MHRA S NORMAN GRAY ON ANNEX 15 REVISION AND VALIDATION INSPECTION FINDINGS

Transcription

1 MHRA S NORMAN GRAY ON ANNEX 15 REVISION AND VALIDATION INSPECTION FINDINGS At the ISPE/PQRI Process Validation Conference in Silver Spring, MD in early October, MHRA Senior GMP Inspector Norman Gray discussed: the revision process on Annex 15 the changes made in the revision how it compares with FDA s process validation guidance, and recent MHRA PV inspection findings. Gray was rapporteur on the Annex 15 revision. I was the rapporteur for Annex 15. It sounds like a grand title. But basically it means that I am the project lead. So I end up doing most of the work and all of the others make comments on the work. It can be a difficult role sometimes. This presentation is in four parts. The first part is about development of the revision of Annex 15. The second part explains the main changes of the document from the previous version. The third part is doing a comparison between the EU guidance and the FDA guidance. And the fourth part is giving you some examples of where some companies do not do validation particularly well. Annex 15 Development I would just like to start off by telling you a little bit about the history, the timing, and the consultation process for Annex 15. In the EU, there is a defined process for developing a document. Notice that Annex 15 is the main guidance document for validation. The first version was published way back in So it has been 14 years approximately since we got around to doing the revision. The revision is out of inspectors control it is through the planning group at the European Medicines Agency. They decide when a document is going to be changed. One thing I did notice when I was researching this presentation is that it took us 14 years to revise the document. And I think it was a similar time frame or a slightly longer time frame when the FDA revised its document in So it maybe a document that people do not want to touch too much. I think it opens up too many worms. I have explained the role of the rapporteur. It also involved inspectors from other European member states. We had some people from Ireland, Germany, Italy, and Portugal. We also had some representatives from the European Medicines Agency. And for the first time in the revision of an EU guidance, we also had a representative from PIC/S and also from the FDA. The aim is to try to make sure there is a more global harmonization of regulatory documents. We found it very useful. And in this presentation, I would like to formally acknowledge the support of Grace McNally, who was the FDA member on the drafting team. Because of that, we would hope that there are a lot of similarities between what we use in the EU for compliance and what you use in the USA for compliance. So let s move on now to look at some of the timing. If you do a quick calculation from the first date to the last date, we were working on this project for about two-and-a-half years. So we started off in August 2012 when the drafting group was first established.

2 The first public consultation was on the concept paper. And that started in November Now, I will just briefly discuss what a concept paper is. Basically, a concept paper is the plan and the main changes to the document. So it is why we are changing the document and how we are going to go about changing it. In essence, we wanted to really bring it up to date to make sure it really reflected ICH guidance and all sorts of things like that. That date was November We then went through the process of preparing the Annex 15 draft, which would then go out for public consultation. And it did in fact go out for public consultation in February It was then adopted by the European Commission after they had a quick look over it to make sure there were no significant implications to Europe. And then it came into force in April There was a plan to publish it on the first of April 2015, but we did manage to convince them otherwise, because we did not want to publish on what we call April Fools Day, which is when there are things that come out that are not true. So we published it on the second of April. There is usually a six-month period to allow companies to look over the guidance and to implement it into their systems on site. As you are aware, it is now eight days since it came into force. I am pleased to say that I did my first inspection of a US company this week, and they had done their gap analysis to see what the differences were between the EU guidance and their current procedures. I was most impressed. Usually we find that it is a couple of months after the implementation date that they actually do something, or they do not actually know the implementation date and they have not done anything at all. So that was good. That cheered me up a little bit. So let s talk about the consultation process. We do have a consultation process. We try not to impose guidance on our stakeholders. We do try to give them an opportunity to contribute. And in this instance there were effectively two consultations. We had the consultation on the concept paper. And there were approximately ten to fifteen companies, groups, etc. that replied. And they were generally positive about it. Again, it is a broad document, so you do not really expect many significant issues at that point in time. We are only looking to see if we actually missed something really significant. The second consultation is more important. That is when the first draft is actually visible by stakeholders. And we usually allow about a three-month period for people to look over it. In this particular instance we got a good response. We had forty-four organizations responding. These organizations could be an individual. A lot of consultants seemed to respond. So maybe there was not any work on the weekends and they decided they wanted to do something, so they responded. It gives them something different to do. You also find that you get some pharmaceutical companies responding. Interesting to note that it is mainly the smaller and middle level companies that respond. We did not get many responses from very large pharmaceutical companies. You can speculate on the reasons for that. I will leave it up to your imaginations to work that one out. The best response I actually saw was from a consultant who did cleaning validation. There were some great ideas. And we certainly took a lot of the things that he pointed out on board. I do not know if he is in the audience here, but thank you very much. It was most appreciated.

3 So as you can see, we generated a lot of paper, similar to a normal validation study. We generated 131 pages of comments for review. We are obliged to go through every single response that we get. And if we accept it, we mark that we have accepted it. And if we do not accept it, we have to give an explanation. And somebody actually does look at these to make sure that we avoid prejudices that issues like that do not interfere with taking on board good ideas. I just want to reinforce that if you do make a contribution, we do take it into account. And we thank you for all of the contributions that you make. There are also other sorts of review processes for example, the other EU inspectorates. There are 56 members of European community. They will also make comments on the draft. So that was the consultation. You can see from the number of organizations and the volume of work it provided that it was quite successful. Changes to Annex 15 So now I want to move on to talk a little bit about the main changes to Annex 15. So this is the second part of the presentation. What I have done is broken it down to the main sections of the document and left out all of the stuff about equipment qualification. General Changes In all EU guidances there is usually a principles section that really just summarizes the rest of the chapter. In this instance, we decided that there was so much in the principle section that we had to split some of that into another general section. So there are actually two sections in this document as opposed to just the principle section. It may seem hard to believe that the concept of a validation lifecycle was not mentioned in the original draft in So obviously we had to create that. We now expect that validation is not treated as just a one-off alternative for when you are transferring a product from development to the manufacturing site, or you are transferring an old product to another site. It is throughout the lifecycle of the product from initial development through to discontinuation of the product. To make sure that the Annex complied with all the ICH guidance, there was an expectation that you include risk assessments throughout the lifecycle of the product. And again, we consider risk assessments as important because you can then assess the risk to the product, the risk to the validation exercise, the risk to the ongoing supply of the product, and therefore it increases the chances of success for the validation. So in the EU we do treat risk assessments seriously or importantly. However, in execution I think that a lot of companies fall down in terms of risk assessments. And I think the key factor in which they fall down is the identification of the risks. They can be quite poor at identifying these. You may find that other than in the principal and the general sections you do not see the words risk assessment used much throughout the rest of the document. And the reason for that was we did not want to end up with a document that mentions risk assessment on every line. So the approach was to put it into the general section and the principle section and then it was implicit throughout the rest of the document. We did not want to burden people with that many words. So just because it is not mentioned further down does not mean that you should not be doing it. It is implicit in all of the document.

4 Obviously process validation exercises and all of the validation in general can be quite complex, so therefore it is important that the validation is organized appropriately. We would expect when you are doing validation that you use personnel who are suitably trained in validation activities. It is a complex task. You are looking for people who have the technical knowledge, attention to detail, follow procedures appropriately, and who can see small things happening that have not been taken into account initially, but may have a significant impact later on in the process. So they may be able to identify something that later becomes a problem. You are looking for validation to be performed by people who know what they are doing. It is also important that there is appropriate quality oversight of validation. We are quite relaxed in the EU as to where validation fits into the organization. Personally, I am not too concerned if it reports to the quality department, or if it reports to production, or if it reports to another technical part of the organization. However, it is important that there is that quality oversight. If you decide that you get that more by having a validation department that ties to the quality department, then so be it. But there are other options. Again, we have made the comment in this section that use of risk assessments are required throughout the lifecycle. That implies that they are dynamic and they are going to change over a period of time. Therefore it is important that companies outline their approach to risk assessments and how they are going to update these at any time. And perhaps the most appropriate place for that could be in your validation master plan. But alternatively it could be somewhere else. You are probably all aware of data integrity. Data integrity is a hot topic within the regulator environments. I have been to places in India where there has been poor data integrity. And as a result, these companies have got into problems. I have accompanied some of your FDA inspectors in India, and data integrity issues have been identified. It is important that data is complete and accurate. We would expect you to do some checks in data integrity when you are preparing and reviewing validation documents. It is not just checking that there are no typing errors in the document. It is looking more broadly at the data. It is drilling down into the data. If you do an overseas site, for example, you want to ask them for the log books to confirm that the product validation batches were actually manufactured at the time they said they were manufactured. You might want to look at sample receipt logs to confirm that the validation samples were actually received at the laboratory. You may actually want to drill down and look at some chromatograms to confirm that the results were as expected in the validation report. You may want to look at the audit trails. We have an expectation that you do not just accept the data in the report that you confirm the data in the report because the environment in which you operate has changed. I think in the past, we as regulators had a general expectation that companies would do the best thing for the patient. However, experiences in recent years have made us change that. We are a bit more skeptical than what we have been in the past. And that is why data integrity has been added into Annex 15. Documentation is an important part of validation. And unfortunately in the revision of the document we probably have not managed to reduce the documentation burden to companies. Personally I wish we had, because there is nothing that sort of makes my soul drop as when you are inspecting the rear end of a trolley that has fifty folders of process validation work. And you think to yourself, it is going to take me two days to

5 go through that, and it was only a three-day inspection. And unfortunately, I do apologize that we did not manage to reduce the amount of documentation that we need to generate. However, what we have emphasized is the fact that you need to obtain information. You need to make sure that the information you have, that the documentation that you have, is readily available and in a form that allows you to search. So if during the validation lifecycle you run into a problem, you have the information available that allows you to understand the process, if part of the process is unclear, and therefore have a better chance of being able to solve the problem. Again, Annex 15 emphasizes the role of deviations in validation. We would hope that we would not have any deviations. But obviously there will be deviations, and you have to treat them properly. You have to investigate them. Because sometimes a deviation in a validation stage is really an early warning of some issue that may potentially happen in the future. Deviations may be an early warning mechanism for you. So it is important that they are investigated promptly. I sometimes feel that validation you write a protocol, you write a report can become very mechanistic. So if you have acceptance criteria, at the end of the report you say it met all of the acceptance criteria. However, I think we are looking for more than that. There is a risk that becomes too mechanistic. We are looking for a conclusion, the views of the person who did the validation, and any suggestions that he had during the validation. We are looking for not just to make sure it met the acceptance criteria, but actually looking at the data to see if there are abnormalities, such as one set the data at one end of the range and the other set of data is at the another end of the range. So we are looking for not just doing the work, but critically evaluating the data and making sure it is appropriate. We do mention in Annex 15 the use of statistical techniques. Perhaps the emphasis on the EU is not so much on the statistical techniques, but there is nothing to stop companies from using them. And we would certainly promote the use of them in validation activities. Specific Changes The next part is to look at some of the specific changes to process validation in a bit more detail. The first thing I would just point out to you is that you should not just look at Annex 15 as a stand-alone document. It is linked to another European document, and that document is called, the Guidelineon process validation for finished products information and data to be provided in regulatory submissions. Annex 15 ties in with that document. That is the primary document that somebody would use to make your regulatory submission. Annex 15 is how we confirm that the manufacturer is meeting the requirements for GMP and validation activities. So the two are linked. And there is one specific section in that document that you may want to look at, where it defines two subsets of products. The first set is a standard product, and the other set is a nonstandard product. And a nonstandard product is defined as something that may have been novel, that may have new technology involved in it, or it may be an unusual dosage form. For example, metered dose inhalers are included as a nonstandard product. Also products that are manufactured aseptically are defined as nonstandard, as well as products that are sterilized by a noncompendial method. They are defined as nonstandard. And the implications for that are that you have to do

6 full scale validation batches for nonstandard products. So again, I do not have time to go into that document in too much detail, but it is a sister document and therefore essential reading if you are reading Annex 15. You can see here we have sort of tightened up on the use of concurrent validation. We believe that it should only be used in exceptional circumstances. And that is similar to the FDA approach, where it specifically mentions shortages. We have a statement that there must be a strong risk/benefit to the patient. You might find that difficult to understand. But basically what we are saying is there must be a benefit to the patient for you to do a concurrent validation. There should be no benefit to the company in terms of reducing inventory, increasing time to market, etc. It is all to help the patient. So shortages potentially could be a reason for using concurrent validation. We put in the statement that it must be visible in the VMP [validation master plan]. You might ask yourself the question: Why in the VMP rather than the protocol? The reason for that is if you are inspecting a company that has fifty products, you are not going to look through fifty protocols. You do not have the time to look through fifty protocols. So we were looking for a quick way by which we can confirm how the company is operating. If they send in the VMP, it is a cumulative list. It is for one year and then you update that list as you go along. And we have a better chance of seeing it and therefore we have a better chance of being able to ask the company why they did concurrent validation. So it is purely from a selfish regulator inspector viewpoint that it was put in the validation master plan. Again, in the 2001 Annex 15, we did allow retrospective validation. Now the view here is that prospective has prevailed. You have had fourteen years to move to the position of doing prospective validation. Therefore you have reached your expiration date. So we would expect that you no longer do retrospective validation. And again, that is very similar to what we see in the USA. I have one word of caution for you. And that word of caution is that the scope of Annex 15 is finished products. And it is in Part I of the EU GMP guide. There is also a Part II of the EU GMP guide, which covers APIs. And it has its own section on validation. It now allows retrospective validation and also allows concurrent validation. Under certain circumstances they are justified. You need to be aware of this. There is a statement in the principle that says that Annex 15 could be used for APIs, but it is not mandatory to use it for APIs. So we have that disconnect. And it is unfortunate that we are contradicting each other to a certain extent. But that is the way it works. All of these revisions are done independently of each other. And it just so happens that the API guide was being revised about the same time as Annex 15, and no one told us that that was the case or that they were not changing it to comply with what we had put in Annex 15. So that is an anomaly. Perhaps in the future it may be clarified. We want to make it clear that Annex 15 applies to all dosage forms, new products, changes in products, and also to site transfers. As I indicated, the submission document and process validation allows both a traditional and a continuous verification approach to process validation. It was interesting that in the consultation there was one comment from one individual that said that we should not allow the traditional approach to process validation at all because we should be trying to move the pharmaceutical industry to a more high-tech position. So his view was we should not allow traditional validation to improve the way in which we develop products.

7 However, we must remember that any guidance that we produce has to cover a wide range of companies. So it is big pharma, small pharma, generics companies, so therefore it is not something that we can force on them. Otherwise there would be no supply of products. As regulators, we do try to reduce the workload to stakeholders. So we do allow you to take a bracketing approach. You also see we are matricing there. We had great difficulty in finding a definition for matricing. There is a lot of it in analytical documentation, but not so much of it in process validation. So you might see it mentioned there. But I think in the final version it is removed. Some of your polling concerned legacy products. It has always been the requirement in Europe that if you have a marketing authorization for a product you are under a general obligation to keep that dossier up to date with current practices. So if you have a finished product specification that involves TLC with limited detectability, we would expect you to update that to a UV HPLC method. So there is that general requirement has always been there for all products to keep them up to date. However, in practice, you will find that a lot of companies do not do that. You will find a lot of products in Europe that are very old. They have not been updated for many years. So this was put in not to force, but to stimulate companies to recognize that and then to start to look at their older products, especially if they are transferring it from one site to another. And not just transferring it as it stands, but making sure that it is in a fit state to be transferred. So that is why we specifically make that statement. Again, in the polling there was some discussion on the importance of CPPs and CQAs. We think it is important because it allows people to understand what the key parameters are for products when they are manufacturing them. This ties in with ICH requirements. We talked about briefly about validation personnel and their experience. We also try and emphasize the transfer of knowledge that translates to production personnel. In a lot of companies, it will be the R&D people or a specific group that transfers products. However, you have to recognize that it is the production department that is going to have to make these products going forward. So the chances of success of the validation and the commercialization of the product is enhanced by involving the production personnel at the earliest stages. We have emphasized that in the document. Tying in with knowledge management we have also made it a requirement that any data that is available for product development should be available at the commercial site. That does not mean it has to be physically present at the site, but they should have access to it. We do not expect a silo R&D to put up their defensive walls and not allow production to access that sort of information, because it is important to insure a continuity of supply and quick resolution if things start to go wrong with products. We made a specific requirement that you cannot just make a validation batch and then decide to release it. You have to allocate that batch in advance to be released. In terms of the approach, we just expanded a bit more on the traditional approach. We have done this for many years. We made a series of batches and confirmed reproducibility. The number three: We have had lots of debates about this. Do we just go and say that the company should make a number of process validation batches based on QRM principles? We considered that we could do that, but we did not want a lot of companies to not be familiar with what we were expecting. They were comfortable with the number three. So we decided, to avoid too much confusion because it was a significant change, to leave three as it is.

8 But basically we are giving them a warning we would expect it to be based on other criteria. This is a transition we want them to make. So in this version we still have three. The next reversion will not say three. It will be based on risk management principles. So we are really trying to make them evolve. But as general guidance, if there is more variability in process validation results, or if there are any uncertainties, or the process is complex, we would expect the number of validation batches to increase. As indicated, there is a continuous verification approach allowed now in the EU GMP. I am sure you have talked about it a lot in earlier presentations, so you probably know more about the subject than me. So I will not dwell very long on this slide. There is also a hybrid approach. So as you have gained a lot of knowledge about a product over many years that is manufactured at the same site using the same equipment for a long time, then potentially you could move to a continuous process verification approach. Ongoing process verification is something new that has been introduced to EU GMP. Traditionally in the past, companies would maybe repeat the process validation based on a time interval. Five years was common. Some might repeat the whole process validation. Some might do an assessment. So they may look at the data and then decide if the need to do a process validation or not. So there were lots of approaches previously. Now we are saying that it needs to be done for all products. So our definition: There is a monitoring process to confirm that state of control is maintained throughout that product lifecycle. The aim is to detect unplanned departures or unintended process variability from the process as designed. And I am sure that definition is not significantly different from how you use it in the USA. How would we expect that to work in practice? In practice, companies spend an awful lot of time on what we call product quality reviews [PQRs] in Europe, and in America you call them annual product reviews [APRs]. We spend an awful lot of time preparing that document. And I have always thought, do we actually get any benefit from doing it? So hopefully with the introduction of ongoing process verification, that could be used to confirm that the process is in a state of control. There may also be some circumstances where you have a written PQR or you want to look at a specific issue. And under these circumstances you could also write a specific protocol or write a specific report to confirm some aspects of ongoing process verification. Again, the frequency by which you perform it should be based on the lifecycle. For example, if it is a new product, you would expect it to be more frequent than an established product. I should have said at the beginning when I presented this that we changed continued process verification to ongoing process verification, because we thought there was confusion between continuous and continued. So the terminology has changed. I apologize for not saying that earlier. In American terms, this is continued process verification. Some of the slides showed what we would expect from some of the older products. So if it were a legacy product you are manufacturing, we would expect ongoing process verification. Comparing EU and US Guidance

9 The next section is just a quick comparison between the EU guidance and the FDA guidance. As I have indicated, there was an FDA member in the drafting group. She was quite vocal in ensuring that we took FDA requirements into account. I just quickly tried to put together a slide that shows some of the criteria and how the FDA and EU guidance meets it: We have already talked about the scope of the document. The FDA document includes API. Again, this is the wording in the EU guidance it is supplementary optional guidance for APIs, because they have their own section on process validation. They both have the lifecycle approach. They both emphasize that process understanding and knowledge is important. In terms of legacy products, I think FDA has looked to continually improve the process. As I have discussed, in the EU GMP, the process should be kept up to date with the current standards that we have. Good facility design and equipment qualification are prerequisites for process validation. That is recognized in both documents. Increased level of scrutiny, testing, and sampling during PV is recognized in both documents. The importance of documentation for validation is recognized. We require a protocol, a report, deviations, and clear conclusions. Data should be statistically trended. Probably in the US there is more emphasis on statistical tools in validation. We have only mentioned it once in the EU guideline. That is not to say that you do not need to include it. I think it is important personally that you do include it. And if you want to show state of control, then you must use some form of statistical tools. FDA references ASTM E2500. We would not endorse another document other than another EU document. Concurrent release is rarely used. Again, you want that to be defined in the protocol. For practical reasons as I have described, we would want that described in the validation master plan. Retrospective process validation: Again, both documents in the EU should be used. Processes should remain in a state of control during manufacturing. Again, FDA uses the terminology continued process verification, and we use the terminology ongoing process verification. So hopefully these two slides will perhaps give you some confidence and some clarity that the two documents are adopting a similar approach with small differences. Inspection Findings

10 The next stage of the presentation is to really highlight some of the things I or my colleagues have seen during inspections where companies could improve validation processes. I am not going to go through them all. I am just going to highlight some of them. I am not going to spend much time on it because it is important that you are able to ask questions. The section on organization and planning: It is important that there are good document links when you are doing validation. A lot of companies are not particularly good at that. I would expect some sort of pathway to show how all the documents link together. Because if you do not do it systematically, there is a good chance you will forget something and leave something out. Using trend charts rather than control charts to monitor the process: A trend chart does not tell you about all that much. It just tells you what the value is. If you are wanting to control the process, then you need to use a control chart. Some companies prepare a process validation protocol and then change that halfway through. It could be not a good thing to do, because you are keeping the existing results and making sure that they fit in without having to do any further work. It is especially important if you do some experimental batches up front to make sure that your protocols are achievable. We always encourage companies not to go straight into process validation, but to do the work upfront to confirm that it is going to be successful. A lot of companies, especially in India, tend to get confused between process qualification of equipment and process validation, especially when introducing a new line at the same time that they are introducing a new product. It tends to get a bit messy there. We have talked a little bit about data integrity. As an inspector, if you start to see discrepancies in reports, your eyebrows start to raise and you start to get questions in your mind about whether the data is correct and if it has been executed properly. It is important to make sure that everything is satisfactory. I talked a little bit earlier about the process of developing risk assessments. The process can be very poor. A lot of companies just copy it from one product line to another product without looking at the specific attributes of the product and the manufacturing. We still see some protocols that do not do any additional sampling. They just take normal one hour checks. They do a normal production and use that data. And then another important point is that sometimes deviations are just stored in the validation reports. I think it is important in terms of understanding what has happened to the process to use the information you have to solve problems in the future. Deviations should not be treated as just validation deviations they should go into the formal deviation system. So at least if you find a problem with the product and you do your search of historical deviations for that particular product then you are likely to find it, which may help you solve the problem. Visit IPQPubs.com every day for IPQ s real-time tracking of the latest CMC and GMP developments from Inside the Global Regulatory Dialogue IPQPubs.com

11 IPQ Publications LLC, 7920 Norfolk Avenue Suite 900, Bethesda, MD Phone: , Fax: Contact us at: Contents Copyright 2015 IPQ Publications LLC. All rights reserved.