Volume III

ROADMAP TO GMP COMPLIANCE

A division of UBM Americas

 A Roadmap to GMP
COMpliance PART 3
Quality Risk Management: State of the IndustryPart 1. Has the Industry Realized
the Full Value of ICH Q9? | Anne Greene, Kelly Waldron, and Nuala Calnan........................................................... 4

Mergers & Acquisitions: Managing GxP Compliance Through Integration and

Organizational Change | Eldon Henson and Whitney Sandberg........................................................................... 12

Structured GMP Audits | Carol Brandt . ............................................................................................................. 18

Moments of Truth: Creating a Quality Culture by Making Good Manufacturing

Practice a Lifestyle in Your Company | David Markovitz . .................................................................................. 23

The FDA Compliance Program Guidance for GLPs - General | Steven S. Kuwarahara ........................................... 26

Quality and Compliance in the Asian Pharmaceutical Industry | David W. Vincent .............................................. 30

Integration of Risk Management Principles into the Quality System: Risk-based

Impact Assessment | Kelly Waldron................................................................................................................... 36

Laboratory Self-Audits | Paul Pluta and Jerry Lanese......................................................................................... 43

Good Manufacturing Practice and Stable Systems - Part One: Reducing Stress
with the Power of Data - Know When to Act and When Not to Act | David Markovitz . ......................................... 54

Implementing an Effective GLP Program at the Contract Laboratory |

Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, and N. Knight ............................ 57

GXP Talk: Questions 66 & 67 | Jerry Lanese and Tim Fields............................................................................... 65

GXP Talk: Questions 68 & 69 | Jerry Lanese and Tim Fields............................................................................... 67

GXP Talk: Questions 70 | Jerry Lanese and Tim Fields . ..................................................................................... 69

GXP Talk: Questions 71 & 72 | Jerry Lanese and Tim Fields................................................................................ 71

2017 UBM, LLC All rights reserved.
Reproduction in whole or part is prohibited without prior written permission of the publisher. GMPQ7003
Anne Greene, Kelly Waldron, Nuala Calnan

Quality Risk Management: State

of the IndustryPart 1. Has the
Industry Realized the Full Value
of ICH Q9?
Anne Greene, Kelly Waldron, Nuala Calnan

ABSTRACT
This paper is the first in a series that explores the state of implementa-
tion of Quality Risk Management (QRM) in the pharmaceutical and
biopharmaceutical industries. A brief history of QRM in these indus-
tries with regard to ICH Q9 Quality Risk Management is offered, and
the high-level risk maturity model proposed by the Parenteral Drug
Association (PDA) is described. A comprehensive review of US and
Irish recall data and cGMP-related compliance/enforcement actions was
performed to determine whether those data provide insight into the
maturity of implementation of QRM in these industries and whether
the anticipated benefits of QRM have been realized. Results of this
analysis show that maturity in QRM is lagging and that the benefits of
QRM in terms of improved product quality and patient safety have not
yet been fully harnessed.

INTRODUCTION
the challenge ahead is significant the pharmaceutical community
has arrived at a cross-road; one path goes towards the desired state and
the other maintains the current state. The path towards the desired
state is unfamiliar to many while the current state provides the comfort
of predictability. [We hope] the pharmaceutical community will choose
to move towards the desired state. Food and Drug Administration,
2004 (1) .
Over a decade ago, a paradigm shift in the regulatory environment
surrounding the supply and manufacture of medicines emergeda
transition from traditional rule-based compliance to a modern risk-
based view of compliance. The traditional approach was characterized
by rigid conformity with regulatory statutes that defined the minimum
requirements necessary to ensure medicines were produced with the
appropriate quality, whereas the risk-based view tasked each manu-
facturer with the responsibility to develop a deep product and process
understanding and tailor their quality management systems through a
scientifically sound risk management framework. In the United States,
the initial mobilization towards a risk-based model was championed by
the Food and Drug Administration (FDA) through an initiative known
as Pharmaceutical Current Good Manufacturing Practices (cGMPs) for
the 21st Century. This initiative, announced in August 2002, sought
to enhance and modernize the regulation of pharmaceutical manu-
facturing and product quality by re-envisioning the underpinnings of

4 Special edition: A Roadmap to GMP Compliance Part 3


compliance through the lens of science and risk. (1)
The final report on this initiative, issued in Sep-
tember 2004, summarized the key accomplishments
since the 2002 announcement, including the estab-
lishment of risk-based inspection planning, change
review, and dispute resolution within the Agency,
among other deliverables. Most notably, the report
expressed FDAs desire to improve harmonization
of regulation through collaboration and knowledge
sharing with sister organizations throughout the
world. (1) Working groups in the International Con-
ference on Harmonization of the Technical Require-
ments for Registration of Pharmaceuticals (ICH) were
tasked with the creation of a risk- and science-based
quality systems model, later to materialize as a triad
of guidelines known as ICH Q8 Pharmaceutical De-
velopment, ICH Q9 Quality Risk Management, and
ICH Q10 Pharmaceutical Quality System. (2, 3, 4)
While the final report looked towards the future with
a sense of optimistic pragmatism, it also acknowl-
edged that further work must be done in order to
realize this vision.
The movement towards a science- and risk-based
approach to cGMPs was advanced with the finaliza-
tion of ICH Q9 in 2005, Q10 in 2008, and Q8(R2) in
2009. ICH Q8 described drug development concepts
commonly known as Quality by Design (QbD) in
which an intimate scientific understanding of the
product and its clinical utility is used, along with risk
management techniques, to define critical aspects of
the product and the enabling manufacturing process-
es. (2) ICH Q9 focused on defining a lifecycle process
for quality risk management (QRM), offering a list of
risk management tools that had seen success when
applied in other industries and describing potential
applications of QRM within pharmaceutical develop-
ment, manufacturing, and control systems. (3) While
the concepts set forth in Q8 and Q9 showed signifi-
cant theoretical promise, industry stumbled with the
application of these guidelines in the absence of an
overarching framework within which to apply them.
The concepts were finally synthesized in ICH Q10,
which established a quality systems structure to be
applied throughout the product lifecycle, enabled by
knowledge management and QRM. (4) The remainder
of this paper will focus on QRM as described in ICH
Q9 and its application in the quality system per ICH
Q10.
ICH Q9 introduced the concept of risk manage-
ment, which had been successfully applied in other
industries such as aerospace, nuclear energy, and
finance, to the pharmaceutical and biotechnology
arena by focusing on its application in the definition
Anne Greene, Kelly Waldron, Nuala Calnan
and assurance of medicinal product quality. Q9 notes
that the use of QRM principles and practices has
the potential to yield multiple benefits for patients,
regulators, and manufacturers alike. Such benefits
include:
Better assurance of product quality through pro-
active identification and mitigation of potential
risks
Improved compliance by enabling an under-
standing of the relationship between regulatory
requirements and the unique concerns of the
product or process
More informed and consistent decisions relative
to product quality (for realized/reactive risks)
and quality system process design
Potential reduction in the level or frequency of
regulatory oversight through improved commu-
nication and higher confidence in quality system
effectiveness (3)
This multi-faceted value proposition was both
ambitious and attractive, and the guidance as a whole
offered significant insight into the execution and
iterative nature of QRM.
To further characterize QRM application (as well
as the concepts laid out in ICH Q8 and Q10), and to
accelerate the learning curve relative to these guid-
ances, the Parental Drug Association (PDA) launched
the Paradigm Change in Manufacturing Operations
program in 2008 (5). One of several outputs of this
program was a comprehensive technical report aimed
at providing a detailed review of how QRM could be
implemented throughout the product lifecycle and
supporting quality system. The technical report de-
scribed the notion of a QRM maturity model, depict-
ing the general transition towards maturity associated
with QRM program deployment. This QRM maturity
model illustrated the expected growth phases as a
manufacturer gained comfort and confidence with
QRM:
Maturity Phase 1: No quality risk management
activities performed
Maturity Phase 2: Informal quality risk manage-
ment in place
Maturity Phase 3: Mostly retrospective and/or
corrective quality risk management in use
Maturity Phase 4: Prospective, preventive quality
risk management in use
Maturity Phase 5: Quality risk management inte-
grated throughout manufacturing operations and
quality systems (adapted from PDA Technical
Report No. 54, reference 5)
The QRM maturity model provided general direction
regarding the focus of a firm as they progress towards
a robust QRM programostensibly, with each suc-
cessive phase of maturity, a QRM program grows
Special edition: A Roadmap to GMP Compliance Part 3 5
Anne Greene, Kelly Waldron, Nuala Calnan
more efficient, effective, and pervasive throughout
operations and quality systems (5). While the model
can serve as a useful indicator of the maturity of
implementation at a given firm without measurement
against the model, it does not answer the question
of whether we have achieved the value proposition
offered in ICH Q9. Twelve years after the announce-
ment of the 21st century cGMP initiative and almost
a decade following the inception of ICH Q9 and these
questions remain:
Have we realized the full benefits of QRM?
Are we making better quality products?
Are we more compliant?
This paper describes research undertaken by the
Pharmaceutical Regulatory Science Team at the Dub-
lin Institute of Technology (DIT) in an effort to find
the answers.
RESEARCH METHODOLOGY
The research sought to provide a systematic review of
US and Irish product recall and compliance enforce-
ment data spanning the 2006 through 2013 time
period. This timeframe was selected based on the
potential to identify trends in product quality and
cGMP compliance following the publication of ICH
Q9 in 2005, through the most current period in
which a comparable data set (i.e. a complete year of
data) was available.
Data from the US was sourced from the weekly
enforcement report and warning letter databases
available through the Food and Drug Administration
website (6, 7). Drug recall data was reviewed in an ef-
fort to characterize product quality, and by extension
patient safety, over time. In the US, drug recalls are
divided as individual events, each assigned a unique
recall tracking number and associated classification
level based on risk to patient or consumer. While
most recalls are separated based on product presenta-
tion and dosage form, in certain instances (e.g., where
all products manufactured by a single firm in a given
time period were subject to recall) a single tracking
number was assigned to a portfolio of products. The
data reviewed and presented in this paper retains
the separation and classification as assigned by FDA,
including subsequent corrections for previously re-
ported data (e.g. expansion of recalled lots).
Warning letters issued by FDA for cGMP-related
concerns were selected based on the insight they may
provide into the industrys state of compliance over
time. FDA is charged with protecting public health
and as such has several levels of compliance enforce-
ment options available to facilitate this mandate (8).
Compliance observations noted during inspections
are summarized on a Form 483. Unlike the practice
in the European Union (EU), these observations are
6 Special edition: A Roadmap to GMP Compliance Part 3
not categorized according to criticality and, there-
fore, may not delineate the gravity of noncompliance
concerns as identified during inspections; in addi-
tion, access to individual Form 483s are not readily
available from FDA. Warning letters represent the
principal means of achieving prompt voluntary com-
pliance with applicable regulations and are typically
issued for significant violations of related statutes or,
in many cases, inadequate responses or commitments
from violative firms following the issuance of a Form
483 (9). Warning letters are posted to a public access
database and have the potential to offer a rich source
of information regarding noncompliance with cGMPs.
Various cross checks (e.g., database searches by year,
company name, warning letter category, product
type, and keywords) were performed throughout the
research period to assure the collected data were both
valid and comprehensive.
Data from the EU, particularly in the area of inspec-
tional observations, proved more difficult to retrieve,
despite allowances offered by the Freedom of Infor-
mation Act. As a result, the research focused on Irish
recall and quality defect data ascertained through
publicly available annual reports written by the
Health Products Regulatory Authority (HPRA; for-
merly the Irish Medicines Board) as well as research
assistance for this project provided directly by the
HPRA (10, 11). As the worlds largest drug exporter
and the hub of the Dublin Institute of Technologys
Pharmaceutical Regulatory Science Team (of which
the authors are part), Ireland is an attractive source
for European data (12).
All data were categorized and analyzed as discussed
in the Results and Analysis section of this paper.
RESULTS AND ANALYSIS
Procedure Development and Understanding
(Identify and Study Potential Analytical Vari-
ables)
One of the potential benefits of QRM is improved
product quality and resultant patient safety; indeed,
one of the primary principles of ICH Q9 is that QRM
activities should . . . ultimately link to the protection
of the patient (3). One indicator of trends in this area
is the number of recalls that may result from inad-
equate quality products reaching the marketplace.
Improvements in product quality, such as the ability
to meet specifications prior to drug product release,
should therefore, manifest as a reducing trend in the
number of recall events over time. Figures 1 and 2
illustrate the number of quality-related recall events
initiated from 2006 through 2013 in the US and Irish
markets, respectively.
As shown in Figures 1 and 2, an increasing trend is
apparent. Further analysis of US data reveals that in
 Anne Greene, Kelly Waldron, Nuala Calnan

peak recall years (2009 and 2011), seemingly isolated

2500 issues resulted in multiple recall events. For example,
Number of Quality- related

Penicillium spp. cross-contamination at a single firm

2000 (Aidapak Services) led to 1,021 recall events in No-
Recall Events

1500 vember 2011 while cGMP deviations in June and July

2009 led to 1,107 recall events from another manu-
1000 facturer (Advantage Dose LLC). While variables such
500 as improved detection of quality defects or increases
in volume of drug products on the US and Irish mar-
0 2006 2007 2008 2009 2010 2011 2012 2013 kets cannot be ruled out as contributing factors for
the trends seen, the data indicate that recall events
Year are increasingly common.
This led to examination of how the application of
Figure 1: Total Number of Quality-Related Drug Recall Events in the US,
2006 through 2013 (6)
QRM may have influenced these outcomes. Table I
listed the top three categories of recall events for each
year included in the research:

Table 1: Top Three US and Irish Recall Categories, 2006 through 2013 (6)
Number of Quality- related

200 * cGMP deviations is a classification for recall

events given by FDA. Information regarding the im-
150 pact of such deviations, or the specific nature of the
Recall

deviation, was not readily available from the Agency.

100 Annex II of ICH Q9 highlights potential applica-
tions of QRM that, when employed appropriately,
50 could be used to avoid these types of recalls.

0 2006 2007 2008 2009 2010 2011 2012 2013 For example, OOS release specification events
Year might have been prevented through the application
of QRM:
Figure 2: Total Number of Quality-Related Medicinal Product Recalls in
Ireland, 2006 through 2013 (10)

Special edition: A Roadmap to GMP Compliance Part 3 7

Anne Greene, Kelly Waldron, Nuala Calnan

to establish appropriate specifications, identify
critical process parameters and establish manu-
facturing controls (e.g., using information from
pharmaceutical development studies regarding the
clinical significance of quality attributes and the
ability to control them during processing) and to
decrease variability of quality attributes [to] reduce
product and material defects [and to] reduce manu-
facturing defects. (3)
Similarly, QRM could have minimized instances
of cross contamination, lack of sterility assurance /
sterility failure, and microbial contamination of non-
sterile products if used:
to determine appropriate zones when designing
buildings and facilities, e.g., [to] minimize contami-
nation, prevent mix-ups, and [to determine the need
for] dedicated or segregated facilities / equipment
(3).
in warning letters may refine the interpretation of
these data; however, such information is not readily
available from FDA.
A review of warning letters through the lens of QRM
reveals an increasing trend of citations against the
QRM programs and practices themselves, as shown
in Figure 4. This would indicate that many applica-
tions of QRM do not inspire confidence that the
manufacturing site has understood the current guid-
ance and regulations in a meaningful way within the
context of their individual operations.
While further research within industry is warranted
to identify and benchmark effective QRM programs
60

Total Number of cgmp- related

50
Though it is not clear in the context of these spe-
cific recall events whether QRM was ineffective or 40

Warning Letters
whether it was simply not used at all, the data dem-
onstrate that product quality (and potential patient 30
exposure to defective product) has not improved
20
since the inception of ICH Q9.
10
State of the Industry: cGMP Compliance
Another potential benefit of QRM implementa- 0
2006 2007 2008 2009 2010 2011 2012 2013
tion is reduced regulatory oversight, which may be
achieved through demonstration of quality system Year
effectiveness in the form of a robust QRM program Figure 3: Total Number of US FDA cGMP-related Warning Letters, 2006
(3, 4). When firms fully embrace the principles through 2013 (7)
and practices of QRM, incidences of breaches of
GMP, product quality deficiencies, and risks to
patient safety should reduce and compliance status
should improve. This should allow manufacturers
Number of cgmp- related Warning Letters with one

to demonstrate the enhanced effectiveness of their

pharmaceutical quality systems through the use of
or more Quality Risk management citations

meaningful measures of quality or quality metrics. 12

Improved quality outcomes for the products and site
in regard to numbers of deviations, CAPAs, custom- 10
er complaints, or evidence of a proactive self-inspec-
tion program would also confirm their increased 8
understanding of how to apply current guidance and
regulations in a meaningful way within the context 6
of their individual operations. 4
Figure 3 illustrates the overall number of cGMP-
related warning letters issued by FDA from 2006 2
through 2013. The increased numbers of compliance
enforcement actions since 2006 indicates that cGMP 0
compliance has not improved since the inception of 2006 2007 2008 2009 2010 2011 2012 2013
ICH Q9. Year
We acknowledge that further analysis of variables
such as the total number of GMP inspections con- Figure 4: US FDA cGMP-related Warning Letters with one or more QRM
ducted in each calendar year and the proportion of citations, 2006 through 2013 (7)
inspection observations (Form 483s) that resulted

8 Special edition: A Roadmap to GMP Compliance Part 3

 Anne Greene, Kelly Waldron, Nuala Calnan

that have not been subjects of warning letters, these

data confirm a gap between regulatory expectations
and current industry practice. This conclusion is re-
inforced with a review of the nature of the QRM cita-
tions. Figure 5 illustrates whether each individual ci-
tation indicates either an absence (i.e., failure to apply
QRM where warranted based on an individual event
or circumstance) or misapplication (i.e., inappropriate
use of QRM principles or faulty conclusions drawn as 18.2%
a result of QRM implementation). For example: Misapplied
Absent QRm: we note that your response
includes a commitment to retrain personnel,
revise procedures, and use of premade agar plates
to address [deficiencies in aseptic processing 81.8%
techniques]. Your response is inadequate because Absent
your firm failed to conduct a comprehensive risk
assessment of these poor aseptic process activi-
ties, and the inadequate environmental monitor-
ing program, to evaluate their impact on product
quality (13).
misapplied QRm: We are concernedwith
your risk assessment, which suggests that the
failure of these products to meet acceptance cri-
teria for defects during the 100% inspection has Figure 5: Type of Quality Risk Management Deficiency in US FDA
no bearing on the quality of the released units. Warning Letters Issued between 2006 and 2013 (7)
Please provide detailed information regarding
how you reached your conclusion (14).
An absence of QRM was cited in the overwhelming
majority of instances. This is striking considering 1.8%
that ICH Q9 has been available for nearly a decade. 3.6%
It would be reasonable to expect that sufficient time 5.5%
has elapsed to allow industry to overcome some of
the initial inertia inherent in any paradigm shift, even
one of the magnitude of transitioning from rule-based
to risk-based compliance.
Further analysis with respect to the QRM lifecycle
stage that was cited in the warning letter is similarly
informative. Figure 6 shows the proportion of cita-
tions for the various sections of the lifecycle: risk 89.1%
assessment, risk control, risk review, risk communi-
cation, or risk management as a whole.
The majority of citations indicate that risk assess-
ment, the first phase of QRM, was implicated.
Because QRM is an iterative process beginning with
a robust and science-based risk assessment, citations
in this area of the lifecycle are particularly concerning Risk Management
since it is unlikely that the remaining phases would
prove effective if built upon a faulty or absent risk as- Risk Assessment
sessment. No citations were given for the risk review Risk Control
portion of the lifecycle; if firms struggle to initiate
the QRM lifecycle and successfully complete a risk Risk Communication
assessment, it is likely that the risk review phase was
not reached, thus explaining the absence of citations
for this lifecycle phase. These data support the hy- Figure 6: Quality Risk Management Deficiency by Lifecycle Stage in US
pothesis that certain firms within industry are still in FDA Warning Letters Issued between 2006 and 2013 (7)

Special edition: A Roadmap to GMP Compliance Part 3 9

Anne Greene, Kelly Waldron, Nuala Calnan
the early phases of QRM maturity (i.e., no quality
risk management or informal quality risk manage-
ment) with challenges centered on the initial risk
assessment phase of the QRM lifecycle.
Another indicator as to the expected level of QRM
maturity from the perspective of FDA is whether
warning letter citations include reference to a focus
on reactive or prospective QRM implementation.
While it is broadly acknowledged that risk manage-
ment applied in response to a realized issue (i.e.,
reactive) can be helpful to get to true root cause and
plan and appropriate remediation strategy, most risk
management practitioners will assert that the full
value of QRM is achieved through proactive anticipa-
tion and mitigation of potential risks to ensure those
issues do not materialize (3, 5, 15). The PDA QRM
maturity model positioned reactive risk management
as a characteristic of a moderately mature program,
with more effective programs transitioning towards
a prospective and fully integrated focus (5). When
QRM-related warning letter citations are classified
by emphasis (i.e., prospective or reactive; Figure 7),
it is evident that industry shortcomings are primarily
focused on reactive QRM during the prior eight-year
period.
Examples of this emphasis are evident in the follow-
ing excerpts:
Please provide a copy of your investigation [sur-
rounding breach of data integrity through the
deletion of critical analytical data and backdating
records], along with your risk assessment regard-
ing the extent and impact of the missing data on
the quality of all finished drug products released
for distribution (16).
your firm failed to investigate numerous cus-
tomer complaints for several lots of [product]
concerning cracked vials your firms response
failed to include a risk assessment for the product
currently on the market (17).
your firm failed to conduct and document
a verification under actual conditions of use of
[multiple] laboratory test methods [in your
response] please provide a risk assessment
for possible impurities present in [lots of API
released to market] (18).
In these instances FDA is calling for the application
of QRM in situations where an impact assessment
might have been used traditionally, i.e., where the
full breadth and gravity of a cGMP-related event or
circumstance must be determined. This trend implies
that FDA expects industry to have mastered a moder-
ate (reactive/corrective) level of QRM maturity; there-
fore, a gap between the current state of industry (no to
low maturity) and FDA expectations is apparent.
While a comparable data set was not available from
10 Special edition: A Roadmap to GMP Compliance Part 3
30.9%
Prospective
69.1%
Reactive
Figure 7: Quality Risk Management Deficiency Emphasis in US FDA
Warning Letters Issued between 2006 and 2013 (7)
Ireland, excerpts from HPRA inspectional observa-
tions similarly indicate a gap in risk maturity. For
example:
With regard to the usage of the flexible isola-
tor / barrier for the dispensing of [material X] in
[room Y], there was no formal risk assessment
documented assessing the impact of the intro-
duction of the flexible isolator on pre-existing
activities in the room. (emphasis proactive, risk
assessment [11])
Following a risk assessment exercise that had
been performed in 2011 on the use of diaphragm
pumps at the site following a diaphragm pump
failure issue that had occurred at a sister site,
appropriate actions had not been taken to ensure
that the controls on which the risk had been
deemed acceptable in (Site) were effective
(emphasis proactive, risk control [11])
Without focused effort on behalf of industry, this dis-
parity may intensify as the FDA, European Medicines
Agency (EMA), and its member states continue along
the current path towards an increasingly risk-focused
regulatory model (19, 20).
CONCLUSIONS
This paper summarizes research designed to char-
acterize the current state of pharmaceutical and
biotechnology industries with respect to the adop-
tion of Quality Risk Management as per ICH Q9. The
research supports the hypotheses that the full value
of QRM with respect to product quality and patient

safety has not yet been realized. In addition, industry
appears to be lagging behind regulatory expectations
with respect to QRM maturity, indicating that cur-
rent approaches to QRM require significant improve-
ment. While causality has yet to be established, fur-
ther research in this area as well as the development
of more robust roadmap towards maturity may offer
additional insight into what is necessary to achieve
these goals. The next paper in this series will explore
this line of inquiry.
REFERENCES
1. FDA, Pharmaceutical cGMPs for the 21st Century A Risk-
based Approach. Final Report. September 2004.
2. ICH Q8 (R2), Pharmaceutical Development.
3. ICH Q9, Quality Risk Management.
4. ICH Q10, Pharmaceutical Quality System.
5. PDA Technical Report No. 54. Implementation of Qual-
ity Risk Management for Pharmaceutical and Biotechnology
Manufacturing Operations. 2012.
6. FDA, Enforcement Reports, http://www.fda.gov/Safety/
Recalls/EnforcementReports/default.htm, accessed July 3
through August 2, 2014.
7. FDA, Warning Letters, http://www.fda.gov/ICECI/Enforce-
mentActions/WarningLetters/default.htm, accessed June 1
through July 1, 2014.
8. FDA, About FDA. http://www.fda.gov/AboutFDA/Transpar-
ency/Basics/ucm192695.htm. Retrieved August 21, 2014.
9. FDA, Regulatory Procedures Manual, Chapter 4 Advisory
Actions. 2011.
10. HPRA (formerly IMB), Annual Reports, 2006 through 2009.
http://www.hpra.ie/homepage/about-us/publications-forms/
corporate-and-policy-documents. Retrieved June 23, 2014.
11. Extracted inspectional observations (anonymous) specifi-
cally related to observed QRM deficiencies provided by Dr. K.
ODonnell from HPRA on August 8, 2014.
Anne Greene, Kelly Waldron, Nuala Calnan
12. Looney, W. Irelands Celtic Tiger: Back on the Hunt.
Pharmaceutical Executive. September 1, 2014. http://www.
pharmexec.com/pharmexec/Europe/Irelands-Celtic-Tiger-
Back-on-the-Hunt/ArticleStandard/Article/detail/853390.
Retrieved September 22, 2014.
13. FDA, Warning Letter issued to Hemofarm A.D., June 20,
2012. http://www.fda.gov/ICECI/EnforcementActions/Warn-
ingLetters/2012/ucm310959.htm. Retrieved June 2, 2014.
14. FDA, Warning Letter issued to Jubilant HollisterStier General
Partnership, February 20, 2013. http://www.fda.gov/ICECI/
EnforcementActions/WarningLetters/2013/ucm341683.htm.
Retrieved June 2, 2014.
15. Vesper, James L. Risk Assessment and Risk Management in the
Pharmaceutical Industry: Clear and Simple. Davis Healthcare
Publishing International LLC, River Grove, IL. 2006.
16. FDA, Warning Letter issued to RPG Life Sciences Limited,
May 28, 2013. http://www.fda.gov/ICECI/EnforcementAc-
tions/WarningLetters/2013/ucm355294.htm. Retrieved June
2, 2014.
17. FDA, Warning Letter issued to Bracco Diagnostics Inc., Janu-
ary 31, 2012. http://www.fda.gov/ICECI/EnforcementActions/
WarningLetters/2012/ucm375606.htm. Retrieved June 21,
2014.
18. FDA, Warning Letter issued to Ercros S.A., June 20, 2012.
http://www.fda.gov/ICECI/EnforcementActions/WarningLet-
ters/2012/ucm310963.htm. Retrieved June 18, 2014.
19. FDA, Strategic Priorities 2014 2018. Draft for Public
Comment. http://www.google.com/url?url=http://www.fda.
gov/downloads/AboutFDA/ReportsManualsForms/Reports/
UCM403191.pdf&rct=j&frm=1&q=&esrc=s&sa=U&ei=dF
bzU9_ZKMvioASmnIG4Cg&ved=0CBQQFjAA&usg=AFQj
CNEvMy6uqINSw2C8tJ7rqhjIHzNclg. Retrieved August 10,
2014.
20. EMA, Road map to 2015. December 16, 2010. http://www.
ema.europa.eu/docs/en_GB/document_library/Report/2011/01/
WC500101373.pdf. Retrieved September 13, 2014.
Special edition: A Roadmap to GMP Compliance Part 3 11
Eldon Henson and Whitney Sandberg

Mergers & Acquisitions: Managing

GxP Compliance Through
Integration and Organizational
Change
Eldon Henson and Whitney Sandberg

ExEcutivE Summary
In todays world of record-breaking merger and acquisition activity,
management of change, especially relating to GXP compliance is essen-
tial. Many do this poorly with a reported failure rate of 70%. However,
the risks associated with integration can be significantly reduced with
proper planning and execution. This article outlines those key ele-
ments that can drive successful integration activities:
Planning
The Integration Roadmap
The Integration Playbook
Value Capture
Risk Remediation
Human Capital, and
GXP considerations
By developing a plan and working that plan, you can significantly re-
duce the risks and hurdles that can threaten the overall value expected
by these transaction.

iNtrODuctiON
According to Price Waterhouse and Coopers, the life science sector
experienced records levels of merger and acquisition activity and 2015
with over $400B in closed deals1. Higher numbers are expected for
2016. However, did you realize that, according to a number of sources,
most mergers are doomed from the beginning? It is estimated that
approximately 70% of mergers fail to achieve the overall value antici-
pated2.
Because of the challenges of mergers and the poor success rate
experienced, an entire culture and practice of integration management
has arisen designed to manage toward successful integration. Firms
create integration processes, information technology solutions, check-
lists, workplans, and every other tool to ensure that integration is not
doomed. Many have become so process oriented that they actually
believe just follow the process and you will not fail will guarantee
success. Others believe that keeping integration simple is the key.
Despite these formal approaches to integration, our experience is that
integrations are like snowflakes every integration is different. Thus,

12 Special edition: A Roadmap to GMP Compliance Part 3


you need to achieve that difficult balance between
formality and flexibility; processes and relationships;
systems and people.
McKinsey & Company estimates that those who do
integration well achieve as much as 6 12% higher
total shareholder return that those that do integra-
tion poorly3. Similarly, in FDA-regulated industries,
there are a number of examples of GXP compliance
issues that have arisen because important compliance
elements have fallen through the cracks during the
integration process.
Integration is a journey that should result in high
GXP performance, a reliable supply chain, outstand-
ing product quality, and fair product costs. Anything
less diminishes the return expected and harms the
business case that actually justified the acquisition/
merger.
In this paper, we outline some of the key success
drivers that can guide you to a successful integration.
By identifying and managing these key drivers, you
can predict better outcomes and higher shareholder
returns for these critical activities.
Planning, Planning, Planning
Despite the need to remain flexible and treat each
integration as a unique event, you must not neglect the
critical role that planning plays in a successful integra-
tion. The integration roadmap is comprised of four
Figure 1: INTEGRATION ROADMAP.
Eldon Henson and Whitney Sandberg
integration phases as follows:
1. PreClose to Close Phase
2. Interim Recognition Phase
3. Full integration Phase
4. Business Continuity.
Figure 1 below describes the duration of each phase,
respective goals, critical activities, and deliverables.
Planning in the Pre-Close Phase
Perhaps the most important thing we have learned
in our own integration effort is that involvement by
the integration team early in the process is critical.
In fact, we believe the best integration results occur
when the actual integration team is involved in the
due diligence process. By doing so, those individuals
charged with executing integration activities already
understand the deal model, the key risks, the key is-
sues to be addressed, and the critical success factors.
They will have an excellent understanding of the
business from their review of due diligence docu-
mentation and, from a GXP perspective, they will
know what potential compliance issues or concerns
are on the horizon. The integration team can begin
planning key activities for the subsequent phases
during due diligence and have an initial plan ready to
execute on the day of closing. When integration team
members are not involved in the due diligence phase,
you risk delaying integration activities (possibly, by
Special edition: A Roadmap to GMP Compliance Part 3 13
Eldon Henson and Whitney Sandberg
several months) or you risk missing critical compli-
ance activities that must be addressed.
Critical activities during this phase include:
Talent management Assessment and retention
of key talent is an activity that must begin early
in the planning process. In most cases, mergers
and acquisitions pose significant organizational
anxiety. As a result, good individuals often now
become more aggressive toward career options.
Identifying key talent and communicating future
roles and incentives to ensure retention can make
or break the integration process.
Governance and/or organizational structure As
quickly as possible, it is important to outline how
the new organization will fit into the new organi-
zation in total. Creating a vision of the new orga-
nization can aid both the integration team and
impacted individuals see their role and direction
toward the eventual merged team.
Knowledge exchange Early in the process,
preferably during due diligence, you begin
accumulating needed knowledge that might be
critical in the success of the integration. For
example, when an acquisition is made of early
drug development products, key individuals may
hold much of the knowledge needed for eventual
product approval and manufacturing. Identify-
ing this knowledge and capturing it is critical
early in the planning process.
Communication You cannot over-communicate
to both parties during the planning phase for
integration. Helping individuals and teams
understand what is occurring and how they fit
into the new organization is critical to early buy-
in and participation.
Value capture and/or business synergies Begin
early to identify the key value drivers for the
merger/acquisition. Knowing how the new
organization will drive key shareholder value
can guide future integration activities that may
ensure success.
Planning in the Interim Integration Phase
A number of key activities are essential during the in-
terim integration phase (that period between the deal
close and full integration). The first objective must be
to do no harm to the existing business. In many inte-
gration cases, failure occurs because the purchaser
attempts to consolidate too much too quickly that the
key business drivers are lost. For acquisitions with
complex supply chains, for example, care must be
taken to ensure business continuity through existing
and revised contracts, relationships, and business
processes. A failure to plan in these areas is a plan to
fail.
14 Special edition: A Roadmap to GMP Compliance Part 3
Critical activities during this phase include:
Systems requirements and alignment Some sys-
tems integrations may require extended time or
funding to fully integrate. Thus, early identifica-
tion and planning is essential. Identifying these
activities and beginning the planning process
should occur during this phase.
Regulatory/compliance requirements The key
success factor for many mergers or acquisitions
in GXP industries is remediation of compliance
concerns or navigation through regulatory pro-
cesses. Identifying these early may define overall
project success.
Talent assessment and organizational design
- From a business perspective, you must also
determine how the acquisition will fit into the
existing organization. For example, will the
new entity operate as a separate entity or will it
be incorporated into an existing business group
(e.g., division or commercial function)? Under-
standing this and the key business drivers will
determine the level of integration required before
and after the deal close date.
Development of full integration plan - Identifying
the team members from each side of the deal to
drive the integration process is also a key activity
executed during this phase. Selection of indi-
vidual team members is critical as it possible for
an integration process to fail simply because of
poor relationships between parties. This team
should develop the specific actions, target dates
for completion, and individuals responsible for
the integration that will define and drive success.
Planning in the Full Integration Phase
Once the preliminary integration principles and activi-
ties have been outlined and the deal has closed, you
progress to the full integration phase. By this time,
you understand the key business drivers and how val-
ue of the acquisition will be captured. In this phase,
you are executing the integration activities outlined in
the interim integration phase. The integration team
is performing and the business is shifting to the new
normal operating mode.
Critical activities during this phase include:
Execution of the full integration plan At the full
integration phase, the primary activity is to simply
execute the plan already developed. Processes to
monitor and guide progress (e.g., typical project
management oversight activities) will be required.
Functional area policy/procedure alignment It
may be necessary during full integration to begin
aligning policies and procedures to reflect the
new normal for the organization.
Systems integration Full integration of systems

(e.g., SAP for example) may take months or years.
Monitoring these activities and ensuring processes
exist to drive progress are essential.
Implementation of organizational design At
this point, final implementation of the new orga-
nizational design should occur. Involvement
of Human Resources personnel should have
occurred earlier to ensure that key talent are
retained.
Planning for Business Continuity
Finally, as the primary integration activities are be-
ing completed, planning for the ongoing business and
business continuity must occur. In this phase, you
are executing new contracts with suppliers, working
to enhance business flexibility, removing redundan-
cies, and improving both operational and financial
performance. It is during this phase that you begin
realizing the value the drove the deal business case.
Critical activities during this phase include:
Routine operation per business plan At some
point after full integration, the merged/acquired
entity should be under all the same normal busi-
ness processes that govern other businesses.
However, some activities, such as metrics, may
take a full year planning cycle to fully imple-
ment.
Identification of synergies/redundancies By this
phase, you should understand what synergies
may be possible through the new organization.
Working to align activities and eliminate redun-
dancies should now be ongoing.
Continuous improvement As with any activity,
continuous improvement should be an ongoing
success driver. Execution of improvement activi-
ties and identification of new opportunities can
drive further value from the merger/acquisition.
In short, planning for integration must involve
more than the deal close. It must include the busi-
ness case for the acquisition, the basic business im-
peratives that provide the expected value, the actual
execution of the integration to realize that value,
and the ongoing continuity of the business after it
has been normalized into the operation. A failure to
properly plan in any of these stages can hamper the
overall success of the integration.
iNtEgratiON PlaybOOk
Most companies that have been successful in integra-
tion activities have developed an integration playbook
that guides their efforts. A playbook for integration
is essentially the same thing as the playbook used
by sports teams. It is a plan that includes repeatable
end-to-end processes and specific merger/acquisition
Eldon Henson and Whitney Sandberg
activities or technologies (e.g., biologics, CMO-man-
ufactured, solid dosage forms, etc.). The playbook
includes:
Stage gates (stopping points at which an assess-
ment of progress occurs, solicitation of additional
resources, and modifications of the plan, as
needed)
Role owners and responsibilities for key activities
Core teams, members, and responsibilities
Checklists
Documentation requirements
Risks
Process maps
Performance objectives (a necessary component
for ensuring accountability for key deliverables
AND to monitor progress toward full value cap-
ture)
However, as occurs in sports, the playbook only out-
lines what we know and the capabilities we have. Ev-
ery integration process is unique, thus, flexibility and
the ability to shift activities, resources, and priorities
is essential for a successful integration.
valuE caPturE
Organizations often struggle to maximize the po-
tential value during the integration because work is
not planned around key value drivers. A complete
evaluation of the supply chain, operations, quality
network, and corporate or strategic initiatives is nec-
essary to fully realize synergies that either maintain
or enhance the value of the merger/acquisition.
Process maps can often be useful tools for identify-
ing potential synergies. Lets look at an example. In
one merger, the classical distribution process was
used by the acquiring company. That is, the supply
chain bundled shipments for numerous customers for
regular shipment to a distribution partner. How-
ever, the acquired firm shipped product directly to
the customers every three months from an on-site
distribution center. By looking at potential synergies,
the combined company was able to include the new
products in their bundled shipments to reduce distri-
bution handling and shipment costs with no adverse
impact to customers or service.
Capturing the total composite value of a merger/ac-
quisition requires collaboration, openness to change,
and a realization that change is required. By truly
seeking the best practice across the new combined
company, the elimination of redundancies and a
culture of continuous improvement can come quicker
and be done more effectively.
HumaN caPital riSkS: culturE iS kEy
Integration is not risk-free. Perhaps the most signifi-
Special edition: A Roadmap to GMP Compliance Part 3 15
Eldon Henson and Whitney Sandberg
cant risk (and, reason for the failure of integration
efforts) is a failure to properly consider and integrate
competing or diverse cultures. The result is a loss of
human capital, either through undesirable attrition
or disengagement.
So, what are the key factors to fully retain the
benefit of the human capital resulting from a merger
or acquisition? Successful firms consider the fol-
lowing 5 key elements for blending cultures during
integration:
Understanding the values both firms have in
common
Understanding the differences in values that
drive each
Collaborating to establish combined values
Identifying the right leaders to drive the com-
bined/new culture
Engaging the new workforce around the com-
bined/new culture
For these steps to be successful, engagement from
both parties is required. Establishing a new culture
cannot be a one-sided effort. It also cannot be a top-
down effort. Someone once said,
Culture is defined as the worst behavior that the
leader allows to occur in an organization.
Culture is not what you say, but what you do.
Thus, it is imperative that you ensure that actions to
back-up the desired culture are created, nurtured,
and uncompromisingly enforced.
Following are a few learnings we have identified
that define in the early days of an integration what
kind of culture is likely to emerge:
How is the leadership of the acquiring firm
viewed? Is that leadership viewed as trustwor-
thy, open, and forthcoming?
Is there a strategic vision and strategy that
makes sense in the newly combined company?
Can each employee, especially for the acquired
firm, see how they fit into the newly combined
firm?
Does the acquiring firms actions back up their
words around compliance, quality, and safety?
What objectively proves this commitment?
Are people held accountable for results? Is per-
formance valued over behaviors?
Are employees rewarded for creative thinking?
Are employees reprimanded for taking risks?
Open and frank discussions around these ques-
tions can set the stage for productive collaboration
as the integration progresses.
cOmmENtS ON gxP cOmPliaNcE
Throughout the integration process for GXP prod-
ucts/processes (from due diligence through full
integration), considerations for compliance must be
16 Special edition: A Roadmap to GMP Compliance Part 3
made. Identification and remediation of existing
compliance issues can be costly, delay product intro-
ductions, or hamper customer service/satisfaction.
Realizing the ultimate value of the deal can hinge on
the avoidance of costly GXP issues.
So, what are some key considerations for manag-
ing GXP compliance risks?
Encourage open discussions at the earliest stage
possible regarding existing or potential GXP
concerns the earlier you know about these
risks, the better opportunity to prepare resourc-
es and financing to correct them
Share compliance enhancement plans across
entities compliance is one area that should
facilitate an early success regarding collabora-
tion and synergies
Encourage cross-functional and cross-company
learning often, the new acquired company has
technologies that are new to the acquiring com-
pany take advantage of these as collaborative
learning opportunities
Share GXP expertise often, experts from one
entity can provide immediate benefits to the
other
Ensure that emerging GXP issues (such as data
integrity, metrics, etc.) are discussed, shared,
and fully engaged as early in the process as pos-
sible
GXP compliance is one that should foster sig-
nificant common ground and common interests
between companies. This should allow early and
deep collaboration to help drive compliance up and
risks down.
cONcluSiONS
The failure rate for firms to realize the expected value
from mergers and acquisitions is staggering. Howev-
er, we must not resign ourselves to that fate. It is pos-
sible to realize or exceed the value of these transac-
tions, but the appropriate approach must be exerted.
Realizing that a merger or acquisition can be a time
of significant change for quality and manufacturing
organizations, developing a plan to properly integrate
the acquired organization into the new combined
organization is essential. By creating a roadmap with
specific planning activities in each phase of integra-
tion, you can significant reduce the risks and hurdles
to value capture that have plagued so many others.
Integration activities also do not come risk-free.
Identifying and remediating these risks early in
the integration process can help avoid pitfalls that
increase costs, impart delays, or impact business con-
tinuity after the deal has closed. In every integration,
consideration for people and relationships can be the
difference between success and failure.

GXP considerations must be included in any
merger or acquisition impacting healthcare industries.
Identifying opportunities and including compliance
enhancement into the planning and execution plan
can set the tone early for a smooth and collaborative
integration.
Integration of mergers and acquisitions can be
successful. Hopefully, we have outlined many key
considerations that can drive value for your future
initiatives.
Eldon Henson and Whitney Sandberg
rEFErENcES
1. Drone, Dimitri, and James Woods. Pharmaceutical and life
sciences. PwC. N.p., Feb. 2016. Web. Sept. 2016.
2. McMorris, Esther. Why do up to 90% of Mergers and Ac-
quisitions Fail? Business Review Europe - European Business
Magazine & Website - European Business News. N.p., 28 Jan.
2015. Web. 05 Aug. 2016
3. Doherty, Rebecca, Oliver Engert, and Andy West. How the
Best Acquirers Excel at Integration. McKinsey & Company.
N.p., Jan. 2016. Web. 14 Sept. 2016.
Special edition: A Roadmap to GMP Compliance Part 3 17
Carol Brandt

Structured GMP Audits

Carol Brandt

ABSTRACT
Although Good Manufacturing Practices (GMP) audits are common
both for internal and external customers, a structured approach to
planning and execution can result in a successful well-executed audit.
There are a variety of audit types (GMP baseline, GMP risk-based, due
diligence, product-specific, procedures, area-specific, etc.) that may be
scheduled for a variety of reasons (preventative or remedial, Regulatory
Agency findings, inspection readiness, product or process failures, com-
plaints, deviations, routine assessments of systems, etc.). The proper
planning, management, facilitation and execution of an audit are criti-
cal to a successful audit. A complete and concise report of the exercise
provides maximum benefit to the customer.

INTRODUCTION
GMP audits are an important activity in a site compliance program.
An organization that initiates a GMP audit has clear objectives and
expectations for the audit.A significant amount of time, personnel
effort, and cost is expended in a GMP audit.Audits that are properly
planned, structured, and executed should yield maximum benefit to
the organization.A successful audit will result in the appropriate level of
coverage, clear direction, guidance, communication, controls, appropri-
ate auditor skills for the respective site areas, clear observations, good
recommendations, and customer satisfaction that audit objectives and
expectations are met.
A properly planned audit should be carefully structured to comprise
several defined activities.These include:
Customer communication. Customer objectives set the objectives,
tone, focus, and technical scope for the audit.
Auditor selection. Competent auditors with appropriate expertise
(technical, regulations, industry practices, etc.) must be selected.
Multiple auditors may be required to successfully audit widely
divergent technical areas.
Audit planning. Early communication and sharing of any manufac-
turing, facility, and customer information.A proposed agenda and
audit focus is determined.
Audit preparation. The proposed agenda is reviewed with the
customer to finalize specific audit activities.Site documents to be
reviewed in the audit are requested.
Audit execution. The actual audit is performed as planned and pre-
pared in prior discussions.
Audit report. Results of the audit are communicated to the cus-

18 Special edition: a roadmap to gmp compliance part 3


Figure 1: Structured Audit Approach
tomer.
Figure 1 describes the sequence of activities in a
structured GMP audit.
CUSTOmeR COmmUNICATION
The customer requesting an audit may be a client,
internal department, or external group or firm.
Understanding the customer reasons and concerns
must set the tone for the focus of the audit.If client
Carol Brandt
is external, ensure a Confidential Disclosure Agree-
ment (CDA) is in place before the final audit planning
since a customer may be reluctant to disclose known
internal issues.
It is critical to understand the basis for the audit.
For examples, audits may be routine, voluntary, prior
to merger or purchase, product or process failures/
focus, deviations, complaints, Regulatory-Agency
driven, and other types. Pre-audit discussions must
include participation from customer compliance or
Quality Assurance (QA) contacts. It is fairly common
for initial customer contacts to be with executive
management or with operations management repre-
senting the site who may not have a strong Quality/
Compliance background. These individuals may not
be able to clearly express any compliance-related
concerns and focus for the audit.
Mock audits may be conducted to prepare and
make ready a site for a future regulatory agency audit.
These mock audits require a trust-based relation-
ship between the customer and auditors to ensure
all potential risk areas are addressed without bias or
prejudice. The customer is provided with a complete
report that identifies areas of compliance risk before
they become investigation findings or present a risk
to product safety at the completion of the mock audit.
A firm date and time should be set as well as the
duration of the audit and number of auditors.Specific
and special needs of the customer should be identi-
fied, such as internal resource issues when multiple
systems are audited concurrently.
AUDIT TypeS AND AppROACh
General pharmaceutical Good Manufacturing
Practices (GMP) audits, risk-based assessments, due
diligence, and baseline audits contain many of the
same requirements for audits. These audits may vary
in length of time, depth of the audit, number of audi-
tors, and perhaps focus. They may be limited to a
specific product, area, or procedures. There are many
different approaches to performing audits. One of the
more common approaches is to take a systems ap-
proach in assessing the six systems described in the
FDA Code of Federal Regulations, Good Manufac-
turing Practices:
Quality Systems
Facilities and Equipment System
Materials Controls System
Production Controls System
Packaging and Labeling System
Laboratory Controls System
Sub-systems would include any requirements listed
in the CFR within the above system categories. For
example, a facilities and equipment system audit
Special edition: a roadmap to gmp compliance part 3 19
Carol Brandt
might assess the following sub-systems: Physical fa-
cility space, maintenance and repair function, utilities
qualification, temperature/humidity controls, equip-
ment qualification, cleaning validation, and other
related systems.
Audits should be conducted for compliance with
21 CFR Parts 210/211/11, ICH (International Confer-
ence on Harmonisation) Q10, Pharmaceutical Quality
Systems; ICH Q9, Quality Risk Management; ICH
Q8, Pharmaceutical Development; and any relevant
US FDA Guidances such as process validation, stabil-
ity, Active Pharmaceutical Ingredients (APIs), aseptic
manufacturing, and so on. Additional requirements
for compliance with any international regulatory
agencies should be clarified with the customer.
AUDITOR SeleCTION
Auditors should be subject matter experts (SME)
with focused areas of expertise. It is rare to identify
someone who has the technical qualifications and
can successfully audit all of the systems listed above
with a comprehensive knowledge of the require-
ments, industry practices, and regulatory guidance
recommendations. This expertise should extend to
the customer products manufactured oral sold dose,
API, sterile products, OTC (over-the-counter), etc.
Also extremely important are the personal commu-
nication skills of the auditors. An audit is not based
on opinion or preference, but on compliance with
the regulations and guidance documents. An audit
should ultimately result in knowledge transfer from
the SME to the customer in a partnering, helpful, and
non-threatening fashion.
With the more common audit addressing the six
systems, and the most common risk-based audit
being conducted in 3-5 days, the best results for ap-
propriate SME coverage are by assignment of at least
three auditors. All of the auditors should be experts
in the regulations and their applications, and have
years of auditing experience. For any audit includ-
ing a laboratory, one of the three auditors must be
a chemist. The remaining five systems should be
divided among the auditors based on their qualifica-
tions, capabilities and experience. All must have GMP
expertise and working knowledge of their specific
expertise and applications.
Oral solid dosage and aseptic manufacturing may
require specific skills and expertise in production
and facilities. An auditor with technical microbiology
background should be engaged to conduct the micro-
biology lab audit for aseptic processing.
Once auditors are selected and audit dates are con-
firmed, copies of the respective auditor CVs/resumes
and auditor contact information are provided to the
customer.
20 Special edition: a roadmap to gmp compliance part 3
AUDIT plANNINg
Early communication and sharing of any manufac-
turing, facility, and customer information with the
auditors is a key to the success of the audit. Plan a
conference call with the auditors ahead of the audit, for
which customer background has been provided in ad-
vance of the call. Assign a lead auditor to provide audit
guidance and cohesiveness of the audit team, answer
auditor questions, report concerns, and act as primary
communicator between the customer and the team. A
draft agenda should be reviewed with the auditors for
the opportunity to identify additional areas of con-
cern or focus to be assessed. Timing should also be
reviewed with the auditors to ensure they are comfort-
able with the time allotted to each area. Preliminary
responsibilities should be assigned and discussed.
It may be beneficial to mix responsibilities across
systems based on technical qualifications. This should
be clearly delineated, documented and shared with the
auditors to ensure the responsibilities are understood
and the sub-system assessments are fully covered.
AUDIT pRepARATION
Audit preparation based on above plans is the next
phase of the structured audit.Once finalized, the
proposed agenda is provided and reviewed with the
customer for comment. The agenda should include a
brief overview presentation of the site and products
by the customer and a tour of the facilities to fully
acclimate the auditors. Each audit day should end
with a status meeting with auditors and appropri-
ate site personnel. The schedule should include time
for auditor preparation prior to end-of-day wrap-up
discussions. The end-of-day discussions present the
most significant findings and observations from the
day to the customer.
A brief list of documents for the customer to
provide to the auditors ahead of the audit and during
the audit should be developed. This will allow the
auditors to come prepared and allow the customer to
begin retrieving documents. One of the most help-
ful documents is an organizational chart to identify
responsible heads of the systems groups. Past inspec-
tion reports and responses can be beneficial to under-
standing the areas of highest compliance risk. Each
auditor must devote a few hours of time ahead of the
audit to prepare and review for the audit.
The agenda is finalized and distributed to the
primary customer contacts and auditors prior to the
actual audit day. Final dates, location, times and con-
tact information are distributed to all involved.
Detailed checklists should be prepared which
follow the GMP requirement sections in the CFR to
assess the quality system sub-systems. These may be
tailored to focus on potentially problematic areas for

the customer if applicable. For example, if commit-
ments have been made in the past two years to a
Regulatory Agency, it may be beneficial to include a
review of the status of those commitments for veri-
fication of completion. Checklists should be further
tailored for the audit type. Shorter risk-based and
due diligence audits will focus on the areas of highest
potential compliance risk. This requires the preparer
to have a full understanding of the customer compli-
ance status, as well as knowledge of industry compli-
ance trends and regulatory agency key focus points.
A well-structured checklist ensures that all scheduled
sub-systems are assessed and there is appropriate
coverage of the topics defined by the audit type and
focus.
AUDIT exeCUTION
Actual performance of the audit as planned and pre-
pared is then initiated.It can be beneficial for the au-
ditors to meet in person ahead of the audit to discuss
any concerns and additional questions they might
have. If external auditors, they should arrive on
site together and plan enough time to sign onto the
site in advance of the scheduled start time. Internet
connections should be available to them when they
arrive and set-up time should be allowed to minimize
disruptions when the audit starts.
Unless the customer prefers to lead the opening
meeting, the lead auditor should be prepared to initi-
ate the audit. This should include brief introductions
from auditors and customers. The auditors should
focus on relevant background, expertise, and areas
each will be involved in assessing. A review of the
agenda and responsibilities with all involved should
be performed.
The auditors should provide additional lists of
documents required for review in their relevant areas
to their customer contact at the beginning of each
audit day. The status of each of the documents re-
quested, when requested, and when received should
be documented. All site procedures should be readily
available to all of the auditors on day one of the audit.
Rapid retrieval of information is an important factor
in Regulatory Agency audits.
The auditors must maintain a list of documents
reviewed by title, number, version, and effective date
for listing in the final report. It is recommended that
the auditors address higher compliance risk sub-
systems first in case more detailed review is required
requiring more the originally allotted time. Time
constraints may then preclude auditing of other areas
as previously planned. The lead auditor should be
kept informed of the status of such constraints if sub-
systems must be re-assigned during the audit.
A review of the audited area standard operating
Carol Brandt
procedures (SOPs) is necessary to understand the
customers requirements. If not compliant with regu-
latory requirements or agency guidances, this should
be noted as a finding. Evidence of the execution of
the SOPs must also be reviewed to ensure the SOP is
being followed in practice. Any SOPs, records, logs,
other documents reviewed as supporting evidence
must also be identified. While conducting the audit,
ensure that documented evidence of any findings are
reviewed and references noted. Findings related to
observations must be referenced by document title,
date, area, and book and/or page number such that
the customer is able to locate and correct the observa-
tion as applicable. Too many audits draw conclusions
about the compliance of a system without looking
beyond the SOPs to the actual execution of the SOPs
in practice.
Thorough audits cannot be conducted solely from
a review of documentation unless such limited focus
is specifically requested. Plant walk-throughs can
uncover a host of problems not evident unless the
auditor is actually present on the plant floor or in the
laboratory. Physical maintenance, operational cross-
contamination risks, people flow and gowning, materi-
al and product flow, and storage issues may be readily
identified but only if the auditor devotes sufficient
time to the actual operations area. Discussions with
and observing activities of operators and analysts can
also identify processes which are not represented in an
SOP or activities which are not compliant.
A daily wrap-up meeting each day is recommended
to review significant findings of the day. The meeting
ensures that the customer understands the nature of
the findings.It also provides the customer an oppor-
tunity to refute any findings with additional informa-
tion that might not have been originally available to
the auditors.
AUDIT RepORT
The audit report provides finding of the audit team
for review and initiation of remediation by the cus-
tomer. The lead auditor should obtain copies of the
facility/product overview presented by the customer
at the beginning of the audit. This may be sum-
marized in the report to include a description of the
facility, types of products manufactured, previous
regulatory agency inspection dates, and any other
pertinent information audit information.
Each finding should be accompanied by document/
record evidence of the inadequacy or non-compliance
associated with the observation as applicable which
require a review of associated records. The finding
must be stated as a finding -- not a recommendation
-- and based on clear, referenced evidence. Some
customers prefer to have the regulatory reference pro-
Special edition: a roadmap to gmp compliance part 3 21
Carol Brandt
vided in the report as well. Auditors should take care
not to provide a personal opinion. It may be that the
typical industry practice is to implement a process in
a certain way, but if the customer process is different
and compliant, it is simply a personal opinion and
not a requirement.If industry practice differs from
the manner in which the customer performs a task, it
might be noted by the auditor as a consideration but
not cited as a regulatory finding.
Findings should be identified individually and
categorized is a risk manner (minor, major, critical or
low, medium, high) depending on the customers re-
quirements. Each finding should be accompanied by
a recommendation for action to be taken to mitigate
the finding. The more detail that can be provided in
the recommendations relative to actions required, the
more benefit to the customer, and the easier it is for
the customer to generate a corrective action plan from
the report details.
The report is combined from respective auditor
inputs and reviewed to ensure findings are based
solely on regulatory requirements and not on audi-
tor opinions. Any inconsistencies are reconciled and
overlaps combined. For example, a review of the
deviation management process in the quality system
may result in the conclusion that the system might
not be fully compliant based on the SOP and records
reviewed, while a sampling of selected production
system-specific deviation records may have been
properly reported and investigated.
Sub-systems that could not be addressed due
to time constraints but were listed on the original
agenda should be identified in the report.
Since many audit reports can be quite lengthy
based on the areas covered and number of findings,
an executive summary is beneficial to customer man-
agement who may require a high level brief reporting
of the critical findings.
22 Special edition: a roadmap to gmp compliance part 3
CONClUSION
Consistent, well-planned, and executed GMP audits
not only provide the auditors with the necessary
structure to ensure all required areas are assessed,
but also benefit the customer for the same reasons.
From one audit to the next, even if the focus is ad-
justed, similar materials may be used with the same
approach. Standardizing and structuring the man-
ner in which the audit is planned and executed can
ensure consistent, successful, and beneficial audits
and reports.
ReFeReNCeS
1. Code of Federal Regulations, Title 21 Food and Drugs (Govern-
ment Printing Office, Washington, DC), Part 210..
2. Code of Federal Regulations, Title 21 Food and Drugs (Govern-
ment Printing Office, Washington, DC), Part 211..
3. ICH (International Conference on Harmonisation of Technical
Requirements for Registration of Pharmaceuticals for Human
Use), ICH Q10 Pharmaceutical Quality System, June, 2008..
4. ICH (International Conference on Harmonisation of Technical
Requirements for Registration of Pharmaceuticals for Human
Use), ICH Q9 Quality Risk Management, November, 2005..
5. ICH (International Conference on Harmonisation of Technical
Requirements for Registration of Pharmaceuticals for Human
Use), ICH Q8 Pharmaceutical Development, November,
2007.
6. FDA, Guidance for Industry Process Validation: General
Principles and Practices, (Jan, 2011)..
7. FDA, Guidance for Industry Drug Stability Guidelines, (Dec,
2008).
8. ICH (International Conference on Harmonisation of Technical
Requirements for Registration of Pharmaceuticals for Human
Use), ICH Q7 Good Manufacturing Practice Guide for Active
Pharmaceutical Ingredients, November, 2000..
9. FDA, Guidance for Industry Sterile Drug Products Produced
by Aseptic Processing Current Good Manufacturing Prac-
tice, (Sept, 2004).
 Anne Greene, Kelly Waldron, Nuala Calnan

Moments of Truth: Creating

a Quality Culture by Making
Good Manufacturing Practice a
Lifestyle in Your Company
David Markovitz

The late management consultant, educator, and author Peter Drucker

said, Culture eats strategy. Culture equates to the habits of the people
who work in the organizationhow they behave on a daily basis.
The late quality guru W. Edwards Deming said, People work in the
system, management works on the system.
So, if we want to create a culture where quality is paramount, then
management must create a system that encourages and rewards people
to do the right thingall the time. Thus, we can have a culture of qual-
ity.
Consider a Gallup survey published in June 2013 (1):
Seven out of 10 workers have checked out at work or are ac-
tively disengaged, according to a recent Gallup survey. The survey
classifies three types of employees among the 100 million people
in America who hold full-time jobs. The first is actively engaged,
which represents about 30 million workers. The second type of
worker is not engaged, which accounts for 50 million. These
employees are going through the motions at work. The third type,
labeled actively disengaged, hates going to work. These workers --
about 20 million -- undermine their companies with their attitude,
according to the report.
Here is an example of how one company is addressing the issue of
not engaged and disengaged workers. In April 2014 Amazon chief Jeff
Bezos, in a letter to the company shareholders, revealed what has to be
the most counterintuitive personnel policy in corporate America today:
If an employee isnt happy working at the online retail giant, they can
earn up to $5,000 just for quitting.
The goal is to encourage folks to take a moment and think about
what they really want, Bezos explains. In the long-run, an employee
staying somewhere they dont want to be isnt healthy for the employee
or the company. (2).
Amazon is giving the rest of us an interesting viewpoint of business.
This action is sending a message to everyone working at Amazon, or
who may be looking to work at Amazon, that they want you on the
team only if you are willing to be actively engaged in your work. The
hiring and selection process is highlighted here as a process critical to
the success of the company.

Making a Difference
Those people who are actively engaged in their work are not only work-
ing for a paycheckthey are working to make a difference.

Special Edition: a roadmap to gmp compliance Part 3 23

Anne Greene, Kelly Waldron, Nuala Calnan
The industries regulated by the US Food and Drug
Administration have an advantage over most other
industries in the Making a Difference department.
For the most part, these industries are contributing
to improving the quality of life and, in many cases,
preserving life itself.
In our good manufacturing practice (GMP) work-
shops, we always state that working in one of the
FDA-regulated industries is a privilege. Certainly its
a privilege to work in an industry with an honorable
goal of improving the quality of life. However, along
with that privilege comes an awesome responsibility,
the responsibility to do the right thing, all the time.
Thats where creating a culture of quality, or what
we call Making GMP a Lifestyle, comes into play. It
starts with top management. Key questions that must
be asked include:
Does top management view improving the qual-
ity of life as their primary goal or does top man-
agement view profits as their primary goal?
How does top management communicate their
goals?
Certainly profits are critical to any organization.
One couldnt produce products or provide services
that improve the quality of life without sustained
revenue.
Yet, which company do you think has the best
chance of creating a culture of quality?
Company A, where top management states that
our goal is to improve the quality of life for our
customers, often called patients, and when we do
that well, well make money.
Company B, where top management states that
we produce products and services to improve
the quality of life for our customers, often called
patients, so that we can make money.
Most people in the workplace are not in upper
management. They work in the system created by
those in these higher management positions. Most
people who want to be actively engaged in their work
ask themselves, How am I making a difference?
Both (high quality products/services and healthy
profits) are important to the success of a business,
but the difference is often in how it is communicated.
Creating a culture where GMP is a Lifestyle begins
with communication of the purpose of the company.
The behavior of those in top management must
be consistent with the message they communicate.
People learn at a very young age that actions are more
powerful than words.
Moments of Truth
Every person in a company makes decisions every
day. Some people make bigger decisions than oth-
ers, but all employees all make decisions that impact
24 Special Edition: A Roadmap to GMP Compliance Part 3
the quality of the products, services, processes, pro-
cedures, and policies that guide them in their work.
In a company where GMP is a Lifestyle, people
are more apt to make the right decision when faced
with a Moment of Truth.
Consider an example from a Warning Letter issued
by FDA (3):
In January 2010, your firm identified an insect
floating in a waste container in an aseptic filling
room. During your root cause analysis, you stated
that the most likely cause was the stopper supplier;
however, you did not conduct an audit of the supplier
until April 2011.
Here was a Moment of Truth. Even though the
thinking was that the problem was with the supplier,
the firm waited 14 months to conduct an audit.In a
company where GMP is practiced as a lifestyle, the
audit would have taken place as soon as the supplier
was suspected to be the source of the problem.
Next, consider two examples from a manufacturing
operation. Keep in mind that manufacturing opera-
tions are schedule driven. There is pressure to keep to
the schedule.
Example One: Joe works as a Compounder. He is
preparing a batch of product by combining ingre-
dients as a manufacturing document dictates.
Joe has gathered all the right components and
ingredients together and begins the compound-
ing process. He opens one container that has the
quality control (QC) approval label affixed and
is within its expiration date. However, once he
opens it, he smells an unfamiliar odor. He says
to a fellow worker, This smells different than it
usually does. Here is now a Moment of Truth.
Does Joe proceed, seeing that the QC approval
label is in order and the material is still within
the expiration date? Or should Joe stop and alert
his supervisor? In a company where GMP is
practiced as a lifestyle, Joe stops and alerts his
supervisor. Something may be wrong with that
container of raw material.
Example Two: Jill works as a Filling Operator.
She is preparing the filling line for filling a batch
of product. When she turns on one of the pieces
of equipment, she says to herself, Hmm, this
sounds different than it normally sounds. Here
is now a Moment of Truth. Does Jill proceed with
starting the filling operation,oOr should she stop
and alert her supervisor? In a company where
GMP is practiced as a lifestyle, Jill stops and
alerts her supervisor. There may be something
wrong with that particular piece of equipment.
Heres an example from an FDA 483 Observation
report (4):
Bad cartons had been handwritten in black ink

on the cardboard boxes. The cartons were in unre-
stricted status in their computer inventory system.
Here was a Moment of Truth. Someone determined
that something was wrong with those cartons and
took action to mark them, but they did not follow
up by having their status changed in their inventory
system nor did they remove the cartons from the
production area, as evidenced by the FDA inspector
discovering them.
Making GMP a Lifestyle
Review FDA Warning Letters and 483 Observations
reports in preparing for your GMP training sessions.
Identify how each observation is related to a Moment
of Truth. These often reveal the subtleties and nu-
ances of complying with GMP.
Use these examples in GMP training sessions to
generate dialogue and discussion about complying
with the intent of the regulations and a company
policies and procedures. The goal should be to obtain
everyones commitment to quality and providing the
Anne Greene, Kelly Waldron, Nuala Calnan
very best products and services to our customers.
It is those companies who have the highest per-
centage of personnel that are actively engaged that
will outperform their competition. Management
needs to provide a work environment that encourages
people to be actively engaged in their work. The com-
mitment to do the right thing at all levels will assure
customers that they will consistently receive safe,
pure, and effective products.
REFERENCES
1. R. Lopez, Most workers hate their jobs or have checked out,
Gallup says, LA Times, 2013, available here.
2. Amazon Offers Employees $5,000 to Quit, ABC News, 2014,
available here..
3. FDA, Warning Letter Issued to APP Pharmaceuticals, LLC
2/22/12, Inspections, Compliance, Enforcement, and Criminal
Investigations, 2012, available here..
4. FDA, FDA 483 Issued to McNeil Consumer Healthcare, Elec-
tronic Reading Room, 2010, available here.
Special Edition: a roadmap to gmp compliance Part 3 25
Steven S. Kuwahara

The FDA Compliance Program

Guidance for GLPs - General
Steven S. Kuwahara

ABSTRACT
This article provides an overview of the US Food and Drug Admin-
istrations good laboratory practice guidelines found in the compliance
program guidance manuals.

Making a Difference
The enforcement of good laboratory practices (GLPs) is often left to the
BioResearch Monitoring (BiMo) program of the US Food and Drug Ad-
ministrations Center for Drugs Evaluation and Research (CDER). BiMo
inspections have a reputation of being very thorough and conducted
by knowledgeable investigators. It is thus valuable to have some insight
into the guidelines that these investigators are trained to follow. These
guidelines may be found in the compliance program guidance manuals
(CPGMs) that are available online at the FDA website (1).
The CPGMs are internal FDA documents that provide guidance and
instructions for FDA investigators who conduct inspections. For the
worker dealing with the GLP guideline, the most interesting CPGM is
the one specifically covering the GLPs. This document, usually referred
to as CPGM 7348.808, covers the inspection of studies that were con-
ducted under GLP rules (2). As such, it is useful for the GLP worker to
review it to be prepared for an inspection.
CPGM 7348.808 is in Chapter 48 covering bioresearch monitoring
and was issued on February 21, 2001. This 37-page document is mostly
devoted to administrative matters that will concern FDA personnel, but
not the laboratory worker. Certain sections, however, will be of interest,
and shall be discussed here.

BIMO INSPECTION PROGRAM

Although the BiMo inspection program is identified as being a CDER
program, it is clear from the title page and the background statement
of the CPGM document that it applies to the full range of products cov-
ered by the GLP, and therefore covers products regulated by all of the
FDA centers, including foods and veterinary drugs. In fact the docu-
ments background statement says:
The FFDCA (Federal Food Drug and Cosmetics Act) and Public
Health Service Act require that sponsors of FDA-regulated products
submit evidence of their products safety in research and/or marketing
applications. These products include food and color additives, animal
drugs, human drugs and biological products, human medical devices,
diagnostic products, and electronic products. FDA uses these data to
answer questions regarding:

26 Special Edition: A Roadmap to GMP Compliance Part 3


The toxicity profile of the article
The observed no adverse effect dose level in the
test system
The risks associated with clinical studies involv-
ing humans or animals
The potential teratogenic, carcinogenic, or other
adverse effects of the article
The level of use that can be approved
The importance of nonclinical laboratory studies to
FDAs public health decisions demands that they be
conducted according to scientifically sound protocols
and with meticulous attention to quality (2).
This statement makes it clear that conclusions
stated above and other possible adverse effects of a
product are, at least initially, dependent upon good
GLP studies. In the past, some of these studies have
been conducted with a complete or partial disregard
of GLP requirements. This behavior was partially
justified by the lack of close scrutiny of these stud-
ies. There was a belief that only human trials could
show the true nature of any lack of safety, and non-
clinical studies were only valuable for finding major
adverse properties. The idea that it was unethical to
ask human volunteers to consume a poorly tested
product did not appear to be a major concern. This
has changed with the increasing sophistication of the
public that has produced greater demands for a high
level of product safety.
With the pressure on FDA to approve new prod-
ucts more rapidly, their reliance on good GLP-regu-
lated studies has increased proportionally. This will
also increase with the advent of biosimilars where the
importance of GLP studies will rise in proportion to
the reduction of human clinical trials. This will mean
that the quality of the GLP studies will become more
important to FDA reviewers and to manufacturers,
who will use them to gauge the toxicity, pharmaco-
kinetics, and pharmacodynamics of new products
especially in relation to a reference product.
BiMo Objectives
The objectives of the BiMo GLP inspection program
are given in section II.A of the document:
To verify the quality and integrity of data submit-
ted in a research or marketing application
To inspect (approximately every two years)
nonclinical laboratories conducting safety stud-
ies that are intended to support applications for
research or marketing of regulated products
To audit safety studies and determine the degree
of compliance with GLP regulations (2).
As with the GLP regulations themselves, these
objectives are aimed at verifying the information sup-
porting the idea that the products are safe. The first
objective directs attention to the data in a research
Steven S. Kuwahara
application that would be an Investigational New
Drug (IND) application for a small molecule or bio-
logical drug and an Investigational Device Exemption
(IDE) application for a device. In turn, this supports
the idea that in the sequence of drug or device de-
velopment, the GLP regulations come into play well
before clinical trials begin.
The FDA centers or the headquarters of the Office
of Regulatory Affairs initiate the inspections. They
are conducted without prior notification when com-
mercial laboratories are inspected, but university and
government laboratories will receive a notification
letter from the BiMo program coordinator, at least
for the initial inspection. There is a provision that
inspections of government or university laboratories
should be done as soon as possible after the labora-
tory has received the letter.
BiMo Inspections
The document describes the two types of inspec-
tions:
1. Surveillance Inspections
Surveillance inspections are periodic, routine
determinations of a laboratorys compliance with
GLP regulations. These inspections include a facil-
ity inspection and audits of on-going and/or recently
completed studies
2. Directed Inspections
Directed inspections are assigned to achieve a spe-
cific purpose, such as:
a. Verifying the reliability, integrity, and compli-
ance of critical safety studies being reviewed in
support of pending applications.
b. Investigating issues involving potentially
unreliable safety data and/or violative conditions
brought to FDAs attention.
c. Re-inspecting laboratories previously classified
OAI [Official Action Indicated] (usually within
6 months after the firm responds to a Warning
Letter).
d. Verifying the results from third party audits
or sponsor audits submitted to FDA for consider-
ation in determining whether to accept or reject
questionable or suspect studies (2).
Surveillance inspections are the routine inspec-
tions that are conducted on establishments known to
the agency. The problem here is that there are many
laboratories, especially contract testing laborato-
ries, that only do GLP-regulated work when a client
requires it. Unlike the established GLP laboratories,
these organizations often have untrained workers
and supervisors who only have a hazy idea of what
GLP is. These laboratories only seem to come to the
agencys attention when mentioned in an applica-
tion, causing them to become the target of a directed
Special Edition: a roadmap to gmp compliance Part 3 27
Steven S. Kuwahara
inspection.
The inspection team should be composed of at
least two people. The team leader will be a field in-
vestigator, and the second person will be a field ana-
lyst or headquarters person who serves as a scientific
or technical support for the team leader. This usually
results in having experienced investigators including
at least one person chosen for knowledge about the
technical or scientific issues that will be encountered.
Part III of the document covers the inspections
themselves and the general instructions tell the inves-
tigators to obtain copies of three documents. These,
along with the instructions to the investigators, are as
follows:
Organization ChartIf the facility maintains an
organization chart, obtain a current version of
the chart for use during the inspection and sub-
mit it in the EIR.
Facility Floor-plan DiagramObtain a diagram
of the facility. The diagram may identify areas
that are not used for GLP activities. If it does not,
request that appropriate facility personnel iden-
tify any areas that are not used for GLP activities.
Use during the inspection and submit it in the
EIR.
Master Schedule SheetObtain a copy of the
firms master schedule sheet for all studies listed
since the last GLP inspection or last two years
and select studies as defined in 21 CFR 58.3(d).
If the inspection is the first inspection of the
facility, review the entire master schedule. If
studies are identified as non-GLP, determine the
nature of several studies to verify the accuracy of
this designation. See 21 CFR 58.1 and 58.3(d).
In contract laboratories determine who decides if a
study is a GLP study (2).
The experienced auditor will note that items A and
B are often requested when conducting establishment
audits. However, in the GLP context they, and item
C, have certain meanings that were defined in the
regulations. When the term facility is used in GLP
work, it is important to remember that it refers to the
test facility and not the whole establishment in which
it may be located. Similarly, the master schedule sheet
only refers to the schedule of GLP-regulated studies
and not all of the activities of the firm.
The organization chart will be of interest because
it will show the reporting relationships among test
facility management, members of the institutional
animal care and use committee (IACUC), person-
nel actually conducting a given study (including the
study director), and the members of the quality assur-
ance unit (QAU) for a study. These reporting relation-
ships are important when considering the potential
for conflicts of interest regarding specific studies.
28 Special Edition: A Roadmap to GMP Compliance Part 3
For example, it would be relatively easy for the study
director to unduly influence the actions of the head of
the IACUC or the QAU. This could occur if the study
director and the head of the IACUC or QAU appear
to be independent, if the study director were a senior
member of the test facilitys management while either
the head of the QAU or the IACUC were relatively
junior employees of the test facility. These situations
have been seen in hospital laboratories when the
study director was a senior physician or surgeon and
the head of the QAU, IACUC, or the IRB was a junior
physician or surgeon.
Floor Plan
The floor plan is important for judging the degree
of isolation of each study and the potential for cross
contamination of test samples. In some company lab-
oratories, routine potency and safety tests conducted
under GMP rules may coexist with other studies that
are being conducted under GLP rules or under no
rules at all. Also GLP rules require the physical sepa-
ration of studies, animal species, test articles, feed,
and animal wastes. In some testing laboratories, the
use of single sample preparation rooms has led to the
cross contamination of all samples processed in the
room, while in others the absence of sample prepara-
tion areas has led to the contamination of the whole
laboratory, including the technicians.
The master schedule allows the investigator to
draw conclusions about the workload in the labora-
tory and, by cross checking against the organization
chart, the adequacy of staffing. The potential for
cross contamination among test articles may also be
assessed, as well as the adequacy of study separation
in the light of the floor plan. It is fairly easy to use the
organization chart, floor plan, and master schedule
to see which areas are used for each study and which
employee works on each study. Also the ability of the
QAU to monitor the studies can be similarly assessed.
These three documents are important tools in the
management of the test facility, and the absence of
even one of them should raise questions about the
ability to manage the test facility. It is important to
have the test facility management maintain up-to-
date versions of the organization chart and floor plan,
and the QAU must maintain a current copy of the
master schedule sheet.
Inspections
What will the investigators inspect? The obvious
answer is that they will inspect the operations of the
GLP test facility, but in GLP work there are specific
studies that are conducted by the test facility, so the
next point of interest is how are the studies selected
for inspection? The answer is found in section III.A.5,

which reads:
5. Identification of Studies
a. Directed InspectionsInspection assignments
will identify studies to be audited.
b. Surveillance inspectionsInspection assign-
ments may identify one or more studies to be
audited. If the assignment does not identify a
study for coverage, or if the referenced study is
not suitable to assess all portions of current GLP
compliance, the investigator will select studies
as necessary to evaluate all areas of laboratory
operations. When additional studies are selected,
first priority should be given to FDA studies for
submission to the assigning Center. NOTE: Stud-
ies performed for submission to other govern-
ment agencies, e.g., Environmental Protection
Agency, National Toxicology Program, National
Cancer Institute, etc., will not be audited without
authorization from the Bioresearch Monitoring
Program Coordinator (HFC-230).
However, this authorization is not necessary to
briefly look at one of these studies to assess the ongo-
ing operations of a portion of the facility.
1) Criteria for selecting on-going and completed
studies
Safety studies conducted on FDA-regulated prod-
ucts that have been initiated or completed since
the last GLP inspection.
Safety studies that encompass the full scope of
laboratory operations.
Studies that are significant to safety assessment,
e.g. carcinogenicity, reproductive toxicity, chronic
toxicity studies.
Studies in several species of animals.
The investigator is encouraged to contact the Cen-
ter for guidance on study selection.
2) Ongoing StudiesObtain a copy of the study
protocol and determine the schedule of activi-
ties that will be underway during the inspection.
Steven S. Kuwahara
This information should be used to schedule
inspections of on-going laboratory operations, as
well as equipment and facilities associated with
the study. If there are no activities underway in
a given area for the study selected, evaluate the
area based on on-going activities.
3) Completed StudiesThe data audit should
be carried out as outlined in Part III, D. If pos-
sible, accompany laboratory personnel when they
retrieve the study data to assess the adequacy of
data retention, storage, and retrieval as described
in Part III, C 10 (2).
The studies of interest are those that are critical to
the assessment of the safety of a product and the ones
that cover a wide range of test facility activities.
CONCLUSION
There are many interesting and important points in
CPGM 7348.808 that cover the inspection of studies
conducted under GLP rules. Personnel working in a
GLP environment should review CPGM 7348.808 in
preparation for an inspection.
REFERENCES
1. http://www.fda.gov/ICECI/ComogramManual/default.
htm#bimoplianceManuals/C.....
2. CPGM 7348.808, Good Laboratory Practices (Non-clinical
Laboratories), February 21, 2001. (Note: the letters preceding
the numbers are sometimes given as CP or CGM) GXP
ARTICLE ACRONYM LISTING
BiMo BioResearch Monitoring
CDER Center for Drugs Evaluation and Research
CPGMs Compliance Program Guidance Manuals
GLP Good Laboratory Practice
IACUC Institutional Animal Care and Use Committee
IND Investigational New Drug
IDE Investigational Device Exemption
QAU Quality Assurance Unit
Special Edition: a roadmap to gmp compliance Part 3 29
David W. Vincent

Quality and Compliance in the

Asian Pharmaceutical Industry
David W. Vincent

Note: This piece is an update to a commentary written in 2011 for the

Journal of Validation Technology entitled Quality and Safety of Asian Phar-
maceutical ProductsEU and US Regulatory Agency Activities and New
Chinese GMP Regulations.

Introduction
The Asian pharmaceutical manufacturing industry is becoming more
complex, with some Asian countries moving more aggressively than
others to supply their to regulated markets such as the US and Europe.
Emerging markets, poised to account for about 45% of the worlds
gross domestic profit by 2018, are projected to represent the majority of
growth in pharmaceutical sales in the next five years (1).
According to a recent report, in 2008, the global active pharmaceuti-
cal ingredients (APIs) market (including both captive and merchant)
worth was $91 billion; it increased to $113 billion (USD) in 2012. From
2008 to 2012, the global API market increased at an average annual
growth rate of 5.6%, though it is less compared to an annual growth
rate of 7.2% from 2004 to 2008. The market, which stood at $113 bil-
lion in 2012, is expected to grow at a compound annual growth rate of
around 8% during 20122017 (1).
Up to 40% of finished drugs used by US patients are manufactured
abroad, and 80% of the active ingredients and bulk chemicals used in
US drugs come from foreign countries (1).
Currently, Asia leads the world in the manufacturing of APIs. While
the US and European pharmaceutical industries are experiencing little
or no growth in API manufacturing, Asian producers are seeing high
growth rates, both from domestic demand and export sales. According
various records, Chinas API producers generated estimated revenues of
$4.4 billion in 2005 and are projected to make sales of $10.3 billion in
2013. Indias API producers had sales of about $2 billion in 2005 and
$20.8 billion in 2013; they are forecast to grow to $35.1 billion by 2016.
Japan accounts for over 50% of pharmaceutical sales in Asia-Pacific, fol-
lowed by China, which is a distant second with 19% (2).
Chinese pharmaceutical companies are primarily oriented towards
supplying their own domestic market. Thus, they tend to place less
emphasis on external good manufacturing practices (GMP) compliance.
Indian API manufacturers, on the other hand, are focused on export
sales to highly regulated global markets. They have thusly developed
considerable expertise in complying with global GMPs and supplying
documentation to foreign regulatory agencies for drug master files.
With rising costs of pharmaceutical products and new low-cost com-
petitors, manufacturing efficiency is becoming more important to Asian

30 Special Edition: A Roadmap to GMP Compliance Part 3

David W. Vincent
API manufacturers. They are looking to regulated-
markets for growth, and that means compliance to
GMPs. The issue of cost and safety for the producers
of API manufacturing equipment is also a significant
driver for growth in this industry.
In recent years, more manufacturing facilities APIs
have relocated to Asia. Approximately 80% of the
APIs used in the US and the European Union (EU) to
manufacture finished pharmaceutical products come
from Asia, with China and India accounting for much
of the supply. However, there is a major concern
with foreign drug manufacturers producing certain
proprietary drug products in Asia; this is due to weak
intellectual property laws.
In addition, some Asian countries make it difficult
for small foreign support companies (e.g., validation,
quality, laboratory, and technical consultant services)
to establish local businesses and to enter the mar-
ket. Due to this, many larger foreign and local API
and pharmaceutical companies have to import this
knowledge based services at much higher cost then
could be provided by local businesses.
These, plus other issues, are limiting factors that
have prevented some foreign companies from relocat-
ing to certain Asian countries.
Quality and Safety Issues
Asian API and drug manufacturers can better un-
derstand how they can achieve regulatory compli-
ance and avoid production stoppages and recalls by
following new guidance issued by the US Food and
Drug Administration and the European regulatory
agencies. In addition, Asian API industry must also
understand that education and training is a key busi-
ness investment that in the long run, will produce
a safe and effective product. If most Asian countries
focus on developing a strong quality and compliance
philosophy in the long-term, their business goals for
financial success will be achieved
The international regulating bodies have pub-
lished various guidances, (e.g., Eudralex Part 2 Basic
Requirements for Active Substances used as Starting
Materials (3), Pharmaceutical GMPs for the 21ST
Century A Risk-Based Approach Final Report (4),
and Quality Systems Approaches to Pharmaceutical
Current Good Manufacturing Practice (GMP) Regula-
tions) (5) in order to help manufacturers maintain
consistent high quality and improve efficiency prod-
uct. FDA has also published a new process validation
guidance document titled Process Validation: General
Principles and Practices (6).
The aim of these documents is to help both US
and international manufacturers produce drugs more
efficiently, which should help lower costs and prevent
shortages of critical medicines due to manufactur-
ing failures that can result in product seizures and
recalls. Yet, theses documents are not intended to cre-
ate new requirements for pharmaceutical manufac-
turing that go beyond those established in the current
regulations, nor are the publications intended to be a
guide for the conduct of FDA and EU inspections.
In Asia, Japan is currently the leader in under-
standing the regulatory and compliance requirements
required to produce a high-quality pharmaceutical
product. However, the pharmaceutical sector in India
has been one of the fastest growing sectors of its
economy over the past several years, and it is fore-
casted to continue growing. Similar to China, India is
now one of the most important healthcare markets in
the world, having its own domestic market as well as
a huge pool of clients for exports. India is considered
to be ahead of China in terms of its control of quality
over pharmaceutical manufacturing. Its approach to
quality is much different from the China API manu-
facturers, with focus on long-term commitment to
quality and compliance. Quality is considered to be
a part of the Indian business model and investment
into strong quality strategy will, in the long-term,
make them a successful player in the global pharma-
ceutical markets. Additional Asian markets such as
Taiwan and Singapore are committed to long-term
investment into the Global API markets. Hopefully,
other Asian markets will follow suit and commit to
investing into a strong quality strategy, but the pres-
sure to maximize profits by minimizing quality will
always be challenge for the API industry.
Quality and Safety Issues
There has been an accelerating rate of change within
the industry over the last 20 years, with massive glo-
balization occurring driven by the pressure to drive
drug-manufacturing costs down.
US and EU manufacturers supplied 90% of API
needs 20 years ago; now, they are supplying less
than 20%. At the same time, the number of generic
medicines accounted for less than 5% 20 years ago
whereas now they account for over 50%, with much
of the API coming from Asia.
The above chart shows the cost structure dif-
ferential between European-US manufacturers and
manufacturers in India and China. Key to numerical
superscripts: 1) includes cost of goods sold without
cost for raw material, 2) assessment of direct person-
nel cost reduction from approximately 60 to 6 total
salary dollars (tsd)/FTE (1=$1.25), indirect person-
nel cost reduction factor of two, 3) assessment of
direct personnel cost reduction from approximately
6 to 3 (tsd)/FTE (7).
Consumers take it for granted that the medicines
they buy are manufactured to the highest standards
Special Edition: a roadmap to gmp compliance Part 3 31
David W. Vincent
Figure 1: Assessment of API manufacturing costs by region (in $ mil., basis 2004)
and expect the regulatory authorities to ensure that
this remains the case. Manufacturing plants have
to meet strict standards to ensure the products they
make meet the requirements of the GMPs and are
not contaminated by poor manufacturing practices.
However, in reality, there is a high probability that
the drugs on the shelves of European and United
States pharmacies will contain APIs that were made
in Asian manufacturing facilities that have never been
inspected, and the new regulations due to come into
force in the future will still not solve this problem.
Compliance with GMP regulations requires that
batches of an API remain of consistently high quality
throughout the entire manufacturing process. Any
changes to the process can only be implemented after
the impact on quality has been assessed, and pro-
cess change records must be kept so that all actions
can be traced, if necessary. However, without GMP
or proper understanding of GMPs, the consistency
and the quality of the batches cannot be assured. All
process changes should be assessed, regardless of its
effect on product quality, and the lack of deficient or
non-conformance records makes investigations nearly
impossible. This means that a number of problems
are more likely to occur without being noticed, such
as changes in impurity profile, cross contamina-
tion with other APIs because of ineffective cleaning,
or altered crystal forms or particle sizes, which can
impact bioavailability.
EMEA and FDA Approaches to GMP Inspections
Performed in Asia
European Medicines Agency (EMEA) and FDA are
32 Special Edition: A Roadmap to GMP Compliance Part 3
faced with a daunting task to tackle the escalating
problem of inspecting all API and pharmaceutical
manufacturing sites in Asia.
Records indicate that an estimated 7% of all for-
eign API facilities are inspected by FDA each year,
compared to 97% of US facilities inspected every
two years. Most pharmaceutical companies in the US
have expressed that this comparison is unfair given
that the level of controls, deterrents, or sanctions on
foreign facilities are not of the same standards.
There are almost 7,000 foreign firms that import
pharmaceutical products into the US listed on the
FDA database. The number of inspections performed
on these firms by FDA had been criticized to be un-
representative of the number of products imported.
For example, in 2007, 13 out of 714 Chinese import-
ers of pharmaceutical products into the US were in-
spected by FDA whereas 65 out of 410 were inspected
in India (8).
Furthermore, in 2007, warning letters were issued
by FDA for GMP non-compliance to two Chinese
pharmaceutical manufacturers, resulting in denial of
entry of products into the US. This was considered
to reflect a high proportion. From 2008 to 2013,
FDA has inspected 785 establishments in China.
Out of the 785 site inspections, 260 inspections were
conducted by the Center for Drug Evaluation and
Research (CDER), 228 inspections were conducted
by the Center for Devices and Radiological Health
(CDRH), 42 inspections were conducted by the Cen-
ter for Veterinary Medicine (CVM), and 255 inspec-
tions were conducted by the Center for Food Safety
and Applied Nutrition (CFSAN) (8).

Although FDA uses a risk-based process to develop
a prioritized list of foreign establishments for inspec-
tions to monitor the quality of marketed drugs, few
are completed in a given year. This prioritized list
was used to select foreign establishments for in-
spection in fiscal year 2014. According to the FDA
website, for fiscal year 2013, actual unique count of
foreign inspections includes 67 Office of International
Programs (OIP) inspections (17 for China and 50 for
India) (9).
FDA is supposed to inspect all facilities that supply
the US with APIs, regardless of location. This means
that there are numerous facilities selling APIs to
the US, compared to the thousands of uninspected
plants whose products reach the European market. It
also leads to the complex situation of European API
manufacturers selling their ingredients for use in the
US, while they are left unable to sell them in Europe
because they are undercut by lower cost and unin-
spected Asian manufacturers. This unfair, one-sided
condition puts the European API manufacturers at an
unfair disadvantage.
FDA now performs GMP inspections on selected
pharmaceutical enterprises, regardless of location.
However, there has been recent criticism of this ap-
proach, citing that the number of pharmaceutical
enterprises FDA has been able to inspect is not nearly
representative of the total number of foreign suppliers
exporting pharmaceutical ingredients to the US.
FDA has started to establish more affiliates in the
main exporting countries. It recently opened affili-
ates in Chinese cities such as Beijing, Shanghai, and
Guangzhou to strengthen its global presence. FDA
inspections in exporting countries are expected to
increase, primarily in China and India. By opening
these offices and relocating approximately 13 em-
ployees in order to certify inspections of U.S.-bound
Chinese exports, FDA quality concerns became more
apparent. As FiercePharma reports:
The FDA is adding 19 people to the staff of 9 it
already has there, but 9 of those are food inspectors,
according to Bloomberg. The FDA opened an office
there in 2008 after being hammered for lax oversight
when tainted Chinese heparin led to dozens of deaths
in the U.S. The FDA has been trying to boost its pres-
ence in China for more than a year, but the Chinese
government blocked visas of FDA employees assigned
there. U.S. Vice President Joe Biden was able to get
a final commitment for the expanded FDA presence
during a visit to Beijing last week
While China is believed to be understaffed and
unable to keep on top of its burgeoning drug produc-
tion industry, Western drugmakers say it is making
more of an effort. When drugmakers provide Chinese
authorities with evidence of companies making coun-
David W. Vincent
terfeits of their products, they will take action. Last
year China cracked down when it found companies
using gelatin from scrap leather that contained toxic
chemicals to produce drug capsules. It sent 7 people
to prison and closed dozens of production facilities.
It will take about a year to fill out the staff in
China, Hickey told Bloomberg. Some earlier hires
moved on when they couldnt get visas. The FDA can
still send U.S.-based personnel, as it has for years.
Hickey hedged when asked if having more inspectors
there will lead to more actions. One thing we have
seen with our inspections overseas in India, and here
in China, is that over time, inspectors are better able
to identify specific problems in the firms. (10).
The foreign inspection process involves unique
situations that are not encountered domestically. For
example, FDA relies on staff that inspects domes-
tic establishments to volunteer for foreign inspec-
tions, and unlike domestic inspections to monitor
the quality of a marketed drug, FDA does not arrive
unannounced at a foreign establishment. It also lacks
the flexibility to easily extend foreign inspections if
problems are encountered, due to the need to adhere
to an itinerary that typically involves multiple inspec-
tions in the same country. Finally, language barriers
can make foreign inspections more difficult than
domestic ones. FDA does not generally provide trans-
lators to its inspection teams. Instead, they may have
to rely on an English-speaking representative of the
foreign establishment being inspected, rather than an
independent translator. Most Chinese API producers
know this is an issue and they sometimes exploit this
weakness by redirecting the inspection process.
Bloomberg Article (11)
More recently (Apr 3, 2014), Anna Edney of Bloom-
berg wrote the following concerns regarding product
safety in China in a piece entitled Drug Quality in
China Still Poses Risks for U.S. Market. The article
discusses the quality issues in Chinese manufactur-
ing, a study on overseas manufacturing of Lipitor, and
the international staffing situation at FDA. Readers
are recommended to read the article here.
FDA Reduces Domestic Inspections
Furthermore, as FDANews reports, FDA is scaling
back the number of routine quality inspections it
plans to conduct in the U.S. each year by 40 percent
in favor of conducting more inspections overseas. The
shift is part of a broader agency push to improve the
quality of drugs imported into the U.S. (12).
Based on FDAs new strategy, which necessitated a
reduction in domestic inspection in response to great-
er perceived risks abroad, difficult decisions had to
be made due to budget restraints. This does not mean
Special Edition: a roadmap to gmp compliance Part 3 33
David W. Vincent
that domestic drug manufacturing should adopt
lower level of GMP standards, rather that the FDA
has shifted some of the onus onto the manufacturers
themselves. From the authors personnel experience,
this strategy for foreign inspections should develop
interesting results
Major Areas of GMP Concerns
According to statistical data based on foreign inspec-
tion observations, the following are the top 15 major
areas of GMP deficiencies for 2008 to 2014 (2):
Quality system elements/procedures documenta-
tion
Design and maintenance of premises
Design and maintenance of equipment
Process validation
Procedures and facilities sampling
Manufacturing documentation issue (falsification)
Potential for microbiological contamination
Specification and testing documentation
Facilities and equipment status labeling
Environmental monitoring
Supplier and contractor audit and technical agree-
ments
Equipment validation
Hygiene/clothing
Duties of key personnel
Potential for chemical/physical contamination.
Energy conservation (Many of the API producers
in China consider it acceptable to shutdown their
clean utilities at night and restarting them in the
morning without considering of the impact on the
environmental conditions of these systems [e.g.,
bioburden]).
These above-listed deficiencies are an indication of
lack of understanding or commitment to the GMPs.
These types of GMP deficiencies cause concern among
regulatory agencies regarding the import of APIs and
other drug-related materials utilized in the production
of finished drug products. Without proper inspec-
tion or oversight of foreign companies, the potential
of adulterated products entering the US or European
markets is an accident waiting to happen.
While the finished drug manufacturers are ul-
timately responsible for the quality and safety of
the drugs they produce, this should not alleviate
or remove the oversight by the regulatory agencies.
There should be strong harmonization and guidance
between the regulatory agencies and finished drug
manufacturing in regards to oversight and inspection
of foreign imports of APIs. To date, there have been
no guidance documents related to the standardization
of auditing of APIs or other drug materials used in fin-
ished drug products. As a result, auditing standards
are left up to the finished drug manufacturers who are
34 Special Edition: A Roadmap to GMP Compliance Part 3
sometimes under pressure to accept a vendor based
on cost and efficiency, rather than quality and full un-
derstanding of GMPs. This is one of the reasons there
should be some discussion on the development of a
global harmonization for second and third-party GMP
auditing standards for the pharmaceutical industries.
This recommendation is based on the lack of re-
sources within the regulatory agencies to perform the
inspection necessary to safeguard the public health.
Furthermore, another suggested resolution to the cur-
rent problem would be to have the regulatory agencies
certify or approve consultants or consultant compa-
nies to act on their behalf to perform foreign inspec-
tion as per standard auditing practices. This would
minimize the risk of potential adulterated products
and materials from entering foreign markets. Unfor-
tunately, this suggestion may not be viable because of
current FDA policies on foreign inspections.
One of the major concerns for some of these drug
manufacturers is their inability to produce a sterile
drug product according FDA GMPs. With the ever-in-
creasing pressure to be competitive and keep the cost
of drug production low, there is real temptation to cut
corners. The culture of strict inherence to the GMPs is
relative new concept in Asia. With past issues related
to adulterated drug products from foreign countries
entering the US, there must be stricter regulatory
oversight and controls for final filled sterile drugs
entering the US market.
Conclusion
Asian pharmaceutical and API suppliers need solu-
tions that will enable them to ensure regulatory
compliance and address the global concerns on qual-
ity and authenticity. Over the past few years, there
arose issues that have created a need for a harmonized
approach to GMP audits of pharmaceutical and API
suppliers in Asia. Asian markets need to develop ef-
fective quality strategies to comply with the various
GMP standards required in API and pharmaceutical
production. This has been, and will remain for some
time, a significant concern for the pharmaceutical
industry in Asia. This article is not to be intended
as a criticism of the Asian API and pharmaceutical
markets, but rather a source of constructive ideas to
promote further growth of the industry.
REFERENCES
1. Deloitte, Opportunities in Chinas Pharmaceuticals Market,
Deloitte Analysis.
2. US Food and Drug Administration and European Medicines
Agency websites.
3. Eudralex, Part 2 Basic Requirements for Active Substances used
as Starting Materials (Brussels, BE, 2010).
4. FDA, Pharmaceutical GMP for the 21st Century A Risk-

Based Approach Final Report (Rockville, MD, May 2007).
5. FDA, Quality Systems Approaches to Pharmaceutical Current
Good Manufacturing Practice (GMP) Regulations (Rockville,
MD, Sept. 2006).
6. FDA, Process Validation: General Principles and Practices
(Rockville, MD, Jan. 2011).
7. C. Paddison, C. White, and C. Cruickshank,China and India:
Outsourcing Beyond the Comfort Zone, Pharmaceutical
Technology, 2005.
David W. Vincent
8. C.H. Yin Lau, GMP Trends in Asia, Life Science Auditing.
9. Number of routine inspections completed by investigators
based in-country in the month, available here.
10. E. Palmer, Vice president clears way for FDA to add inspec-
tors in China, FiercePharma, 2013, available here.
11. A. Edney, Drug Quality in China Still Poses Risks for U.S.
Market, Bloomberg, 2014, available here.
12. FDA to Slash U.S. GMP Inspections by 40 Percent,
FDANews, available here.
Special Edition: a roadmap to gmp compliance Part 3 35
Kelly Waldron

Integration of Risk Management

Principles into the Quality
System: Risk-based Impact
Assessment
Kelly Waldron

Introduction
As the principles of quality risk management have become increasingly
pervasive in the biopharmaceutical and medical device industries, a
point of saturation has been reached with respect to the risk toolkit.
Standard risk assessment techniques such as hazard operability analy-
sis (HAZOP), hazard analysis and critical control points (HACCP), and
failure modes and effects analysis and its derivatives (FMEA, FMECA,
FMEDA) have proven effective in increasing understanding of the gen-
eral level of risk inherent in products and processes and have allowed
the industry to realize tangible gains through the reduction of unac-
ceptable risks and the development of more targeted, robust preventive
actions. However, in seeking to apply quality risk management as an
enabler of the overarching quality system (1, 2), this standard toolkit
reveals some inherent limitations; specifically, none of these tools were
designed for use in a GxP environment (3). As a result, when using
such template tools to make risk-based decisions within a given quality
system element, the user is left to interpret the output of the risk tool in
a rather subjective way: what does the level of risk mean with respect
to the quality of products or the safety of patients? Since answering this
question often forces one to invoke concepts and make decisions based
on information extrinsic to the risk assessment, the validity of the risk
tool in a specific GxP context may be called into question. Perhaps the
best path forward, therefore, is not to use existing tools in a novel way
but rather to develop new risk tools to meet specific GxP objectives.
This paper will focus on one such customized approacha risk-based
impact assessment (RBIA) designed to determine the acceptability of
potential impact scenarios that may arise from a process deviation.

Laying the Foundation

The general process and goals of deviation investigation are famil-
iar to each of us. Domestic and international regulations require any
deviation from written, approved procedures to be investigated and
explained (4, 5). Such an investigation commonly includes the determi-
nation of the root cause of the deviation, proposal of appropriate correc-
tive and preventive action (CAPA), and the determination of the impact
of the deviation on product quality. While a variety of root cause analy-
sis tools are available to help satisfy the first goal of the investigation,
few, if any, practical tools exist to assist with the impact assessment.
In the authors experience, deviation impact is typically determined

36 Special Edition: A Roadmap to GMP Compliance Part 3


by building a logical argument stemming from the re-
sults of the investigation. Since these sorts of impact
assessments are often the product of a single assessor,
the robustness of such arguments vary widely in ac-
cordance with individual experience and potentially
undisclosed bias, subjectivity, or assumptions intro-
duced by the assessor. Within the scope of any indi-
vidual deviation, the strength of such a narrative and
the resultant product disposition decision are judged
based on their own merits. However, when multiple
impact assessments are viewed together as represen-
tative of the quality system output, inconsistencies
can bubble to the surface. This need not be the case.
Replacing or supplementing the current status quo
for deviation impact assessments with a common
RBIA tool can increase the consistency of the process
within the quality system and reduce the subjectivity
and bias inherent within such assessments.
Risk-based Impact Assessment Tool Design
Since the risk-based impact assessment tool is a type
of risk assessment, it follows that the methodology
should mirror the quality risk management lifecycle.
ICH Q9 Quality Risk Management separates a risk
assessment into three component parts: risk identifi-
cation, risk analysis (including risk estimation), and
risk evaluation (1). The sections that follow explore
each of these components in detail as they relate to
the RBIA tool
Risk Identification
An important distinction within the RBIA tool is one
common to the quality risk management field: the
difference between a hazard and the resultant harm.
ICH Q9 defines a hazard as a potential source of
harm and harm as the damage to health, includ-
ing the damage that can occur from loss of product
quality or availability (1). When placed into the
context of a deviation, the deviation event itself can
be considered the hazard whereas the harm is the po-
tential impact(s) that may result from that deviation.
For example, a deviation may be raised to address a
loss of high-efficiency particulate air (HEPA) filtration
during batch manufacturing (the hazard), which in
turn may result in microbial or particulate contami-
nation of product, equipment, or facilities (the harm).
While different risk tools address each of these
concepts in different manners, the scope of concern
with respect to an RBIA is clearly the harmthat is,
seeking to understand the risk associated with the
potential harm to patient safety, product quality, and
GxP compliance. The risk identification portion of
the RBIA process should, therefore, focus on defin-
ing all potential impact scenarios within the scope
of concern of a specific deviation event, whether the
Kelly Waldron
impact could be on a portion of a batch, the whole
batch, other batches linked in space or time with the
deviation, or implicated equipment or facilities. These
potential impact scenarios will then be ranked inde-
pendently through the risk analysis process.
Risk Analysis
Risk is commonly defined as the combination
of the probability of occurrence of harm and the
severity of that harm (1, 6). In order to capture these
dimensions, many risk tools, including RBIA, employ
the terms likelihood and severity within the risk
analysis process. The advent of International Organi-
zation for Standardization (ISO) 31000 introduced a
fresh perspective of risk by defining it as the effect of
uncertainty on objectives (7). In this way, ISO 31000
encourages to consider not only the likelihood and
consequences of a risk, but also the level of certainty
surrounding those aspects. ICH Q9 echoes this
sentiment by noting the evaluation of risk to quality
should be based on scientific knowledge (1). In
a GxP environment, scientific knowledge can take
many forms, such as direct testing through appropri-
ate design of experiment (DOE), awareness of the ex-
istence and effectiveness of good manufacturing prac-
tice (GMP) controls through documented evidence
and monitoring, and inductive reasoning based on
sound scientific principles. Since the relative strength
of the scientific knowledge can vary, and may also be
interpreted in different ways (3), explicit disclosure
of such information is often necessary to preserve the
integrity of the assessment. RBIA directly addresses
the question of uncertainty, ambiguity, and subjec-
tivity by including a confidence factor. Likelihood,
confidence, and severity and their relationship to the
overarching RBIA tool will be discussed in detail in
the sections to follow.
Risk Estimation
To guide the assessment and ensure consistency of
risk estimation, pre-defined rating criteria should be
established for each of the RBIA dimensionslikeli-
hood, confidence, and severity. It is important to note
that any such criteria should be assessed prior to
beginning the risk estimation process. The establish-
ment of clear, objective risk-rating criteria that are
directly tailored to the task at hand will prove invalu-
able as the exercise progresses.
The first step of risk estimation is to determine the
likelihood of each identified impact scenario. Since
likelihood is a ubiquitous concept in the risk do-
main, it will not be belabored here. It is important to
reinforce that, within the scope of RBIA, the likeli-
hood rating is directly related to the potential impact
statement(s) outlined during the risk identification
Special Edition: a roadmap to gmp compliance Part 3 37
Kelly Waldron
Rating
Remote
Average The potential impact is moderately likely to have occurred.
Likely
Table I: Example of Likelihood Rating Scale and Criteria.
Rating Simple Criteria
High degree of confi-
dence in the likelihood
High rating assigned. Presence
of potential impact (nearly)
confirmed/refuted through
the investigation process.
Moderate degree of con-
fidence in the likelihood
rating assigned. Presence/
Medium absence of potential impact
can be estimated based on
the results of the investiga-
tion
Low level of confidence
in the likelihood rating
assigned. Presence/absence
Low of potential impact could
neither be confidently
confirmed nor estimated
based on the results of the
investigation.
Table II: Example of Confidence Rating Scale and Criteria.
38 Special Edition: A Roadmap to GMP Compliance Part 3
Criteria
The potential impact is unlikely to have occurred.
The potential impact is likely to have occurred.
Detailed Criteria
Supporting data was gathered through targeted (DOE) in con-
ditions mirroring those present in the deviation event (e.g.,
using identical buffer formulations, actual product, etc.).
All supplemental controls in place at the time of the deviation
event were evaluated and the effectiveness confirmed (e.g.,
multiple redundant controls in place to prevent occurrence of
the impact).
Samples taken to investigate the product quality were rep-
resentative of the entire batch with the appropriate level of
statistical confidence (e.g., multiple aliquots taken from a
homogeneous bulk solution).
Applicable assays used to test samples were validated with
the appropriate level of precision, reproducibility, and robust-
ness to detect the potential impact.
Supporting data gathered through experiments performed
using conditions was comparable, though not identical, to
those present in the deviation event (e.g., using similar buffer
class, representative product, etc.)
The majority of supplemental controls in place at the time of
the deviation event were confirmed as effective; some con-
trols were not evaluated or the effectiveness at the time of the
event could not be confirmed.
Samples taken to investigate the product quality represented
a statistical cross-section only or may not provide assurance
of the entirety of the batch (e.g., discrete vials from a filled
lot).
Applicable assays used to test samples were validated with
levels of variability, precision, or robustness that may hinder
the detection of the potential impact, or the impact can be
detected through manual visual inspection only.
Supporting data gathered from external literature may not
represent the conditions of the actual deviation event, or no
supporting data is available.
The majority of supplemental controls in place at the time of
the deviation event was not evaluated or could not be con-
firmed as effective.
Potential impact cannot be directly observed, tested, or
detected.

process. Likelihood answers the question, How
likely is it that this potential impact has occurred?
An example of rating criteria for likelihood is illus-
trated in Table I.
Once each potential impact has been assigned a
likelihood rating, the risk estimation process pro-
ceeds to the confidence dimension. The inclusion of a
confidence factor in the RBIA tool links the potential
impact(s) directly to the deviation investigation and
explicitly addresses any sources of subjectivity, ambi-
guity, or uncertainty that may jeopardize the integrity
of the assessment. Confidence represents a measure
of the detectability of each potential impact combined
with an assessment of the preventive controls that
would have mitigated its occurrence. The confidence
rating therefore answers the question, How sure are
we with respect to the likelihood rating assigned to
this potential impact scenario? To achieve this ob-
jective, the confidence rating should account for:
The quantity and quality of data available to sup-
port the likelihood rating
The depth and rigor of the deviation investigation
and the resultant evaluation of the existence and
effectiveness of risk-mitigating controls
The relative representativeness of sampling
schemes used to support likelihood conclusions
Any inherent weaknesses or limitations associ-
ated with impact detection methods used to sup-
port likelihood conclusions
Any other assumptions or circumstances that
may improve or detract from the validity of con-
clusions related to product or system impact, as
appropriate.
Confidence
High Low
Medium
Likely
L3 L3 L3
Average
L2 L2 L3
Remote
L1 L1 L2
Figure 1: Preliminary Risk Matrix
Kelly Waldron
The multiple dimensions of confidence should be
contained within a confidence rating scale with asso-
ciated criteria. The level of detail associated with this
scale may vary based on the complexity of the issue
at hand and the resulting necessity to specify tangible
inputs, as illustrated in Table II.
The purpose of the confidence factor is to temper
the likelihood rating to account for the strength of
available evidence in support of the actual probability
of occurrence such that situations wherein limited
supporting data around the presence or absence of
a given impact scenario force the assignment of a
more conservative risk estimation. This objective is
achieved through the use of a preliminary risk matrix
as shown in Figure 1. To use the preliminary risk
matrix, simply find the intersection of the applicable
likelihood and confidence ratings to arrive at the
preliminary risk level denoted as L1, L2, or L3.
An analysis of the preliminary risk matrix design
illustrates the relationship between the likelihood and
confidence ratings. Where the confidence in a given
likelihood rating is high or medium, the matrix indi-
cates a customary risk level commensurate with that
probability rating (i.e., L1 for remote, L2 for average,
and L3 for likely). However, where the confidence is
low, indicating a lack of sufficient scientific evidence
to support the likelihood rating, the matrix assigns
a more conservative rating (i.e., low confidence in a
remote likelihood becomes an L2, and so on). This
preliminary risk level can be considered a calibrated
likelihood rating that is then used, along with sever-
ity, to determine the overall risk.
The final step in risk estimation is the assignment
of a severity rating to each potential impact. Since po-
tential impact scenarios can vary significantly based
on the type of impact, a bit of discussion around
the structure of severity rating criteria is warranted.
In recent years, regulatory agencies have begun to
develop defect classifications that directly address the
relative level of patient risk. For example, US Food
and Drug Administration defines recalls associated
with dangerous or defective products that predict-
ably could cause serious health problems or death
as Class I (8), while the European Medicines Agency
(EMA) describes Class I defects as those that are
potentially life threatening (9); Class II defects are
those that may affect the patient in a less significant
way (such as a transient illness or manageable adverse
event); Class III defects are unlikely to impact patient
health. In all cases, the defect classification reflects
the relative severity of the impact scenario that may
result from product administration; these concepts
should be preserved during the establishment of
severity criteria within the RBIA tool.
A helpful way to classify such defects is to explore
Special Edition: a roadmap to gmp compliance Part 3 39
Kelly Waldron

the relationship between a given potential impact and
the products design space; that is, the combination
of and relationships between process parameters,
equipment components, and product attributes
that collectively define product quality (10, 11). For
example, if a deviation is related to a critical process
parameter (CPP), there is a strong potential that there
may have been an impact to a defined critical quality
attribute (CQA) of the product, which in turns calls
product efficacy and patient safety into question (11).
An example of severity criteria, considering design
space relationships (for product-type impacts), good
engineering practices (for equipment and facility-type
impacts), GxP compliance, and regulatory expecta-
tions is detailed in Table III.
business climate and product profile. For example,
life-saving products for which there is currently insuf-
ficient available inventory may warrant a higher risk
tolerance than a quality-of-life product with several
direct competitors since the impact to patient due to
lack of product availability may be more significant
for life-saving drugs than for other types of medici-
nal products. Therefore, it is recommended that each
manufacturer establish a unique risk tolerance level
for each product based on the business environment
at the time of the assessment (e.g., available inven-
tory, comparability of competition, etc.). Any such risk
tolerance must be developed considering the potential
impact to the patient rather than to business concerns
such as loss of revenue.

Rating Simple Criteria Detailed Criteria

Product Equipment/Facility

Minor Insignificant or negligible Class III defects: Potential Potential impact is not
impact impact is not related to a related to a critical aspect
CQA. (CA) of equipment or
facility and does not
significantly affect GxP
compliance status.

Moderate Moderately significant Class II defects: Potential Potential impact is related

impact impact related to a CQA,
however, is of a nature or
magnitude that is unlikely
to affect product efficacy or
patient safety.
to a CA but is of a nature
or magnitude unlikely to
affect critical or key process
parameters. Moderate
impact to GxP compliance
status.

Critical Significant impact Class I defects: Potential Potential impact is related

impact related to a CQA and to a CA and is of a nature
is of a nature or magnitude of magnitude likely to affect
likely to affect product CPPs. Significant impact to
efficacy or patient safety. GxP compliance status.

Table 3: Example of Severity Rating Scale and Criteria.

Once the likelihood, confidence, and severity

ratings have been determined and appropriately justi-
fied, for each potential impact scenario, the risk as-
sessment will progress into the risk evaluation phase
where decisions are made regarding risk acceptability
and next steps.
Risk Evaluation
Any discussion of risk evaluation should begin with
a consideration of the relationship between risk toler-
ance and risk acceptability (7). Decisions surrounding
what levels of risk are considered acceptable should
be made following a thorough review of the current
Within the realm of RBIA, risk tolerance is captured
in a final risk matrix that marries the severity rating
for a given potential impact scenario with the associ-
ated preliminary risk level. An example is provided
in Figure 2. In the event a different risk tolerance is
expected for product-type impact scenarios than for
equipment or facility-type impact scenarios (for ex-
ample, situations wherein one is willing to accept less
risk for equipment impact than for product impact
due to responsibility to protect patients), separate
matrices should be developed. The actions to be taken
based on the acceptability of the risk should be de-

40 Special Edition: A Roadmap to GMP Compliance Part 3

 Kelly Waldron

Risk Actions
Acceptability
(Figure 2) Product Equipment/Facility

Product acceptable for Risk is acceptable: No remedial action necessary prior to further
Acceptable
release. processing.

Product not Risk is not acceptable: Immediate remediation/CAPA required

Unacceptable
acceptable for release. before further processing can proceed.

Table 4: Example of Risk Acceptability and Actions Table.

Severit
Minor Moderate Critical
(from the Preliminary Risk Matrix, Figure 1)

Acceptable Unacceptable Unacceptable

Preliminary Risk Level

Acceptable Unacceptable Unacceptable

Acceptable Acceptable Acceptable

Figure 2: Final Risk Matrix

fined (see Table IV for an example) to ensure objectiv-
ity of decision-making.
Since it is expected that there will be several potential
impact scenarios for a given deviation event, decisions
should be made based on the highest risk presented.
For example, when there are two acceptable product-
type risks and one unacceptable risk, the more
conservative action (discarding of the product) should
be taken. Employing this practice will ensure that
patients, or future batches of product, are not exposed
to any unacceptable level of risk.
Conclusion
As biopharmaceutical and medical device companies
seek to achieve complete integration of risk manage-
ment principles into their quality systems, the need
for customized risk tools becomes apparent. Any such
custom tools, such as the risk-based impact assess-
ment tool described in this article, should be designed
to directly address GxP concerns and link general risk
principles to the specific quality system element in
which the tool will be used.
The RBIA tool expands upon foundational risk
assessment methodologies to facilitate risk-based
decision-making for product and process impact stem-
ming from deviation events. RBIA includes a measure
of confidence in addition to the standard likelihood
x severity dimensions to assure compliance with the
primary tenets of risk managementthat the risk
assessment is founded in the best available scientific

Special Edition: a roadmap to gmp compliance Part 3 41

Kelly Waldron
knowledge, explicitly addresses any sources of un-
certainty, and ultimately seeks to protect the patient
(1, 7). Use of a discrete confidence factor within the
risk tool has several benefits: investigation teams
are encouraged to provide exhaustive supporting
evidence to improve the confidence ranking, the
design of the risk tool improves the robustness of
investigations and the validity of conclusions drawn,
underlying assumptions are explicitly recognized
and confirmed or refuted, and patients are protected
by assuring the assignment of appropriately conser-
vative risk estimations where such supporting data
is limited.
The implementation of the risk-based impact
assessment methodology fosters consistency and
improved investigations through a standardized
decision-making process ensuring that the principles
of quality risk management are integrated into the
overarching quality system. Repeated use of RBIA
and similar custom-designed tools can elevate risk
from a resource-intensive rarity to the new normal
the way we do business in a GxP environment.
REFERENCES
1. ICH, Q9 Quality Risk Management.
2. ICH, Q10 Pharmaceutical Quality System.
3. K. ODonnell The development of a Quality Risk Management
42 Special Edition: A Roadmap to GMP Compliance Part 3
Solution designed to facilitate compliance with the risk-based
Qualification, Validation, & Change Control GMP require-
ments of the EU, Unpublished doctoral dissertation, Dublin
Institute of Technology, Dublin, Ireland, pp. 15, 212-216,
December 2007.
4. Code of Federal Regulations, Title 21, Food and Drugs
(Government Printing Office, Washington, DC), Part 211,
subpart F Current Good Manufacturing Practices for Fin-
ished Pharmaceuticals - Production and process controls.
Section 211.100 Written procedures; deviations.
5. EU Guide to Good Manufacturing Practices, Volume 4, Part
II, Basic requirements for active substances used as starting
materials. Section 2.16, p. 8.
6. ISO/IEC Guide 51, Safety aspects Guidelines for their
inclusion in standards (1999).
7. ISO 31000, Risk management principles and guidelines
(2009).
8. Code of Federal Regulations, Title 21, Food and Drugs (Gov-
ernment Printing Office, Washington, DC), Part 7, subpart
A Enforcement Policies General provisions. Section 7.3
Definitions.
9. EMEA, Standard Operating Procedure - Public, Dealing
with reports of suspected defective medicinal products.
SOP/INS/2018. Oct 5, 2012. p. 15.
10. ICH, Q8 Pharmaceutical Development.
11. ICH, Q11 Development and Manufacture of Drug Substances
(Chemical Entities and Biotechnological/Biological Entities).
 Paul L. Pluta and Jerry Lanese

Laboratory Self-Audits
Paul L. Pluta and Jerry Lanese

Audit 101 provides useful and practical information that addresses various
topics associated with audits. Common-sense suggestions with application to
all audits internal and external, regulatory and non-regu-latory, domestic
and international are provided. examples of actual occurrences are de-
scribed whenever possible. Audit 101 has previously discussed the following
First impressions -- the Plant tour (1)
Preparation, Preparation, and More Preparation (2).
reader comments, questions, suggestions for discussion topics, and actual
audit experiences are needed to help us fulfill the column objective. Please
send your comments and suggestions to column coordinator Paul Pluta at
paul.pluta@comcast.net.

iNtrOduCtiON
every organization must become comfortable with being audited.
regulatory audits by global agen-cies, international Organization for
Standardization (iSO) registrar certification audits, external custom-er
audits, and internal quality assurance (QA) audits happen frequently.
Some may come at a moments notice while others are planned weeks
in advance. the key to a success is to make sure your area is always
prepared for an audit. A functioning labora-tory must function in a state

every laboratory must become comfortable with being audited.

A self-audit conducted internally is an excel-lent tool for the lab
to prepare itself for any audit, iden-tify problems, test execution,
and simulate an actual audit experience. Conducting a rigorous
self-audit that simulates an actual audit also helps to establish
a culture that supports an on-going state of prepared-ness in
the laboratory. Successful laboratories oper-ate in this state at
all times. this discussion provides a guide to the self-audit of
a laboratory. Laboratory systems independent of an actual test
result are reviewed beginning with the laboratory organizational
structure through sample collection, analytical testing, and re-
cord retention. Areas of interest are identified including specific
function, procedures, practices, records, and staff compliance
with procedures. topics discussed include the laboratory audit
process, rel-evant audit documents and references, laboratory
procedure availability, document requests by auditors, and
audit training for personnel. An approach to gap identification,
analysis, and prioritization of mitigation projects is presented.
A case study is given describ-ing an actual regulatory audit of
an analytical quality control (QC) laboratory and its supporting
research and development (r&d) laboratory.

Special Edition: a roadmap to gmp compliance Part 3 43

Paul L. Pluta and Jerry Lanese
of readiness on a daily basis. However, audits and in-
spections of the labo-ratory are often not anticipated.
Audits that start in a distant sites conference room
usually lead to the manufacturing floor and ultimate-
ly involve one or more laboratories at the site.
Organizations often have a designated internal
function whose sole purpose is to conduct inter-nal
audits. these may be very rigorous audits; the person-
nel conducting such audits are usually very well ex-
perienced. these audits are stressful events for the lab
since the results may be communi-cated to high-level
personnel in the organization. to prepare for these
internal audits as well as the aforementioned regula-
tory, iSO, and other audits, self-audits conducted by
the laboratory personnel are recommended. this is an
excellent tool for the lab to prepare itself for any au-
dit, identify prob-lems, test execution, and simulate
the actual audit experience.
Conducting a rigorous self-audit or that simu-
lates an actual audit also helps to establish a culture
that supports an ongoing state of preparedness in
the laboratory. the following discussion provides a
guide to the self-audit of a laboratory. Audits may be
conducted in different ways. this approach ad-dresses
the laboratory systems independent of an actual test
result. it begins by identifying the major elements of
a laboratory operation listed according to a typical
sequence of activities. it then identi-fies areas to as-
sess to determine the readiness of the laboratory for
an outside audit. the elements of a laboratory opera-
tion are listed below begin-ning with the laboratory
organizational structure through the sample collec-
tion, testing, and record retention:
Laboratory overview
Sample collection
Sample receipt in the lab
Sample handling and storage in advance before
testing
Sample testing
instrument qualification
instrument maintenance and calibration
test method and sampling procedure develop-
ment
test method validation
Laboratory technical training
data treatment
results verification, review and approval
results reporting
investigations
record compilation.
record storage, retention and retrieval
topics including the laboratory audit process,
rel-evant audit documents and references, laboratory
procedures, document requests by auditors, and au-
dit training for personnel are also discussed.
44 Special Edition: A Roadmap to GMP Compliance Part 3
when self-audits of laboratory operations are com-
pleted and gaps are identified, risks are evalu-ated.
the remedial actions required to mitigate these risks
are then prioritized and addressed.
A case study demonstrating an alternate ap-proach
to the laboratory audit is also presented. this case
study follows an actual test result back-wards
through the lab, starting with the result. either of
these approaches, (incoming sample re-ceipt through
final results or final result through incoming sample),
may be utilized in a self-audit. A combination of
methods, or use of both approaches at different times,
may serve to best uncover area weaknesses.
Approach to the Self-Audit
Areas of interest are identified within each of the ele-
ments of the laboratory operation. the auditor should
investigate the following in each area and re-spective
activities:
Function of the specific element or activity
Appropriate procedures are in place
Procedures accurately reflect the practice
records are complete, accurate, and maintained
Staff is compliant with procedures
LABOrAtOrY OVerView
An overview of the laboratory operation is the first
area for review in the self-audit. Areas for review in
this element address the general goals and objectives,
operations, function, and management of the labora-
tory. this type of information is requested when the
auditor first arrives at the laboratory. information
re-garding the type of testing conducted, qualifica-
tions of personnel and management, organizational
chart, responsibilities, and other descriptive informa-
tion must be readily available. documentation and
re-cords must be provided when requested. the areas
to assess here are:
type of testing conducted in the laboratory
Areas and units that submit samples to the labo-
ratory
Organization of the laboratory, including respon-
sibilities and accountabilities
Qualifications of laboratory personnel
Qualification of laboratory management
education, training and experience of labora-tory
management
Processes which monitor laboratory performance
Laboratory work outsourced to other areas
within the company or outsourced to an out-side
laboratory
Prior audit or inspection observations
SAMPLe COLLeCtiON
the areas for review in this element address the

source of samples for testing. what areas submit
samples, how are samples collected, required spe-cial
training for sampling personnel, etc. Samples may be
submitted from various areas in the orga-nization.
Samples may also be submitted at vari-ous stages of
manufacturing. Some samples may require immedi-
ate testing, while others may able to be staged within
the specific response time for laboratory efficiency.
each of these considerations may lead to a specific
line of questions including specific requirements,
specific handling, and so on. the sampling activity is
often not within the con-trol of the laboratory. if the
laboratory cannot assure the quality and integrity of
the samples received for testing, testing results will
be suspect because the sampling process lacks appro-
priate controls. the specific areas to assess are:
Areas or units that submit samples to the lab for
testing
Qualifications of individuals who actually
remove the samples from the manufacturing pro-
cess, stability area, or other source of samples
Specialized personnel training required for sam-
pling
Specialized equipment or facilities required for
sampling
the qualifications of individuals who deliver
samples to the laboratory
the technical input by the laboratory into proper
sampling, packaging, and labeling of the samples
Sample labels
Procedures for sampling, packaging, and label-
ing, and submission of samples to the laboratory
SAMPLe reCeiPt iN tHe LAB
the areas for review in this element address specific
activities associated with the receipt of samples by
the laboratory from the sample delivery person. Are
all samples simply dropped into a receipt box or are
there specific receipt procedures under laboratory
control? important areas to evaluate are:
Sampling receiving areas security and integrity
Sample receiving process
Sample receiving records
Storage of samples immediately upon receipt and
environmental controls
Security of receipt area
Qualification of the sample receiving area
examination and evaluation of samples upon
receipt, including records of the activity
Process for logging samples into a laboratory
information management system (LiMS) com-
puter system for tracking
Validation of the LiMS system.
Paul L. Pluta and Jerry Lanese
SAMPLe HANdLiNG ANd StOrAGe iN AdVANCe OF
teStiNG
the areas for review in this element address the han-
dling and storage of samples before they are actually
tested by the laboratory. these areas are:
Sample storage while samples are awaiting test-
ing
Provisions for special storage conditions such as
refrigeration, light protection, or other require-
ments
Qualification of sample storage area
identification and prioritization of samples that
require immediate testing
Security of storage area
Specific goals for completion of testing
Procedures for sample handling and storage in
the laboratory
SAMPLe teStiNG
the areas for review and assessment in this element
address the actual testing of samples:
reference standard program and controls
reagent controls
Control of chromatographic columns
Preparation control of stock reagents
System suitability requirements for test methods
Procedures for handling deviations to analytical
methods or other laboratory procedures
Procedures for handling changes to test meth-
ods or other laboratory procedures
test procedures
test-specific work sheets
Qualification of analysts to perform tests
the performance of required tests
iNStruMeNt QuALiFiCAtiON
the areas for review in this element address the ca-
pability and readiness of laboratory instrumentation
for testing. All instruments and equipment must be
qualified according to their united States Pharma-
copeia (uSP) (or equivalent) instrument categoriza-
tion (3). Laboratory management must be mindful
of the intended use of the instruments as well as
the instrument manufacturers recommendations
re-garding the equipment use. Changes to laboratory
instruments should be evaluated through a change
control system:
Procedures related to instrument qualification
responsibility for instrument and equipment
qualification
Status of laboratory instrument and equipment
qualification
Change control as it applies to instruments and
equipments
Special Edition: a roadmap to gmp compliance Part 3 45
Paul L. Pluta and Jerry Lanese
iNStruMeNt MAiNteNANCe ANd CALiBrAtiON
the areas for review in this element address main-
tenance and calibration activities associated with
instruments and other equipment. instrument cali-
bration is significant routine maintenance activ-ity for
analytical instruments. instruments must be calibrat-
ed or user standardized for actual use. the following
must be assessed:
instrument maintenance procedures
Laboratory instrument calibration program
instrument calibration procedures
Calibration records
instrument logbooks
teSt MetHOd ANd SAMPLiNG PrOCedure deVeL-
OPMeNt
the areas for review in this element address the de-
velopment of test methods by Analytical research and
design (r&d) or other technical support functions:
Responsibilities for the development of test meth-
ods, including sampling used in the laboratory
Evidence that specific samples for testing are rep-
resentative of the material received
Availability of method development reports in the
lab when needed for problem solving
Transfer of methods from other labs to this labo-
ratory
Procedures defining test method and sampling
procedure development
teSt MetHOd VALidAtiON
the areas for review in this element address test
method validation and associated activities. test
method validation is a key area in the laboratory
audit. industry and regulators focus on analytical
method validation. Any type of test method (physi-
cal, biological, microbiological, chemical) must have
documented evidence that demonstrates the test
performs as intended. test methods must be ap-pro-
priately validated if they are used for any test-ing re-
quired by the good manufacturing practices (GMPs).
Changes to validated test methods must be evaluated
through a change control system. the fol-lowing as-
pects of the test method validation must be evaluated:
Responsibilities for test method validation
The test method validation process
Status of the validation of all test methods
Evidence that test methods perform as intended
The system for changing test methods
The involvement of development subject matter
experts in evaluation of changes
Location and availability of test method valida-
tion documentation
46 Special Edition: A Roadmap to GMP Compliance Part 3
LABOrAtOrY teCHNiCAL trAiNiNG
the training of laboratory personnel and associated
training records are always requested in an audit.
Areas that should be reviewed include:
The laboratory technical training program
Process for determination of appropriate train-ing
for each analyst
Evidence of analyst qualifications
Retraining
Maintenance of training records and responsi-
bility, and current records
dAtA treAtMeNt
the areas for review in this element address raw
data recording, calculations, and other treatment of
data to determine test results. the laboratory analysts
who perform the analytical testing record all data,
calculations, and compile instrument documenta-
tion and associated information. Calculations may be
done with calculators, spreadsheets, or other com-
puter software. if computer systems and soft-ware are
involved, these must be validated. the spe-cific areas
of data treatment to be reviewed are:
Procedures for recording data in worksheets or
notebooks, labeling of instrument printouts,
entry into computer systems, calculation, and
result reporting
Procedures covering averaging and significant
figures
Procedures for good recordkeeping practices
(good documentation practices)
Software and spreadsheets used to perform cal-
culations, spreadsheet development standards,
evidence of validation
Change control
reSuLtS VeriFiCAtiON ANd APPrOVAL
the areas for review in this element address the
final review and approval of raw data, calculations,
data treatment, and other associated activities by
super-vision prior to release of results to the appro-
priate organizations. Laboratory records are signed
and dated by the analyst to affirm performance of the
testing. they are then reviewed and approved by lab-
oratory supervision. All records are signed and dated
by laboratory supervision affirming performance of
the testing, approval of the test results, and com-
pliance with internal procedures and regulations.
througout this process, there should be heightened
emphasis on the assemente of:
Responsibilities of analysts and reviewers
Procedures covering verification, approval and
release of raw data, calculations, final reports to
appropriate areas, and signature/date require-
ments for analysts and supervisors

Responsibilities for approval of all data and cal-
culations prior to reporting results
reSuLtS rePOrtiNG
the areas for review in this element address the
report of approved results to the sample originator
or the unit using the data. Sites may have electron-ic
systems into which test results are entered and are
ultimately transferred for final lot disposition. Other
sites may have paper systems that accom-plish the
same objective. Sites may also have mixed systems,
(e.g., electronic systems) for certain sam-ples and
paper systems for special samples. Spe-cifically, in
results reporting, the following should be reviewed:
The process for reporting results to quality or
sample originators
Validation of any computerized system used in
the sample reporting process
Timeliness of results measured against labora-
tory turnaround goals
Procedures for reporting of results
Assurance of appropriate testing and complete
testing
iNVeStiGAtiONS
the areas for review in this element address perfor-
mance of investigations when aberrant test results
are generated. test data may fail specifications or may
vary significantly from historical norms. this data
requires investigation by the laboratory to de-termine
the causes for the aberrant laboratory re-sults. there
should be focus on the reviewing the following:
Procedures for handling and investigating out-of-
specification or out-of-trend laboratory results
Procedures for laboratory investigations
Evidence of typical laboratory investigations
Retention of laboratory investigation reports
Corrective and preventive actions resulting from
laboratory investigations
reCOrd COMPiLAtiON
After testing is completed, data verified, results calcu-
lated, reviewed, and approved; and results re-ported
to quality or the originator, all records are compiled
in a standardized format. Areas for review in
this element include:The process for reporting
results to quality or sample originators
Procedures covering the format for completed
laboratory records
Procedures for compilation of records
evidence of completed records
reCOrd StOrAGe ANd retrieVAL
the areas for review in this element address the
storage and retrieval of laboratory data. data and
Paul L. Pluta and Jerry Lanese
test documentation may be stored electronically or
in hardcopy depending on the organization. Stor-
age must be secure. Access to test records must be
restricted to qualified personnel. if storage is by
electronic systems, these systems must be vali-dated.
data and test information must be quickly and easily
retrievable. reviewing the following is a necessity:
Procedures for record storage, retention and
retrieval
Security and environment of the record storage
areas
Qualifications of individuals responsible for
record storage
tHe LABOrAtOrY Audit PrOCeSS
actual laboratory audits may be conducted in vari-
ous ways. the above elements outline a start to fin-
ish approach to the audit structured according to the
business process of the lab. it establishs the labo-ra-
tory organization infrastructure through the test-ing
to the storage and maintenance of the records. Audits
may also be conducted in the reverse order, (i.e.,
following a test result from finish to start.). in this
approach, the audit follows a reported test result from
the laboratory report to data generation. the audit
then follows to testing through sample receipt and
original sampling by the sample originator. the at-
tached case study is an example of this latter ap-pro-
ach and represents a realistic audit experience. use of
both approaches at different times will chal-lenge the
laboratory system and expose personnel to a variety
of audit circumstances.
Other documents that may be used as the basis
for internal audits include the uS Food and drug
Association Compliance Program Guidance Manual
#7356.002 (4), FdA Compliance Program Guidance
Manual #7345.848 (5), and PiC/S Aide Memoire: in-
spection of Pharmaceutical Quality Control Labora-
tories (6) and periodic review of FdA warning Let-ters
(7) are also helpful. FdA observations provide insight
into current regulatory emphases and ideas for ad-
ditional areas or questions in a self-audit.
FdA Compliance Program Guidance Manual
#7356.002
this document was written to provide Center for
drug evaluation and research (Cder) investigators
an overview of areas to be reviewed during a drug
manufacturing inspection. it identifies the six basic
systems within a quality system including the labo-
ratory control system. this guidance identifies areas
within each system which the investigators should re-
view. it also directs that the firm should have writ-ten
and approved procedures for each of the areas and
records of these procedure results. the investi-gators
Special Edition: a roadmap to gmp compliance Part 3 47
Paul L. Pluta and Jerry Lanese
are also directed to verify that personnel are follow-
ing the procedures. the areas listed for the laboratory
control system are:
Training/qualification of personnel
Adequacy of staffing for laboratory operations
Adequacy of equipment and facility for intend-ed
use
Calibration and maintenance programs for ana-
lytical instruments and equipment
Validation and security of computerized or auto-
mated processes
Reference standards source, purity and assay, and
tests to establish equivalency to current official
reference standards as appropriate
System suitability checks on chromatographic
systems such as gas chromotography or high per-
formance liquid chromotography
Specifications, standards, and representative
sampling plans
Adherence to written methods of analysis
Validation/verification of analytical methods
Control system for implementing changes in
laboratory operations
Required testing performed on the correct sam-
ples
Documented investigation into any unexpected
discrepancy
Complete analytical records from all tests and
summaries of results
Quality and retention of raw data such as chro-
matograms and spectra
Correlation of result summaries to raw data;
presence of unused data
Adherence to an adequate out of specification
(OOS) procedure which includes timely com-
pletion of the investigation
Adequate reserve samples; documentation of
reserve sample examination
Stability testing program, including demon-
stration of stability indicating capability of test
methods
the guidance also identifies example laboratory
and control system problems. these include the fol-
lowing:
Pattern of failure to establish/follow a control sys-
tem for implementing changes in the labora-tory
operations
Pattern of failure to document investigation of
discrepancies
Lack of validation of computerized and/or auto-
mated processes
Pattern of inadequate sampling practices
Lack of validated analytical methods
Pattern of failure to follow approved analytical
procedures
48 Special Edition: A Roadmap to GMP Compliance Part 3
Pattern of failure to follow an adequate OOS pro-
cedure
Pattern of failure to retain raw data
Lack of stability-indicating methods
Pattern of failure to follow stability programs
FdA Compliance Program Guidance Manual
#7345.848
this document provides Center of Biologics evalu-
ation and research (CBer) investigators an overview
of areas to be reviewed during a biolog-ical manu-
facturing inspection. it identifies the same six basic
systems within a quality system and critical elements.
Standard operating proce-dures (SOPs) and train-
ing records are highlight-ed. it also identifies areas
within the laboratory control system that should
be reviewed, as well as observations that could be
reported. these are similar to the areas identified in
7356.002 and include:
Written procedures and control system for labo-
ratory operations
Calibration and maintenance programs for ana-
lytical instruments and equipment
Adherence, validation/verification to the writ-ten
methods of analysis
Testing and release for distribution
Specifications, standards, and representative
sampling plans
Stability testing program, including demonstra-
tion of stability indicating capability of the test
methods
Special testing requirements
Adequate reserve samples and documentation of
reserve sample examination
Required testing is performed on the correct
samples
Laboratory records
PiC/S Aide-Memoire
this document provides guidance for GMP inspec-
tors for training and preparation of inspections. it
contains nine tables addressing general subjects and
items to be investigated during GMP inspections. the
general subjects addressed in this document in-clude
the following:
General information
Quality assurance system
documentation system
Personnel
Premises and equipment
Materials and supplies
Sampling and samples
testing
results and release of test results
An extensive list of specific questions for each of

the above sections is listed in PiC/S Aide-Memoire.
the above provides a different approach to a labora-
tory audit with different focus.
Supplements addressing GMP inspection of
chemical, physical, and microbiological testing
labo-ratories are also provided, also including an
exten-sive list of very specific questions.
the quality assurance system section of this
docu-ment asks the following questions regarding
self inspection:
How is it, and by whom performed?
How is it reported?
How are corrective measures implemented?
is the schedule available and adhered to?
OtHer CONSiderAtiONS
documents requested by Auditors
whenever documentation is requested by an audi-
tor, it must be quickly retrieved within a reasonable
time (for example, 30 minutes). if r&d reports or
other documents or records generated by another
unit are not readily available through an electronic
report system, hardcopies or relevant reports should
be obtained from the originating unit and stored
within the laboratory area to facilitate timely retriev-
al. excessive time delays in retrieval of documents
are not acceptable.
Laboratory Procedures
Auditors always request the approved laboratory
procedures and test methods. these are usually
available through an electronic system. in the nor-
mal operation of the laboratory, analysts may print a
copy for their immediate personal use. this intro-
duces the potential for using an out-dated procedure
when revisions have occurred. Laboratory person-
nel must be trained to always access the current
procedure when a procedure is needed. there should
be a system that prevents the holding and extended
use of printed copies. if printed copies are used in
performing testing, they should be destroyed after
completion of the activity.
Audit training for Personnel
Aside from the technical training for personnel on
laboratory and testing procedures for the actual per-
formance of sample testing, laboratory personnel
should also be trained on proper interactions with
auditors. this includes topics such as audit protocol,
listening carefully to questions, asking for clarifica-
tion if requests are unclear, being calm, and phrases
to avoid. internal audits should include analyst
in-teraction to provide practice for handling audits
and responding to auditor questions. Laboratory
analysts will be nervous when dealing with exter-
Paul L. Pluta and Jerry Lanese
nal audi-tors. Practice will help to minimize their
anxiety and fears.
riSK eVALuAtiON OF ideNtiFied GAPS
Gaps in procedures, processes, records, and perfor-
mance will be identified after conducting a rigorous
self-audit. these gaps must then be evaluated and
corrective actions initiated. Highest risk gaps must
be prioritized for rapid response. tables i, ii, and iii
illustrate the results of a representative self-audit
us-ing the activity format discussed. table i provides
a representative list of audit observations from a
self-audit using the format of the above discussion.
table ii demonstrates a risk evaluation of observa-
tions. table ii provides a prioritized list of project
assign-ments addressing gaps with target dates and
person-nel responsibilities.
CASe StudY: LABOrAtOrY Audit
A regulatory auditor team was conducting a new
tab-let product pre-approval inspection at the
product manufacturing site. the audit was being
conducted in the designated conference room in the
manu-facturing plant. the regulatory agency auditor,
site compliance officer, and QA manager were pres-
ent in the conference room.
the process validation report for the new product
was requested by the auditors. the process valida-
tion report was retrieved from the validation library.
the auditors reviewed the report. the auditor then
selected the content uniformity test results in the
validation report. the report provided the sampling,
test procedure, test lab location, acceptance criteria,
table of results, description of data treatment, and
a statement that the data met acceptance criteria
re-quirements.
the auditors then requested to visit the labora-to-
ry where test data were generated. the testing labo-
ratory was approximately 30 minutes away from the
manufacturing plant. the laboratory su-pervisor was
immediately contacted and informed that the audi-
tors would be visiting his lab in ap-proximately 30
minutes to review content uni-formity testing from
the process validation. the regulatory audit team,
compliance officer, and QA manager then departed
for the lab with the process validation report.
After arriving at the laboratory and brief intro-
ductions of personnel, the lead auditor selected a
single test result reported in the process validation
report. the specified result was determined by an
HPLC test method. He asked to see the following
laboratory documentation associated with the test
result:
The analytical test method procedure associ-
ated with the sample
Special Edition: a roadmap to gmp compliance Part 3 49
Paul L. Pluta and Jerry Lanese
Table 1: Laboratory self-audit
The analytical method validation report
The analytical method development repor
After the above review, the auditors then focused on
the specific test result. they requested the following:
Hplc chromatogram associated with the sample
Sample preparatory equipment associated with the
test method
Actual equipment on which sample was tested
Standard used in the test procedure
50 Special Edition: A Roadmap to GMP Compliance Part 3
Standard storage, handling, and source of supply
Reagents used in the test procedures
Reagent preparation procedures including expi-
ration dating
Instrument qualification report
Calibration procedure
Calibration history
Name of laboratory analyst
Resume of laboratory analyst

Table 2: Risk evaluation of identified gaps
Training records of laboratory analyst
Name of supervisor who approved data and calcu-
lations
Resume of supervisor
Training records of supervisor
Procedure for sample receipt and storage
Sample receipt area
Sample receipt record
Sample storage area
Procedure for data treatment
Procedure for data and report storage
Data and report storage facility
Procedure describing report security area
All laboratory documentation requested was re-
trieved and reviewed. results were consistent with the
results reported in the process validation report.
After looking at the analytical method develop-ment
report which was written by an analytical r&d scien-
tist, the auditors requested to visit the r&d lab where
analytical method development work was conducted.
the r&d area was contacted. the r&d manager was
informed that the auditors would be visiting the labora-
tory in connection with the content uniformity method
development for the new product. After approximately
a fifteen minute walk between site buildings, the audit
team arrived at the analytical r&d lab. the following
Paul L. Pluta and Jerry Lanese
were then requested from the r&d lab manager:
General overview of r&d laboratory function
Organizational chart for laboratory
Analytical r&d report for the content uniform test
method
Raw data for testing reported in the analytical r&d
report (this data was recorded in a labo-ratory
notebook. Consistency between the raw data and
the analytical r&d report for repre-sentative data
was verified.)
Procedure describing r&d documentation prac-
tices
Data security and storage policy
Equipment and instrumentation used in the devel-
opment process, including instrument mainte-
nance and calibration logs
Standards and reagents used in the develop-ment
process, including expiration dating of materials.
Resume and qualifications for r&d scientist who
developed the test method
Resume and qualifications for r&d manager
All auditor questions were successfully answered
and requested documents provided. No inconsisten-
cies between reports and original data was found.
this case describes a typical progression of a regula-
tory audit. the audit started with a reported test result.
Special Edition: a roadmap to gmp compliance Part 3 51
Paul L. Pluta and Jerry Lanese
Table III: Risk mitigation goals, responsibilites, and target dates
this result was then tracked to laboratory raw data.
Activities associated with the test result were then
reviewed. these included laboratory test procedures,
supporting equipment and instrument information,
miscellaneous laboratory systems, and review of train-
ing of personnel associated with the original test result.
the audit then continued to the r&d area the developed
the test method of inter-est. r&d reports were reviewed,
equipment was reviewed, calibration records were
52 Special Edition: A Roadmap to GMP Compliance Part 3
checked, reagent dating was checked, personnel train-
ing was re-viewed, etc.
All questions and requests from by the auditor were
successfully answered. All documents were quickly
retrieved. the audit of the quality control (QC) and
r&d laboratories required one full day of review. No
deficiencies were cited by the auditor. the auditors then
returned to the manufacturing area to continue the
audit.

FiNAL tHOuGHtS
Successful laboratories operate in a constant state of
compliance to internal procedures and regula-tions
and they are continually prepared for an au-dit. there
is no getting ready for an audit. Suc-cessful labora-
tories are always ready. in reality, regulatory auditors
may arrive unannounced at a firm at any time and
proceed to initiate an audit. Successful laboratories
understand this reality and operate appropriately.
Conducting self-audits on a regular basis is a good
way to assess laboratory performance, im-prove
readiness for an audit, and expose personnel to an
audit experience. using different approaches and
styles as described above and in the case study is
desirable. Knowledge of regulatory requirements,
recommendations, and expectations as described in
official documentation is mandatory. Periodic review
of regulatory FdA warning Letters is also helpful.
Audits are a way of life. A good laboratory and its
personnel are always prepared.
REFERENCES
1. Pluta, Paul L., editor. Audit 101. First impressions -- the
Plant tour. Journal of GXP Compliance, Volume 15 # 1,
winter, 2011.
2. Graham, Ballard, richard Poska, robert ertmann, and Paul L.
Paul L. Pluta and Jerry Lanese
Pluta. Audit 101. Preparation, Preparation, and More Prepa-
ration. Journal of GXP Compliance, Volume 15, #4, Autumn
2011.
3. uSP <1058> Analytical instrument Qualification. www.usp.
org.
4. FdA. Compliance Program Guidance Manual: Program,
#7456.002. implementation date 2-1-2002.
5. FdA Compliance Program Guidance Manual: Program
7345.848. implementation date 10-1-2010
6. PiC/S. Aide-Memoire. inspection of Pharmaceutical Quality
Control Laboratories. September 25, 2007.
7. FdA. www.FdA.gov/iCeCi/enforcementActions/warnin-glet-
ters/default.htm
ABOut tHe AutHOrS
Paul L. Pluta, Phd, is Column Coordinator and
editor-in-Chief, Journal of GXP Compliance and
Journal of Validation technol-ogy. Contact dr. Pluta
with comments or questions on this discussion at
paul.pluta@comcast.net.
Jerry Lanese, Phd, is an independent consultant
specializing in quality systems and laboratory con-
trols. He is a member of the editorial Board of Journal
of GXP Compliance. Contact dr. Lanese at jerry@
lanesegroup.com
Special Edition: a roadmap to gmp compliance Part 3 53
David Markovitz

Good Manufacturing Practice

and Stable Systems - Part One:
Reducing Stress with the Power
of Data - Know When to Act and
When Not to Act
David Markovitz

Good Manufacturing Practice (GMP) is a quality system designed to help

manufacturers produce quality products that are safe, pure, and effective. In
theory, this is easy to do. In practice, however, there are several challenges.
Manufacturing operations are comprised of multiple systems and processes.
Effectively managing these systems and processes is the key to success
One of the biggest challenges is knowing when to act and when not to act in
managing our systems and processes. The late W. Edwards Deming (1900-
1993) cited two mistakes people make when managing systems and processes.

Mistake Number One

To react to an outcome as if it came from a special cause of variation,
when actually it came from common causes of variation.

Mistake Number Two

To treat an outcome as if it came from common causes of variation,
when actually it came from a special cause.
So what did Deming mean by these two mistakes. Lets first examine
Mistake Number One.

Understanding Mistake Number One

When all the variation within a system is due to common causes of
variation, we call that a stable system. We may be getting the desired
results or we may not be getting the desired results. The results are
predictable within a certain range. The system is what it is. It does what
it does. All the variation is built into the system.
When we react as if something special is happening, we almost al-
ways make things worse. Deming called this tampering. We take action
when we shouldnt take action.
Heres an example. Consider your commute to work. This is a com-
mute most of us make five days a week, week after week. Lets also
consider that your commute includes about ten miles of surface street
driving and about ten miles of driving on a freeway or turnpike.
Your commute time likely varies from day to day, but not by much,
perhaps five to ten minutes or so. What accounts for the variation? Sev-
eral factors contribute to the variation.

54 Special Edition: A Roadmap to GMP Compliance Part 3


Among them are:
The time you leave home. (Lets assume that you
leave home about the same time every day)
The route you take (Likely to be the same route
every day)
The signal lights along the route, and whether you
catch them red or green. (Over time, you will get
about 50% red lights and about 50% green lights)
The volume of traffic. (Likely to be about the same
every day)
Your personal driving habits. (Whether you
change lanes frequently or rush from one red light
to the next)
The weather (Most of the time the weather on any
given day is similar to the previous da
Based upon these factors, we make a prediction
each day on how long it takes to get to work, and
hence what time to leave home.
What if on Monday you arrive at work at 7:55 am?
And on Tuesday you arrive at 8:05 am? Wednesday at
7:59 AM, Thursday at 7:58 am, and on Friday at 8:02
am?
Do you believe that you deserved a Good Driver
Award for Mondays performance? After all, it was
your best performance for the week. And do you
believe that your award should be taken back when on
Tuesday you turned in your worst performance?
Of course not. The variation is built into the sys-
tem. Half the time you will arrive before 8:00 am and
half the time you will arrive after 8:00 am.
Do you think it may be wise to buy a faster car?
Of course not. That would be a waste of money and
acting when we shouldnt.
How about getting a different driver? Hire someone
else to drive you to work, perhaps a former race car
driver. Again, a waste of money and acting when we
shouldnt.
How often have people tried to fix a system by buy-
ing new equipment (a faster car)?
How often have people tried to fix a system by
changing the operator/worker (a different driver)?
Sports teams do this all the time - they fire the
coach or manager and hire someone else expecting
different results. It works about half the time - about
what you would expect if you have a basic under-
standing of statistics and probability.
The system of commuting to work is what it is - it
does what it does.
If the results are not meeting your needs (specifica-
tions), then the only thing you can do is to work to
improve the system.
Perhaps try a different route, or leave at a significant
different time (with traffic in most places that would
mean leaving earlier), or even move closer to work.
David Markovitz
How to avoid Mistake Number One
When dealing with a stable system the only way to
improve the results is to work to improve the system.
Identify the inputs and process variables and experi-
ment until you find what works better.
Deming called this the Plan-Do-Study-Act cycle.
Plan a change. Try it out on a small and manageable
scale, study the results, and, if favorable, put them
into action. If the initial results are not favorable, run
through the Plan-Do-Study-Act cycle again and again
until you learn what works best.
Rewarding people for things over which they have
no control and punishing people for things over which
they have no control is tampering. It will make things
worse. This leads to confusion among people and mo-
rale usually suffers as a result of these actions. Think
of how many Employee of the Month programs are just
rewarding people who were lucky that month. They
just got more green lights that month. And the next
month they are back in the pack, no longer singled
out for good performance, or worse, punished for poor
performance.
People work in the system that was designed by
management. Managements job is to improve the
system over time. Continually working to have stable
systems, and optimize those systems so they are
constantly getting better in relationship to all the other
systems that they interact with. You may one day reach
the point where additional improvement is not worth
cost of implementation. Then your responsibility is
to continue to monitor the system to maintain the
improved level of performance.
How can you identify whether a system is stable?
Easy - Walter Shewhart figured it out in the early
1900s. He invented Statistical Process Control (SPC)
charts. Effectively applying SPC charts helps you
identifying the difference between common causes of
variation and special causes of variation.
These charts can help you determine when to act
and when not to act. Research and experience has
found that the key to applying SPC charts effectively
lies in knowing what to measure and how frequently
to measure it. Preparing the charts and interpreting
the charts is the easy part. Knowing what to measure
is the challenge.
Understanding Mistake Number Two
Lets now turn our attention to Mistake Number Two.
Heres where something unusual occurs (a special
cause of variation) and we miss it, or ignore it. Special
causes, if left alone, can become part of the system over
time. Most systems are guided by the laws of nature.
They dont usually get better by themselves, they tend
to degrade (in physics we call this entropy), and tend
to get worse over time. When special causes of varia-
Special Edition: a roadmap to gmp compliance Part 3 55
David Markovitz
tion exist, our system is no longer stable. That is - we
can no longer predict the results to be within a certain
range.
Consider our commute to work example and use
the same factors identified above.
For several weeks your arrival time at work has
ranged from 7:55 am to 8:05 am. Its a stable system.
But one day you arrive at 8:30 am. Here its fair to ask
What happened? What was different in your com- measures into place to manage and control these.
mute today?
Possible answers include:
Car had a flat tire, and it took 30 minutes to
change to the spare tire.
Big traffic accident on the freeway or turnpike and
you were stuck in traffic an extra 30 minutes get-
ting to the next exit.
The day care provider called in sick and it took an
extra 30 minutes to find alternative care for your
children.
There are numerous possibilities here.
These are all special causes of variation. But lets
say that you start having flat tires at the rate of one
per week. The action to take here is to buy new tires.
Or big traffic accidents are occurring frequently. The
action is to take alternate routes.
How to avoid Mistake Number Two
Sometimes our systems get worse over time because
we are missing the signals that SPC charts can pro-
vide. When special causes occur, specific signals can
be found in interpreting SPC charts. These signals
dont tell you what happened, they just tell you when
to look. You have to be smart enough to know what to
look for and where to look. And then smart enough to
know what to do to eliminate the special causes from
the system. Or if the special cause is providing better
results, your job is then to find a way to incorporate
this into your system so it becomes part of a stable
system with predictable results.
56 Special Edition: A Roadmap to GMP Compliance Part 3
How you can use this information to make
better decisions
ONE - Start by characterizing your systems and pro-
cesses. Each system and process has inputs, outputs,
and process variables. Identify the inputs and then
put measures into place to manage and control these.
Identify the system and process variables. Select what
to measure and how frequently to measure these. Put
By managing your inputs and system and process
variables you can more accurately predict outcomes.
Predictable outcomes and results lead to better and
more consistent product quality and leads to less
stress in the workplace - always a good thing.
TWO - Learn how to apply SPC in your systems and
processes. Its not hard; it just takes some knowledge
and diligence to apply it effectively. Properly applied,
SPC can help make the invisible visible.
THREE - Stop asking who and start asking why. So
often when things go wrong, management is quick to
ask Who is responsible for this? Its easy to blame
people, and harder to examine our systems. It is far
better to ask the people closest to the system or pro-
cess, Why do you think this happened?
Remember people work in the system. Manage-
ment works on the system. And those working in the
system may have more knowledge of how the system
works than those outside the system can see. Their
knowledge, combined with the knowledge gained
from the effective use of SPC charts, can help you
make better decisions and avoid making the two
mistakes.
REFERENCES
1. The New Economics for Industry, Government, Education;
Deming, W. Edwards; MIT Center for Advanced Engineering
Study; 1994.
 Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight

Implementing an Effective
GLP Program at the Contract
Laboratory | IVT
Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight

ABSTRACT
This discussion provides an overview of a GLP program at a contract
laboratory. The objective of the GLP program is generation of analyti-
cal data in support of a GLP study. Understanding what is required
to complete a single study leads to understanding what quality sys-
tems must be in place in order to complete multiple and simultane-
ous studies. Desired qualities of a GLP study include transparency,
traceability, completeness, accuracy, precision, clarity, integrity, and
retrieveability. Each will render the study easier to audit and minimize
non-compliance. Administrative tools recommended for a GLP program
include pre-printed workbooks and logbooks, standardized formats for
result reporting, study-specifics, and peripheral records; study num-
bers, study files, and client codes; checklists, and other tools. A typical
study workflow is presented. This basic workflow may be scaled for
application to multiple simultaneous studies. Other useful information
provided includes an experimental workbook template, instrument
logbook template, information captured on controlled forms, GLP study
requirements, some essential SOPs, and key quality subsystems to GLP.
Elements of a quality systems approach to auditing GLP studies are
discussed. Having and following good SOPs is the key to implementing
the program described. Training personnel on SOPs and revisions, and
dealing with deviations and change is also vital. The concepts dis-
cussed herein are critical to developing a compliant GLP program that
will improve, become self-correcting, be stable and efficient.

INTRODUCTION
Implementing a GLP program in a contract lab such as ours at NSF
Health Sciences is a large undertaking. It does not really help if the
scale of the operation is relatively small: Small labs and large labs are
held to the same regulatory standards. Good quality systems, once
in place, should be scale-able. While it is true that smaller typi-
cally means fewer instruments and scientists to be qualified, it is also
true that small and large CROs and big pharmaceutical companies all
continually face risk vs. resources challenges. One must determine the
right way to do something and how to pay for it. For the purpose of
the present discussion, the something is generating analytical data to
support a GLP study, while the right way is that way or ways that are
in compliance with the GLPs and have a high probability of remaining
in compliance during growth and change (1). The goal of this discus-
sion is to provide useful, hands-on tools that have been tested in our

Special Edition: A Roadmap to GMP Compliance Part 3 57

Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight

laboratory over the past 15 years for implementing an
effective GLP program.
BACKGROUND
Many scientists approaching Good Laboratory
Practice (GLP) for the first time are surprised to find
that the subject matter lives up to its name. It is all
about having and following good practices in the
laboratory. For example, the importance of keeping
a scientific record that is good enough to permit the
reconstruction of the experiment at a later date and
the importance of scientific honesty are at the heart
of good scientific research and GLP. Keeping good
lab records on the calibration, cleaning, maintenance,
and performance of lab instruments is part of this, as
is keeping a lab notebook or workbook that includes
results from all attempts made in an experiment or
study both successful and unsuccessful. That this
record has the qualities of being original, attributable
to the author, contemporaneous, accurate, and legible
is emphasized as part of a subset of good documen-
tation practices. These and similar ideas have been
taught in the undergraduate university curriculum
for a long time. The 1952 text by Harvard Professor
E.B. Wilson, Jr. entitled Introduction to Scientific
Research remains an excellent resource (2). Still, the
largest part of the burden of educating scientists in
this area falls on the companies that use their talents.
This discussion focuses more on the how than on
the why of GLP. Readers will find an introduction
to some of the early motivation in referenced litera-
ture (3).
COMPLETING A SINGLE STUDY
Understanding what is required to complete a single
study leads to understanding what quality systems
must be in place in order to complete multiple and
simultaneous studies. Before we step through the
flow of work, we point out some of the important
qualities that a GLP study must possess. This will
help the reader understand why certain steps are
placed in the workflow. These include: transparency,
traceability, completeness, accuracy, precision, clarity,
integrity, and others such as being readily retrievable.
Each will render the study easier to audit. One test of
a good study is that it must be easy to audit and the
audit not identify any GLP non-compliances. Such
attributes can be built-in by thinking about how the
GLP program will be administered. We believe good
administration is a key to effective management.
Some simple examples of administrative tools fol-
low:
Workbooks and Logbooks
We use pre-printed laboratory workbooks. Work-
books are designed to permit the capture of infor-
mation deemed essential for later reconstruction
of the experiment. The flow of information follows
chronologically the steps taken in the lab to obtain
the data. The design is pre-approved by lab manage-
ment and Quality Assurance and changes to design
are controlled. Workbooks are easy to use and to au-
dit. Information appears time and again in the same
location in the workbook, regardless of the particular
analyst, analysis, or study. Workbooks are controlled
documents and are printed by the Document Control
Unit (DCU) only. Table I provides a list of typical in-
formation recorded in the workbook. The same logic
applies to the various laboratory logbooks (Table II).

Table 1: Experimental workbook template

Analyst name
Objective
Test article information
(ID #, lot #, description, etc.)
Instrument list (ID #, date of
last calibration, next calibration
due date)
Sample preparation (weights,
volumes, dilution factors and
final concentrations)
Reporting results (with units)
Study number & date
Test method number or protocol
number
Instrument set-up and parameters
Reference standard information
(name, lot, expiration date, purity,
manufacturer)
Solution preparation, diluents and
mobile phases (lot #, manufacturer
and expiration date of each reagent
used)
Document number
Test specifications/ranges
Standards preparation
Reagents/solutions
(name, lot, expiration date, purity,
manufacturer)
Calculations (with units and
proper significant figures)

58 Special Edition: A Roadmap to GMP Compliance Part 3

 Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight

Table II: Instrument logbook template

Instrument ID number Manufacturer Model & serial number

Instrument custodian
Instrument type/description
Date of last calibration
Date when next calibration is
due
Details of PQ
Reference the SOP (with version
number) used in performing PQ
Log of Instrument failures
Instrument location/ lab number
Table of Contents: running list
in chronological order of all
instrument events (e.g. repairs,
cleaning, preventative maintenance,
calibration, etc.)
Details of OQ
Reference the SOP (with version
number) used in performing OQ
Details of instrument repairs and
remedial actions
Qualification/Calibration status
Date of IQ
Details of IQ
Reference the SOP (with version
number) used in performing IQ
Date of PM
Details of the PM
Reference the SOP (with version
number) used in performing PM
KEY: IQ/OQ/PQ, PM stand
for Installation/Operational/
Performance Qualification and
Preventative Maintenance

Reporting Results Study-Specific and Peripheral Records

Each data table in the GLP study final report in-
cludes reference to the lab workbook containing the
original recording of the data. Each lab workbook
also contains a summary table of the results. We
call this section of the workbook Reported Results
and it includes all results derived from that part of
the experimental study that is represented by the
particular workbook. When the results are numeri-
cal (as is typical) they are given with final units and
rounded to the proper number of significant figures.
The auditor then can easily work backwards and
forwards between the GLP report and the raw data.
In addition, since we use a different lab workbook
for each attempt at completing the analysis, coupling
the lab workbooks to the GLP study final report in
this way adds integrity and helps to ensure transpar-
ency, traceability, and completeness in our reporting
practices.
A typical study generates a large number of records.
An old joke is that GLP stands for generate lots of
paper. Some of the records are identified in Tables
I-IV. Study recreation depends upon records that are
study-specific and those that are not. For example,
the analyst enters the instrument number into the
workbook (a study-specific document) and this links
it to the instrument logbook (a document used for
multiple studies). Likewise, the analytical test method
document number is entered into the workbook and
this links to the approved written procedure. The
integrity of the study depends in part on the strength
of the links between the study-specific record and the
record of events occurring simultaneously in the lab
that impact upon the quality of the study. In Table III,
we identify some of these peripheral records.

Table III: Some records peripheral to the study

Lab Operations Training
Test article (sample) log Master signature list
Reference standards log Organizational chart
Employee training binder
(including training on SOPs,
Instrument use logs
methods, protocols, quality
agreements and other)
Workbook log Employee job description
Change control log Employee curriculum vitae
Metrology
Master equipment list
Instrument logs
System suitability and instrument
failure logs.
Environmental chamber logs

Special Edition: A Roadmap to GMP Compliance Part 3 59

Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight

Table IV: Useful information captured on controlled forms

Study Transmittal Form
Date of transmittal
Name of client-coordinator
Study director contact info
Study sponsor contact info
Test article identification
Listing of tests to be done
Client code
Study number
Study title and objective
Is there a quality agreement in
place (Y/N)?
Date the study was forwarded to
the DCU
Test Article/Sample
Transmittal Form
Client code
Test article/sample description
Number of units
Lot number
Container-closure system
Test article (sample) ID number
Tests to be performed
Handling and storage
conditions
Test specifications or ranges
Client, client-coordinator and
QA signatures and dates
Kick-off Meeting Checklist
Meeting date
Study director
Study number & client code
Study personnel in attendance
Check qualifications of all study
personnel
Review study protocol & quality
agreement (if any)
Review test methods
Review test article handling and
storage and MSDS data
Review reference materials used
Review results reporting requirements
Check qualification of equipment &
instruments

Study Number, Study File and Client Code
GLP documentation has four simultaneous goals:
Capture in the study record all the information
required to reconstruct the study at a later date
Contain an audit of the study to that study
Facilitate rapid recovery of the complete study
record and
Protect client confidentiality.
The first goal is reached primarily by designing a
workbook that is self-contained while also linking
to all the supporting study records. The second is
reached primarily by segregating lab work by study
i.e. by study number. The third is reached primar-
ily by creating for each study a study file. The study
file is maintained by the DCU following an SOP that
states what must be filed and when. The fourth is
reached primarily by identifying clients by an as-
signed code that is unintelligible to outsiders.
Checklists
Checklists greatly simplify study conduct. For ex-
ample, in order to start experimental work, the study
director makes readiness checks using the Kick-off
Meeting checklist (Table IV). This document ensures
participating scientists understand the study protocol
requirements and are qualified to perform the tasks
they are being asked to perform. Checklists should
reflect good planning and be placed in the workflow
where they can aid in process execution.
Peripheral Records and the Snap-Shot-in-Time
Idea
At any time the company should be able to demon-
strate from the written recordthat at the time of the
particular analysis or test, the following were true:
A ll analysts were qualified to perform the analysis
and followed a validated or verified test method
using a qualified/calibrated instrument
Test and control articles and reference standards
were properly handled and stored at all times
Workbook was used to record experimental data
Instrument performed properly throughout the
analysis
A nalyst did not deviate from approved procedures
and
If significant changes were made having the poten-
tial to impact the quality or integrity of the study
(e.g., the study director was replaced), then these
were logged in the Change Control Log and were
evaluated and approved by the appropriate unit.
The reader following the work-flow (Figure 1)
through a single GLP study should keep in mind
that since it is a single study, all documents can be
one-time-use. Likewise, procedures such as test
procedures, calibrations, and unit lab operations can
be written into the study protocol and approved since

60 Special Edition: A Roadmap to GMP Compliance Part 3

 Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight

they are not needed again. The company can set aside a limited number of instruments, equipment, and per-
sonnel to be qualified those required to support the study. All of the experimental preparations and results
can be recorded contemporaneously in a single lab notebook. For a one-time single study, gaining control over
the study documents is a fairly trivial matter.
Even for a single study, however, the lab must meet a large number of GLP regulatory requirements. Those
that are most relevant to the present article are paraphrased and listed in Table V with reference to the cor-
responding requirement found in Title 21 of the Code of Federal Regulations, Part 58 (21CFR, Part 58, for
short). They were put into place by Congress in the late 1970s to ensure the Food and Drug Administration
that results from nonclinical laboratory studies reported to the agency through new drug applications were
valid and accurately reflect study conduct.

Table V: Some GLP study requirements (with reference to 21 CFR, Part 58)
The study must at the start be identified as a GLP study, meaning that the work is to
1
be conducted in compliance with the GLPs.
2 A study director must be assigned by Management. 58.31
3 The study director must write a study protocol. 58.120
The protocol must clearly indicate the objectives and all methods for the conduct of the
4 58.120
study.
5 The study must be placed onto a Master Schedule. 58.35
Management must ensure that an independent Quality Assurance Unit (QAU) is in
place to monitor the study, to report findings back regularly to the study director and
6 study director Management, to review the study final report to ensure that it accurately 58.31 58.35
describes the findings and conduct of the study and to write the Quality Assurance
Statement.
7 The study director must ensure that the lab is prepared to start the study.
The lab must have an area clearly designated for GLP test article (sample) receipt and
8 58.47
ensure that the test article cannot be confused with other substances e.g. regents.
Test articles, control articles and reference standards must be properly stored. It is
9 58.107
typical to dedicate a space that is under environmental control and has limited access.
Participating scientists must be qualified to play their role, which must be clearly
10 58.29
defined.
11 Written and approved procedures (e.g. SOPs) must be in place and followed. 58.81
Any and all deviations from written approved procedures (e.g. SOP deviations) must be 58.31 58.33
12
approved by the study director and documented in the raw data (e.g. workbook). 58.35
All raw data collected in the conduct of the study must be recorded following good
13 58.130
documentation practices and be readily retrievable.
Equipment and instrumentation must be shown to be fit for its intended use (e.g.
14 calibrated or standardized or qualified) and there must be a written record of this 58.63
activity.
A responsible person e.g. metrologist must be assigned to the inspection, cleaning,
15 58.63
maintenance, qualification of each instrument or piece of equipment.
16 Instrument failures must be investigated and repairs documented. 58.63
17 All reagents and solutions must be properly labeled. 58.83
18 QAU must perform at least one audit of the experimental work in progress. 58.35
19 A final report must be prepared, signed and dated by the study director. 58.185
20 The study must be archived in accordance with the GLPs. 58.190

Special Edition: A Roadmap to GMP Compliance Part 3 61

Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight

COMPLETING SIMULTANEOUS, MULTIPLE STUDIES DCU, and Archivist

Resource sharing is key to scaling-up to perform mul-
tiple simultaneous studies. Scale-up is facilitated by
copying procedures that are common to many studies
from study-specific documents such as the study pro-
tocol and pasting them into templates under docu-
ment control for use in other studies. This involves
creating the following:
Workbooks and logbooks
Standard Operating Procedures (SOPs) that de-
scribe how to perform daily lab unit operations
A nalytical test procedures to be used by multiple
studies
SOPs that contain the procedures to be followed
by the Quality Assurance Unit (QAU), Metrologist,
Templates for study final reports, protocols, work-
books and logbooks and
Standardized forms to capture information in sup-
port of the study other than raw data.
Table VI contains a list of some of the essential
SOPs that must be in place and Table IV is a list of
useful information that is captured on standardized
forms. The importance of having an SOP on Defini-
tion and Preservation of Raw Data cannot be under-
estimated. It will establish what must be recorded as
raw data and how. Any and all documents used in
recording raw data (e.g. workbooks and logbooks)
must be under control by the DCU.

Table VI: Some essential SOPs

General lab operation
Standard Operating Procedure:
Administration, Distribution,
Maintenance and Training on SOPs
Management Commitment to
Quality
Training and Qualification of
Personnel
Responsibilities of the Study
Director
Writing GLP Study Protocols
Writing GLP Study Final Reports
Receiving, Logging, Storing,
Testing, Archiving and Disposing of
GLP samples or test articles
Definition and Preservation of Raw
Data
Use of Lab Workbooks, Logbooks,
and Instrument Use Logs
Document Control
Archiving
Change Control
Investigations
(suspect data and OOR data)
Deviations
Corrective and Preventative Actions
(CAPA)
Metrology
Master Plan for Instrument
and Equipment Qualification
The Master Instrument
(Equipment) List
Use of Instrument Numbers,
Labels, and Responsible
Persons
Creation and Use of
Instrument Logbooks
Installation Qualification (IQ)
Calibration Schedule
Operational and Performance
Qualification (OQ and PQ)
OQ, PQ and Preventative
Maintenance on Temperature-
controlled Storage Areas
Analytical Balance
Lab Automatic Dishwasher
Temp and Humidity Sensor
Instrument Change Control
Metrology Investigations
Qualification by a Vendor
Lab Fume Hoods
Quality Assurance
Quality Assurance Unit Activities and
Responsibilities
Qualification of QAU auditors
Master Schedule
GLP Study Protocol Review
Monitoring In-house GLP studies
Audit of GLP Study Records
Audit of the GLP Study Final Report
Reporting QAU audit results to Study
Directors
Writing the Quality Assurance
Statement
Quality Systems Audit Schedule
Hosting Regulatory Visitors
Handling Complaints
QAU File Maintenance and Archiving
Vendor Qualification
Quality Agreements

62 Special Edition: A Roadmap to GMP Compliance Part 3

 Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight
Templates, standardized forms, and the company
organizational (org) chart should be controlled by
the DCU. Regarding the later, a format that identifies
each employee by job title and function is helpful. For
example, an employee might be identified on the org
chart as Scientist II and reference standards coordina-
tor. An auditor can review the org chart, single-out
this employee, and find in the employees training
binder the following: a job description that includes
the roles of reference standards coordinator and Sci-
entist II, a curriculum vitae that shows the employee
is qualified to serve as reference standards coordi-
nator, and Scientist II and documentation of all the
other relevant GLP training (e.g. training on SOPs)
that the employee has received to date. An outside au-
ditor will review the org chart as part of their effort to
determine that the company has adequate resources
(e.g. space, qualified lab personnel, instrumentation,
qualified QAU personnel, study director) to conduct
all of the GLP studies that are on the Master Sched-
ule. Keeping a master signature list that includes each
employees printed name, signature, and the initials
they will use on GLP documents is an excellent idea.
Similarly, keeping an updated master equipment list
is expected of the lab.
Figure 1 provides the workflow through a study
in brief. What follows is a fairly detailed look at the
study workflow (starting with receipt of the study
and ending with study archival) with references along
the way to procedures and forms that are helpful.
The Study Transmittal Form (Table IV) is used
to identify the GLP study, test article, sponsor, and
study director and provide information that is re-
quired for placing the study onto the Master Schedule
and for creation of the study file by the DCU. By writ-
ing the study protocol, the study director establishes
control over the study. The protocol and its template
are controlled through the DCU. Once the protocol
is signed by the study director, the QAU places the
study onto the Master Schedule. The Kick-off Meet-
ing checklist (Table IV) is used by the study direc-
tor to ensure that the lab is ready to start the study.
Test articles are received in the designated area by
the sample-coordinator following an SOP (listed in
Table VI under the title Receiving, Logging, Storing,
Testing, Archiving and Disposing of GLP Samples
or Test Articles) and using the Test Article/Sample
Transmittal form (Table IV). The later form prompts
both sender and receiver to record vital informa-
tion about the test article. Test articles (and control
articles) are logged into storage under those condi-
tions specified on the Test Article/Sample Transmittal
form. Their condition upon receipt is noted and any
chain-of-custody paperwork is filed in the study file.
The DCU prints the workbooks for the study and logs
them into the workbook logbook. Participating sci-
entists log out the workbook they need and proceed
to perform experimental work as per the appropriate
study protocol, SOPs and written test methods, while
recording raw data contemporaneously in the work-
book (Table I). The QAU will perform at least one
audit of the experimental work while it is in prog-
ress. QAU uses an audit checklist and a standard-
ized report form to report audit findings back to the
study director and the study directors management.
Workbooks are subject to peer-review then submit-
ted to the QAU for review. The QAU will release
the workbook after all corrections have been made,
i.e., all related Corrective and Preventative Actions
(CAPA)) are closed-out. The study director writes the
study final report, which includes all of the data (i.e.,
good, bad and ugly). The study director references in
the report the study protocol, all workbooks used in
the study and all investigation reports (e.g. suspect
data investigation) generated by the study. The study
director attaches the compliance statement to the
report that testifies to the fact that the study was con-
ducted under GLP and lists out any and all significant
non-compliances. The QAU reviews the study final
report to ensure that the report accurately reflects the
conduct of the study. The QAU writes the Quality As-
surance Statement, listing out each phase of the study
that was audited, the date of each audit and the date
that audit findings were reported to the study director
and the study directors Management. The study final
report, compliance statement, QAU audit checklist
and QA Statement are all template-based, with the
template and all its revisions controlled through one
or more SOPs. The study director signs and dates the
study final report and submits it and all other study
materials to the archives. An exact copy of the study
final report is issued to the sponsor.
THE QUALITY SYSTEMS APPROACH
The QAU will acquire data on the performance of
personnel, instrumentation, equipment, and facil-
ity from multiple studies over a period of time.
Examples include the number of CAPAs identified
with an individual and the number of instrument
failures associated with an instrument. On a higher
level, the QAU collects data on how well the various
functions are performing. An example is the use of
workbooks: Are the workbook templates being ap-
propriately revised over time? Are workbooks being
used properly? Logged properly? Controlled properly?
On still a higher level, the QAU collects data on the
various systems in place to control the functions,
e.g., the DCU, Training, Metrology, Vendor Quali-
fication, Change Control, and Archiving systems.
Are investigations conducted in accordance with the
Special Edition: A Roadmap to GMP Compliance Part 3 63
Richard C. Wedlich, Agata E. Libera, Joseph M. Fransen, C. Tellarini, T. Heath, N. Knight
investigations SOP? Are personnel being trained on
SOP revisions? Is Metrology on top of the calibration/
qualification schedule? Are changes to the facility air-
handling system receiving the proper review and ap-
proval before being made? We refer to these systems
as quality systems, although in the larger scheme,
Good Laboratory Practice is the quality system (4). All
of these data are developed by the QAU and reported
to management with the aim of identifying and cor-
recting negative or disruptive trends. Some key qual-
ity systems used in a GLP program are listed in Table
Table VII: Key quality systems (sub-systems) to GLP
Written procedures (SOPs) Test article (sample) receipt
Metrology Reference standards
Quality Assurance Unit (QAU) Deviations and planned changes
Vendor qualification Change Control
Document Control (DCU) & Corrective & Preventative Actions
Archiving (CAPA)
*Laboratory Information Management System
IMPLEMENTATION
Having and following good SOPs is the key. Closely
related is the job of training personnel on SOPs
and revisions and of dealing with deviations and
change. The former is handled through the training
program, while the latter are handled through the
CAPA and Change Control programs, respectively.
It is important to understand that implementing
is an iterative, learning process for the lab. Discrep-
ancies (gaps), redundancies and inconsistencies in
the program, along with other shortcomings reveal
themselves upon implementation. It is a goal for the
process, through continual improvement, to con-
verge on what we can call absolute compliance. The
adequately designed program will improve, become
self-correcting and at some point highly-stable
and efficient. The poorly designed program will not
get there. It will grow into a beast, becoming a con-
stant drain on resources, resulting in lower quality
and a decreased potential for the lab to ever perform
quality work. The companys leadership will reflect
the will, drive, and commitment to implement the
GLP program.
SUMMARY
This discussion has provided detail in describing a
real GLP program so that the reader relatively new
to GLP can get a firm grip on the subject. Having the
correct, clearly stated, and understood goal, one maps
64 Special Edition: A Roadmap to GMP Compliance Part 3
VII. They operate in cafeteria-like fashion, ensuring
that the resources are available in order to meet the
various requirements (on personnel, procedures, in-
strumentation, equipment, available lab space, proper
storage conditions, data recording and retrieval, and
others) for conducting the study under GLP. The per-
formance of each quality system is continually moni-
tored by the QAU, who reports back to management,
who in turn, assures that corrective and preventative
actions are taken when needed. The QAU will follow-
up on the CAPA to ensure that it was effective.
LIMS*
Training
Complaints
Investigations
Continuous improvement
out a laboratory program, complete with the support-
ing functions of document control, records retention
and quality assurance and backed by a committed
management. When installed and implemented, it
will become self-correcting and compliant with the
GLPs. In this way, a quality culture will become a
reality in the organization.
REFERENCES
Code of Federal Regulations, Title 21, Good laboratory
practice for non-clinical laboratory studies (Govern-
ment Printing Office, Washington, DC), Part 58.
E.B. Wilson Jr., Introduction to Scientific Research,
McGraw-Hill Publishers, New York, NY, 1952.
J.P. Seiler, Good Laboratory Practice, Springer, New
York, NY, 2nd ed., 2005.
FDA, Draft Guidance for Industry: Quality Systems
Approach to Current Good Manufacturing Practice Regu-
lations (Rockville, MD, Sept., 2004).
 Jerry Lanese and Timothy J. Fields

GXP Talk: Questions 66 & 67 |

IVT
Jerry Lanese and Timothy J. Fields, editors

A Column for Discussion of Issues Identified by Readers of the Journal of GXP

Compliance.
This column is one of a continuing series in which representatives of the in-
dustry and the regulatory agency have an opportunity to ask questions about,
and express opinions on, current GXP issues. The Editors welcome your ques-
tions and your opinions on the questions.

QUESTION 66
If we receive a raw material from a supplier and it does not meet our
specifications should the event be captured in our deviation system, the
suppliers deviation system, or tracked in some separate system?

ANSWER
The failure of an incoming raw material component should be entered
into a defined system that is established to log the failure, manage the
investigation and determination of the cause of the failure and recom-
mend corrective and/or preventive actions. This might be a system
committed only to managing component failure investigations. In most
organizations, it would be the site deviation system designed to log all
deviations and manage the investigation, determination of corrective
and/or preventive actions and the CAPAs. It is entirely up to the orga-
nization how it manages the follow-up to a component failure. There
must be a system, however, for timely determination of the cause and
follow-up, the process must be defined (there should be a procedure or
procedures), the procedure(s) must be followed and records must be
completed, reviewed, and approved by the quality unit and retained.
In the specific case of a raw material failure, it is very likely that the
supplier will be involved. The failure also will be entered into the sup-
pliers system, and the supplier will be responsible for a significant part
of the investigation and follow-up. General supplier responsibilities
in the case of a component failure should be discussed in the Quality
Agreement.

QUESTION 67
The most cited FDA observation is not following procedures. How does
an organization eliminate or justify human error such as not following
procedures?

ANSWER
Yes, this is a common problem with many potential underlying reasons

Special Edition: A Roadmap to GMP Compliance Part 3 65

Jerry Lanese and Timothy J. Fields

that must be explored before providing an answer. also welcome your questions for responses from read-
One potential reason for not following a procedure ers. Please submit your responses to the above or new
is that the procedure is unclear or lacks sufficient questions for consideration to Jerry Lanese or Tim
detail regarding how to perform a task. If the tasks to Fields. You may also to any previous questions via the
be executed are not clearly defined, the person may comments section below.
deviate from the SOP to complete the task. Another
reason for not following the procedure may be due to
training. Often on the job training is provided by a
more experienced person, who may have developed
shortcuts over the years and who then, in turn,
teaches these shortcuts to the new person. These
shortcuts may deviate from the actual SOP. Getting
the people who perform the tasks to write the SOP,
easily solves the above examples. Their input helps
ensure the SOP is written in a way that they under-
stand it and in the manner in which they actually
perform the tasks. They will feel a sense of owner-
ship which will encourage them to follow the SOP.
Another reason for not following SOPs is that
people get into a hurry, so again, they take shortcuts
or simply fail to perform steps as required by the
SOP. A common example of this is the failure to
document the performance of steps. People are hur-
rying to execute tasks and simply forget to document
that the tasks were completed as described in the
SOP. Ensuring that personnel have adequate time to
perform tasks or that adequate resources are available
can help address this issue.
Often SOPs are revised, and the people perform-
ing the tasks are not advised of the changes. They
continue, therefore, to follow the old SOP and are
unaware of the changes. This can be solved by
ensuring that personnel are advised and trained on
new or revised SOPS prior to performing the tasks.
Inadequate training is often an underlying cause of
failure to follow an SOP.
The last reason people do not follow SOPs is lack of
concern, i.e. they are just there for the paycheck. The
only way to resolve this problem is termination.
Mistakes happen; however, the goal is to eliminate
systemic errors that may be caused by some of the
reasons cited above.

Two new questions for comment.

QUESTION 68
The GMPs require that non-sterile products be free of
objectionable organism. What is an objectionable
organism?

QUESTION 69
Do we need to validate test methods for raw materi-
als, intermediates and in-process materials? If yes,
which of the characteristics should be evaluated?
Let us know your opinion on these questions. We

66 Special Edition: A Roadmap to GMP Compliance Part 3

 Jerry Lanese and Timothy J. Fields

GXP Talk: Questions 68 & 69 |

IVT
Jerry Lanese and Timothy J. Fields, editors

A Column for Discussion of Issues Identified by Readers of the Journal of GXP

Compliance.
This column is one of a continuing series in which representatives of the in-
dustry and the regulatory agency have an opportunity to ask questions about,
and express opinions on, current GXP issues. The Editors welcome your ques-
tions and your opinions on the questions.

QUESTION 68
The GMPs require that non-sterile products be free of objectionable
organism. What is an objectionable organism?

ANSWER
21CFR Part 211.113(a) states: Appropriate written procedures, de-
signed to prevent objectionable microorganisms in drug products not
required to be sterile, shall be established and followed. This is further
supported by21CFR 211.165(b): There shall be appropriate laboratory
testing, as necessary, of each batch of drug product required to be free
of objectionable microorganisms. However, as is the case with many
cGMP requirements, the determination of what this means is left to the
firm. The definition of an objectionable organism is dependent on the
product or material in question. For example, the definition of an ob-
jectionable organism for an oral drug product may be different than the
definition of an objectionable organism in a topical product. The defini-
tion must consider the effect of the organism on the product as well
as the end users safety. If an organism can affect the product physico-
chemical or biological properties, it should be considered as objection-
able as it may alter the product beyond its defined quality, efficacy, or
purity requirements. Obviously any microorganism that can impact the
safety of the end user or that is considered to be pathogenic must be
considered as objectionable. A risk assessment should be performed to
determine if an organism should be considered as objectionable. The
risk assessment should include subject matter experts in microbiology
and medical personnel that can evaluate the potential risk to the end
user. As such organisms are encountered, a list should be prepared and
maintained of these organisms. As indicated in 21CFR 211.165(b), the
product should be tested for such organisms where necessary. If such
organisms are detected in the environment through the environmental
monitoring program, in water, or other raw materials, appropriate con-
trols should be implemented to eliminate the source.

Special Edition: A Roadmap to GMP Compliance Part 3 67

Jerry Lanese and Timothy J. Fields
QUESTION 69
Do we need to validate test methods for raw materi-
als, intermediates, and in-process materials? If yes,
which of the characteristics should be evaluated?
ANSWER
Yes. The requirement for test method validation
is found in 211.165(e), a subparagraph of 211.165,
Testing and Release for Distribution. From this, one
might interpret that a laboratory is only required
to validate product release methods. However, the
GMPs were written a long time ago and the industry
has changed. It is current industry practice and FDA
expectation that all test methods used in the produc-
tion and control of a pharmaceutical product are
validated. This includes methods used for the testing
of components such as starting materials and packag-
ing, in-process materials, and finished products.
Whether or not required, demonstrating and docu-
menting that a test method performs as intended is
good science and good business.
Both USP <1225> Validation of Compendial Meth-
ods and ICH Q2(R1) categorize test methods into
types of methods and list seven characteristics that
should be considered in the validation of a chemical
test method. These include:
Specificity
Accuracy
Precision
Linearity
Range
68 Special Edition: A Roadmap to GMP Compliance Part 3
Limit of Detection
Limit of Quantitation.
These references also provide guidance as to which
characteristics should be studied for each type of
method.
It is appropriate to note that a USP Expert Panel
has recently published a stimulus article on the
lifecycle approach to test method validation. In this
article, it is stated that ICH Q2(R1) and USP <1225>
were originally intended to provide guidance but
have come to be interpreted as mandatory practice.
The article proposes the implementation of a guid-
ance that encourages method development chemists
apply good science to understand and control sources
of variability as they develop and validate a method.
Two new questions for comment.
QUESTION 70
Biological products are more variable than small
molecule products. How can one validate the process
as required by cGMP?
QUESTION 71
What is the regulatory requirement for process im-
provement in the pharmaceutical industry?
We welcome your opinion on these questions.
Also, let us know if you have any questions to ask
of the industry. Please submit your questions or
responses to Jerry Lanese or Tim Fields. You may also
replay to any previous questions.
 Jerry Lanese and Timothy J. Fields

GXP Talk: Question 70 | IVT

Jerry Lanese and Timothy J. Fields, editors

GXP Talk provides a forum for compliance practitioners to address

issues identified by the readers of the Journal of GXP Compliance. GXP
Talk is the longest-running continuing series in the Journal of GXP Com-
pliance. This series was introduced in April, 2006. Previous discussions
addressed a wide range of compliance activities covering essentially all
sections of the US GMPs. Responses to questions and associated opinions
have been contributed by representatives from multiple pharmaceutical
industry and regulatory agencies.
Readers are invited to participate and contribute questions, answers,
and discussion for this series please share your successful practices
with others. This column succeeds when we are able to address cur-
rent GXP issues submitted by interested readers. Please contact column
coordinators Jerry Lanese at jerry@lanesegroup.com or Tim Fields at
timfields213@comcast.net with comments or submissions for publication.
We welcome your questions and your opinions on questions.

QUESTION 70

What are the Regulatory Requirement and Expectations for Process

Improvements in the Pharmaceutical Industry?

ANSWER
21CFR211.180, GMP for Finished Pharmaceuticals (1) states that re-
cords for each product must be reviewed at least annually to determine
the need for changes to drug product specifications or manufacturing
control procedures. This is known as the annual product review and
the intent is that the firm should identify and implement product and
process improvements. The GMPs are regulations -- An annual prod-
uct review must be conducted.
In addition to the above legal requirements, more recent guidance
documents support the concepts of continual improvement. Although
these are not regulations, they do express the regulatory expectations.
Regulations are interpreted and enforced consistent with these guid-
ances. As regulatory agency investigators become more familiar with
these guidances, expectations for ongoing improvement initiatives will
increase.
ICH Q8(R2), Pharmaceutical Development (2), discusses product life-
cycle management and continual improvement. Companies have op-
portunities to evaluate approaches to improve product quality. Process
performance should be monitored by trend analysis to confirm predict-

Special Edition: A Roadmap to GMP Compliance Part 3 69

Jerry Lanese and Timothy J. Fields
ed quality attributes. Changes in the design space
may occur based on additional process knowledge.
ICH Q10, Pharmaceutical Quality System (3), states
that one of the objectives of a Pharmaceutical Quality
System is to facilitate continual improvement and
provides guidance for the continual Improvement of
process performance and product quality through-
out the product lifecycle.
The Quality by Design (QbD) initiative, first identi-
fied by Juran and later applied to pharmaceutical
manufacturing, was the basis for focus on continual
improvement as described in subsequent ICH and
FDA guidances. QbD provides a systematic approach
to product development emphasizing process under-
standing. Process understanding coupled with actual
experience and capability analysis should identify
process improvements. Five phases in continual
improvement activities have been identified. Con-
tinual improvement is applicable to new products and
legacy products with historical manufacturing experi-
ence. A recent paper by Yu et. al. (4) overviews the
QbD process and provides numerous references.
The FDA Guidance on Process Validation (5)
suggests that data gathered during the commercial
manufacturing stage of the validation lifecycle might
suggest ways to improve and/or optimize the process
by altering some aspect of the process or product,
such as the operating conditions (ranges and set-
points), process controls, component, or in-process
material characteristics.
The revised European Union GMPs (6) also include
an expectation for continuous improvement. Al-
though the requirement for continual improvement
in the US GMPs, which are now more than 35 years
old, is a matter of interpretation, it is a regulatory
requirement in the EU. It is clear from the above
regulations, guidances, and associated papers that
contemporary quality systems in the pharmaceutical
industry must have a program of continual improve-
ment.
References
1. Current Good Manufacturing Practice for Finished
Pharmaceuticals; 21CFR 211.180(e).
2. ICH Q8(R2), Pharmaceutical Development. Au-
gust, 2009.
70 Special Edition: A Roadmap to GMP Compliance Part 3
3. ICH Q10, Pharmaceutical Quality System, June
2008.
4. Yu, Lawrence X, Gregory Amidon, Mansoor A.
Khan, Stephen W. Hoag, James Polli, G.K.Raju, and
Janet Woodcock. Understanding Quality by Design.
AAPS J, 2014 Jul; 16(4): 771-783, accessed 10-4-15.
5. Guidance for the Industry: Process Validation,
General Principles and Practices; FDA, January, 2011.
6. http://ec.europa.eu/health/files/eudralex/vol-4/
vol4-chap1_2013-01_en.pdf, accessed 10-3-15.
Future Questions and Discussion Topics
The following are questions submitted by readers for
discussion in future issues of GXP Talk. Comments
on any of the following as well as new questions for
discussion are invited. Further discussions on previ-
ous questions (link) are also invited. Submit ques-
tions, comments, or topics for discussion to column
coordinators Jerry Lanese at jerry@lanesegroup.
com or Tim Fields at timfields213@comcast.net. We
welcome your input this column succeeds because
of reader input!
Pending Questions
The following are questions that have been received
and will be answered in the future. We are interested
in your input as we formulate the responses.
1. Biotech process validation. Biological products are
more variable than small molecule products. How
can one validate the process as required by cGMPs?
2. Raw materials. If a raw material does not meet
specifications, should it be captured in the site de-
viation, the suppliers deviation system, or another
deviation system? Who should investigate this devia-
tion -- the firm or the supplier?
3. Manufacturing yield. What are requirements for
documenting manufacturing process yield?
4. Personnel training. What are regulatory require-
ments and expectations for personnel training in
pharmaceutical manufacturing and associated activi-
ties?
5. What disciplines are required to approve change
controls?
6. How frequently should data be trended?
 Jerry Lanese and Timothy J. Fields

GXP Talk: Questions 71 & 72 |

IVT
Jerry Lanese and Timothy J. Fields, editors

GXP Talk provides a forum for compliance practitioners to address

issues identified by the readers of the Journal of GXP Compliance. GXP
Talk is the longest-running continuing series in the Journal of GXP Com-
pliance. This series was introduced in April, 2006. Previous discussions
addressed a wide range of compliance activities covering essentially all
sections of the US GMPs. Responses to questions and associated opinions
have been contributed by representatives from multiple pharmaceutical
industry and regulatory agencies.
Readers are invited to participate and contribute questions, answers,
and discussion for this series please share your successful practices
with others. This column succeeds when we are able to address cur-
rent GXP issues submitted by interested readers. Please contact column
coordinators Jerry Lanese at jerry@lanesegroup.com or Tim Fields at
timfields213@comcast.net with comments or submissions for publica-
tion. We welcome your questions and your opinions on questions.

QUESTION 71
Biological products are more variable than small molecule products.
So, how can one validate the biological process, as required by the
FDA?

ANSWER
The U.S. cGMPS, as codified in 21CFR 210-211, do not distinguish
between requirements for large molecules (i.e., Biologics) and small
molecule products. 21CFR 211.110(a) requires that control proce-
dures be established to monitor the output and validate the perfor-
mance of those manufacturing processes that may be responsible for
causing variability in the characteristics of in-process materials and the
drug product. Certainly chemical reactions as used in small molecule
manufacturing processes are well defined and easily controlled relative
to a biological system. However, the same basic validation principles
apply to biologics as are applicable to small molecules: Understand the
sources of variation, detect the presence and degree of variation, under-
stand the impact of variation on the process and ultimately on product
attributes, control the variation in a manner commensurate with the
risk it represents to the process and product.
The FDA Guidance Document: Process Validation: General Princi-
ples and Practices published in 2011 also states that the process valida-
tion principles included in the guidance apply to biologics. This should
be expected since the purpose of validating a process is to ensure that

Special Edition: A Roadmap to GMP Compliance Part 3 71

Jerry Lanese and Timothy J. Fields
a safe product is consistently produced that has the
efficacy and quality attributes that it is intended to
have.
The guidance documents breaks process validation
into three major phases:
Stage 1 Process Design: The commercial manu-
facturing process is defined during this stage based
on knowledge gained through development and
scale-up activities.
Stage 2 Process Qualification: During this stage,
the process design is evaluated to determine if the
process is capable of reproducible commercial manu-
facturing.
Stage 3 Continued Process Verification: Ongoing
assurance is gained during routine production that
the process remains in a state of control.
Lets explore some examples of applying these
principles to biologicals.
Stage 1 - Process Design: one example of ap-
plying process design concepts to biologicals is in
purification steps such as chromatography. Small
scale studies can be performed to define the optimal
conditions for purification to ensure good yields with
high quality product. Conditions such as resin to be
used, pH, salt and detergent concentrations can all be
developed at small scale and then used to establish
processing parameters for full scale. Similar pro-
cess design studies can be used to establish the best
growth conditions for upstream processing.
Stage 2 Process Qualification: continuing with
the purification theme, the parameters defined at
small scale can be implemented and tested at large
scale using confirmatory studies or batches. At this
stage it is critical to understand the impact of critical
process parameters on the process. For example,
what happens if the pH is too high or too low, of
what happens if the salt concentrations are too high
or too low. These parameters should be defined at the
small scale and confirmed at full scale. Such experi-
ments are too costly to perform at the full scale.
Stage 3 Continued Process Verification: pro-
cesses should be continuously monitored to evaluate
the robustness or the process. Deviations should be
investigated to provide valuable data that may allow
extending operating ranges. However, it is critical
that when extending operating ranges that one has
clear understanding of the impact of the changes.
Likewise when evaluating changes to a process, it
is important to fully understand the impact on the
process. For example, changes to operating param-
eters for a bioreactor may increase yield, but may lead
to lower purity or other by-products. Going back to
the process knowledge and understanding is critical
for ensuring that the process remains in a state of
control.
72 Special Edition: A Roadmap to GMP Compliance Part 3
Risk assessments should be considered in deter-
mining critical process parameters and their control.
Likewise the application of risk assessment tools as
part of evaluating changes or deviations are critical
for ensuring the process remains in a state of control.
The key to validating a process whether it is a bio-
logical process or a chemical process is to identify the
critical process parameters and understand the affect
they have on the process and control their variability.
QUESTION 72
If a raw material does not meet specifications should
it be captured in the site deviation, the suppliers
deviation system or another deviation system? Who
should investigate this deviation, the firm or the sup-
plier?
ANSWER
This is a very timely question because the FDA, and
other regulatory agencies, are scrutinizing deviations
and deviation investigations. It is clear from pub-
lished observations that the regulators expect that all
deviations will be investigated, the cause identified,
and appropriate corrective and/or preventive actions
implemented and verified within a reasonable time.
The paragraph cited in most FDA observations re-
lating to inadequate investigations is 21CFR211.194,
Production Record Review, which states: All drug
product production and control records, including those for
packaging and labeling, shall be reviewed and approved
by the quality control unit to determine compliance with
all established, approved written procedures before a batch
is released or distributed. Any unexplained discrepancy
or the failure of any of its components to meet any of its
specifications shall be thoroughly investigated, whether or
not the batch has already been distributed.
It is clear that the regulation requires an investiga-
tion of any deviation from the expected. Since this
deviation was identified at the site of the final prod-
uct production it should be captured in the deviation
system of that site and that site is responsible for
assuring a timely investigation of the deviation. Cor-
rective and/or preventive actions are also expected.
Which organization is responsible for conducting
the deviation investigation is dependent upon site
policies and procedures and agreements between the
supplier and the site. These agreements are gener-
ally spelled out in the quality agreement between the
product production site and the raw material supplier
and include communications between parties in the
event of a raw material failure, responsibilities for
failure investigations, and the time within which any
investigation and follow-up actions are to be com-
pleted. Product production site deviation procedures
and time requirements should be consistent with the

quality agreement with the raw material supplier and
provide additional requirements for actions taken
internally.
In the case sited, it is very likely that any cor-
rective action or preventive action identified in the
investigation will occur at the raw material suppliers
site. This will complicate the product production
sites responsibility for assuring a thorough investiga-
tion and completion of corrective and/or preventive
actions. This deviation does raise questions about
the consistent quality of the incoming component.
Identification of the cause of the problem and process
improvements by the supplier are important for the
maintenance of the quality of the incoming raw mate-
rial, and therefore, the quality of the final product.
Jerry Lanese and Timothy J. Fields
Whether or not a process for the investigation of
a failure of a component is identified in agreements
with the supplier, the product production site is
responsible for assuring the completion of an investi-
gation and appropriate follow-up actions in a timely
manner.
We want to encourage our readers to ask questions
and comment on the answers. One of the purposes
of this column is to generate a dialog within the FDA
regulated industries. Please submit your questions
or comments to Jerry Lanese or Tim Fields. You are
encouraged to comment on any previous questions or
answers.
Special Edition: A Roadmap to GMP Compliance Part 3 73