Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q. Some 10 years ago, we implemented an electronic quality management system. Over the years, we have added some modules (e.g., for change control and deviation management). The system documentation was amended as changes happened. In a recent audit, we were given an observation: “Your system description does not meet regulatory expectations.” We are still unsure what is expected from us as we presented the system description given to us by the vendor, plus the validation documentation.

A. The regulatory authorities understand the importance of computerized systems in a modern pharmaceutical environment. They also understand the complexity of such systems and that these systems are likely to change over time. For that reason, companies must maintain an inventory of their automated systems, detail whether these systems are GxP-relevant, and if so, if these are validated. This is the very basis expected by the regulators. To understand the intended use of each system, a system description is also required. Your auditors found your system description deficient. You mention that you provided the system description written by the system manufacturer. This, I believe, is the key issue of concern.

Annex 11 of the European Union’s regulations state in paragraph 4.3: “An up-to-date listing of all relevant systems and their [good manufacturing practice] GMP functionality (inventory) should be available. For critical systems an up-to-date system description detailing the physical and logical arrangements, data flows and interfaces with other systems or processes, any hardware and software pre-requisites, and security measures should be available” (1).

Every company using the system will have different physical and logical arrangements, for example:

You may have 50 users, whereas another company may have 5000 users.

You may not have implemented any interfaces to other systems, whereas other users may have linked their system to other software packages.

You may use the system for GxP relevant documentation, whereas another company may only use it for non-GxP purposes.

Therefore, each company’s system description will be unique. The manufacturer can only provide a generic description, which can of course be the basis for your individual one.

You also mention that you do have additional pieces of information about the system, which can be found in the validation documents. That may be so, but these pieces of information are not consolidated, interlinked, or otherwise logically connected to fulfill the requirements of the regulations, which call for an up-to-date system description for critical systems. Your system is obviously critical as you use it for GxP-critical processes.

It doesn’t mean that you should copy/paste all the information that can be found in your validation documentation or elsewhere, into a document called ‘system description’. It is perfectly acceptable to provide the relevant links. A system description could therefore be structured like this:

System description. In a few sentences describe the name, origin, and intended use of the system (e.g., by installed system module [in your case documentation, change, and deviation management])

System history. Describe the key milestones in the lifecycle of this automated system.

Technical information and system validation. In a few sentences describe what system version is installed where and when it was last validated.

References. Here you provide the links to all the relevant documentation.

Following this advice, you should be able to prepare your system description, and I hope you will also find it a useful exercise as it will help you find all relevant information faster in future.

 EudraLex Vol 4, Annex 11 “Computerised Systems”

Siegfried Schmitt is Vice President, Technical at Parexel.

When referring to this article, please cite it as S. Schmitt, "Computerized System Descriptions–How Hard Can It Be?," 

Articles

System documentation should include a system description, history, validation information, and references, according to Siegfried Schmitt, Vice President, Technical at Parexel.

Computerized System Descriptions–How Hard Can It Be?

We have updated our vendor audit program for 2021, and the list includes several companies that perform transport and warehousing services for us. This is a new area for us, and given the continued travel restrictions, we are not certain how best to audit these companies. Can you give us some direction?

A: Good distribution practices (GDPs) are required by regulators in most regions. The United States is different from all other agencies as there are no separate GDP regulations in place. FDA covers violations of storage and distribution under good manufacturing practice (GMP) violations (1). The European Union has codified GDP in two directives (i.e., community law, which has been transposed into member states law) (2–4). In China, GDP is the law, they call it Good Supply Practice (5–6).

Service providers for the storage and transport of goods will have to comply with different regulations, based on their location and the specific type of services they provide. Generally, these companies will have to comply with GDPs. This means that it is essential to have a clear and unambiguous understanding and documentation of the precise nature of the services.

Let us look at an example for illustration: company A (headquartered in Germany) performs the road transport of drug substance and drug product from your warehouse in Switzerland to company A’s warehouse in Germany, where the goods are relabeled, picked, and packed for distribution to wholesalers in the European Union. Based on these activities, which include wholesaler activities, such as importation, storage, and transport, company A must hold a respective licence from the German authorities.

If you cannot audit on site, you have the possibility to perform a virtual audit via videoconference instead. Irrespective of the mode of audit, preparation is essential. This includes a detailed audit agenda, which in this case may look something like this:

Personnel qualification and training program

Subcontractor management including quality agreements

Shipping route validation, including security and risk management

Cold chain and ambient temperature shipping management processes, including vehicle qualification.

The three items in bold letters are those you may wish to focus on particularly, because the vast majority of service providers subcontract all transport. Subcontractors merely performing transport may not even have to comply with the GDP regulations by law. They may not even have a quality system, yet they are transporting your goods. You really want to make sure that company A, with which you have your contract, has a good system of subcontractor oversight. Such oversight may have to include training of the transport company’s staff in aspects of security and documentation (particularly with regards to temperature records).

In fact, the best way to understand who performs what activity in a supply chain is to follow it step by step. Request supporting documented evidence for each step. This way you will be able to fully understand who is involved, which procedures govern these activities, and how these are documented.

The previous example may not necessarily apply to your situation, but the principles are the same for any other supply chain scenario. Yes, the applicable GDP regulations differ from one jurisdiction to another and from one country to the next. One goal, however, is common to all, namely the protection of the patient from products that are adulterated, be it from inappropriate storage or transport conditions, or from falsified products entering the supply chain. Your audits need to evaluate if your service providers have everything necessary in place to assure that goal. Their licences will support that assertion but it will be your audit that proves it.

 Guidelines of 5 November 2013 on Good Distribution Practice of Medicinal Products for Human Use

 (Text with EEA relevance) (2013/C 343/01)
3. European Commission, 

Guidelines of 19 March 2015 on Principles of Good Distribution Practice of Active Substances for Medicinal Products for Human Use

 (Text with EEA relevance) (2015/C 95/01).
4. European Commission, 

EudraLex Volume 4, Good Manufacturing Practice Guidelines


5. CFDA, Good Supply Practice for Pharmaceutical Products (China Food and Drug Administration Decree No. 13) Issued on July 1, 2015.
6. CFDA, Announcement on the Revision of 5 Appendixes to Drug Good Supply Practice (GSP) Dec. 29, 2016.

Siegfried Schmitt is vice president, Technical at PAREXEL.

When referring to this article, please cite it as S. Schmitt, "Auditing for Good Distribution Practices," Pharmaceutical Technology 45 (3) 2021.

Auditing distribution suppliers provides understanding and documentation of the services performed, says Siegfried Schmitt, vice president, Technical at Parexel.  

Auditing for Good Distribution Practices

Q. The current travel restrictions have an effect on how we can perform supplier audits. Most audits are now virtual audits. Some work well, others not so well. How can we achieve more consistency?

A. For most companies, virtual audits (i.e., audits where contact is made via electronic means, such as video conferencing) are something new. This means that the participants do not yet have established protocols for the execution of such audits, nor is there a standardized technology platform available or agreed to. Thus, it comes as no surprise that auditors’ and auditees’ experiences are rather variable.

This fact has been noted, and industry associations (e.g., the Parenteral Drug Association) have established special interest groups to address this very problem. The virtual audit issues are multi-faceted and raise important questions.

Technology: Which video sharing platform should be used? What bandwidth is required? Can several parallel video streams be set up?

Methodology: Will a virtual tour of the facility be provided? Will documents be shared prior and after the audit? Will documents be reviewed online during the audit, or offline outside of audit hours?

Culture and language: How can translation be accommodated remotely? What is the official language? Some countries have more than one official language, or a foreign language may be selected as the agreed language for the audit.

Timing and time zones: How can different time zones be accommodated? Does the agenda clearly define the time zone (some countries have more than one time zone)? When and for how long will breaks be planned?

Staff availability: Do staff members have to isolate at home, preventing them to come to the site? Are staff, such as operators in the plant, available for interview? Are staff comfortable being interviewed via video link?

Privacy, security, and confidentiality: Could video footage impinge on data privacy legislation? Who is allowed to listen in to the audit? Do all attendees, even those not visible on screen have to be disclosed? Will the audit
be recorded?

Documentation sharing and availability: Can documents be scanned (e.g., logbooks, executed protocols)? Will documents be available for download to the auditors, or will they only be presented on screen?

The fact that a company may perform audits of a supplier is documented in quality technical agreements (QTAs). Typically, a QTA states that an audit may be performed over a set number of days in a set interval, involving a maximum number of auditors. That amount of information proved generally sufficient as documentation would be available and reviewed on site. Interaction would be with personnel present on site. There would be no time difference, and confidentiality can easily be achieved by a variety of means. Technology would not be an issue as everything would be present on site. If required, translators could be present. One would be able to talk to several persons within the same room and look at a number of documents simultaneously.

That was the past. Now much of the audit process is no longer a given, and it is therefore prudent and necessary to update the QTA. The section on audits should be expanded to include virtual audits and in that context address many, if not all, of the issues mentioned above. It may prove valuable to have a standard checklist (playbook) available that can be shared with the auditees. Updating the QTA in this way will make it clear to all involved parties what can be expected during an audit and what the limitations may be.

This definitely is the way forward for more consistency in your supplier audits and the time to do so is now. 

When referring to this article, please cite it as S. Schmitt, "Now is the Time to Update the Quality Technical Agreement," Pharmaceutical Technology 45 (1) 2021.

Updating the quality technical agreement will clarify any expectations and limitations, says Siegfried Schmitt, vice president, Technical at Parexel.

Now is the Time to Update the Quality Technical Agreement

Q. We are a manufacturer of prescription pharmaceuticals, and we experienced many disruptions to our operations because of the COVID-19 restrictions. This made it difficult to fully comply with current good manufacturing practices (CGMPs). Is there a regulatory agency expectation by when we need to be back in compliance?

A. During the current pandemic, manufacturers have encountered difficulties in continuing operations while staying in compliance with regulations. Although there is a lot of talk about the “new normal”, when it comes to CGMP, there is no such thing, because the regulations have not changed, nor were they suspended. So, the question is not when you need to be back in compliance, but when you can resume normal operations in compliance.

Guidance for Industry, Resuming Normal Drug and Biologics Manufacturing Operations During the COVID-19 Public Health Emergency

 (1), in which FDA acknowledges that deviations from established CGMP activities have likely happened and provides guidance on how to address these issues. FDA writes, “This guidance describes how to evaluate and prioritize the remediation of CGMP activities that were necessarily delayed, reduced, or otherwise modified during the public health emergency in order to maintain production and the drug supply” (1).

A risk-based approach to remediating is necessary, as resources are strained, be it for employee illness and absenteeism, travel restrictions, site closures, social distancing measures, or supply chain disruptions (including services). Despite these difficulties, FDA reminds industry of their obligation to provide necessary medicines to patients and to maintain compliance with the regulations (i.e., to prevent disruptions to the supply chain, especially of medically necessary products) (2), or the release of products that would be considered adulterated. FDA emphasizes that, “CGMP requirements remain in effect during the COVID-19 public health emergency” (1).

With the COVID-19 pandemic, the supply of any type of drug, not just medically necessary drug products, is at risk. FDA therefore requests that, “A drug manufacturer whose manufacturing operations have been disrupted by the COVID-19 public health emergency should 

when there is a reasonable expectation that normal operations will be maintainable for an extended period of time

” [emphasis added by author] (1). In other words, companies must have a plan (e.g., based on a business continuity plan) on how to get back to normal operations on a continuous basis.

Before companies reach that situation, they may have departed from established CGMP activities. FDA requests that in these circumstances drug manufacturers perform the following (1):

Identify these deviations and any necessary remediation actions.

Evaluate these actions as part of their risk management approach.

Prioritize resumption activities based on the results of the evaluation.

FDA explains that, “Where critical CGMP activities were delayed, interrupted, or reduced in frequency, the batch should be quarantined and the decision to approve the batch delayed until remediation activities ensuring drug quality are completed. Such activities include, for example, critical quality attribute testing, investigations of critical deviations, and evaluation of unapproved changes to critical operations or materials. Drugs not manufactured in a manner that ensures their quality must not be distributed” (1).

The guidance document includes examples of areas where remediation may be needed. This section reminds drug manufacturers to be extra vigilant with regards to the supply chain (e.g., look out for economically motivated adulteration or changes to established logistics or transportation systems).

FDA points out in the guidance that a resumption plan, preferably in conjunction with an emergency plan, requires management leadership for successful execution and that such a plan should be based on a risk management approach. The concern must be the patient (i.e., the assurance of supply of drugs of the right quality). To come back to your question, this guidance document provides a wealth of information for manufacturers like yourself and you are well-advised to study it carefully.

Guidance for Industry, Planning for the Effects of High Absenteeism to Ensure Availability of Medically Necessary Drug Products

Siegfried Schmitt is vice president, Technical at Parexel.


Volume 44, Number 11
November 2020
Page: 58

When referring to this article, please cite it as S. Schmitt, "Resuming Operations During a Pandemic,"

Siegfried Schmitt, vice president, Technical at Parexel, offers insight into FDA’s guidance on performing operations during COVID-19.

Resuming Operations During a Pandemic

Q. We recently performed a detailed assessment of our computer systems for compliance with the applicable regulations, especially 21 Code of Federal Regulations Part 11 (1). The aim was to remedy critical systems first, if any gaps were found. However, almost all systems ended up in the critical category and many of these have compliance gaps. We do not have the resources to address all of these now, so how can we prioritize?

 Your approach to perform a review and apply a risk assessment (RA) is commendable and correct. As you did not provide details about the criteria in your RA and how you weigh them, my answer has to be generic as this is a common issue when it comes to computer systems.

The principles of computer systems validation (CSV) are not dissimilar to process validation. To validate a process, you need to have qualified equipment. Similarly, for CSV, you need to have a qualified infrastructure. Once this is in place, you can then validate software for business purposes. This allows you to focus your compliance assessment on the software.

The next step is to perform a straightforward triage (see

Next comes the risk assessment, and in order to do this logically and compliant, we should follow regulatory guidance. FDA guidance states, “The extent of validation studies should be commensurate with the risk posed by the automated system” (2). Guidance from the Medicines and Healthcare products Regulatory Agency (MHRA) in the United Kingdom states, “Validation effort increases with complexity and risk (determined by software functionality, configuration, the opportunity for user intervention and data lifecycle considerations)” (3). The key word here is complexity. When you look through your inventory of computerized systems, you should be able to at least make a distinction between simple and complex systems, such as a Karl Fischer titrator and a chromatography data management system.

The regulations demand that your validation is for the intended use of the computerized system. The intended use should be documented or referenced in the system inventory. All too often, companies fail to document the intended (i.e., actual) use of the system. For example, an electronic quality management system may have many modules, but you may only be using the documentation management and the training module. When you assess your system for compliance, make sure that you assess these modules specifically, instead of a whole range of installed, yet not used, modules.

Now you should have been able to identify the critical systems and the gaps in compliance based on intended use. It is generally possible to categorize the remediation effort for eliminating these gaps into short-, medium-, and long-term activities. A short-term solution may be to stop using a particular instrument; a medium-term solution may be an upgrade of the software or a revalidation exercise; and a long-term measure could be the replacement of a piece of automated equipment.

Coming back to your question, you may want to review your approach to assessing your systems and verify you really understand each item’s intended use based on the above recommendations. This should leave you with a much more manageable task in hand.

 Title 21 Part 11 Electronic Records; Electronic Signatures.
2.FDA, 

Data Integrity and Compliance with Drug CGMP, Questions and Answers, Guidance for Industry

‘GXP’ Data Integrity Guidance and Definitions 

Siegfried Schmitt is vice president technical, Parexel.


Volume 44, Number 9
September 2020
Page: 66

When referring to this article, please cite it as S. Schmitt, "Computer Systems Validation–a (Un-)Manageable Task?," 

An assessment can identify the critical systems and the gaps in compliance based on intended use, says Siegfried Schmitt, vice president technical, Parexel.

Computer Systems Validation–a (Un-)Manageable Task?

Q. In a recent audit, we were asked about the meaning of the signatures on our controlled documents. Our reply was that it clearly states that the signatories are either authors, reviewers, or approvers. The auditor considered our response insufficient, pointing out that we often have up to 10 reviewers. Though the names and titles of these are given, their review responsibilities are not defined or described. We are unclear how to make the meaning of the signatures more precise.

	A. The regulations do not provide much detail with regards to your question. For example, the European Union guidelines (1) require, “Documents containing instructions should be approved, signed, and dated by appropriate and authorised persons.” The US regulations are a little bit more specific in 21 

) Part 11 (2) regarding the signing of electronic records and state, “This information must include the printed name of the signer, the date and time when the signature was executed, 

 [emphasis added] (such as review, approval, responsibility, and authorship) associated with the signature.”

	The question is whether the meaning of the signatures in your documents is clear enough and unambiguous. Let us look at an example, such as a cleaning standard operating procedure (SOP) for manufacturing equipment. An author, most likely a member of the operations team, prepares the document. There will be several reviewers, possibly including manufacturing, engineering, validation, quality unit, regulatory affairs, and health and safety. These reviewers will each have a different perspective from which they perform their review.

	One could argue that the role and the associated job description define sufficiently what a reviewer has to do. In theory, yes; but in practice this is often not the case. Therefore, companies typically apply one of two approaches: either define the controlled documents review and approval responsibilities in a document (e.g., the SOP for SOPs) or add the meaning to each signature in the signature list.

 is an example of such a review responsibilities matrix.

	If we apply this to the cleaning SOP example, we would expect:

		The operators to check if the instructions can actually be performed (technical feasibility)

		Managers in manufacturing to check the functional correctness of the cleaning procedures (e.g., cross-reference cleaning validation reports) and to verify that the instructions are clear and logical

		The validation team to verify that the cleaning procedures are in concurrence with previously executed cleaning validations

		The quality unit to ensure that the document uses the correct template and format, that the procedure meets regulatory requirements, and that any related change controls or audit/inspection commitments have been met

		The regulatory affairs department to confirm that the procedure is in concurrence with the manufacturing licenses

		The health and safety executive to check that all required safety precautions are applied, for example, where flammable or corrosive solvents are used.

	In summary, it is good industry practice to clarify the precise remit for each of the reviewers of a controlled document, rather than just apply the general term of ‘reviewer.’ This does not have to be as difficult as the example herein.

	And finally: are you still sure you need up to 10 reviewers?

EudraLex Vol. 4 Part I Chapter 4 Documentation

.
	2. Electronic Records; Electronic Signatures, 


	Vol. 43, No. 11
	November 2019
	Page: 59

	When referring to this article, please cite it as S. Schmitt, "Signatures–What’s in a Name?," 

It is good industry practice to clarify the precise remit for each of the reviewers of a 
controlled document, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.
