Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q. Creating a contamination control strategy (CCS) is now a requirement defined in Annex 1 of the European good manufacturing practice regulations (1). The document does not describe how to create such a strategy. Can you provide us with some best practice information?

A. Any company that must comply with that regulation have until Aug. 25, 2023 to be compliant. Several industry associations are working on or have already issued some best practice documentation to their members. Therefore, it may be beneficial to become a member of such an organization.

In the meantime, the following are some best practices:

Define the CCS scope, which should encompass sterile products, and any products or ingredients requiring bioburden control. Identify all contaminants, including those that impact quality, sterility, or efficacy.

Position the CCS, which means developing the CCS relative to process and facility design. The CCS will be related to the site master file and the site’s pharmaceutical quality system (PQS), as well as the life cycles for the products manufactured on site.

Establish the CCS structure, which is typically a Site Master CCS that is an overarching approach to contamination control document. The Site Master CCS links the detailed area CCS documents together, which address the area specifics and product specific information.

A CCS is a holistic approach to contamination control that will take into account all existing measures in place. These are likely to include (in no particular order) housekeeping, materials storage and management, personnel and material flows, facility and equipment design, process design and controls, heating, ventilation, and air conditioning (HVAC) and utilities, preventive maintenance, corrective and preventive actions, training, cleaning and disinfection, outsourced activities, continuous improvement, and quality by design.

The control measures in these will comprise:

Technical control measures based on science and knowledge of process, product, and risks

Organizational/procedural control measures defined in the PQS based on quality risk management principles.

The goal of the CCS is to document detailed process knowledge and all associated potential contamination sources, and how the company assures appropriate controls to manage the risks at an acceptable level. Furthermore, the CCS documents the interrelation of the various control measures. As mentioned, many control measures are in place, but it may not be clear if there are any gaps (i.e., lack of a comprehensive overview).

This may still sound abstract, so here is an example. For a cleanroom suite, a company has gowning and operating procedures in place, HVAC installed, and is monitoring differential pressure, room temperature and relative humidity, amongst other measures. That is considered good practice and addresses regulatory requirements. However, it does not describe what the gowning procedure is achieving, (i.e., whether the gowning is reducing the shedding of particles, or whether the gowns are of the appropriate material and size). It also does not address whether this gowning regime is appropriate in relation to the contamination in the rooms, as controlled by the HVAC system and as measured by the room monitoring system. Only if this is reviewed, assessed, and documented as part of a CCS, will it be known if the technical and procedural controls are balanced and represent compliant controls.

Hopefully, this shows that a CCS is not merely a regulatory requirement, but provides significant benefits to the industry, not least to help understand the controls holistically

EC. Annex 1 : Manufacture of Sterile Medicinal Products. EudraLex, The Rules Governing Medicinal Products in the European Union, 

Volume 4 EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use. 

Siegfried Schmitt is vice president, Technical at Parexel.

When referring to this article, please cite it as S. Schmitt.Creating a Contamination Control Strategy. 

Articles

A CCS provides significant benefits to the industry and helps with holistically understanding contamination controls, says Siegfried Schmitt, vice president, Technical at Parexel. 

Creating a Contamination Control Strategy

Q: We are a newly established small company, and we would like to understand the principles of equipment qualification. Can you give us some essential guidance?

A: Equipment must be fit for use, and to prove this within the realm of your quality system, you need to qualify the equipment. Equipment may consist of mechanical parts or it may be a system that is made up of mechanical parts and automation (software).

It all starts with your user requirement specification. Unless you describe what you want (need) and how you want to use the system, it will be impossible to perform qualification. Let us take the example of a mixer. At what speeds and temperatures and for what length of time do you intend to use the mixer? Do you require preset programs, alarms, power supply of a specific voltage, polished stainless steel surfaces, specific dimensions of the mixing paddle, etc.?

Once you know what you need, you can prepare the qualification plans and protocols (these can be one document). These documents describe what you want to test, who will perform the testing, how the tests have to be performed and how results have to be documented. The mixer may come with 50 pre-installed mixing programs. It is probably unnecessary to test them all, and sometimes it is not possible to test 100%. In these cases, you describe your rationale for selecting a limited number of test cases. Do you need to test at all? In principle yes, because with any delivery and installation, something can go wrong, such as missing connections, incorrect software version, wrong version of the user manual, etc.

If your test plans contain tests that have no related user requirement (perhaps you verify the color of the mixer), you can certainly document these items; but remember, you cannot pass or fail the result. It just is what it is.

Crucial to qualification is documentation (i.e., documented evidence). An example of insufficient evidence would be if the test checks that the mixer can be run for 60 minutes without overheating and all you document is:

Test: ‘Verify that the mixer does not overheat after 60 minutes of mixing at full load.’

You need to also document the type of load (e.g., sugar syrup with a viscosity of xyz), the mixing speed (e.g., 10 rpm setting on the mixer), how the time was measured (e.g., stopwatch), and how it was proven that the mixer did not overheat (e.g., alarm 12 ‘overheating’ did not show and stop the mixer). That will then be documented evidence that satisfies the regulators.

This is of course just a very high-level summary of qualification basics, but it should give you something to start with.


Volume 46, Number 11
November 2022
Page:

When referring to this article, please cite it as S. Schmitt, “Principles of Equipment Qualification,” 

Documentation is crucial to equipment qualification, says Siegfried Schmitt, vice president, Technical at Parexel.

Principles of Equipment Qualification

Q. During the periodic review of our ‘Third-Party Auditing’ standard operating procedure (SOP), the quality and the operational teams could not agree on the contents. Some wanted more detail, others less. What best practices can you recommend?

A. Quality systems evolve, and this evolution brings changes to the contents of the documents, such as SOPs. The regulations do not demand effective and efficient systems and instructions, but this of course is in the interest of any company. They do, however, require that activities that must comply with the laws and regulations are documented. Before starting to write any text, please remember:

All activities that form part of a quality system can be described as processes.

All processes can be described in a process flow diagram.

The description of the activities, roles and responsibilities, and associated data and documents are associated with specific process steps.

Best practices take this into account. Thus, a SOP shall be based on an agreed process flow. Unfortunately, all too often process flows are an afterthought when the SOP has already been written. It is rarely easy or even possible to create a process diagram based on existing text. The opposite, however, is straightforward.

Let us therefore look at the example of your third-party auditing SOP. First, you need to prepare a process flow diagram. A generic example is given in 

 Process flow diagram for a third-party auditing standard operating procedure. Figure courtesy of the author.

Based on this process flow, you can now start writing, detailing the activities. As you can see, the steps are numbered. This numbering establishes a connection between the text and the graphic; allowing anyone to quickly find the information either in the process diagram
or the instructions.

Regarding the question,how much or how little text is required—there is no simple answer. It depends on many factors, such as the size of your organization, how you structure your quality system, or the expertise of your personnel. A company with a staff count of five requires a different level of detail and amount of text than a company with thousands of staff in multiple locations.

If you structure your quality system such that the SOPs contain the “what to do” and the Work Instructions (WI) the “how to do” information, then the description for step 1 in the SOP can be as short as:

Company quality and operational management identify the need for an audit and request the company audit cadre to prepare for the audit.

Open the request in the audit management application following WI eyfds.

The audit preparation by the company audit cadre follows WI xyzzy.

Note: Typically, the need is identified as part of a supplier assessment or as part of a deviation

Note: The right to perform an audit should be documented in the quality/technical agreement with the third party

Note: The audit can be an on-site or a remote (virtual or paper) audit

If, however, you pack the “what to do” and the “how to do” all into one document, then this will become a large and more cumbersome-to-use document.

It is quite easy to change the structure of your current SOPs into this best practice one, every time you need to revise an existing SOP. This allows your staff to become continually more familiar with the new design and layout. And it should, iteratively, help achieve consensus between your departments as to the amount of detail required.

Siegfried Schmitt is VP Technical at Parexel.


Volume 46, Number 9
September 2022
Pages: 58, 57

When referring to this article, please cite it as S. Schmitt, "Best Practices for Developing a Third-Party Auditing SOP," 

A process flow diagram can help create an agreed-upon process flow for a third-party standard operating procedure, says Siegfried Schmitt, VP Technical at Parexel. 

Best Practices for Developing a Third-Party Auditing SOP

Q. In a recent audit, we received an observation because we do not have a standard operating procedure (SOP) for the archiving of electronic records. We keep our electronic data and records on our live systems. Why would we need such a procedure?

A. The short answer is because the regulations stipulate this. “For new systems, a Validation Summary Report for each computerized system should be in place and state (or provide reference to) at least the following procedure for data archiving (processes and responsibilities), including procedures for accessing and reading archived data” (1). It is, however, sensible to look at the reasons behind this requirement and why it is also good business sense to have such a SOP in place. Data and records that are governed by the healthcare regulations must be retained and be available throughout the mandated retention periods for the respective records. In the case of clinical data, this can be 25 or more years, and for manufacturing records (paper or electronic), this is typically five or more years.

Over such a period of time, almost every computerized system undergoes modifications for a variety of reasons. These include patching the system (e.g., for security), installation of new software modules (e.g., for enhanced usability), system upgrades, system retirement, or system replacement. Any of these changes may or will affect the electronic records in the system. Depending on the impact, it can or will be necessary to remove the records from the system and store them in an archive.

Despite best intentions and good planning, there is always the possibility of an unexpected need to archive electronic records. That could be because of an unforeseen system failure or because the system performance falls below acceptable levels. It is not acceptable to wait until such an event occurs to write a procedure for the archiving of records and data; instead, it is essential to prepare the SOP well in advance.

Archiving electronic records is rarely trivial. Simply printing out the records is unlikely to either assure the entire record is captured or to be compliant with the regulations (paragraph 7.7.2 in reference 2). Archiving must take into consideration the regulations for automated systems and the guidance on data integrity. Especially:

If data are transferred to another data format or system, validation should include checks that data are not altered in value and/or meaning during this migration process (2)

Data may be archived. These data should be checked for accessibility, readability, and integrity (2).

Practical guidance has been published by various regulatory authorities (3,4) and industry associations (e.g., Appendix O1: Retention, Archiving, and Migration in reference 5).

In summary, having an electronic-records archiving SOP in place is not only a regulatory requirement, but it also makes sense from a business perspective. After all, you want to be sure that you can access your data and records throughout their lifespan and to be certain that the values and information therein is still correct and complete. Writing the SOP, however, is only a first step, implementing the process and validating it are the necessary and logical next steps.

 Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments 

Data Integrity and Compliance With Drug CGMP

Questions and Answers, Guidance for Industry

‘GXP’ Data Integrity Guidance and Definitions

When referring to this article, please cite it as S. Schmitt, “The Difference between Electronic Records Retention and Archiving,” 

An SOP for electronic-records archiving is a regulatory requirement and good for business, says Siegfried Schmitt, vice president, Technical at Parexel. 

The Difference between Electronic Records Retention and Archiving

Q: In light of the COVID-19 pandemic, many of our planned on-site audits can no longer be performed for the foreseeable future, and there is a need to replace these by remote (desktop) audits. Under what circumstances can such remote audits be considered equivalent to on-site audits?

	A: Regulatory agencies around the world are facing the same challenge of deciding when inspections can be performed remotely and when they must be performed in person. Each respective agency has its own guidelines, but across the board, they all rely on the fundamental principle of a risk-based approach to compliance.

	In April 2020, the European Medicines Agency (EMA) updated its guidelines to allow for quality personnel to conduct remote audits when on-site audits are not possible, noting that, “… on-site audits as well as remote audits can be considered, after agreement with the investigator and if the audits are assessed as essential, e.g., triggered audits with the purpose of investigating serious deviations from the trial protocol or from the applicable legislation” (1).

	Similarly, FDA announced postponement of both foreign and domestic inspections, except those deemed mission critical, and the agency is now relying on off-site monitoring and the commitment of companies to quality in the absence of in-person regulatory oversight. For medical devices, FDA has published a “Remote Auditing Pilot Program” document outlining a voluntary pilot program for remote auditing of processes, the Medical Device Single Audit Program (MDSAP) as part of the audit of a medical device organization (2). An important aspect of this pilot is the use of technology that facilitates remote audits, including:

		Web-based meeting systems with screen sharing capability

		Teleconferencing in conjunction with e-mail

		Smart glasses or optical mounted head displays

		Remote ‘read only’ access to automated systems, such as electronic quality management systems (e.g., to view standard operating procedures [SOPs], deviations, electronic batch records, video recordings from the operational area, etc.).

As part of the audit preparation, it is important to ensure that all involved parties have suitable and compatible technological means in place, as tools and technology vary considerably across organizations. It is recommended to prepare a checklist with minimum requirements, such as Internet upload and download speeds, for each technology, and to share this checklist in advance with the sites to be audited.

	It is also important to consider in advance not only the feasibility of each type of audit, but its respective benefits and limitations. 

provides an example for such a comparison. Whichever audit model is selected, it should be based on a documented risk assessment, and standard audit procedures should be developed in advance of the audit.

	1. EMA, “Update to Guidance on Regulatory Expectations in the Context of COVID-19 Pandemic,” Press Release, April 20, 2020.
	2. FDA, Medical Device Single Audit Program (MDSAP), 


	Vol. 44, No. 7
	July 2020
	Pages: 66, 65

	When referring to this article, please cite it as S. Schmitt, “Performing Remote Audits During the Pandemic,” 

It is important to consider the feasibility, benefits, and limitations of each type of audit in advance.

Performing Remote Audits During the Pandemic

Q. While working on a variety of projects in three different continents, I had the opportunity to meet and work with young, enthusiastic newcomers to the industry. They were from a variety of different professional backgrounds, including pharmacists, engineers, and chemists. During our conversations, most of them asked the following types of questions:

The college or university I graduated from did not provide courses on compliance or industrial operations-how can I fill this gap?

Though I applied for many positions, I have been unable to find a permanent position yet-how can I improve my chances?

On the Internet, I found several courses on good manufacturing practices (GMPs), for compliance experts, or similar. These are relatively expensive. Are they worth investing for someone like me (a beginner)?

Should I work my way up within a particular department or would it be better if I gain experience in different departments?

	A. The following are not exhaustive or the only answers to these questions, but they will give some insight.

	It is true that few graduates have seen industrial operations by the time they graduate, but that doesn’t mean that they don’t come equipped with many of the basic skills needed in the industry, such as team working, presentation skills, analytical thinking, and the ability to self-study. Companies will provide training, as a minimum on the applicable and relevant internal processes and procedures, which will cover both the operations and the compliance side of the business. A lot will be learning on the job, from peers and often also from mentors.

	Finding your first permanent job can be a frustrating experience, but persistence usually pays off. Gaining experience through temporary voluntary engagements, placements, or positions is what helps improve the chances for long-term or permanent employment. And don’t forget to network through portals such as LinkedIn, Bing, or similar sites that have a good reputation with industry and job agencies. Also, it’s important to write a succinct and well-thought-out curriculum vitae, and there is a lot of great advice available for free online on how to do this. The Internet is the place to research jobs, but often also for potential employers to find the right candidate.

	Having a better understanding about compliance will surely be of benefit, whether looking for a job or for furthering one’s career prospects. Whether you are lucky enough to have your employer pay for external courses, be subsidized (e.g., by a state job center), or have to pay yourself, in all cases you should scrutinize the courses offered:

		How relevant are they to your current or prospective work?

		Do they provide references? Is there feedback available?

		Are the certificates merely proof of attendance or are they widely recognized by the industry?

		Is it just classroom learning or is there also a practical element?

		Do they provide comprehensive documentation?

	The answers to these questions will help you determine if the course is right for you. For example, if you want to become a certified auditor (be it for GMP or ISO 9001), you will have to pay for a course with an approved training company. If however, you want to get a basic understanding of the freeze-drying process, you will easily find free tutorials online. Should you need hands-on experience, then training courses offered by universities or industry associations with in-house training centers will be the right choice.

	What if you have been in the industry for a while, but would like to change positions and/or area of expertise? Very often this is less of a question of opportunity, but more of a question of an individual’s preferences. There are equally excellent subject matter experts who never strayed from their vocation (say regulatory affairs, quality control, or manufacturing) and who are perfectly happy in their jobs, and there are those who worked in different departments to become more universal experts. Pharmaceutical companies probably look more for experts in a particular subject, whereas service providers, such as consultancies or contract research organizations, may have a need for experts with more varied backgrounds.

	We may not always find the job we want, but we can always learn from what we do, and it will always be a beneficial personal and job experience.

	When referring to this article, please cite it as S. Schmitt, "Starting a Career in the Bio/Pharmaceutical Industry," 

Having a better understanding about compliance will be of benefit when looking for a job or for furthering one’s career, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.
