Validation, which is confirmatory

Transcription

1 Validation and Change Control By definition, validation is a snapshot in time. by Gamal Amer, Ph.D. Validation, which is confirmatory in nature, is defined by FDA as Establishing through documented evidence, a high degree of assurance that a specific process will consistently produce a product that meets its predetermined specifications and quality attributes. By definition, validation is a snapshot in time, demonstrating that if a given process/system is installed in a certain way and operated in a certain manner (according to an established procedure), it will perform accordingly and produce a product/result with certain characteristics. Since the pharmaceutical industry is continuously attempting to improve its process through implementing change to the process, it is important to ensure that the operation/system remains in a validated state through the strict implementation of a change control system. This article defines the validation process and explores the issues associated with changes in the manufacture of healthcare products, their implication on validation, and how to control these changes to ensure that the systems remain in a validated state and cgmp compliant. Validation and its Implementation Validation as a Means to Ensure the Consistency of the Processing Operation In conducting a validation of a process or a system, the industry standard is to prepare protocols to be followed. These protocols are usually referred to as Installation Qualification (IQ), Operation Qualification (OQ), and Performance Qualification (PQ). The Process Validation (PV) protocol is normally used to validate an entire process comprised of various systems/equipment operating in tandem, producing the specific product. The use of a validation protocol is now required by the regulation. 1 The proposed regulation defines a validation protocol as a written plan describing the process to be validated, including production equipment and how validation will be conducted. Such a plan would address objective test parameters, product and process characteristics, predetermined specifications, and factors which will determine acceptable results. As the validation effort progresses, one can identify specific activities which must take place. These are: 4 Institute of Validation Technology

2 Preparation of a validation master plan. 2 Collection and/or insuring the availability of all the critical documents required 3 for a successful validation effort. Preparation of the appropriate validation protocols. Execution of all relevant protocols. Preparation of final reports summarizing the results of the validation. Ensure that the process/systems remain in a validated state and in continuous compliance with cgmp requirements. This is normally accomplished using a change control procedure. Protocol Preparation A well-documented protocol is the first step in the validation effort and serves as a record that the equipment performed properly. The rigorous nature of the validation effort requires the completion of qualification protocols that serve as the procedure to be followed, providing a step-by-step set of instructions to perform the validation. In addition, the protocol provides a place where the test findings are recorded and supporting documents are stored. These qualification protocols can be prepared as IQ, OQ, PQ, or combinations thereof. Since the process validation normally depends on the specific process configuration, a separate protocol is normally developed for this ultimate activity. The PV protocol is usually executed once all subsystems have been validated/qualified. Figure 1 depicts an example table of contents of a typical protocol. The IQ protocol is written with the objective of confirming the following aspects for each individual critical system/piece of equipment: Fabrication or construction meeting user s specifications and applicable codes as well as cgmp requirements The existence of correct as-built drawings for the critical equipment and supplies for the process as well as the critical utilities Availability and qualification of utilities at points of use specified Presence of operation, maintenance, and cleaning manuals or substitute written procedures should manuals not be available Defined preventive maintenance and calibration schedule Figure 1 Example Table of Contents for a Validation Protocol 1.0 Approvals 2.0 Purpose and Objectives 3.0 Equipment/System Descriptions 4.0 Responsibilities 5.0 References 6.0 Validation Methodology 7.0 Acceptance Criteria 8.0 Procedures and Data Tables 9.0 Final Report and Approvals 10.0 Appendices Completeness of the documentation of system construction by reviewing the following (consult reference three for more details): training records, change controls, submittals, punch lists, weld logs, pressure leak tests, cleaning and passivation records, startup certification, instrument inventory, calibration, loop check, manuals, drawings, specifications, and purchase orders The OQ protocol is written with the objective of confirming the following aspects for each individual critical system/piece of equipment: Compliance of deliverables purchased or site erected to user s specifications as promised by the supplier and described in applicable codes and standards for operation, maintenance, calibration, and cleaning System operation within predetermined and approved acceptance criteria The PQ/PV documents are written with the objective of confirming the following aspects for each individual critical system or the entire process: Performance of a system is reproducible over an extended period of time. An example would be to demonstrate that a purified water system is capable of producing water that consistently meets biological and chemical standards established by the United States Pharmacopoeia (USP) Process performance such as the ability of a certain processing sequence to produce a product within predetermined and approved acceptance criteria Special Edition: Change Control 5

3 Protocol Execution Once the protocols are prepared, reviewed, and approved by the appropriate units within the organization, the equipment/system is validated through: Performing the activities identified in the approved protocols Ensuring that all instrumentation, either used in the validation effort or associated with the equipment and critical to its operation, is calibrated and has certificates traceable to National Institute of Standards and Technology (NIST) (or equivalent) standard (this is a specific requirement of the regulations) Sufficient qualified personnel are used during the execution of the protocols (a regulatory requirement) Proper analysis of samples and monitoring of critical parameters is performed as part of the protocol execution Summary Report/Final Validation Report Preparation Upon successfully completing protocol execution in the field, final reports are prepared. These reports summarize the results of the protocol execution and report findings in writing to the user. The reports follow a similar format to the protocols. Following report approval, all executed protocols, product related literature, and analytical results are packaged together and represent the overall validation record. rmally, a final process validation report would be prepared which summarizes what transpired during the validation effort and the efforts main findings and conclusions. A Validation Procedure The following is an outline of a proposed validation procedure developed based on the discussion presented above. In this procedure, I suggest names for groups within an organization, which would have specific responsibilities. It is understood that responsibilities associated with the validation effort will change from one company to the next. However, the names of departments/organizations presented in this example procedure are used in many companies and appear to be developing into an industry standard. ❶ Preparation of the Validation Master Plan (VMP): The first step in the validation procedure is to develop a VMP. This issue has been discussed at length in a previous article. 2 ❷ Protocol development: The next step in implementing a validation program is development of appropriate protocols as outlined in the VMP. These may simply be standard protocols with or without some modification or newly developed protocols. The validation group, with the help of the engineering group, normally prepares protocols for IQ and OQ. On the other hand, the validation group will prepare the PQ with the help of the user group. The user group, engineering, QA, and the validation group should then approve the protocols. I recommend that personnel approving the initial protocols be the ones who review and approve the executed protocols and final reports. ❸ Protocol Execution: Because of the engineering nature of the IQ, I recommend the validation group execute it while being assisted by the engineering department. For the OQ, the validation group should conduct the execution using normal operators, while for PQ execution, the validation group should manage the execution effort while the user group personnel perform the necessary activities. ❹ Data Collection and Final Report Preparation: This activity should be relegated to the validation group which collects the data, conducts the proper analysis of the data, reaches the proper conclusions, and prepares the final report. ❺ Approval of Final Report and Archiving the Documents: The final report is normally reviewed and approved by the user group, engineering, QA, and the validation group. It is recommended that the protocol with the associated report (and all documentation associates with it) be filed in a central file where all validation documents are stored. This central file should be either in the QA department or with the validation group. Controlled copies of the documents can be distributed to interested parties. This procedure is depicted in Figure 2. Change and Change Control The Need for Change w, as we all know, changes to the process are always occurring due to regulatory, economical, technical, and/or safety reasons. However, one should be aware of what the previous section indi- 6 Institute of Validation Technology

4 Figure 2 Activity Design Review Validation Procedure VMP 2 Protocol Preparation Protocol Execution Summary Report Preparation Validation Record IQ, OQ, PQ Executed IQ, OQ, PQ Validation Reports Example Documents Requirements 3 Engineering Drawings Specifications Manuals and ID SOPs Weld Logs, Certifications, Analytical, and Integrity Tests Product Data cates, namely, that validation is part of the overall requirements to adhere to cgmp. It further indicates that validation is a snapshot in time indicating that the equipment/process installed and operated in a certain way will continue to consistently produce a specific product, which meets its predetermined quality attributes, if and only if: ❶ Equipment/process has been installed in a certain fashion and the installation is not altered from the installation used during the IQ, is properly connected to required utilities, and connected to other pieces of equipment within a process sequence according to the design. ❷ Equipment/process is continually maintained according to appropriate procedures defined by the manufacturer. ❸ All of its controllers are calibrated and maintained according to manufacturer recommendations. ❹ Equipment/process is operated according to specific Standard Operating Procedures (SOPs) which were used during the validation effort and that the personnel operating it are properly trained. ❺ The raw materials and other inputs to the process are consistent and not altered from the inputs used during the validation effort itself. In short, the process, once validated, will remain validated and in compliance with cgmp if the equipment is maintained and operated in the manner that was in effect when the validation was conducted. It is important that whenever a change is contemplated to the system or one of its components, that it be evaluated to determine the impact of the change on the GMP compliance and validation status of the system as a whole. Once such a review is completed, an educated assessment as to whether or not revalidation is required can be made. Other GMP compliance actions can also be defined based on the review, such as updating the SOP, modifying a maintenance procedure, or making additional changes to the process to insure that it remains in compliance with cgmp requirements. The industry practice, as well as the regulatory requirement, 1 is the use of a change control procedure/measures. Types of Changes Changes can be divided into two categories depending on the timing of the change. A. Planned Changes: changes that would improve operations. Such changes have normally been studied and justified and all interested parties are in agreement that it would be beneficial to implement. In addition, one could envision routine maintenance changes as being planned changes, well known in advance, and everyone believes they should be done. B. Emergency Changes: Changes performed on an emergency basis to ensure continued operation of the system. Changes, either planned or emergency, can further be divided into two categories based on the types of systems requiring the change. These are: ❶ Facility/Utility type changes: These are changes which are to be made to a facilityrelated component, such as changing the positions of a door, the type of wall finish used, or modifying the layout of the manufac- Special Edition: Change Control 7

5 turing space. On the other hand, utility system changes could be related to modification to an existing water system, Heating, Ventilation, and Air Conditioning (HVAC) system, compressed air system, steam generating system, house vacuum system, etc. ❷ Equipment/processing changes: These are changes made in the equipment utilized in the manufacture of a drug product, such as substituting one type of filter with another or using a larger tank to conduct a reaction other than the one originally installed. Processing changes could include changing the temperature at which a given reaction is conducted to the changing of a raw material that is used in the process. Finally, all changes can be viewed from the point of view of their impact on cgmp as either: a. Major changes: These are changes which have the greatest possible impact on the GMP compliance of the process/facility used in the manufacture of the product. The impact will arise from the fact that the change would have the potential of affecting the quality, efficacy, or safety of the product. Examples of major changes include extending the loop of a given WFI system to service another building not anticipated in the original design, changing the raw material used in the production of a drug to a different grade, modifying the layout of a clean room (class 100), adding a step to the operation or making significant changes to the processing procedure. Such changes should be reviewed very carefully, and an appropriate strategy to address the GMP implication should be devised. b. Minor changes: These are changes which would have no impact on the quality, safety, and efficacy of the product and, therefore, would not affect the GMP compliance status of the facility/process. Examples of such changes include exchanging a process pump with the same exact pump (inkind) without modifications to the piping or the operation, increasing the flow rate of a stream without going outside the original validated, or regulatory approved, range, changes performed on noncritical systems 2 which were not validated initially, or changing a leaky valve in-kind for the HVAC humidifier. Change Control Procedure Change control is not used to prevent change, but rather, as the name implies, control it. The idea is that through the use of a simple procedure, an organization will ensure that any changes to a GMP system/process will not go unnoticed, and their effect on validation and GMP compliance will be addressed prior to implementing the change and making it permanent. The following represents an outline for a proposed change control procedure. This procedure is based on discussions with many industry professionals involved in validation and GMP compliance and is based on certain assumptions of organizational structure. Some of the department names presented in this example procedure may not represent actual situations in a given company. However, the main issues and divisions outlined in the example appear to be universal. ❶ Initiating a change: The first step in attempting to implement a change is to request a change be reviewed and approved by all interested parties. This can be achieved by the person/group requesting the change using a change request form. The change request form will contain the following information: Reason and justification for requesting change Technical information necessary to implement change Drawings and sketches ❷ Review: The change request form is then reviewed by a group comprised of the user group (operations), engineering, Quality Assurance (QA), and the validation group. In addition, representatives from the safety and environmental groups should participate in such a review. ❸ Identify GMP implications: As part of the change approval process, both QA and the validation group render an opinion regarding whether or not the change would impact the cgmp status of the system. If it does impact 8 Institute of Validation Technology

6 the system s cgmp status, then an opinion is rendered regarding whether or not requalification/revalidation of the system is required. The change request is then approved with the proviso that certain GMP compliance requirements be satisfied prior to making the change permanent. ❹ Identify Revalidation Requirements: Should requalification/revalidation be the requirement, the system is requalified and or revalidated according to the validation procedure described earlier in this article. Of course, the implementation of the change will take place after the protocols have been developed, and the protocols will be executed once the change has been made to the system but prior to making the change permanent. ❺ Making the change permanent: Once the change is made and adequately validated and is demonstrated to comply with GMP requirements, it becomes permanent, which means that the change is now part of the normal operation. Should a need to revert to the original state of the operation arise, the system is changed again using the change control procedure. Figure 3 graphically depicts this change control procedure. Implementing the Change Once the change control request is approved and the consequences of the change are defined, an implementation plan is developed, and the change is implemented according to a defined schedule. Necessary GMP compliance-related issues are addressed as part of the change implementation exercise. Many situations could arise and require attention from the quality unit and validation groups within the organization. For example, in the case of emergency changes, the change has probably occurred while no one was around. In such a situation, a request has to be filed immediately. Review of the request should be conducted within a very short period of time and, it is key in this case to, obtain quick approval and define all cgmp actions required immediately. Should requalification be required, it should be done quickly to allow for the continued operation of the facility/system. Conversely, in the case of planned changes, adequate time was available to review, document, and validate the change. rmally the appropriate individuals are involved early in the process and agreement is reached prior to the actual implementation. Major changes to facilities, utilities, or equipment, which have a cgmp implication, normally require requalification. On the other hand, minor changes to these systems only require a review by interested parties to confirm that no requalification is needed. Generally, the responsibility of implementing changes associated with the facility/utility lies with the facilities engineering department. It is also their responsibility to ascertain that the systems/facility is continually in a validated state. rmally, for equipment-associated changes, the user group/equipment owner is responsible for alerting appropriate parties of the change and making sure that the change is properly done. It is also their responsibility to ascertain that the equipment is always in a validated state. Finally, I have found that one of the major problems faced by pharmaceutical companies in cgmp compliance is the lack of appreciation, by most people involved, of the importance of adhering to change control policies and procedures. I believe that regular training of mechanics, maintenance personnel, engineers, and operators is essential to raising the awareness level regarding change control and improving cgmp compliance. In Summary Validation is a GMP requirement. Implementation requires the use of validation protocols. The industry standard is to use Installation, Operation, and Performance Qualification (IQ, OQ, PQ) protocols. In order to ensure that a validated system remains in compliance with GMP and in a validated state, regardless of changes which may be done to it, a change control system must be implemented. Change control is achieved using a procedure and is invoked each time a change to the system is contemplated. A change control procedure is a tool to make sure facilities and systems remain in a validated state as well as in compliance with cgmp requirements and should not be used to discourage change. The procedure should be kept simple and easy to follow to ensure that it is always used. The objective is to ascertain that all appropriate personnel are informed of a pending change and have the opportunity to review the change and make an assessment as to Special Edition: Change Control 9

7 Figure 3 Change Control Procedure Change Required Generate Change Requested GMP Implications? Implement Change End Requalification Revalidation Required? Implement Change Prepare, Update, or Retrieve Protocols Prepare GMP Report Review/Obtain Approvals Obtain Approvals End Make Change and Execute Protocols Prepare Report Review Systems Adequately Qualified Obtain Approvals Change is Permanent End 10 Institute of Validation Technology

8 whether or not revalidation or other actions are required to ensure its continued compliance with GMP regulations. References 1. Food & Drug Administration, 21 CFR Parts 210 & 211, Proposed Rule, Federal Register, Friday, May 3, 1996, Docket # 95N Amer, G. (1999), Validation Master Planning: A Practical Guide for Development, Journal of Validation Technology, Vol. 5, Amer, G. (1999), Critical Documentation Requirements in Validation, Journal of Validation Technology, Vol. 5,. 3. Special Edition: Change Control 11