short-, medium-, and long-term activities. A short-term solution may be to stop using a particular instrument; a medium-term solution may be an upgrade of the software or a revalidation exercise; and a long-term measure could be the replacement of a piece of automated equipment.

Coming back to your question, you may want to review your approach to assessing your systems and verify you really understand each item’s intended use based on the above recommendations. This should leave you with a much more manageable task in hand.

 Title 21 Part 11 Electronic Records; Electronic Signatures.
2.FDA, 

Data Integrity and Compliance with Drug CGMP, Questions and Answers, Guidance for Industry

‘GXP’ Data Integrity Guidance and Definitions 

Siegfried Schmitt is vice president technical, Parexel.


Volume 44, Number 9
September 2020
Page: 66

When referring to this article, please cite it as S. Schmitt, "Computer Systems Validation–a (Un-)Manageable Task?," 

An assessment can identify the critical systems and the gaps in compliance based on intended use, says Siegfried Schmitt, vice president technical, Parexel.

Computer Systems Validation–a (Un-)Manageable Task?

Q. In a recent audit, we were asked about the meaning of the signatures on our controlled documents. Our reply was that it clearly states that the signatories are either authors, reviewers, or approvers. The auditor considered our response insufficient, pointing out that we often have up to 10 reviewers. Though the names and titles of these are given, their review responsibilities are not defined or described. We are unclear how to make the meaning of the signatures more precise.

	A. The regulations do not provide much detail with regards to your question. For example, the European Union guidelines (1) require, “Documents containing instructions should be approved, signed, and dated by appropriate and authorised persons.” The US regulations are a little bit more specific in 21 

) Part 11 (2) regarding the signing of electronic records and state, “This information must include the printed name of the signer, the date and time when the signature was executed, 

 [emphasis added] (such as review, approval, responsibility, and authorship) associated with the signature.”

	The question is whether the meaning of the signatures in your documents is clear enough and unambiguous. Let us look at an example, such as a cleaning standard operating procedure (SOP) for manufacturing equipment. An author, most likely a member of the operations team, prepares the document. There will be several reviewers, possibly including manufacturing, engineering, validation, quality unit, regulatory affairs, and health and safety. These reviewers will each have a different perspective from which they perform their review.

	One could argue that the role and the associated job description define sufficiently what a reviewer has to do. In theory, yes; but in practice this is often not the case. Therefore, companies typically apply one of two approaches: either define the controlled documents review and approval responsibilities in a document (e.g., the SOP for SOPs) or add the meaning to each signature in the signature list.

 is an example of such a review responsibilities matrix.

	If we apply this to the cleaning SOP example, we would expect:

		The operators to check if the instructions can actually be performed (technical feasibility)

		Managers in manufacturing to check the functional correctness of the cleaning procedures (e.g., cross-reference cleaning validation reports) and to verify that the instructions are clear and logical

		The validation team to verify that the cleaning procedures are in concurrence with previously executed cleaning validations

		The quality unit to ensure that the document uses the correct template and format, that the procedure meets regulatory requirements, and that any related change controls or audit/inspection commitments have been met

		The regulatory affairs department to confirm that the procedure is in concurrence with the manufacturing licenses

		The health and safety executive to check that all required safety precautions are applied, for example, where flammable or corrosive solvents are used.

	In summary, it is good industry practice to clarify the precise remit for each of the reviewers of a controlled document, rather than just apply the general term of ‘reviewer.’ This does not have to be as difficult as the example herein.

	And finally: are you still sure you need up to 10 reviewers?

EudraLex Vol. 4 Part I Chapter 4 Documentation

.
	2. Electronic Records; Electronic Signatures, 


	Vol. 43, No. 11
	November 2019
	Page: 59

	When referring to this article, please cite it as S. Schmitt, "Signatures–What’s in a Name?," 

It is good industry practice to clarify the precise remit for each of the reviewers of a 
controlled document, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.
