Kathleen A. Pelley

Pharmaceutical companies that seek to hire a contract manufacturing organization (CMO) must consider information technology (IT) concerns when they evaluate service providers. A sponsor company must investigate the manufacturing automation and systems, laboratory automation and systems, IT infrastructure, and business applications of each potential CMO. The authors describe the criteria that help pharmaceutical companies hire the appropriate CMO for their project.

Pharmaceutical and biotechnology companies use a web of contract research organizations (CROs), contract manufacturing organizations (CMOs), and other service providers to produce clinical-trial materials, provide process and formulation development, resolve problems in scale-up, and produce commercial quantities of drug substances and finished products. Pharmaceutical and biopharmaceutical companies may also seek contract organizations that can provide day-to-day operating services for internal functions that are not considered core competencies. When an organization outsources many of its key business processes to contract partners, it may be considered a virtual enterprise. Managing various contractors is difficult under any circumstances, but this task is particularly challenging in the highly regulated pharmaceutical industry. Effective project management, well-planned service-level agreements (SLAs), practical quality assurance, and effective use of information technology (IT) are key elements in managing a virtual enterprise, even when IT itself may be outsourced. Shortcomings in any of these areas can cause the delicate web of the outsourced supply chain to fail (see Figure 1). 

A sponsor evaluates potential CMOs on the basis of their proposals, management experience, references, manufacturing capabilities, and record of compliance with good manufacturing practices (GMPs). The initial evaluation involves an assessment of a CMO's manufacturing facilities, processes, and supporting systems. A further assessment of the CMO candidates' quality and IT systems is crucial because these systems provide the sponsor with regulatory evidence, information and electronic reports, actionable data, and communications capabilities to monitor and manage the CMO. For example, the CMO's IT systems must be able to collect and report data on material-handling processes, laboratory results for active pharmaceutical ingredients, excipients, and finished products, as well as the manufacturing process controls (e.g., cleaning, sterilization, labeling, packaging) and the transport of the finished product.  

A potential CMO might initially appear to meet the sponsor's superficial manufacturing requirements but closer assessment of the CMO's IT and control systems might reveal underlying risks. Figure 2 identifies key areas to assess regarding CMOs' manufacturing and laboratory automation and critical IT components. 

Evaluating automated support and control systems as part of the due-diligence process in CMO selection is critical for identifying weak technology and business processes that will create risk for the sponsor. Depending on the size of the project to be outsourced, a preselection IT assessment of infrastructure, select systems and data, and communications capabilities should take between two to four days. A preselection IT assessment should include an evaluation of manufacturing automation and systems, laboratory automation and systems, the IT environment, and IT processes and controls. 

The sponsor must evaluate whether the CMO's automated manufacturing-control systems are qualified. These systems may either control or collect data from manufacturing process equipment or packaging equipment. The sponsor should assess the CMO to determine whether the CMO has defined processes or procedures for the installation, qualification, and validation of manufacturing equipment, systems, and processes. If these processes and procedures are absent, then the CMO probably does not have evidence of a consistent controlled qualification of its manufacturing equipment or systems (see Figure 3). 

The CMO should have records documenting the installation (installation qualification) of the equipment. These records will include the specifications and verification of materials, piping, wiring, vacuum, air supplies, and other equipment components as applicable. Records should also include functional and design specifications for automated equipment control. Often called programmable logic controls (PLCs), these computer systems are specifically designed to interface with certain types of manufacturing or packaging equipment. These computers' programs should be subjected to unit-level testing to confirm that they function correctly before they are integrated with the equipment. The connections and wiring between the automation or computer and the equipment should also be documented in wiring diagrams and verified as part of the qualification activities. 

The CMO should have documented evidence that the integrated equipment and automation have been tested together and shown to function correctly according to the given specifications. This evidence is often called installation qualification (IQ) and operational qualification (OQ) of the integrated unit. A final check should determine whether the CMO has documented procedures for the ongoing operation, maintenance, and change control of these integrated equipment units. If the CMO has performed these activities and retained the specifications and records, the sponsor can be confident that the CMO's automated equipment is qualified and ready to execute the manufacturing or packaging processes required to produce the sponsor's product. 

If the CMO candidate cannot produce the documentation discussed above, the sponsor could be at risk for increased costs. These qualifications will need to be performed to ensure that the sponsor's product will meet specifications and that the records will satisfy regulatory expectations.  

A CMO may also use various manufacturing systems that help execute the manufacturing business processes but do not control or interact directly with the manufacturing equipment. These types of systems include manufacturing execution systems (MES), inventory-control and materials-management systems, warehouse-management systems, and electronic-batch-record (EBR) systems. Because these systems are used to perform GMP activities, they should be validated. The US Food and Drug Administration provides its expectations for validation in 

General Principles of Software Validation; Final Guidance for Industry and FDA Staff

Evidence for validation of these types of applications includes a validation plan, requirements specifications, functional specifications, design specifications, configuration specifications, development-level testing, IQ protocols and results, OQ protocols and results, and either user-acceptance testing or performance qualification (PQ) protocols and results. An overview of the mapping between the specifications and testing should be presented in a traceability matrix. Standard operating procedures (SOPs) should exist for the ongoing use, maintenance, and control of these systems. Finally, a summary of the validation activities and evidence created should be presented in a validation summary report.  

As it did for the manufacturing-automation assessment, the sponsor should ask the CMO to provide evidence that it has defined processes for validating a manufacturing operation business application system. If the CMO can share with the sponsor a risk-based method for qualification or validation, it will demonstrate that it has achieved a high level of compliance sophistication (2). If the CMO has no documented processes for qualification, validation or ongoing control, this omission may be a source of compliance risk to the sponsor. A CMO with uncontrolled automated manufacturing equipment or systems can jeopardize the acceptance of a clinical study or the approval of a new drug application (NDA) or cause the recall of a commercialized batch of product. 

A final, subjective assessment of the manufacturing automation or systems area can be made by simply touring the CMO's manufacturing facility and observing its equipment, automation, and practices. The sponsor can look for some of the following indicators that may be warning signs of regulatory noncompliance, CMO financial instability, or inability of the CMO to meet contractual agreements with the sponsor: 					

				Automated equipment or computers that are independent and not networked together			

				Computer workstations that are active and unsecured even when left unattended			

				Computer workstations at which operators share one identification code and password			

				Automated control systems with unsecured computer code or programs			

Computer equipment in areas that are experiencing environmental extremes (e.g., of temperature, humidity, airborne particulate matter, or water) 

Computer cabling that is dangerously located and subject to damage or electromechanical interference. 

The subjective observation criteria can also be applied to the assessment of a CMO's quality-control laboratory, automated laboratory instrumentation, and laboratory systems. 

The sponsor should determine whether the CMO candidate will provide quality control (QC) laboratory capabilities and operations. In certain cases, the sponsor may decide to hire an independent QC laboratory contractor. If the CMO candidate is to provide QC capabilities, the sponsor must determine whether the CMO's QC laboratory instruments and systems are qualified. These systems may control or collect data from analytical laboratory instruments or help automate laboratory processes such as sample management. The sponsor should assess the CMO to determine whether it has defined processes or procedures for the installation, qualification, and validation of automated laboratory instrumentation, laboratory systems, and processes. If these processes and procedures are absent, the CMO probably does not have evidence of a consistent, controlled qualification of its laboratory instrumentation, analytical methods, or laboratory systems (see Figure 4). 

Laboratory instrumentation is considered differently than manufacturing equipment because the automation portion of the laboratory instrument is normally embedded into the instrument by the vendor. Thus, the analytical instrument and its embedded computer controls are installed as a single unit. The CMO should have functional and design specifications for the automated laboratory instrumentation and records documenting the installation (IQ) of the automated analytical instrument. These records may include the instrumentation specifications or installation instructions provided by the vendor. In the case of automated laboratory instruments, parameters will often be set or configured according to the intended use of the instrument. The CMO should retain a record of these configuration settings. 

A laboratory-instrument application software package often provides the functional interface between the automated instrument and the laboratory technician. At a minimum, functional requirements or specifications should document the functionality of the application. The CMO should also have documented evidence that this application software, and any associated computer hardware, has been installed according to the manufacturer's specification and the CMO QC laboratory configuration requirements (IQ). The CMO should also verify that the application communicates correctly with the automated instrument.  

Once these activities have been completed, the CMO should provide evidence that the integrated application and laboratory instrument have been tested together and shown to function correctly according to the given specifications. This is often referred to as OQ.  

As with manufacturing systems, a final check should determine whether the CMO has documented procedures for the ongoing operation, maintenance, and change control for this automated laboratory instrumentation and associated systems. If the CMO has performed these activities and retained the specifications and records, the sponsor can be confident that the CMO's automated laboratory instruments are qualified and ready to execute the analytical methods that the sponsor requires. The sponsor will specify the analytical methods that must be performed by the CMO's QC laboratory. The CMO will be responsible for validating the analytical method on its automated instrumentation and within its laboratory environment.  

If the CMO candidate cannot produce the documentation discussed above, the sponsor could be at risk for incorporating unacceptable materials into product, clearing unacceptable product for release, or maintaining inadequate specifications and records for regulatory purposes. 

The CMO may also use various laboratory or quality systems that help execute the QC laboratory business processes but do not interact directly with automated instrumentation. These types of systems include laboratory information management systems, laboratory-chemicals inventory management, material-safety data sheets management, and deviation-reporting systems. These systems may be governed by select sections of 21 

 Part 58 (Good Laboratory Practice for Nonclinical Laboratory Studies), and 21 

 Part 11 (Electronic Records; Electronic Signatures). The need for system validation depends on the system's intended use and the applicable regulations. If validation is required, the CMO should use a process similar to the one described in the manufacturing section. The sponsor should require the CMO to have similar documentation for this validation. 

The quality and capabilities of the CMO's IT systems and environment are as critical to the success and compliance of the sponsor as the CMO's manufacturing and QC laboratory capabilities. Figure 5 presents an overview of the components of the IT environment.  

During the preselection IT assessment process, early identification of weaknesses and risks in the IT infrastructure, applications, or data-management areas enables the sponsor to avoid hidden costs and compliance failures. 

 The following areas of the CMO's IT infrastructure should be evaluated: network and communications capabilities, servers, data-storage devices, and the facilities that house these primary infrastructure components.  

The facilities that house the infrastructure components should be inspected to determine whether they are adequately secure. Security can be provided by physical locks, password- or code-enabled locks, identification-card readers, or biometric sensors. The sponsor should also look for physical elements that ensure the safe, continued operation of the equipment within the facility or data center. Fire-extinguishing systems, heating and air-conditioning systems, uninterruptable power supplies and power-conditioning units, battery backup, and power generators protect the equipment and the data or records they hold. 

The CMO's networks provide the communications capabilities within the CMO's own organization and between the CMO and the sponsor. During the preselection assessment, the sponsor should ask the CMO candidate for an explanation of the networks and communications capabilities. This overview will help determine how the CMO approaches network design in the manufacturing, laboratory, and administrative or corporate areas. The sponsor should look for network design elements that provide the appropriate level of isolation, security, and performance for the functioning of the specific area. Isolated proprietary shop floor or laboratory networks are often used to protect the data and equipment or instrument controls from the day-to-day business or administrative operations and data. The CMO should have processes and controls in place for securing their internal network through user identification and passwords. 

Firewalls should be in place to provide additional security between the CMO's internal IT environment and the outside world. The network components that provide data exchange between the CMO and the sponsor should have the capacity and speed the sponsor requires. If electronic data exchange is a critical concern and requirement for the sponsor, actual transmission tests can confirm the connectivity and transmission speed between the CMO and the sponsor.  

The CMO should be able to pre-sent evidence to the sponsor that the network has been qualified accor-ding to industry good practices. The evidence should show that the CMO understands the current network configuration, knows that it is functioning properly, and has controls in place for the ongoing support and control of the network. 

The CMO should be able to present evidence that its computer servers have been properly installed and qualified. The evidence should include an inventory of all servers, configuration information for each server (e.g., vendor, model, major components, processor model, amount of memory), amount and type of other internal server storage, operating system and utility software installed along with the version and patch level, communications addresses, and identification of any application software (version and patch level) installed on each server. Controls should be in place for the ongoing operation, support, and control of the servers. 

If the CMO uses mass data-storage devices that are external to the computer servers, then it should show evidence that the data-storage devices were properly installed and qualified and that adequate strategies are in place for their ongoing operation, support, and control. Basic configuration information should be available. 

 During the preselection assessment, the sponsor should determine which business processes the CMO candidate performs with the assistance of computerized applications. The sponsor's quality unit can provide an initial determination of the applicability of federal good practices regulations (GXP) for the computerized applications. This determination will allow the sponsor to focus on systems that have high GXP visibility. Regulatory inspectors tend to focus on systems that: 					

Have a direct effect on product safety, purity, or efficacy (e.g., manufacturing-recipe systems, materials management, inventory tracking, and systems that provide required procedures) 

Have an effect on the patient (e.g., systems that directly affect the product such as labeling and packaging systems and automated inspection and materials-handling systems) 

Directly affect the creation, maintenance, or retention of critical records (e.g., manufacturing-batch records, quality-control records for raw materials and finished products, and product-distribution records). 

Articles

A sponsor company must investigate the manufacturing automation and systems, laboratory automation and systems, information-technology infrastructure, and business applications of each potential contract manufacturing organization.