Steven J. Lynn is executive vice-president, Pharmaceuticals for Regulatory Compliance Associates, Inc.

Steven J. Lynn 

Q: Do I have to follow traditional pharma rules when I investigate deviations for my emerging therapy? 

A: There is really no process difference when performing deviation investigations for traditional pharmaceutical products versus biotech products versus advanced therapy medicinal products (ATMPs). The purpose of performing an investigation into a deviation is to determine why the deviation happened and what its impact was on the product quality. To determine the impact of the deviation on the product quality, it is important to determine the root cause of the deviation. 

The process used in the industry to determine root cause is, of course, the investigation procedure. This procedure, regardless of the type of product you are manufacturing, should require the investigator to review various systems and determine whether they were the cause of the deviation under investigation.

It is important to remember when performing an investigation to keep the following few general rules in mind:

One size does not fit all. Simple errors require simple corrections, while serious deviations require broader investigations.

The complexity of the investigation is related not only to the seriousness of the incident but also to the myriad of factors that could influence the outcome.

If you follow your investigation procedure and thoroughly document your results, you should have an acceptable investigation regardless of whether you are manufacturing a traditional product or a biotech product.

Volume 4 for ATMPs (1) supports this concept by stating, “As long as the specifications for the finished product are met, a QP [Qualified Person] may confirm compliance/certify a batch where an unexpected deviation related to the manufacturing process and/or the analytical control methods has occurred provided that: (i) there is an in-depth assessment of the impact of the deviation which supports a conclusion that the occurrence does not have a negative effect on quality, safety or efficacy of the product, and (ii) the need for inclusion of the affected batch/batches in the on-going stability programme has been evaluated, where appropriate.”

Q: I need to get my product to the patient before the traditional test for sterility is concluded. This requires me to release product at risk. Is there any way to avoid this?

A: The global regulatory authorities are aware that the ATMP manufacturers face this and similar situations, and rather than have you release your product at risk, they have offered guidance that not only recognizes this situation but offers solutions to alleviate it.

The European Union states, “[a]pplication of the sterility test to the finished product (

] 2.6.1) may not always be possible due to the scarcity of materials available, or it may not be possible to wait for the final result before the product is released due to short shelf-life or medical need. In these cases, the strategy regarding sterility assurance has to be adapted” (1).

In a 2020 Guidance for Industry, FDA recognizes that traditional analytical methodology may not be suitable for this product category stating, “Analytical procedures different than those outlined in the 

 (CFR) may be acceptable under IND [investigational new drug] if sponsors provide adequate information on test specificity, sensitivity, and robustness” (2). This guidance goes on to recognize the limitations of the traditional sterility test stating, “We recognize that the compendial sterility tests (

 <71>; 610.12) may not be suitable for all products (e.g., those with limited shelf life),” and “rapid sterility tests may be acceptable for ex vivo genetically modified cells administered fresh or with limited hold time between final formulation and patient administration” (2).

 both recognize rapid sterility in their respective publications. Chapter 2.6.27 of 

, titled Microbiological Examination of Cell-Based Preparations, allows for the use of automated growth-based methods or alternative methods such as a combination of direct detection by alternative methods or other methods based on the harmonized sterility test. The 

 has a general Information Chapter <1071> titled Rapid Microbial Tests for Release of Sterile Short-Life Products: A Risk-Based Approach. All of this information supports the concept that ATMPs are different and offer unique challenges regarding sterility. This recognition allows you to pursue options for demonstrating sterility including the use of rapid microbiological/sterility testing equipment.

The best way to proceed forward in getting approval for rapid techniques is to make sure you have performed the proper installation qualification/operational qualification and performance qualification on the equipment and have demonstrated its suitability for use with a complete validation package. In case there is an equipment failure, you should have backup methodologies identified as part of your quality risk management plans. The final word of advice is to make sure you and your organization have a robust, well-documented quality risk management plan that is in line with the concepts set forth in International Council for Harmonisation Q9 

EudraLex, The Rules Governing Medicinal Products in the European Union, Volume 4, Good Manufacturing Practice, Guidelines on Good Manufacturing Practice to Advanced Therapy Medicinal Products 

Chemistry, Manufacturing, and Control (CMC) Information for Human Gene Therapy Investigations New Drug Applications (INDs), Guidance for Industry


Vol. 45, No. 8
August 2021
Pages: 58, 57

When referring to this article, please cite it as S. Schniepp and S. Lynn, "GMPs for Emerging Therapies," 

Articles

Experts Susan J. Schniepp, distinguished fellow for Regulatory Compliance Associates, and Steven J. Lynn, executive vice-president, Pharmaceuticals for Regulatory Compliance Associates, provide answers to frequently asked regulatory questions about advanced therapy medicinal products.

GMPs for Emerging Therapies

Q. What is a deviation and do all deviations need to be investigated?

A. A deviation is when there is a failure to follow the instructions guiding the performance of how an activity should be executed for optimal results. Simply put, deviations result from people not following their standard operating procedures (SOP), work instructions, batch record instructions, or other documents that explain what needs to be done in performing certain functions or tasks. Deviations relate to non-compliance and are a serious issue. While not all deviations are equal in their impact on product and quality, all should be investigated.

A. In our opinion, there is no such thing as a planned deviation. Planned deviations were supposed to justify changes from SOPs that would be utilized to carry out the operation over a certain period of time. The current thinking by regulatory authorities is there is no such thing as a planned deviation. During a breakfast session at the 2018 PDA/FDA Joint Regulatory Conference, a representative from the FDA stated, “it’s a very strange term, and it kind of makes your skin crawl a little bit” (1). If you need to make a change to a procedure for a short period of time, we suggest you use the change control system to document the change. This may seem like a picky point, but until the change is evaluated for its impact on the process validation requirements and formally documented in a change control, encouraging the deviation’s continued use is supporting a posture of non-compliance.

Q. What’s the best process for investigating deviations?

A. There is no single best process for investigating deviations. The ultimate goal of deviation investigations is to determine why something went wrong, what caused it to go wrong, and how to address the issue and prevent its recurrence. To achieve successful resolution of deviations, keep the following general considerations in mind:

A one-size investigation doesn’t fit all situations. Simple errors require simple documentation while more serious deviations require broader investigations.

The best tool to have is inquisitiveness. Ask yourself how far this deviation could extend.

Widen your perspective. Look for ways to relate, not separate, similar issues.

Human error is rarely a sufficient root cause.

Always verify information or your instincts and never assume you are correct without proper data to support your instincts.

Q. Why is human error not an acceptable finding for deviations?

A. The overuse of human error as a root cause to a deviation represents lost opportunities to reduce future issues by masking the identity of the true root cause. Herein is the human error in Human Error. The question that needs to be asked during the initial investigation into a deviation is what caused the employee to make the human error? Asking this question early in the investigation leads to better root cause identification and opportunities for continued improvement.

Let’s look at an example that might help clarify why human error can mask the real root cause of a deviation. Suppose, for example, you have a second shift manufacturing operator who continually forgets to sign a step in the batch record for a specific product. This operator is the only one who seems to have this issue. Your initial investigation into the first occurrence of the issue determines a root cause of human error. Because the operator works on the second shift, it is inconvenient to interview him directly, so you rely on the word of his supervisor that this was just a case of human error. You decide to retrain the operator on the proper use of filling out the form and skip the operator interview in order to complete the investigation and perform the retraining in the allotted 30-day time frame. This scenario repeats itself 10 times over the course of four months. You finally decide to interview the operator directly. When you talk to the operator, he informs you that in order to sign the batch record when it needs to be signed, he needs to exit the aseptic core, degown, sign the batch record, and regown, leaving the product unattended during that time. The operator tells you he chose to stay with the product and sign the batch record later but sometimes forgot after the manufacturing run. In this simple exchange with the operator, you realize that the root cause of the repeat deviation is not a result of human error but a result of poor process flow.

Q. How much time should I allow for a deviation to be investigated?

A. The length of time it takes to complete an investigation depends on the complexity of the investigation. Simple deviations can be completed in a short time frame, but more involved deviations will take longer to complete. We recommend you set a time frame that is reasonable for your organization. For example, you might indicate that deviations will be investigated and completed between 30–60 days after the deviation was documented. This gives you some flexibility.

Q. Are out-of-specification (OOS) results considered deviations?

A. No. OOS results need to be investigated separately and quickly due to the potential impact to the product. If the root cause of the OOS cannot be attributed to laboratory error, you should initiate a deviation/investigation to determine what happened during product manufacturing that attributed to the erroneous laboratory result.

1.  B. Cox, FDA Compliance Experts Advise Against Treating Minor Changes as ‘Planned Deviations’, Pink Sheet, Oct. 5, 2018.

When referring to this article, please cite it as S. Lynn and S. Schniepp, “Frequently Asked Questions on Deviations,” 

Experts Steven J. Lynn, executive vice-president, Pharmaceuticals for Regulatory Compliance Associates, Inc., and Susan J. Schniepp, distinguished fellow for Regulatory Compliance Associates, Inc., provide simple answers to frequently asked questions regarding deviation investigations.

Frequently Asked Questions on Deviations

Experts Steven J. Lynn, executive vice-president, Pharmaceuticals for Regulatory Compliance Associates, Inc., and Susan J. Schniepp, distinguished fellow for Regulatory Compliance Associates, Inc., provide simple answers to frequently asked questions regarding regulatory inspections, although many of the concepts can be applied to internal and supplier audits as well.

Q. What documentation should I have ready to present to the inspectors?

A. There are a number of documents and supporting evidence that can be staged prior to an inspection whether it is in-person or is being handled remotely. The objective is to make the inspection process go smoothly for both parties. At a minimum, there should be a list of all current standard operating procedures (SOPs) provided to the auditor so they can choose the specific ones they are interested in reviewing, a listing of customer complaints for the past two years, a list of current closed and open deviations and corrective and preventive actions (CAPAs) for the past two years and the site’s quality manual, the current organizational charts, a copy of the employee training program, and a map of the facility. In addition, it is advisable to have a short introductory presentation (5–10 minutes) that describes the facility, the products produced, and the operating hours of the facility. This information can be provided up front for the inspectors.

Q.How long should an inspection/audit take?

A. There is really no specific time frame defined for an audit. Typically, supplier and internal audits should take between one to two days and a regulatory inspection typically takes three to four days. Any inspection/audit can be extended depending on what the auditors/inspectors observe during the inspection. If things go well, the inspection will be completed quickly. If problems arise, the auditors may wish to extend the inspection and pursue the issue. This time frame is consistent whether the audit is done in-person or remotely.

Q. Do I need to make copies of everything the inspectors request?

A. In organizing for an inspection, it is advisable to track all documentation provided to the inspector. This is an important activity whether the inspection is performed in-person or remotely. The inspection tends to run more smoothly when both parties are looking at and discussing the same documents. Whatever documentation is provided and kept by the inspector, it is advisable that the hosting site keep a record of the documentation being provided so they can refer to the specific document when responding to any observations associated with that documentation. Basically, the hosting site needs to have an accurate log, so they are able to recreate the audit activities after the inspector leaves. This is especially important when responding to the audit observation because it eliminates any questions about which document/information was discussed. Audits are fast paced, and anything that helps people remember what was discussed benefits the ability to understand and respond to any observations associated with the documentation that was reviewed.

Q. How much time do I have to answer a question after the inspector asks it?

A. There really isn’t a defined time frame to answer the questions. Questions that can be answered immediately should be answered immediately. Questions that need a little more investigation or clarification before answering should be responded to in a timely manner.

Let’s look at an example. If the inspector is reviewing a technical document, they may ask to see a previous version of the document. If this document is stored off site, then it may take a day or two to retrieve it. This is acceptable as long as you inform the inspector why there is a delay in providing the requested information. Bottom line, all questions and documentation should be answered as soon as possible, and if there is a delay, it is important to be transparent with the inspector and explain the reason for the delay.

Q. If an inspector makes an observation, do I need to have a corrective action in place before the inspection ends?

A. No, there is no reason to have a corrective action in place before the inspection ends. In some cases, the observation may be easily corrected, so it might be possible to have the corrective action in place before the conclusion of the inspection, and if the correction is acceptable to the inspector, it may actually help remove that observation from the final inspection report. Having said that, the best advice is to wait until the inspection is completed before you implement any corrective action so you can be sure the action is appropriate for the observation and you have had time to make sure related documentation and activities have also been updated in relation to the observation. 

Steven J. Lynn is executive vice-president, Pharmaceuticals for Regulatory Compliance Associates, Inc., and Susan J. Schniepp is distinguished fellow for Regulatory Compliance Associates, Inc.

When referring to this article, please cite it as S. J. Lynn and S.J. Schniepp, “Frequently Asked Questions on Regulatory Inspections,” 

Frequently Asked Questions on Regulatory Inspections

The audit function of a pharmaceutical company is one cornerstone of an effective and efficient quality management system. There are several types of audits that comprise a robust auditing program, including supplier audits, internal audits, and regulatory audits. Each of these specific audits requires preparation to make sure the audit is productive and accomplishes its intended purpose, which, in the manufacturing world, is to ensure facilities are manufacturing fit-for-use products in full adherence (hopefully more) to current good manufacturing practice (CGMP) requirements.

Supplier audits are performed to confirm that the suppliers of raw materials, packaging, and labeling components, etc., are able to provide a continuous, uninterrupted supply of the materials that are compliant with CGMPs. Regulatory authorities perform inspections to determine if the manufacturing company is providing materials that comply to CGMPs. Internal audits are performed by the company as a self-assessment for the purpose of identifying areas/issues that might affect their compliance status. Internal audits are solely under the purview of the company, while regulatory/supplier audits involve two distinct entities. Supplier audits are conducted using personnel from the supplier company and the client, and regulatory audits are conducted using personnel from the regulatory authority and the company being inspected.

Pre-pandemic, preparing for a supplier or regulatory audit typically consisted of the regulatory inspector or the auditor for supplier/internal audits providing the facility being audited with an agenda listing the areas to be toured (e.g., incoming raw material area, quality control [QC] chemistry and microbiology laboratories, manufacturing, etc.) and a list of documents to review (e.g., quality manual, list of standard operating procedures, open deviations, and corrective and preventive actions [CAPAs]) and any additional supporting evidence the auditor chooses to review. This information helps auditing authorities assess and decide the compliance status of the facility.

Performing external audits during a pandemic

The documentation that would have been reviewed on-site pre-pandemic is the same documentation that is needed for review during and post the COVID-19 pandemic. The documentation and supporting evidence review conducted pre-pandemic would most likely have occurred at the facility. However, audits conducted during the pandemic require the documents and supporting evidence to be shared electronically to the auditor using secure electronic systems. This electronic exchange helps make time more efficient for both the auditor and the facility being audited. The documentation can be reviewed by the auditor, and questions can be communicated to the audit manager via email or conference/video calls. While this may not be ideal, because it eliminates the in-person interaction, it is still an effective way to conduct an audit when there are conditions prohibiting face-to-face interaction.

Touring the facility is challenging when the audit is conducted during a pandemic, but the challenges are not insurmountable. Live video feed could be streamed to the auditor, while the company’s audit manager and/or subject matter experts are available to answer questions that might arise during the live feed. Additionally, operations could be recorded, and that recording could be provided to the auditor, again with the understanding that the audit manager would be available to answer any questions posed by the auditor upon the review of the video. While the recorded version of the tour is probably not the most ideal, because the auditor needs to see things in as real time as possible, it does allow for the auditor to pause and go back to review a specific operation in more detail if warranted.

Preparing for a supplier audit requires the same discipline as preparing for internal and regulatory audits. During the COVID-19 pandemic, many companies reduced the number of employees allowed at the site, and many of the quality personnel that conduct audits are allowed to work remotely.

Conducting a supplier audit is different from the other audit types, whether it is pre-, during, or post-pandemic. If designed and implemented appropriately, the value of the supplier audit is that it allows both the supplier and client company to find vulnerabilities in their existing supply chain and remediate them before they are discovered by an external auditor. Supplier audits should not be looked at as punitive from the supplier perspective. The best supply audits are ones where the client auditors are looked upon as partners in the overall continual improvement efforts of the supplier company.

Supplier audits can provide valuable information that can be used to prevent issues at the supply company before they become compliance concerns that may disrupt the supply chain. Issues that can be discovered during a regulatory inspection may be identified during a supplier audit. If these issues can’t be completely remediated before a regulatory audit, a plan to correct them can be established and action taken to mitigate them. Having corrective actions in place before others identify the issue may lessen the impact of the observation and instill confidence that the quality system is under control and there is a process in place for continuous improvement. In addition, the results from the supplier audit can be used for training staff and communicating valuable information to the organization.

The objective of a client when conducting a supplier audit is not to pretend to be the regulatory authority and show up unannounced, but rather to work in cooperation with your supplier to identify and solve potential issues. An effective program establishes a partnership between the client and the supplier so they can work together to solve issues before they affect the ability of either partner to supply material/product that complies to current standards. The ideal tone for a supplier audit should be a collaborative team-oriented activity that is instructive, informative, open, honest, and inclusive.

There are several factors that help contribute to establishing this tone, even during a pandemic. One way to set the proper tone is to publish the audit schedule/agenda in advance and make sure the functional areas personnel are informed of the schedule. During a pandemic, the agenda takes on another level of importance because it ensures that the site can have the proper documents ready to go and upload them either before or during the audit. Prior planning precludes poor performance in this area. Also, the audit itself should be forward thinking and unlimited in scope, even during the pandemic.

The auditor’s behavior is also important to obtaining valuable information. Auditors should be direct and avoid asking questions designed to intentionally stump people. Another important behavior is the ability of the auditor to listen to the answers personnel give and refrain from judging. The exact same behavior defined for the auditor should also be the exact same behavior displayed by the auditees. Auditees should be direct and avoid deflecting or obfuscating answers and take the time to explain why they do things the way they do them. They need to listen to the auditor’s concerns and not overreact to questions being asked. They should be proactive and point out things of concern and seek advice on how to remediate them. Both parties need to remember they are not enemies, rather they are the partners in improving their organization together.

The pandemic has allowed the industry to creatively utilize technology-based applications to communicate and perform an effective audit. The documentation and supporting evidence review can be conducted remotely, and confidentiality can be maintained. After reviewing the documentation and supporting evidence, the auditor can request interviews with various personnel, which can then be scheduled via video conferencing to accommodate both the auditor and the facility personnel.

The outcome is that, with appropriate planning and the proper use of technology, remote auditing can be as effective and informative as in-person auditing, as well as being more time and cost effective for companies who typically allocate a great deal of budgetary resources to an audit program. The post-pandemic sweet spot will likely be balancing remote and in-person audits.

Steven J. Lynn is executive vice-president, pharmaceuticals for Regulatory Compliance Associates, Inc., and Susan J. Schniepp is distinguished fellow for Regulatory Compliance Associates, Inc.


Supplement: Partnering for Bio/Pharma Success
February 2021
Pages: s24–s25

When referring to this article, please cite it as author, “Conducting Effective Audits During and Post Pandemic,” Partnering for Bio/Pharma Success Supplement (February 2021).

With appropriate planning and the proper use of technology, remote auditing can be as effective and informative as in-person auditing.