GCP Auditing Methods and Experiences
GCP Auditing Methods and Experiences 2nd, revised and expanded edition Edited by the German Society for Good Research Practice (DGGF) EDITIO CANTOR VERLAG AULENDORF (GERMANY)
Bibliographic data available from the National Library of Germany ( Deutsche Bibliothek ) This publication is catalogued and indexed in Deutsche Nationalbibliographie of the National Library of Germany; detailed bibliographic data is available on the Internet at http://dnb.ddb.de. GCP Auditing. Methods and Experiences Edited by the German Society for Good Research Practice (DGGF) 2nd edition ISBN 978-3-87193-356-1 pharmind-serie Dokumentation 2007 ECV Editio Cantor Verlag für Medizin und Naturwissenschaften GmbH, Aulendorf (Germany). All rights reserved, especially the right of duplication, distribution and translation for an indefinite period. No part of this publication may be reproduced, stored in a retrieval system, or otherwise without the prior written permission of the publisher. The absence of the registered trademark sign after a name does not mean that the name is not protected by trademark rights. Printed and bound by VeBu Druck + Medien GmbH, Bad Schussenried (Germany)
Contents Key Note Address Gabriele Schwarz 7 Preface for the 1st edition Hans Günther Stelzer 9 Preface for the 2nd edition Hans Günther Stelzer 10 Papers Quality Management in Clinical Research and the Value of Audits Rita Hattemer-Apostel 11 Clinical Quality Management in a Medical Department of a Multinational Pharmaceutical Company an Enhanced Approach to Quality Jürgen-Hans Schmidt, Martin Gebauer, and Thorsten Gorbauch 33 Audit Schedule and Project Auditor in a Clinical Project Eva Beate Ansmann, Ilona Fleischhauer, Jürgen-Hans Schmidt, Christine Korbmacher, and Christiane Ehmer 41 Audit of Protocol, Written Information for Study Participants, Informed Consent Form and Case Report Form Wolfgang Krempien and Roland Scharpf 48 The Investigator Site Audit Carmen Julius, Beat Widler, Elfriede Lindauer, and Friederike Spengler 61 Clinical Investigator Audit as Part of the Systems Audit Beat Widler, Elfriede Lindauer, Carmen Julius, and Friederike Spengler 71 Investigator Site Audits by the Sponsor in CRO-Monitored Studies Jürgen-Hans Schmidt and Martin Gebauer 77 Sponsor Audits at Contract Research Organisations (CROs) the CROs Perspective Dagmar Chase and Jürgen-Hans Schmidt 82 5
Sponsor Audits at Contract Research Organisations (CROs) the Sponsors Perspective Jürgen-Hans Schmidt and Dagmar Chase 99 Audit in the Analytical Laboratory Ralf Schaltenbrand, Susanne Plate, Volker El-Samalouti, and Karin Renneisen 109 Audits of Specialised Laboratories: Approaches, Problems and Solutions Andreas Edelmann and Michaela Rittberger 124 Audits of Early Phase Clinical Trials and Clinical Pharmacology Units Rita Hattemer-Apostel and John Norton 146 Systems Audits in Pharmacovigilance Michaela Rittberger, Michael Stegemann, and Jürgen-Hans Schmidt 164 Audits in Data Management, Statistics and Medical Writing: Auditing Clinical Databases, Trial Reports and Related Systems Rita Hattemer-Apostel and Wolfgang Reinhardt 188 Validation of Computer Systems in Clinical Trials Peter M. Kaiser, Per-Holger Sanden, and Thomas Badautschek 206 Electronic Data Capture (EDC) in Clinical Trials from a Quality Assurance Perspective Hans Poland 219 Performing and Reporting an Audit Administrative and Technical Aspects Beat Widler, Iris Sobol, and Rudolf Löffel 247 Appendix Acronyms and Abbreviations 259 Glossary 263 Index 283 Authors Addresses 285 6
Key Note Address I have the great pleasure of writing this preface and congratulating the authors from the GCP Expert Group of the German Society for Good Research Practice on their 1 st revision of the book GCP Auditing Methods and Experiences. Clinical trial results are the scientific basis for the authorization of new medicinal products as well as for the improvement of therapeutic standards. Good Clinical Practice (GCP) describes on the one hand the ethical principles that have their origin in the Declaration of Helsinki and that aim at ensuring the rights, safety and well-being of the trial subject and on the other hand the scientific standards that ensure the reliability and validity of clinical trial results. Meanwhile the CPMP/ICH/135/95 Note for Guidance on Good Clinical Practice (GCP) has been in force for nearly one decade. This guidance was developed in the early nineties to provide a unified standard for the European Union, the United States and Japan in order to facilitate the mutual acceptance of clinical data intended for submission to regulatory authorities. Commission Directive 2003/63/EC of 25 June 2003 as well as Regulation (EC) No 726/2004 of 31 March 2004 specify that those clinical trials that are performed outside the EU but are destined for the authorisation of a new medicinal product within the EU need to be conducted in accordance with the scientific and ethical principles of GCP to be taken into account during the assessment of an application. Furthermore, Commission Directive 2001/20/EC of 4 April 2001 on clinical trials emphasises that any clinical trials on medicinal products for human use, regardless of their particular purpose and whether they are conducted by commercial or non-commercial sponsors, should be performed in accordance with GCP. In view of the enormous costs of clinical research, compliance with GCP is not only a question of ethics and science but also an economic point to consider. Sponsors as well as their contractual partners are forced to implement effective quality assurance and quality control arrangements in order to meet the growing expectations regarding quality in clinical trials. The numerous GCP deviations that are detected in GCP inspections conducted on behalf of the European Commission demonstrate that compliance with the GCP standards is still a challenge. Audits as one important tool in quality assurance are valued highly by regulatory authorities. 7
Audits vary from process to document audits and from systems to project audits. They need to be performed on different facilities and functions ranging from sponsor and investigator site audits, audits of contract research organizations (CROs) responsible for monitoring, data management or pharmacovigilance functions to audits of laboratories. Sponsors must ensure quality assurance in all clinical trial phases from trial design to trial conduct to trial evaluation and reporting. In view of the wide range of different audit types that has to be covered by auditors, ICH GCP explicitly asks for auditors that are qualified by training and experience. However, the expectations on such experience and training are not standardised. In this book, senior auditors are willing to share their individual knowledge and experience with the interested reader and thus the book is sure to become a valuable source for other colleagues in the clinical operations and quality assurance units in pharmaceutical companies, CROs and non-profit research organizations. I wish all readers an insightful learning experience and that this book may contribute to the improvement of quality in clinical trials. Bonn (Germany), May 2007 Gabriele Schwarz Clinical Trials / GCP Inspection Unit Federal Institute for Drugs and Medical Devices 8
Preface for the 1st edition During the past decade, it was predominantly the Good Clinical Practice (GCP) regulations that made it possible to reach an unprecedented quality standard in the clinical development of new pharmaceutical products. For the next decade the objective of quality assurance in clinical research and development will not only be to maintain the quality standard achieved but also to further strengthen organisational structures and enhance responsibilities, procedures, processes and resources for the implementation of quality management at all levels of clinical drug development. The GCP Quality Assurance Working Party of the German Society for Good Research Practice (Deutsche Gesellschaft für Gute Forschungspraxis e.v. DGGF) is very much involved in all subjects of quality assurance in clinical research and development. The Working Party also deals with the application and interpretation of guidelines as well as professional statements concerning new draft regulations for clinical trials, and has focused on promoting the exchange of information and views between its members. In this book experienced auditors and colleagues from quality management, all of whom are members of the GCP Quality Assurance Working Party, describe methods and processes of quality assurance and quality management in clinical research and development. Their articles also present aspects of experience gained during numerous auditing years. Principles and standards applied in quality assurance are outlined as well as methods for planning, conducting and analysing audits, providing the reader with an overview of the current standard of quality assurance in clinical drug development. The authors would like to thank ECV Editio Cantor Verlag for their willingness and cooperation in editing this book. Freiburg/Brsg. (Germany), July 2003 Hans Günther Stelzer Head of GCP Quality Assurance Working Party of the DGGF 9
Preface for the 2nd edition The first edition of this handbook was already sold out when we decided more than one year ago to publish a second edition which should of course be updated and expanded with some additional facets. Therefore all chapters have been revised, adopting the current legal provisions and EU Directives. Five new chapters have been added: Quality Management in Clinical Research and the Value of Audits. Clinical Quality Management in a Medical Department of a Multinational Pharmaceutical Company. Audits of Specialised Laboratories: Approaches, Problems and Solutions. Audit of Early Phase Clinical Trials and Clinical Pharmacology Units. Electronic Data Capture (EDC) in Clinical Trials from a Quality Assurance Perspective. It should be emphasised that all individual articles represent the opinion of their authors and do not assert other authors claims to agree. I would like to thank the authors for their work enthusiasm and for the meticulous revision of their articles. Special thanks go to Rita Hattemer-Apostel for her support in reviewing and editing the manuscripts and her valuable ideas. We are especially grateful to John Norton for his review of the English texts and translations. Finally, ECV Editio Cantor Verlag and its editorial office deserve our best thanks for their care and expertise in the preparation of this book. We hope that the second edition of this volume will once more become successful as a reference book for clinical operations professionals and quality assurance experts. Freiburg/Brsg. (Germany), July 2007 H. Günther Stelzer Head of GCP Quality Assurance Working Party of the DGGF 10
Quality Management in Clinical Research and the Value of Audits Rita Hattemer-Apostel Regulatory authorities expect quality assurance (QA) programmes being established at sponsors and external service providers; however, this should not be the only reason for implementing a proper QA programme. QA audits can help ensure the integrity and validity of clinical trial data from the beginning to the end, from trial planning until the final study report through auditing. Audits assess if studies are conducted in an ethical manner, if the trial participants safety and well-being is respected, if the clinical data is valid and the trials are accurately reported. This chapter sets out to provide a profound basis on quality management aspects in clinical research. It looks at the origins of quality management and auditing and explains key definitions related to quality management in clinical research, quality control (QC) and QA as well as why QC and QA must be clearly distinguished. Possible follow-up activities, such as corrections, corrective and preventive actions, are also defined and how they relate to QC and QA is described. Effective quality management systems are composed of different components which are presented in this chapter. However, the focus of quality management systems in clinical research extends not only to compliance, documentation and transparency but also to ethics a dimension to be particularly aware of in Good Clinical Practice (GCP) QA. Audit types (e.g. trial-specific and systems audits), audit locations and the time point of audits (e.g. prospective, in-life and retrospective audits) are presented in detail as these variables are determined by the purpose and the aim of an audit. The chapter discusses the value of audits and also addresses the possible downside of auditing. Apart from confirming compliance or uncovering compliance deficiencies, audits provide the basis for continual improvement in that they highlight areas for improvement and, due to the auditors independence from operational functions, help overcome the blind spots. Audits prevent quality management systems from getting rusty and auditees (and auditors!) from getting complacent and they ensure the continued fitness of the company to meet internal and external requirements. 11
1. Introduction It can hardly be imagined that anyone would question the contribution and value of quality management to any kind of industry. Quality management helps ensure that processes are standardised, that legal and regulatory requirements are followed, that customer expectations are met, that products are safe and reliable and that organisations are run in an organised and efficient manner. Of course, this is true as well for the pharmaceutical industry. Quality management efforts are undertaken in many areas, from research and development to manufacturing and distribution of pharmaceuticals. The purpose of all quality-enhancing activities in pharmaceutical research and development is to ensure that valid and robust data are generated which prove the drug s safety, efficacy and quality, reflected in the three core areas of the International Conference on Harmonisation (ICH). While this does not mean that the quality of a pharmaceutical product is limited to these three aspects as availability and affordable price may also be of importance, the chapter is focusing on the ICH aspects. In the ICH context, quality stands for pharmaceutical quality, which means that drugs are manufactured following validated and controlled processes, that active pharmaceutical ingredients and excipients are used which meet pre-defined specifications and which are acquired from quality-assured suppliers, and that the final product complies with specifications. None of the three aspects safety, efficacy and quality can be neglected: a drug which is safe and of proven therapeutic efficacy, but which is of inadequate pharmaceutical quality is as harmful as a drug perfectly manufactured and effective but which is unsafe for the patients. And what would justify having a product on the market lacking efficacy? 2. Quality assurance and audits in GXP what do regulations ask for? Good Laboratory Practice (GLP), Good Clinical Practice (GCP) and Good Manufacturing Practice (GMP) are quality systems established in pre-clinical research, clinical drug development and manufacturing, respectively. While it is a common feature of these quality systems to ask for an independent quality assurance (QA) function to be established, the necessity for conducting audits or self-inspections is not equally important in the three different GXP areas. 2.1. Good Manufacturing Practice In accordance with Article 6 of the European GMP Directive [1], the manufacturer shall establish and implement an effective pharmaceutical 12
quality assurance system, involving the active participation of the management and personnel of the different departments. Article 13 outlines that the manufacturer shall conduct repeated self-inspections as part of the quality assurance system in order to monitor the implementation and respect of good manufacturing practice and to propose any necessary corrective measures. While the European GMP Directive [1] does not request that self-inspections or audits be performed by independent personnel, Chapter 9 of the PIC/S Guide to GMP for Medicinal Products [2] requires that self-inspections [...] be conducted in an independent and detailed way by designated competent person(s) from the company and independent audits by external experts may also be useful. 2.2. Good Laboratory Practice According to the Organisation for Economic Co-operation and Development (OECD) Principles of Good Laboratory Practice [3], the Quality Assurance Programme means a defined system, including personnel, which is independent of study conduct and is designed to assure test facility management of compliance with these Principles of Good Laboratory Practice. The conduct of inspections to determine if all studies are conducted in accordance with these Principles of Good Laboratory Practice is part of QA s responsibilities. 2.3. Good Clinical Practice While ICH GCP [4] requests that systems with procedures that assure the quality of every aspect of the trial [...] be implemented, that the QA function be independent of and separate from routine monitoring or quality control functions, audits are not explicitly requested. If or when sponsors perform audits audits remain a voluntary activity in ICH GCP. The European Clinical Trials Directive [5] mentions quality assurance arrangements which are to be reviewed during inspections, without being more specific about what exactly these activities entail. The European GCP Directive [6] mentions in Article 16 that the trial master file shall provide the basis for the audit by the sponsor s independent auditor and for the inspection by the competent authority 1). 1) It should be noted that ICH GCP is only a Note for Guidance and bears, therefore, less legal weight than a European Directive which has to be transposed into national law of the Member States and is then legally enforceable. However, this does not exclude the possibility that ICH GCP was referred to in some national laws and consequently was legally binding before the European Clinical Trials Directive was transposed into national law. 13
Hence, auditing is no longer a voluntary activity, but a mandatory requirement in accordance with the GCP Directive. The need for an independent QA unit and the conduct of audits is also described in the draft Guideline on Monitoring of Compliance with Pharmacovigilance Regulatory Obligations and Pharmacovigilance Inspections [7], published by the European Commission. Surprisingly, the Food and Drug Administration (FDA) neither mandates the establishment of QA units nor the conduct of audits: Clinical trial quality assurance units (QAUs) are not required by regulation. However, many sponsors have clinical QAUs that perform independent audits/data verifications to determine compliance with clinical trial SOPs and FDA regulations. QAUs should be independent of, and separate from, routine monitoring or quality control functions. [8] In summary, establishing independent QA functions and conducting audits are GCP requirements in Europe. Although the FDA is much less explicit, it may generally be considered unwise to ignore the possible contribution of QA to assuring the quality of clinical research. 3. Historical roots of quality management Efforts to produce goods and to provide services of high quality, to assess quality and to impose punishments in case of inadequate quality are not a new phenomenon. One of the first written documents regulating quality goes back to Hammurabi (1728 1686 BC), a Babylonian king. Under his rule, a code of laws was developed and chiselled into a huge stone stele which was found in 1902 and is now to be seen in the Louvre Museum in Paris. Hammurabi s code comprises 282 laws. Penalties are barbaric by modern standards and include for example burning, drowning, hanging, impalement on a stake, bodily mutilation and monetary fines. The expression an eye for an eye, a tooth for a tooth has come to symbolise the principle behind Hammurabi s code [9, 10]. Some examples [11] are displayed in Table 1. In the late 13 th century in medieval Europe, guilds were responsible for developing strict rules for product and service quality and furthered quality management. Inspection committees enforced the rules by marking flawless goods with a special mark or symbol [12, 13]. This can be considered the start of quality control an activity to assess finished products to evaluate whether they meet pre-established criteria. One of the next important steps was the introduction of sampling techniques for inspection enabling to infer from a small representative sample to the population, thus speeding up quality control processes. With the possibility to evaluate large amounts of data, statistical process control was introduced; a technique in use in many manufacturing organisations. This technique paved the way to focus on improving the production 14
Table 1: Excerpts from Hammurabi s Code. No. 218 No. 225 No. 229 No. 232 No. 235 If a physician make a large incision with the operating knife, and kill him [the patient], or open a tumor with the operating knife, and cut out the eye, his hands shall be cut off. If he [the veterinarian] perform a serious operation on an ass or ox, and kill it, he shall pay the owner one-fourth of its value. If a builder build a house for some one, and does not construct it properly, and the house which he built fall in and kill its owner, then that builder shall be put to death. If it ruin goods, he [the builder] shall make compensation for all that has been ruined, and inasmuch as he did not construct properly this house which he built and it fell, he shall re-erect the house from his own means. If a shipbuilder build a boat for some one, and do not make it tight, if during that same year that boat is sent away and suffers injury, the shipbuilder shall take the boat apart and put it together tight at his own expense. The tight boat he shall give to the boat owner. process rather than inspecting the final product by preventing errors instead of correcting them: this was the birth of quality assurance. The benefits of QA soon led to the insight that quality is an attribute that can be managed and this in a double sense. On the one hand, investments in process quality affect the outcome of the product, i.e. quality can be managed. On the other hand, quality is a task of management. The International Organization for Standardization (ISO) standard 9000:2005 [14] describes the responsibility of senior management and emphasises the importance of leadership by top management in implementing and developing quality management. Further development led to the introduction of Total Quality Management (TQM) where quality management principles are applied to all areas within an organisation or company, not just the operational departments but also functions such as human resources, business development, marketing, finance and controlling. 4. Quality Management, Quality Assurance and Quality Control Although ICH GCP includes an extensive glossary on the most important definitions used in GCP, the following thoughts and explanations may be useful. 15
4.1. Quality Management ISO 9000:2005 [14] defines quality management as the coordinated activities to direct and control an organisation with regard to quality. None of the GCP regulations, directives or guidance documents, whether from Europe or from the US, mentions the term quality management the absence of this term is striking! Neither the European Clinical Trials [5] or GCP Directives [6] nor the Code of Federal Regulations (CFR) describes the requirement for a comprehensive quality management system in clinical research. While ICH GCP [4] does not contain an explicit definition for quality management, principle 2.13 speaks of systems with procedures that assure the quality of every aspect of the trial. ISO 9000:2005 (as well as other standards of the ISO 9000 family) may be a useful resource when establishing a quality management system in clinical research as it provides comprehensive information for an area which is only scarcely described, if at all, in GCP regulations and guidelines. This must not imply, however, that ISO certification is to be sought in clinical research. 4.2. Quality Assurance According to ISO 9000:2005 [14], QA is defined as the part of quality management focused on providing confidence that quality requirements will be fulfilled. This definition emphasises that QA activities are futureoriented ( will be fulfilled ) and should focus on improving systems and procedures to be followed to ensure that these are set up in such a way that produces a quality result or service. ICH GCP [4] defines QA as all those planned and systematic actions that are established to ensure that the trial is performed and the data are generated, documented (recorded) and reported in compliance with GCP and the applicable regulatory requirement(s). There is no mention that QA is confined to auditing, but QA comprises all activities suitable to ensure that company procedures are designed so that the product or service will comply (in the future) with pre-established quality requirements. 4.3. Quality Control ICH GCP [4] describes Quality Control (QC) as the operational techniques and activities undertaken within the quality assurance system to verify that the requirements for quality of the trial-related activities have been fulfilled. ISO 9000:2005 [14] uses a more precise definition which nicely contrasts the above ISO definition for QA. Quality control is the part of quality management focused on fulfilling quality requirements. Here, the focus is on activities undertaken by operational departments (such as clinical moni- 16
toring, project management, data management etc.) to ensure that processes are performed and documents are written in compliance with the trial protocol, Standard Operating Procedures (SOPs) and other procedural documents. In-process QC steps are conducted as part of the daily routine and are a vital component in the overall quality management system. 5. The difference between QC and QA It is important to distinguish clearly between QC activities, which are embedded in the routine functional tasks and are the responsibility of operational staff, and QA activities (e.g. audits), which are conducted by auditors independent of operational functions. While the intention of both activities, QC and QA, is similar, i.e. enhancing quality, the approach to and the impact of their activities are entirely different. QC is focused on confirming as part of routine operational activities that the output of a process complies with pre-established criteria. Useful QC tools are checklists, for example in order to evaluate if informed consent documents contain all necessary elements and comply with all internal and regulatory requirements, and peer review processes in that a second (or third, fourth) employee another pair of eyes reviews documents prior to their finalisation to verify their accuracy, completeness and consistency. Built-in QC steps with short feedback loops guarantee that deficiencies and errors are identified and rectified early, preventing unnecessary delays caused by time-consuming corrections. Also, for example at investigator sites, behaviours and procedures that might compromise the ethical and safe treatment of trial participants are uncovered in a timely manner. These activities help ensure that processes are run efficiently by minimizing the need for corrections and rework; hence, that the things are done right. Doing the right things, however, is what QA should be concerned about. Placing the focus on effectiveness asks for a change of perspective: rather then checking the quality from within a department, QA should apply a holistic view on processes and procedures. Being independent and detached from operational activities, QA auditors are able to see the big picture and are in a position to identify if processes are suitable to produce the desired result at the expected level of quality. QA should assess the overall capability and aptitude of procedures to verify if these are fit for purpose. QA auditors, and also management, need to be aware of the fine line between QC and QA and clearly define respective responsibilities. Often, in companies and organisations where QC activities are insufficiently implemented or even entirely neglected, QA steps in the role of QC and is misused to conduct QC activities, focusing on present compliance with internal and external regulations, instead of assessing procedures for systemic compliance deficiencies, weaknesses or ineffectiveness. 17
As a consequence, the much-needed critical and independent review fails to be conducted and the opportunity is missed for establishing processes which inherently lead to future compliance. If this is the case, error correction rather than prevention prevails. The confusion between the two distinct roles of QC and QA is furthered by the fact that both functions have quality in their name and that neither GMP nor GLP clearly distinguishes between QC and QA. However, this should not be an excuse for being similarly fuzzy about QC and QA roles in GCP. 6. Correction, corrective action and preventive action Quality management is unthinkable without corrections, corrective and preventive actions, also in clinical research. Often, follow-up to QC activities or QA audits mandates corrections to deficiencies observed (if corrections are possible at all). Follow-up activities can range from being selective or far-reaching. The following definitions may shed some light: 6.1. Correction and corrective action ISO 9000:2005 [14] describes correction as an action to eliminate a detected nonconformity whereas corrective action is defined as an action to eliminate the cause of a detected nonconformity or other undesirable situation. As a consequence, applying corrective actions is more lasting than simply correcting errors. 6.2. Preventive action According to ISO 9000:2005 [14], preventive action is described as an action to eliminate the cause of a potential nonconformity or other undesirable potential situation. It should be noted that preventive action is taken to prevent occurrence, i.e. preventing an error from happening at all, whereas corrective action is initiated to prevent recurrence, i.e. preventing an error from happening again. 6.3. Corrective and Preventive Action = CAPA Regulatory authorities have recognised that both aspects are to be considered in a quality management system, for example in pharmacovigilance [7]: Particular emphasis should be placed on organisational roles and responsibilities [...] for ensuring corrective and preventive action. Corrective and Preventive Action (CAPA) is not a new concept in the pharmaceutical 18