Compliance Architects

Consulting Technology Outsourcing

CAPA – The Untold Story

compliance architecture

CAPA – The Untold Story

Try as I might in my consulting work, I can never seem to get away from CAPA.    As much as I would like to help companies prospectively improve their process control;   embrace better quality system integration and document design;   assess and implement computer-based quality systems; and use process risk analysis to rationalize quality system decisions and improve inspection outcomes (among other things I love to do), it always seems like companies need help – and lots of it – with CAPA.

Now don’t get me wrong – I certainly understand the importance of CAPA, and why it is such a necessary system.     And all you have to do is read a few FDA Warning Letters or look at industry training offerings to see how significant CAPA is to the FDA, and as a result, to FDA-regulated industry.    And CAPA in its current form has been around a long time – at least since the 1996 formal effective date of the medical device Quality System regulation.     Unfortunately though, CAPA has gone far beyond being just an important sub-system that helps to resolve any one of those many, many things that can “just go wrong” for a manufacturer of FDA-regulated products.   CAPA has in recent years become the de facto cornerstone of FDA-regulated quality systems (with the expectation expanding far beyond just devices!)      Given this development, you have to ask yourself:    What does it say about the state of control within FDA-regulated industry that a system that is designed to remediate failures is now the cornerstone of most companies’ quality systems?     As troubling as the implications of this statement are, it is a topic I will leave to discuss another day.

That’s because today I want to talk about CAPA – The Untold Story.

REAL WORLD CAPA PROBLEMS

As I alluded to above, I see lots of CAPA systems.     Or better said, I see a lot of CAPA procedures.     Or more precisely, I see a lot of CAPA procedures masquerading as CAPA systems.        What I mean by that is – I see a lot of companies in their desire to have “an SOP” in place for CAPA, confusing the process of CAPA completion with the need to have a CAPA system of incident identification, analysis, categorization, evaluation, investigation, reporting, follow-up, etc.    In large part, because CAPA has become such a fundamental part of FDA’s regulatory expectations, the scope and extent of what we now call CAPA has grown along with it.    This growth in scope – by well intentioned Investigators looking to CAPA as the primary solution to a company’s problems, and by companies that are only trying to do the right thing by having a comprehensive CAPA program in place – is itself causing some of the poor outcomes with CAPA.   As scope increases, complexity often increases.    So despite the focus on CAPA – what’s wrong?   Why do many companies – solid, name companies in addition to small and mid-size companies – have such continuing trouble with CAPA? From what I see, despite this focus and good intent, there are many causes for poor CAPA system designs and compliance outcomes.  A few of these include:

  1. Failure to differentiate between the CAPA system and the CAPA execution process;
  2. Failure to describe in an easy to understanddocument or documents:
    • how the different elements  of CAPA work together;
    • how to define and differentiate trigger events; and
    • how the different elements  collectively contribute to the overall concept of control.
  3. Insufficient knowledge and lack of training for SMEs on how to document, investigate, analyze, and most importantly, write-up good, understandable CAPA documents;
  4. Overcomplicating the simple; and
  5. Trying to make CAPA something it is not (like Six Sigma/DMAIC) or failing to understand CAPA is a regulatory requirement – not something that you can adapt to your liking in the guise of something like “continuous improvement.”

As figure 1 below shows conceptually, there are a lot of inter-related elements to a good CAPA program, and using text based documents – SOPs – to describe how these inter-related systems work, and where process begins and system ends, can be a challenge.

CAPA System Integration

This is where the concept of “The Untold Story” comes into play…

THE UNTOLD STORY

So what do I mean by “The Untold Story?”    I mean – or better said I see (and this may be the biggest “duh” thing I’ve ever written)  – that many firms fail to communicate effectively in their quality and compliance documents.    And, nowhere is this more apparent than in the documents that define and constitute CAPA.

Initially, many of the CAPAs that I read are almost unintelligible!  They are filled with jargon , disconnected statements, proprietary acronyms, unsupported conclusions, data and statistics with no explanation, and often, internal inconsistencies.    Further, many companies have almost no idea of how the sub-process elements (or some would call “inputs”) of CAPA work together, much less are able to describe this effectively.      From this and a review of many other types of compliance documents (submissions, procedures, etc.)  I have come to believe that one of the most important failures in FDA compliance activities is the failure to communicate simply and effectively.  (2018 Update:  See Writing for Compliance®)

So what does this mean to CAPA?   Well, in my strong belief, good CAPA is nothing more than a good story – or better said, a series of related stories.    But why stories?     Why not a report?  Why not a quality record?   Why not an investigation protocol?    Why not a journal?

Well simply, because humans are hard-wired for stories!

It’s in our DNA – it’s in our genes.    From the water-cooler to the television;  from the dinner-table to the cinema;    from political speeches to the evening news, humans process communication best if it the communication takes the form of a story.   And with CAPA (like other FDA-required documents) why do we create these documents anyway?    Because we have to?   Well yes, but more importantly, we create them so that we can communicate – effectively – in this case to an FDA Investigator – what we do, and how we do it.

So if we want to communicate effectively to FDA, we need to communicate more stories.   We need both our CAPA system and our individual CAPAs to tell a story!

My experience has been extremely positive working with clients on this one simple concept.    Stories are actually pretty simple to write – and CAPA’s actually are perfectly adapted to follow the same basic structure:

STORY STRUCTURE1 CAPA STRUCTURE
Exposition:    Character /
Scene Development		 Background and Details of Event/Incident
Conflict / Rising Action Investigation
Crisis / Climax Root Cause Analysis
Falling Action / Resolution Corrective / Preventive Action

The application of a basic, simple story structure can help you immensely improve your technical writing for FDA compliance.   Clearly though, we are not writing childrens’ novels, or even adult fiction.   There will be references to SOPs, technical details, organizational structures, complex activities, etc.  However, when you place all of these complicated elements in the structure of a simple story, it becomes so much easier to understand than if you are forced to simply read, e.g.,  fishbone diagram outlining the factors in a root cause analysis without any context.   This type of writing will help FDA Investigators understand your operation, help you to know that your SMEs and responsible CAPA authors understand the issues associated with the failure, and overall, improve your compliance outcomes.  (2018 Update:  See Writing for Compliance®)

—————————–

For information on how to build sustainable FDA compliance with world-class CAPA programs for pharmaceutical, medical device and other FDA-regulated companies, please contact Compliance Architects® at info@compliancearchitects.com or at 888-734-9778.

1 Literary Elements (http://www.orangeusd.k12.ca.us/yorba/literary_elements.htm)

The Risk of Using the GMPs to Design Your Quality System

Holmes on Homes

Over the last few months, I’ve become a big fan of a TV show called Holmes on Homes.   The show features super-hero contractor Mike Holmes coming to the rescue of homeowners across Canada and the United States that have been the victims of shoddy home contracting work.   Wildly successful on HGTV, Holmes on Homes provides viewers with technical insight into the highly inconsistent world of home contractors, and highlights how “doing the minimum” or worse, can result in high levels of frustration, a very big repair bill, and incredible amounts of lost time by the affected homeowners.

As I watched Mike Holmes come to the rescue week after week, it became clear to me that many of the compliance problems that we encounter within FDA-regulated companies stem from a common problem that Mike runs into, namely, building something to “minimum code.”    Now, to a lot of people, the last statement might not seem to make sense, and goes against much of what they’ve been taught.   If we try to meet minimum code, then how could that be a problem?    If our quality systems meet the minimum stated requirements of the law, then how could the FDA have a problem with them?   Why should we do more?  And even if we wanted to, what should we do?    If I have a validation program – if I have a CAPA system –  if I do annual product review or management review – if I perform calibration – haven’t I done enough?

In short, the answer to these questions is an emphatic “no!”

GMPs:  Design Document or Checklist?

The reason that following the minimum code – in this case, the GMPs (or rather, using the GMPs as the sole basis for how your quality system should function) is not sufficient to meet FDA requirements or expectations is that the GMPs are not design documents! In other words, whether it’s the GMPs, (or as Mike Holmes often finds, the building code) these documents are not, and never were, intended for the purpose of designing something that needs building.   These documents are intended solely to establish basic minimum requirements – legal requirements – but they are most certainly not design documents!    Now these documents are important – I’m not recommending you ignore the GMPs;   however, they are important within a very specific context only, i.e., the verification of the adherence of design and function of your quality system to the stated regulations and FDA expectations.     And for the purposes of this discussion, I won’t even discuss the fact that much of what is required by the FDA is not found within the GMPs and is often extremely difficult to identify and apply.

In addition, what happens within many FDA-regulated companies is that people that have no experience with the design and building of systems, even if they had the proper design documents, are given the task of designing, developing, and building these complicated quality systems, using nothing more than the minimum code – the GMPs.     As a result, these systems are almost always built without consideration of the  products’ particular technologies, intended purpose, patient population, the company’s facilities, the complexity of the processes, the company’s organizational model, personnel capabilities, risk tolerance, product supply strategies, fulfillment strategies, etc.,

Given this, it’s no wonder why there is a poor
track record of compliance within FDA-regulated industry.

Thinking further about the challenges Mike Holmes encounters, it is likely that more design effort is typically expended in building a $300,000 residential home than is spent by most companies on the quality systems that form the basis for hundreds of millions of dollars in operational spend!    At least most residential homes have blueprints – which are at least design documents;   most quality systems have nothing approximating blueprints.

Savvy companies can use these failings of their competitors to great competitive advantage.   Well designed quality systems can improve your product quality, fulfillment and compliance outcomes; can help maintain or reduce fixed costs; and will result in a more predictable supply-chain operation for executive management.   Also, well-designed quality systems can keep you on the right side of the law.   The investment in a solid quality system design effort – or often, a re-design effort – can yield better performing systems and improved inspection outcomes.

Design for Compliance Points to Consider

Given the foregoing, what are some things executives of FDA-regulated companies should consider to improve their quality systems and ensure they are designed and built to meet FDA requirements and expectations:

1)       To use an analogy, consider that that just because you live in a house, doesn’t mean you can build one! Your company’s quality team may do an excellent job with managing base business; however, that doesn’t mean they know how to design and build effective, compliant quality systems.    The skills to manage and operate within a well-designed system are not the same skills required to build one.   Get professional assistance with designing these systems for maximum outcomes and effectiveness.

2)     The FDA will not, and cannot, tell you what you need to do to comply with legal requirements.   FDA personnel are severely constrained with what they can tell you about how to comply with their regulations and expectations.  More importantly, FDA personnel aren’t quality system design professionals and really don’t know how to design quality systems for business and compliance success.    To use another analogy, would you hire a building inspector to build your house??   No, you wouldn’t.    The skills that an FDA Investigator brings to bear on assessing your operation are not the same skills that are necessary to design and build good quality systems in the first instance.

3)     Even if you were fortunate to have a well-designed quality system a number of years ago, due to the natural evolution of business operations, it’s a good bet that these systems need re-development.    Changes to your business through outsourcing, new products, changes in personnel, changes in individual procedures, acquisitions, mergers, in-licensing, etc. all create disconnects and dis-integration of systems that can create significant quality, compliance and operational failure possibilities.   Have skilled design professionals “re-engineer” your systems every few years to be sure they are operating at maximum effectiveness.

4)     Be careful with focusing too much on spending just the minimum to comply with the GMPs.     There is no bright-line of compliance when dealing with the FDA, and many a company has played the game of nickel and dime-ing quality and compliance expenditures only to be stuck with a very, very big bill later on!     The saying, “penny-wise and pound-foolish” exists for a reason, and it could not have more relevance than in the context of FDA-regulation.

Companies that look at FDA compliance as merely a checklist activity to engage in to write some SOPs for an FDA Investigator to look at when they walk in the door are doing themselves a grave disservice.     The development of FDA-compliant quality systems takes an extraordinary combination of subject matter expertise, high-level design effort, visualization, integration activities, and document drafting expertise (among other things) to ensure successful outcomes.    Although doing so requires significant investment, when you eventually have to sit across the table from an FDA Investigator, you will be able to feel confident that you are well-positioned for compliance success and ultimately, for long-term business benefits.

For further information on how to develop high-performing quality systems for pharmaceutical, medical device and other FDA-regulated companies, please contact Compliance Architects® at info@compliancearchitects.com or call us at 888-734-9778.

Compliance on a Budget: Can it be Done? What are the Risks?

Like a lot of people, when I was a younger, I always wanted the newest toy or the shiniest item in the store.    An unfortunate reality of growing up is that as we become adults, we come to the realization that things cost money and that there are limits to what we can spend.    We find out that everyone has a budget — whether we like it or not.   (Let’s not get into the Government budget process!)

Similarly, as quality and compliance professionals we are often challenged by the realization that what we would like to accomplish with our operations costs a lot of money.   People cost money;   instruments cost money;   computers cost money;    excellence costs money.     We are given budget targets (often reduced year over year) to hit, and increasing expectations regarding inspection performance and enforcement actions.  Particularly in the current business climate, executive management is scrutinizing all expenditures for value and return on investment, and adding fixed costs (translated:  people) is simply not being considered.     Given that the departments central to carrying out the activities that support FDA quality and compliance are resource-intensive functions, and that even with the best computerized systems, there is simply a great deal of work that people (yes, living-breathing people) have to do, how can we do this on a budget?     Is it possible to be successful in this environment?     In other words, what can we not afford to do and what risks do we incur by not spending as much as we would like?

Like the adult that has come to the realization that we can’t afford everything, we need to accept that modern companies, particularly the FDA-regulated companies we work for, will never stop their quest for continual cost-reduction.   This is especially true now that revenue streams from blockbuster products are in jeopardy, and companies are scrambling to maintain profitability against the specter of government-influenced pricing.  Unfortunately, many companies simply reduce heads without an in-depth understanding of what parts of their operations will be compromised, and call that effective fixed-cost management.    The problem with this approach is that most people in today’s corporations are not sitting around reading The Wall Street Journal – many people are already working 10-12 hours per day, efficiently, and are already using technology.      So, simply cutting people that may already be working hard, without much consideration about what work is now not going to be done, can actually impede your business revenue and profitability objectives, and worse, can place your company at significant legal or regulatory risk.

The secret of how to accomplish these difficult, conflicting goals is really not so secret.  It does, however, require companies to do a little planning, a little analysis, and embrace a little change.    Let’s explore two basic principles that I would submit are fundamental to successful headcount reduction, or, maintenance of existing staffing while still improving outcomes:

It Starts With Risk…

It seems like everyone is talking about risk management these days.    Risk management has been formally embraced by the FDA, risk MAPs are required for new pharmaceutical product introductions, risk concepts have been formally integrated into ICH Q10, and there is a growing cottage industry related to risk management and how to perform it.    While everyone is talking about risk management, most substantive information I review on risk management refers to risk management as the identification of all risk and the comprehensive set of activities that are intended to minimize or eliminate that risk.

However, true risk management starts with a very fundamental, and sometimes difficult principle for people to embrace – that is – that not all risk is equivalent, and that differentiation of risk is the most important factor in cost-effectively managing today’s quality and compliance operations.    The reason this is so difficult is that by differentiating risk, and focusing on only those risks that, well, present the most risk, you are implicitly acknowledging that you will take no action – purposefully – against some things that you know may go wrong.   This is a difficult concept to embrace in Corporate America today – executives have been less than enthusiastic about embracing mistakes – and, it is a difficult concept to present to the FDA when things go wrong.   However, it is imperative to understand that if you don’t differentiate risk, and address significant risks accordingly, you face the prospect of spreading your limited resources thin and ultimately, facing greater failure or more significant issues in areas that could create extraordinary problems for your company.   So, risk differentiation is an essential part of managing FDA-regulated operations today;   and fortunately, with the right assistance, there are methods and practices that can help you truly separate the proverbial wheat from the chaff with respect to your company’s quality and compliance risk.

… It Ends With Change

The other essential aspect to maintaining your functional operational outcomes while reducing or maintaining your fixed costs (headcount) is that you can’t expect other people to just “pick up” work that the targeted resources are performing, or, add additional  work to their already over-crowded plates.  There has to be a change in the way work is performed to make the work processes more efficient – in other words, so you can do more with less.     Without doing so, you simply are cutting possibly essential activities from occurring without understanding the impacts of the reduction.

The changes that could be considered to achieve efficiency improvements are extremely diverse.    You may need to make changes to process design;   you may need to implement new or improved computer systems;  you may need to change/upgrade your personnel capabilities;  you may need to add new equipment or automation;  you may need to make your documentation simpler.    The possibilities and the interrelated permutations are many and varied, but, it is essential that these possibilities be identified, and that maximum returns on investment be considered before changes are made.

On this topic, much has been made of what are called “lean” principles for process redesign and improvement.   The terms “Lean Quality” and/or “Lean Compliance” have become de rigueur in certain circles.    I guess because I hate buzzwords, I have refrained from embracing these terms – I look at the concept of Lean as basically a structured repackaging of pre-existing principles, and accordingly, not something that is really all that new (albeit, also not often well applied!).     Lean is, at its core, a very sound and effective approach to process redesign and organizational improvement.   In fact, Lean, like Six Sigma, and a host of other quality management and engineering tools, can provide significant value to the enterprise when applied and used properly as supportive of the changes that are necessary for the organization to make to ultimately, achieve more with less.

Managing FDA-regulated operations is not for the faint of heart.   Heavy science.   Strict regulation.   Overwhelming documentation.   Significant risk.   Extraordinary cost pressures.    However, by properly differentiating risk, and by engaging in well-substantiated operational change, you can improve your odds of success with all your stakeholders – executive management, the FDA, and your customers.

The Importance of Compliance Strategy

strat – e – gy [strat-i-jee] – noun

  1. skillful use of a stratagem: The salesperson’s strategy was to seem always to agree with the customer.
  2. a plan, method, or series of maneuvers or stratagems for obtaining a specific goal or result: a strategy for getting ahead in the world.
  3. The art or skill of using stratagems in endeavors such as politics and business.

(dictionary.com)

Strategy is not something often associated with compliance operations or activities. In fact, compliance is virtually never considered strategically, and certainly the design of compliance functions, staff models, document systems, computer operations, etc. are not designed strategically. This is a major mistake on the part of most regulated enterprises.

Exceptional compliance outcomes only result from top-tier compliance strategies, implemented with robust compliance architectures, compliance-supportive cultures and world-class teams!

How do you develop a world-class compliance strategy? Here are a few points to consider:

  • If you are an FDA-regulated company, it is likely that more than 80% of your business has extensive regulation. Weaving regulatory requirements, expectations and risk-tolerance together with your business objectives will help to ensure you have invested properly, understand your risks, and have taken the appropriate actions to protect your business for the future.
  • Most compliance activities have not been considered in a strategic review for fit to purpose, business supportive capability, or even appropriateness for risk-reduction. In fact, many executives have NO IDEA of how well performing their compliance functions are, and whether they are ready for the FDA or other regulatory body. This is astonishing considering upwards of 25% of operational fixed costs (CA estimate) can likely be attributed to regulatory compliance functions. Billions of industry dollars are spent each year on compliance operations, without high-level strategic integration and business support analysis. How can this be?
  • The compliance / enforcement record of FDA-regulated industry is abysmal! If we operated in the nuclear industry, the regular and consistent enforcement actions attributed to individual companies would be front page news in the Wall Street Journal! Yet, in FDA-regulated industry, we accept it as normal, and the cost of doing business. For companies committed to success, this enforcement track-record should not be acceptable.

Developing a compliance strategy is not hard — but it does take vision, knowledge, expertise, business acumen, and a commitment to excellence that is often lacking. We can help you ensure your compliance operations are strategically integrated into the your company’s long-term business success. Isn’t that the least your company deserves?

For information on how to develop a world class compliance strategy, contact Jack Garvey at john.garvey@compliancearchitects.com, or visit our website at:  www.compliancearchitects.com

Contact Us Today