Regulatory Updates Including Method Validation, Convergence of GAMP & USP <1058>, Data Integrity & Paper versus Electronic Raw Data

Regulatory Updates Including Method Validation, Convergence of GAMP & USP <1058>, Data Integrity & Paper versus Electronic Raw Data Bob McDowall McDowall Consulting McDowall Consulting 2014 www.rdmcdowall.com 1

Contents McDowall Consulting 2014 www.rdmcdowall.com 2

EU GMP Current Status http://ec.europa.eu/health/documents/eudralex/vol-4/index_en.htm McDowall Consulting 2014 www.rdmcdowall.com 3

Laboratory Regulatory Updates Impact of ICH Q10: Pharmaceutical Quality Systems EU GMP Chapter 1: PQS, effective Jan 2013 ISO 9000 QMS: move from reactive to proactive active approach Senior management responsible for QMS & GMP Continual improvement Outsourcing: CMOs and contract labs: EU GMP Chapter 7 on Outsourcing, effective Jan 2013 Draft FDA guidance on Quality Agreements, May 2013 specific discussion on contract labs See Focus on Quality September 2013 McDowall Consulting 2014 www.rdmcdowall.com 4

EU GMP Annex 15: Qualification & Validation Draft Annex 15 released for discussion February 2014 Main topics: Validation Master Plan Equipment Qualification Process Validation McDowall Consulting 2014 www.rdmcdowall.com 5

Welcome to the 21 st Century! EU GMP non - compliance reports are now available on-line: Summary reports from all European regulatory agencies http://eudragmdp.ema.europa.eu/inspections/ gmpc/searchgmpnoncompliance.do McDowall Consulting 2014 www.rdmcdowall.com 6

Regulatory Update for Laboratories Data integrity inspection issues CPG 7346.832 Pre-approval inspections effective May 2012 FDA Inspector data integrity training 2011 2012 MHRA expectation for internal audits Dec 2013 McDowall Consulting 2014 www.rdmcdowall.com 8

CPG Objective 3: Data Integrity Audit Audit the raw data, hardcopy or electronic, to authenticate the data submitted in the CMC section of the application. Verify that all relevant data (e.g., stability, biobatch data) were submitted in the CMC section such that CDER product reviewers can rely on the submitted data as complete and accurate. Generally, data on finished product stability, dissolution, content uniformity, and API impurity are good candidates for this audit (page 20 of 35) McDowall Consulting 2014 www.rdmcdowall.com 9

Inspector Training in Data Integrity FDA are training their inspectors to investigate data integrity: Compare raw data, hardcopy or electronic, such as chromatograms, spectrograms, laboratory analyst notebooks, and additional information from the laboratory with summary data filed in the CMC section. Raw data files should support a conclusion that the data/information in the application is complete. Lack of contextual integrity include the failure by the applicant to scientifically justify non-submission of relevant data, such as aberrant test results or absences in a submitted chromatographic sequence See Paul s WL presentation for the impact of this approach McDowall Consulting 2014 www.rdmcdowall.com 10

MHRA Expectation Regarding Self Inspection & Data Integrity The MHRA is setting an expectation that pharmaceutical manufacturers, importers and contract laboratories, as part of their self-inspection programme must review the effectiveness of their governance systems to ensure data integrity and traceability. This aspect will be covered during inspections from the start of 2014, when reviewing the adequacy of self inspection programmes in accordance with Chapter 9 of EU GMP. It is also expected that in addition to having their own governance systems, companies outsourcing activities should verify the adequacy of comparable systems at the contract acceptor. The MHRA invites companies that identify data integrity issues to contact: GMPInspectorate@mhra.gsi.gov.uk 16 December 2013 Unknown the situation in other EU inspectorates McDowall Consulting 2014 www.rdmcdowall.com 11

USP Method Validation United States Pharmacopoeia (USP) Revision of general chapters 2010-2015 cycle Method development and validation and impact on ICH Q2(R1) <1224>, <1225> and <1226> McDowall Consulting 2014 www.rdmcdowall.com 13

Method Development, Validation & Transfer USP three general chapters: <1224>: Analytical Method Verification validation <1225> Analytical Method Validation <1226> Method transfer ICH Q2 (R1) outdated and incomplete Stimulus to review process published Pharm Forum, Sep 2013 Impact of ICH Q10 and ICH Q9: quality by design Replacement by: <220>: Basic requirements for validation <1220>: Lifecycle Management of Analytical Procedures McDowall Consulting 2014 www.rdmcdowall.com 14

USP Method Validation Now McDowall Consulting 2014 www.rdmcdowall.com 15

QbD: Life Cycle of Analytical Procedures Lifecycle Management of Analytical Procedures: Method Development, Procedure Performance Qualification, and Procedure Performance Verification USP Expert Panel for Validation and Verification Stimulus to the Revision Process, Martin et al, Pharmacopoeial Forum, Sept-Oct 2013 McDowall Consulting 2014 www.rdmcdowall.com 16

Proposed USP Changes Stage 1: Method design development and understanding Analytical Target Profile (ATP) defines need Identify analytical variables and design space Experimentation and refining design space Robustness studies Analytical procedure Input of changes for redevelopment or revalidation McDowall Consulting 2014 www.rdmcdowall.com 17

Proposed USP Changes Stage 2: Procedure Performance Qualification (PPQ) PPQ Protocol Experiments to verify fitness for purpose PPQ Report Local Analytical Control Strategy including formal procedure McDowall Consulting 2014 www.rdmcdowall.com 18

Proposed USP Changes Stage 3: Procedure Performance Verification (PPV) Routine monitoring of procedure Changes within procedure design space made and documented Issues that arise: trigger for investigation Risk assessment: continual improvement & unacceptable common cause variation input to redevelop or revalidate procedure McDowall Consulting 2014 www.rdmcdowall.com 19

FDA Release Draft Guidance: Feb 2014 Analytical procedures and methods validation for drugs and biologics Replaces existing draft guidance from 2000 Poor coverage of method development vs USP No consideration of design space Focus on method validation Parameters to validate (in previous draft guidance) Life cycle management of analytical procedures Does not consider method development Statistical analysis and models for validation data Not covered in USP stimulus paper McDowall Consulting 2014 www.rdmcdowall.com 20

Lab Qualification & Validation The System Instrument Cannot qualify the instrument without the application Qualify the instrument Wait until software validated before using system Software Cannot validate the application without the instrument Software qualified by supplier Validation of software awaits specialists Integrated Analytical Instrument Qualification and Computerised System Validation is Essential to Avoid Duplication of Effort McDowall Consulting 2014 www.rdmcdowall.com 22

Lab Qualification & Validation The System Instrument USP<1058> AIQ risk based instrument qualification: Groups A, B and C Naïve software validation approach Software GAMP focusses on software Does not consider instrument Integrated Analytical Instrument Qualification and Computerised System Validation is Essential to Avoid Duplication of Effort McDowall Consulting 2014 www.rdmcdowall.com 23

GAMP GPG Validation of Laboratory Computerised Systems First Edition, 2005 Based on GAMP 4 but diverged substantially Simplified life cycle good Validates everything ignores qualification Lab specific classification separate from the rest of the organisation Over complex and confusing risk assessment McDowall Consulting 2014 www.rdmcdowall.com 24

<Software Validation: Group B Firmware Firmware for basic instrument operation in <1058> Test implicitly as part of AIQ Pragmatic approach and consistent with GAMP 1-4 (not 5) Firmware with calculations - omitted from <1058> Check calculations where used e.g. content uniformity with balance to comply with GMP 211.68(b) Firmware that can be parameterised / programmed omitted from <1058> Typically done after OQ of instrument YOU need to define and test the parameters as part of OQ Programs / routines need to be defined, controlled, documented and tested by YOU. McDowall Consulting 2014 www.rdmcdowall.com 25

Group C: Failure to Validate Software Adequately Separate PC with software to operate the instrument and acquire, process and report data Data system needs to be validated at the same time the instrument is qualified Terminology between AIQ and computerised system validation (CSV) is different <1058> approach to software validation is naïve: Relies on the vendor to do all the validation work BUT the system owner is responsible McDowall Consulting 2014 www.rdmcdowall.com 26

General Principles of Software Validation FDA Guidance for Industry from 2002 Guidance does not use 4Qs model Written by CDRH for medical devices where software is used as is and not changed Does not cover configuration of software (GAMP software category 4) Does not cover customisation of software (GAMP software category 5) McDowall Consulting 2014 www.rdmcdowall.com 27

<1058> Software Validation <1058> is deficient for CSV: too simplistic and naïve Manufacturer validates the software and provide users with a summary of validation User site: holistic qualification of the system implicitly tests the software OK for very simple systems BUT deficient for complex ones as it omits: Configuration of security and access control Configuration of software to change the operation of the system 21 CFR 11 functions Custom reports Macros written by the users McDowall Consulting 2014 www.rdmcdowall.com 28

GAMP 5: Flexible approach to computerised system validation Focus on software only equipment ignored Not one size fits all as for GAMP 1 4 Different life cycle models for different software categories Risk management Demise of Category 2 software see later McDowall Consulting 2014 www.rdmcdowall.com 29

GAMP GPG for Lab Computerised Systems Second Edition, 2012 Aligned with GAMP 5 risk based approach Alignment to USP <1058> as much as possible GAMP SIG collaboration with Burgess and McDowall Focus on mostly on software Harmonisation paper from SIG core group mapping GAMP and <1058> published Pharmaceutical Engineering January 2014 McDowall Consulting 2014 www.rdmcdowall.com 30

USP <1058> Timeline McDowall Consulting 2014 www.rdmcdowall.com 31

USP <1058> Revision Process Jan 2012: PF Stimulus to Revision Process An Integrated and Harmonised Approach to Analytical Instrument Qualification (AIQ) and Computerised System Validation (CSV) A Proposal for an Extension of USP <1058> C Burgess and R D McDowall McDowall Consulting 2014 www.rdmcdowall.com 32

<1058> Analytical Instruments and Systems: Software Options Majority of instruments and systems (groups B & C) use software Software options: Firmware for basic instrument operation (B) Firmware for operation plus calculations (B) Firmware that is user programmable (B) Data systems built into the instrument (B > C) Separate PC with software to operate the instrument and acquire and process data and report results (C) McDowall Consulting 2014 www.rdmcdowall.com 33

It s Just a Pipette? Enhance your VIAFLO pipetting experience with exciting features: Manage your pipettes in the lab Maintain a service history of your pipettes Create complex custom programs in no time Save and share custom programs in the program library Personalize your VIAFLO pipettes with start up screens Upgrade the pipette's firmware to enjoy more features Risk assessment essential McDowall Consulting 2014 www.rdmcdowall.com 34

Proposed Data Quality Triangle McDowall Consulting 2014 www.rdmcdowall.com 35

USP <1058> Risk Classification Group A: Apparatus Group B: Instruments Type 1: Firmware Type 2: Firmware plus built in calculations Type 3: Firmware plus user defined programs Group C: Systems Type 1 Low complexity system - instrument plus non-configured software Type 2: Medium complexity system - instrument plus configured software Type 3: High complexity system - Instrument plus configured software & macros McDowall Consulting 2014 www.rdmcdowall.com 36

<1058> Risk Assessment <1058> risk assessment Burgess and McDowall Detailed paper published with additions Spectroscopy Nov 2013 McDowall Consulting 2014 www.rdmcdowall.com 37

Mapping USP <1058> v GAMP McDowall Consulting 2014 www.rdmcdowall.com 38

FDA Focus on Data Integrity CPG 7346.832: laboratory data audit focusses on laboratory data integrity FDA inspectors have received data integrity training Increased number of warning letters with data integrity and lack of complete data Complete data is a facet of data integrity McDowall Consulting 2014 www.rdmcdowall.com 41

GAMP Data Integrity SIG SIG Established late 2013 Leaders: Mike Rutherford, Lorrie Schuessler, Mark Newton, Christopher White & Nigel Price Kick off TC meeting in Jan 2014: >70 people attended Next meeting due in April Questions: What do you want? What would help you? McDowall Consulting 2014 www.rdmcdowall.com 42

Laboratory Complete Data 21 CFR 194 (a) Laboratory control records should include complete data derived from all tests conducted to ensure compliance with established specifications and standard, including examinations and assays, as follows Definitions: complete: having every necessary part or entire data: a series of observations, measurements, or facts. I.e. Data integrity! McDowall Consulting 2014 www.rdmcdowall.com 43

Criteria for Data Integrity: Applies to Paper, Hybrid & erecords Attributable Legible Contemporaneous Original Accurate Complete Consistent Enduring Available ALCOA is FDA s interpretation of data integrity Remaining criteria from the EMA concept paper on GCP electronic source data 2007 or ALCOA+ McDowall Consulting 2014 www.rdmcdowall.com 44

Criteria for Data Integrity Attributable Legible Who acquired the data or performed an action and when? Can you read the data and any laboratory notebook entries? Contemporaneous Documented at the time of the activity Original Accurate Complete Consistent Enduring Available Written printout or observation or a certified copy thereof No errors or editing without documented amendments All data including any repeat or reanalysis performed on the sample All records of the analysis are date and time stamped in the expected sequence Recorded on controlled sheets, laboratory notebooks or electronic media Accessed for review and audit or inspection over the lifetime of the record McDowall Consulting 2014 www.rdmcdowall.com 45

Paper: Lab Notebook / Sheets Integrity: notebook pages numbered or controlled sheets with accountability Time sequence enforced by order of entries Entries written down Signed by analyst Reviewed by second person (four eyes principle) WL RPG: Worksheets deliberately back dated McDowall Consulting 2014 www.rdmcdowall.com 46

Hybrid Systems Paper records Handle outputs as discussed in previous section Electronic records Handle as discussed in the next section BUT McDowall Consulting 2014 www.rdmcdowall.com 47

Hybrid System Paper Records Work recorded in laboratory notebook Signed paper printouts from IT system Identifies the user who did the analysis Identifies the files created Identifies the library used Electronic Records Time and date stamp accurate User uniquely identified Analysis files uniquely identified Files backed up Comparison with library correct Library maintained correctly Audit trail entries McDowall Consulting 2014 www.rdmcdowall.com 48

RPG Life Sciences WL May 2013 For HPLC analysis there were no raw data related to sample weights and sample solution preparations. Chromatographic analysis involved the use of trial runs which were not used to calculate the reportable results if the results were outside of the specification. McDowall Consulting 2014 www.rdmcdowall.com 49

Big problem: Record Synchronisation Hybrid system synchronising electronic records and signed paper printouts Generate e-records and interpret Analyst prints out records and sign by tester Supervisor reviews data and requires changes Analyst reinterprets, reprints and signs Supervisor agrees and signs print outs Batch released and both sets of records archived Complaint results in checking original data reinterpretation and reprinting Hybrid is the default option in most labs. Original Printout Updated Printout 1 Updated Printout 2 McDowall Consulting 2014 www.rdmcdowall.com 50

Electronic System e.g. CDS Validated system: workflow and calculations Users uniquely identified with appropriate access privileges File creation and management via CDS Signed electronic report and records Minimal paper printouts (e-signed report) Audit trail entries reviewed Time and date stamp accurate McDowall Consulting 2014 www.rdmcdowall.com 51

USV Warning Letter Feb 2014 McDowall Consulting 2014 www.rdmcdowall.com 52

EU GMP Chapter 4: Records Provide evidence of various actions taken to demonstrate compliance with instructions, e.g. activities, events, investigations, and in the case of manufactured batches a history of each batch of product, including its distribution. Records include the raw data which is used to generate other records. For electronic records regulated users should define which data are to be used as raw data. At least, all data on which quality decisions are based should be defined as raw data McDowall Consulting 2014 www.rdmcdowall.com 53

Generation and Control of Documents 4.1 All types of document should be defined and adhered to. The requirements apply equally to all forms of document media types. Complex systems need to be understood, well documented, validated, and adequate controls should be in place. Many documents (instructions and/or records) may exist in hybrid forms, i.e. some elements as electronic and others as paper based... Etc. McDowall Consulting 2014 www.rdmcdowall.com 54

4.1 Further Discussion Many documents (instructions and/or records) may exist in hybrid forms, i.e. some elements as electronic and others as paper based. All records covered: paper, electronic and hybrid Define relationships between records Define control mechanisms for records Define the means to ensure data integrity Equivalent to Part 11 McDowall Consulting 2014 www.rdmcdowall.com 55

Impact of Chapter 4 Must define raw data: However electronic records are not defined by chapter 4 in any detail unlike Part 11 Must include e-records that produce the paper if a heterogeneous system is used McDowall Consulting 2014 www.rdmcdowall.com 56

FDA Question and Answer 2010 Questions and Answers on Current Good Manufacturing Practices, Good Guidance Practices, Level 2 Guidance - Records and Reports 3. How do the Part 11 regulations and "predicate rule requirements" (in 21 CFR Part 211) apply to the electronic records created by computerized laboratory systems and the associated printed chromatograms that are used in drug manufacturing and testing? FDA thinks industry is misinterpreting Part 11 McDowall Consulting 2014 www.rdmcdowall.com 57

FDA Q&A 21 CFR 211.180(d) requires records to be retained either as original records or true copies such as photocopies, microfilm, microfiche, or other accurate reproductions of the original records. 21 CFR 211.68 further states that: Hard copy or alternative systems, such as duplicates, tapes, or microfilm, designed to assure that backup data are exact and complete and that it is secure from alteration, inadvertent erasures, or loss shall be maintained McDowall Consulting 2014 www.rdmcdowall.com 58

FDA Q&A: BUT The printed paper copy of the chromatogram would not be considered a true copy of the entire electronic raw data used to create that chromatogram, as required by 21 CFR 211.180(d). The printed chromatogram would also not be considered an exact and complete copy of the electronic raw data used to create the chromatogram, as required by 21 CFR 211.68. The chromatogram does not generally include, for example, the injection sequence, instrument method, integration method, or the audit trail, of which all were used to create the chromatogram or are associated with its validity. McDowall Consulting 2014 www.rdmcdowall.com 59

Dead as a Dodo: Paper Records are My Raw Data Regardless of how a laboratory system is used it will generate electronic records System falls under 21 CFR 11 and Chapter 4 Discussion now moves: is the system hybrid or electronic? McDowall Consulting 2014 www.rdmcdowall.com 60