Thursday, July 8th, 2010 saw the announcement by the FDA of a re-enforced emphasis on inspecting for compliance with 21 Code of Federal Regulations (CFR) 11 on electronic records. This move came on the heels of the agency pulling back from releasing a revised 21 CFR 11 in 2009. 

Now, 14 months later, where is the FDA headed?¹

Agency Intent

When the agency published its intent to raise the enforcement profile of 21 CFR 11 (i.e., “Part 11”), it listed four goals:²

1. Assess the industry’s comprehension or continuing misinterpretations of Part 11
2. Determine how firms are ensuring the integrity of electronic records
3. Extend scrutiny of data quality-related and computerized system validation-related 483 observations since 2007
4. Determine next steps for Part 11 — including whether to issue a revised regulation or simply draft more guidance

To achieve these objectives, FDA is conducting two types of inspections: For Cause and Extended. The For Cause inspections are typically due to a record integrity-related issue in a submission, as a result of a recall investigation or a whistleblower allegation (e.g., some tip-off that all is not proper with company data related to product safety and effectiveness).

An Extended inspection will occur as a result of a standard, routine inspection wherein the inspector has come across one of two issues:

1. The firm relies heavily on computerized system controls to make its product, or
2. The firm has not made reasonable progress toward achieving full compliance with 21 CFR 11 requirements.³

The inspector is to check electronic records for “accessibility, durability, and accuracy” over the lifetime of the records’ required retention periods. Typical inspector questions include:

• Who is authorized to access the system and enter or change data?
• Are original data entered directly into an electronic record at the time of collection or are the data transcribed from paper records into an electronic record?
• Are there edit checks and data logic checks for acceptable ranges of values?

Here is the key instruction to inspectors: “If initial findings indicate the firm’s electronic records may not be trustworthy and reliable, a more detailed evaluation [i.e., an Extended inspection] may be warranted.”⁴

Setting aside the few firms that automate most or all of their product production, the issues the agency are looking for leave every FDA-regulated company vulnerable in at least two ways:

• stable records retention, and
• Part 11 compliance progress.

A brief analysis of FDA warning letters citing Part 11 issues since early 2010 confirms these vulnerabilities.

Part 11 Citations

Since 2010, FDA’s observations related to 21 CFR 11 noncompliance cover laboratories, manufacturing and clinical trials: the entire product lifecycle. The core commonality is a lack of controls that call into question the reliability of a company’s information used to make decisions around product safety and/or efficacy (or otherwise to ensure compliance with predicate rules).

In April 2010, the FDA issued a Warning Letter to Capricorn Pharma and its laboratories, noting, “Your firm’s laboratory analysts have the ability to access and delete raw chromatographic data.

. . . Due to this unrestricted access, there is no assurance that laboratory records and raw data are accurate and valid.”⁵

One month later, the agency cited AVEVA Drug Delivery Systems: “Your firm failed to check the accuracy of the input to and output from the computer and related systems of formulas or other records and data and establish the degree and frequency of input/output verifications.”⁶

In February 2011, the agency had harsh words for contract manufacturer Ningbo Smart Pharmaceutical Co.:

You are responsible for the accuracy and integrity of the data generated by your firm. A firm must maintain all raw data generated during each test, including graphs, charts, and spectra from laboratory instrumentation. These records should be properly identified to demonstrate that each released batch was tested and met release specifications. Appropriate record retention policies should also be in place. . .  Should product quality or safety concerns arise in the future, the original records pertaining to batches listed in an application may be integral in providing reasonable assurances to the Agency regarding a product and integrity of data submitted to support it. . .  We highly recommend that you hire a third party auditor, with experience in detecting data integrity problems, who may assist you in evaluating your overall compliance with CGMP.⁷

Then, later this spring, the FDA informed contract research organization Alpha Laboratories, “As a contract testing laboratory, it is your responsibility to ensure the integrity of the data generated and that all test results be properly documented, maintained and reported.”⁸

And just in case firms still were questioning the need for data integrity assurances under predicate rules as part of 21 CFR 11 compliance, the FDA informed Cadila Healthcare in a June Warning Letter:

You are responsible for the accuracy and integrity of the data generated by your firm. Provide a more comprehensive corrective action plan to ensure the integrity of all data used to assess the quality and purity of all drugs manufactured at your facility, including any registration lots.⁹

Ironically, given the agency’s intent to raise the enforcement profile of Part 11, none of these warning letters actually cites 21 CFR 11, only the predicate rules. Nonetheless, as should be clear from the above Warning Letter excerpts, FDA’s enforcement emphasis for Part 11 compliance is all about how companies ensure — or fail to ensure — record integrity.

George Smith, one of the leaders of FDA’s Part 11 revision team has repeatedly noted over the past five years, “Validation is to intended use. Thus, the exact same two computers or two exact same software installations at two different companies produce two different sets of records.” In other words, Part 11 validation is undertaken to ensure the integrity of the records produced and/or maintained by the computerized system as part of a regulated business process.

Protecting Yourself

To ensure your firm is on the right path, look anew at your current Part 11 compliance efforts (and those of your critical suppliers). Assess the scope of those activities. Given that FDA inspectors are looking first at records associated with proving product safety and efficacy, those systems that do not produce or maintain such records can be assigned a lower priority.

Because systems create and manage so many records, narrowing the scope of records — and therefore, the scope of systems — subject to 21 CFR 11 is crucial to avoid slipping back into a “validate everything” mentality.

As the Ningbo Warning Letter pointed out, your firm should have some sort of records retention schedule or matrix. This should list the types of records — e.g., training records, batch records, quality agreements and the like — that your firm is required to retain for a specified time period based on various regulations, laws, and contractual agreements. You can then use this retention schedule to assess the Part 11 risks associated with each record.

Avoid complications early on and start with a simple, one-question risk assessment: What could clearly happen if a particular type of record is wrong, corrupted, accidentally destroyed, etc. (i.e., the information is unreliable)?

At the last management workshop I ran, I posed two situations for attendees to help them quickly see how to assess risk to records that might be under Part 11. First, I posed this question:

Imagine a situation wherein you discover two issues with your finished product shipping records (such as shipping manifestos). Some of the records are missing, while some of the records are wrong (e.g., addresses are mixed up, recipient names are misspelled or even missing). Assuming no other controls exist, do these unreliable shipping records call into question, cause, or otherwise likely result in a loss of patient safety or product efficacy?

Although the product specifics involved might generate a possibility that unreliable shipping records could result in patient injury or product ineffectiveness (i.e., for a product that must be refrigerated, the firm could no longer guarantee that the product was picked up and delivered by a refrigerated delivery method), for most of the attendees and their firms, unreliable shipping records did not present an immediate risk to product safety or efficacy. Thus, even though the records are required under predicate rules, it is possible to place this shipping manifesto system on a lower priority of Part 11 compliance.

Next, I posed the attendees this question:

Now, imagine a similar situation, again with two similar issues — some records are missing, some are incorrect — but this time, the records in question are those that show finished product sterilization records. Assuming no other controls exist, do these unreliable product sterilization records call into question, cause, or otherwise likely result in a loss of patient safety or product efficacy?

In this context, we can clearly see that not being able to guarantee the finished product is sterile has a clear and direct risk to patient safety and/or product efficacy.

Assuming the records in these two instances are maintained electronically, the risk to the consumer, to the company, and of receiving a 483 FDA observation, is the driving force behind which computerized system should not only be prioritized in Part 11 compliance efforts, but that should also receive the greater share of Part 11 validation efforts.

Recognizing — and then building your Part 11 compliance program around — the reliability of records associated with product safety and efficacy (and predicate rule compliance) are the first steps in ensuring alignment with current FDA enforcement of 21 CFR 11.

Whenever I’m asked to help firms fix Part 11 compliance efforts gone awry, I am sadly no longer surprised at the continuation of the old computer validation miscues. Computer validation mistakes start subtly, build steadily, and cause no end of frustration.

To avoid Part 11 mistakes slipping into your compliance efforts, always keep the end in mind: Are FDA inspectors looking for reliable computers and software or reliable data on product safety and efficacy? 

References

1. John Avellanet, “2009: A Look Ahead,” SmarterCompliance, No. 24, Vol. 2, Iss. 12 (2008)
2. FDA, Press Release: “FDA To Conduct Inspections Focusing on 21 CFR 11 (Part 11) Requirements Relating to Human Drugs” (2010), online at: http://www.fda.gov/AboutFDA/CentersOffices/CDER/ucm204012.htm
3. FDA, BIMO Enforcement Compliance Policy Manual, Part III, Attachment A (2009)
4. Ibid.
5. FDA, Warning Letter to Capricorn Pharma (2010), online at: www.fda.gov/ICECI/EnforcementActions/WarningLetters/ucm227896.htm
6. FDA, Warning Letter to AVEVA Drug Delivery Systems (2010), online at: www.fda.gov/ICECI/EnforcementActions/WarningLetters/ucm214564.htm
7. FDA, Warning Letter to Ningbo Smart Pharmaceutical Co. (2011), online at: www.fda.gov/ICECI/EnforcementActions/WarningLetters/2011/ucm249425.htm
8. FDA, Warning Letter to Alpha Laboratories (2011), online at: www.fda.gov/ICECI/EnforcementActions/WarningLetters/ucm262219.htm
9. FDA, Warning Letter to Cadila Healthcare (2011), online at: www.fda.gov/ICECI/EnforcementActions/WarningLetters/ucm261159.htm

John Avellanet  helps clients solve compliance challenges with pragmatic, business-savvy solutions. His latest book is Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine (2010) has garnered significant praise from industry executives, former FDA officials, and Amazon.com reviewers, and was featured at BIO 2011. Mr. Avellanet can be directly reached through his lean FDA compliance consultancy, Cerulean Associates LLC, on the web at http://www.Ceruleanllc.com, or through his award-winning blog at http://www.ComplianceZen.com. This article was adapted from Cerulean’s client newsletter, SmarterCompliance (vol. 5, iss. 3).