STANDARD OPERATING PROCEDURE

Transcription

1 STANDARD OPERATING PROCEDURE Title Reference Number Audits and Inspections SOP-QMS-004 Version Number 4 Issue Date 29 th Sep 2016 Effective Date 10 th Nov 2016 Review Date 10 th Nov 2018 Author(s) Reviewer(s) Melanie Boulter, QA Auditor Teresa O Leary, Head of Regulatory Compliance Authorisation (Original signatures are retained by Research & Innovation) Dr Stephen Ryder Director of Research & Innovation Dr Stephen Fowlie Medical Director 01 st Aug nd Sep 2016 USERS OF THIS STANDARD OPERATING PROCEDURE MUST REFER TO TO ENSURE THE MOST CURRENT VERSION IS BEING USED

2 Page 2 of Document History Version Number Issue Date Reason for Change 1 15 th May 2014 Original SOP. Replaces SOP th Dec 2015 Amendments due to review of QA programme processes th Apr 2016 Amendments due to implementation of revised QA programme and templates 4 29 th Sep 2016 Amendment due to documentation changes regarding the audit plan

3 Page 3 of Introduction To maintain oversight of a study, the Sponsor, Nottingham University Hospital NHS Trust (NUH) will assess the study s compliance by auditing and monitoring. Auditing is an independent quality assurance (QA) activity to determine whether study related activities are compliant with the study protocol, sponsor procedures, Good Clinical Practice (GCP) (or International Organisation for Standardisation (ISO 14155) for medical device studies) and other regulatory requirements. NUH hosted studies (where NUH is not the sponsor) may also be audited in order to ensure appropriate conduct and patient safety is maintained. The study s or Sponsor s compliance can also be assessed by a Competent Authority (CA). EU Directive 2001/20/EC mandates the inspection of studies and sponsor premises to verify compliance with GCP for Clinical Trials of Investigational Medicinal Products (CTIMPs). A regulatory inspection is performed to assess compliance with guidelines and regulations and to assure the CA of the validity of the study data and the protection and rights of the participants. 3. Purpose and Scope This standard operating procedure (SOP) describes the process for selecting, planning, conducting and reporting of audits and the process by which corrective and preventative actions (CAPA) are managed in order to ensure that the Trust meets its obligations under both The Medicines for Human Use (Clinical Trials) Regulations 2004 and subsequent amendments, and the Department of Health Research Governance Framework for Health and Social Care (RGF).. This SOP also describes inspection readiness activities, responsibilities and requirements to ensure that NUH is prepared for regulatory inspections by CAs. This SOP is applicable to all staff performing NUH audit or inspection activities and will not apply to audits performed by external service providers (ESPs), as these will be performed in accordance with their own procedures.

4 Page 4 of Responsibilities Head of Regulatory Compliance (HRC) Approval of the QA audit programme Review and approval of audit reports. Implementation of CAPA from audit findings for NUH sponsored studies Assisting with collating and formatting responses to inspection reports as required. Liaising with external sponsors to issue findings from NUH hosted study audits. Quality Assurance Auditor (QAA) Preparing, conducting, reporting and following-up all audits performed by NUH R&I QA. Regular review (and amendment if applicable) of the QA audit programme Auditee Preparing for audit and follow-up of corrective and preventative actions (CAPAs). External Sponsors Co-ordination and follow up of CAPAs for NUH hosted studies Deputy Director of Research and Innovation (R&I) Ensures the appropriate co-ordination of actions before, during and after regulatory inspection.

5 Page 5 of Definitions AE Adverse Event Audit Systematic and independent examination of study related activities and documents to determine whether the evaluated study related activities were conducted, and the data were recorded, analysed and accurately reported according to the protocol, Sponsor's SOPs, GCP, and the applicable regulatory requirement(s). CA Competent Authority CAPA Corrective and Preventative Action CHMP Committee for Medicinal Products for Human Use CI Chief Investigator EMA European Medicines Agency ESP External Service Provider GCP Good Clinical Practice HA Host Administrator HRC Head of Regulatory Compliance Inspection The act by a regulatory authority(ies) of conducting an official review of documents, facilities, records and any other resources that are deemed by the authority(ies) to be related to the clinical study. IRT Inspection Readiness Team ISF Investigator Site File MHRA Medicines and Healthcare products Regulatory Agency NUH Nottingham University Hospitals NHS Trust PV Pharmacovigilance QA Quality Assurance QAA Quality Assurance Auditor QMS Quality Management System R&I Research and Innovation RCM Research Contracts Manager RGF Research Governance Framework for Health and Social Care: 2 nd Ed, 2005 RPM Research Project Manager SOP Standard Operating Procedure TMF UK Trial Master File United Kingdom

6 Page 6 of Procedure Appendix 1 provides a summary of the different types of audit that may be performed by NUH, or a sub-contracted ESP on behalf of NUH. 6.1 Audit Types Study Audits The HRC will decide on the necessity and frequency of an audit for each study. Where NUH is acting as study Sponsor and responsible for QA, an assessment of the need for an audit will be determined by the HRC during the initial risk assessment (refer to SOP- RES-002 Risk Assessment). The risk assessment should take into consideration factors such as the regulatory importance, study type and complexity and risk to participants. Audits may take place at any stage of the study up to and including issue of the final study report. In addition, it may be necessary to conduct a specific triggered or for cause audit where compliance issues have been identified by other means e.g. monitoring Internal Systems Audits The HRC and QAA will assess the previous year s internal systems audit findings and any non-compliances that may have arisen in that area. A risk assessment will be performed to ascertain whether an internal systems audit would be beneficial. If so the audit will be added into the Quality Assurance Programme (TAFQ00301) (refer to SOP- QMS-003 Quality Assurance Programme). Any new processes will also be added to the audit programme periodically to ensure they have been designed as fit for purpose Vendor Audit The requirement to perform a vendor audit will be assessed at the vendor evaluation stage (refer to SOP-QMS-005 Vendor Management). If deemed necessary, the HRC will use the vendor questionnaire for initial evaluation. Based on a completed vendor questionnaire the HRC will determine if further evaluation through a vendor audit is required. This will be documented in the vendor questionnaire. The HCR and QAA will schedule the audit and document this as part of QA audit programme.

7 Page 7 of Audit Process Audit Preparation and Oversight The HRC/QAA will ensure that, where the responsibilities below are delegated to an ESP, the process is followed, albeit with the ESP s own SOPs and templates. Where the auditee is an ESP, the HRC/QAA will ensure that expectations are properly communicated and the process is supervised. For study or vendor audits, the QAA will; Generate an Audit Confirmation Letter (TAFQ00404) once dates and a location for the audit have been agreed. The Audit Confirmation Letter will be sent to the auditee(s). Create an audit plan and agenda using the Audit Plan and Agenda template (TAFQ00403). This should be distributed to the auditee at least 1 week prior to the start of the audit (unless triggered). Request documents from the auditee(s) as appropriate. Depending on the type of audit, these may include: i. Key contact details; ii. A list of applicable SOPs; iii. Organisation charts; iv. A history of regulatory inspections; v. A completed questionnaire; vi. A manufacturer s site master file (if relevant). For internal systems audits the QAA will liaise with the relevant system manager at least 2 weeks before to inform them that an audit of the system will take place. An audit plan and agenda will be drafted using the Audit Plan and Agenda template (TAFQ00403) and will filed within the QA files only. The QAA may choose to generate an audit checklist based on applicable legal requirements, recognised guidance and experience of the type of organisation, system or document.

8 Page 8 of Audit Conduct The QAA will conduct the audit in accordance with the Audit plan and agenda (TAFQ00403). The QAA will hold opening and closing meetings (except for internal systems audits). On becoming aware of an issue during audit that may indicate a potential serious breach of the protocol, GCP, ISO 14155, or fraud/scientific misconduct the QAA will: i. Keep the issue confidential; and ii. Carefully document any evidence that may be relevant and escalate as soon as is reasonably possible to the HRC (refer to SOP-RES-017 Non Compliance and Serious Breach Reporting, and SOP-RES-018 Research Fraud and Misconduct) Audit Reporting The QAA will prepare an audit report using the Audit Report template (TAFQ00405). The QAA will report audit findings by describing the way in which the observed practice deviates from required practice, quoting the reference standard and specific section in which the required practice is described. The QAA may report recommendations (if felt necessary and/or helpful) by describing how an observed practice could be improved according to the Auditor s knowledge of best practice. All findings will be categorised in accordance as follows: Critical: a) Where evidence exists that significant and unjustified departure(s) from applicable legislative requirements has occurred with evidence that: i. the safety, well-being or confidentiality of study participants either have been or have significant potential to be jeopardised, and/or; ii. the clinical study data are unreliable and/or; iii. there are a number of Major non-compliances (defined in (c) and (d)) across areas of responsibility, indicating a systematic quality assurance failure, and/or; b) Where inappropriate, insufficient or untimely corrective action has taken place regarding previously reported Major non-compliances (defined in (c) and (d)); Major:

9 Page 9 of 18 c) A non-critical finding where evidence exists that a significant and unjustified departure from applicable legislative requirements has occurred that may not have developed into a critical issue, but may have the potential to do so unless addressed, and/or; d) Where evidence exists that a number of departures from applicable legislative requirements and/or established GCP guidelines have occurred within a single area of responsibility, indicating a systematic quality assurance failure. Minor: e) Where evidence exists that a departure from applicable legislative requirements and/or established GCP guidelines and/or procedural requirement and/or GCP has occurred, but it is neither Critical nor Major. For all critical and major findings for internal systems or sponsored study audits, CAPA will be raised (see SOP Corrective and Preventive Actions SOP-QMS-008). Minor findings require corrective action only in the response section of the audit report). Recommendations are not mandatory for any action, but the QAA can provide these if so desired. Observations do not require a response but are noted where practice could be improved. It is at the QAAs discretion to determine whether a finding classification requires amendment following receipt/review of responses Completion and Follow-up of Audit Reports Following completion of the draft audit report, the Auditor will forward it to the HRC for peer review. The QAA will ensure all peer review comments have been addressed satisfactorily and will apply version control to the report. The QAA will distribute the audit report to the distribution list as stated in the audit report, requesting responses from the auditee(s) in accordance with the timelines stated in the audit plan and agenda. Following receipt of audit responses from the auditee(s) the QAA will review the responses for acceptability. If the audit responses are not acceptable, the QAA will communicate with the auditee(s) and repeat the response/review cycle until both parties accept the responses, applying version control to the reports as necessary. Upon acceptance of the audit responses by the QAA, the final audit report (including all responses) will be issued to the auditee for their signature. This can be provided by PDF/ but is preferred to be in wet ink wherever possible.

10 Page 10 of 18 Upon receipt of the auditee s signed audit report, the QAA will sign the audit report to indicate that the audit is now considered closed. The lead Auditor will be the sole signatory to the audit report unless otherwise stated in the audit plan and agenda. A copy of the final audit report will be sent to the HRC who will ensure that all relevant findings that have not been addressed to completion in the auditees responses are processed as per the Corrective and Preventive Action SOP (SOP-RES-006). For study or vendor audits, the QAA will generate an Audit Certificate (TAFQ00406). This verifies an audit has been performed and is not a statement of compliance. The QAA will provide copies of the audit certificate to the auditee and relevant personnel. The original will be kept in the QA files. For study audits, a copy of the audit certificate must also be retained in the TMF. The CAPAs will be followed up to their completion. The HRC and auditee are responsible for follow-up and timely resolution of all CAPAs 6.3 Inspection Inspections take place to examine systems and look for good control of processes and opportunities for process improvement. To do this the Inspector will select several studies and look at the processes involved and/or select a process and review it in depth in a number of studies Types of Inspection In the United Kingdom (UK) there are three types of inspection; Triggered, Routine and Committee for Medicinal Products for Human Use (CHMP) Inspections. i. Triggered Inspections, or For-Cause are prompted by events, such as licensing requests or a suspected violation report sent to the Medicines and Healthcare products Regulatory Agency (MHRA). ii. Routine Inspections are conducted at regular intervals with advance notification. iii. CHMP are requested inspections resulting from Marketing Authorisation (MA) submissions. The European Medicines Agency (EMA) directs these inspections Notification of Inspection

11 Page 11 of 18 CAs may or may not provide NUH with prior notice of the inspection. The section below addresses the required preparation when prior notification is provided. In the absence of prior notification, it is the responsibility of site management, and R&I managers, to ensure the required arrangements are made to manage the regulatory inspection. The contacted person/department must forward any inspection communication to the Deputy Director of R&I who will then communicate with the Director of R&I, the Medical Director and the Chief Executive Officer of NUH. The CA will send out the preliminary notification to the intended organisation informing them of the planned inspection and related documents required. For a GCP inspection, a pre-inspection dossier is requested by the inspectors to be able to develop the inspection plan and allocate resource. The dossier is an electronic document to be sent on a CD- ROM or USB Memory Stick within 30 days of notification. Items in the dossier will include, but not be limited to, documents such as: i. Organisational charts and responsibilities summaries; ii. Overview of Trust facilities; iii. List of clinical studies, and if they have Adverse Events (AEs) reported; iv. List of current SOPs; and v. Laboratory Procedures. With the inspection notification a documents list will be included for the dossier but this list can also be found on the MHRA webpage. The Deputy Director of R&I will ensure the dossier is completed and submitted to the CA. Once the CA has received the dossier, the inspection dates will be confirmed with the Deputy Director of R&I, along with any MHRA logistics. The CA will then write their inspection plan and finalise it with NUH. The CA will indicate which studies the inspection will be based on, this is dependent on size of organisation and quantity of studies within the UK. Once signed off, the Deputy Director of R&I will communicate the impending inspection with the following: i. All R&I staff, and other relevant research departments (such as the Clinical Research Network); ii. Director of R&I; iii. Medical Director; iv. Chief Executive Officer; v. Investigators and study teams of studies selected for inspection, and of those of studies that were not selected; vi. Support department managers (e.g. Pharmacy, Laboratories, Medical Records, Radiology); and

12 Page 12 of 18 vii. Appropriate ESPs and partners (such as a Clinical Trials Units or the Treatment Centre) Inspection Preparation Once the final inspection plan has been received, the Deputy Director of R&I, or delegate, will assemble the Inspection Readiness Team (IRT) to go through the plan. The IRT should consist of the Deputy Director of R&I, the HRC, and any QAAs. The team will also include the chosen studies Research Project Manager (RPM). The IRT will appoint tasks and timelines appropriately amongst themselves, involving any other staff as required and informing any relevant teams, departments or ESPs. IRT activities will include, but not be limited to: i. Ensuring any actions from previous inspection(s) have been completed; ii. Study specific quality checks of the TMF, to be co-ordinated by the RPM; iii. Study specific quality check of the investigator site file (ISF): case report forms, source documentation, participant information sheets and informed consent forms, delegation logs; iv. Training records will be checked to make sure all SOP, GCP and relevant training has been undertaken and is up to date and that job descriptions and CVs are also updated where necessary; v. Laboratory documentation is up-to-date and available: laboratory accreditation certificates, laboratory procedures, equipment maintenance and calibration servicing routines; vi. Pharmacy checks: drug accountability; vii. Quality Management System (QMS) and SOP review dates are checked; viii. QA will carry out any necessary study audits; ix. Interview practice will be given to those that are to be interviewed, external consultants are commonly used to do this as a mock inspection; and x. Create the document retrieval process, and ensure all personnel involved are trained Pre-Inspection Before inspection, special inspection related activities must be carried out on instruction by the IRT. Key staff are decided upon: i. Host (usually the Deputy Director of R&I);

13 Page 13 of 18 ii. Host Administrator (HA) (usually the HRC); iii. Backroom Lead(s) (usually R&I managers); iv. Scribes; and v. Runners. The room bookings and any other logistics will be organised on instruction by the IRT. The backroom is used for the collection of requested documents, as well as the briefing and debriefing of staff selected for interview by the Inspectors. It should be equipped with the appropriate IT equipment, photocopier/printer, telephone and stationery. Reception and building security staff will be notified of the intended inspection, providing them with the details of the HRC with instructions to contact them upon the Inspectors arrival. The IRT will brief all staff as a forum for discussion and answer questions anyone may have Inspection The IRT will ensure the rooms being used by the Inspectors are free of all Trust and study specific documentation, including white boards and flip charts. All rubbish bins should be emptied and confidential waste disposed of appropriately. Upon arrival at the NUH R&I reception, the Inspectors should sign in as visitors and be given an appropriate ID badge. All applicable staff should be informed of the Inspectors arrival. At least one member of the Trust must accompany the Inspectors at all times. This may be a member of R&I or a member of the department (site) under inspection as appropriate. The opening meeting should be attended by all members of the IRT, the Director of R&I, the Medical Director and Chief Executive Officer and any other staff deemed appropriate. The agenda and the purpose of the inspection will be confirmed with the Inspectors. Typically the Deputy Director of R&I will give a brief presentation introducing NUH, however this may be delegated to an appropriate alternative representative. The Inspectors will confirm how they will provide their document requests. Inspectors frequently use their own logs, giving requests an allocated number. The logs will be photocopied by a nominated member of R&I and returned to the Inspectors directly. All documents are to be provided without delay but before they are submitted will have COPY and CONFIDENTIAL stamped on them. All documents will be checked by the Backroom Lead, ensuring any confidential information e.g. financial information is obscured.

14 Page 14 of 18 After the Inspection, all document copies will be shredded and all originals returned to their storage location. If the CA requests information on personnel records, NUH will provide records of employee s experience, education and training only. A duplicate copy of all documents given to the Inspectors should be maintained by R&I following the inspection. All staff being interviewed and their scribes will be asked to report to the Backroom at least five minutes before the session is due to start. Scribes are not expected to write down every word verbatim during interview but are asked to take note of the questions asked by the Inspectors and a summary of the response given. Interviewees may take in prompting cards if necessary e.g. accurate timelines. The interviewee: i. Does not volunteer information; ii. Does not guess, lie, deny the obvious, make misleading statements or engage in unconstructive arguments; iii. The interviewee responds in a concise, factual and accurate manner when the Inspector asks a relevant question; iv. If the interviewee decides that the question is outside their area of expertise or authority, or outside the scope of the Inspector s authority they should consult with an R&I manager. v. If an interviewee does not understand the question and/or the context they should ask the Inspector for clarification; vi. If the interviewee realises they have provided erroneous information they should take immediate corrective action when appropriate and have such an action noted by the Inspector; vii. The interviewee does not solicit opinions from the Inspector; viii. The interviewee does not attempt to answer what if questions and other hypothetical questions; ix. The interviewee does not contradict something said by a colleague. If necessary, the interviewee leaves the room, confirms the correct answer, and then corrects the response with the Inspector. After the interview session is complete staff are to reconvene in the Backroom for a debrief. The session is not to be discussed with any other members of staff. The Inspectors may call interviewees back during the remainder of the inspection to answer any ad-hoc questions, so staff must assure their availability at all times. At the end of each day, dependent on the days outcome, staff may be invited to a debrief session led by the Deputy Director of R&I, or delegate, and any document requests will be completed for the next day. The close out meeting will be attended by all who attended the opening meeting. The Inspectors will give a brief summary of findings and notification dates and details for the report.

15 Page 15 of Post Inspection The Inspectors may decide to inspect other sites. Study staff may be requested to be present. If there are no further sites to inspect the Inspectors will send their report to the Deputy Director of R&I within a specified time frame normally stated at the closing meeting. The Deputy Director of R&I will provide a copy of the inspection report to the Director of R&I, the Medical Director and the Chief Executive Officer of NUH. Instructions will be sent on how to respond to the findings by the Inspector. Each finding must be addressed individually. The Deputy Director of R&I and HRC will lead on the CAPA (refer to SOP-QMS-008 Corrective and Preventative Actions) and the response report. The responses must be returned within 30 days of the report being issued, or as requested by the Inspector. This will be under the responsibility of the Deputy Director of R&I, who may delegate this responsibility to another R&I representative. The HRC will ensure all responses are reviewed for compliance, consistency and completeness. After the responses have been returned to the Inspectors, they will review the CAPA plan and if acceptable an inspection closing letter and GCP statement will be issued. The Deputy Director of R&I will notify the Director of R&I, the Medical Director and the Chief Executive Officer of NUH when the inspection is closed. The HRC is then responsible for ensuring all CAPAs are completed. CAPA status will be reportable to the Trust Clinical Effectiveness Committee. The inspection report and the response report is confidential and must not be disclosed to anyone outside of the R&I department without prior authorisation from the Director or Deputy Director of R&I.

16 Page 16 of References and Associated Documents The Medicines for Human Use (Clinical Trials) Regulations 2004, as amended Department of Health Research Governance Framework for Health and Social Care 2005 (2nd Edition) EU Directive 2001/20/EC SOP-QMS-003 SOP-QMS-008 SOP-RES-002 SOP-RES-017 SOP-RES-018 TAFQ00301 TAFQ00401 TAFQ00403 TAFQ00404 TAFQ00405 TAFQ00406 TAFQ00501 Quality Assurance Programme Corrective and Preventative Actions Risk Assessment Non Compliance and Serious Breach Reporting Research Fraud and Misconduct Quality Assurance Program Audit Log Audit Plan and Agenda Audit Confirmation Letter Audit Report Audit Certificate Vendor Questionnaire 8. Appendices

17 Page 17 of 18 Appendix 1. Definitions of Different Audit Types Data Management Audit An audit of the clinical study data and the methods used to collect, transfer, validate and report it. Document Audits An audit of a standalone document (e.g. Investigator Brochure), TMF or an audit of a series of related documents (e.g. protocol, informed consent form or clinical study report). For-Cause or Triggered Audit An audit conducted when NUH identifies or is notified of a potential problem. Problems may be identified by site/participant complaints, employees, third party ESPs or partners. The main goal of a for-cause audit is to evaluate instances of suspected non-compliance and to determine appropriate action(s) to be taken. Internal Audit A routine system audit of internal departments, processes and/or systems to ensure compliance with ICH-GCP, regulatory requirements, procedures documents and study specific instructions (as applicable). Investigator Site Audit An audit conducted at an investigator site, to ensure participant safety and data integrity have not been compromised, to ensure compliance with the protocol, ICH-GCP and applicable regulatory requirements. Laboratory Audit An audit of a local or specialist laboratory either prior to contract award or during the contract period to assess GCP, GcLP, regulatory, protocol and contract compliance, as applicable. Pharmacovigilance Audit An audit performed of pharmacovigilance systems and/or data to ensure compliance with all applicable regulations and procedural documents. Study Audits An audit relating to the conduct of a clinical study, including but not limited to, Investigator Site Audits, Data Management Audits, Study Document Audits, trial master file (TMF), and related Vendor Audits.

18 Page 18 of 18 Vendor Audit An audit of a vendor conducted either prior to contract award (due diligence) or during the contract period to assess GCP, regulatory, protocol and contract compliance, as applicable. Vendors can include clinical laboratories, IVRS service providers, Clinical Trials Units, etc.