Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Ask the Expert: Quality Control Units

After an FDA inspection of a pharmaceutical manufacturing facility, any deviations the inspector might find during the inspection are reported on a Form 483 and sent to the manufacturer. If the company fails to properly respond to the agency, FDA will follow up with a warning letter. A common theme seen on warning letters is that companies fail to properly establish a quality control unit. So how should a company respond if they receive such a citation?

“Well, you see the mere fact that they actually received a warning letter means that their initial response to the observations by the FDA inspectors were considered inadequate or incomplete,” Siegfried Schmitt, vice president of Technical at Parexel, explains. “I think it's therefore essential to admit that this shortcoming has happened, and so they should make sure that the response they now give to this warning letter is really a complete and convincing one and provides a remediation plan that will be acceptable to the authorities.

 video series, Susan J. Schniepp, distinguished fellow at Regulatory Compliance Associates, and Siegfried Schmitt, PhD, vice president, Technical at Parexel, discuss what manufacturers should do when they receive a warning letter from FDA for an insufficient quality control unit.

Click the video above to watch Sue and Siegfried answer the following question:

“My company received an FDA warning letter for failure to create a quality control unit. What is the best way to respond to FDA?”

Susan J. Schniepp is distinguished fellow at Regulatory Compliance Associates and a member of 

Siegfried Schmitt is vice president, Technical at Parexel and a member of 

Welcome to the Ask the Expert video series. This series is an extension of the PharmTech Group’s long-running print column in which industry experts answer common quality and regulatory questions from the industry. This new video series will expand on topic areas to include development and manufacturing concerns to help those working in the industry better understand bio/pharmaceutical requirements. Have a question you would like answered? Send it to PTProjects@mmhgroup.com, and it may appear in a future episode or print column.

Videos

In this episode of the Ask the Expert video series, Susan J. Schniepp, distinguished fellow at Regulatory Compliance Associates, and Siegfried Schmitt, PhD, vice president, Technical at Parexel, discuss how to address an FDA warning letter citation for a failure to establish a quality control unit.

Question mark background | Image Credit: © Leigh-Prather - © Leigh Prather - stock.adobe.com

Q: We understand that the European Union’s good manufacturing practice (GMP) regulations are quite similar to the US Code of Federal Regulations (CFR). Can you explain some key differences?

A: You are correct that there are many similarities, not least because the United States and the EU have long worked towards global harmonization of GMP regulations. GMP regulations in one form or another have been around for half a century or more, so there has been plenty of time for alignment. The differences in the two regulatory systems are certainly twofold: the specific wording and requirements aren’t identical, and the two entities (US and EU) themselves are distinctly different.

Whereas the US has one CFR that applies as is in all US States, the EU has a regulatory system that is based on Union law and the laws of the 27 Member States (MS). Thus, the EU regulations are only harmonized to some degree, particularly in their interpretation, resulting in many member-state specific requirements and procedures.

Differences between the two regulatory systems are also in their structures. US 21 CFR 211 describes GMP for finished pharmaceuticals in the US. To find the equivalent regulations in the EU, it is easiest to go to EudraLex–Volume 4–Good Manufacturing Practice (GMP) guidelines (1). The EU laws are directives, which need to be transposed into national law in the MS. Though EudraLex provides the consensus interpretation of the directives, each MS can and likely has interpreted some parts slightly differently.

A distinct difference exists with regards to drug product release (to the market). In the US, this is under the authority of the quality control unit (21 CFR 211.22), whereas in the EU this can only be performed by a Qualified Person (QP) (2). The QP can be a member of the quality unit, or even be an independent consultant, depending on the applicable national or regional legal requirements. For certain products (e.g., blood products), an additional release by the Official Control Authority Batch Release is required (3). And should you be confused about the quality unit terminology, please see the article, “The Role of the Quality Unit” (4).

A large number of products are aseptically manufactured. The sterilizing filter is thus a critical component in sterility assurance of the finished product. In the EU, Annex 1 (5) all but mandates that the integrity of the sterilised filter assembly should be verified by integrity testing before use (pre-use post sterilization integrity test or PUPSIT). There is no equivalent requirement in the CFR or FDA guidance documents. PUPSIT is yet another example of differing requirements or expectations.

Tables that compare the EU and US regulations have been created by many a company. These are very useful; however, as shown above, this is not enough to really fully understand the detailed expectations, which are often published in guidances and in the case of the EU may only be available in national or regional communications in the local languages. For a full picture, it is always recommended to consult with the local agencies.

–Volume 4–Good Manufacturing Practice (GMP) Guidelines. https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en

EC. Annex 16–Certification by a Qualified Person and Batch Release. 

–Volume 4, https://health.ec.europa.eu/document/download/20c41532-33d5-4635-ae80-8735d3d09fe0_en?filename=v4_an16_201510_en.pdf

. https://www.edqm.eu/en/omcl/human-biologicals-ocabr-

S. Schmitt. The Role of the Quality Unit. 

EC. Annex 1–Manufacture of Sterile Medicinal Products. 

–Volume 4https://health.ec.europa.eu/document/download/e05af55b-38e9-42bf-8495-194bbf0b9262_en?filename=20220825_gmp-an1_en_0.pdf

Siegfried Schmitt, PhD is vice president, Technical at Parexel.

When referring to this article, please cite it as Schmitt, S. Complying with European versus US GMPs. 

Articles

While global harmonization exists, there are still differences between the US and European GMP requirements that manufacturers should know, says Siegfried Schmitt, PhD, vice president, Technical at Parexel.

Complying with European versus US GMPs 

Q: There appear to be a lot of recent changes in the requirements for aseptic processing. Are there any other key developments in this field we should expect in 2025?

A: The two issues that will most likely be top of the list are compliance and competitiveness. Regarding compliance, although Annex 1, the European Union’s guide to the manufacture of sterile products (1), has been in force for over a year, many companies are still somewhat unsure as to how to comply with certain aspects of this document. In particular, establishing the contamination control strategy (CCS) proves to be more complex and resource intensive than many expected (2,3). Creating this document requires access to many disparate sources of information from several departments. Unless this information is accessible electronically, the task will be made excessively difficult.

When it comes to competitiveness, increasing demands from regulatory bodies, including those governing environment and health, place a burden on industry to find solutions (e.g., minimize waste even when using single-use equipment) that do not compromise compliance.

A good source to keep abreast of developing trends is to look at events and activities organized by leading industry associations that traditionally cover aseptic processing; for example, the International Society for Pharmaceutical Engineering (4,5) or the Parenteral Drug Association (6).

These and other organizations (7) are also providing fora for interested parties that prepare guidance documents (e.g., technical reports, good practice guides, points to consider, or similar) from industry experts for industry peers. Active participation in such groups provides early access to these highly valuable documents.

An area of special interest is to bring manufacturing as close as possible to the points of need or care. Rather than shipping product from a central manufacturing hub to a large number of locations, the idea is to establish more manufacturing sites, or even mobile manufacturing units (8) that will bring a lot more flexibility to manufacturing schedules, and deliver resilience to interrupting factors like environmental disasters or new trade barriers. Aseptic processing validation under these circumstances may need careful consideration.

Annex 1 Manufacture of Sterile Medicinal Products, 

Schmitt, S. Contamination Control Strategy–Are We There Yet? 

Schmitt, S. Creating a Contamination Control Strategy. 

ISPE. Building Resilience in ATMP Manufacturing: Insights and Innovations at the 2025 ISPE Aseptic Conference, 

PDA Good Aseptic Manufacturing Conference 2025

Regulatory Affairs Professionals Association. Fundamentals of Pharmaceutical and Biologics Regulations, A Global Perspective. 2nd edition, 

PDA. PDA Points to Consider Mobile Manufacturing, 2025. www.pda.org, [publication planned for 2025].

Siegfried Schmitt, PhD, is vice president, Technical at Parexel.

When referring to this article, please cite it as Schmitt, S. Developments in Aseptic Processing. 

Compliance and competitiveness are key factors in aseptic processing, says Siegfried Schmitt, PhD, vice president, Technical at Parexel.

Developments in Aseptic Processing

Q. Artificial intelligence (AI) seems to be everywhere. Are there specific regulations covering AI for the pharma and medical devices industries?

A. There are indeed regulations; however, it is important to note that AI regulations in healthcare are rapidly evolving, and specific regulations can vary significantly between countries and regions. There certainly isn’t yet a unified global approach to regulating AI in the healthcare industry.

Though companies explore a multitude of opportunities to apply AI (e.g., for improving and strengthening the supply chain to prevent drug shortages), these technologies are still in their infancy. That is reflected in the discussion and policy papers published by the various regulators. AI algorithms are created by humans, and it is only logical to assume some level of bias. Addressing bias and ensuring fairness in AI algorithms is one of the common themes across these regulations. Avoiding bias is essential to ensure patient safety. A benefit of AI is that these algorithms are capable of learning and evolving. To avoid anyone blaming the algorithm for when an AI tool, such as an AI-based medical device malfunctions, the regulators are keen to establish clear liability and accountability frameworks.

The use of AI in the healthcare industry invariably impacts patients’ wellbeing. Any application of AI must therefore follow or adhere to ethical principles. Unlike a piece of traditional software that remains static in its output, AI is often intended to evolve and change. Companies may no longer be able to rely on a one-time validation effort to maintain transparency and explainability of AI decision-making processes.

Though the regulators do not wish to prevent the use of AI, considering the assumed benefits for patients, they do have to weigh the risks to protect patient safety, as well as patient data privacy and security. All these concerns are reflected in the current legislation. The following are merely a small number of regulations, guidance documents, and discussion papers from key regulatory agencies.

The World Health Organization (WHO) published Ethics and Governance of Artificial Intelligence for Health in 2021, which addresses the use of AI in healthcare globally (1). Most of the regulations and guidance documents have been issued for medical devices (2–9).

A more detailed overview of these regulations has been published by the Regulatory Affairs Professionals Society, though access is for members only (10).

For the most current and detailed information on AI regulations in specific countries or regions, it is always advisable to consult with regulatory subject matter experts in those areas, particularly as this is such a rapidly evolving regulatory field.

Ethics and Governance of Artificial Intelligence for Health

FDA. Artificial Intelligence and Machine Learning (AI/ML)-Enabled Medical Devices. 

 updated Aug. 7, 2024 (accessed Dec. 5, 2024).

Discussion Paper on Proposed Regulatory Framework for Modifications to (AI/ML)-Based Software as a Medical Device (SaMD)

FDA. Transparency for Machine Learning-Enabled Medical Devices: Guiding Principles. 

Guidelines on the Responsible Use of Generative AI in Research Developed by the European Research Area Forum

Future of Life Institute. The EU Artificial Intelligence Act. 

MHRA. Software and Artificial Intelligence (AI) as a Medical Device, 

MHRA’s AI Regulatory Strategy Ensures Patient Safety and Industry Innovation into 2030

The National Medical Products Administration (NMPA) (China). 

NMPA Announcement on Guidance for the Classification Defining of AI-Based Medical Software Products.

Kulshreshtha, A.; Bharadwaj, M.S. Global Regulatory Landscape for AI/ML-enabled Medical Devices. 

. 2024;4(3):5-20. Published online Sept. 18, 2024.

Siegfried Schmitt, PhD, vice president, Technical at Parexel.

®
Vol. 49, No. 1
January/February 2025
Page: 34

When referring to this article, please cite it as Schmitt, S. Regulations in AI and Other Digital Technologies. 

AI regulations in healthcare are rapidly evolving, and one should consult with regulatory subject matter experts, says Siegfried Schmitt, PhD, vice president, Technical at Parexel.

Regulations in AI and Other Digital Technologies

Q. According to our quality management system, we assess the suitability of all our suppliers in one way or another. Is this sufficient with regards to supplier oversight?

A. The supply chain for pharmaceutical products is complex and involves many actors, often in different countries and jurisdictions. Importantly, the ultimate responsibility for the product and its quality always remain with the Marketing Authorization Holder (MAH) (i.e., the license holder). Therefore, the MAH must have a supplier oversight system in place that assures that any materials (e.g., excipients), equipment (e.g., laboratory instruments), or services (e.g., transport and storage) meet the appropriate quality requirements and specifications. Such a supplier oversight system, which obviously is part of the pharmaceutical quality system (PQS) (1), must comply with the applicable rules and regulations for the good practices (e.g., good manufacturing practices). That this is by far not always a given is demonstrated by the regulatory agency inspection observations, such as those made public in warning letters by FDA (2).

The question is not whether we can trust a supplier, but what controls one must put in place to be able to trust said supplier. A risk-based approach (3) is required. This is where companies can do too little (non-conforming with the regulations) or too much (waste of valuable resources). This is best demonstrated with two examples.

Company A relies on the Certificates of Analysis (CoAs) from their suppliers for raw materials, including excipients and APIs without performing any incoming tests. The company argued that they only buy from reputable suppliers. However, FDA insists on at least identity testing and additional testing depending on the criticality of the material: “Without adequate testing, you do not have scientific evidence that your raw materials conform to appropriate specifications prior to use in the manufacture of drug products. As a manufacturer, you have a responsibility to sample, test, and examine drug components before use in production to assure adequate product quality” (4).

Whereas, Company B performs a large amount of testing. For example, the microbiology laboratory purchases media and performs several incoming tests, including identity and mycoplasma testing. The media is in use with a large number of pharmaceutical companies globally and comes with a CoA that covers mycoplasma testing. The company needs to assess if the risk from the media warrants mycoplasma testing. A review of testing data showed that there never had been an issue with the media. Equally, an Internet search found no evidence of any issues with that media. Furthermore, the supplier is qualified by the contract giver, and an identity test is always performed when the media is received. Thus, this testing is not necessary.

It requires experience and expertise to devise a supplier oversight system that is compliant and optimized. Such a system assures that all activities, including supplier audits, material testing, etc., are risk-based, meet the minimum legal requirements, and are of a manageable complexity. This means, for example, that suppliers are assigned to risk categories. Therefore, risk assessments don’t have to be performed for each supplier, only for each supplier category. Such systems need to be reviewed, revised, and updated based on the company’s evolving needs and any changes in the regulations and their interpretation.

Becker, G. The FDA Warning Letter Report 2023. 

®
Vol. 48, No. 11
November 2024
Page: 34

When referring to this article, please cite it as Schmitt, S. The Importance of Appropriate Supplier Oversight.

The product license holder must have a supplier oversight system in place, says Siegfried Schmitt, PhD, vice president, Technical, Parexel.

The Importance of Appropriate Supplier Oversight 

Q: We are revising our audits and inspections programs and wanted some advice on best practices. How can we limit the number of on-site audits or inspections?

A: Companies need to find the right balance between the different types of audits, be it a questionnaire, a remote (virtual) or an on-site audit, or a combination of these. A number of reasons have to be taken into consideration, including criticality of the product or service, the feasibility of the type of audit, the regulatory expectations, and others. Here, the company is in charge of the decision making.

This is different in the case of inspections. It is at the discretion of the inspecting authority what type of inspection they will perform. The inspected company can greatly help such an inspection succeed if they are suitably prepared for the various scenarios, especially with regards to remote inspections.

Let us first address the audit program. It is essential to understand that there are fundamental differences between the different types of audits. The following examples shall exemplify this.

A third-party logistics (3PL) company with its own warehouses and fleet of transport vehicles is to be audited. The 3PL fills in a questionnaire sent by the customer. According to the answers, the company is in full compliance with all good distribution practice requirements. The customer decides to perform a virtual audit of the 3PL. This allows for a review of the actual documentation and a virtual site tour. Everything is clean, and there is sufficient space for performing the work. All seems to be fully compliant. However, the customer decides to perform an on-site audit. The documentation is the same; although, it is now possible to have several documents next to each other and cross-reference easily. Importantly, the premises and operations can now be seen firsthand, making it possible to see problems such as cracks in the concrete floor of the warehouse, paint peeling off the wall, insect traps that hadn’t been cleaned for too long, aisles blocked by pallets because there actually isn’t enough space, and electronic access controls being bypassed by doors that were propped open. Just be aware.

In reverse, if you the customer get inspected, you do not want to be the one who isn’t open and honest. You want to present truthfully what you do and how you do it. And this you want to do equally well, whether it is a virtual or an on-site inspection. Plenty has been published about preparing for on-site inspections, and companies are usually well prepared. The issues are still with preparing best for virtual audits. Specifically, can you share all documents electronically, including logbooks or other paper documentation? Can you show live video of all areas without a wobbling (handheld) camera? These are the two most challenging aspects of such inspections.

Updating your audits and inspections program gives you a chance to make sure you are as prepared for inspections as you would want your suppliers to be prepared for your audits.

Siegfried Schmitt is vice president, Technical at Parexel.

®
Vol. 48, No. 9
September 2024
Pages: 34

When referring to this article, please cite it as Schmitt, S. Keeping Audit and Inspection Programs Current. 

Updating your audits and inspections program ensures inspection preparedness, says Siegfried Schmitt, vice president, Technical at Parexel.