Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q. I work in my company’s quality department. What are some best practices for handling process or product changes?

	A. In December 2019, the Pharmaceutical Inspection Co-operation Scheme (PIC/S) published a recommendation, ‘How to Evaluate/Demonstrate the Effectiveness of a Pharmaceutical Quality System in relation to Risk-based Change Management’ (1) and a Concept Note on this Recommendation document (2). This action highlights two critical aspects, namely the importance of change management within the realm of quality and the necessity to apply a risk-based approach.

	Nothing stands still; therefore, change is inevitable. Though the PIC/S document covers all relevant steps in the change management process-from change proposal, change assessment, change planning and implementation, through to change review and effectiveness checks-it does not detail categories of change. It merely states, ‘Change categorizations are appropriate and based on the level of risk’ (1).

	In practice, the following are three typical categories of change:

		Planned changes: Someone wishes to make a change for whatever reason and applies to make this change. This change, if approved, will be implemented, its effectiveness verified, and it becomes permanent.

		Temporary changes: Sometimes, someone wishes to make changes for a defined period of time followed by a return to the previous state. This could be because there is the need for some building work, or because of staff shortages, or other reasons.  Again, it is known that someone wants to make this change. If approved, it will be implemented for the desired period and then all goes back to as it was before. Some companies use the term ‘planned deviations,’ which is synonymous with ‘temporary changes.’

		Emergency changes: Rarely, an organization may have to implement emergency changes. Here, nobody knew that this change would be required, so there is no planning. Perhaps there is not even time for approval before the change is being implemented. Almost always, this type of change is triggered by an event that endangers environment, health, or safety. In short, an emergency change is triggered by a deviation. Perhaps a gas pipe develops a leak; the line must be immediately shut down and work perhaps continues with gas cylinders. As soon as possible, the change needs to be properly assessed and a decision must be made; this will either become a temporary change or a permanent change. To emphasise, the only difference here is that you cannot plan for it.

	Looking at these scenarios, one finds that the starting point can differ (either a change request or a deviation). The end point may also differ; one may end up in a new state (permanent change) or back where it all started from (temporary change). The pathways for these change categories are shown in the flow chart (

). This flow chart needs to be amended as necessary, to reflect the specific processes and procedures within each company. Just make sure, you comply with all the relevant requirements in the regulations, as summarized in the PIC/S document.

	1. PIC/S, “Recommendation, How to Evaluate/Demonstrate the Effectiveness of a Pharmaceutical Quality System in relation to Risk-based Change Management,” Nov. 28, 2019.
	2. PIC/S, “Concept Note on a Document prepared by the PIC/S QRM Expert Circle on ‘How to Evaluate/Demonstrate the Effectiveness of a Pharmaceutical Quality System in relation to Risk-based Change Management’,” Oct. 7, 2019.

	When referring to this article, please cite it as S. Schmitt, "Embracing Change Management," 

Articles

No matter why change may be needed, it is important to comply with all the relevant regulatory requirements, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.

Embracing Change Management

Q. A recent inspection of our facility resulted in several observations, including insufficient hand sanitization by personnel in the sterile filling area, deficient gowning in the microbiology laboratory, and use of wooden pallets in the cold storage area. Before concluding, the inspectors told us that they want us to address these deficiencies holistically. Can you give some advice on how to do this?

	A. It is correct that all too often, companies address each and every inspection observation individually, rather than address fundamental flaws or gaps in the systems, processes, or organizations. The regulators want the industry to find the true root causes for their compliance lapses. This is why your inspectors want to see the issues they identified addressed holistically. For example, they want you to clearly identify the functional relationship between the parts that lead up to a compliant operation and the whole.

	Looking at the examples you cite, it seems that you would be best served by preparing a contamination control strategy (CCS). Control strategies are an increasing requirement in the European Union good manufacturing practice regulations (EU GMPs) and expected to be referenced in the next revision of 

 (1). The draft text, which is likely to be adopted in the final version, reads:

	‘Quality assurance is particularly important, and manufacture of sterile products must strictly follow carefully established and validated methods of manufacture and control. A contamination control strategy should be implemented across the facility in order to assess the effectiveness of all the control and monitoring measures employed. This assessment should lead to corrective and preventative actions being taken as necessary. The strategy should consider all aspects of contamination control and its life cycle with ongoing and periodic review and update of the strategy as appropriate.’

	In your case, the CCS should consider all the integral elements of sterile product manufacturing, including quality risk management (QRM) principles and supporting risk assessments for contamination control and monitoring (detectability of contamination event) (2). How should or could you develop this CCS? First, you need a complete process flow description of all materials and personnel. This will allow you to identify points of critical risk of contamination and points of inherent risk of contamination.

	If we take the examples provided by your inspectors, you will need to identify where there is a risk for contamination (e.g., the operators) and how you control this risk of contamination (e.g., gowning and barriers, such as isolators and disinfection). Next, you need to determine whether these control measures (individually and as a whole) are sufficient to reduce the risk to an acceptable level. For example, is hand sanitization performed often and sufficiently, and is the procedure following 

 (3)? Are your personnel suitably trained and are they following the prescribed procedure? Have you collected sufficient data (e.g., from swabs and dabs) that prove the efficiency of the sanitizing regime? Once you have performed this risk assessment, you will have sufficient information and data to understand, whether:

		Your hand sanitizing procedures are adequate and effective

		Your personnel training and personnel following procedures is correct

		Your contamination control strategy for all points of risk of contamination from gloved hands is appropriate and sufficient.

	If not, you should be able to immediately identify corrective action and preventive action (CAPA) measures to reduce the risks to an acceptable level.

	The CCS will bring all these assessments together and provide a holistic view of your approach to contamination control. The CCS is not only needed for responding to the inspection observations, it is an essential document for any pharmaceutical operation and, in particular, for sterile manufacturing ones.

Annex 1, Manufacture of Sterile Medicinal Products

	2.  PHSS, Control Strategy in Manufacture of Sterile Pharmaceutical/
	Drug Products, Whitepaper.


	Vol. 43, No. 9
	September 2019
	Pages: 58, 57

	When referring to this article, please cite it as S. Schmitt, "Developing an Effective Contamination Control Strategy," 

Providing regulators with a holistic approach to addressing deficiencies is the best response to an inspection, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.


Developing an Effective Contamination Control Strategy

Q. We are preparing for our first inspection by an overseas regulatory agency. This will be a challenge from several perspectives: language, culture, and presentation style. We believe we have covered the first two issues through highly experienced translators and cultural training sessions with coaches. Our concern is about how to present and respond in an appropriate manner. Can you give any advice?

	A. Hosting a foreign agency for the first time is always challenging, but as with all inspections, nothing beats preparation, practice, practice, and more practice. Even seasoned personnel can become flustered, nervous, or even unsure how to respond to unfamiliar questions or requests, especially when asked in a foreign tongue. One tool proven to be particularly useful in such situations is a playbook. Playbooks may be known by other terms, but essentially these are aide-memoires that function as references for company representatives who need to present or answer questions from inspectors or auditors. The playbook may include prepared answers to anticipated questions the auditor may ask and/or detailed information about process steps.

	How detailed should these playbooks be and in what format? Here is what has stood the test of time:

		Always start with a succinct, logical, and convincing few lines of text and/or graphics.

		If necessary, have a second playbook with more detailed, supporting information.

		Have a third party (i.e., someone unfamiliar) review your playbook and/or provide feedback.

	The first point is the most important. As we all are experts in what we do, we can talk in great detail about it. But inspectors do not have unlimited time. They want to receive answers that provide them with clear and easy-to-comprehend information. This is best illustrated with an example. The inspector may ask: ‘What is your bioburden control strategy for this product?’ Without a playbook, the answer may go like this: ‘In step 5 after vessel 234 on the second floor, remember you saw this reactor on the tour of the facility. We have installed a 0.2-micron filter …’

	With a playbook, the answer would be more similar to this: ‘We have a bioburden control strategy that takes into account environment, process equipment, material handling, product properties, and regulatory expectations. For the five steps produced in our facility, we have prepared a strategy paper, which has subsequently been verified during the validation studies and ongoing monitoring.’

	Of course, should the inspector then want to know more details, this is when all the evidence can be presented. Again, it may be useful to have a playbook ready for this, especially if many activities should be organized in a logical sequence and timeline.

	Playbooks have several benefits, as they help those responding in an inspection to give clear answers. They also help prepare the site personnel to find answers to difficult questions (e.g., why certain deviation investigations are overdue, or why a particular change hasn’t been documented as per requirements). They also help summarize convoluted event histories or complex situations. Often, one has to overcome obstacles to reach a successful outcome, and playbooks help to focus on the positives, rather than to overemphasize the difficulties experienced.

	Then why should one have these playbooks reviewed by someone from the outside? Well, the inspector will be exactly such a person (i.e., an outsider who isn’t necessarily familiar with the terminology, the facility, or the processes used at the site). Therefore, by having an outside third party review the playbook, you essentially perform a dry run of the inspection.

	In summary, these playbooks are a useful tool in any inspection or audit, whether foreign or local, but writing these in a clear and concise manner is anything but child’s play.

	When referring to this article, please cite it as S. Schmitt, "Playbooks Are Not Just Child’s Play," 

Cultural and language discrepancies during an audit can be resolved using what many call a “playbook,” says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.


Playbooks Are Not Just Child’s Play

Q. During a recent audit of our company, the auditor found some non-conformance issues that we disagreed with. Do we have to make the changes the auditor suggested?

	A. Those of you who have been audited will likely have come across the following situation: the auditor has identified a non-conformance with the applicable regulations. Purely for illustrative purposes, let us say that the auditor identified missing documents that should have been prepared as part of a laboratory information management system (LIMS) validation. Now the auditor informs the auditee about this finding.

	The auditee shows surprise and retorts that this site/company/laboratory has a long history of successful inspections by regulatory authorities from three continents and that they never had an observation like this. In fact, during the last inspection by an agency, the LIMS validation package had been reviewed and found perfectly acceptable. Therefore, the auditee refutes the validity of the auditor’s observation.

	So, how do we resolve this? Shouting match? Exchange of heated arguments? Certainly not! After all, we are professionals. And as such, we need to understand both sides.

	No matter what conclusions the auditor comes to, the auditee should review the validity of the results. Obviously, the auditees will accept a positive inspection outcome with no or few or only minor observations as confirmation of the validity and acceptability of their quality systems, modes of operation, facilities and equipment, and organizational structures. However, any such result should be carefully analyzed, and the following questions (not all-inclusive) should be asked by the auditee:

		Was the inspector an expert in the field? Of note, very few people are an expert in everything.

		Did the inspector look at the documentation and the system in detail? Or was the focus of the inspection on other aspects or areas?

		Are we aware of any issues regarding the validation of that system (i.e., something we know about, but the inspector may have missed)?

		If the answers to the first two questions are a yes and no to the third, then we can be quite confident that indeed the system documentation is fully supportive of our claim to validation.

	The auditor should also question their own results

	Auditors should always challenge their decisions and statements, as their audit findings can have as much impact on the audited company as a regulatory inspection. Questions an auditor should ask themself include, but are not limited to:

		Am I sufficiently proficient and experienced in the specific field to make an informed decision?

		Have I referenced the correct and the latest regulations, guidance documents, industry best practices, or other sources of pertinent information?

		Have I been able to collect a sufficient and/or representative sample of evidence to support my statements?

		Did I take the auditee’s challenge seriously, and have I managed to refute it based on science, regulatory evidence, and/or other unbiased basis? 

	We should bear in mind that inspectors and auditors alike are humans. As such, auditors make mistakes, have preferences, and to some extent, may be biased. Furthermore, an audit or inspection can only ever be looking at a snapshot in time. For example, unlike the people working in the company under scrutiny, auditors will not see all the behaviors, all the operations, etc. As a result, all statements made are based on a limited amount of information and observations.

	And we must not forget that the focus of an inspection (or audit) can change over time, be it for developments in the regulatory field (e.g., the increase in data integrity-related inspections in recent years) or changes to the circumstances in the inspected site (e.g., new ownership, the introduction of new dosage forms, etc.), to name a few possible reasons. Consequently, a site may have been in compliance over many years, but may not have kept up with the changes, which may suddenly find the site in a state of diminished compliance.

	It is better to have a non-conformance picked up during an audit than have it recorded during an inspection. So, the next time your auditor tells you about an issue you didn’t know about, it may be sensible to accept and investigate it before deciding to reject it.


	Volume 43, Number 5
	May 2019
	Page: 66 

	When referring to this article, please cite it as S. Schmitt, "The Auditor Vs. Inspector Issue," 

We need to understand both sides when it comes to audits, says Siegfried Schmitt, PhD, vice-president, technical, PAREXEL Consulting.


The Auditor Vs. Inspector Issue

Q. In recent times, several agencies and organizations have published regulations and guidances on data integrity. It is hard enough keeping up with all the requirements and recommendations, and it seems that our processes and procedures are becoming ever more complicated because of these regulations. How can we prevent ‘death by complexity’?

	A. Indeed, a lot has been published on the subject of data integrity (1–3), all with the best intentions, but not necessarily always providing the most practical of advice. Or, it may just be hidden in the vast amount of information provided in these documents. For example, a Pharmaceutical Inspection Co-operation Scheme (PIC/S) guidance document (2) states, ‘Examples of factors which can increase risk of data failure include complex, inconsistent processes with open ended and subjective outcomes. Simple tasks which are consistent, well defined, and objective lead to reduced risk.’ In 2016, the World Health Organization (WHO) (4) stated, ‘Good data process design should consider, for each step of the data process, ensuring and enhancing controls, whenever possible, so that each step is: consistent; objective, independent, and secure; simple and streamlined.’

	Therefore, it is worth noting that simplification is a strong enabler of data integrity. So how does this work? There are some basic principles that should be applied consistently, such as:

		Simple, but clear and unambiguous instructions

		The sequence of instructions reflects the sequence of activities

		In a written document, the reader is never required to go back within the document

	In one example, the records for the cleaning of a controlled area were scrutinized in an audit. According to the records, it was not clear when the operator cleaned a specific room and whether the cleaning was done correctly. The operator had to clean three rooms; this process was always done in a logical sequence, but that was not described in the instructions. As the operator was not allowed to take paper into these areas, the record was only completed once the operator had exited the area. The instructions were 45 pages long, which made it doubtful whether the operator could remember all the steps correctly.

	Following the audit, the cleaning instructions for each room were extracted and written in a simple logical sequence. It was possible to fit the new sequence of instructions onto one or two pages (per room), which were laminated and could thus be disinfected and permanently displayed in the respective areas. This way, the operator could consult the instructions whenever necessary. Furthermore, the cleaning logbook was redesigned to show on one line the date and time the operator entered the area, and the date and time the operation was complete, together with a field for any comments (rather than having each entry on a different line and often on different pages of the logbook).

	This simple example illustrates that it is not always necessary to change the way operations are performed. What has to be done, however, is to break down instructions into manageable pieces, with tasks unambiguously described and presented sequentially. Why does this help with data integrity? Because it eliminates or prevents errors, reduces the risks of data omissions or errors, and enhances confidence in the system by inspectors.

	In summary, though compliance with data integrity regulatory requirements may necessitate some more complex methodologies or systems, simplification of procedures and instructions is a key element of the compliance effort.

Data Integrity and Compliance with Drug CGMP, Questions and Answers, Guidance for Industry

 (CDER, December 2018).
	2. PIC/S, PI041-1 (Draft 3), 

Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments

GAMP Good Practice Guide Data Integrity–Key Concepts 


	4. WHO, Technical Report Series No. 996 (WHO, 2016),

	When referring to this article, please cite it as S. Schmitt, "Is Simplification Aiding Data Integrity Compliance?," 

Simplification is crucial to maintain data integrity, according to Siegfried Schmitt, PhD, vice-president, technical at PAREXEL Consulting.

Is Simplification Aiding Data Integrity Compliance?

Q: We are a medium-sized company in Europe, specializing in gene-therapy products. So far, we have only marketed our products in Europe, but we are planning a global expansion. By now, we are familiar with the European inspectors and how they inspect. How can we prepare for inspections from overseas agencies? We hear that there is no harmonization in expectations?

	A: Congratulations on your plans and being proactive in preparing for these inspections. To some degree, inspectorates from around the world are making attempts at harmonizing how they inspect. Regulatory agencies that belong to Pharmaceutical Inspection Co-operation Scheme (PIC/S) follow a harmonized inspection process. It is sensible to familiarize oneself with these procedures, which are freely available on the PIC/S 

	Other drivers for harmonization are mutual recognition agreements (MRAs), which require agencies to recognize each other’s competence and equivalence. Currently, the United States and the European Union (EU) are in the process of 

 (2). As you will already be aware, inspectorates of the EU’s member states, the 

, are all peers (i.e., recognizing each other’s inspections as completely equivalent) (3).

	That said, you may still encounter differences in inspection process and style, and moreover, differences in opinion from your inspectors. Why might this be? There are three main contributions:

		The law: different national regulations

		The approach: country-specific inspection processes and requirements

		The human factor: personal preferences of the inspectors.

	To make your inspections as smooth and successful as possible, you need to acquaint yourself with all three aspects and prepare for them. A pharmaceutical firm is legally required to comply with the national regulations in any country it wishes to market its products. Therefore, you must be familiar with the regulations. For example, your products will have to comply not merely with the pharmacopeia in your native country, but also with those of the country the overseas inspector is from. Do not be surprised if an inspector wants to see that you do possess a copy of that document and that you can read it if it isn’t in your native language.

	Many agencies publish details on how they inspect and often also provide additional information on the inspection process and the agency’s expectations. The United Kingdom’s Medicines and Healthcare products Regulatory Agency (MHRA), for example, has a 

 (5), and Australia’s Therapeutic Goods Administration (TGA) updates information on their inspection approaches regularly on their 

(6). It is essential to stay informed on the inspection process, as some agencies may have specific requirements. Russia’s Roszdravnadzor, for example, requires you to provide certified third-party translators with good manufacturing practice expertise for its inspection; or Colombia’s National Food and Drug Surveillance Institute (INVIMA) expects you to have all observations resolved by end of inspection. Here, the difficult part is that not all the expectations are included in the guidance documents. The best way to get access to such detailed information is to use the help of professional service providers and to interact with peers (e.g., at conferences or through industry associations).

	The last point, namely an inspector’s personal opinions, is one you simply have to address at the time of the inspection. As with all inspections, courtesy and professionalism will go a long way.

	To answer your question: be prepared by having a sound understanding of the regulations and the regulatory inspection processes, including the unwritten expectations. Regulatory intelligence is essential as regulations change continuously and so do the inspection processes.

Module 09–Good Practice and Inspections

,” Presentation at the 2nd International Awareness Session–The EU Medicines Regulatory System and the European Medicines Agency, March 8–9, 2018,.
	4. MHRA, MHRA Inspectorate Blog, 

, www.fda.gov/iceci/compliancemanuals/complianceprogrammanual/ucm2005382.htm.
	6. TGA, Manufacturing Inspections, 


	Volume 43, No. 1
	January 2019
	Page 62

	When referring to this article, please cite it as S. Schmitt, "Global Inspection Harmonization," 

Understanding the differences in inspection processes is the key to successful global expansion, according to Siegfried Schmitt, PhD, vice-president Technical, PAREXEL Consulting.