Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

In February 2020, travel ceased as the COVID-19 pandemic began to emerge. Since that time, we have come a long way with stay-at-home orders, social distancing, testing, tracing, and quarantine. Countries that implemented aggressive public health measures have had fewer cases and fewer deaths. The regulatory authorities also ceased to travel and were forced to utilize alternative mechanisms to assess industry compliance and review and approve new applications. This article discusses select industry experience with regulatory authorities utilizing alternative mechanisms for assessing compliance as part of their review and approval of existing marketing authorizations or new applications.

Until the time of the pandemic, the norm was that inspections would be performed as in-person on-site inspections. In the case of the European Union, Amended Directive 2001/83/EC, article 46(f) (1) explicitly states, “the holder of the manufacturing authorisation shall verify compliance by the manufacturer and distributors of active substances with good manufacturing practice and good distribution practices by conducting audits at the manufacturing and distribution sites…” [emphasis added by author].

Pharmaceutical Technology’s Quality and Regulatory Sourcebook eBook

James Stumpff, RPh, is principal consultant at Parexel International. Siegfried Schmitt, PhD, is vice president Technical at Parexel International.

When referring to this article, please cite it as J. Stumpff, S. Schmitt, “Remote Inspections - Lessons Learned," 

Articles

This article discusses select industry experience with regulatory authorities utilizing alternative mechanisms for assessing compliance as part of their review and approval of existing marketing authorizations or new applications.

Remote Inspections - Lessons Learned

Q. We, a contract manufacturing organization (CMO), have a written rule that describes that we will not show batch records, which have not been completely reviewed and approved by the quality function, during a customer audit. We consider this an absolute necessity to avoid an auditor finding missing or incorrect entries in the batch record. Yet, we received a critical finding for that in a recent audit. We pointed out to the auditor that we are following our quality system, but the auditor would not change the criticality of the observation. Do you think this is fair?

A. Clearly, if this had been a regulatory inspection, refusal to present a batch record, whether reviewed by your quality unit or not, would be considered preventing an inspection, with all its consequences (1). However, this was an audit, so this is a different situation.

We must consider why a CMO may not wish to present a batch record during an audit. The one obvious and valid reason is client confidentiality. But even this can easily be overcome by asking the client to use an impartial auditor.

You cite a very different reason, namely the need to have the batch record first reviewed and approved by the quality unit in order to have a “perfect” batch record. The best way to demonstrate the error in this is by presenting real examples from various CMO audits.

The regulations specify that batch record entries must be made contemporaneously (2). That means as close to the event as is possible. During an audit of a filling line, it was found that the machine had broken down and two engineers were busy repairing the equipment. As this would take a while, the operators had left the line and went to have an unscheduled break. The review of the batch record revealed that there were no entries for the following:

The equipment having broken down, or when

The shift operators having left the room, or when they left

The engineers being present in the room, or when
they entered.

The site’s quality system explicitly required all these to be documented, yet it hadn’t happened. Only the possibility to review the batch record allowed the auditor to find and record this deviation. Even a later review by the quality unit could not have found these errors and omissions. Thus, only a review of the batch record at the time of the audit can uncover such non-compliances.

When the shift operators returned to the line, they were confronted with the missing entries. Thereupon, one of the operators started to enter the data from memory, in fact backdating the events. Again, something impossible to detect at a later date.

The regulations also specify that entries cannot be made before the actual activity has taken place (3). A good time to perform audits is during lunch breaks when staff are away from their workplaces. During an audit of a packaging line, a batch record was found that had signed entries for completed actions that would only take place after the lunch break. If the batch record had not been presented in that audit, it would not have been possible to find this serious deviation from the basic principles of good documentation practice.

Batch record reviews by the quality unit typically take 40 or more days at CMOs, by which time the audit report has long been written and issued. In most cases, auditors would thus be unable to even review the “sanitised” version of the batch record.

These few actual examples clearly demonstrate the absolute need for auditors to have access to the batch records of the activities they are reviewing. If this is prevented, they cannot verify the truthfulness (i.e., the integrity) of data in the batch record. And to most auditors, this is a critical observation.

Circumstances that Constitute Delaying, Denying, Limiting, or Refusing a Drug Inspection, Guidance for Industry 

Data Integrity and Compliance With Drug CGMP, Questions and Answers, Guidance for Industry

PIC/S Guidance Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments

Siegfried Schmitt is vice president, Technical at Parexel.

When referring to this article, please cite it as S. Schmitt, “The Importance of Batch Record Reviews During Audits,” 

Auditors must have access to the batch records of the activities they are reviewing, says Siegfried Schmitt, vice president, Technical at Parexel.

The Importance of Batch Record Reviews During Audits

Q: We have been manufacturing specialty chemicals for many years. Some clients have asked us to manufacture intermediates and drug substances for them in compliance with good manufacturing practices (GMPs). We are very interested to do so, but how do we manage two quality systems (GMP and non-GMP) within the same facility?

A: It is understandable that you wish to have a non-GMP quality system for your specialty chemicals business and a GMP system for pharmaceutical intermediates and drug substances, as these have a direct bearing on the cost of goods. Companies can certainly operate more than one quality system; the difficulty however is to operate them within one and the same facility. In short, I have never seen it work. Let us look at some of the reasons for this.

Your personnel will need to be trained in the respective quality system. Following a particular system requires more than training; it needs repeat experience (i.e., learning on the job). Having to switch between two rather different systems would be like having to cook over a campfire today and to prepare the same meal in a professional kitchen tomorrow. This is confusing, to say the least. Where GMP-trained and untrained staff work in close proximity, there is always a chance that untrained operators are called for help, thus creating a risk to product quality and compliance.

Your equipment must be suitably qualified, calibrated, and maintained to meet GMP requirements. Especially during times of high demand, the temptation is all too real to use unqualified equipment due to production pressure and looming deadlines. Or, if there is no clear physical segregation between non-GMP and GMP equipment, the probability to erroneously use unqualified equipment (in manufacturing or the laboratory) is unacceptably high.

You may require the same raw materials for pharmaceutical product manufacture and for other goods, yet in differing qualities (i.e., different specifications). It requires a very robust dispensing and documentation system to prevent any accidental use of raw materials with the incorrect specification. It is, however, not merely the use of the correct material that is of concern. You also need to consider the risk from accidental cross-contamination from non-GMP materials. Such materials may have unknown impurities, which may be difficult to detect and remove during cleaning. Unless you have dedicated GMP and non-GMP equipment, there is a real risk of accidental cross-contamination.

Where things go wrong most often where more than one system is in operation is with documentation. GMP requires not only good documentation practice, but also must meet the strict requirements for data integrity. It matters for GMP products who performed the task, documented the task, and documented it contemporaneously. Yes, mistakes happen with GMP documentation too, but these errors need to be corrected in a controlled manner. GMP processes need to follow documented, controlled procedures and instructions, whereas non-GMP activities don’t. It is human nature to follow the path of least resistance. Thus, there is a real likelihood that staff may not want to bother with onerous procedures, particularly when there is a high workload and pressure to meet deadlines.

In summary, it is conceivable to have more than one quality system, but it is nigh impossible to operate them alternating or in parallel within one and the same facility. Physical and organizational segregation is a necessity, or deviations and costly mistakes will be encountered almost inevitably.

Siegfried Schmitt is vice president Technical at Parexel.

When referring to this article, please cite it as S. Schmitt, “Good Manufacturing Practice on Demand?” 

Siegfried Schmitt, vice president Technical at Parexel, discusses the difficulty of operating non-GMP and GMP quality systems in the same facility.

Good Manufacturing Practice on Demand?

Because of the COVID-19 pandemic, many companies no longer permit on-site audits. This has many advantages for the audited company (the auditee). This article tells how a company could explore this opportunity to its maximum advantage.

In order to make customer audits as efficient and effective for us, we have decided to update the respective standard operating procedure. Here we summarize the key elements:

From now on, we will only allow virtual audits or questionnaire audits, but no on-site audits.

These audits are limited to normal office hours (i.e., between 9 am and 4.30 pm with a one-hour lunch break from noon to 1 pm). Extensions are not possible.

We will only participate in Microsoft TEAMS video conferencing sessions that we have set up.

We do not allow parallel sessions (e.g., for more than one auditor).

There will be only one person from our company (the moderator) participating in the audit.

Any questions from the auditors that the moderator cannot answer, will be forwarded to the relevant subject matter experts (SMEs). The audit will be paused while the moderator types the emails to the SMEs.

The moderator will relay answers from the SMEs to the auditors as and when these are received.

If the moderator has been in contact with a person infected with COVID-19, the audit will be cancelled. Cancellations should not be sent out more than 24 hours before the start of the audit.

Documents can be reviewed in a data room during audit hours only.

For data protection reasons, anything we put in the data room, like the company presentation, will be non-editable, non-printable, and the “print screen” function will be disabled.

Documents will only be shared with the auditors through the data room.

Auditors can either access the data room to look at the documents, or they can access the video conference with the moderator. Parallel sessions are disabled.

For privacy reasons, we cannot switch on video on our side.

Virtual site tours cannot be conducted live. We will prepare pictures that will serve as a site tour.

For privacy reasons, the pictures for this virtual site tour cannot show any personnel.

The pictures for this virtual site tour will be available in the data room. No other pictures can be provided.

Only questions received during the audit will be answered.

Audits can be so much more relaxed and enjoyable because virtual audits have become commonplace. If this memo seems familiar, then this is pure coincidence.


Volume 45, Number 11
November 2021
Page: 66

When referring to this article, please cite it as S. Schmitt, “The Remote Audit–A Tongue-in-Cheek Memo,” 

Siegfried Schmitt, vice president, Technical at Parexel, comments on the new paradigm of remote audits. 

The Remote Audit–A Tongue-in-Cheek Memo

Q: We have been tasked by management to improve our processes and to enhance compliance. To achieve this goal, we intend to significantly increase the use of automated systems, replacing manual paper-based processes. It is a well-known fact that IT projects can easily end up in disasters as an Internet search will tell you. We want to be diligent. Can you share some best practices that can help us prevent or at least mitigate automation project failures?

A: Some things still need to be done by hand, such as typing the answer to your question. But automation is a necessity in a regulated healthcare environment, not merely for business optimization reasons, but also for being able to operate in a compliant manner. The keyword here is data integrity. For example, every time someone performs a manual transcription of data (e.g., typing a measurement into a form), there is a chance of a typing error. Even when you check and double check, you will never be able to reduce the error rate to zero. That alone is reason enough to eliminate manual entries, wherever possible.

The following are some suggestions that can help you on your road to success when automating processes.

Benefit from others’ experience and expertise. Well-known and widely used methodologies include COBIT (Control Objectives for Information and Related Technology) (www.isaca.org/resources/cobit), ITIL–The IT Infrastructure Library for IT Service Management (ITSM) (www.itsmf.co.uk/), and Good Automated Manufacturing Practice (GAMP) (https://ispe.org/initiatives/regulatory/what-gamp), to name but a few. In simplest terms, make sure you have a well-structured, carefully planned, and professionally executed project.

Always have a plan B. In IT terms this could be a roll-back option (i.e., you restore the status as it was before). It will be better to continue working the old ways than not being able to work at all.

One should avoid transposing a manual paper-based process “as is” into an automated process flow. This will not really deliver an improvement. If we take the example of signing documents, then a piece of paper can only be signed by one person at a time. An automated process on the other hand should allow simultaneous signing by several signatories, using electronic signatures.

Automated systems almost always offer transactions that cannot be (easily) performed manually. Therefore, find out what the automated system will let you do that you could not have done on paper.

Avoid going live “big bang” style (i.e., stop any old process or system and use the new system only from day one). Yes, you will have tested the system and you have done dry runs, but the chances of things going wrong, users getting frustrated, clients becoming irate, and management being displeased are to be expected. So don’t do it. Use a phased approach; sometimes it is possible to switch on one module after another; use one site or one department as the trial site. This approach will limit the fallout from any system failures.

Avoid having user acceptance testing performed by the vendor or someone from the IT department, instead of the actual users. Invariably, users will do something totally unexpected and will stress test the system in ways that those who are experts in the system could never imagine. I vividly remember situations where I was told by IT “but this has never happened before”. The clue is in the expression ‘user acceptance testing’.

Don’t buy the sales pitch (“this is the all-singing, all-dancing system”), when all you actually need is one tool to handle one very specific process. Overly complex systems will only mean that users will find ways and means to bypass the system, and the benefits of having an automated system will be lost.

Of course, these are only a few suggestions, and there will be many more that can be found online and through other channels, such as industry organizations. Good luck with your endeavors.


Vol. 45, No. 9
September 2021
Pages: 62,61

When referring to this article, please cite it as S. Schmitt, “Improve Automation, but Beware of the Pitfalls,” 

Siegfried Schmitt, vice president, Technical at Parexel, provides best practices for switching from paper-based to automated processes.

Improve Automation, but Beware of the Pitfalls

Q. We are a US-based start-up company, and we are about to put our quality management system in place. One of our consultants advised us to review Form 483 and warning letters issued by FDA. We looked at some of them but are unsure what we are expected to find or what to do with the information in these documents. Do you have any advice?

A. At the end of an FDA inspection, the inspectors will document observations of deviations from the codified regulations on Form FDA 483 (1). This document contains only the inspector’s most significant observations. Other observations may be communicated to the company verbally during the inspection. Importantly, FDA does not classify its inspection findings (e.g., as critical, major, or minor).

The inspector(s) submits his or her report to a district office. The district office classifies an inspection in one of three ways:

Official action indicated (OAI), which means that the inspection was unsatisfactory, and the district advises enforcement actions.

Voluntary action indicated (VAI), which means that deficiencies were identified, but these can be resolved by the company without the need for enforcement action.

No action indicated (NAI), which means that no problems (or only very minor ones) were identified.

The district office will either issue an establishment inspection report (EIR) or, if advised, will take further action, such as issuing a warning letter. Warning letters are just one tool at FDA’s disposal to alert a firm to the fact its products are considered a risk to human health; therefore, authorities may take drastic action to safeguard patients (2). All warning letters are posted on FDA’s website and are visible to anyone interested, particularly the competition and customers. Making inspection reports easily accessible to the public is a peculiarity of FDA.

Redacted Form FDA 483s are available from FDA under Freedom of Information Act (FOIA) requests. Some commercial providers specialize in providing these at a fee.

What is the benefit of reviewing these documents, and what can you do with the information found? The rules and regulations (e.g., 21 Code of Federal Regulations Parts 210 and 211) describe the requirements a company must comply with. There are, however, many aspects that are not described in much detail, such as how to perform complaints investigations, how to respond to inspection observations in an acceptable manner, and much more. What you can glean from Form 483s and warning letters is basically an interpretation of the regulations (i.e., the agency’s thinking and expectations).

Of course, you need to filter the information and only review what may be relevant to your line of business. Still, there will be plenty of information that can help you avoid making costly mistakes. Bear in mind that the reported observation only tells part of the whole story, and there is much information, such as the actual product involved, that is confidential and thus not reported (i.e., redacted). As the observations on Form 483 are not classified, companies should take them all seriously. Not doing so could result in a warning letter, and that definitely would mean that the company is in trouble.

Making mistakes is human, repeating mistakes others made, and which have been reported in 483s or warning letters, is just plain careless and bad management. Unlike other regulatory agencies, FDA provides these valuable resources to anyone who cares to read them. It is a great opportunity for you to make good use of them.

,” www.fda.gov, accessed June 9, 2021.
2. FDA, “

When referring to this article, please cite it as S. Schmitt, “The Value of FDA 483s and Warning Letters” 

Regulatory inspection reports can be a valuable resource for quality management, according to Siegfried Schmitt, vice president, Technical at Parexel.