Compliance Architects

Consulting Technology Outsourcing

A Low Cost, Seven-Step Approach to Reducing FDA Enforcement Risk

quality management systems

|

A Low Cost, Seven-Step Approach to Reducing FDA Enforcement Risk

August: normally full of summer… sun, sand and surf. As the song goes, “summertime and the living is easy…”

In 2020, COVID-19 — and more recently its Delta variant — wreaked havoc on an orderly return to business as usual.

But recently progress has been made as the FDA said they have resumed some of its foreign inspectional activities and has begun transitioning to its standard operations for domestic inspections.

My hope is that all of you involved in quality and compliance are enjoying some time off with friends and/or family and getting a chance to read a good book on a quiet beach somewhere.

But be forewarned, the FDA does not appear to be taking any enforcement vacations. Companies need to remain vigilant reducing enforcement risk for the remainder of the Summer and Fall. In keeping with the season, this posting is going to be light, relatively short, and easy on the eyes. But, don’t underestimate what I’m about to tell you. The following can be a roadmap for significant risk-reduction within your operation, and you don’t have to spend one thin dime to accomplish any of this.

So let’s get started.

Initially, enforcement risk reduction is largely a matter of focus. Reducing risk prospectively is a project, and in my strong opinion, should not be considered part of “base business” operations. Organizations are generally staffed to manage base business, not to develop new or fix broken systems. That said, you can achieve such focus with the following.

Step 1: Create a three-month, strict timeframe for an enforcement risk reduction project. Why three months? Well, for one thing, it’s a manageable timeframe – it is short enough to be real. Also, three months puts pressure – and focus (which is what you want) – on your team to deliver.

Step 2: Prepare to get things done. If you’ve got a staff of 20 people that are already overworked, you can’t just add more work to their plate. You have to eliminate low-value work items to free staff up for a big project push. There’s no magic here – even the best people need to go home and relax after a hard day’s work – and therefore, to focus on enforcement risk reduction, you will likely have to eliminate some other activities for the three month period. Get your staff together for one-hour and go through and ask them what activities should be put on hold for three months so that you can achieve focus. In all likelihood, you’ll get an earful from them.

Step 3: Turn your staff into a project-based team. There is a big difference in how people work on routine, base-business business responsibilities, as distinguished from tight, project-focused, project-managed activities. I personally believe that humans are “hard-wired” for project type work: cross the river; hunt the animal; build the shelter; plant the crops. By turning your workforce from a “staff” into a focused “project team” you immediately convert passive content consumers into active content producers.

Make sure you appoint a project lead (project manager) and decompose the project sufficiently to make it manageable. Make sure the project lead is a “can-do” type of individual that will not only get things done, but will make sure that the other people with task responsibilities get their things done!

Step 4: Conduct a hyper-critical assessment (deep dive) of your operation. The objective here is to not provide a report for management to beat anyone up with. The objective here is to quickly, and without attribution of fault, figure out where there is risk in your operation. I would suggest that no names be included with the report, and perhaps, the report should not even be published or circulated. The report should only be used as the basis for an aggressive project remediation plan.

Step 5: Review/Analyze/Triage. Get together with your quality and compliance team in a conference room with multiple stacks of Post-It Notes, flipcharts and markers. Take each of the findings / risk areas from Step 4 and for each finding, identify the level of risk exposure from the finding (high, medium, low) and what specific actions and resulting deliverables can be taken to reduce or mitigate the risk within a finite 90 day window. It is essential that you focus on activities that can be completed within the 90-day window. Capture everything, but if it’s a longer-term remediation project, analyze it separately, after the fact.

After you prioritize the risk exposure, re-prioritize within each classification of risk exposure to get a prioritized list of activities that needs completion within the 90 day window.

Step 6: Plan. Project management should be a core skill of any quality, regulatory or operations professional but unfortunately, it often isn’t. A checklist or to-do list is not a plan – plans are documents that provide a roadmap – with details, resources, explanations, etc., of how you are going to get from Point A (in this case a list of things that need completing) to Point B (a list of things that are completed).

The project leader you appoint (with overall responsibility for project timing and commitments) should develop a fully-resourced project plan with realistic completion deadlines, identified predecessor tasks, and containing the prioritized list of items you identified as necessary to drive down enforcement risk. Ensure supporting documents exist to help project members understand the project purpose, governance, support structure, etc.

Step 7: Execute. No matter how well you plan, if you don’t execute, everything up to this point has been for nothing. Good execution is hard – people need to focus on completing activities within pre-defined timeframes. If they run into problems, make sure they ask for help. I once worked for a company that told me that one of the few things that would simply be considered unacceptable was failing to ask for help if I needed it.

Track progress closely; meet regularly and update status; update project plans (and GANTT charts if you have them); identify task delays that disrupt the critical path; communicate regularly and consistently. By ensuring you execute strictly to plan, you will walk away in 90 days with a huge level of progress, and will have reduced substantial risk.

Enforcement risk reduction is hard work. Systems need to be remediated; documents rewritten; training conducted; procedures redeveloped; stories developed; gaps plugged. All this work is generally above and beyond the role of base business personnel. By providing focus, project-based approaches, and good project execution discipline, however, your organization can begin to reduce enforcement risk without a great deal of expenditure.

Enjoy the rest of the Summer!

Quality Agreements – Cornerstone of Product Supply Relationships

I worked for a Chief Quality Officer a number of years ago who always had this response when our company was contemplating movement of a large volume of internal production to third parties:

“You can delegate your responsibilities
but you can never delegate your accountabilities.”

He was a wise man.

I have personally experienced the challenges of maintaining accountability for third party manufacturing in the Bio Pharma, Pharma and Consumer segments.  The complexities can be overwhelming.

The basis for an effective third-party supply relationship is framed out in two key documents: the Supply Agreement and the Quality Agreement.  Typically the Supply Agreement is managed between the Supply Chain teams in both organizations and the Quality Agreement is managed between the Quality teams in both organizations.  The Quality Agreement spells out the detailed Responsibilities and Accountabilities of each party as well as when either organization needs to be Consulted or Informed.  The Agreement may also identify which party is the final Decision-maker in specific circumstances.  Often I have seen a RACI/RACID document attached to the Quality Agreement delineating the R, A, D for each element of the Quality System as well as when either party needs to be Consulted and/or Informed.  Specific time-frames may be specified for certain key QA responsibilities.  For example, tPlanning - Third Party Manufacturing Quality Agreementshe QA Agreement may specify a timeframe of not more than 30 days for a Third Party Manufacturer to complete the manufacturing site investigation needed for a quality complaint investigation.

It can take weeks or months to complete the Quality Agreement and to obtain the required approval signatures.  I have seen more than one ISO Audit Report or Health Authority Audit Report in my 30+ years in industry citing the lack of a Quality Agreement between the company I was working for and a given Third Party Manufacturer.  When the audit closed, the team would often come forward stating that the Quality Agreement was “in draft” at the time of the audit.  When I would ask follow-on questions as to how long the Quality Agreement had been “in draft”, the timeframe provided was in some cases, months to years.

While getting the Quality Agreement signed can be a challenge,
the complexity of managing to the Quality Agreement is a much larger challenge.

For example, most Quality Agreements require notification of changes potentially impacting the product produced by the Third Party to be communicated to the company prior to implementation.  The reverse scenario is also true.  When the company responsible for developing and distributing the product makes changes to specifications or test methods, for example, the company must provide prior notification to the Third Party Manufacturer for implementation of the change.  Management of change — change control— is just one of the many QA Systems that must be executed between the two parties.  Other Quality System activities requiring information sharing, approvals, or decision-making include, but are not limited to:

  • creation of the Annual Product Review for drug products;
  • annual marketed product stability test results reporting;
  • test method validation and transfer;
  • deviation reports for non-conforming lots/batches;
  • CAPA;
  • quality complaint investigations; and, for devices,
  • design control documentation.

 

Executing the specifics of a Quality Agreement in a consistent,
robust manner is very, very complex. 

At worst, most Quality Agreements are approved, filed and never looked at until requested in an audit or until there is a significant quality issue impacting product supply which the companies must work together to resolve.

I have often seen the Quality Agreement implemented through a combination of “human-ware” and low tech software, aka e-mail.  Weekly conference calls held with a few company mid-level dedicated Quality staff and tens to hundreds of emails a week may be exchanged across multiple Third Party Manufacturing companies.  Any one of these emails might contain important or critical information in one to two sentences.  The opportunity for miscommunication leading to costly errors impacting product supply, patient/consumer product availability at the pharmacy or store shelf, and financial goals is very high.  At one time or another, I have observed or personally experienced all of these negative outcomes first hand.   Also, beyond the product, patient/consumer, and financial impacts is the lack of trust that builds up over time between the two parties and the individuals trying to collaborate across companies.

At best, I have seen lean, portal-based cloud-based software solutions between the companies that enable exchange of information, workflow approval of various document types, and shared metrics between highly-capable quality staff in each company.  In these instances, the business relationship between the company and the Third Party Manufacturer strengthens over time and the goal of having a strategic partner is achieved.  The financial and supply chain benefits of having a supply chain that fully leverages both internal and external capabilities is achieved.  Relationships are deepened between the contracting and partner companies.  Most importantly, the patient/consumer’s needs are met each and every time they experience the product.  “Product Quality” is an outcome and “compliance” is achieved through the creation of a robust, living Quality Agreement implemented through the use of lean, portal-based solutions by highly capable, empowered quality staff.

To read more about effective Third Party Management please see our White Paper on Third Party Supply Management:  Third Party Management White Paper.

To review a real life example of the use of lean, portal-based technical solution deployed between a company and its Third Party Manufacturers, please see our Case Study:   Annual Product Review Case Study.

If you would like to have further discussions on this, or other topics, please contact Teresa Gorecki at

Teresa.Gorecki@compliancearchitects.com or via mobile phone at +1-310-465-7285

Welcome To The Party Compounders!

Pharma EquipmentThe September 12 edition of the industry newsletter QMN Weekly contained an article about objections voiced by the International Academy of Compounding Pharmacists (IACP) concerning FDA’s July 2014 Interim Guidance for Human Drug Compounding Outsourcing Facilities Under Section 503B of the FD&C Act. As described in the newsletter, the compounding pharmacies, through IACP, are objecting to the new guidance based on certain portions of the guidance being “subjective” and “unclear”. The newsletter goes on to provide an example from the IACP of this subjectivity and lack of clarity on HEPA filters and guidance restrictions on HEPA filters that are “damaged, dirty or discolored”.

As I read this article, the first thing that popped into my head was:

balloons “Welcome to the Party Compounders!!”balloons

 

To someone who has been in the business of FDA-regulated product manufacturing for almost their entire career, it’s funny to see IACP complain about issues of subjectivity and lack of clarity with this “new” guidance.   First of all, I’ll take a guidance that says “replace HEPA filters that are damaged, dirty or discolored” any day of the week!   If THAT is their example of subjectivity and lack of clarity, good luck with things in the future – it only gets worse. Second, take a look at the guidance: Click Here.   Not only is this document not wholly subjective and lacking clarity – at least relative to current 21 CFR 211 and other FDA Guidance (e.g., the 2013 Guidance on Good Manufacturing Practices for Cosmetic Products), it is quite specific with respect to a number of considerations such as particulates, environmental monitoring program requirements and release testing.   Also though, there is a lot of information and guidance available on the topic of how FDA expects pharmaceutical manufacturers – now YOU compounders – to act and manage your operations.   It’s been close to 36 years since the 1978 GMPs were first introduced and there are many information resources, readily available, describing and detailing how FDA interprets and enforces manufacturing regulations and expectations. This information is easily extrapolated to the practice of “compounding.”

Quality and compliance practice within FDA-regulated industry is not just about finding answers in a book or on the Internet though.   You – the regulated company – have a lot of work to do.   And with that, it might be a good time to provide an important piece of information – a lesson as it were – to the IACP and the entire compounding industry:

In short —
it is NOT FDA’s job to tell you what you
should and shouldn’t do to “comply” with your specific manufacturing operations. 
It is YOUR job to:

  • fully and completely understand FDA’s Good Manufacturing Practice requirements and expectations, and
  • APPLY those requirements to your VERY SPECIFIC product formulation, delivery form and product risk profile based on therapeutic indication.   If you can’t or are unwilling to do this – you should not be manufacturing products for introduction into interstate commerce. And if you ARE willing, but don’t have the knowledge or experience, there are plenty of good consultants that would be more than willing to help you with understanding your role, responsibilities and obligations for meeting all of FDA’s requirements and expectations.

Since Drug GMPs Final Rule Image1978, pharmaceutical manufacturers have dealt with the skeleton structure of 21 CFR 211, the pharmaceutical GMPs, and the massive amounts of guidance and interpretation overlaid onto the regulatory structure by individual FDA investigators during enforcement actions.   Although the structures of this long-standing regulation and guidance, and the corresponding enforcement activities that flow from them, can be maddeningly challenging and complex, it has generally served the public health well for these 36 years.   The IACP and the compounding industry – if they want to restore any shred of credibility after the recent tragedies resulting from product quality failures – need to get on board with the FDA and the rest of the pharmaceutical industry and begin investing, learning and executing on improved quality management systems that are just beginning with this new, interim guidance.

Welcome to the Party!

CAPA – The Untold Story

Try as I might in my consulting work, I can never seem to get away from CAPA.    As much as I would like to help companies prospectively improve their process control;   embrace better quality system integration and document design;   assess and implement computer-based quality systems; and use process risk analysis to rationalize quality system decisions and improve inspection outcomes (among other things I love to do), it always seems like companies need help – and lots of it – with CAPA.

Now don’t get me wrong – I certainly understand the importance of CAPA, and why it is such a necessary system.     And all you have to do is read a few FDA Warning Letters or look at industry training offerings to see how significant CAPA is to the FDA, and as a result, to FDA-regulated industry.    And CAPA in its current form has been around a long time – at least since the 1996 formal effective date of the medical device Quality System regulation.     Unfortunately though, CAPA has gone far beyond being just an important sub-system that helps to resolve any one of those many, many things that can “just go wrong” for a manufacturer of FDA-regulated products.   CAPA has in recent years become the de facto cornerstone of FDA-regulated quality systems (with the expectation expanding far beyond just devices!)      Given this development, you have to ask yourself:    What does it say about the state of control within FDA-regulated industry that a system that is designed to remediate failures is now the cornerstone of most companies’ quality systems?     As troubling as the implications of this statement are, it is a topic I will leave to discuss another day.

That’s because today I want to talk about CAPA – The Untold Story.

REAL WORLD CAPA PROBLEMS

As I alluded to above, I see lots of CAPA systems.     Or better said, I see a lot of CAPA procedures.     Or more precisely, I see a lot of CAPA procedures masquerading as CAPA systems.        What I mean by that is – I see a lot of companies in their desire to have “an SOP” in place for CAPA, confusing the process of CAPA completion with the need to have a CAPA system of incident identification, analysis, categorization, evaluation, investigation, reporting, follow-up, etc.    In large part, because CAPA has become such a fundamental part of FDA’s regulatory expectations, the scope and extent of what we now call CAPA has grown along with it.    This growth in scope – by well intentioned Investigators looking to CAPA as the primary solution to a company’s problems, and by companies that are only trying to do the right thing by having a comprehensive CAPA program in place – is itself causing some of the poor outcomes with CAPA.   As scope increases, complexity often increases.    So despite the focus on CAPA – what’s wrong?   Why do many companies – solid, name companies in addition to small and mid-size companies – have such continuing trouble with CAPA? From what I see, despite this focus and good intent, there are many causes for poor CAPA system designs and compliance outcomes.  A few of these include:

  1. Failure to differentiate between the CAPA system and the CAPA execution process;
  2. Failure to describe in an easy to understanddocument or documents:
    • how the different elements  of CAPA work together;
    • how to define and differentiate trigger events; and
    • how the different elements  collectively contribute to the overall concept of control.
  3. Insufficient knowledge and lack of training for SMEs on how to document, investigate, analyze, and most importantly, write-up good, understandable CAPA documents;
  4. Overcomplicating the simple; and
  5. Trying to make CAPA something it is not (like Six Sigma/DMAIC) or failing to understand CAPA is a regulatory requirement – not something that you can adapt to your liking in the guise of something like “continuous improvement.”

As figure 1 below shows conceptually, there are a lot of inter-related elements to a good CAPA program, and using text based documents – SOPs – to describe how these inter-related systems work, and where process begins and system ends, can be a challenge.

CAPA System Integration

This is where the concept of “The Untold Story” comes into play…

THE UNTOLD STORY

So what do I mean by “The Untold Story?”    I mean – or better said I see (and this may be the biggest “duh” thing I’ve ever written)  – that many firms fail to communicate effectively in their quality and compliance documents.    And, nowhere is this more apparent than in the documents that define and constitute CAPA.

Initially, many of the CAPAs that I read are almost unintelligible!  They are filled with jargon , disconnected statements, proprietary acronyms, unsupported conclusions, data and statistics with no explanation, and often, internal inconsistencies.    Further, many companies have almost no idea of how the sub-process elements (or some would call “inputs”) of CAPA work together, much less are able to describe this effectively.      From this and a review of many other types of compliance documents (submissions, procedures, etc.)  I have come to believe that one of the most important failures in FDA compliance activities is the failure to communicate simply and effectively.  (2018 Update:  See Writing for Compliance®)

So what does this mean to CAPA?   Well, in my strong belief, good CAPA is nothing more than a good story – or better said, a series of related stories.    But why stories?     Why not a report?  Why not a quality record?   Why not an investigation protocol?    Why not a journal?

Well simply, because humans are hard-wired for stories!

It’s in our DNA – it’s in our genes.    From the water-cooler to the television;  from the dinner-table to the cinema;    from political speeches to the evening news, humans process communication best if it the communication takes the form of a story.   And with CAPA (like other FDA-required documents) why do we create these documents anyway?    Because we have to?   Well yes, but more importantly, we create them so that we can communicate – effectively – in this case to an FDA Investigator – what we do, and how we do it.

So if we want to communicate effectively to FDA, we need to communicate more stories.   We need both our CAPA system and our individual CAPAs to tell a story!

My experience has been extremely positive working with clients on this one simple concept.    Stories are actually pretty simple to write – and CAPA’s actually are perfectly adapted to follow the same basic structure:

STORY STRUCTURE1 CAPA STRUCTURE
Exposition:    Character /
Scene Development		 Background and Details of Event/Incident
Conflict / Rising Action Investigation
Crisis / Climax Root Cause Analysis
Falling Action / Resolution Corrective / Preventive Action

The application of a basic, simple story structure can help you immensely improve your technical writing for FDA compliance.   Clearly though, we are not writing childrens’ novels, or even adult fiction.   There will be references to SOPs, technical details, organizational structures, complex activities, etc.  However, when you place all of these complicated elements in the structure of a simple story, it becomes so much easier to understand than if you are forced to simply read, e.g.,  fishbone diagram outlining the factors in a root cause analysis without any context.   This type of writing will help FDA Investigators understand your operation, help you to know that your SMEs and responsible CAPA authors understand the issues associated with the failure, and overall, improve your compliance outcomes.  (2018 Update:  See Writing for Compliance®)

—————————–

For information on how to build sustainable FDA compliance with world-class CAPA programs for pharmaceutical, medical device and other FDA-regulated companies, please contact Compliance Architects® at info@compliancearchitects.com or at 888-734-9778.

1 Literary Elements (http://www.orangeusd.k12.ca.us/yorba/literary_elements.htm)

UPDATE: Free FDA GMP / QSR Ebooks for IPhone, IPad

This is an UPDATE to a post from May 2010.
Please click this link for the original post.

On Monday, June 21, Apple released the IPhone OS4.    This update to the Apple IPhone operating system added great new features such as multitasking, folders and more.    Also, along with this release, Apple released a great new application for the IPhone:   iBooks!

From the Apple website: “More than a great ebook reader,
iBooks is also an amazing place to browse and shop for books, day or night.”

In the original post from May 5, 2010, I advised how to get free FDA GMP/QSR Ebooks for the IPhone.   Although I thought that the instructions were pretty easy, with IOS4 and iBooks, the process of getting these is even easier! So, follow the instructions below, and check out the following FDA GMP/QSR Ebooks.    iBooks makes them look and function even better!

Let’s get started:

First, update your IPhone OS to IOS4.    This update is now available through iTunes for IPhone 3G and 3GS phones.    Next, download iBooks, which is a free download, from ITunes or directly from your IPhone or IPad using the App Store Icon.

Second, to download each individual eBook, right-click on each of the following links.   Select “Save Link As,”  and save the files, one by one, to a convenient location on your computer.    They take up very little space.   The file extension will be ” .EPUB ”

Third, launch iTunes.   Under the “Library” section of iTunes, click on the “Books” tab.    Using Windows File Manager, locate the .EPUB files in step two, and drag and drop them to the file list on the  “Books” tab.     Then, sync your computer with your IPhone and the new books will be installed as eBooks in iBooks.

Come back and get the next one when you want / need.   It’s that simple!

[su_box title=”UPDATE: PLEASE SEE OUR NEW RESOURCES PAGE” box_color=”#E35205″ title_color=”#fffcf2″]Please see our new RESOURCES page to download the most recent regulation eBooks for the iPad, iPhone and Android smartphone devices.[/su_box]

Please consider registering with our site to be notified of new, upcoming eBooks and articles of interest.    We will use this to keep you abreast new quality, regulatory and compliance information.

What other reference documents would you like to see in this eBook format? Please let us know, and we’ll try to get them developed and out to you ASAP!

We hope you find this useful, and if you like this, please send us a note (or consider giving us a call for your compliance advisory and consulting needs!).   Enjoy!

Webinar, June 23: Inspection Readiness for a More Aggressive FDA

Join the Center for Business Intelligence for a one-hour, information-packed webinar on managing FDA  inspections from a more aggressive FDA.   Now that pharmaceutical, medical device, dietary supplement, and biologics’ companies know that the FDA is back on the hunt for non-compliant companies, what can your company do about it?

The short answer is be prepared!

This webinar will provide background information, strategies, and approaches that will give you the best chance of success when the FDA knocks on your door!

I will be your presenter for this important 1 hour webinar!

Please go here to register:

CBI Webinar:  Inspection Readiness for a More Aggressive FDA

There is no substitute for preparedness when you are dealing with the FDA.   Do you know if you are ready for today’s FDA Investigator to knock on YOUR front door?

To get prepared for FDA inspections, or, to find out how well you would do if the FDA walked into your facility right now, please contact Compliance Architects® at info@compliancearchitects.com or call us at 888-734-9778.

Contact Us Today