Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

 	Siegfried Schmitt, principal consultant, PAREXEL, discusses how to handle internal audit reports during inspections.	 	

Q. Our internal audit procedure is due for revision. It currently states that internal audit reports will not be made available to inspectors from regulatory agencies and that the reports can be destroyed once all corrective actions have been completed. Is this still compliant with United States and European Union (EU) regulations?

	 	A. Internal audits, or self-inspections as they are called in the EU, help assess a pharmaceutical company’s quality system and compliance status. When a company performs internal audits, it is essential to have a procedure in place, which your company does have. The US and the EU have different regulations regarding internal audit records. In short, if you destroy your internal reports, you would be compliant with US regulations, but not with EU regulations. 	To further elaborate, it’s important to realize that the US cGMP regulations (21 

] Parts 210 and 211) do not describe specifically a requirement to conduct or keep records of an internal quality assurance audit. Considering this, your procedure would be compliant. According to published FDA policy, during routine FDA inspections and investigations conducted at any regulated company that has a written quality assurance program, FDA will not review or copy reports and records that result from internal audits under the written quality assurance program (1), and additionally, for medical device manufacturers, the policy is codified at Title 21, 

, Section 820.180(c) (2). Consequently, you could, if you so wish, destroy the report once all corrections have been performed and implemented. However, you do have to retain the documentation on the corrective actions as these are covered in 21 

 211 (3).	 	On the other hand, the EU GMP regulations for medicinal products for human use have a chapter dedicated to self-inspections (4), which specifically mention the need for an internal audit report: “All self-inspections should be recorded. Reports should contain all the observations made during the inspections and, where applicable, proposals for corrective measures. Statements on the actions subsequently taken should also be recorded.”	 	Therefore, self-inspection reports must be prepared, retained in accordance with documentation retention requirements, and most importantly, be provided to the regulators when requested. In fact, refusal to provide the internal audit report in an inspection can be considered a critical observation. EU inspectors are known to have terminated inspections because of critical observations. This is similar to FDA’s “refusal to co-operate with the inspection” in which FDA would terminate the inspection. 	 	In the EU, the requirement for self-inspections extends to drug substance (i.e., API) manufacturers as specified in the Delegated Act of 28.5.2014 supplementing Directive 2001/83/EC (5), which says, “The manufacturer shall conduct regular internal audits and follow-up on the findings.”	 	While you are revising your internal audit procedure, it would be beneficial to check and ensure that it covers a review of the effectiveness of your governance systems for data integrity and traceability (6). Updating procedures when new legislation and guidance is issued will help ensure compliance (7).	 	To recap, you are still compliant with US regulations, but as detailed above, this is not the case for EU regulations. It is good practice to design your quality system so that it complies with even the most stringent regulations that apply to your business.	 	

	1. FDA, CPG Sec. 130.300 FDA Access to Results of Quality Assurance Program Audits and Inspections (FDA, June 2, 2007). 

www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm073841.htm

 Title 21, Part 820.180 (Government Printing Office, Washington, DC, revised April 1, 2014), 

www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=820.180

www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=211

, accessed June 1, 2015.	4. European Commission, 

EudraLex, The Rules Governing Medicinal Products in the European Union, Vol. 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use 

http://ec.europa.eu/health/files/eudralex/vol-4/pdfs-en/cap9_en.pdf

, accessed June 1, 2015.	5. European Commission, Commission Delegated Regulation (EU) No 1252/2014 Of 28 May 2014, 

http://ec.europa.eu/health/files/eudralex/vol-1/reg_2014_1252/reg_2014_1252_en.pdf

, accessed June 1, 2015.	6. MHRA, MHRA expectation regarding self inspection and data integrity (MHRA, Dec. 16, 2013), 

http://webarchive.nationalarchives.gov.uk/20141205150130/http://www.mhra.gov.uk/Howweregulate/Medicines/Inspectionandstandards/GoodManufacturingPractice/News/CON355490

www.pharmtech.com/how-stay-abreast-shifting-regulations-and-remain-compliant

:
		When referring to this article, please cite it as, S. Schmitt, "Compliance with US and EU Internal Audit Requirements," 

Articles

Siegfried Schmitt, principal consultant, PAREXEL, discusses how to handle internal audit reports during inspections.

Compliance with US and EU Internal Audit Requirements

	Q. We are a medium-sized company and our products are sold in nearly 70 countries world-wide. Consequently, we are inspected by several agencies. These inspections resulted in some observations for not complying with the current good manufacturing practice (cGMP) regulations. Because our quality unit is relatively small, it is challenging to stay up to date with the latest regulatory changes. What are the best ways to stay abreast of shifting regulations to remain compliant?
	
	A. As you are aware, companies must comply with currently applicable regulations. To do so, you will need individuals, ideally from the quality unit, dedicated to gathering regulatory intelligence. This process includes collating information on existing and anticipated laws and regulations. Such information is available from a variety of sources including from the regulatory agencies themselves, free newsletters, and commercial providers.

	Regulatory intelligence does not stop there. Teams must analyze whether regulations will impact your company’s quality system, operations, or regulatory dossier/application. Sometimes new or changed regulations come with a defined implementation (‘grace’) period, while in other instances they are immediately enforceable upon publication. The European Union 

 Volume 4, Chapter 3 on Premises and Equipment, for example, was revised in August 2014 but was not enforced until March 1, 2015 (1). In some cases there is only an expectation, which may be embedded in guidance documents or in concept papers published by a regulatory agency. For example, the Medicines and Healthcare Products Regulatory Agency first issued a guidance document in January 2015 that sets a 2017 deadline for compliance to certain data integrity aspects (2). Similarly, 21 

 Part 11 Electronic Records; Electronic Signatures in the United States has an effective date of Aug. 20, 1997 (3).

	Once the regulatory intelligence team has reviewed and analyzed changes to the legislation for applicability and impact, it is then tasked with communicating and disseminating it to all the relevant parties within the company including the quality unit, production departments, logistics teams (e.g., for good distribution practices), and regulatory affairs. Process owners in these various departments must implement the changes to comply with the new requirements. The quality unit needs to verify timely compliance through internal audits throughout the process.

	At the very minimum, companies must establish a regulatory intelligence function to gather information and proactively help shape new legislation. Most new laws and regulations go through an ‘open comment’ period where interested parties-either individuals or members of industry associations--can provide feedback and ask clarifying questions to help eliminate errors, point out omissions, or suggest changes.

	Establish a dedicated regulatory intelligence function, put the right communication channels in place, and empower your quality unit to verify compliance in a timely manner. Doing so will help you stay current with applicable regulations and compliant with new and amended laws.

EudraLex, The Rules Governing Medicinal Products in the European Union, Vol. 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use

 Part 1, Chapter 3: Premises and Equipment.
	2. MHRA, 

Good Manufacturing Practice: Data Integrity Definitions And Guidance

, Jan. 23, 2015, Re-issued March 13, 2015.
	3. FDA, Title 21 

www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=11

http://www.fda.gov/downloads/RegulatoryInformation/Guidances/ucm125125.pdf

 When referring to this article, please cite it as “How to Stay Abreast of Shifting Regulations and Remain Compliant,” 

Siegfried Schmitt, principal consultant, PAREXEL, discusses how to keep up with changing regulations.

How to Stay Abreast of Shifting Regulations and Remain Compliant

	Siegfried Schmitt, Principal Consultant, PAREXEL International, discusses good engineering practices.

	Q. Our engineering department is managed by a small team of professionals who supervise and manage a large number of service suppliers that perform the majority of engineering tasks. We find that it typically takes more than a month before these suppliers provide us with necessary documents, such as calibration reports or updated piping and installation diagrams (P&IDs). The engineering manager explained that this process cannot be expedited. We are concerned that this long delay may lead to a negative observation during our next inspection. How can we change this pattern?
	
	
	A. Outsourcing services is a common industry practice in the pharmaceutical business. The regulatory agencies are well aware of this fact and have issued rules and regulations governing outsourced activities (1, 2). These regulations and guidance documents, however, do not provide information that would define an acceptable period of time for providing data and records to the contract giver. In this specific case, the engineering department is the contract giver, but there are no specific regulations you can cite to ensure timely documentation. However, it is important to fix this challenge, due to the possible impact on operations and quality this document delay may create. 
	
	You mention two examples: calibration and engineering drawings. There can be major impacts on each of these due to slow response service suppliers. Let us first look at the calibration data and records. For both manufacturing operations and process validation, it is crucial to know the current calibration status of your equipment and instrumentation. If that information is unavailable, then you simply cannot proceed, seriously impacting your ability to operate. Also, in the case of deviations, such missing information can impede on the root cause investigation. Most companies attempt to complete this type of investigation within 30 days, which may be difficult if you must wait even longer for the relevant engineering information and documents. It is important to note that the validation in not confirmed until the engineering department verifies and approves the third party’s report and conclusion.
	
	In the case of the P&IDs, it will be difficult, if not impossible, to present the as-is build of your facility in case of an inspection. Without current drawings, making changes to the facility will be challenging at best. Not having a picture of the as-is situation may also hinder investigations if and when deviations occur. In either case, the slow response time of your suppliers can have critical impact on your engineering department and will need to be addressed.
	
	The time span from having the activity performed until you receive the data and reports from your suppliers seems excessively long, from both a compliance and a business perspective. If possible, work with your engineering department to review the quality/technical agreements in place with their suppliers (3). These should detail defined timeframes and modes of delivery. The agreement, for example, may specify that sending a scanned copy, instead of a paper copy, of a report is acceptable. You will find that a scanned copy may save time. Where suppliers are unable to deliver within a reasonable amount of time (e.g., days), your company may need to consider bringing the services back in-house.
	
	Should you find it difficult convincing your engineering department of the need to improve timelines, you should escalate this issue to your senior management. After all, senior management has the ultimate responsibility for quality and compliance. It is in the best interest off all involved parties to assure your compliance status reflects current good manufacturing practices. 
	
	


	1. EC, EudraLex, Vol 4, Chapter 7 “Outsourced Activities,” http://ec.europa.eu/health/files/eudralex/vol-4/vol4-chap7_2012-06_en.pdf, accessed Jan. 19, 2014. 
	2. FDA, FDASIA Title VII Drug Supply Chain Provisions, www.fda.gov/RegulatoryInformation/Legislation/FederalFoodDrugandCosmeticActFDCAct/SignificantAmendmentstotheFDCAct/FDASIA/ucm365919.htm, accessed Feb. 17, 2015.
	3. Quality-Technical Agreements, 

Siegfried Schmitt, Principal Consultant, PAREXEL International, discusses good engineering practices.

Managing Supplier Data Collection

. Our quality assurance (QA) team organizes training sessions for staff at all levels in our organization. We include links to the various applicable regulations in the training materials provided. During the sessions, we have encountered staff that question compliance requirements in our quality system. They argue that they cannot identify applicable requirements written in the regulations. QA teams are challenged and have difficulty obtaining buy-in from the entire staff. How can we navigate their objections?
	
	

. The good news is that your personnel are interested in regulations. This demonstrates that your protocol is successfully engaging non-QA staff on this crucial information, but clearly the contents and intent of the regulations, as well as the function of the quality unit, need further clarification.
	
	The rules and regulations typically only specify the principles, minimum requirements, and expectations for compliance, not necessarily specific details or examples. Companies, therefore, need to interpret the regulations relevant to their business. No two companies have the exact same circumstances, and consequently, there are as many interpretations of the regulations as there are enterprises.
	
	A company’s interpretation of the regulations is reflected in its quality system, which details the organizational structures, processes, systems, and safeguards in place to assure compliance. To assure independence of the quality unit from operations, for example, the head of quality may report to the chief compliance officer in Company A and to the CEO in Company B. While Company A may decide to sign in wet ink every page of a document (e.g., a standard operating procedure) to assure control, Company B may choose to only sign the title page and rely on other safeguards instead (e.g., unique headers and footers in the document).
	
	Whichever approach or solution is selected, it must be compliant--and the QA department is the ultimate authority for determining how a company will implement the regulations. The quality system provides the necessary guidance to avoid regular QA arbitration. The quality system is owned and managed by the QA department, but senior management is accountable for ensuring an effective quality system is in place (1). QA staff will be intimately familiar with the regulations, guidelines, and other helpful documents from regulatory agencies or other sources. They are tasked with the responsibility of maintaining and improving the quality system in real time to ensure it reflects current good manufacturing practices.
	
	The QA department creates the contents of the quality system by amalgamating the wealth of information, knowledge, and expertise. It comes as no surprise that there are many elements where there is no direct equivalent in the rules and regulations (2). Maybe these basic concepts have not been conveyed clearly or assertively enough. Constructive criticism should be welcomed, but obstruction or non-compliance is simply unacceptable. If all else fails, senior management will have to weigh in.
	
	If your staff wants to know where a particular regulation is written, they needn’t look any further than your quality system.
	
	

The Rules Governing Medicinal Products in the European Union

, Volume 4, Part 1, Chapter 2: Personnel, http://ec.europa.eu/health/files/eudralex/vol-4/
	2. Dr. B. Renger, 

The Role of Quality Assurance within the Pharmaceutical Quality System

, LOGFILE No. 20 (June 2014), www.gmp-publishing.com.

: When referring to this article, please cite it as S. Schmitt, "Where is it Written?,"

Siegfried Schmitt, Principal Consultant, PAREXEL International, discusses how to handle staff challenges to regulation requirements

Where is it Written?

 We are expecting routine inspections of our solid dosage manufacturing plants by the European Union competent authorities. We have a good inspection history and high standards for GMPs. We have been told that the inspectors may want to review GMP and good distribution practices (GDP). As we have outsourced all distribution activities, is it sufficient to have service agreements in place and audit the providers? Or are we missing something?

 GDP is crucial as an industry standard to ensure quality control and, ultimately, improve distribution and clinical-trial management. To determine who is responsible for GDP, the applicable regulations must first be considered. In Europe, GDP regulations were revised following the issuance of the Falsified Medicines Directive (FMD).

	According to the Medicines and Healthcare products Regulatory Agency (MHRA), the FMD came into play in Europe in January 2013, introducing measures to help prevent falsified medicines from entering the legal supply chain. The directive substantially changed the European framework for the supply of medicines and affected businesses that have not traditionally been directly monitored through medicines regulation (e.g., brokers) (1).

	The FMD was followed by the release of the Good Distribution Guidelines in March 2013 (revised in November 2013) (2). The Good Distribution Guidelines ensure the level of quality determined by GMP is maintained throughout the distribution network, safeguarding the distribution of authorised medicines to retail pharmacists through the eventual end-consumer, without any alteration of their properties (3).

	As you are being inspected, I assume you are the marketing authorisation holder (MAH) and, therefore, responsible for the secure, controlled, and compliant pharmaceutical supply chain-from raw material supplies to shipments of products to customers. GDP must be covered by the MAH’s quality system. You mention that you audit your distributors, which is an excellent practice. It is important, however, that your audits cover current regulatory requirements. For example, does your audit program include all wholesalers, warehouses, freight consolidators/freight forwarders, and brokers within your supply chain? In many companies, some of these third parties are managed through the logistics department and may not be under the same scrutiny of quality control. To fully understand logistics, supply chain, and distribution channels, a comprehensive assessment of each department is crucial. Ideally, these assessments would be part of a greater risk assessment to ensure all regulatory requirements are being met. Further, this approach helps reveal possible GDP gaps in quality and regulatory oversight among third parties. As with all newly enforced regulations, interpretation of GDP regulations will become clearer over time. For example, the UK MHRA published this information on Aug. 18, 2014 (4):

“The GDP Inspectorate is raising awareness of the impact of the new regulations to those parties that are either directly or indirectly affected and any freight consolidator or freight forwarder either in the air, sea, or road transport sector that is either holding ambient medicinal products on site for more than 36 hours or has cold room facilities will require a Wholesale Distribution Authorisation WDA(H) in order to comply with the Human Medicines Regulations 2012 [SI 2012/1916] (as amended) and with the Falsified Medicines Directive 2011/62/EU (4).”

	Considering this example, it is quite possible that goods stored intermittently in warehouses now fall under the above definition. The warehouse management team may not be aware of the changed requirements. Regardless, ultimate responsibility for compliance remains with you, not the third party. Through technical/quality agreements, the contractor and third party can confirm that roles and responsibilities are understood. Any agreement made with the warehouse operators should clarify which licenses will be required for a compliant operation.

	A quality and compliant system requires deep understanding of all applicable regulations and how these applications should be applied to any given distribution network. GDP is crucial as an industry standard to ensure quality control and, ultimately, improve distribution and clinical-trial management. GDP should be considered in advance of contracting third-party distributors to ensure best practices in clinical-trial management.


	1. MHRA, The Falsified Medicines Directive.
	2. EMA, Good Distribution Practice (March 2013).
	3. EC, 

Good distribution practice of medicinal products for human use

MHRA position on freight consolidation depots

 (freight forwarders), accessed Nov. 11, 2014.


	Siegfried Schmitt, Principal Consultant, PAREXEL International.


	Vol. 38, No. 12
	Pages: 58
	Citation: When referring to this article, please cite it as S. Schmitt, “Good Distribution Practices: Who is Responsible?,” 

Siegfried Schmitt, Principal Consultant, PAREXEL International, discusses the requirements for good distribution practices.

Good Distribution Practices: Who is Responsible?

Q.We are manufacturing drug substances (APIs) and drug products for a global customer base. Many of our processes are manual, and the majority of our documentation is on paper. Although we have an excellent inspection record and a satisfied customer base, we are concerned about the need to increase our level of automation. Should we move to automated systems such as electronic batch records (EBRs)?

A.Though regulations do not explicitly require firms to apply automated systems, they do require the industry to apply current good practices, which may well be automated/electronic processes rather than a manual/paper system. FDA, for example, describes the need to evaluate automated solutions in various Form-483 and warning letter observations (1, 2).

Manual operations carry the risk of human error and often require verification by a second person. Similarly, handwritten records typically require confirmation of accuracy and completeness by a third party. While this time-trusted practice has historically proven to be effective, there are more efficient ways to operate, especially with the technology advancements available today.

When records are kept on paper, there is a need to transcribe data and information to prepare essential documents, such as the annual product quality review, trend information (e.g., monitoring of corrective actions and preventive actions), statistical evaluations (e.g., for process capability), and others. In addition to being time consuming, manual transcriptions are prone to errors.

Automated/electronic systems have distinct advantages and provide functionality that manual/paper systems may not be able to offer, such as making information accessible anywhere and anytime. For many applications, well-established computer systems or programs are available. Some programs have become industry standards, including enterprise resource planning (ERP), laboratory information management systems (LIMS), chromatography data management systems (CDMS), and building management systems (BMS). The question is not whether there is a system, but rather which system is right for your particular needs and purposes.

A major misconception, however, is that automated systems will do the work for you. While they perform transactions for which they were programmed, they do not replace human intellect. Typical examples are change-control or deviation-management systems, in which automated systems provide functionality for process flows, alerts, and searches. Descriptive texts, assessments, and logical conclusions, however, must still be recorded and entered by a human. Automated systems do not necessarily free up resources; they provide a framework and tool set for managing these processes more efficiently.

For making the transition to more automated/electronic systems, the answer ultimately depends on individual needs and circumstances. Take electronic batch records. If your operational environment (manufacturing and analytical laboratories) already provides much of the data in electronic format, then the data (e.g., weights, temperatures, times, analytical results, etc.) can be imported electronically. The batch records can then be reviewed online by the quality assurance department, which can increase efficiency. Use of electronic signatures is another option provided by most EBR systems.

If you want to replace second-person verification of critical entries by the computerized system (automated verification checks), then the EBR could be the right solution for you. Additionally, if access to the records is an issue, then electronic versions can provide much more versatility. Keep in mind that such automated systems, especially highly configurable ones like an EBR, require full and diligent computerized systems validation, a task that requires significant amounts of time and resources.

Automated systems are a bare necessity in today’s enterprises, but they are not a cure all. They are useful, providing functionality that is otherwise unavailable, and well established. In terms of the right system for your business, prepare a SWOT, or strengths, weaknesses, opportunities, and threats analysis of your existing systems and develop an automation strategy based on the findings. If this is not something your teams are familiar with, there are many companies who can assist.

Inspections, Compliance, Enforcement, and Criminal Investigations

, Warning Letters, accessed Sept. 9, 2014.


Siegfried Schmitt is Principal Consultant at PAREXEL International. 

Siegfried Schmitt, Principal Consultant, PAREXEL International, discusses the benefits of automated processes.