Special Edition TABLE OF CONTENTS. Corrective and Preventive Action Vol. II. The StN Boundary Line of Effective Action J.

Special Edition TABLE OF CONTENTS Corrective and Preventive Action Vol. II 14 Future State CAPA Management- A Productivity Improvement Tool By Kamal Biswas 15 Corrective Action and Preventive Action (CAPA) in a Laboratory David Drovetta 18 What Companies Should Know And Consider When Designing A CAPA System PART I By Gabriela Bodea 27 How To Set Up A CAPA Program From Scratch PART II OF A TWO-PART ARTICLE By Gabriela Bodea 46 Corrective Action and Preventive Action The StN Boundary Line of Effective Action J. Ambrose Van Wert 50 When Systems Fail, CAPA Validation Begins By IVT Staff Based on a Teleseminar given by Jackelyn Rodriguez, September 20, 2006 2008 Advanstar Communications Inc. All rights reserved. Reproduction in whole or part is prohibited without prior written permission of the pulisher.

Future State CAPA Management- A Productivity Improvement Tool By Kamal Biswas EXECUTIVE SUMMARY ABSTRACT The top spot in the Food and Drug Administration (FDA) observations (FDA 483) list has almost permanently been taken by Corrective and Preventive Action (CAPA). Being a major subsystem of FDA s Quality System Inspection Technique (QSIT), CAPA is audited in all FDA inspections. Effective CAPA management is a top priority to ensure compliance. While compliance need is given, it should be viewed with a broader outlook to use it as a productivity improvement tool. That way it could get all the stakeholders buy-in, hence better compliance would result. CAPA should not be regarded as the headache of the quality functions; it should become an integral part of operations. CAPA has been a major stumbling block for many pharmaceutical companies, mainly to manufacturing operations. About 40% FDA 483s seen in the industry relate to CAPA - the highest single category of FDA non-compliance. Therefore, the FDA does a thorough check during every inspection it performs in a company. If companies know that CAPA is a major non-compliance issue, why are they not taking adequate safeguard measures? It is the author s opinion that current CAPA measures are failing because CAPA is often considered a compliance need rather than as an important mechanism to improve operational excellence. Effective CAPA management will not only save pharma companies in compliance audits, its preventive measures can help companies improve productivity by radically reducing rework. Effective CAPA management could bring on time analysis of process execution data to identify deviations and take early action improving quality and productivity. CAPA needs to be viewed with a broader outlook and made a key focus area for corporate, away from the traditional view of a point-in-time localized function. Companies can get substantial benefits by taking an enterprising view of CAPA.

Kamal Biswas INTRODUCTION What is CAPA? FDA regulations for CAPA for the pharmaceutical company are defined in Code of Federal Regulations (CFR) 21 section 211, as part of the Quality System Regulations (QSR). This process identifies reported and potential causes of product SQUIP- Safety, Quality, Integrity, Potency or Purity - performs root cause analysis of deviations, and determines appropriate corrective and preventive actions to eliminate repetition of failure. The program ensures that corrective and preventive actions get implemented through proper management reporting and review. FDA views this as a linkage to the entire quality management process. That is why the FDA makes sure that CAPA audit is done without any deviation at all levels of its inspection in all pharma companies. Industry Trend CAPA is a very important function, but it does not get sufficient attention because it does not fall under core production processes. FDA reports show that 30%-50% of observations (FDA 483s) are related to CAPA. In Quality Systems Inspection Techniques (QSIT), management function is given importance and made responsible for observations, thereby bringing many CAPA management issues under the management umbrella and reducing CAPA issues, but even the lowest percentages show that CAPA needs to be addressed with greater priority. Figure 1 QSIT Inspections - Graphical Analysis Non-QSIT Inspections QSIT Inspections CAPA: 50 Records: 20 Records: 10 Management: 40 PAPC: 20 PAPC: 30 CAPA: 30

Kamal Biswas Drivers of the Current Situation Pharma Companies View Numerous manual processes required to produce the final product hamper the CAPA process. Managing the parent-child relationship in raw materials across products is challenging. This problem increases many fold in dispersed operations. A proliferation of regulations makes compliance cumbersome, expensive and often confusing if not contradictory. Proposed View The pharma industry s view is correct, but there is justification for another view. While pharma companies highlight operational difficulties as the major reason for CAPA non-compliance, there are many other causes: CAPA is seen in the narrow light of a compliance need, and therefore, is considered as extra work by all except the compliance group. It is not part of core production processes, and therefore is dis-integrated from core operations. It is taken as a point-in-time localized problem, not as part of an enterprise initiative that can bring more focus. CAPA plays a big role in corporate risk. It can radically disrupt businesses, but it does not appear in corporate risk management programs and remains the responsibility of production managers. Figure 2 Complex Compliance Issues Too complex a situation for efficient compliance - multiple regulations, multiple products, multiple locations Location 2 Location 3 FDA LOCATION-1 OSHA Operations Continuous Improvement Purchase Customer Care Quality EHS R&D Field Services Sales Finance ICH Engineering Support HR ITY Legal Marketing Location 5 EPA Location 4

Kamal Biswas DESIGN CAPA WITH A BROADER PERSPECTIVE While CAPA covers remedial corrections of an identified problem, root cause analysis with corrective action to help understand the cause of the deviation and potentially prevent recurrence of a similar problem, and preventive action to avert recurrence of a similar potential problem as part of Quality Systems, it needs to be expanded with a broader outlook and go beyond quality systems into core operational excellence. The following four major steps can make this happen: Make CAPA part of core operations Integrate CAPA review as part of Corporate Risk Management Make it mandatory for all business divisions to participate in and collaborate with the CAPA program Make the CAPA program part of the financial turnaround Make CAPA Part of Core Operations To make CAPA part of core operations, it must, as a system, provide added value to operations. Use it as a productivity improvement tool Utilize the program to increase operational success predictability CAPA Review as Part of Corporate Risk Management Design the CAPA program as part of the corporate mandate. The CAPA program must be seen as a core operation that can put the organization at risk if not properly acted upon. Corporate risk management needs to mandate all CAPA incidents to be reported at the corporate level and must include CAPA incidents as part of performance metrics. They should be as critical as other business performance metrics such as top-line and bottom-line growth. Ineffective CAPA management can truly impact the top- and bottom-lines of companies. Figure 3 Productivity improvement function Early stage detection of problems can improve throughput and make operations more productive. Example: How CAPA can help improve productivity and throughput Reaction Steps Hypothesis Throughput Productivity Step A Step B Step C A B C D 80% yield 80% yield 90% yield If product D fails in final quality check, it needs to be reprocessed that sheds ~20% of Product D. This reduces the overall yield to 46%. CAPA can detect the problem early enough in the reaction lifecycle that will help avoiding the reprocessing-hence the overall yield improved to 58%. Elimination of reprocessing improves the production productivity. Example: How CAPA can help improve product quality

Kamal Biswas Reaction Steps Example: How CAPA can help improve productivity and throughput Step A Step B Step C A B C D 80% yield 80% yield 90% yield If product D fails in final quality check, it needs to be reprocessed that sheds ~20% Figure Hypothesis 4 of Product D. This reduces the overall yield to 46%. Predictability of Occurrence and Impact on SQUIP- Safety, Quality, Identity, and Purity or Potency Throughput CAPA can detect the problem early enough in the reaction lifecycle that will help Use Productivity enterprise CAPA avoiding system the reprocessing-hence to improve predictability the overall yield of improved success, to 58%. both Elimination in terms of of quality and cost reprocessing of the final improves product. the production productivity. Example: How CAPA can help improve product quality Reaction Steps Hypothesis Quality Step A Step B Step C A B C D 80% yield 80% yield 90% yield Due to deviation in process, some of the reaction steps may remain incomplete leading to more impurities in product D. Routine QC checks are designed to test pre-defined tests that may not be enough to detect impurities due to process deviation. A robust CAPA system can find the deviation early to enable appropriate remediation steps. Some of the sample metrics that can be tracked include: Product reprocessing loss CAPA incidents with potential impact on product quality Impact on regulatory commitments Impact on validation status Other product or lots potentially impacted Need for an NDA Field Alert report or recall Pre-defined periodic monitoring of metrics at the Corporate Risk Management Council would surface CAPA trend and loss of productivity. The visibility at top management on the productivity loss could bring more seriousness into the CAPA initiative to make it more successful. Make it Mandatory for all Business Divisions to Participate and Collaborate CAPA programs must be implemented across business functions such as manufacturing, engineering, maintenance, automation, safety, and even research and development. Many functions, such as early stage R&D, do not follow CAPA because they are viewed as compliance functions. But, if CAPA is treated as a mechanism to identify the root causes of failures, it can help R&D functions become more productive; for example: CAPA applies to protocol deviation as well as GCP Note to File investigations and remediation. A robust electronic quality management system would accommodate all GXP, not only cgmp.

Kamal Biswas Make it Part of Financial Turnaround Accountants must report the loss of revenue due to CAPA incidents. This should include direct productivity loss as well as loss of time. FDA regulations do not allow release of a product until all CAPA issues for that batch are closed. This, at times, increases inventory at the manufacturing plant and creates shortage of product supply in the market, thereby reducing cash flow the throughput impact due to rework increases manufacturing cost significantly. These important metrics fortracking the performance of the whole organization can be improved by placing more importance on CAPA. HOW INFORMATION TECHNOLOGY CAN HELP Information Technology (IT) can help pharma companies reduce CAPA incidents and improve quality, while improving productivity by detecting issues very early in production. The Vision Make CAPA a part of core activities and provide a system to execute the program efficiently. The strategy to develop an efficient CAPA program is accomplished by changing the 90%+ corrective action scenario to 90%+ preventive action mode. Information Technology (IT) systems can help achieve this. The System Requirements Well defined requirements specifying the internal and external needs must be covered. They must include the proper handling of quality deviations, process deviations, audit findings, Non Conformance Reports, operational disruptions, change management, quality assurance checks, and customer complaints. It is very important to include all business functions and their processes to monitor and track CAPA incidents. CAPA architecture must be robust to scale enterprise needs. It must also be flexible to accommodate process customization for multiple sites, regions, countries, or regulations. Figure 5 Move from Corrective to Preventive Action Corrective Action Preventive Action Corrective Action Preventive Action

Kamal Biswas Data analysis to help resolve CAPA incidents has to be built into the system to make the system critical enough for operational teams. Create the system keeping in mind a future state of compliance - make it 21 CFR Part 11 compliant. This will help the company in taking a step forward to electronic submissions and Process Analytical Technology (PAT). The Solution A well defined requirement can help in building a system that meets all business needs. Define user requirement specifications and a strong business case to support development of the system. Executive sponsorship is a must for a successful program and early user buy-in makes the program useful. A strong business case and a change management initiative are always useful. Figure 6 Sample Business Case Parameters Process Variables Description Current Future Delta 1. Number of CAPA incidents 5 4 20% 2. Average time spent in looking for documents, templates 25% 5% 20% 3. Average time spent in document handling 10% 0% 10% 4. Average time spent in status trackingmeetings, phone calls 20% 5% 15% 5.......... Benefit Calculation Description Current Future Delta Reduction in CAPA management time 2.80% 0.85% 1.95 Annual Cash Flow Benefit $146,250 10

Kamal Biswas System Features The IT system should be able to continuously monitor data against the standard and create deviation alerts. The system must be able to provide features that dive deep into earlier data and help solve CAPA issues. It must show CAPA status on a real-time basis. CAPA players should be able to manage all actions using the workflow. All required data must be accessible from the systems. Manual collection of data and its upload into the system will reduce its popularity. The system should be self-sufficient to manage CAPA end-to-end. SUCCESS STORY Effective CAPA design can have a major impact in product release cycle time. This has been observed for a major U.S. pharma company. The author was involved in helping them to design, develop, and roll out a product release and CAPA system for their manufacturing unit. The system helps the product release team create a single view of manufacturing artifacts with all CAPA incidents and their status. Key metrics collected to support the company s decision to invest in the CAPA initiative included: 60% reduction in product release time Extensive reduction in CAPA incidents Increased confidence in product release with all re- Figure 7 System Features Interact CAPA Action and Closure Deviation Flag Compare with Standards CAPA Monitoring Analysis Historical data analysis CAPA resolution Knowledge base Failure analysis 11

Kamal Biswas Figure 8 CAPA Management Control Chart Analytics Input System Materials Mgmt Historical Data Analysis MES LIMS Plant Mgmt Deviation Monitoring Data Comparison Create Deviation Notify Regulatory Manager Notify Process Owner Impact Analysis CAPA Tracking Initiate Investigation Review Investigation Report Initiate Root Cause Analysis Define Investigation Workflow Create Action Plan Instruct for Product Containment Notify Investigators Assign Actions Complete Investigation Complete Actions Generate Investigation Report Approve Actions Close CAPA CAPA Status Monitoring CAPA Reporting Document Mgmt Change Control Management 21 CFR Part 11 Compliance Audit Trail 12

Kamal Biswas quired documents compiled and stored online to enable easy retrievability for audits Production database created to analyze historical data and for use as a knowledge base A step toward FDA e-submission The problem was viewed as an end-to-end manufacturing problem and provided a solution not only to reduce compliance issues but also improve operational efficiency. The system has separate CAPA components for R&D and manufacturing to keep the two processes separate. The system is designed to get data from existing applications with a provision for manual entry as well. It has a deviation monitoring component to send alerts to concerned stakeholders and for workflow-driven end-to-end CAPA tracking. CONCLUSION REFERENCES 1. QSIT workshop material on Corrective And Preventive Actions: http://www.fda.gov/cdrh/comp/qsitpage.html 2. Internal Research- Infosys Technologies Ltd: http://www.infosys.com 3. Food and Drug Administration : http://www.fda.gov ABOUT THE AUTHOR Kamal Biswas is with Life Sciences Consulting in Infosys Technologies Limited. Kamal is an expert in Pharma IT strategy and regulatory compliance in FDA regulated industry. He has over a decade experience in pharmaceutical manufacturing operations and IT. He is a thought leader in pharma IT strategy, IT enabled productivity in pharmaceutical manufacturing operations, and regulatory compliance transformation. Kamal is based in New York City /New Jersey, USA, and can be reached at kamal_biswas@infosys.com. Historically, pharma companies have not provided enough attention to CAPA programs and CAPA management. The compliance focus needs to be strengthened by adding CAPA as a part of the core activity. Production team should use this as a productivity improvement function and not just as a compliance need. Making it a key performance indicator for corporate risk management will help in monitoring it more closely. Company finance teams must be more vigilant to this function and must report loss of revenue due to it. Good CAPA management improves compliance and productivity, and also builds the image of a good quality system practices company. This helps in building a brand that drives customer excellence and satisfies regulatory authorities. An enterprise-level CAPA strategy, backed by strong IT system support, can help achieve this. 13

Kamal Biswas CAPA CFR cgmp FDA GCP CGXP IT NDA PAT QSIT QSR R&D Article Acronym Listing Corrective Action Preventive Action Code of Federal Regulations Current Good Manufacturing Practice Food and Drug Administration Good Clinical Practice Current Good Clinical, Laboratory, Manufacturing Practice Information Technology New Drug Application Process Analytical Technology Quality System Inspection Technique Quality System Regulation Research and Development SQUIP Safety, Quality, Identity, Purity/Potency U.S. United States Originally published in the October 2007 issue of The Journal of GXP 14

Corrective Action and Preventive Action (CAPA) in a Laboratory David Drovetta Although the letter of the law may not, strictly speaking, call for a CAPA process in the laboratory, the realistic laboratory professional working in today s economy supplying domestic, European, and other international customers is accustomed to managing corrective and preventive action processes in the course of his or her work. This article discusses the need for integrating CAPA processes in the laboratory. In the world of Good Clinical, Laboratory, and Manufacturing Practices (GXP), CAPA has traditionally been relegated to the halls of manufacturing whether that is drug or device. My first experience with CAPA in a Food and Drug Administration- (FDA) regulated environment was with the change from 1978 Good Manufacturing Practice (GMP) to the Quality System Regulation (QSR) for Medical Devices, 21 Code of Federal Regulations (CFR) Part 820. Specifically 21 CFR 820.100 (a) states, Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The change in the regulations strengthened or clarified what many believed was already required by implication. This implication has been furthered by FDA over the years. For example, in their September 2006 Guidance for Industry Quality Systems Approach to Pharmaceutical CGMP Regulations, reference 21 CFR 211.22 (a) and 211.192, as specific requirements for corrective action and acknowledge no specific requirement for preventive action. However, they do discuss the importance of preventive action in sound quality systems. CAPA is an adopted acronym that evolved from the ISO series of industry standards. Those standards have required both corrective and preventive action throughout their existence. Manufacturers who have been supplying products to European customers have been accustomed to managing comprehensive preventive and corrective action processes for many years. In research laboratories or in clinical laboratories providing data for human studies, the need for a CAPA process, again, is not well defined in regulation. In fact, some may argue it is not a requirement at all. I would agree that review of the regulations will not specifically call out a corrective action process; even guidance documents provided by FDA focus on manufacturing. The Good Laboratory Practice (GLP) regulations, 21 CFR Part 58, are quite clear regarding the requirements for the conduct of nonclinical studies. Reading the regulation will not yield any reference to CAPA or even a requirement for a corrective action system. However, an implied requirement can be read into the responsibility of the QA unit. The following highlights key elements of 21 CFR 58.35 (3) and should demonstrate the need for at least a corrective action process. The QA unit must maintain records showing findings and problems, action recommended and taken to resolve existing problems. Although CAPA may not be delineated as a required process in certain regulations, I am confident that auditors would have concerns if a laboratory would justify the absence of a formal process merely because it is not spelled out specifically in a regulation. Clinical laboratories however are subject to the Clinical Laboratory Improvement Act (CLIA) Title 42 Part 493 and will have in place a corrective action process. The Centers for Medicare & Medicaid Services (CMS) regulate all laboratory testing (except research) performed on humans in the U.S. through CLIA. Stated specifically in 493.1239, General Laboratory Systems Assessment: (a) The laboratory must establish and follow written policies and procedures for an ongoing mechanism to monitor, assess, and, when indicated, correct problems identified in the general laboratory system requirements specified at Sections 493.1231 through 493.1236. (b) The general laboratory systems assessment must in- 15

David Drovetta clude a review of the effectiveness of corrective actions taken to resolve problems, revision of policies and procedures necessary to prevent recurrence of problems, and discussion of general laboratory systems assessment reviews with appropriate staff. Once again the acronym CAPA is not used directly, but the requirement for a systematic approach to corrective and preventive action is quite clear. It is reasonable, therefore, to expect that medical laboratories providing testing services to Clinical Research Organizations (CROs) would have in place fairly comprehensive CAPA processes. Auditors from these organizations often have expectations that laboratories have in place quality systems similar to what may be found in drug or device manufacturing or that are structured around the relevant GXP. In those laboratories which provide testing exclusively for the clinical trials that may be the case. However, for those labs that primarily serve healthcare, the CAPA processes in place will more likely be focussed on patient outcomes. The name of the process may be Event or Occurrence Management rather than Corrective and Preventive Action as one might find in an ISO based system. The auditors should have an expectation that the process for event management will contain all the essential elements of a well-defined CAPA system. They should find a system that insures information is: 1. Captured 2. Investigated 3. Reviewed to identify issues that require improvement measures The system for capture will range from logs to forms to on-line systems depending on the size of the laboratory and its affiliations. Regardless of the complexity of the system of capture, it must be available to all employees and be capable of documenting all the relevant information necessary to investigate the report - the who, what, when, and where of the specific incident. An example might be a Specimen Integrity Log in which the processor or technician would record issues related to the condition of a particular specimen and outcome. Investigation should be documented in a manner that demonstrates the corrective action taken. There should be an indication that remedial action was taken to correct the specific incident as well as an indication that a proper investigation of potential systemic issues took place. There should also be a method of classification of the incident as pre-analytical, analytical, or post analytical. These may not be of particular concern to the auditors or their clients, but they are important to the review by lab management. Using the specimen integrity sample, it would be reasonable to expect the lab to have in place documentation that would address the cause of the integrity issue such as transport or storage conditions, proper collection methods, and some action to prevent recurrence such as a modified courier process or transport packaging. The laboratory may have in place a formal management review process as one may see in an ISO based system or a specific review of event management by lab management. The two key elements that must be present are that: 1. The review occurs at defined intervals 2. The review looks for and identifies trends and takes appropriate action Again with respect to specimen integrity, there should be some overall analysis that would include trending, Pareto of causes, comparison to other labs in the system, etc. Finally, an expectation that internal audit findings are part of the CAPA process is reasonable, including some level of comparison of audit results to the findings of event management as a means of providing further investigation into systemic issues that may be identified. Those laboratories that do not typically support clinical or GLP studies may not have a traditional, internal audit process in place. Laboratories who have modeled their systems after the Clinical and Laboratory Standards Institute Quality System Essentials will have a process for independent system review similar to an ISO based internal audit process. All labs should have some process for self-inspection and management should review the results of those inspections. The College of American Pathologists, an organization, which provides accreditation of labs through inspection to the requirements of CLIA, states, The laboratory must have a documented quality manage ment program to systematically ensure the quality of laboratory services. CROs and study sponsors as well have an obligation to ensure that laboratories used to provide test data have quality management systems in place to provide that same assurance. A comprehensive and effective CAPA process, however it may be named or managed, is a necessary key component of that system. 16

David Drovetta REFERENCES 1. FDA 21CFR 820.100 Quality System Regulations; Subchapter H- Medical Devices, Subpart J - CAPA, rev April 1, 2007, FDA website: http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/ CFRSearch.cfm?CFRPart=820&showFR=1 2. FDA 21CFR 211.192 Drugs - General; CGMP for Finished Pharmaceuticals, Subpart J - Records and Reports: Production Record Review, rev April 1, 2007, FDA website: http://www.accessdata. fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?fr=211.192 3. FDA 21CFR 211.22 Drugs-General; CGMP for Finished Pharmaceuticals, Subpart B - Organization and Personnel: Responsibilities of Quality Control Unit, rev April 1, 2007, FDA website: http:// www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/ CFRSearch.cfm?fr=211.22 4. FDA 21 CFR Part 58 Good Laboratory Practices for Non-Clinical Laboratory Studies, rev April 1, 2007 FDA website: http://www. accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch. cfm?cfrpart=58 5. FDA Clinical Laboratory Improvement Act Title 42 Part 493 DHHS Sept 1995. GXP ARTICLE ACRONYM LIST CAPA Corrective and Preventive Action CFR Code of Federal Regulations CGMP Current Good Manufacturing Practice CLIA CMS CRO FDA GLP GXP ISO QA Clinical Laboratory Improvement Act Centers for Medicare & Medicaid Services Clinical Research Organization Food and Drug Administration Good Laboratory Practice Good Clinical, Laboratory, Manufacturing Practice International Organization for Standardization Quality Assurance ABOUT THE AUTHOR David Drovetta is the Director of Quality Systems for Physicians Reference Laboratory of Overland Park, Kansas. Mr. Drovetta has over 25 years experience in quality and manufacturing for regulated industry. Originally published in the January 2008 issue of The Journal of GXP 17

What Companies Should Know And Consider When Designing A CAPA System PART I By Gabriela Bodea INTRODUCTION Corrective and Preventive Action (CAPA), as a subsystem, integrates all quality subsystems, thereby closing a quality loop. CAPA represents one of the mechanisms that ensures continuous improvement within an organization; along with customer satisfaction measurements, internal audits, trend recording, and non-conforming product control. Once the targeted performance is reached, new performance criteria are set to realize continuous improvement and ever more focused quality. In this way, CAPA actualizes the philosophy of the spiral helix depicted by the International Organization for Standardization (ISO) 9001: 2000. A CAPA program is established to serve as an uninterrupted element for the improvement of product, process, and quality systems. Think of it as a quality improvement vehicle that operates as a two-loop system a reactive loop and a proactive loop. With the Food and Drug Administration s (FDA) new systemic audit inspection approach and its emphasis on risk-based management, utilizing a CAPA program must be proactive. The following points are business baseline requirements for any CAPA system. Journal of GXP Compliance WHY IMPLEMENT A CAPA SYSTEM? Implementing an effective, smoothly functioning corrective and preventive action system is important because CAPA: Is a regulatory requirement of the U.S. FDA Quality System (QS) regulation. Is a requirement of ISO 9001: 2000 and ISO 17025. Represents a quality improvement tool. To avoid non-conformities in regulated areas and their repercussions, but more importantly to ensure product safety and consistency, companies should embrace a CAPA system. This will ensure customer satisfaction by correcting existing problems or by implementing controls to prevent potential problems from occurring, both of which are key for continuous customer satisfaction. Ultimately, establishing and implementing a well thought out CAPA system represents good business practice. Regulatory Requirements CAPA is an area of interest for both the FDA and ISO 9000 and for everyone concerned with quality. CAPA is not restricted to QS regulations or to the Quality System Inspection Technique (QSIT) Guide. The ability to correct existing problems and to implement controls to prevent potential problems from occurring is essential for sustained customer satisfaction and effective business practice. 18

Gabriela Bodea CFR 820, Subpart J Corrective and Preventive Action, 820.100, 1 states: (a) Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for: (1) Analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, or other quality problems. Appropriate statistical methodology shall be employed where necessary to detect recurring quality problems; (2) Investigating the cause of nonconformities relating to product, processes, and the quality system; (3) Identifying the action(s) needed to correct and prevent recurrence of nonconforming product and other quality problems; (4) Verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device; (5) Implementing and recording changes in methods and procedures needed to correct and prevent identified quality problems; (6) Ensuring that information related to quality problems or nonconforming product is disseminated to those directly responsible for assuring the quality of such product or the prevention of such problems; and (7) Submitting relevant information on identified quality problems, as well as corrective and preventive actions, for management review. (b) All activities required under this section, and their results, shall be documented. FDA Guidance The FDA s Guide to Inspections of Quality Systems, 2 August 1999, lists CAPA as one of the seven areas for compliance review. Under the chapter dedicated to CAPA, the Purpose and Importance section states: The purpose of the corrective and preventive action subsystem is to collect information, analyze information, identify and investigate product and quality problems, and take appropriate and effective corrective and/or preventive action to prevent their recurrence. Verifying or validating corrective and preventive actions, communicating corrective and preventive action activities to responsible people, providing relevant information for management review, and documenting these activities are essential in dealing effectively with product and quality problems, preventing their recurrence, and preventing or minimizing device failures. One of the most important quality system elements is the corrective and preventive action subsystem. While FDA s QSIT has included the requirement for CAPA since 1996, still today the drug Good Manufacturing Practices (GMPs) (21 Code of Federal Regulations (CFR) Parts 210 and 211) do not spell out this requirement. The main reason for this omission is not that FDA believes such a requirement would not be useful; it is more that the current version of the drug GMPs was released in 1980 without any major revision thereafter. However, in the proposed amendment of 1996, the requirement was included. It is also being included in the new draft guide, Quality Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations (cgmp), 3 released by FDA for comment in September 2004. Section D Evaluation Activities, describes CAPA as: A key component in any quality system handling nonconformities or deviations. The investigation, conclusion, and follow-up should be documented. The FDA expects corrective actions, which are the follow-up required in CFR 211.192. An employee may detect discrepancies during any stage of the process or during quality control activities. The establishment of a discrepancy investigation process becomes critical when a discrepancy is found that affects product quality. (cgmp also requires this; see 211.192.) 19

Gabriela Bodea Corrective action is a reactive tool for system improvement ensuring that significant problems do not recur. Both quality systems and the cgmp regulations emphasize corrective action. Quality system approaches call for procedures to be developed and documented that ensure that the need for action is evaluated relative to the possible consequences, that is, the root cause of the problem is investigated, possible actions are determined, a selected action is taken within a defined timeframe, and the effectiveness of the action taken is evaluated. It is essential to maintain records of corrective actions taken. (See 211.192.) Regulatory Consequences FDA Warning Letters (WLs) are frequently issued because companies do not have an implemented CAPA program or do not follow the existing system. CAPA non-compliance is among the top three reasons for FDA citations. The following are excerpts from FDA-483 observation reports published in the newsletter, GMP Trends, 4 that illustrate frequently cited CAPA related non-compliance. Laboratory Controls Corrective actions you committed to in your response to the FDA-483 issued concerning data maintenance and security in laboratory instruments have not been completed. For example, you committed to assess other critical instrumentation, and that individual action plans will be developed as appropriate. However, your laboratory does not maintain the raw data obtained from your laboratory equipment. These systems have not been assessed and you have not developed the individual action plans necessary to bring these systems into compliance. Manufacturing Controls The investigations related to microbial contamination detected in several samples from the capsule manufacturing areas did not address adequately the source of the contamination and the corrective actions necessary to prevent recurrence. Pathogenic organisms and coliforms have been detected in nine different instances in manufacturing equipment, rinse water and the environment. The investigations are inconclusive regarding the source of the contamination, with sample handling listed in five of the nine instances as the possible cause of the Out-of-Specification (OOS) results. Active Pharmaceutical Ingredients In the manufacture of Active Pharmaceutical Ingredients (API s), the firm failed to maintain/replace deteriorated manufacturing process equipment, reactor trains and piping at appropriate intervals to prevent malfunctions or contamination that would alter the safety, identity, strength, quality or purity beyond the official or established requirements. For example: a. The firm s short-term corrective actions, such as increased manufacturing equipment maintenance and repair, and increased visual inspection of the drug product, have not corrected the problem. Inspectional review of the most recent batch of revealed that many black specks and flakes were detected in the intermediate crude. Manufacturing Deviation Report (MDR) identified the problem as another condenser failure. b. The firm concluded in Manufacturing Deviation Report (MDR) that long-term corrective actions would require replacement of entire reactor trains and condensers. Condensers were identified as the major source for particle shedding. Condensers are currently used in several of the reactor trains, which are used to manufacture at least sixteen different API s, including eight API s sold for use in parenterals. ISO/IEC 17025 The ISO/International Electrotechnical Commission (IEC) standard, General Requirements for the Competence of Testing and Calibration Laboratories, 5 has several sections on corrective and preventive actions, for example, section 4.10.1 states: The laboratory shall establish a policy and procedure 20

Gabriela Bodea and shall designate appropriate authorities for implementing corrective action when nonconforming work or departures from the policies and procedures in the quality system or technical operations have been identified. The standard also suggests that a root cause analysis of the problem be determined. The procedure for corrective action shall start with an investigation to determine the root cause(s) of the problem. The need for preventive actions is stated in section 4.11.1: Action plans shall be developed, implemented, and monitored to reduce the likelihood of the occurrence of non-conformances and to take advantage of opportunities for improvements. CAPA as a Tool for Continuous Improvement CAPA is a fundamental management tool that should be used by everybody for on-going quality improvement. The program provides the process for implementing, evaluating, and documenting corrective or preventive actions. The result of the effort should be a well-documented investigation and solution to quality problems that will satisfy not only regulatory requirements, but also will form the basis for effective, continuous improvement. POTENTIAL SOURCES OF QUALITY PROBLEMS Each company must decide on the quality problems to be included in a CAPA program. Creating general criteria for screening quality problems would facilitate correct decision-making parameters for considering the initiation of a CAPA process. Quality records represent the primary inputs to any CAPA subsystem. Records retain information after the fact. An early step in designing a CAPA system is the identification of the key suppliers to the system. All quality systems have some quality subsystems. The subsystems encompass activities from the satellite supplier to the CAPA system. For instance, think about API manufacturing companies. At a system level, a CAPA sub-system must include the following satellite suppliers as defined by the noted sections of the International Conference on Harmonization (ICH) Q7A: 2 Quality Management 3 Personnel 4 Buildings and Facilities 5 Process Equipment 7 Materials Management 8 Production and In-Process Controls 9 Packaging and Identification, Labeling of APIs and Intermediates 10 Storage and Distribution 11 Laboratory Controls 12 Validation 13 Change Control 14 Rejection and Reuse of Materials 15 Complaints and Recalls 16 Contract Manufacturers (including Laboratories) Data Quality data that typically require a CAPA process could be classified according to the source origin, in two categories: internal data and external data. Internal data This group comprises corrective action items gleaned from: Information resulted from self inspections (internal audits) Internally identified problems: Quality Control (QC) generated data related to raw materials, intermediates, and finished product quality (e.g. OOS results, trends) Data related to process and product (deviations, reworked batches, non-conforming product, validation) Training records Change control data Management reviews Observations by employees Statistical Process Control (SPC) charts Trends charts (Pareto or Run charts) and 21

Gabriela Bodea periodical reports Equipment maintenance reports Equipment calibration record Supplier assessment reports For the preventive loop, inputs could also include: Engineering change requests and engineering change notes Deviation requests Change requests Risk management records (Pharmaceutical Failure Mode and Effects Analysis (PFMEA), Device Failure Mode and Effects Analysis (DFMEA), or Fault Tree Analysis (FTA) Process run charts, process capability index data (CpK or Cp), other SPCs External data This group comprises: Information resulted from external audits (audit and non-conformity reports issued by regulatory authorities or customers) Complaints, returned products, customer feedback WHERE DOES CAPA START? Once the source of quality problems and the corresponding systems that manage those problems are identified, the next question is where do the quality systems that feed into CAPA end, and where does CAPA start? Looking again at the potential inputs for a CAPA program listed in the previous section, in most cases, the quality problems are documented in the corresponding systems on specific forms, e.g.: audit findings on Non Conformance Reports (NCRs) or audit reports, OOS results onto OOS investigation reports, change requests onto change request forms, training records on specific training forms, trends as statistical interpretation, etc. After the assessment of the issue, there are two possible situations: 1) no further actions are necessary or 2) further activities are required to help identify corrective actions to prevent recurrence. In the first case, the conclusion of the final report will clearly state that no follow-up (CAPA) is needed. In the second scenario, root cause analysis, corrective actions or preventive actions, and effectiveness assessment are indicated. For instance, the final audit report identifies nonconformities and not only observations. The responsible department affected by the quality issues would conduct an in-depth failure investigation based on risk assessment to determine whether the problem(s) is systemic: to implement efficient measures meant to correct problems with immediate corrective action, to correct in order to prevent repetition by way of corrective action, or to prevent the occurrence of potential problems by way of preventive action. Correction of nonconformities must be followed by indepth investigation to prevent recurrence. Here starts CAPA. A Corrective/Preventive Action Request (C/PAR) marks the beginning of CAPA. 6 Risk assessment and root cause analysis, as part of the investigation, will enable the identification of corrective or preventive actions that succeed in addressing the actual problem rather than merely its symptoms. ATTRIBUTES OF A GOOD CAPA PROGRAM A CAPA program should be SMARTER: specific, measurable, attainable, results-oriented, time-based, evaluated, and reviewed. All seven attributes of a SMARTER program are equally important. If performance criteria and established metrics (measurable actions) do not exist for analysis and monitoring, program effectiveness cannot be evaluated. The purpose of this section is to present some of a CAPA program s attributes from the perspective of personal experience, recommending as excellent complementary reading, the article 7 by Larry Nold, published in the Journal of GXP Compliance, presenting his views regarding a SMART CAPA. Prevention A successful quality system could be described as a well-coordinated mechanism that functions as a unique organism: the more complex the quality system, the more difficult it may be to reach the goal. An ideal CAPA program should prevent the identified problem from ever recurring. In practice, things are more problematical and companies may have limited choices when the correction of a quality problem involves financial resources that the company cannot afford. One choice is to keep the problem under control without eliminating it completely, 22

Gabriela Bodea for instance, by increasing the frequency of testing, establishing and following a more stringent monitoring program, etc., all of which help to avoid extreme solutions, such as failing to do anything or spending large sums of money that would end in company closure. This type of choice makes the design of an attainable (reasonably feasible and at the same time, efficient) CAPA program so important. Timing Why is timing important? Timeliness is required for every other quality system not only for CAPA systems. A good CAPA program integrates all other quality subsystems. The output of quality problem management (deviations, OOS results, complaints, returned goods, trends, etc, as presented in an earlier section) is input for CAPA, the subsystem meant to ensure in-depth insight into the addressed problem and correct the root cause to prevent repetition. The output of CAPA opens doors for improvements. Moreover, from a documentation perspective, setting deadlines for each component of CAPA ensures an organized flow of data, avoiding disturbances at all levels of the quality system. For example, if there is a delay in completing CAPA for assessed out-of-trend results, the information may not be available in time for the issuance of the stability report, for periodical review by management, and finally, for inclusion in the Annual Product Review (APR). A postponement could also have undesirable impact on a regulatory submission or on the issuance of responses to a Regulatory Body observation regarding filing documentation. Review and Evaluation Considering CAPA a subsystem that realizes a closed loop means that all steps are defined and followed to ensure CAPA completion and that, at the end, top management evaluates and reviews the outputs of the CAPA subsystem: evaluation after implementation to determine effectiveness, and periodical review to determine the status of the company s quality system and potential improvement opportunities. The quality loop cannot be considered closed until the CAPA program is reviewed and its effectiveness verified and monitored. ASSIGNING RESPONSIBILITY FOR IMPLEMENTING THE CAPA PROGRAM The pharmaceutical industry is dynamic and demanding, requiring top management commitment to continuous improvement ensuring the efficient manufacture of safe products in conformity with the CGMP regulations and related guidelines and guidance. Essential in a CAPA program is management commitment and team building. The responsibility for the CAPA program is shared among executive managers (organized as a Quality Council or Quality Steering Committee), the Management Representative (MR), process owners, and the CAPA team. Senior Management Senior management (executive or C level management) is the first line called to take the initiative and set healthy bases for company quality systems. A top-down approach to quality systems or subsystems generally guarantees a good start. As a Quality Manager, how do you convince company management of the validity of such a point? In the draft guidance, released for comment on September 2004 Quality Systems Approach to Pharmaceutical Current Good Manufacturing Practice Regulations, Chapter IV. A - Management Responsibilities - emphasizes well known and recognized management principles and clearly shows the FDA s current view on executive management level involvement in the matter: In a robust, modern quality system, senior management demonstrates commitment to developing and maintaining their quality system. There is no doubt that management of pharmaceutical companies must commit to quality and, moreover, provide leadership. Obtaining Commitment It is not easy to obtain management commitment to the implementation of a new quality system and from a manager s perspective, questioning the appropriateness of a new subsystem like CAPA, is legitimate. Such a project involves additional resources, money, etc. But terms such as, efficiency, cost reduction, complaint reduction, and customer satisfaction increase, catch the attention of any manager. Compliance managers must be persuasive and make effective use of these arguments. First of all, the Compliance Manager must make it clear to management that quality systems are not a burden or merely a compliance requirement. To the contrary, these 23