Approaching The Response To Audit Observations

Approaching The Response To Audit Observations By Troy Fugate Understanding your systems and taking responsible and appropriate actions are at the core of beneficial audit responses. Systemically applying response strategies yield the greatest rewards. INTRODUCTION One of the first things consistently drilled into our collective memory in the quality world is the statement that we should always be prepared for an audit. It is a number one priority prevailing over our activities as a quality unit. The reason is simple; always being prepared prevents, or at least minimizes, the peaks and valleys of audit preparation. This is demonstrated by the graphic of an audit cycle shown in Figure 1. Since experience is gained not only at the front end, during audit preparation, but also at the back end, during audit response, it is evident that if Always be Prepared is a number one priority, then a number two priority is Respond Systemically to any observation. If done properly, systemic resolution to issues should eliminate the peaks and valleys syndrome outlined in Figure 1. Understanding the Observations It is essential that the observations be understood and evaluated in the context in which they were given. Personnel involved with the audit should have input into the reasoning behind the issue. Hopefully, the auditor will provide feedback either when the observation was made or on a daily basis. This is an opportunity to understand the points being made. Typically, the last prospect for obtaining feedback directly from an auditor is during the close-out meeting. The close-out meeting is a review of the observations made by the auditor. For the U.S. FDA, when a Form 483 is issued, the firm will receive it during this close-out. For the Medicines and Healthcare Products Regulatory Agency (MHRA), the firm will receive a verbal list of observations. The written list will follow in about two weeks. For internal, corporate, or external auditors, there is usually a verbal close-out meeting followed shortly thereafter with a formal report. During the close-out meeting (especially during formal or governmental audits), it is important to have the appropriate personnel in attendance. Attendees usually represent Quality Assurance, Regulatory Affairs, Operations, and Senior Management. It is important to keep the number of personnel in attendance to a reasonable level. Too many people and the auditor may become uncomfortable. Too few and it may seem that you are not taking the audit seriously. Decide in advance how you are going to approach the close-out meeting. Will you question every observation and attempt to get them removed - analogous to a Scorched Earth Policy? Will you accept every observation even if there are errors present? Who will comment on the observations - everyone? Will people debate or disagree with valid observations? A good approach is typically one that abides by the following outline: Special Edition: Conducting Audits 33

Figure 1 Audit Cycle Audit complete company at a high state of compliance Audit Announced Cycle Repeats! Now that the audit is over, we can get back to some real work Overtime, extra help, replace items, conduct training RUSH, RUSH Lower Level of Compliance High Level of Compliance The head of Quality is the one who hosts the audit and will be the firm s representative during the close-out. That person alone will be the one who questions any observation unless a person hears a point that is blatantly in error. The head of Quality can, and often does, ask for assistance from other key representatives of the group. Review each item with the auditor. Understand what is being cited. Do not guess or speculate - your response could be far off-target when you speculate or assume. If errors are present, comment on them. Ask for clarification. Auditors are human and can make mistakes. If you have already made corrections - decide whether you will indicate that fact during the closeout. If the points are minor or easily rectified, you could make the comment that actions have already been implemented to correct the problem, but be cautious with this approach. There is a concern that should be noted on this point - If the firm has a knee-jerk reaction and implements corrective actions too quickly, the auditor may be concerned that you are reacting without truly evaluating the systemic nature of the observation. Many questions can be raised, such as: - How did you get the change control implemented so quickly, Have you trained personnel, Did you evaluate all the systems? Your quick response may elicit far worse comments such as: That is not what I meant by the observation. If there are true points of contention, discuss them, but do not argue directly with the auditor. You should not argue every point or even a large percentage of them. It should be understood that these observations are simply points made during an inspection by an auditor. The firm has an ample amount of time to respond to the issues in a written format, citing examples of compliance, references, guides, testimony, etc. Be cautious in committing to anything during the close-out. The auditor is taking notes and will indicate that the firm committed to a particular action or timeframe. This is particularly important during a governmental audit and may result in further actions. There are other means of gaining an understanding of 34 Special Edition: Conducting Audits

the observations, including, but not limited to, obtaining the Establishment Inspection Report (EIR) or directly contacting the inspector for questions. Re-establishing Credibility - The Response Once observations are given, particularly on critical or major points, the firm has a limited amount of time to respond. This could range anywhere from 15 to 30 days. If not, a timeframe for response is provided by the auditor. The firm should have a policy in place and adhere to it diligently. This is the firm s chance to re-establish credibility with the auditing body, client, potential client, MHRA, etc. The last thing an auditor or auditing body wants to do is chase down a firm for corrective actions or to conduct extensive follow-up. Any issues with the response, such as, lack of clarity or detail, will only result in a request for further information, followed by more details, followed by another review, etc. This loss of time in obtaining a conclusion to the audit can result in delays in obtaining contracts or governmental approvals. An approach for formulating a response on each observation is recommended as follows: Evaluate the current state of compliance in light of the audit observation. If possible, indicate what is compliant. Identify the root cause of the issue as appropriate. Understand how the firm will resolve the issue systemically. Definitions Quality should be built into the process and auditing alone cannot be relied upon to ensure quality. Actions taken before, during, and after an audit will ultimately determine the level of compliance. Before proceeding further, it is best to define some of the main points being discussed. Without a basis of understanding for these points, misunderstandings and confusion are bound to happen. Audit Compliance Conformance Observation Quality Audit Systemic Audit Planned, independent, and documented assessments to determine whether agreed upon requirements are met. Affirmative indication or judgment that the supplier of a product or service has met requirements. An affirmative indication or judgment that a product or service has met the requirements of the specifications or regulations. An item of objective evidence found during an audit. A systemic and independent examination and evaluation to determine whether quality activities and results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives. Note: This last section of underlined text is very important to understanding whether one is to respond systemically to an audit finding. The auditor is looking for current implementation of programs AND how you plan to implement corrective actions to observations. A means of conducting an audit that evaluates the systems implemented by a firm to control their operations. Although the auditor or firm may divide their systems into various classifications, a good standard is provided by the U.S. Food and Drug Administration (FDA). (See Attachment I.) Special Edition: Conducting Audits 35

Review prior commitments. Are any issues a repeat observation or a repeat observation for the same type system issue? This is critical to know and understand. If you have made a commitment in the past regarding an observation, but the corrective actions were not implemented or did not resolve the issue, the inspecting body will evaluate the current observations in a more critical light. Repeat observations also greatly increase the likelihood of further regulatory actions. Identify the root cause. This is a fundamental principle in the FDA s view of systemic audits and is certainly used widely in Europe as a format for inspections. Figure 2 Responding to an Audit Analyze Observations Determine the Timeline Relate each observation to the appropriate Quality System. Understand the area of impact of the issue in relation to the functions impacted by that system. Develop a corrective action plan around the entire scope of the issue(s) noted. Secure the required resources needed to complete the job in the timeframe indicated. DO NOT underestimate the forces needed to complete a job within schedule - let alone evaluating the outcome of the work. Verify that responsibilities are assigned to key people and make them accountable. Assignments given to departments or groups of people are almost doomed to failure. Someone must be in charge to assign work and to track and modify the assignment as needed. Just as importantly, a single key individual, typically the head of Quality, should be responsible for the overall work. Note: In the steps provided, points one through seven are directly related to formulating a response to the observation. It is critical to understand that points six and seven directly relate to the response letter in that these actions determine the timeframe in which actions can be accomplished. Without knowledge of the requirements needed to complete the actions, the events following the response will fall into one of three categories: 1. Actions needed to finish the task will be completed significantly earlier than the date indicated in the response. The risk here is that the reader of the response will know that it does not take that long and will consider your reaction inappropriate. Review and Re-write Write the Response Letter 2. Actions needed to complete the task are performed prior to the date indicated in the response. This position can be great if planned out and performed in a compliant manner. As some have discovered, much to their chagrin, some response timeframes are not that well thought out and in order to complete the task necessary, monumental actions have to be taken. This may include significant overtime, hiring temporary staff, not completing routine activities, or completing the task with shortcuts or in a non-compliant manner. 3. Actions needed to complete the task are performed after the date indicated in the response. Most audit bodies (even governmental auditors) understand that things happen and sometimes tasks cannot be completed in the time indicated. The audit body 36 Special Edition: Conducting Audits

should be notified immediately (the best time for notification is BEFORE the due date of the action). Explain the situation, what has happened, the tasks completed, and the new due date. That being said if missed commitments are frequent enough or happen not once, but two or three times, the auditing body may become concerned and inquire into the situation further. An overview of the process for responding to the audit is provided in Figure 2 and subsequent actions are provided in Figure 3. WRITING THE RESPONSE There are some basic rules that can be established regarding writing a response letter. Some or all of these rules may apply depending upon the particular situation of the firm, e.g.: lengthy list of observations from a governmental body, client audit, warning letter pending, etc. Someone at a high level in the Quality Department should write the response. Personnel copied on the response should include high-level management. This shows that management at the firm is aware of the issues and the commitments being made. Include a cover letter or opening statement. Thank the auditor(s) for being professional, providing insight, or other appropriate remarks as warranted. State the site address of the audit and the dates. Always remember that you are writing the response to the auditors, management, governmental auditing bodies, as well as clients. Do not assume that the person reading the report understands the context of the observation or your reply. Restate the observation and reference number in the response. Typically, the observation goes directly above the response. If possible, indicate the related compliant systems. This shows that you are in control and that some operations were functioning within acceptable Good Manufacturing Practice (GMP) parameters. If the action item is going to take some time to implement, state what will be done in the interim to be compliant with GMPs. Do not merely indicate that actions will be taken in six months to correct the issue in which you are currently out of compliance without addressing what you will do to become compliant from the current date until the corrections are implemented. If corrective actions have already taken place, indicate the following: Dates implemented Training performed (copies of training sign-up sheets included) Copies of purchase orders, installation work, etc. Copies of updated Standard Operating Procedures (SOPs) - indicating what was changed. Define how enhancements will prevent recurrence of the issue observed. Do not assume that the reader will understand this fact. Explain what will be done to expand, enhance, or streamline the compliance system. Do not forget about training. Allow sufficient time to implement changes to incorporate training that may include proficiency testing. Describe how the firm will monitor the progress and effectiveness of the corrective actions. It may be helpful to explain, if apropos, that despite the issue stated, there has never been a problem caused by this issue. It is not advisable to use this response tactic each time, but it can be advantageous for critical observations to state something on the order of the product has always met predetermined quality parameters Revise, revise, and revise again. Allow other people not directly involved with the audit to review and comment on the response. They may have insight on response wording that would assist in clarification or strengthening of points. When initially formulating a response, a four-stage inspection approach may be helpful to develop perspective on the format of the response and contribute to a better understanding of what actually needs to be implemented to attain compliance. Special Edition: Conducting Audits 37

Figure 3 Acting on Audit Observations Observations are received at this point Audit Systemic Verification Systemic Analysis Systemic Execution of the Plan Systemic Implementation Plan Response to the audit observations is made at this point This approach includes: 1. Restating the Observation 2. Defining the Root Cause 3. Indicating a Corrective Action 4. Developing a Due Date If this approach is followed completely, any corrective actions will be systemic and should address the root cause(s) defined. This will also aid in the development of due dates because the firm will be more informed as to what actually needs to be accomplished. Response Strategies to Avoid Although the following information is not exhaustive, these are some strategies taken by firms which indicate a firm s unwillingness to change or its inability to make appropriate corrective actions. If a firm does not have the capability, time, or experience to respond appropriately to an audit, especially to a government audit, a prime objective should be to seek outside assistance. Pathways to Disaster Scorched earth. During the closeout or in the response letter, argue every point stating they are not appropriate or we have never had an issue with this point from other auditors. This is called a scorched earth policy and will ensure that the auditor has a strong message of noncompliance to take to the auditing body about your firm. Scare tactic. State that the corrective actions being requested will put the firm out of business or drive jobs to a foreign country. These are scare tactics that have been used for at least 20 years and have not proven to be true. The rain forest or overwhelming response. 38 Special Edition: Conducting Audits

Figure 4 Ensuring All Areas Are Corrected Departmental Corrective Actions on a Specific Observation Departmental Corrective Actions on Other Points in Relation to the Specific Observation Site-wide Corrective Actions on a Specific Observation Site-wide Corrective Actions on Other Points in Relation to the Specific Observation Contract Firms, Third Parties, Vendors Site-wide Corrective Actions on Other Points in Relation to the Specific Observation Corporate-wide Evaluation Special Edition: Conducting Audits 39

Include massive amounts of data that is not warranted with the hope that the reviewer will be impressed with the work. This type of response sends an immediate warning signal to the auditor that issues are being glossed over. Implement changes immediately. Either during the closeout meeting or with a quick response, all changes have been implemented for complex issues. If the issue is simple, implementing changes quickly is not a problem. However, for complex observations, a rapid response indicates that the firm has taken a knee-jerk reaction and implemented corrective actions without thinking of the root cause. Failure to respond Actions may be taken, but no formal letter is sent indicating what was performed. This approach indicates that the firm does not take the audit seriously. The enigmatic response. The firm indicates that actions are going to be taken but does not address what these actions include. Such an example would include: Actions Taken - Records were updated. When? How were they updated? Promise without substance. Similar to the enigmatic response, this approach does not indicate any specifics. An example includes: Deficiency - Detailed investigation not performed in a timely manner. Response - Investigations will be carried out in a timely manner. MANAGEMENT S ROLE The role of management cannot be understated in its stance regarding a successful audit outcome. The auditor must get the impression that management is informed of issues and is vested in resolving those issues. Some of management roles include: Hosting the inspection. Up front, this will be the first impression that an auditor receives of how the firm actually operates. If no one from management is available or even attempts to participate in the audit, there is a lost opportunity to indicate that the firm is willing to listen and learn from the experience of the auditor. Management does not have to be present during the entire audit, but should be there during the opening and to discuss any key observations. Participation in Closing. Taking part in the closing meeting will indicate that the firm s management is accountable for decisions made and actions taken. Awareness. Management should be aware of or participate in the response letter. Indication of the copy circulation of the response letter should be included on the letter. Commitment. The most critical role of management after the audit is the commitment of resources to accomplish the task in the allotted timeframe. This could range from more money to more people. Beyond the Context of the Direct Observations A systemic response to any audit observations must equate to a systemic resolution to any issues within the firm. This response requires further evaluation than simple actions within a system at a company site. The FDA in particular will require that all company sites implement corrective actions along the same plan of action. Failure to do so may result in further regulatory actions. Programs must be established which require any observations and their responses to be circulated for evaluation within a company to determine whether other areas are noncompliant. Figure 4 illustrates this approach. Helpful Hint #1: EIR Evaluation The FDA will write an Establishment Inspection Report (EIR) on the audit. This report, along with any observations and the firm s response, are submitted to FDA Management for final inspection, conclusions, and closeout (or further action from the District). It is highly recommended that the EIR be obtained by the audited firm and be evaluated for accuracy. Any discrepancies should be diplomatically handled via a letter to the auditor. Helpful Hint #2: Prepare to be Re-inspected After the audit, there is a tenancy to drift back into an operational mode. Along with other daily issues, some commitments may be dropped or forgotten. It is Quality Assurance s (QA) role to ensure that the firm has met their commitments in anticipation of a re-inspection. During the re-inspection, auditors will verify actions taken and timeline adherence. QA should substantiate GMP compliance by assuring the resolutions encompassed root causes were systemic or comprehensive and actually worked to resolve all issues. 40 Special Edition: Conducting Audits

CONCLUSION Although comprehensive and seemingly overwhelming, the audit response can be accomplished successfully. This report offers numerous points and options for success when facing an audit. The firm should consider these options when addressing all audit observations and systemically concentrate on any actions. If completed, the firm and auditor are both in a win-win scenario whereby the firm resolves root cause problems and the auditor has fewer repeat observations. ABOUT THE AUTHOR Troy Fugate, Vice President for Compliance Insight, Inc, located near Cincinnati, OH, is a worldwide compliance consultant in the areas of pharmaceutical quality, operations and packaging, laboratory and construction activities. Troy has worked around the globe on a variety of projects and specializes in quality systems, audits, investigations, FDA issue resolution, and training. Troy can be reached at troy@compliance-insight.com. REFERENCES 1. U.S. FDA, Guidance for Industry, Quality Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations, Draft Guidance, September 2004. 2. Preparing for Audit and The Quality Audit, Compliance Printing Operational Booklets, 2004 and 2005. EIR FDA GMP MHRA QA SOP Article Acronym Listing Establishment Inspection Report Food and Drug Administration Good Manufacturing Practice Medicines and Healthcare Products Regulatory Agency (UK) Quality Assurance Standard Operating Procedure Special Edition: Conducting Audits 41

Attachment I FDA Systemic Approach PRODUCTION Maintain Validation Controls Product System FACILITY/ EQUIPMENT Maintain Qualify Controls Calibrate Clean Packaging & Labeling System Quality System Facilities & Eq;uipment Systems PACKAGING/ LABELLING Control Maintain Qualify MATERIAL Control Qualify Materials System Laboratory Controls System LABORATORY Control Disposition Authority Qualify Maintain Calibrate QUALITY Control Disposition Authority Investigate (CAPA) Originally published in the July 2006 issue of The Journal of GXP 42 Special Edition: Conducting Audits