FDA Expectations for Parenteral Supplier Controls
Does a device guidance hold the key?
Cerulean Associates LLC
In general, the strategy for ensuring compliance with regulatory requirements governing supplier management is this: first, verify the Food and Drug Administration (FDA) statute and regulation specifics, then, rely upon one’s own knowledge and experiences to write and follow standardized processes, and third, wait for the inspector’s approval.
The wise executive realizes the two flaws underlying this approach: first, it leaves too much open to interpretation based on personal experience, and second, it leaves the initiative in the hands of the regulator. For executives in parenteral firms, the risks to the bottom line are too great to risk personal vagaries and an inspector who does not like what he sees. Parenterals necessitate a penetrating understanding of the FDA inspector’s likely inspectional path and a means by which to minimize the risks of personal misinterpretations.
Fortunately, there is a published guidance document that lays out precisely what the inspector looks for, the records he or she expects to see, and even provides advice on some of the document sections that should be within those supplier control records. Can’t remember seeing it on the FDA’s website? That’s because it’s not there. The guidance was just published on the website of the Global Harmonization Task Force (GHTF): Audits of Manufacturer Control of Suppliers.
There is one additional catch: the GHTF is ostensibly just for medical device makers . . . or is it?
GHTF and the FDA
In 1992, the FDA became a founding member of the GHTF. Other members include FDA’s sister agencies in Europe, Canada, Japan, and Australia. The organization is the device industry’s equivalent of the International Conference on Harmonization (ICH) for drug makers.
As I point out to my pharmaceutical clients and newsletter subscribers, there are two key reasons to pay some attention to guidance documents published by the GHTF. First, the guidance documents tend to be very specific in terms of what device firms should have: e.g., specific standard operating procedures, specific records, specific process points where management decisions should occur and be documented, etc. Compared to ICH or FDA guidelines, these GHTF guidance documents are extremely helpful in the day-to-day of designing, organizing and implementing effective compliance systems. The second reason to keep an eye on GHTF publications is that FDA inspectors are trained using GHTF guidance documents because these publications tend to define precisely the types of documents and records inspectors should find when examining quality systems.1 And that is priceless advice that should be taken advantage of by anyone who will be inspected.
Let us look more closely, then, at the recently published GHTF guidance, Audits of Manufacturer Control of Suppliers, Part 5 of the Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers. What can parenteral executives take advantage of?
General Supplier Controls
Under the General Principles section of the regulatory agency auditing principles — e.g., the items regulatory health inspectors will look for — is this statement:
“The Purchasing Controls subsystem [in a quality system] should be considered the main subsystem for those manufacturers who outsource essential activities such as design and development and/or production to one or more suppliers.”2
Or put another way: firms that outsource to a contract research organization (CRO) or contract manufacturing organization (CMO) should plan for the inspector to spend his/her primary efforts on scrutinizing the firm’s supplier selection, evaluation, qualification, and oversight processes.
The guidance document then goes on to spell out the specific components of these processes that the inspector will look for, including a two-page listing of records and document-types that a firm should have in its files. This specificity is why the FDA uses GHTF guidance documents in its current inspector training program.
And it is why the wise parenteral executive will use this guidance to his/her advantage.
Procedures To Have
The GHTF guidance lays out the following processes that firms should have in place, either as stand-alone standard operating procedures (SOPs) or bundled together in some form or fashion:3
•Supplier management and oversight
•Supplier selection and qualification
•Change management methodology
•Risk evaluation and management
•Incoming materials inspections
•Corrective and preventative actions (CAPA)
•Supplier audits (internal and external suppliers)
•Internal quality audits
Before rushing out to write each of these, there are three points to understand when looking at this list. First, these processes need not be supplier-only procedures; in other words, a firm does not need a separate “supplier change control” SOP. Rather, widely-applicable processes such as change control or CAPA need to also apply to the management and oversight of suppliers.
Second, a firm does not need to force its suppliers to adhere to any of the firm’s processes. Instead, the guidance recommends that only when a supplier is unable to provide satisfactory evidence of its own internal controls — for instance, the supplier does not have its own internal change control process — should a firm hammer out a joint process.4
And third, all of the records and/or record-types in the two-page listing in the guidance document — from a documented supplier selection and decision rationale, minutes of formal meetings with suppliers, and documented incoming materials verification — should be produced, or otherwise referenced (in the case of a purchase order), in the firm’s supplier management and oversight procedures. For instance, under the “supplier selection and qualification” procedure, the following records might be generated and/or referenced:
•Documented selection criteria and decision rationale for why a particular supplier was chosen,
•Documented competency of the supplier selector(e.g., the resume or credentials of the person who chosethe supplier),
•Documented list of risk associated with the material or service to provided by a supplier,
•Documented initial supplier capability assessment, and
•Mock FDA audit report — or at least the summary thereof — of the supplier from an onsite audit by an independent third party.
Is an Onsite Supplier Audit Necessary?
The answer to the question above has always been “maybe,”a nice ambiguity if you are the inspector, but a poor basis for a decision if you are an executive. Again, a look at the GHTF guidance document can provide significant help. Section 6.2, Decision on Whether to Audit at the Supplier Premise, provides a one-page bulleted list of specific considerations to take into account, segregated into four main sections:5
2.The criticality of the material or service being purchased
3.The outcome of an internal quality review of the adequacy of current supplier controls (in other words, a mock FDA audit of your own internal controls or a rising trend of incoming materials quality control failures from a particular supplier)
4.In response to postmarket information, such as recalls, complaints, or even an increasing trend of adverse events.
With my clients, I supplement the fourth item on the list, postmarket information changes, with several additional items, such as a government investigation into the supplier or its top executives, and a loss of any third-party accreditation such as ISO certification. Criteria should be developed using an SOP like the supplier selection and qualification procedure referenced earlier.
Supplier Audits and Reports
The last two sections in the guidance document delineate the minimum expectations of supplier audits and audit reports, including any supporting audit documentation. While FDA cannot currently require parenteral executives to turn over a firm’s internal quality audits of its suppliers, the wise executive understands that FDA inspectors also have access to records generated by sister agencies, both in the U.S. and abroad. Thus, if a firm in the U.S. refuses to share an audit report of a CMO based in Europe, the FDA inspectors may simply ask their European Medicines Agency colleagues for a copy of their latest inspection of that CMO. This is why I advise my clients to summarize their supplier audit findings and place the summary document in the supplier dossier.
Note that GHTF member organizations, including the FDA, are clear that it is a firm’s responsibility to discuss audit findings with the supplier “and to take necessary action.”6 Such action may be placing the supplier on a vendor improvement plan, adding additional internal controls at the firm’s receiving docks, or simply finding a new supplier. The key is to document the actions taken and the supporting rationale.
This is why, when deciding to hire a third-party to help audit suppliers, one must make sure the audit report will include recommended, prioritized actions and rationales thereof. It is not enough to simply document inadequacies. If the audit report suggests the supplier be put on a vendor improvement plan, the auditor should define what the vendor improvement plan should look like, a set of reasonable timelines associated with each milestone, and the criteria for success. Expect documented, actionable follow-ups in a good third-party supplier audit report — this is what the FDA inspector will be looking to see were developed by the firm in question. Thus, a wise executive will ask his/her outside, third-party auditor to come up with this type of actionable plan as part of the independent audit report.
A final note of caution regarding third-party audit reports of suppliers: do not accept summary judgments such as “find another supplier.” A supporting rationale needs to be developed and documented as to why the supplier will not ever work. This is particularly true when a firm is tied to its own subsidiary or affiliate as a supplier, or when the cost of finding and qualifying a new supplier outweighs the price of the purchased material or service. Any outside auditor needs to work with the realities of what a firm has to face, not with a set of black-and-white blinders.
Parenteral executives willing to look beyond the confines of traditional pharmaceutical rules, guidance documents, and best practices, can find excellent advice. As the FDA increasingly moves toward a risk-based, quality system focus, executives can use this to their advantage. The recent GHTF guidance on auditing manufacturer control of suppliers should help executives clarify the good supplier management processes that their parenteral firm already has in place, and what they have yet to accomplish.
Are you ready?
1.Avellanet, John. Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine, Logos Press: Washington, D.C., May 2010, p. 28.
2.GHTF, Guidelines for Regulatory Auditing of Quality Management Systems of Medical Device Manufacturers, Part 5: Audits of Manufacturer Control of Suppliers, SG4/N84:2010, 27 August 2010, p. 4.
3.Ibid, pp. 5-6.
4.Ibid, p. 7.
6.Ibid, p. 8.
John Avellanet is managing director of Cerulean Associates LLC (www.ceruleanllc.com). He is the author of Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine (2010, Logos Press). Mr. Avellanet has been a featured at speaker at Contract Pharma’s annual Contracting & Outsourcing conference. He can be reached at firstname.lastname@example.org.