Although not specifically

Change Control: Seven Pharmaceutical Manufacturers Share Their Experiences Individuals from seven different pharmaceutical companies met to discuss change in the pharmaceutical industry, what a change control system is, and why a change control system is needed by Nellie Waterland, Matthew Shapiro, Charles Douty, ArDen Grice-DuBose, Sophia McKinley, Gerri Thrasher and Marissa Ulmer Although not specifically required by current regulations (Title 21 CFR Parts 210 and 211), written change control procedures in the pharmaceutical industry are current Good Manufacturing Practices (cgmps). Individuals from seven different pharmaceutical companies met to discuss change in the pharmaceutical industry, what a change control system is, and why a change control system is needed. They then discussed similarities and differences in their companies systems, looked at problems experienced by their companies change control systems, and investigated possible solutions to these problems. Introduction In the pharmaceutical industry, change can be defined as a modification to documentation, equipment, packaging, utilities, facilities, formulations, processes, or computer systems. This change may or may not impact the safety, quality, purity, or potency of a product throughout its shelf life. A change is also a deviation from what is contained in an approved marketing application or filing. In short, a change is any variation that may impact consistent product quality. In any of these definitions, the change may be temporary or permanent. To ensure that a change has no deleterious impact on product safety, quality, purity, or potency throughout the shelf-life period and/or does not impact the marketing applications, the pharmaceutical industry has developed written change control procedures which may be company or site specific. These change control procedures are part of a proactive management system that involves multiple disciplines. Ownership of each step in the system is identified, and in some instances, different procedures are implemented for different types of changes. It should be noted, that though written change control procedures are Special Edition: Change Control 43

not specifically required in the FDA s current cgmps found in 21 CFR 210 and 211, these regulations do imply the need for written procedures. Written change control procedures are necessary to prevent inappropriate changes from occurring. Inappropriate changes are those made without complete review and approval of the quality unit and any other department or division that may be impacted by the change. These procedures ensure consistency in the products manufactured and allow for appropriate review and approval of any and all possible changes. A written change control procedure will also ensure that all required testing is completed prior to or shortly after the change is made. In addition, these procedures ensure that all relevant persons, departments, and contractors (where applicable) are made aware of, have access to, and are adequately trained according to the change. Change control procedures also ensure documentation supporting the change is maintained and easily retrievable. Similarities and Differences Of the seven pharmaceutical companies represented, there were several similarities within the represented companies change control procedures. For example, all procedures listed a change originator or initiator. This individual initiates the change control process and may or may not champion the change through the process. All companies also had one or more change request forms and a change control committee or change control board. The change control committee may be centrally located at the company s headquarters, or there may be a separate change control committee located at each manufacturing site. The procedures listed a change tracking system to ensure change documentation could be retrieved should a question arise and had some system of listing necessary requirements and supporting data for the change. All seven systems also had review and approval processes for the proposed changes and provisions for filing the change with the appropriate regulatory authorities, delaying the implementation of the change until the Changes Being Effected date, or, if applicable, receipt of approval. The final major similarity between the seven change control systems was the allowance for training, both in the companies change control procedure and the change itself. The major differences between the seven change control systems were also discussed. The first major difference was the role of the change administrator and whether this individual represented Quality Assurance, Manufacturing, or Engineering. According to cgmps, the quality unit should review and approve all changes; therefore, it was determined in our discussion that the quality unit should administer the change control process. The second major difference was the activity of the change initiator or originator. In some companies, this individual merely identified the change and initiated the process, leaving another individual or individuals to carry the change through to implementation. In other companies, the initiator was assigned the responsibility of initiating the change in the company s change control procedure and ensuring that the change proceeded through the process to implementation. In this system, the assigned initiator may or may not be the originator of the initial preliminary proposal. The proposed change may have been identified by another individual in the initiator s department or by an individual in a different department. The third major difference discussed was the classification of changes. Some of the companies represented did not classify changes. All changes went through the same process. Other companies classified the proposed changes as high- or lowlevel changes. Still other companies classified them as high-, medium-, or low-level changes. In the classification systems, the level of change indicated the probability or likelihood that the proposed change could impact the product. High-level changes were very likely to impact the product, medium-level changes were somewhat likely to impact the product, and low-level changes were anticipated to have no or a negligible impact on the product. In one company, the highest level of change was assigned only if some type of regulatory filing was required, delaying implementation until the Changes Being Effected date or until receipt of approval. The fourth difference was whether a time line was incorporated into the change plan. This time line is useful for high- and medium-level changes, allowing all parties to anticipate major milestones in the change process. Furthermore, if the anticipated implementation date is included in the plan, reviewers and approvers can determine if there are major obstacles (such as delays due to the necessity of regulatory agency approvals) to meeting this date. The inclusion of a provision for emergency changes was the fifth difference noted. This pro- 44 Institute of Validation Technology

vides for low-level changes to take place immediately, with review and approval to follow within a period of a few days. To implement this provision, a definition of what can be considered an emergency change, along with requirements for quarantining the lot or lots manufactured with the change (pending approval of the change within the company change control procedure), must be included in the change control SOP. It should be noted that change control proceedings for emergency changes are typically considered high priority. The last major difference discussed was the different compositions of the change control committee, including who must be present in the review and approval process, and if meetings are held, who must be present to hold a change control committee meeting. There was unanimous consent that Quality, Manufacturing, Regulatory Affairs, and Engineering must be members of the root change control committee. Other committee members suggested including Marketing and Legal. As stated earlier, each change may require other functional departments, depending upon each individual change. In the current GMPs, 21 CFR 211.100 requires review and approval of written procedures for production and process control, including any changes, by the appropriate organizational units and reviewed and approved by the quality control unit. Figure 1 gives a snapshot of what departments a change control committee should contain. In some instances, departments not regulated under cgmps may be asked to participate in the change control committee to assist in the change control decisions for a particular change if their input is anticipated. Other Functional Groups Involved Depending Upon The Change Figure 1 should be expanded or revised according to the specifics of the company or manufacturing site using the written change control procedure. Change Control Problems Observed and Possible Solutions Timing: The first problem encountered with any change control system is timing. Timing problems, for the most part, may be broken down into three separate problems: Figure 1 Functional Groups Involved in Change Control Technical Services Quality Control Laboratory Toxicology/Safety Assessment Biopharmaceutics Marketing and Sales Quality Regulatory Affairs Root Change Control Committee Labeling Stability Purchasing Manufacturing Engineering Packaging Quality Assurance Medical/Clinical Affairs Pharmacy R&D Drug Metabolism Package Engineering Special Edition: Change Control 45

❶ Changes requiring different levels of priority and urgency ❷ Turn-around time for changes (from request to review to implementation to notification of implementation) ❸ Generation of sufficient supporting data in a timely manner Possible solutions for these three sub-problems include: ❶ Provisions for different levels of priority in the change control procedure, including a provision for actual emergency changes (criteria defining an emergency change should also be included). In the companies represented in our discussion, the low-level changes covered changes such as like-for-like changes and many changes required by preventative maintenance. For a low-level change, the level of review was lower and didn t require review by the change control committee. After appropriate sign-off by individuals representing areas impacted by the change (usually simultaneously), the responsible Quality individual gives the documentation a final review and signs the change form. The change may be implemented, and the change documentation is filed. Again, as stated earlier, if different types of emergency changes are listed up front in the written procedure, these changes may be made (even if the change is necessary at 2:00 am) with the documentation being completed after the change is made. Emergency changes may be made only if the documentation is completed and filed, including the quality unit s approval, within a limited time, as the finished product cannot be released until the documentation is completed and the change has been signed off by the appropriate Quality representative. Procedures covering emergency changes must provide for a mechanism delaying batch release until the change is approved and signed off by the quality unit. ❷ The presence of appropriate management support to ensure review and approval is performed in a timely fashion (ensuring the reviewers and approvers have adequate time in their schedules to conduct the review and approval properly). In our discussions, it was very apparent that many of the pharmaceutical companies represented experienced delays in the implementation of proposed changes due to insufficient management support of timely reviews of change documents. Individuals have too many priorities, and when pushed, lower-level priorities are delayed. There was a consensus that if timely review of change control documentation was included as part of each individual s perfor- Figure 2 Equipment Parenteral Manufacturing Sample Test Matrix IQ/OQ/PQ Validation Chemistry Functionality Cleaning Calibration Change Revalidation Testing Testing Validation Request Form New X X X X X X Repairs X X X (like for like) Modifications X X X X X Solid Oral Manufacturing New X X X X X X Repairs (like for like) Modifications 46 Institute of Validation Technology

mance discussions, there would be an increase in change control documentation being reviewed in a timely manner, resulting in quicker implementation of changes. ❸ A listing or matrix of what would be enough data for a list of frequent change types. This table would list the types of frequently made changes and the tests and documentation that should accompany each change (see example in Figure 2). The content of this table, when included in your company s change control procedure, should be modified and extended based on your company s equipment, processes, and situation. It should be noted, though, that any one of the reviewers or approvers can request additional testing, data, and/or documentation for any change being reviewed. If the same request is made frequently, the requested item should be added to your company s matrix. Many of the items in this matrix can be determined by reviewing each process s validation documentation and, if applicable, the validation master plan. Though the Quality and Manufacturing groups should create this matrix, your company s Regulatory Affairs group should be consulted to ensure any necessary filing requirements are included in addition to those items required by cgmps. These requirements may be listed in existing regulations and guidance documents, such as the Scale-Up And Post-Approval Changes (SUPAC) guidances. Although SUPAC should be consulted, it should be noted that not all requirements for a change will be listed in these guidances. Your company s functional groups should provide a complete list of the required testing and documentation required for each change. The SUPAC guidances do not replace validation and qualification of each change. Communication: The second frequently seen problem with change control systems is communication. Problems with communication may be broken down into four major sub-problems: ❶ Lack of communication between departments ❷ Lack of follow-up on emergency changes, deviation requests, or unplanned changes (such as equipment breakdown requiring replacement or modification) ❸ Changes made by suppliers without proper and timely notification ❹ Changes implemented without proper notification to the persons who are affected by the change As a method to improve communication between departments, a periodic (usually weekly) change committee or change control board meeting is extremely helpful. This meeting should bring together the initiator of the change and responsible individuals from all departments affected by the change. Proposed changes are discussed and are either approved as presented, approved with modifications to the plans, or not approved. In the case where multiple levels of change are defined in the procedure, all changes except the lower level changes (with negligible impact on the product) would be discussed. Again, there must be controls in your procedure to prevent release of lots manufactured with changes that are not yet approved according to the appropriate change control procedure. To ensure that follow-up is completed for emergency changes, deviation requests, or unplanned changes, it is recommended that all change requirements are completed prior to the change being filed as complete and prior to the release of any affected batches. Although cgmps require this type of documentation prior to batch release, this is sometimes overlooked in the urgency to meet an order. Once the batch is released, the completion of necessary change requirements is often given a lower priority and frequently not completed. Such an oversight should not be ignored, as your company s first priority is patient safety and quality, not shipping the product out the door. Unreported changes made by suppliers are often the most difficult to handle, as the supplier is not automatically subject to your company s policies, procedures, and culture. With most suppliers, this can be overcome with training them on your company s change control policies, cgmps, and, if applicable, DMF regulations. In addition, you should periodically conduct audits of your suppliers, which should include a review of their change control procedure and their adherence to it. Your contract should also contain a signed quality agreement, stating that the supplier agrees to follow your company s change control policies and any other quality-related policies necessary to ensure proposed changes are reported to you in a timely manner. (The time required is dependent upon the change Special Edition: Change Control 47

being made; however, this should take into account possible regulatory filings, and thus this notification should be made to you as soon as the proposed change is being seriously considered by the vendor). In this agreement, expectations and responsibilities of the contractor for change control are listed, including the responsibility of informing your company of any changes proposed. If these measures do not give satisfactory results, an alternative supplier should be pursued. Changes implemented without proper notification can be remedied through proper and routine training of initiators on your company s change control procedures and proper completion of the change control form. This should be required training for all personnel who may be appointed as an initiator for changes that fall under the change control umbrella. Training: There were two major problems in the area of training. The first was not keeping SOPs current with actual practices as changes are made to those practices. The second problem consisted of changes being made without proper training given to the operators regarding the change. In order to remedy this situation, a policy or SOP needs to be implemented that requires a periodic review of all SOPs, along with a requirement for training for all procedural changes made to SOPs. In addition, there should be mandatory training in both the change control process and for appropriate job functions as they are affected by the change. Including an area on your change control form asking if other documents are affected by the proposed change is also helpful in assuring that all SOPs are kept up-to-date as changes are made. Data: Most proposed changes require some sort of data to support them. Problems arise when the data provided is not sufficient to support the change, i.e., when proper testing and validation has not been conducted. These problems can be remedied by communicating all aspects of the change, such as in a meeting of the change committee, when the change is in the proposal stage. The data and testing requirements for the change can be documented; test protocols can be attached to the change documentation, listing tests, and acceptance criteria; and any necessary training can also be listed. In addition, the test matrix can be consulted for frequent change types (see Figure 2). Again, in addition to your company s Quality unit, your Regulatory Affairs group should review all applicable regulations and guidance documents (such as SUPAC guidance documents) to ensure that all requirements are being met. Documentation: There were many problems discussed regarding documentation and change control. The most frequently occurring problems were: Insufficient documentation Keeping the necessary documentation up-todate (including revision history) Filing strategy decision framework Lack of adequate review by Regulatory Affairs to develop a filing strategy Lack of involvement by Regulatory Affairs resulting in variances between the data developed and the data necessary for submission These problems may be solved by developing procedures that provide more detail regarding the documentation necessary to support each change, including determining a record retention period sufficient to answer any questions the FDA or other regulatory agencies may ask many years after the change is made. Maintaining these records until expiration of the first batch manufactured after the change is not sufficient. These change records need to be maintained for the life of the manufacturing process. It is important to note that record retention is an area strictly governed by cgmps. To ensure documentation necessary for filing is available, Regulatory Affairs should be an active member of the Change Committee. When changes are proposed, Regulatory Affairs should be consulted (preferably in writing) regarding the type of filing necessary in each country in which the product is marketed and what documentation will be necessary in the submissions to support the change. Of course, this assumes strong Regulatory Affairs management buy-in that this participation is necessary. A few of the companies represented in our discussions only obtained this buy-in after one or more major changes were made without a documented and signed Regulatory Affairs opinion regarding filing strategy and necessary documentation. This oversight resulted in the change being delayed or rejected due to the amount of testing (and resulting documentation) needed for the regulatory filing. This testing was sometimes duplicative 48 Institute of Validation Technology

of testing previously performed; however, tests or time-points were not performed, resulting in the need for the testing to be repeated. Interrelationships: There are very few people in any pharmaceutical company who know everything about every manufacturing process and regulatory impact. Consequently, identification of the essential parties that need to be involved with the change, including review and approval of the change, needs to be thorough. To assist with this, a flow chart of a typical change process should be included in your change control procedure. Also included should be a list of the essential people (including Regulatory Affairs for all but low-level changes) responsible for reviewing and approving a change. Again, refer to Figure 1 to determine the make-up of a Change Control Committee. Documentation, and above all, Cooperation. All of these items must be present for any change control process to function smoothly. Pharmaceutical companies must ensure that their products maintain the safety, quality, purity, and potency purported on the label through the product s shelf life. Any change in this process may impact these necessary characteristics and thus must be investigated fully prior to the change being made and properly reported to the appropriate regulatory agencies either before or after the change is made, depending on the type of change. Suggestions pertaining to various aspects of a pharmaceutical company s change control process have been discussed in the text here. It is left to you to decide which methods are best for your company. Conclusion Along with quality leadership or at least strong involvement, there are five essential, critical toquality parts of any pharmaceutical change control process. These consist of Training, Communication, early and continual Regulatory involvement, Your Key To New FDA Compliance Information And Validation Content ivthome.com www.ivthome.com www.ivthome.com Special Edition: Change Control 49