While the recognition

Transcription

1 Designing the Perfect Change Control System Change control systems today are expected to be designed in a way that provides a system to not only document and approve changes, but also to anticipate change within the quality organization. by David M. Stephon While the recognition and management of change is a key quality consideration within the pharmaceutical industry, there is actually very little information provided on changes within the Good Manufacturing Practice (GMP) regulations as described under 21 Code of Federal Regulations (CFR) Parts 210 and 211. There are only two sections within the current GMP for finished pharmaceuticals that specifically discuss change. These sections are found under Subpart F Production and Process Controls and Subpart I Laboratory Controls. In Subpart F, section (a), change control is mentioned in regard to making changes to written procedures. Specifically, the regulation states: There shall be written procedures for production and process control designed to assure that the drug products have the identity, strength, quality, and purity they purport or are represented to possess. Such procedures shall include all requirements in this subpart. These written procedures, including any changes, shall be drafted, reviewed, and approved by the appropriate organizational units and reviewed and approved by the quality control unit. Furthermore, Subpart I, section (a) makes reference to change regarding changes to laboratory control mechanisms. This regulation states, in part: The establishment of any specifications, standards, sampling plans, test procedures, or other laboratory control mechanisms required by this subpart, including any change in such specifications, standards, sampling plans, test procedures or other laboratory control mechanisms, shall be drafted by the appropriate organizational unit and reviewed and approved by the quality control unit. Therefore, these two sections in the GMP regulations state the minimal requirements for managing change within the pharmaceutical industry, which include management and documentation of change for production and process controls and laboratory controls, but also that the quality control unit, or perhaps by a more modern definition, the quality unit, review and approve these changes. In addition, perhaps a more contemporary definition of the quality unit s role in change control can be found in the proposed amendments to 21 CFR 210 and which states: The quality control unit is responsible for reviewing changes in product, process, equipment or personnel and for determining if and when revalidation is necessary Special Edition: Change Control 59

2 Regulatory expectations suggesting the need for defined change control systems are also articulated in Active Pharmaceutical Ingredient (API) GMP guidance documents. For example, in the now retired March 1998 Food and Drug Administration (FDA) guidance for API GMPs under section XII, Change Control/Revalidation, it states: To provide mechanisms for ongoing optimization and ensure a continuing state of process control, a formal change control system should be established to evaluate and approve proposed changes to specifications, test procedures, raw materials, facilities, support systems, equipment (including computer hardware), processing steps, packaging materials, and computer software. Moreover, under current API GMP requirements as described now under the International Conference an Harmonization (ICH) Q7A guidance, 2 several statements are made that suggest the need for a well-defined system for controlling change. These requirements include: A formal change control system should be established to evaluate all changes that may affect the production and control of the intermediate or API. The potential impact of the proposed change on the quality of the intermediate should be evaluated. A classification procedure may help in determining the level of testing, validation, and documentation needed to justify changes to a validated process. Changes may be classified (e.g., minor or major) depending on the nature and extent of changes, and the effects these changes may impart on the process. Although changes are expected during clinical development, as knowledge is gained and the production is scaled up, every change in the production, specifications, or test procedures should be adequately recorded Even within FDA s own inspectional guidance documents, the requirement for a well-designed change control system is apparent. For example, in FDA s Compliance Program Guidance Manual , Post Approval Audit Inspections, it states under the audit process instructions for the FDA investigator: A centralized approach could also be used for auditing records of the quality control unit s change control operations. For those changes identified for products of inspectional interest, the records and supplements related to the changes would be audited for compliance with the requirements. Based on these recent guidance documents, the concept of change control and its management is interpreted in a much more global sense by today s regulatory expectations, from the minimal requirements as originally defined in 21 CFR 210 and 211. Change control systems today are expected to be designed in a way that provides a system to not only document and approve changes, but also to anticipate change within the quality organization. Modern approaches to designing change control systems include development of a centralized approach as opposed to decentralized approaches. This is an important consideration as an architectural quality design concept for a change control system. Centralized Versus Decentralized Change Control A decentralized change control system is often characterized by the dependent use of revision history logs solely within the document being changed as the method for controlling change. For example, if an analytical control method or batch production record is changed from the previous version to the next version, a notation is added to the document revision log history indicating the reason for the change. The organizational unit responsible for making the change approves the changed document followed by the quality unit s approval. However, this decentralized approach to managing change fails to capture the essence of good change control management practice. In order to be effective and add the most value, the change control system must be centrally managed. Ideally, all changes that occur within the quality organization should go through one centrally managed change control system or procedure. A centralized quality model for managing change within the organization lends itself much better to increased communication of change within the company, allows controlled maintenance of regulatory filings, as well as makes sense from a business perspective. A centralized change control system is characterized by the use of one overall change con- 60 Institute of Validation Technology

3 trol system that requires all changes, whether they are significant or non-significant, to be reviewed and approved prior to implementation. The implementation step from the centralized change control model is in fact the final demarcation point under the decentralized approach; that is the issuance of the process, system, and supportive documents approved as changed. The output from the centralized change control process is eventually the approved process, document, batch record, analytical method, new supplier, etc. just as it is with the decentralized change control system, but many elements and communication levels are built into the centralized change control system that do not exist in the decentralized change control management system. The centralized change control system depicts various attributes such as change description, documentation requirements, change classification, impact assessment, and quality approval for any change that is encountered within the quality organization. These important elements are usually not part of the decentralized change control model, which is more of a document control system, as opposed to a system for evaluating and managing change in and of itself. However, the centralized change control system goes beyond that. The centralized system includes a two-tier system where the quality unit approves a proposed change for implementation, but the regulatory function, namely the Chemistry, Manufacturing and Control (CMC) operations group, also reviews and approves the change to evaluate the regulatory impact of the change, if any, before the quality unit s approved change is implemented. This evaluation of the change involves a determination of what type of regulatory filing update will be required in order to provide appropriate notification to the regulatory agency. This two-tier approach also introduces the idea of who the gatekeeper will be within the quality organization. After the proposed change is reviewed and approved by the quality unit, the change should be reviewed by the CMC operations group before implementation of the quality unit s approved change. In this way, the CMC operations group, not the quality unit, is the gatekeeper of changes that may have an effect on current regulatory commitment documents. In some instances, depending on how low the detection limit is set in the change control system (i.e., the degree of definition to what constitutes a minor change), the quantity of changes that need to be reviewed for regulatory filing impact may require a CMC/quality liaison position to manage the review of change control. While it is recognized that not all changes within the organization will necessarily require regulatory filing updates, allowing the decision by another group, for example the quality unit, of what The centralized change control system depicts various attributes such as change description, documentation requirements, change classification, impact assessment, and quality approval for any change that is encountered within the quality organization. changes the CMC operations group should be made aware of and what changes they should not be made aware of, can often lead to dire consequences. It is often better to allow the organizational unit responsible for their function to make the decisions regarding the management of that function. Organizations that are not direct holders of regulatory filings, such as contract manufacturers, will want to design appropriate change notification systems into the change control procedure to ensure that their customers, who may be holders of a regulatory filing and impacted by a change made by the contract service provider or supplier, are notified in a timely and appropriate fashion. This is often accomplished by building in requirements for approval by the client of significant change that the contract research organization initiates. This approval of the change by the client serves as an appropriate mechanism for documentation and notification of the change, and allows the client firm to make required changes, if any, to their current regulatory filings impacted by the change initiated by their subcontractor or material supplier. In other cases, especially for contract service companies, the client is often the initiator of change, and Special Edition: Change Control 61

4 in these cases, the vantage point of change notification is from the client s perspective through their change notification system, not the contractor. As discussed, the centralized change control system allows for a bi-level approach to change notification and approval within the organization. This second tier of change approval is performed by the CMC operations group. In clinical development, these regulatory filing maintenance requirements are in the form of amendments and annual reports to the Investigational New Drug Application (IND), as described under 21 CFR and supplemental FDA guidance documents, 3 or for contractors and suppliers, as applicable, to the Drug Master File (DMF), as described under 21 CFR and supplemental FDA guidance documents. 4 Change control requirements for post approval changes have been well-defined by the FDA in the form of guidance as described under the plethora of Scale- Up and Post Approval Change (SUPAC) documents purported over the last several years as an expanded interpretation of 21 CFR Post approval change requirements continue to be interpreted by the FDA by the issuance of new guidance documents. 6 While the intent of SUPAC guidances is for use in deciding appropriate impact studies and notification requirements for post approval issues, it also serves as an excellent quality model for designing a well-managed change control system for use during clinical development. Sometimes pharmaceutical firms use very generic, non-robust definitions for describing types of changes in their change control procedures. Usually these are described as minor or major, non-critical or critical, etc. This two-level approach often leaves out the required definition for change decisions made in the gray areas that fall between minor and major changes and are often encountered in the research environment during clinical development. The three-tier change control definitions described under SUPAC guidances minor, moderate, and major lend themselves well to defining levels of change at the clinical development stage. Under these definitions, minor change is described as: a change unlikely to have a detectable impact on critical attributes, moderate change is described as a change that could have a significant impact on quality attributes, and major change is defined as a change that would be likely to have a significant impact on the critical quality attributes. The middle of the road change definition, described as moderate change under the SUPAC model, is often the most used change classification during clinical development. These change definitions, in the same way that they are designed to provide the appropriate filing requirement for post approval changes for a New Drug Application (NDA), Abbreviated New Drug Application (ANDA), and Biological License Application (BLA), also can be used to define when an amendment versus an annual report for an IND or DMF would be required during clinical development. For example, within a clinical development environment, a general change control design concept could necessitate annual report filing requirements for minor changes, amendments for major changes, and case-by-case evaluations for determining the appropriate regulatory filing update for moderate changes. Change Control and What It Actually Means Before we discuss further design considerations for change control systems, let s take another look at change control and what it actually means. To understand the purpose of change control, it is helpful to first attempt to define change control. Change control is often defined as a system of procedures through which changes are reviewed, justified, documented, approved, and implemented in conformance with regulatory and corporate requirements. Change control is in fact a system that controls change by: ❶ Identifying ownership of the change ❷ Allowing for review and approval of the change ❸ Preventing changes that could adversely affect product quality or conflict with registration or regulatory requirements ❹ Providing an assessment of change and monitors the impact of change Therefore, the principle purpose of managing change within the quality system is for evaluating the potential impact on: Validated conditions, processes, or systems maintained in a state of control Regulatory commitments Product quality and safety 62 Institute of Validation Technology

5 The premise of product quality and safety is an easy concept to fathom in our industry. However, recognition of validated systems may not be as obvious. At face value, if a process or condition has been validated using certain equipment, automated controls, control methods, component suppliers, etc., then it goes without saying that any changes made to these systems may impact the validated conditions to the point that there is no longer assurance that products using these systems will meet all regulatory and release requirements. Therefore, these changes must be evaluated and actions identified to support the proposed changes. In some cases, this involves a complete repeat of the original validation of the process, system, or defined state of the controlled condition the firm had previously established. In other cases, the evaluation of the change may show little or no impact, or perhaps be limited in impact to the extent that defines the sections of validation to be repeated. In other instances, for example, most often during clinical development, change control becomes more of a system for compiling and managing change rather than controlling it. The clinical development environment describes the need for a change management system as opposed to a true change control system in certain instances. Operations are typically defined as being in a state of evolving control during clinical development. At this stage, where for example the final manufacturing process is not defined, some systems may not be in a defined state of control or may be in an evolving state of control, such as control methods, cleaning methods, and process batch records. Moreover, support systems for clinical supplies manufacturing such as facilities, utilities, automated systems, laboratory and manufacturing equipment, and personnel would be presumed to be in a state of control under appropriate qualification requirements during the clinical development stage. Changes during development, such as changes in the product formulation, manufacturing process, component sources, site of manufacture, and control methods must still be carefully evaluated and archived by the change control system. This is not only important for the maintenance of regulatory filings during clinical development, but also for defining the development history for the product later on in the compilation of the product development report. A well-managed and archived change control system allows the decisions and rationale for key product development decisions and milestones to be easily retrieved and comprehended. In addition, FDA investigators often ask for documentation that supports claims made by the company in its product development report and process validation protocol at the time of the Pre-Approval Inspection (PAI) and related regulatory surveillance investigations. This documentation should be in the form of archived approved change control documents that allow the FDA investigator to substantiate timeframes of the firm s product development changes and authenticate the firm s data results and rationale for product development decisions. Another important design feature to include in the change control management procedure is to carefully state where, within the quality organization, that the change control system is not applicable when performing certain operations. For example, under normal practice, equipment Standard Operating Procedures (SOPs) should state when preventative maintenance and calibration are to be performed. Without an exemption statement in the change control procedure stating that change control is not required when performing these routine calibration and maintenance operations, an expectation that change control be followed may be implied. Having this exception feature in the change control procedure, with a few listed examples, will likely preclude otherwise irrelevant questions from auditors and FDA investigators as to when change control applies (and when it does not apply) within the firm s quality system. How Do You Know the Change Control System Is Working? There are often clues to look for in evaluating the effectiveness of the change control system within the quality organization. For example, a product reject is a potential sign of a change occurring a bad change, but a change nonetheless. An inordinate number of rejects means the process has shifted and the cause must be found. Often, investigations into product rejects lead to the discovery of unreported changes to the process, materials, or procedure. Product complaints are another indication that changes need to be implemented with appropriate review and approval. A pattern of similar complaints may be an indication of a process change. The presence of a trend in product rejects or complaints are ultimately disclosed by the performance of annual product re- Special Edition: Change Control 63

6 views or perhaps more appropriate for clinical development, the conduct of annual quality reviews. These reviews ideally identify improvements to the quality system, including redesign of the change control system or re-education of operational staff to the appropriate use of change control, to prevent future occurrences of uncontrolled change within the quality organization. Another consideration in the design of a change control system is the proper identification of what change is and what change is not. For example, one can envision perhaps two fundamental types of change in a company: planned and unplanned. Often, firms treat unplanned changes as true changes under their change control system. However, unplanned changes should be viewed for what they really are. Unplanned changes are actually deviations and should be addressed using appropriate deviation handling procedures. Planned changes, on the other hand, are intentional and pre-approved. Planned changes are in fact the true changes that the change control system should be designed to anticipate, identify, and effectively resolve. Planned changes can be permanent or temporary. With temporary or emergency changes, the change is still predefined, justified, and authorized, but the temporary change also defines the change duration or time period. The use of temporary change is best exemplified during the approval of rework or reprocess procedures, protocols, and batch records. What Role Does the Quality Unit Play in Change Control? The quality unit reviews the proposed changes for adequacy and appropriate rationale to determine requirements needed to implement the change. Like all GMP records and reports such as protocols, batch records, control methods, etc., as required under 21 CFR , the quality unit should have final approval for the change. Although the quality unit manages change control, the other organizational units within the company coordinate change control. In addition, the quality unit must have a system that tracks and monitors change. The tracking system should accommodate the need to monitor the status of the implementation of approved changes to ensure that approved changes, which may not be implemented in the order they were approved, have been verified as completed. Based on this, it is important to include in the design of the change control system the requirement for the quality unit to follow up on implemented changes. Moreover, often the quality unit s approved change is not the same change that was implemented weeks or months afterward when the change is finally completed. It is important to include evidence that the change was completed as originally agreed. For example, under an approved change control form that states a new piece of equipment will be purchased as part of the change, a copy of the purchase order and packing slip for newly delivered equipment should be included to serve as evidence of when the equipment was delivered, and also as a time stamp for subsequent activities such as equipment qualification documentation. This cycle closure to the change control process should allow the quality unit to determine if the change as approved was the change that was eventually implemented. Indications to the contrary should be investigated, documented, and justified. In other circumstances, approved change controls in the system that have been forgotten need to be resurrected or closed. Considering all of these factors, it is clear that continuous monitoring of the status of open change controls needs to be performed. Any well-managed quality system requires a documentation counterpart. For change control, just as with other document-driven quality systems like deviation investigations, a well-designed form is an integral part of the SOP. The change control form should allow unique identification of changes for tracking and monitoring purposes and ideally be easily accessed by user groups when needed. Electronic form distribution or use of shared drives under the organization s computer network system is the most common method to meet the requirements. Appropriate provision should be made to ensure that computer systems comply with current requirements for security and data integrity. Automated systems that are relied upon to make GMP decisions require appropriate validation. The change control form should allow designated fields for the description of the change, justification for the proposed change, classification of the change, and approval of the change. Often, it is advantageous to segregate different sections of the change control form to allow for adequate documentation of subsequent steps in the change control process, including CMC operations change approval oversight and follow-up to the approved change control by the quality unit. 64 Institute of Validation Technology

7 Training on the change control system should be performed routinely. Personnel who will one day be a change initiator need to understand what change control is, the requirements for managing change in a regulated environment, how change is defined, proper documentation requirements for change, and opportunities for recognizing change within the company. Reinforcement training should address deficiencies in the correct use of the change control system. All GMP functional operation personnel should be required to go through review and training on the firm s change control SOP on a reasonable, continuous basis. Conclusion This article describes a number of design considerations for developing a change control system. The overall goal of any change control system is, of course, to prevent unauthorized changes from getting into the quality system. Hopefully, following several of the recommendations stated in this article will accomplish this goal for your organization. The context of this article was presented within the scope of the pharmaceutical industry, but the elements of the system can certainly be applied, as appropriate, to other areas of the regulated industry, such as biologics and medical device industries. Although this author discussed the advantages of using a single change control system for managing all change within the organization, alternative approaches often include separate change control procedures for certain departments or processes. For example, standard practice is often to use a separate change control procedure for managing changes in the regulated environment that occur within the information technology department. In other cases, as for special temporary processes within the organization such as GMP build-out design, construction plans, and master validation plans, it is often advantageous to use a separate change control system to capture these changes. References 1. Current Good Manufacturing Practice; Proposed Amendment of Certain Requirements for Finished Pharmaceuticals. 61 FR 20104, 21 CFR 210 and 211. Federal Register. May 3, International Conference on Harmonization. Draft Guidance of Good Manufacturing Practice for Active Pharmaceutical Ingredients. 3. FDA. Content and Format for Submission of Drug Products for Investigational New Drug Applications. Center for Drug Evaluation and Research. February 1, FDA. Guideline for Drug Master Files. Center for Drug Evaluation and Research. September Supplements and Other Changes to an Approved Application. 64 FR 34608, 21 CFR 5, 206, 250, 314, 600, and 601. Federal Register. Currently under revision. June 28, FDA. Guidance for Industry Changes to an Approved NDA or ANDA: Questions and Answers. Center for Drug Evaluation and Research. January Change Control Management SOP Page 66 Advanstar Communications Inc. All rights reserved. Special Edition: Change Control 65