When reviewing health agency citations, it is clear that a common area of focus by investigators during inspections is the stability program and the data that is generated by the program. Why is this? Obviously, there can be numerous reasons such as that stability studies are frequently on the critical path when seeking agency approval and the resource demands associated with stability testing and the competing priorities. But one of the issues, I believe, is that stability testing is commonly outsourced, which puts a focus on the vendor qualification/oversight program, along with the associated quality agreements, adding a complexity/risk that investigators are aware of.

The risk applies to both the third party and the sponsor that is looking to outsource the stability activity. For example, a contract manufacturing organization (CMO) that manufactures OTC product is at risk of being cited for not conducting stability studies on such product as it may assume that this is its customer’s responsibility if there is no documentation to support such a claim. Similarly, a sponsor that outsources stability testing is at risk of a citation if the test data it accepts from the laboratory where the third-party analytical method has not been validated as stability indicating.

A key consideration when outsourcing the stability activity is that the sponsor must understand the risk associated with what is specifically being outsourced and ensure that this is reflected in the qualification and monitoring of a third-party laboratory and the quality agreement between the parties. For example, if the vendor is responsible for manufacturing the stability batches, setting up the stability studies, and executing the stability protocols, then the risk and focus of the vendor qualification and the associated quality agreement is going to be different than if the third-party laboratory’s responsibility is solely the testing of stability samples that are shipped by the sponsor.

This does not mean that the latter is necessarily a lower risk, but rather that, in the latter scenario, the sponsor needs to recognize the challenges with maintaining the integrity of stability samples during shipment and this should be reflected in the vendor qualification/monitoring of that third party laboratory as well as the quality agreement. For example, there needs to be consideration of temperature loggers and controls/protocols for addressing excursions during shipment, coordination for the shipment of the samples, and the ability to utilize release data for T = 0.

The sponsor’s quality unit, when outsourcing stability testing, must recognize that it is not only taking ownership of the vendor’s data, but taking ownership of all risk associated with that data, including the effectiveness of the vendor’s quality system. So, what does that mean? If the sponsor is choosing to outsource an activity, then it is the responsibility of the sponsor to confirm the vendor has the necessary programs/systems/processes/ procedures for the activity that is to be outsourced. However, it is also the responsibility of the vendor to confirm that it has the data/information from the sponsor to comply with its stability program’s procedural requirements. For example, the sponsor must confirm that the vendor has a defined stability program per 21 CFR 211.166, which provides in pertinent part, as follows:

There shall be a written testing program designed to assess the stability characteristics of drug products. The results of such stability testing shall be used in determining appropriate storage conditions and expiration dates…

In addition, the sponsor should also confirm that the vendor’s stability program aligns with ICH guidance Q1A Q1F. However, the sponsor must further confirm the appropriateness of the systems/processes that interface with the stability program, such as chamber maintenance/qualification, data governance controls, laboratory sample management, and stability investigations (all with consideration as to which stability services are to be outsourced). From the vendor’s perspective, there must be clear delineation within the quality agreement as to which data/information the sponsor will supply so that its stability procedures will be adhered to.

It should be recognized that with such an arrangement, there is inherent risk for the vendor as it does not have the history and, for example, may fail to recognize an Out of Trend (OOT)/atypical situation and not initiate an investigation. In this example, it is of paramount importance, as part of the stability investigation program, that what constitutes an OOT result is defined, and it should be based upon the known, expected stability profile for the material under those conditions. Therefore, the vendor will rely on the outsourcer to provide the historical data to enable its interpretation/definition of a stability OOT and establish OOT criteria for that material.

A common mistake is using the significant change criteria as defined by ICH Q1A (R2) as a means of defining the need for an OOT stability (where such criteria should be applied to accelerated study data as a means of determining the need for a study at intermediate conditions). The expectation is that stability OOT criteria are defined based upon the expected behavior of the packaged drug product at those conditions and, as such, it is expected that unique OOT criteria are established for each drug product, specific to the product attribute that is being tested.

When establishing drug product OOT criteria, there should be consideration of inter- and intra-study criteria. Intra-study criteria can be based upon assessing historical data for time point to time point variations and then setting confidence bounds around the expected variation. Inter-study criteria can be based upon a comparison of slopes and setting confidence bounds around those slope values to determine whether the subject study slope is OOT.

The purpose of the OOT criteria is to highlight the risk to whether the study is projected to support the assigned retest period/expiration date and, as such, the sponsor should confirm that the vendor’s stability program includes evaluation of the generated stability data so that OOT situations are identified. This should include extrapolation of the study data generated to date (as per ICH Q1E).

Again, the expectation is that the sponsor confirms that the vendor’s stability program has suitable controls as it relates to the evaluation and trending of data generated by the stability studies, including investigation of OOT results, and that the vendor obtains the necessary historical data from the sponsor so that any OOT situations are confidently identified. It must be clear that the evaluation of stability data and identification of OOT results includes confirmation of mass balance with each stability time point and recognition of atypical chromatographic peaks, as well as that the vendor’s stability procedures includes such considerations.

Within the quality agreement between the sponsor holder and the vendor, there needs to be clear delineation of responsibilities as they relate to the review and approval of stability-related documentation such as specifications, test procedures, protocols, reports, data, change controls, and any investigations. The vendor must review and approve the documentation per its procedural requirements, but the sponsor must also confirm alignment with its quality system requirements, including those for data governance. Therefore, the level of the review of afforded documentation from the vendor by the sponsor’s quality unit should reflect any risks identified by vendor qualification and third-party oversight.

When outsourcing stability testing, qualification of the vendor must include verification of controls around the handling and treatment of data, confirming that the vendor has the necessary controls to ensure the integrity of all data throughout its lifecycle as well as that the vendor has a data governance framework addressing people, processes, and systems. Examples of controls would be confirmation of a whistleblower policy (in a consequence free environment) and metrics monitoring the health of the vendor’s data governance program.

With outsourcing of stability testing, there needs to be confirmation of the suitability of analytical method transfers of the stability methods to the vendor. This transfer should occur via a protocol that includes confirmation of the stability-indicating capability of the method. This should include all methods referenced within the stability monograph where method transfer defines the process for the testing of force degraded samples for the assessment of specificity.

When considering a stability testing method, there needs to be confirmation of the capability of the method as it relates to its requirements, as well as that such method’s requirements are defined within the associated protocol. An analytical method lifecycle approach should be employed by both the vendor and the sponsor for stability test methods where an Analytical Target Profile (ATP) is defined in consideration of the stability specification and, thus, the method’s maximum combined precision/bias.

With such a method lifecycle approach, there is assurance that there is understanding of the method’s attributes that impact the ATP. This is critical to establishing the analytical controls strategy, a prerequisite to analytical procedure performance qualification and method transfer. The sponsor should confirm that, as part of the vendor’s analytical method’s lifecycle controls, the vendor will continually monitor performance of the method to ensure continued effectiveness of the analytical control strategy.

As well as the individual methods, there should be confirmation that the vendor’s stability program defines the minimum stability monograph testing requirements that consider the type of drug product. The stability testing protocol needs to define any physical, chemical, microbiological, and biological characteristics that change over time with consideration to the container closure system (for example, testing of moisture ingress/loss when using a semi permeable container). However, the vendor needs to recognize that the sponsor should provide documented rationale for the stability testing regime and test data supporting that rationale (such as force degradation studies or developmental studies). This should be captured within the stability protocol. However, the vendor should challenge the sponsor if the stability testing regime does not align with ICH Q6A requirements or when the rationale is deficient.

When qualifying the vendor for stability outsourcing activities, the sponsor should confirm that there is suitable oversight of the program, which includes generation and evaluation of stability metrics that address adherence to procedural timing requirements relating to the establishment of protocol driven stability studies, pulling of samples, execution of testing, stability investigations (initiation and closure), as well as review and approval of data, along with periodic evaluation of ongoing stability studies. It is recommended (when feasible) that there is a dedicated stability testing group, separate from routine production support, to mitigate the risk of overly focusing resources on laboratory activities that are tied to “getting material out the door” at the detriment of stability testing commitments.

When qualifying a vendor for stability testing, the sponsor must understand how a vendor addresses stability investigations as such investigations are critical to the success of the drug and there are obvious risks with any such investigations. A critical component of a third party’s investigation program is the competence of the investigators. As such, there needs to be assurance that the qualification process for investigators includes understanding and appreciation of what needs to be considered as part of stability investigations. In addition, the sponsor will need to confirm that there is oversight of the third party’s investigators by its quality unit with allowances for disqualification and requalification.

There needs to be assurance that all stability OOX situations are investigated, including those associated with accelerated Out of Specification (OOS) results, and that investigations are complete and consider all potential causes, such as the testing material, method capability, and instrument performance, etc. The quality agreement needs to clearly delineate the role of the sponsor as it relates to review and approval of investigations, responsibility for any market notifications, and expectations regarding timing when the vendor needs to notify the sponsor of such stability incidents (recognizing the time constraints for notifying the respective health agency).

Stability studies are a critical element of drug development and a key commitment in maintaining product on the market. It is understandable that sponsors may look to outsource such activities to a third party due to complexity and resource demands, along with recognizing the benefit of such expertise. However, the sponsor must realize that, ultimately, it needs to defend output from the third party and, thus, qualification of the prospective vendor and continued oversight of that vendor via the sponsor’s vendor management program is of great importance. CP

If you have an any questions relating to the qualification of third parties for stability studies, please feel free to reach out to Lachman Consultants at LCS@lachmanconsultants.com.

---

Paul Mason, Ph.D., is a Senior Director at Lachman Consultants who has more than 20 years of experience in the pharmaceutical industry. He is a quality control chemist experienced in sterile parenteral, API and solid oral dosage forms. His experience spans finished dosage form, CMOs and API (intermediates) manufacture support in both a quality control and analytical development setting.