Susan J. Schniepp is a fellow at Regulatory Compliance Associates, Inc. and a member of Pharmaceutical Technology's Editorial Advisory Board.

Susan J. Schniepp

Q: I am in the quality assurance department at my company. We are a small start-up, and one of my jobs is to develop a quality risk management plan. Can you give me some advice on what I need to consider when putting this plan together?

	A: A well-written and well-implemented quality risk management plan is an integral and valuable element of an effective quality system. During the development and manufacturing of pharmaceutical products, the bottom line is that things can and will go wrong. The purpose of a quality risk management plan is to help ensure continued compliance with regulatory requirements, such as good manufacturing practices or good laboratory practices, when events occur during manufacturing that potentially impact patient safety and product quality.

	International Council for Harmonization (ICH) Q9 states, “Two primary principles of quality risk management are: the evaluation of the risk to quality should be based on scientific knowledge and ultimately link to the protection of the patient; and, the level of effort, formality, and documentation of the quality risk management process should be commensurate with the level of risk” (1).

	In developing your company’s plan, you will need to consider all aspects of the operation that impact the product. Managing your company’s risk with a well-defined plan may help reduce the activities associated with poor quality and inefficiencies associated with the product and the process, such as a reduction in deviations/investigations, scrap or wasted materials, customer complaints, and product yield.

	The concept is to evaluate all aspects of the manufacturing process and identify areas of vulnerability. These vulnerabilities need to be assessed for their impact on the operation and the potential level of risk they pose. A well-written quality risk management plan is an ongoing process requiring rigorous documentation throughout the product lifecycle. It provides a solid rationale for how to improve efficiency and spend resources on the important activities to improve product quality rather than on low-risk activities that have little to no impact.

	There are four basic elements that should be included in a quality risk management plan. The first element is to perform an analysis of the identified risk associated with the operations. For example, if your product is being produced using an older manufacturing line, there is a risk that the line will experience frequent breakdowns.

	The second step is to evaluate the risk in terms of its impact on your ability to supply a quality product. In this case, frequent shut downs can lead to product rejections, yield loss, and potential drug shortages. Once the risk has been identified and the impact evaluated, controls to mitigate the potential situation need to be identified and implemented. Some of the possible mitigation control strategies might include ensuring there are appropriate change parts for the line in inventory or plans to qualify the product production on a new more modern manufacturing line.

	The last key element needed is data input and management. The data evaluated should be able to indicate if and when you need to employ one of your control strategies. In this simple scenario, an increase in down time on the line or a steady decrease in yield could be indicators that the manufacturing line is headed for a catastrophic failure and steps need to be taken to prevent a drug shortage situation.

	The above discussion is only an example of a risk assessment in one area of an operation. Other areas of the process need to be evaluated for potential vulnerabilities and risk. These areas include an evaluation of the reliability of raw material suppliers, stability and compliance of contractual suppliers (e.g., contract manufacturing organizations, contract test organizations), age and reliability of laboratory test equipment, etc. In other words, a solid, well-written and dynamic quality risk management plan will evaluate the overall organization, identify high-risk vulnerabilities, identify strategies for mitigation of the high-risk vulnerabilities, and rely on data to perform continuous monitoring of the vulnerabilities. And, of course, the plan will provide the appropriate documentation and rationale for the decisions.

	Implementing a quality risk management plan in an organization can also be challenging. It needs to be introduced and discussed with all applicable function personnel involved in the operations including, but not limited to, finance, manufacturing, regulatory affairs, purchasing, auditing, and senior management. The plan should be dynamic and should be modified as situations change.

	Let’s say you produce a product and you have a single-source supplier for one of your excipients. You have audited the supplier and have identified some significant gaps in their quality system. You identify this vulnerability in your quality risk management plan and indicate it is a high-risk item because of the lack of compliance of the excipient vendor. One of your mitigation strategies might be to qualify an alternate supplier for the excipient. Once you have qualified that alternate supplier, you need to update your plan to downgrade the risk because you have taken the appropriate steps to mitigate it and eliminate the identified vulnerability.

	Quality risk management plans are important because they help improve a company’s ability to provide quality product to patients. They are contingency plans with identified actions that help to ensure a continuous supply of product to the market that meets the expectations of being safe, effective, and available. They are dynamic documents that require integration into and data inputs from all departments in order to be successfully implemented at a company.


	Vol. 43, No. 8
	August 2019
	Pages 50, 49

	When referring to this article, please cite it as S. Schniepp, "Quality Risk Management Plans Create Effective Quality Systems," 

Articles

Quality risk management plans provide identified actions to 
ensure a continuous supply of safe and effective drug products, says Susan J. Schniepp, executive vice-president of post-approval pharma and distinguished fellow, Regulatory Compliance Associates.


Quality Risk Management Plans Create Effective Quality Systems

Q. I’m responsible for quality at a small, virtual startup company, and we contract out all of our activities. I’m working on documentation to contract out our product testing and was wondering what information there is regarding quality agreements and laboratory investigations.

	A. The best place to start is to take a critical look at existing guidance documents and regulations that govern quality agreements and out-of-specification (OOS) investigations.

	The basic philosophy when establishing any quality agreement is to understand that the contract provider and contract giver are partners and their behaviors reflect on each other. The 21 

) 200.10(b) confirms this concept by stating: “The Food and Drug Administration is aware that many manufacturers of pharmaceutical products utilize extramural independent contract facilities, such as testing laboratories, contract packers or labelers, and custom grinders, and regards extramural facilities as an extension of the manufacturer’s own facility” (1).  The next document to review for quality agreements is the FDA guideline titled 

Contract Manufacturing Arrangements for Drugs: Quality Agreements

. Section B, Elements of a Quality Agreement, Part e. Laboratory controls states that a quality agreement should include: “Designation of responsibility for investigating deviations, discrepancies, failures, out-of-specification results, and out-of-trend results in the laboratory, and for sharing reports of such investigations” (2). This confirms that the responsibility for OOS investigations is shared and communication between the contract giver and contract provider is critical. The European Union also addresses the need for a relationship between you and your outsourced laboratory in 

, Chapter 7 (7.15) on Outsourced Activities by stating: “The Contract should describe clearly who undertakes each step of the outsourced activity, e.g. knowledge management, technology transfer, supply chain, subcontracting, quality and purchasing of materials, testing and releasing materials, undertaking production and quality controls (including in-process controls, sampling and analysis)” (3).

	The above regulations establish the need for quality agreements that cover laboratory activities but doesn’t define what needs to be in an OOS procedure. The EU addresses the need to investigate OOSs in their GMPs. 

 Part 1, Section 6.35 states, “Out-of-specification or significant atypical trends should be investigated. Any confirmed out of specification result, or significant negative trend, affecting product batches released on the market should be reported to the relevant competent authorities. The possible impact on batches on the market should be considered in accordance with Chapter 8 of the GMP Guide and in consultation with the relevant competent authorities” (4). Part 2 of the EU GMP guide for APIs states in section 11.15 that: “Any out-of-specification result obtained should be investigated and documented according to a procedure. This procedure should require analysis of the data, assessment of whether a significant problem exists, allocation of the tasks for corrective actions, and conclusions. Any re-sampling and/or retesting after OOS results should be performed according to a documented procedure” (5).

	The best guidance, however, on conducting OOS investigations is the information provided in FDA’s 

Guidance for Industry, Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production

 (6). The responsibilities for the laboratory analyst and supervisor are clearly defined in this guidance and should be reflected in any laboratory OOS procedure. A well-written standard operating procedure (SOP) on OOSs should require investigations to be thorough, timely, unbiased, well documented, and scientifically sound. Often, the procedure will contain a checklist that assists in identifying obvious laboratory errors. The checklist assesses the suitability of analyst qualification and training, use of correct procedure and specification, the calibration and performance of the equipment, correct preparation of test solutions and dilutions, use of proper reagents and standards, calculations, etc. A thorough checklist and analyst documentation are critical in identifying true laboratory error. The SOP should also discuss the sample retesting requirements when a true laboratory error is determined to be the cause of the OOS.

	The most important and critical element for OOS investigations is specifying the timeliness. This should be stipulated in the SOP and, in most cases, the investigation into the OOS, from the laboratory perspective, should be concluded in 24 hours or less. The expectation of when the contract lab will inform you of any OOS obtained should be clearly defined in your quality agreement. The sooner a laboratory error can be ruled out as the cause of the OOS result, the sooner the full-blown manufacturing investigation can be started.

	Taking the time to establish a quality agreement and investigate the details of their OOS procedure is the first step in establishing a good working relationship with your contract test laboratory. This working relationship will become invaluable when an OOS occurs. The final product testing procedure for OOSs isn’t the only one you need to review, however. You should also look at the quality agreement and OOS procedure being used by your manufacturer for in-process test results, assuming they are different entities. The same information required in the final product OOS procedure should be the same for in-process testing.

Contract Manufacturing Arrangements for Drugs: Quality Arrangements: Guidance for Industry

 (FDA, November 2016).
	3. European Commission, 

The Rules Governing Medicinal Products in the European Union, Volume 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use

, Chapter 7, Outsourced Activities (EC, January 31, 2013).
	4. EC, 

EudraLex, The Rules Governing Medicinal Products in the European Union, Volume 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use, Part 1

, Chapter 6: Quality Control (EC, October 2014).
	5. EC, 

EudraLex, The Rules Governing Medicinal Products in the European Union Volume 4, Good Manufacturing Practice, Medicinal Products for Human and Veterinary Use, Part II: Basic Requirements for Active Substances used as Starting Materials

Guidance for Industry, Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical 


	Vol. 43, No. 6
	June 2019
	Pages 50, 49

	When referring to this article, please cite it as S. Schniepp, "Quality Agreements and Out-of-Specification Investigations," 

A good working relationship between sponsor and contractor will become invaluable when an OOS occurs, says Susan J. Schniepp, executive vice-president of post-approval pharma and distinguished fellow, Regulatory Compliance Associates.

Quality Agreements and Out-of-Specification Investigations

Q. I am a quality assurance professional working for a small start-up company. I am setting up their quality management system, but I have little experience with complaint handling. Can you provide some basic advice on setting up a system to handle customer complaints?

	A. A complaint handling system is a critical quality function that needs to be designed in conjunction with your quality management system (QMS). The requirements for complaint handling are well documented in the regulations (1–3). The importance of the complaint system and its relationship to other functions is often underappreciated by companies when setting up a QMS. The complaint system should be one of the first systems to be established by a company because the information gleaned from complaints feeds directly into the deviations, investigations, and corrective actions and preventive actions (CAPA) functions. Whether your product is a prescription drug (small or large molecule), over-the-counter medication, medical device, or combination product, the process for addressing complaints falls under regulatory scrutiny (4). 

	The first element of a robust complaint system is to establish a standard operating procedure (SOP) for complaint handling. The SOP should indicate the communication vehicle used to collect customer complaint information. These communication avenues can include, but are not limited to, use of a dedicated telephone number and/or an Internet link where customers can report the problem they are having with your product.

	It may seem archaic to recommend a phone number, but it is necessary because not everyone taking your medication is comfortable with or has access to the Internet, and these individuals may be more at ease leaving a message on an answering machine. Needless to say, this is an element of the complaint handling system that might be outsourced. If you decide to outsource this activity, you should specify this in your SOP and have a quality agreement with the company that is performing this service for you.

	Once the basic communication elements are determined and established, they need to be monitored on a routine frequency. The monitoring frequency should be established in the SOP for the handling of complaints. The phone line and the weblink should be monitored at a minimum once a day. It would be ideal if the communication lines could be continuously monitored, but this may be impractical for a small company. If this activity has been outsourced, the information collected on a daily basis by the service provider should be collected and reviewed on a daily basis by the company.

	The next element needed for effective complaint handling is determining the information that you need from the customer. At a minimum you will want to know (4):

		The name of the store where the purchase was made

	A detailed description of the problem/issue associated with the product.

	Again, if you are outsourcing this function, you will need to make sure this information is being collected by your service provider.

	Once you have established the communication avenues and the information requirements, you need to determine the complaint categories. There are several complaint categories that a customer might want to report to a company including medical conditions, product quality problems, preventable mistakes, and therapeutic failures. Any type of medical complaint is serious and needs to be assessed and addressed in a timely manner, because these types of complaints often have regulatory reporting timelines associated with them.

	Medical complaints can range from mild (e.g., headache, rash, tiredness, etc.) to serious reactions (e.g., hospitalization, suicidal thoughts, death, etc.). The more serious the medical complaint, the more aggressive the company needs to be in pursuing the investigation into the complaint. The regulatory reporting requirements for medical complaints should be specified in the SOP.

	Non-medical complaints do not need to be reported to the regulatory authorities, but they should be documented and investigated. These types of complaints (e.g., smashed bottle, smashed carton, incorrect tablet count, etc.) do not need to be reported to regulatory agencies, but they still need to be investigated as they could indicate deficiencies in the manufacturing and packaging operations. There are other considerations to consider when establishing a complaint handling function, such as whether or not the company wants to try and have the product returned for examination and how the product will be handled if it is procured. Keep in mind, however, that all complaints are available for regulatory review during an inspection.

	Establishing a robust and well-documented complaint handling process is a significant and an important element of a strong quality system. Thought and consideration on how complaints will be communicated to the rest of the organization and how complaint resolutions will be investigated, documented, and reported are critical elements to having a complaint function that serves the organization, the customers, and the regulatory authorities.

EudraLex, Volume 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use

, Part 1, Chapter 8: Complaints, Quality Defects and Product Recalls (EC, August 13, 2014).

211.180 (e)(2), Current Good Manufacturing Practice for Finished Pharmaceuticals, Records and Reports, April 1, 2018.

 211.198, Current Good Manufacturing Practice for Finished Pharmaceuticals, Complaint Files, April 1, 2018.

How to Report Product Problems and Complaints to the FDA


	Volume 43, No. 4
	April 2019
	Pages: 70, 69

	When referring to this article, please cite it as S. Schniepp, "Channeling Customer Complaints into Quality," 

A robust customer complaint handling system is an integral part of a quality management system, says Susan Schniepp, executive vice-president of post-approval pharma and distinguished fellow, Regulatory Compliance Associates.

Channeling Customer Complaints into Quality

Q: I am a quality professional in charge of investigations. Sometimes our company has trouble coming up with the root cause for some of our investigations. Can you provide some advice on how to effectively determine root causes for our investigations?

	A:  You aren’t alone in your concerns regarding the inability to identify the root cause when performing an investigation. The regulations for the United States and the European Union require investigations to be performed when deviations occur in the manufacturing process. The ultimate goal of these investigations is to determine why something went wrong, what caused it to go wrong, and how to address the issue and prevent its recurrence. Root-cause analysis is simply a systematic problem-solving approach used for determining the cause of a deviation that occurred during processing and identifying solutions to prevent recurrence.

	The following are a few general considerations to keep in mind while conducting investigations:

		One size investigation doesn’t fit all situations. Simple errors require simple documentation while more serious deviations require broader investigations.

		The best tool to have is inquisitiveness. Ask yourself how far this deviation could extend.

		Widen your perspective. Look for ways to relate, not separate, similar issues.

		Human error is rarely a sufficient root cause.

		Always verify information or your instincts and never assume you are correct without proper data to support your instincts.

		Applying these general rules throughout the investigation should help you get to the true root cause of the deviation.

	Once you have recorded the basics of the deviation, you can begin the root-cause analysis portion. Many tools can assist you in this process. Choosing the right root-cause analysis tool is crucial in assuring the process is effective and ensuring the true root cause has been identified. Keep in mind there is no one right tool to use for root cause analysis, and the tool you choose does not need to be complex to achieve its purpose. Some of the available tools include brainstorming, the 5 Whys, flowcharting, and fishbone diagrams. Using some or all of these tools in combination during an investigation is practical and necessary. Most investigation teams start off with the brainstorming technique. This technique is ideal for flushing out theories about the deviation but may not be ideal for compiling the data needed to prove the correct root cause has been identified. Using the 5 Whys or the fishbone diagram in conjunction with brainstorming adds assurance that you have found the true root cause and have gathered the supporting data. Root-cause analysis tools can be detrimental to the outcome of an investigation if they are improperly used, so it is important to train people in their proper use.

	The information needed to determine the root cause for any investigation should be appropriately documented. The first piece of information to be recorded should be a thorough and precise description of the event. A timeline that discusses the process up to the time the deviation occurred should be established. Once the event and timeline are properly recorded, a number of questions should be asked and information collected to ferret out the root cause. To make sure the true root cause is identified, each investigation must address the following elements:

		Historical evaluation; have we seen this before on this or other products? Have we seen this before on this line? Have we seen this before with these operators?

		An evaluation of the process/methods used during the operation

		An evaluation of the materials used during the operation

		An evaluation of the equipment/instruments used during the operation

		An evaluation of the personnel involved

		An evaluation of the laboratory analysis associated with the operation

		A review of the validation information for the operation.

	Whatever tool/tools you use to identify the root cause of an issue, they need to be supported by a robust, well-documented investigation. Some of the critical elements needed to be addressed in the investigation to support the root cause include a clear, concise description of the issue that delineates what happened, when it happened in the process, and an accounting of who was involved or observed the incident. Other information that should be addressed in the investigation is a record of the immediate action that was taken to minimize or contain the situation.

	The investigation should be broad so that all possible causes of the deviation can be captured and evaluated as the possible root cause. Avoid jumping to conclusions and investigate all possible causes so they can be properly eliminated, thus exposing the true root cause. Also, remember that there could be more than one possible root cause to a deviation. If you keep these investigational elements in mind, properly apply your root cause tools, and thoroughly document the investigation, you should have no trouble identifying the true root cause of a deviation and defending it during an inspection.


	Vol. 43, No. 2
	February 2019
	Page: 54

	When referring to this article, please cite it as S. Schniepp, “Effective Root Cause Determination," 

Getting to the root of the cause can prevent future problems, says Susan Schniepp, executive vice-president of post-approval pharma and distinguished fellow, Regulatory Compliance Associates.

Effective Root Cause Determination

Q. I have just been promoted to be in charge of investigations for my company. Our standard operating procedure (SOP) requires us to complete investigations in 30 days. Depending on the nature of the investigation and to meet the SOP requirement, I have started to close investigations at the 30-day time point even though I think the investigation might not be complete. Sometimes I have had to re-open investigations because the problem recurs, confirming that the investigation was not completed. Do I have a compliance risk if I continue with this practice?

	A. The short answer is yes, you have a compliance risk. You probably also have a data integrity issue and a quality culture issue to accompany your compliance risk. There is no time element associated with conducting investigations. Thirty days is an arbitrary number pharmaceutical companies impose on themselves. The US 

 states “… if errors have occurred, that they have been fully investigated” (1), and “Any unexplained discrepancy … shall be thoroughly investigated, whether or not the batch has already been distributed” (2). Europe’s 

 also addresses investigations by stating, “An appropriate level of root cause analysis should be applied during the investigation of deviations …” (3). None of these citations indicate a time for completion of an investigation. What they do imply is that investigations need to be thorough and determine root cause. In some cases, the investigation and root cause can be easily determined in the defined SOP time frame of 30 days. In other cases, the investigation may be more complicated and could exceed the time frame requirement of 30 days. To address this potential discrepancy, your SOP should allow for investigation extensions. The length of the extension request should be made based on the complexity of the investigation.

	When an investigation is rushed, the organization leaves itself vulnerable. Suppose, for example, you have a second shift manufacturing operator who continually forgets to sign a step in the batch record for a specific product. This operator is the only one who seems to have this issue. Your initial investigation into the first occurrence of the issue determines a root cause of human error. Because the operator works on the second shift, it is inconvenient to interview him directly, so you rely on the word of his supervisor that this was just a case of human error. You decide to retrain the operator on the proper use of filling out the form and skip the operator interview in order to complete the investigation and perform the retraining in the allotted 30-day time frame.

	A few weeks later, the same operator makes the same mistake. You review the previous investigation, arrive at the same conclusion, and perform the retraining of the operator emphasizing the importance of correctly filling out the batch record. This scenario repeats itself 10 times over the course of four months. You finally decide to question the ability of the operator to do the job correctly and bring your concerns to management.

	Your boss asks if anyone has interviewed the operator directly to find out why he is having this issue with the batch record. You say no, that you have relied on the opinion of the supervisor. The boss recommends you interview the operator before demoting him.

	When you talk to the operator, he informs you that in order to sign the batch record when it needs to be signed, he needs to exit the aseptic core, degown, sign the batch record, and regown, leaving the product unattended during that time. The operator tells you he chose to stay with the product and sign the batch record later but sometimes forgot after the manufacturing run. In this simple exchange with the operator you realize that the root cause of the repeat deviation is not a result of human error but a result of poor process flow.

	The question you need to address now is how were other operators handling the situation? By not taking the time to perform the initial investigation thoroughly, you have created a data integrity nightmare because you now need to review all the batch records completed by the other operators to determine if the product is still acceptable.

	Admittedly, this is a simplistic example, but it certainly exemplifies the importance of opting to perform a complete and thorough investigation over meeting an artificially imposed time frame. Explaining to an inspector during an audit that you didn’t perform a thorough investigation because you needed to meet an arbitrary time frame is not a position you want your company to be in. You also don’t want to explain why you closed an investigation to meet the time frame and then felt compelled to reopen it after the batch was released because you had concerns about its conclusions.

	The other element that needs to be addressed is that of the prevalent culture existing in the organization. It is good to set a time goal for performing investigation, thus ensuring their timely completion. It is not acceptable to have the time frame be the driving force behind the investigation. Management needs to emphasize their commitment to having thorough investigations as opposed to incomplete investigations that meet the self-imposed time frame. It is ideal when an investigation is completed and a true root cause identified in the specified time frame but, if that is not achievable, management needs to be clear that they prefer the identification of the true root cause over the rushed investigation that merely checks the box for completion in a timely manner. Without this management commitment, the premature closing of investigations will likely continue.

	Investigations need to focus on determining root cause in a timely manner. The length of time it takes to complete an investigation depends on the complexity of the investigation. The primary driver for avoiding compliance and data integrity risks concerning investigations is arriving at a root cause in a timely manner. This allows you to be confident in presenting your investigations during inspection and avoiding unnecessary scrutiny when the investigation is rushed and a conclusion is reached prematurely.

	            1.         FDA, 21 

 211.22(a), Current Good Manufacturing Practice for Finished Pharmaceuticals, Responsibilities of Quality Control Unit, Sept. 29, 1978.

	            2.         FDA, 21 

 211.192, Current Good Manufacturing Practice for Finished Pharmaceuticals, Production Record Review, Sept. 29, 1978.

	            3.         European Commission, 

Eudralex, Volume 4, Good Manufacturing Practice (GMP) guidelines, Chapter 1–Pharmaceutical Quality System


	Vol. 42, No. 12
	December 2018
	Pages:50, 49

	When referring to this article, please cite it as S. Schniepp, "Investigation Timeliness vs. Thoroughness: Finding the Right Balance," 

A required time frame should not be the driving force behind root cause investigations, says Susan Schniepp, executive vice-president of Post-Approval Pharma and Distinguished Fellow, Regulatory Compliance Associates.

Investigation Timeliness vs. Thoroughness: Finding the Right Balance

Q. I have been hearing that regulatory authorities are beginning to audit companies regarding their ‘quality’ culture with relationship to data integrity issues. Can you give me a little background on this issue?

	A. The regulatory authorities have always been interested in the culture of an organization. Recently, however, the specific culture of an organization is being connected to the veracity and accuracy of the data generated to support the quality of manufactured products. The theory is the more mature an organization is the more reliable the product support data are. To understand this concept thoroughly, we should start with a brief review of FDA’s quality metrics initiative.

	When FDA posted the first draft guidance, 

, the metrics chosen were lot acceptance rate, product quality complaint rate, invalidated out-of-specification (OOS) rate, and annual product review or product quality review on time rate. The guidance also contained three optional metrics intended to measure quality culture: measuring senior management engagement, corrective actions and preventive actions (CAPA) effectiveness, and process capability/performance. Although the optional metrics intended to measure quality culture were removed from the current version of the guideline, it is the first indication that regulators felt there was a correlation between culture and data integrity.

	At the same time the issue of quality metrics was being discussed, there was a resurgence of data integrity problems in the industry evidenced by the number of citations that reference this issue. Between 2005 and 2016, approximately 225 FDA warning letters were issued with observations for data integrity. These observations included repeat human error deviations, insufficient training, system failures, inappropriate qualification or configuration of systems, poor procedures or not following procedures, and intentional acts of falsification. The increase in data integrity observations prompted regulatory authorities to address the issue by releasing a series of guidelines that reemphasize the importance of data integrity. FDA, the Medicines and Healthcare products Regulatory Agency (MHRA) in the United Kingdom, the World Health Organization (WHO), and the Pharmaceutical Inspection Co-operation Scheme (PIC/S) have all released documents to reeducate the industry on data integrity concepts and expectations (1–5). In addition to the regulatory guidelines, the Parenteral Drug Association (PDA) released a free document titled 

Elements of a Code of Conduct for Data Integrity 

	One common theme permeating through these documents is that of quality culture. Regulators have linked the reliability of data to the existence of a quality culture as exemplified by statements taken directly from the guidances. The PIC/S guidance on 

Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments 

(5) states, ‘Management should aim to create a work environment (i.e., quality culture) that is transparent and open, one in which personnel are encouraged to freely communicate failures and mistakes. Organizational reporting structure should permit the information flow between personnel at all levels’ (5).

‘GXP’ Data Integrity Guidance and Definitions 

discusses organizational culture, stating, ‘The organization needs to take responsibility for the systems used and the data they generate. The organizational culture should ensure data [are] complete, consistent, and accurate in all its forms (i.e., paper and electronic)’ … ‘The impact of organizational culture, the behavior driven by performance indicators, objectives, and senior management behavior on the success of data governance measures should not be underestimated. The data governance policy (or equivalent) should be endorsed at the highest levels of the organization.’ WHO deals with the concept of quality culture in their document 

Guidance on Good Data and Record Management Practices 

(4) by stating, ‘adoption of a quality culture within the company that encourages personnel to be transparent about failures so that management has an accurate understanding of risks and can then provide the necessary resources to achieve expectations and meet data quality standards.’ This same document states, ‘Management, with the support of the quality unit, should establish and maintain a working environment that minimizes the risk of non-compliant records and erroneous records and data. An essential element of the quality culture is the transparent and open reporting of deviations, errors, omissions and aberrant results at all levels of the organization, irrespective of hierarchy.’ Based on the language used in data integrity guidance documents, it is clear that regulatory authorities consider quality culture an important element in establishing the veracity and integrity of the data being generated by companies that support the products they manufacture.

	The trouble with quality culture is determining how to measure it. PDA has developed a culture assessment tool that links organizational attributes to specific behaviors (7).

	Attributes were defined as elements of a quality system such as, but not limited to, deviations reporting, change control, CAPA, complaints, and environmental monitoring programs or systems. Behaviors were defined as intangibles such as, but not limited to, robust communication and transparency, rewards and recognition, employee engagement, and cross functional vision. The theory was if quality attributes equaled quality behaviors, which then equaled quality culture, then if the quality attributes of a company could be measured, they would reflect the maturity of the quality culture of an organization. The PDA tool involves several steps that include training employees on the use of the tool, an onsite assessment, an all-staff survey, and finally analysis and action on the results. There are, of course, other tools available to measure the culture of an organization. The real point is whatever tool your company uses to measure culture, it will be an important element in determining your data integrity risks and remediating them before an inspection.

	Auditing a company to determine if their culture is conducive to generating data that meets the attributable, legible, contemporaneous, original, and accurate (ALCOA) concepts is on the horizon and may become a part of routine audits performed by regulators or industry auditors when evaluating the suitability of a manufacturer, potential partner, or service provider.

Data Integrity and Compliance with CGMP Guidance for Industry Draft Guidance

A GxP Data Integrity Definitions and Guidance for Industry

, Draft version for consultation (MHRA, July 2016).

GMP Data Integrity Definitions and Guidance for Industry

Annex 5, Guidance on Good Data and Record Management Practices

Draft Guidance: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments

	6. PDA, Elements of a Code of Conduct for Data Integrity (PDA, 2015).

	7. S. Schniepp, ‘Assessing and Improving Quality Culture: Tool & Resources,’ presentation at 3rd PDA Europe Annual Meeting, June 27, 2018.


	Vol. 42, No. 10
	October 2018
	Pages: 82, 81

	When referring to this article, please cite it as S. Schniepp, "The Link Between Data Integrity and Quality Culture," 

Susan Schniepp, executive vice-president of Post-Approval Pharma and Distinguished Fellow, Regulatory Compliance Associates, takes a look at the regulations around data integrity and how they relate to the concept of quality culture.