DATA INTEGRITY ASSURANCE AS KEY FACTOR FOR SURVIVING CORPORATE AUDITS AND REGULATORY INSECTIONS

Size: px

Start display at page:

Download "DATA INTEGRITY ASSURANCE AS KEY FACTOR FOR SURVIVING CORPORATE AUDITS AND REGULATORY INSECTIONS"

Bryce King
6 years ago
Views:

1 GLOBAL PROVIDER, LOCAL SOLUTIONS IN YOUR LANGUAGE DATA INTEGRITY ASSURANCE AS KEY FACTOR FOR SURVIVING CORPORATE AUDITS AND REGULATORY INSECTIONS Francesco Amorosi PhD Octorber 2017

2 DATA INTEGRITY & CSV: REGULATORY BACKGROUND

3 MEDICINES AND QUALITY OF MEDICINES: ONE POINT OF VIEW ULTIMATE TARGET OF GXP Ensure the Product Quality and Patient Safety within the entire Product Life Cycle from R&D to Distribution 3

4 GLOBALIZATION: NEW CHALLENGES FOR REGULATORS Globalization has fundamentally changed the economic and security landscape : Advances in transportation, telecommunications, infrastructure More outsourcing manufacturing Greater complexity in supply chain Imports coming from countries with less developed regulatory systems Computer Systems and New Technologies are more and more supporting any Actor of the Supply Chain All this demands a major improvement in the way Regulators/Drug Products Manufacturers, Distributors, Suppliers fulfill their mission. 4

5 QUALITY IN 21 ST CENTURY CREATE GLOBAL COALIZATION (to avoid rules interpretation and rely on each others ) PIC/S membership in continuous expansion Inspectional Cooperation Program Jointly announced by FDA & EMA in 2011 (Now in extension and maintenance phase) Formal incorporation of ICH Quality Guidelines into assessor/inspector guidelines (both EU and US Sides) FIGHT COUNTERFEIT Serialization & Aggregation Requirements RELY ON DATA Focus on DATA INTEGRITY (QC and Production) 5

DATA INTEGRITY ISSUES PLAGUE OVERSEAS DRUGMAKERS 1/2 Data integrity issues were the most striking findings included in the Office of Manufacturing Quality s 2015 annual report of warning letters.

6 DATA INTEGRITY ISSUES PLAGUE OVERSEAS DRUGMAKERS 1/2 Data integrity issues were the most striking findings included in the Office of Manufacturing Quality s 2015 annual report of warning letters. FDA investigators found data manipulation, cover-ups with faked test results, uneven paper trails, destroyed or misplaced records, backdated production reports. The warning letters note problems such as failure of the quality unit to ensure: materials are appropriately tested and the results reported, lack of appropriate controls for batch records, lack of controls for documentation. Moreover, data integrity issues uncovered during an inspection were almost always red flags for larger quality control problems, warning letters indicate 6

7 DATA INTEGRITY ISSUES PLAGUE OVERSEAS DRUGMAKERS 1/2 Each warning letter singled out unauthorized access or changes to data and failure to prevent data omission. The FDA also wants to see detailed management strategies and procedures for getting at root causes of data integrity practices affecting the quality of drug products. Data integrity lapses have become so widespread globally, that even the World Health Organization stepped in last year to issue guidance to bridge the gaps between the principles of good data and record management and actual practices. Most of the letters urged companies to hire a third-party consultant with expertise in data integrity and GMP issues, and drugmakers were urged to review their entire organizational structure and personnel responsibilities. 7

8 DATA INTEGRITY EXPERTS FDA expectations on the role of the Data Integrity Expert Gapless identification (electronic data have been recorded and documented incorrectly). Identification and interview of all employees [ ] and the management which contributed to or caused the GMP deviations. Supporting indications of GMP non-compliant handling of electronic data should be identified. It must be revealed to what extent the top and middle management knew about or was involved in the data manipulation. The data integrity expert should find out whether managers are still able to have an influence on the integrity of GMP relevant data. Internal reviews are to be extended to other sites which are known to be involved in violations of GMP-compliant handling of data 8

9 REQUIREMENTS FOR REGULATED DATA REGULATORY EXPECTATION DATA INTEGRITY The extent to which all data are complete, consistent and accurate throughout the data lifecycle, i.e. from initial data generation and recording through processing (including transformation or migration), use, retention, archiving, retrieval and destruction. Where DATA are generated and used to made GxP quality decisions, ensure it is TRUSTWORTHY and RELIABLE YOUR GxP RECORDS REQUIRED TO BE ALCOA 9

10 WHY DATA INTEGRITY MIGHT BE VIOLATED IN YOUR COMPANY (Anil Sawant- PDA Europe - Data Integrity Workshop - London, 2016) 10

Awareness Poor Quality Culture Obsolete /

11 POTENTIAL ROOT CAUSE FOR DATA INTEGRITY VIOLATIONS POTENTIAL ROOT CAUSE FOR DATA INTEGRITY VIOLATIONS Business Pressure No Awareness Poor Quality Culture Obsolete / Inadequate Automation Vulnerable Process DATA INTEGRITY VIOLATIONS STATS 80% 20 % Unintentional Intentional 11

12 REACTION OF REGULATED AGENCIES o Increase in number and severity of DI findings by almost every Regulated Agency o Impact to public health o Increased focus OBSERVED STATUS REACTION GxP Data Integrity Definitions and Guidance Guidance on good data and record management practices Data Integrity and compliance with CGMP (draft) Guidance on data Integrity (draft) Records and Data Integrity GUIDE V1 Mar (V2 Jul. 2016) Sept Apr Aug Mar t 12

13 DATA INTEGRITY FOUNDATIONS

14 DATA INTEGRITY GOVERNANCE SYSTEM The Data Governance System will be oriented to establish the Directives to ensure the Integrity of Regulated Data created and maintained by the company for Regulated purposes 14

15 DATA GOVERNANCE SYSTEM FOUNDATION Data Governance Establishment Plan Data Integrity Policy Code of ethics Computer System Policy Training Program Data Integrity Assessment Procedure Audit Trail Review procedure 15

DATA GOVERNANCE ESTABLISHMENT PLAN Purpose: Design the Governance System to demonstrate effective data governance practices including the necessity for a combination of appropriate organizational

16 DATA GOVERNANCE ESTABLISHMENT PLAN Purpose: Design the Governance System to demonstrate effective data governance practices including the necessity for a combination of appropriate organizational culture and behaviors and an understanding of data criticality, data risk and data lifecycle. This will include: communication of expectations to personnel at all levels within the organization in a manner organizational controls: Procedures, Training Program for Management and staff, Documented authorization for data generation and approval, Routine data verification; Periodic surveillance technical controls: Computerized system control and Automation Both long term and interim measures should be implemented to mitigate risk, and will be monitored for effectiveness. Responsibilities: High management 16

17 DATA INTEGRITY POLICY DI Policy establishes the general approach for GxP data integrity created and maintained by the company. Purpose: set forth the activities to assure the completeness, consistency and accuracy of all data generated in GxP impacting areas and facilities according to the regulatory requirements and to ensure that Regulated data are: attributable, legible, contemporaneous, original and accurate. Responsibilities: High management 17

18 COMPUTER SYSTEM POLICY CS Policy establishes the general approach for implementing, maintaining use of, and retirement of computerized systems in GxP regulated environments Purpose: ensure any CS, IT equipment/service GxP critical is validated or qualificated prior to it use and maintained in a valid state throughout the system lifecycle, together the assurance of data integrity Responsibilities: Management, BPO, TO, QA, IT 18

TRAINING PROGRAM Establish a standard approach (methods and responsibilities) for the training Each personnel should be adequately trained in order to fulfil

19 TRAINING PROGRAM Establish a standard approach (methods and responsibilities) for the training Each personnel should be adequately trained in order to fulfil their duties and responsibilities according to their job description guaranteeing to have the knowledge and skills required to perform tasks. Responsibilities: QA 19

20 AUDIT TRAIL REVIEW PROCEDURE The Audit Trail Review is a process to assure that activities related to a system and modifications to the data are executed in a controlled manner, ensuring the integrity of the data managed by the system. Purpose: to define the strategy and methodology to execute the Audit Trail Review assuring data integrity and compliance with the applicable rules. Responsibilities: BO, QA, Supervisor, Application manager, IT, Validation System which manages RER and used to release Finished Products YES Class 1 AUDIT TRAIL REVISION WEEKLY with AQL 1.5 NO - System which manages RER supporting the batch release of Raw Materials or Intermediate Products - System which manages RER supporting Stability Studies - System which manages RER with direct impact on product Quality YES Class 2 AUDIT TRAIL REVISION MONTHLY with AQL 4.0 Revision of the Audit Trail frequency and/ or AQL by QA and Business Owner, increasing or decreasing the conditions based on the identified recurrent deviations and/or anomalies NO Class 3 AUDIT TRAIL REVISION ANNUALLY with AQL

21 COMPUTER VALIDATION LIFE CYCLE PROCEDURE PACKAGE IT Infrastructure Qualification Life Cycle Computer Validation Life Cycle Procedure Supporting Processes Security Management Backup & Restore Archiving Business Continuity System Inventory Management Supplier Assessment Computerized Systems Risk Management Retirement Periodic Review Incident Management Change and Configuration Management 21

requirements Purpose: defined process for the qualification IT Infrastructure supporting GxP

22 IT INFRASTRUCTURE QUALIFICATION LIFE CYCLE Demonstrate that infrastructure components (networks, servers, clients, server rooms, software tools) are able to meet the related technical requirements Purpose: defined process for the qualification IT Infrastructure supporting GxP computerized systems, which shall be based on actual risks and regulatory compliance. Responsibilities: IT, QA 22

23 ALCOA ASSESSMENT ELECTRONIC RECORDS CASE STUDY

24 DATA INTEGRITY GOVERNANCE ROADMAP DATA INTEGRITY GOVERNANCE PROCESS INVENTORY PROCESS PRIORITY RANK PROCESS MAPPING & DATA LIFE CYCLE GMP RECORDS INVENTORY LIST OF BUSINESS PROCESSES RISK-BASED PRIORITY ASSOCIATED TO EACH MACROPROCESS PROCESS STEPS ASSOCIATED TO EACH BUSINESS PROCESS & DATA LIFE CYCLE LIST OF GMP RECORDS (BOTH PAPER AND ELECTRONIC) 5 RECORD CLASSIFICATION DETERMINATION OF RECORD CRITICALITY AND TYPE 6 ALCOA GAP ANALYSIS Electronic ALCOA Gap Analysis Paper ALCOA Gap Analysis GAPS AGAINST THE ALCOA REQUIREMENTS 7 INTEGRITY EXPOSURE EVALUATION OF EXPOSURE OF RECORDS TO INTEGRITY VIOLATIONS DETERMINED UPON THE OBSERVED GAPS 8 REMEDIATION PLAN RISK BASED & PRIORITY DRIVEN REMEDIATION PLAN 24

25 REMEDIATION PLAN Risk-based and priority-driven remediation actions Short, Medium and Long remediation phases Finalization Deadline: Q1, 2016 Finalization Deadline: Q2, 2016 Finalization Deadline: Q3, 2016 Computerized Systems Assessment Report & Remediation Plan (present document) SHORT TERM: Remediation Very High Risk systems MEDIUM TERM: Remediation High Risk systems LONG TERM: Remediation Medium and Low Risk systems TIME FRAME 25 25

Qualification Plan Risk Assessment User Requirements Specifications Design Specifications Functional Specifications Configuration Specifications System

REGULATORY EXPECTATIONS PAST REMEDIATION FUTURE Assess Historical Data in case the current status is observed as deficient Data integrity technical

26 Qualification Plan Risk Assessment User Requirements Specifications Design Specifications Functional Specifications Configuration Specifications System Build User Acceptance Tests Integration Tests Module Tests System Tests Configuration Tests Qualification Report Traceability Matrix HOW TO MEET REGULATORY EXPECTATIONS PAST REMEDIATION FUTURE Assess Historical Data in case the current status is observed as deficient Data integrity technical measures SOPs & CSV to ensure system reliability Planning Reporting SPECIFICATIONS TESTING ONGOING Requirements and Specifications Definition Testing 0 t0 t Reliable Data 26

27 CONCLUSIONS

28 NOT (ONLY) A TECHNOLOGY MATTER Technologies change our way of working, but the need of Quality Requirements (GxP) remains the same In both the cases Data Integrity must be assured 28

29 CORRELATED COMPONENTS All Data Integrity components (and relevant Compliance Requirements) are essential EVERY ASPECT NOT PROPERLY HANDLED MAY RESULT IN FAILURE USER PROFILES ACCESS CONTROL 29

30 WHERE WE ARE HEADED Globalization has driven the need to create common standards which rely upon the Integrity of GxP data The monitoring of GxP compliance applies to the entire R&D, Manufacturing and Distribution chain Creating a Culture of Quality is the best way to ensure Data Integrity Computer Validation purpose shall be targeted not to technology but to ensure Data Integrity The status of compliance related to Data Integrity must be documented in the present, analyzed with respect to the past and maintained in the future 30

31 GLOBAL PROVIDER, LOCAL SOLUTIONS IN YOUR LANGUAGE

CUSTOMER AND SUPPLIER ROLES AND RESPONSIBILITIES FOR 21 CFR 11 COMPLIANCE ASSESSMENT. 21 CFR Part 11 FAQ. (Frequently Asked Questions)

21 CFR Part 11 FAQ (Frequently Asked Questions) Customer and Supplier Roles and Responsibilities for Assessment of METTLER TOLEDO STARe Software Version 16.00, including: - 21 CFR 11 Compliance software