Conducting a Gap Analysis on your Change Control System. Presented By Miguel Montalvo, President, Expert Validation Consulting, Inc.

Transcription

1 Conducting a Gap Analysis on your Change Control System Presented By Miguel Montalvo, President, Expert Validation Consulting, Inc.

2 Standards, Regulations, Guidelines related to Change Control Management Systems 21 CFR CFR 820 FDA Guideline ICH Q7 GMPs for APIs FDA Guidelines on Pharma. Development (ICH Q8) and PAT FDA Guideline - Quality Risk Management (ICH Q9) FDA Guideline QS Approach to Drug GMPs 2

3 21 CFR 211 Change Control References 21 CFR 211 FDA considers that the requirement for Change Control is implied across the regulations: Archiving of obsolete procedures is necessary Every function and operation requiring documentation should function under a formal change control procedure 21 CFR : Procedures, including any changes, are drafted and approved by the organizational units and reviewed and approved by the quality control unit 21 CFR : Scientifically sound specifications, standards, sampling plans, test procedures and other laboratory control procedures and any changes should be drafted by the appropriate organization and approved by Q.C. 21 CFR (e) Annual review to determine whether changes in specification or manufacturing procedures are needed 3

4 Change Control Statutory and GMP References: Section 506A(b) FD&C Act, Manufacturing Changes, post marketing report requires validation of the effects of a change on the identity, strength, quality, purity and potency FDA Compliance Program Guidance Manual : Post Approval Audit Inspection: A centralized approach could also be used for auditing records of the QC Unit s s change control operations. For those changes identified for products of inspectional interest, the records and supplements related to the changes would be audited for compliance with the requirements 4

5 21 CFR 820 QSR (Device GMPs) Requirements for Change Control Design Changes - Establish and maintain procedures for the identification, documentation, validation, or where appropriate, verification, review, and approval of design changes before their implementation Document Changes: Changes to documents shall be reviewed and approved by individuals in the same function or organization that performed the original review and approval, unless otherwise specified. Approved changes shall be communicated to appropriate personnel in a timely manner. Maintain records of changes to documents. Change records shall include a description of the change, identification of the affected documents, the signatures of the approving individuals, the approval date, and the date the change becomes effective. 5

6 21 CFR 820 QSR (Device GMPs) Requirements for Change Control Production and Process Controls: Establish and maintain procedures for changes to a specification, method, process, or procedure. Changes shall be verified or validated before implementation and the activities shall be documented. Changes shall be approved in accordance with document control requirements. Process Validation: When changes or process deviations occur, the process shall be reviewed and evaluated. Revalidation should be performed where appropriate. These activities shall be documented. 6

7 ICH Q7 for API s a formal change control system should be established to evaluate all changes that may affect the production and control of the intermediate or API the potential impact of the proposed change on the quality of the intermediate should be evaluated. A classification procedure may help in determining the level of testing, validation and documentation needed to justify changes to a validated process. Changes may be classified (e.g. minor or major) depending on the nature and extent of changes, and the effects these changes may impart on the process 7

8 ICH Q8 Guideline on Pharmaceutical Development The aim of pharmaceutical development is to design a quality product and its manufacturing process to consistently deliver the intended performance of the product. The information and knowledge gained from pharmaceutical development studies and manufacturing experience provide scientific understanding to support the establishment of the design space*, specifications, and manufacturing controls. Changes in formulation and manufacturing processes during development and lifecycle management should be looked upon as opportunities to gain additional knowledge and further support establishment of the design space. 8

9 Q8 Concept on Design Space The design space is the established range of process parameters that has been demonstrated to provide assurance of quality. In some cases design space can also be applicable to formulation attributes. Working within the design space is not generally considered as a change of the approved ranges for process parameters and formulation attributes. Movement out of the design space is considered to be a change and would normally initiate a regulatory post approval change process. 9

10 FDA on Design Space The multidimensional combination and interaction of input variables (e.g., material attributes) and process parameters that have been demonstrated to provide assurance of quality Traditional one dimensional process range doesn t meet Q8 definition and will not lead to regulatory flexibility Working within the design space is not considered as a change Movement out of the design space is considered to be a change and would normally initiate a regulatory post-approval change process Design space is proposed by the applicant and is subject to regulatory assessment and approval 10

11 Quality Risk Management (ICH-Q9) relation to Change Control Use Risk analysis to determine requirements after change implementation Use Impact (Direct, Indirect) concepts to determine impact and requirements/tests Make that evaluation part of the Change Control procedure and documentation rationale for decision Evaluation that changes did not create new hazards 11

12 Quality Systems Approach to Pharmaceutical GMP s Guidance from FDA (Sept. 2006) Implementation of Quality Systems, when coupled with manufacturing process and product knowledge, can handle changes without a need for regulatory submissions - changes in facility, equipment or even processes Quality by Design Concept Application of risk analysis Change Control must be controlled and documented: managing change to prevent unintended consequences Warranted when data analysis reveals areas for improvement Effect evaluated after implementation According to CGMP regulations, the QCU has the responsibility of reviewing and approving all initial design criteria and procedures pertaining to facilities and equipment and any subsequent changes (see (c)) If design issues are found during process experience, the entire design (facility/equipment/process/laboratory controls) has to be evaluated 12

13 Personnel Training under the Quality Systems Personnel should also understand the effect of their activities on the product and the customer. Quality personnel should be selected based on their scientific and technical understanding, product knowledge, process knowledge and/or risk assessment abilities to appropriately execute certain quality functions Typical quality systems training should address the policies, processes, procedures, and written instructions related to operational activities, the product/service, the quality system, and the desired work culture (e.g., team building, communication, change, behavior). 13

14 Quality Systems - Elements Management Responsibilities: Commitment Structure roles and responsibilities Environment Communication Formal process for change requests Continuous Improvement Resources: Training/Qualifications Manufacturing Operations changes to improve controls over sources of variability a manufacturer is empowered to make changes subject to the regulations based on the variability of materials used in manufacturing and process improvements resulting from knowledge gained during a product s lifecycle. Evaluation Activities (Management): Change Control Management Effectiveness Revise procedures as needed Resulting action plans may involve changes 14

15 ICH Q10 QS Elements Knowledge Management and Risk Management as Enablers of QS change management will be dependent on the knowledge management and adequate process/product knowledge Quality Manual Policy, Scope, Structure of QS and Management Responsibilities Management Responsibility as Ultimate Responsible for QS Commitment, Quality Policy, Planning, Resources, Communication and Review Continual Improvement of Process Performance and Product Quality Monitoring, CAPA, Change Management and Management Review Continual Improvement of the Pharmaceutical Quality System 15

16 What is Change Control? Change Control is the implementation of, and adherence to, a formal process that documents any change to a (specified/qualified/validated/approved) piece of equipment, system, process or document that can affect the identity, strength, quality or purity of a drug product. 16

17 Why is Change Control Important? COMMON SENSE Change Control is a key component of the Quality System of an organization (systems based approach to FDA inspections and QS Guideline) managing change to prevent unintended consequences Encouraging change towards continual improvement Need to evaluate effect of changes starting at the specifications level for the Direct and Indirect Impact Systems Changes must be documented for future reference even during Design and earlier Qualification stages 17

18 When Should Change Control Be Implemented? Need a policy for Change Control Management which will include applications at different points Define application for new and/or modifications to facilities, utilities, equipment and systems Formal QA Change Control procedures MUST be implemented upon completion of the Qualification / Validation Implement change control for all Direct and Indirect Impact systems level of detail/depth of impact determination will be commensurate with the impact level of the system/process Once the system / equipment is identified and specified (approved documents), it falls under some level of change control 18

19 Change Control Levels early in Projects Impact Determinations and Application of Risk Direct Impact Systems more documentation required and a formal risk assessment done for changes Indirect Impact Systems basic procedure and form to be completed. No need for formal risk assessment as part of the change impact analysis. Responsibilities must be defined for each project phase User functions to be involved Quality (at a defined level) 19

20 Change Control Policy/Procedure Requirements with respect to Specifications, Design, Construction, Commissioning and Qualification Purpose/Objective Scope Responsibilities Procedure: Describe Change and Impact Approval Implementation Verification Forms for each stage in the process or a generic form Summary Report at project completion including changes to specifications 20

21 Applications of a formal QA Change Control System Documents SOPs, Qualification/Validation documents, batch production records, regulatory filings Facilities Utilities, systems (WFI, HVAC, etc.), environmental conditions Equipment Control systems, mechanical systems, computer systems (software), instrument calibration, maintenance Processes Cleaning (not SOPs changes in products/formulas), analytical methods, manufacturing, packaging 21

22 Developing a formal QA Change Control SOP SOPs Should Be: Clear Concise Designed to prevent problems Sufficiently detailed to ensure everyone performs his/her part in a reasonably consistent manner Different SOPs for types of changes documents versus equipment/systems? 22

23 Developing a formal QA Change Control SOP Components Responsibilities How initiated? Who reviews? Who approves? Who trains? Who owns? 23

24 Developing a formal QA Change Control SOP Components (cont.) What is a change? Like for Like Definition is it applied consistently? Planned vs. Unplanned Normal vs. Emergency Temporary Changes careful! How to complete forms? Information to be recorded 24

25 Developing a formal QA Change Control SOP Components (cont.) How to track changes? Unique identifier Track from start to finish Constant monitoring of open changes Filing / archiving system 25

26 Developing a formal QA Change Control SOP Components (cont.) How to define system? Required information How to document change? Detailed description of change Level and degree of testing required Identify any special procedures that need to be followed during change implementation 26

27 Developing a formal QA Change Control SOP Components (cont.) Is there additional impact? Documentation Equipment Systems What is the closure mechanism? Qualification/Validation summary report Final approval of change control form 27

28 Developing a formal QA Change Control SOP Components (cont.) What is the appropriate notification system? Timely and appropriate Change implementation successful Final approvals / Release for production Required QA/QC pre- and post-approval Impact assessment 28

29 Developing a formal QA Change Control SOP Less is Better One corporate policy vs. one for each site/department May need specific site procedures for each type of change Assures consistency Document control is less burdensome Present a clear message of upper management commitment 29

30 Normal Situations Initiate Change Control Form Document equip/system affected Identify needed change Sign/date form Route proposed change for review and approval 30

31 Normal Situations (cont.) Determine whether change requires revalidation Substantiated like for like changes may not require revalidation Once approved, implement change Test changed system as required 31

32 Normal Situations (cont.) Generate final report Change control form Qualification/Validation summary report Route for final approval Archive change control documentation 32

33 Emergency Situations Preparation Prevents Problems Follow guidelines established in SOP Fill in as much information as possible Identify problem / change required sign/date form Notify as many approvers as possible Gain verbal approval Continue with Change / testing Document all steps QUARANTINE system 33

34 Emergency Situations Emergency changes must be closed appropriately Within specified time limit provided by procedure Provide Identifier Formal routing procedure Continued tracking Proper approval, closure and notification through appropriate channels 34

35 Implement the Program Have Qualification / Validation baseline in place Provide comprehensive training - level of comprehension assessment detail will be commensurate with level of control Provide Effective Date for SOPs 35

36 How to Determine the level of competency assessment required for training on change control? Based on Product Quality Impact and other risk considerations: Is the operation/process affected by change purely manual? Are there detection capabilities to verify effectiveness of process/procedure execution? Who Reviews/Approves the change before implementation? Is there a physical barrier or control impeding change implementation? Need to include the decisions on formal training plans 36

37 Changes in Documentation Categorization of SOPs different levels of changes Operational SOPs critical versus non-critical steps/operations Maintenance critical pieces of equipment/systems Cleaning Manual versus automated Quality Functions basic responsibilities Specifications: Critical quality Attributes Raw materials/components critical impact on process 37

38 Changes in Process Batch Manufacturing Controls commensurate with criticality parameters and steps Design space in or out Regulatory submittal 38

39 Change Control - Equipment Weaker system level of control is personnel dependent Adequate and Effective training and fullcommitment are keys to the program Pre and post approval of changes by pertinent functions Apply process appropriately for each type of change definitions are critical Impact of Change determined adequate personnel to evaluate Documentation of results and modified documents and drawings included in package Quality review Change does not require requalification - evaluation of change impact will determine need for it or any additional validation test 39

40 Definitions How to Verify their Application Like for Like versus Change: Verify Work Orders for replacements, repairs Definitions clear in procedure interview related personnel to verify interpretation Planned versus Un-Planned Changes: Verify forms for compliance with procedure approvals by pertinent functions, timing, completion Training evaluation if previous areas show gaps 40

41 Changes on Software Upgrades or Updates Specific (per system or control type) procedure to handle those changes Procedure/Forms to address frequent types of changes in consistent manner 41

42 Maintaining the Program Provide reinforcement training to address deficiencies in the correct use of the change control system Provide separate Procedures for the conduct of annual review of all system changes to determine if the system should be subjected to a full or modified revalidation 42

43 Maintaining the Program (cont.) Annual QA/QC Review Production Problems / Failures Process Changes Assess impact on product quality Identify otherwise undetected changes Determine when revalidation is necessary When changes affecting the process are not controlled, the process may no longer be truly valid 43

44 Gap Analysis Process

45 Gap Analysis Definition The assessment of differences or discrepancies between a set of standards (regulations/guidelines) and the current procedures in place to determine the criticality of such and the actions required for remediation (Risk Based decisions) Evaluation of a specific program or process to determine how it compares to a pre-defined set of objectives, goals, or standards. Defining the specific objectives or expectations to be met is the most difficult part of the GAP Analysis. Required or Recommended? Gap Analysis is usually conducted in order to determine the steps needed to bring a system into compliance with the applicable regulations/guidelines/policies 45

46 Then, What is it? The GAP Analysis is simply a comparison of the current system, its supporting documentation, and the people/resources qualifications/training against the defined requirements.

47 Gap Analysis Process Identify standards (Quality Systems Guides/Regs. Or internal policies) and familiarize with requirements: Change Control Management Policy/Procedures Provide training on conducting a Gap Analysis and the specific requirements to be verified define responsibilities Assess current practices against standards Identify needs for remediation plans (immediate and long term action plans) based on criticality/risk Implement remediation plans 47

48 Gap Analysis Team Gap Analysis Team Selection qualified members and lead person Develop Checklist provide reference material to team members (regulatory and industry standards, local policies and procedures) Discuss adequate Documentation - record what was reviewed, what was seen, who was talked to, observations made, etc Discuss procedure for documentation of observations/gaps, handling of response and communication of results to management Define priorities and criticality levels for gaps 48

49 Gap Analysis Process General Things to Assess for each defined Requirement Do the Procedures, Policies, Forms and Templates for the system/program meet the defined requirements per the standard? (establish) Have the requirements been met in actual practices? Documentation shows that the procedure is being executed as written (implement) Do employees understand the program, expectations, etc? Are they trained? Are resources necessary to support the program appropriate (support) 49

50 How to Conduct the Gap Analysis Conduct an opening meeting with areas to be verified/assessed and the gap analysis team Discuss the process, times, deliverables List the areas, processes to be assessed based on the selected priorities Discuss and document the categorization strategy for the observations and remediation plans Ensure people will be available when needed Ensure that documentation will be available Conduct a Wrap-Up meeting at the end of the audit 50

51 GAP Analysis DOs and DON TS The gap analyst: Do prepare. Know the objectives and scope Do be objective, but thorough Do get opinions and ideas from the employees in the area effected Don't go beyond the scope Don't be judgmental Don't focus on listing errors or defects, but determine why the errors or defects occurred Employees in the area being analyzed: Do communicate problems or quality issues that you know about to the analyst, so they can be recorded and corrected Do provide open and honest answers Do share ideas for improvements Don't be defensive Don't place blame 51

52 Focus of review Change Control Procedures: Adequate Compliant Effective Personnel is committed to perform as described Reviewed/Updated Training: Effective Comprehension Assessment Tool Properly documented Execution: Adequate Documentation Handling of Deviations/Exceptions Required Reviews/Approvals 52

53 Classification of Observations gathered during the assessment Critical: The procedure or program is considered inadequate lacks basic elements or requirements The gap could place the product quality on risk of being nonconforming Major: The procedure needs revisions to make it compliant but the gap will not have a significant effect on product quality or the effectiveness of the overall system Minor: Documentation has to be corrected Procedure must be modified without a critical effect on the systems/process or product quality 53

54 Example Outcomes Typical Observations: Lack of Standards, Processes, Procedures or those are not applied at all Failure to comply with Standards, Regulations, guidance documents, Processes, Procedures not being executed as written Shortfalls in documentation and records Lack or inadequate reviews/impact assessment/approvals Procedures state one way, but documentation reflects a different action Lack of or inadequate definitions of roles and responsibilities Definitions are not used consistently changes versus like-for-like, etc. 54

55 Typical Areas of Concern - Outsourcing Suppliers changes in their process/materials Contract Manufacturers change control management within their operation and communication to process owner (Contract giver) Contract Services providers: Laboratories Calibrations Keys to control: Agreements key contacts/responsibilities Internal Quality System/Function and Adequate Procedures Responsiveness Communication and Trust Planning Audits Filing (if applicable) 55

56 Gap Analysis Assessment Report, Remediation Plan and Follow-up The Gap Analysis team leader shall issue a report within a reasonable time after completion of the assessment The report should describe the findings in sufficient detail to assure corrective action can be accomplished by the organization The responsible manager investigates the cause of the problem noted as a noncompliance and proposes a remediation action to be taken (plan) Indicates the date by which the remediation will be fully implemented The team leader reviews and approves the proposed action Report the effectiveness of the program to management Re-audit areas of concern or deficiencies. 56

57 Remediation Plans Critical gaps versus action plans for longer term resolutions SOP non-conformances revise as needed to comply with the standards Revise Documentation to reflect what the SOP requires Training adequate implementation of the revisions and changes due to the remediation actions 57

58 Conclusions Change Control Management will be a critical enabler of the new Quality Systems approach to GMPs as the FDA expects the industry to manage changes internally with the application of your process/product knowledge and the objective to continuously improve your processes Procedure, Training and Documentation are the key to an effective Change Control Management System Apply a risk factor after the gap analysis/assessment to determine the need for immediate resolutions versus a long term remediation plan 58

59 Questions? 59

60 Interactive Exercise Develop Gap Analysis Checklists for: SOP Change Control System Facility/Utilities/Equipment Change Control System Manufacturing Batch Record Change Control System 60

61 THANK YOU!!! Contact Info.: Miguel Montalvo Expert Validation Consulting, Inc. Mobile Phone +1(407)