The global supply chain for the pharmaceutical industry has expanded during the past decade as companies have striven to be competitive and harness emerging technology. Foreign markets have emerged to offer lower costs for various products. Many companies find managing global suppliers and product-quality issues to be challenging. Recent industry events such as the contamination of batches of heparin demonstrate that a lack of control in the global supply chain can lead to patient harm and death, product recalls, loss of integrity, and significant financial liability for a company. Current good manufacturing practice (CGMP) regulations state that companies that design and manufacture pharmaceutical products must ensure that all components, raw materials, and product from suppliers meet predetermined specifications and that suppliers and their operations are in a state of control. 

In today's climate, companies should use a risk-management program to assess their suppliers' ability to provide material suitable for the manufacture of medicinal products. A risk-management program should help companies evaluate and control the quality of their suppliers and of the supply chain. The US Food and Drug Administration's Pharmaceutical CGMPs for the 21st Century initiative is intended to enhance and modernize the regulation of pharmaceutical manufacturing and product quality. Its goal is to bring the pharmaceutical industry in line with the risk-management activities the medical-device industry uses to reduce patient and business risk. FDA's expectations are outlined in the International Conference on Harmonization's Q7, Q8, Q9, and Q10 guidelines. Several key elements can help control and limit risk throughout a global supply chain. This article will discuss risk prioritization, risk assessment, risk control, risk communication, and risk review in detail. 

Deciding how to begin implementing a supplier risk-management program can be challenging for established companies, let alone for startups. A risk-prioritization matrix outlines a systematic and objective approach that helps companies select the best starting point. 

One approach to developing a specific company's matrix is to create a list of manufactured and distributed products that includes key data. The following data may be considered in developing a risk-prioritization assessment:  

Patient risk (i.e., sterile, parental, nonsterile)

Quality data such as nonconformances, corrective actions/preventive actions (CAPA), deviations, and customer complaints

These data can be entered into a table similar to that in Figure 1. The individual data categories are assigned a numerical risk-ranking value as in the following example:  

Figure 1: Example risk-prioritization matrix. (ALL FIGURES ARE COURTESY OF THE AUTHORS.)  

Key quality data such as nonconformances, CAPA, deviations, and customer complaints should receive values equal to their number of occurrences. 

Likewise, the risk value for the volume of product manufactured is equal to the number of lots or units produced. Typically, this value is weighted to reduce the chance that a low-risk product with a high production volume will become the highest priority. Values are multiplied to obtain a risk-prioritization score. The product with the highest score gets top priority. 

Once the products have been prioritized, a risk-assessment technique can be used to evaluate, control, and communicate the associated risk related to a given product. Failure mode effects analysis (FMEA) is currently used to assess supplier risk. A supplier FMEA does the following things:  

Lists each component of the product along with its function.

Identifies possible supplier-failure modes.

Assesses the severity of the supplier failure modes based on their effect on the end user. Product characteristics are identified as critical if patients are harmed when the characteristics are not controlled.

Lists possible causes of the supplier failure modes and estimates the number of occurrences for each cause.

Lists current controls to prevent or detect the supplier failure modes or causes and estimates how effective the current controls are.

One obtains a risk priority number (RPN) by multiplying predefined rankings for severity, occurrence, and detection. These rankings are typically numbers from 1 to 5 or 10. A threshold RPN should be identified, and suppliers whose risk exceeds the threshold should be considered unacceptable. Figure 2 provides an example of a supplier FMEA template (1, 2).  

Figure 2: Example supplier failure mode effects analysis template. RPN is risk priority number. 

Suppliers with RPNs that exceed the threshold value should be audited. Companies can conduct a full or modified audit, depending on the severity of the risk that prevented the supplier from achieving an acceptable RPN ranking. Key items to focus on during an audit include the quality of the supplier's risk-assessment program and how the supplier controls critical characteristics. Supplier audits are discussed in more detail below.  

The manufacturer and its supplier should work together to establish a plan to reduce the risk of quality nonconformances and agree on an approach for communicating and reducing risk. Approaches to reducing risk generally fall into two categories. 

 The industry prefers the easier approach, which is for the manufacturer and supplier to agree on a joint cooperative plan that reduces the identified risk to an acceptable level. This plan frequently necessitates further risk analysis of the supplier's suppliers and components (i.e., Tier 2 analysis, or analysis of a secondary supplier) to understand where the sources of risk enter the supply chain. In some cases, improved controls at the Tier 1 (i.e., primary) supplier, combined with improved inspection or processing by the finished-goods manufacturer, reduces risk to an acceptable level. Tier 3 or Tier 4) suppliers might be investigated to achieve acceptable finished-good product risk levels if the Tier 1 controls and mitigations are not sufficient. 

During the implementation of the corrective actions or risk mitigations, the supplier FMEA should be updated, and residual risk should be assessed. All revisions and updates to formal risk-management documents and reports should be reviewed and stored in a risk-management file established for that product. If risk controls and mitigations at the supplier and finished-goods manufacturer are exhausted and the risk remains unmitigated, alternative approaches to achieving robust quality may become necessary. 

Category 2: Establish an alternate supplier.

 A longer path toward achieving robust quality and low risk is to qualify an alternate supplier or to change the design or process so it achieves a higher level of quality. Category 2 is generally chosen only if the all plans for reducing risk at the current supplier have been exhausted or if the supplier does not cooperate in implementing a risk-reduction plan. It is useful to apply tools such as design for Six Sigma to the component's critical characteristics during the development of new or modified processes or component designs. 

If the finished product has a level of residual risk that is above the threshold of acceptability, even after all opportunities for risk mitigation and control have been exhausted or found to be economically infeasible, a company should perform a medical risk–benefit analysis to determine whether the product's benefits outweigh the harm that could result from using the end product. Figure 3 provides a flow diagram that shows the supplier-assessment process using FMEA and RPN.  

Figure 3: Supplier risk-assessment process. FMEA is failure mode effects analysis, and RPN is risk priority number. 

After the supplier risks have been identified, reduced to acceptable levels, and communicated, it is important to establish a formal agreement to ensure that the supplier maintains a state of control and the manufacturer is an active participant in the supplier's quality- and risk-management programs. An effective way to establish this relationship is through a quality agreement. The quality agreement is a contract between the pharmaceutical manufacturer and its supplier of critical components or materials used during the development and manufacturing processes. The purpose of a quality agreement is to clearly define supplier qualification requirements, product and process specifications, regulatory-compliance requirements, management responsibility, a risk-management plan and a comprehensive communication plan. 

The quality agreement should also specify the manufacturer's expectations for processing changes that the supplier considers. The supplier should inform the pharmaceutical manufacturer of proposed changes to their manufacturing process in a "Notification of Change." The pharmaceutical manufacturer can thus evaluate the impact of the change on its final product. The manufacturer's previously identified management team should approve the change before the supplier implements it. Even the smallest change to a supplier's process can have an immense effect on a manufacturer's product or process. Establishing and maintaining a quality agreement is essential to controlling this potential risk. 

Once established, the quality agreement should be periodically reviewed and monitored for effectiveness. Predetermined quality criteria such as the number of products out of specification, CAPA, and the number of product complaints should be measured, and trends should be investigated. The quality agreement must be evaluated regularly to ensure that required updates are implemented and communicated to each party in a timely manner. 

In addition to monitoring quality criteria, it is recommended that the manufacturer conduct periodic supplier audits to ensure and verify that the supplier is maintaining a state of control, meeting the pharmaceutical manufacturer's requirements, and employing a quality-management review system. The manufacturer should evaluate its suppliers according to defined criteria and procedures. Results should be documented. Each supplier that a manufacturer selects should have a demonstrated capability of providing products or services that meet the established requirements specified in the quality agreement. Once a supplier is selected, its performance must be monitored periodically. The frequency of monitoring should be commensurate with the significance of the product or service the supplier provides. The complexity of the service and its potential effect on the finished product's performance also should be considered. 

Planning for a supplier audit is critical. Supplier audits should be scheduled according to the product and process risk assessments. The interval between audits should be established according to the significance of the material for final-product performance and the supplier's demonstrated ability to manufacture to the specified requirements consistently. An evaluation of the supplier's past history in providing similar products or services should be included in the assessment when possible. Written mail surveys or questionnaires frequently are used to assess the supplier's quality plan, test and inspection procedures, validation history and references, and the results of previous regulatory inspections or registration audits. Often, one set of questions will not fit all suppliers. Also, the focus of supplier audits can evolve as the relationship between the manufacturer and supplier matures. Though previous relationships with a supplier and registration to a specific industry standard such as ISO 9001 are important to manufacturers, they should not rely solely on previous audits and certifications as evidence that a supplier can provide acceptable products. Instead, manufacturers should conduct on-site supplier audits to assess supplier risk and establish conformance. 

The supplier audit helps identify nonconformances that occur in many processes throughout the product life cycle—from the design process to the manufacturing process to the distribution process. Supplier audits can build both parties' confidence and provide a system for high-quality technology transfer. 

In addition, an audit helps the supplier understand the pharmaceutical manufacturer's expectations. Supplier audits generally provide objective analyses of the vendors and can be fact gathering tools to ensure that the supplier meets the manufacturer's expectations, thus enabling control over the quality of the product.  

Because of the rapid growth of the global supply chain for the pharmaceutical industry, increased risk management is essential to ensure regulatory compliance and consumer safety. By implementing the ideas and tools described in this article, the pharmaceutical manufacturer will reduce risk, enhance patient safety, and ensure long-term success for its products.  

 is the director of product and process development, all at Regulatory Compliance Associates, 7401 104th Ave., Suite 160, Kenosha, WI 53142, tel. 262.842.1250, fax 262.842.1251, 

 is the president of Schniepp and Associates and a member of 

*To whom all correspondence should be addressed. 

Failure Mode and Effect Analysis: FMEA from Theory to Execution,

 (American Society for Quality, Milwaukee, WI, 2nd ed., 2003). 

Guidelines for Failure Modes and Effects Analysis (FMEA) for Medical Devices,

Articles

The growth and globalization of the pharmaceutical supply chain make risk assessment more important than ever for pharmaceutical manufacturers. The authors describe a program to identify, prioritize, mitigate, and communicate risks in manufacturer–supplier relationships.

Risk Management within the Global Supply Chain

Whether for reasons of risk management, capacity requirements, capital limitations, or lack of available human resources, pharmaceutical companies are increasingly entering into outsourcing relationships for the management of their supply chains. Outsourcing allows a company to realize the benefits of production and sales without maintaining infrastructure or making large capital investments. Although such relationships are advantageous, the pharmaceutical company entering into them retains ultimate responsibility for the quality of its compound. Therefore, careful consideration must be given in the selection and review of an outsourcing provider to ensure compliance. 

A company must first determine whether outsourcing is needed. The answer can be as simple or as complex as a given supply chain and may comprise several answers. The company must make a clear-eyed evaluation of its strengths and weaknesses, its available resources, and its risk tolerance to develop an outsourcing model that is applicable to its unique situation. For companies in need of outsourcing, this article serves as a guide for selecting where outsourcing should take place. 

The factors to consider when selecting an outsouring provider and the relevant questions a company should ask include the following: 					

Capability: Does the provider have the equipment, personnel, and experience to meet my outsourcing needs? Are investments needed to close any gaps to meet this needs? Does the facility have a history in my area of interest?

Capacity: Will my product be fighting for share of voice with others?

Commitment: Is the company financially sound? Have we reviewed their annual report? What is the long-term view of the company?

Competition: Does the company work with our competition? Do we have guaranteed access to capacity? Are there systems in place to protect proprietary information?

The first stage in entering into outsourcing, then, is ensuring that a potential partner has the infrastructure, experience, and financial health to provide assurance that the project will succeed. It will do no good if the company has excellent systems and equipment but is ready to shut its doors because of a lost contract. Conversely, a company with a strong balance sheet may not have the right experience that would be required. More, a sponsor company and its competition may arrive at the same conclusion, and so the sponsor's information must be protected and product supply needs must be ensured. With these answers, the sponsor company can proceed with confidence to evaluating the compliance capabilities of the supplier. 

Each product and process is different. Therefore, ensuring compliance in an outsourced model must take into account the specific needs of the product in the context of GMPs and other relevant regulations. 

In the United States, for example, the US Food and Drug Administration expects drug, medical device, and biologics manufacturers to have an active facility and supplier audit program, even though there are no specific requirements in the regulations that show that audits of the quality systems have been conducted. Although the word 

 Parts 210 and 211, the requirement for and responsibilities of a "quality control unit" are nonetheless elucidated. FDA currently takes a systems approach that includes the quality system, facilities and equipment, materials management, production, packaging and labeling, and laboratory controls. The elements of these systems are defined in 21 

 211 and in the various FDA guidances and should be included in the audit. 

Audit checklists can cover all areas of production, from the receipt of raw materials to final release of product, as well as support systems and controls. Or, they can be custom made by the auditor to ensure that each term in the audit plans is specifically addressed. The following are a sample checklists an auditor might use to perform a GMP lab audit. 

Does the quality assurance (QA) staff review calculations, weights, record completeness? Does it perform final approval?

Are procedures in approved, written documents?

Does the QA staff review all deviations and investigations?

Does the QA staff routinely review production records to ensure that procedures are followed and properly documented?

Is there a standard operating procedure that defines the QA department's responsibilities?

Is there a standard operating procedure (SOP) for investigation of out of specification (OOS) results?

Does it describe notification, investigations, product impact, corrective actions, trending, regulatory reporting?

Are investigations performed in a timely manner?

Are investigations thorough and complete?

Are corrective actions followed up in a timely manner?

Is all documentation associated with the routine testing approved?

Does the QA unit have an authorized person or department specifically charged with the responsibility of obtaining approval by signature/date for production and testing procedures, forms, and records?

Is there an SOP that defines the scope and roles and responsibilities for the document control and retention system?

Are all production and control records specifically associated with a batch maintained at least one year after the expiration date of the batch?

Is there a document control procedure that would prevent the use of invalid or obsolete documents?

Are there SOPs covering all elements of the change control process?  Do change requests include description, requirements (e.g., revalidation), impact evaluation, and effective date designation?  

Is change control documented, evaluated, and approved?  

Is a procedure in place to ensure that personnel are trained on the changes in a timely manner?  

Are customers notified of critical changes?

Review some change requests and ensure that they are implemented according to procedure.  

Are personnel trained to perform their assigned tasks? By what method? Are training materials, including GMP training materials, available?  

Indicate how on-going, periodic GMP training is accomplished, including training following an operator or analyst error.

Is all training documented in writing that indicates the date of the training, the type of training, and the signature of both the employee and the trainer?

Does a formal auditing function exist in the QA department?  

Does a written SOP specify who shall conduct audits and qualifications (education, training, and experience) for those who conduct audits?

Does a written SOP specify the scope and frequency of audits and how such audits are to be documented?  

The authors provide detailed lists of important checkpoints to consider when selecting an outsourcing provider.

Compliance in an Outsource Manufacturing Model: What to Look For

In considering the pharmaceutical supply chain and management of change, there are two particular areas in the processing cycle that can expose a company's products to risk. The first is at the start of the chain, when there is potential for contamination of raw materials—active or inactive. The second is at the end of the chain, when the finished product, sealed in its final container, is distributed. This article addresses both topics, their overall management, and individual product control strategies that a company might consider.  

Counterfeiting medicines presents a relatively safe way of generating money. Criminal organizations, with terrorists high on the list, are constantly seeking new ways to obtain funds. Sadly, the pharmaceutical marketplace has become a setting for them to do so. Active pharmaceutical ingredients (APIs) present an opportunity to infiltrate the system early in the supply chain, generating high income. With a little analytical knowledge and understanding of the types of incoming tests performed on materials at finished dosage form manufacturers, counterfeiters are finding sophisticated ways of introducing their fakes into the genuine supply. 

Counterfeit medicines are those that are deliberately contaminated or misbranded and constitute part of a wider group of substandard pharmaceuticals. Substandard products are manufactured beneath minimum recognized standards of quality and thereby pose serious hazards to the end-user. Unlike counterfeits, which are deliberately and fraudulently introduced into the supply chain, substandard medicines are often the outcome of incompetence or negligence. In either case, pharmaceutical companies and regulators alike have an interest in preventing these phenomena. 

Recent estimates from the World Health Organization (WHO) place the pharmaceutical counterfeiting trade as high as 10% of overall commerce in medicinal products. The horrendous growth rate of this bogus industry is set to overtake that of genuine pharmaceuticals by 2010. In 2006, WHO set up a global task force known by the acronym IMPACT, which stands for International Medical Products AntiCounterfeiting Taskforce. The taskforce suggested that key areas of activity tied to combatting counterfeiters include legislation, regulations, enforcement, technology, and communication strategies. However, WHO has stated that the primary driver for anticounterfeit measures should be regulatory agencies and enforcement activities. The US Congress has adopted a similar approach, mostly recriminatory, toward the US Food and Drug Administration subsequent to the heparin recall earlier this year. However, regulators and their regulations, while essential in reducing it, will never be able to entirely prevent criminal activity.  

The primary intent of good manufacturing practice (GMP) and good distribution practice (GDP) regulations is to provide minimum standards for those manufacturers and distributors interested in setting up effective quality systems and to minimize the likelihood of substandard products caused  by negligence or lack of knowledge. Where there is intent to defraud, it is industry that needs to proactively design preventive measures into its supply chain through company policies and procedures and effective training of concerned personnel. The self-interest of genuine pharmaceutical manufacturers to seal off potential penetration points for counterfeit product suggests that the ICH (International Conference on Harmonization) approach, in which legislators and industry representatives work closely to develop guidance, might result in the implementation of rapid and effective measures against those who have the potential to harm industry. Indeed, US regulators have already reached out to industry and set up at least one such task force, resulting in the Sept. 2008 PDA/FDA Supply Chain Conference held in Washington, DC. 

It is therefore appropriate that anticounterfeiting measures for the distribution chain be designed into a product as part of a company's control strategy. These measures can include electronic tagging, tamper-evident seals, holograms, and so forth, as a standard for both finished product and active substances as well as industry investment (possibly in conjunction with the electronics and security industries) in development of novel measures. 

The 2008 heparin recall resulted from contamination of the raw material with large amounts of chondroitin, which is difficult to detect, especially if a company is performing reduced testing (identity only) on most incoming batches. Whether the contamination was deliberate has not yet been firmly established, although there are indicators that it might have been. FDA has not come out of the episode smelling of roses–owing to a "computer glitch" that they inspected the wrong site. In its defense, FDA claims an unmanageable situation whereby the agency is expected to regulate a supply chain spreading across five continents with resources that barely suffice for the US alone. Where does this leave industry?  

Consider the following situation: Your company registered a new finished product in various markets worldwide. The applications are pending. Your purchasing department wants to change the supplier of either an active or key inactive ingredient because it found a new supplier who can give a per kilogram price that is 30% of the current cost. How will you handle the change? 

, finalized in June 2008, states: "The change management system ensures continual improvement is undertaken in a timely and effective manner while providing a high degree of assurance there are no unintended consequences of the change."  

In the current commercial environment, companies are constantly looking for ways to cut costs. One of the areas where, at first glance, substantial savings might be made is in sourcing of active and inactive ingredients. Your purchasing department, for example, may find from a quick Internet search that there is no shortage of suppliers, including manufacturers and, of still greater concern, brokers or distributors. The quality department, understanding that cost savings cannot be calculated by a price-per-kilogram comparison, is in a dilemma as to how to manage such a request. The request cannot be ruled out without investigation. A risk assessment might be a useful approach. A better option may be a product control strategy that assesses the hazards associated with changing a manufacturer of a raw material on a product-by-product basis during development, identifies potential points of entry for counterfeits, and aggressively designs controls into the supply chain. 

A product control strategy, according to ICH Q10, is defined as: 

 A planned set of controls, derived from current product and process understanding, that assures process performance and product quality. The controls can include parameters and attributes related to drug substance and drug product, materials and components, facility and equipment operating conditions, in-process controls, finished product specifications, and the associated methods and frequency of monitoring and control.

Using the Ishikawa (fishbone) diagram, an initial identification of risk associated with sourcing of raw materials can be constructed. Figure 1 provides one example of a partial assessment. To conduct a complete analysis, a multifunctional team should be established, preferably including persons from the development, production, quality assurance/quality control, laboratory, and purchasing departments. The diagram can then serve as a basis for performing a risk assessment such as the failure mode and effects analysis (FMEA) technique, for each point that was identified or for those points which the team designates as significant concerns. For example, microbial issues might be related to potential uses of an API by the end-user. Therefore, as a purchaser, one of the questions to ask the supplier or manufacturer is whether it has performed a risk assessment for microbial control of its process. ICH Q6: 

Specifications: Test Procedures and Acceptance Criteria for New Drug Substances and New Drug Products

 provides decision trees for setting microbial specifications, so this could help the API vendor in performing its risk assessment. However, your company may need the vendor to refine the assessment based on your intended use (e.g., their current customers have used the product in solid oral dosage forms but your company plans to use it for parenteral administration; therefore, your microbial requirements will be more stringent).  

An initial questionnaire can provide useful insight into the quality system of the vendor and regarding other products manufactured by the vendor at the same site. For example, does the vendor have a risk management policy? Does it produce beta-lactam products, potent hormones, or pesticides? Ask about nonpharmaceutical activity at the same site. What type of quality system does it have in place and who releases batches? The initial decision to continue to investigate or reject the supplier out of hand should be based on the outcome of this initial risk assessment. 

After the risk assessment, your company will need to perform an on-site audit which should be planned with precision. Your time on site is going to be limited, so obtaining as much information about the company as possible upfront will be beneficial. 

Try to find out whether personnel at your potential supplier understand quality issues. Take a draft agreement with you addressing responsibilities (e.g., notifying you about changes, reprocessed or reworked batches, and major process deviations) that could result in a different impurity profile if not followed. Before approving a new vendor, make sure the new supplier/manufacturer (and you will need full information about both if using a distributor) is a quality partner willing to listen to and accommodate your GMP needs. 

Ask the supplier whether it has other manufacturing sites before you leave for your audit. You need to visit any site that is a potential supplier. Do not assume that if one site meets your requirements, the other(s) will be equivalent. 

Think about what the change to a new supplier will involve within your company regarding approved and pending applications and how they will be handled. Different markets take different lengths of time to approve variations or amendments to licensing submissions, so a global pharmaceutical company could find itself continuing to purchase material from its previous supplier for three to, in extreme cases, five years. As a result, the compay ends up having to segregate product destined for various countries. Additional stability studies and process validation may be needed as well. These activities will have to be handled as part of the change management plan. 

At the other end of the spectrum are distribution issues. GDPs constitute the part of quality assurance that ensures products are consistently stored, transported, and handled under suitable conditions as required by the marketing authorization or product specification. Storage, transportation, and handling are obvious points for entry of counterfeits into a supply chain and therefore require careful control. Although quality systems generally have well developed procedures in place for managing changes to the starting materials supply chain, the distribution chain may be a different story. Granted, in the past few years, distribution agreements have become far more sophisticated and commonly include a quality/technical agreement, but you need to ask yourself whether the resolution is sufficient. With distribution being a global activity in today's market, there are local laws and regulations that need to be addressed that may require relabeling or repackaging and again offer an opportunity for substitution of the real product with a counterfeit. Tamper-evident seals may not be a solution if the patient insert needs to be replaced with one in the local language. A formal risk assessment (e.g., Ishikawa follwed  by FMEA), can allow your cross-functional team to assess potential hazards in the distribution chain. A few items to be considered include:  

Responsibilities such as ownership of vehicles used for transport

Management of the product at the airport or throughout shipping

Handling of customs and verification that a genuine official opened a shipment (e.g., certified tape might be easy to forge) 

Temperature deviations (e.g., owing to a strike at the port) 

Activation of the temperature datalogger 

Having completed your analysis, take time to consider the unlikely. For example, after you put procedures in place to control all identified risks and sign a distribution agreement with your chosen contractor, how will your company handle a new distributor trying to grab the business? How much time and effort will your quality department need to invest to place the necessary controls in place with the replacement?  

In the case of change management and sourcing of starting materials and contractors for distribution, companies would be well placed to remember one of Deming's 14 principles for quality management: 

End lowest tender contract. Cease the practice of awarding business solely on the basis of price tag. Instead require meaningful measures of quality along with price. Reduce the number of suppliers for the same item by eliminating those that do not qualify with statistical and other evidence of quality. The aim is to minimize total cost, not merely initial cost, by minimizing variation. This may be achieved by moving toward a single supplier for any one item, on a long term relationship of loyalty and trust. Purchasing managers have a new job, and must learn it.

In a global environment, the hazards that exist at both ends of the supply chain require drug manufacturers to be cautious with regard to managing change. Unfortunately, drugmakers must also consider potential rogues within the growing counterfeiting industry waiting to make a fast buck. The current business environment obliges quality professionals to be willing to make necessary changes when proved justified. The way to manage these changes effectively is through partnering: first, partnering internally between your quality and purchasing departments; second, partnering externally with new vendors by ensuring they are on the same page with respect to quality systems. If appropriate risk assessments are made and controls are put in place based on the outcome, the changes should move forward smoothly and efficiently to the benefit of all parties.  

is president of Pharmaceutical Consulting Israel Ltd., 

Regulatory bodies around the world are now revising legislation, regarding counterfeit medicines, good manufacturing and distribution practices, and risk management.

Managing Global Change within the Supply Chain

Pharmaceutical pedigree requirements have been in flux for many years. State governments, federal agencies, and industry have battled over the most secure and efficient method to reduce counterfeiting and diversion by tracking the movement of drug product through the supply chain. 

Today, the confusing patchwork of governing laws requires that manufacturers, wholesalers, and distributors provide, at a minimum, a paper-based record of the quantity, manufacturing lot number, and purchase-order number of a particular drug. This process, however, leaves the documents open to human influence such as error and falsification. The World Health Organization estimates 5–10% of global pharmaceuticals are counterfeits. The US Food and Drug Administration's Office of Compliance reported that there were 1230 Class I and Class II drug recalls from 1997 to 2002—nearly four per week.  

FDA's recall classification system includes Class I recalls, in which the product can cause serious injury or death; Class II recalls, in which the product can cause a temporary or slightly serious health problem; and Class III recalls, which violate manufacturing or labeling laws but do not pose a serious health risk. In one case, the recall of 100,000 bottles of counterfeit cholesterol medicine cost a major North American pharmaceutical manufacturer $55 million (1).  

The methodologies used by counterfeiters are also improving. Not only are there more and more low-cost and illegal pharmacies proliferating on the Internet (many based in Canada and Mexico), but there is an ever-growing number of offshore manufacturers pushing unlicensed generic drugs into the US pharmaceutical supply chain.  

Industry and government recognize that pedigree information needs to be electronically recorded to better secure patient safety. Yet there is no agreement on the best way to make it happen.  

The federal government has been working for years to develop a standard for a secure electronic version of the chain-of-custody requirement (ePedigree), but it has stalled because of technical and legal challenges. Although initiatives remain to create a national ePedigree standard by as early as 2011, many states have enacted their own requirements for firms doing business within their borders.  

Taking ePedigree in a new direction, California is the first state to require that companies create a unique serial number for each saleable unit. The use of serialization in conjunction with a pedigree can help authenticate a drug, ensuring that it does not negatively impact patient safety and security. Serialization refers to a numerical system that assigns a unique number or identification code to each packaging unit. A serialization scheme is built around a code structure that typically identifies the manufacturer, the product type, and each specific item unit.     

Today, most drugs are not serialized at the item, case, or pallet level. A lot number and expiration date is stamped on each saleable unit (e.g., the box or inner-pack) of a pharmaceutical product. But very soon, each of these retail units sold within California will need to have its own unique serial number to distinguish it from other saleable units within the same manufacturing lot.  

This serial number, which is the key piece of data that enables the recording of every step in the chain of custody along the supply chain, must be created and maintained in an interoperable electronic system, along with the ePedigree. Implementing such a serialization solution creates a fresh set of challenges for enterprises working within the pharmaceutical supply chain. Because the vast majority of pharmaceutical manufacturers conduct business in California, organizations will be forced to comply. As a result, some believe that California's mandates will soon become the national standard. 

Pharmaceutical manufacturers, distributors, wholesalers, and retailers must begin the process of implementing solutions that support ePedigrees, incorporate serialization down to the item level, and generate ePedigrees at each point of shipment. For organizations that have already begun the implementation process or have yet to start, the key is to understand where and how serialization impacts processes once the product leaves the manufacturing line and enters the supply chain.  

Although the to-do list may seem overwhelming, it doesn't have to be. A solid serialized distribution plan is the first important step. When implementing a serialization strategy, many companies primarily focus on the finished product on the manufacturing packaging line, and, why not? The California requirement basically stipulates this. Many, however, do not realize that it is equally important to successfully manage the distribution of serialized product. By doing so, regulatory compliance can be realized more quickly. 

 There are three fundamental objectives and capabilities required for serialization within an organization's distribution operations as outlined below:   

Serialization of drug product, typically at the item, case, and pallet level, and management of the associated parent-child relationships of these levels to the saleable unit

Tracking all product movement events such as receiving, putaway, picking, packing, and shipping of serialized product, for which data is integrated with the existing business processes and systems

Tracking the associated serialized product with a shipment to trigger the generation of the ePedigree.

The industry vision is that all pharmaceutical products will be serialized at the item, case, and pallet levels during the manufacturing process. To do so, manufacturers need to consider designing the capability to serialize product during the packaging process. The question arises, should pharmaceutical companies embrace radio frequency identification (RFID) technologies or use less costly barcodes? The answer to both questions is "yes."  

EPCglobal, the governing body leading the development of industry-driven requirements for the Electronic Product Code, defined and ratified a number of serialization standards that offer direction for pharmaceutical companies implementing such solutions. Yet, industry still lacks a consensus on data-carrier technology. For simplicity, and to minimize costs, many manufacturers are leaning toward a 2D-barcode solution at the saleable item level and also at the case and pallet level. A barcode solution, however, makes the distribution process extremely difficult because each packed item requires a manual scan. Using barcodes does not generate the benefits of automatic identification RFID technology. Many distributors demand that manufacturers begin using the ultrahigh frequency RFID standard at the case level to minimize the complexity of the distribution process.  

If the lack of industry consensus on technology and data constructs has been an impediment to starting a company's implementation, there is reason to reconsider. There are several standards already ratified and more on the way covering the fundamental components of the serialization architecture such as tag data formats, data filter and collection, Electronic Product Code Information Services (EPCIS), and ePedigree. Many companies are effectively working with their trading partners to agree on interoperability standards in lieu of a final word from the industry. For example, in the consumer packaged goods (CPG) industry, brands such as  Wal-Mart and Sam's Club adopted standards that suppliers must meet.  

The key to a quick implementation is starting small while developing a business foundation for scaling up in the future. Early adopters' experiences have shown that companies are more successful in rolling out new pedigree and serialization technologies and business processes when they phase in implementation. It is important to work closely with partners to determine the best strategy and to ensure that processes are aligned. Be careful when jumping into a pilot serialization implementation project without considering how the entire enterprise will be affected by the change. As with most things, it's important to define a strategy and then execute. Consider the business implications of counterfeiting, diversion, and pedigree compliance, and how they relate to the organization.  

Full pedigree and serialization compliance affects all products. Companies previously planning a risk-based approach to serializing products in a phased manner over time must think strategically about encompassing all products, including pipeline products. It will also be important to take other regulations into account and develop a single approach for nationwide full compliance and interoperability.  

Understanding the technologies to use—and for what products—in a pragmatic and cost-effective manner is crucial to developing a cohesive product-security program. Until the industry ratifies standards, companies along the pharmaceutical supply chain will employ a wide range of data-collection technologies. Although a company may be starting with fewer stock-keeping units (SKUs), serialization solutions will need to use and support multiple technologies and data constructs. A serialization solution that uses both barcode and RFID technologies requires varying types of hardware. RFID technology requires tags and fixed-mount readers, and barcode technology uses fixed-mount or handheld scanners. Thus, the ideal serialization solution would allow for the capability to manage and orchestrate both types of data-carrier technologies.  

Once a strategy is developed and understood, the company is better prepared to define the appropriate initial implementation, its timeline, and plan for the cost of the overall solution.  

Many companies may find a serialization solution to be yet one more cost of doing business. If implemented properly, however, it actually helps improve the business operation and bottom line. In a July 2008 report from Forrester Research, analysts outlined key benefits and gains of creating supply chain visibility (2). According to the report, the types of benefits will vary depending on the level of tagging (i.e., pallet-, case-, and/or item-level tags) and supply-chain stage. The scale, timing, and duration of these benefits can be estimated by considering one or more key metrics and the value of improving those metrics over time. Benefits include reduction in recalls and returns, reduction in shipping errors, improved financial accuracy of order terms, direct labor savings, reduction in inventory shrinkage, reduced losses due to expiration or spoilage, reduced stock-outs, and inventory cost savings. A well-executed implementation, integrated with existing business and enterprise resource planning systems, provides a real opportunity to further automate and improve distribution processes and realize a positive return on investment.  

California is one of the largest markets for pharmaceutical manufacturers.  While other states have implemented similar, and less extensive measures, California is likely to have a greater impact on the pharmaceutical supply chain at the national level. The key to making the transition for manufacturing and information technology operations as seamless as possible is not to wait for standards. Industry consensus on technology and data constructs is lacking. Thinking strategically as to how serialization will affect the entire enterprise, while roping trading partners into this process, will help define future business implications. It is important to be cautious, but even more important to act early to implement a system that not only complies with state and future federal mandates, but also offers overall business value. 

 is the vice-president and chief marketing officer at Acsis, 3000 Lincoln Drive East, Marlton, NJ 08053, tel. 856.673.3000, 

 1. G.M. Gaul and M.P. Flaherty, "Lax system allows criminals to invade the supply chain," 

2. R.C. Wildeman and P.M. Connaughton, "The ROI Of RFID For Supply Chain Visibility," Forrester Research, July 18, 2008. 

California's ePedigree requirements call for item-level serialization beginning in 2011. The author explains factors to consider when implementing a serialization strategy and how to achieve a positive return on investment.

Serialized ePedigree: From Planning to Execution

Past events, and unfortunately some recent ones, provide evidence of threats to the pharmaceutical supply chain. It is clear that excipients, active pharmaceutical ingredients (APIs), and pharmaceutical products can be counterfeited, contaminated, purposely mislabeled, and adulterated. Although the authors concentrate on excipients in this article, a review of incidents involving all of these product types and similar ones show the diversity of causes and the complexity involved in preventing these incidents. As reported by the World Health Organization, the Center for Medicines in the Public Interest predicts that counterfeit drug sales will reach $75 billion globally in 2010, an increase of more than 90% from 2005. Just as dangerous is the counterfeiting or contamination of the ingredients used to manufacture pharmaceutical products. 

Recent deaths associated with heparin imported from China have drawn attention to APIs. The discovery of  over-sulfated chondroitin in heparin was directly linked to some of the deaths. The speculation of how this chemical came to be in the API ranges from accidental contamination to purposeful adulteration to a change in the process for harvesting the heparin from pigs as a way to increase yield and reduce costs. These situations show the importance of the process for receiving and approving pharmaceutical starting materials in a fully integrated and robust quality system. 

The most tragic incidents involving excipients have involved glycerin, an artificial sweetener (see Table I). These tragedies were caused by diethylene glycol (DEG). Most cases of DEG poisonings are believed to have occurred because of pharmaceutical counterfeits that contained glycerin (also known as glycerol), which is widely used in drug formulations and personal-care products. DEG and glycerin are both clear, odorless, sweet-tasting liquids, but DEG is much easier and cheaper to manufacture. As a result, DEG poisonings have typically occurred because of greed as well as poor quality control for receiving and approval measures during the formulation and dispensing of medications.  

Table I: Select incidents involving adulterated ingredients.			

Other recent examples include toothpaste containing DEG and pet foods manufactured with wheat gluten contaminated with melamine. These examples serve as clear warnings of threats to pharmaceutical supply chains and also provide insight into measures that must be taken to avoid similar tragedies.  

Excipients are used in food, beverages, nutritional supplements, personal-care products, and industrial products in addition to pharmaceutical applications. The food and beverage industry is the primary market for many excipient manufacturers. Facilities producing food ingredients or food additives that are also sold as excipients are usually dedicated to a single product or product families produced under food good manufacturing practices (GMPs) (1). These products typically ship from the manufacturer in finished-goods packages or in bulk to distribution facilities that may hold and package or transfer the product for regional delivery. This situation presents unique challenges in the excipient supply chain because food GMPs do not contain the appropriate controls for pharmaceutical excipients. The Joint International Pharmaceutical Excipients Council–Pharmaceutical Quality Group's (IPEC–PQG) Good Manufacturing Practices for Pharmaceutical Excipient Guide and the IPEC Good Distribution Practices (GDPs) Guide provide direction on the appropriate controls necessary to ensure pharmaceutical excipient quality. 

 The difference between food processors operating under food GMPs and pharmaceutical makers governed by drug GMPs influences the quality systems and operational controls their suppliers adopt. Food GMPs focus on sanitation to prevent the introduction of contaminated or spoiled food. They do not include provisions on quality that ensure the taste, aesthetics, or health benefits of food. GMPs for finished drug products focus on the controls necessary to ensure the identity, strength, quality, and purity of the drug product. The rule of thumb of food regulation is that ingredients should not harm the consumer. The emphasis of drug regulations is that the products also must provide benefit to the health of the patient. Food GMPs do not require specifications for food ingredients. GMP requirements for incoming-goods inspections in the food industry involve inspection to ascertain that the ingredients are clean and suitable for processing into food. Raw materials are often purchased under a supplier's letter of continuing guarantee that assures the ingredient meets food GMP requirements for the absence of pathogens, natural toxins, pests, or extraneous matter. Food-ingredient suppliers provide a letter of continuing guarantee stating that the products shipped will not be adulterated under the Food, Drug and Cosmetic Act in place of certificates of analysis (COAs). Manufacturing personnel release food ingredients for shipment through process-control data monitoring. Their internal audits and controls focus on sanitation inspections, product protection, and cleaning schedules. 

 In contrast, drug GMPs require testing of each component for conformity with all written specifications to assure the purity, strength, and quality of the finished drug product. As a result of their customers' requirements, excipient suppliers have written release specifications for their products that rely on sampling and testing by a quality unit. Excipient manufacturers provide COAs for each lot that conveys the results of such testing. Internal audits and controls for excipient manufacturers ensure that procedures are followed to produce consistent quality excipients. 

 Fungible distribution practices in the food ingredients and industrial chemicals markets, where the same ingredient from multiple manufacturers and manufacturing locations are comingled in a common storage tank, are commonly used to reduce distribution costs. Compatible ingredients may be unloaded into storage with no cleaning, relying on the high dilution factor to maintain product conformance. Samples from these tanks are periodically collected by contract surveyors and tested in local laboratories against multiple specifications to identify suitable customers. When a food ingredient or additive is sold as an excipient, the test results on a COA may list each parameter in a 

) monograph with a statement such as "meets 

 specifications." This misleading statement, which indicates conformance to the monograph, implies to the pharmaceutical user that the excipient was manufactured and distributed following appropriate GMPs and GDPs. Conformance to food GMPs is insufficient to assure that the ingredient quality system adequately conforms to excipient GMPs. As such, product testing simply to determine compliance with a 

 monograph does not mitigate risk and does not indicate that a food ingredient or additive is suitable for use in drug manufacturing. 

It is paramount for the pharmaceutical manufacturer or user to know where and how the excipients were manufactured and to understand the excipient supply chain thoroughly. The pharmaceutical user is responsible for knowing the excipient pedigree (2). Qualification of the excipient manufacturer begins with the pharmaceutical user's request for information concerning regulatory, quality, and site-security details using the Excipient Information Package (EIP) (3). In the past, an excipient manufacturer would receive questionnaires from each customer, requesting similar information but in different formats and with differing expectations as to the details. IPEC developed the EIP in a standard format, based upon the material safety data sheets that are widely used to convey safety information, to facilitate the communication of this information. This standard document benefits the excipient manufacturer because it provides the essential information that all pharmaceutical users need while assuring the pharmaceutical customer receives detailed information and is notified of changes to the content of the EIP (4).  

Many times excipients are not sold directly to the user, but instead go from the excipient manufacturer to a distributor that sells them to the pharmaceutical user. Distributors should maintain the manufacturer's EIP on file to facilitate the delivery of the document from the excipient manufacturer to the pharmaceutical user.  

Qualification of the excipient manufacturer by the pharmaceutical user also requires confirmation that the excipient was produced and handled in conformance with excipient GMPs and GDPs. A site audit of the entire supply chain is the only suitable way to assure conformance. The excipient manufacturer and any and all distributors in the supply chain should be audited.  

The excipient manufacturer should be audited for conformance with excipient GMPs (5–6). IPEC has issued a companion audit guide to facilitate site audits (7). An audit should confirm that the excipient was produced at the site with a quality system that is in substantial conformance with GMPs. Although an audit of the excipient manufacturer is customarily done by the user, it is acceptable practice to use a qualified third party to perform these audits.  

The user should also audit all distributors that are part of the supply chain for conformance to GDPs (8). IPEC has also issued a companion audit guide to facilitate audits of distributors (9).  

 Requirements for a distributor to comply to GDPs vary based on the distributor's services, which can range from warehousing and distribution to repackaging into smaller containers to packaging from bulk storage. For instance, a distributor that warehouses and ships excipients only has to comply with GDPs. A distributor that packages or repackages excipients, however, must also meet various GMP requirements regarding protection of the excipient from environmental contamination or degradation during packaging operations, proper labeling, suitability of the packaging components, maintenance of retained samples, and ongoing stability testing. 

Proper receipt and approval of incoming components is the final step in assurance of the supply chain, and care must be exercised for excipient security. Although it is customary for the user to inquire or specify excipient packaging and labeling, compliance may not be verified at receiving. The emphasis at receiving is confirmation that the package has protected the excipient followed by quality-control sampling. 

To provide assurance that there has been no tampering with the excipient at the distributor or in-transit, it is important to identify the original manufacturer's packaging, labeling, and tamper-evident seal. This review also applies when the excipient has been repackaged or packaged from bulk at a distributor. 

At minimum, the manufacturer's description of the excipient packaging, labeling, and tamper-evident seal should be available to the people responsible for assessing incoming components. A catalog of electronic photographs of the excipient manufacturer's packaging, including contact packaging, labeling, and tamper-evident seals, should be available at receiving. Procedures can then be established to require comparison of the excipient received with those reference photographs to confirm the manufacturer's original packaging, labeling, and tamper-evident seal. 

Once the physical appearance of the excipient packaging has been confirmed, the excipient is sampled according to a scientific sampling plan. This plan should be developed with an understanding of the homogeneity of the excipient lot. Care should be taken in combining samples from individual containers and subsequently removing an aliquot for testing because it is important to first assure the homogeneity of the combined samples. The practice of only performing the identification tests on an aliquot of the combined samples is not recommended. Identification tests should be performed on each sample taken in the scientific sampling plan. 

Examination of the COA is ordinarily the final step in the incoming inspection of components. Although it is important to verify that the test data conform to the appropriate monograph or specification, it is also important to confirm the veracity of the document. Ordinarily, there are no concerns with the authenticity of the COA when provided to the site electronically directly from the manufacturer. When the COA is received along with the shipment, the appearance of the COA should be examined for any signs that it may have been altered. 

Periodically, it is important to confirm the security of the supply chain. This process involves the following:								

Verifying there is a current assessment of the manufacturing site and all distributors that provide the excipient. 

Tracing the shipping papers for a lot (i.e., the manufacturer's bill of lading) back to the excipient manufacturer. This trace can be achieved by having the excipient manufacturer confirm that the lot in question was produced at its facility and shipped as indicated on the bill of lading that the manufacturer provided for shipment to its customer or distributor. 

Confirm that the COA for a lot has come from the manufacturer indicated on the document by asking the manufacturer to send the customer a duplicate COA or by asking the manufacturer to confirm the identity of the COA received in conjunction with a designated lot of excipient. 

By following the measures described in this article, the excipient supply chain can continue to provide excipients that are suitable for use in pharmaceuticals. 

, is vice-president and chief operating officer, and 

, is president and CEO, both at International Pharmaceutical Excipients Auditing,1655 N. Fort Myer Drive, Suite 700, Arlington, VA 22209, tel. 703.351.5266, 

, is global director of quality of J.M. Huber's silica business unit. 

, is director of quality and regulatory policy for worldwide pharmaceutical sciences at Pfizer. 

 is director of global regulatory affairs at Colorcon, chairman of the International Pharmaceutical Excipients Council of the Americas (IPEC–Americas), and a member of 

 (US Government Printing Office, Washington, DC) Part 110, pp. 216–226.  

 2. IPEC, "White Paper on Excipient Pedigree," manuscript in progress as of Sept. 3, 2008. 

 Standardized Excipient Information Protocol User Guide

 4. D. Klug, A. Van Meter, and Laura Horne, "The Excipient Information Package, A Win–Win Solution," 

 26  General Chapter <1078>, "Good Manufacturing Practices for Excipients." 

The Joint IPEC–PQG Good Manufacturing Practices Guide for Bulk Excipients

The Joint IPEC–PQG Good Manufacturing Practices Audit Guide for Pharmaceutical Excipients 

The IPEC Good Distribution Practices Guide for Pharmaceutical Excipients 

Securing the integrity of the excipient supply chain is a crucial task in ensuring the overall pharmaceutical supply chain. The authors outline excipient-control strategies and practices for the manufacture, distribution, and receipt of excipients.

Excipient-Control Strategies

-Janet Woodcock, director, Center for Drug Evaluation and Research (CDER)

"Heparin was a wakeup call," demonstrating that we "need vigilance throughout the supply chain," said Woodcock. Solving these issues is "going to take a lot of harmonization" given the challenges. These challenges include: an explosion of global manufacturing, increased complexity of the supply chain, greater potential for exploitation, a global regulatory system that is still fragmented, US erosion of inspectional coverage, and a lack of modern information technology systems.  

"Globalization is taking over as the standard of the day....," added Woodcock. To move forward from here, we need "seamless, effective global regulatory collaboration" with a worldwide safety net and increased effectiveness of inspectorates in developing countries. We also need fully harmonized quality standards in ICH (International Conference on Harmonization) and non-ICH regions, manufacturing modernization, harmonization of pharmacopeial stands, agreed-upon methods for supply-chain security, and better information technology, including better automation and standardization of global inventory. 

In terms of responsibility, Woodcock discussed the fact that manufacturers must take responsibility for pharmaceutical quality of their products and for the integrity of their own supply chains. Regulators must adopt standards that ensure a safety net and take actions against poor quality, while enabling continuous improvement. Standards and technical organizations need to reach consensus on technical standards. Professional and technical societies must develop and update standards and disseminate them to industry 

For its part, said Woodcock, FDA is continuing with its Pharmaceutical Quality for the 21st Century initiative, intensifying its international outreach with programs such as Beyond our Borders, and keeping track of inventory of manufacturing establishments as well as movement of product. More efforts may crystallize after the upcoming presidential election with regard to legislation currently circulating within Congress. 

-Jeffrey Shuren, associate commissioner for policy and planning, Office of the Commissioner

The Interagency Working Group on Import Safety, established by executive order in July 2007, issued a strategic framework for an Import Safety Action Plan last November. We no longer want a "snapshot at the border, but rather a streaming video feed" of when risk arrives and how we can rapidly respond, said Shuren. The goal is to have a level playing field regarding standards, corporate responsibility, and global partnerships. Companies who are outsourcing or contracting out services need to "trust the 'good actors' but verify their compliance and impose stiff penalties on 'bad actors,'" he said.  

According to Shuren, FDA is continuing to work on "good importer practices" guidance, which will be available for comment. Guidance may involve certification of compliance with FDA standards before imports are allowed into the United States. 

-Joe Famulare, deputy director, Office of Compliance, CDER

"There are many initiatives on the table regarding third-party certification of suppliers, including parts of the Import Safety Action Plan and proposals on Capitol Hill," said Famulare. [The action plan calls for FDA to have the authority to require that producers of certain high-risk products in a particular country, under an agreement with that country, certify that their products meet FDA standards in order to export to the US.] "Other types of possible legislation changes may mandate that companies audit their suppliers," he added. "The main effort in this area is within ICH Q7: 

Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients (APIs)

Pharmaceutical Technology has summarized recent statements by FDA officials on supply chain issues to provde the agency's most up-to-date views and expectations.

Pharmaceutical Technology-10-01-2008

Risk Management within the Global Supply Chain

Compliance in an Outsource Manufacturing Model: What to Look For

Managing Global Change within the Supply Chain

Serialized ePedigree: From Planning to Execution

Excipient-Control Strategies

FDA Talks about Supply Chain Challenges