Ensure Data Integrity Compliance in the Analytical Laboratory A Life Cycle Approach

Transcription

1 Ensure Data Integrity Compliance in the Analytical Laboratory A Life Cycle Approach Paresh Patel Director, Scientific Operations Johnson& Johnson QS&S 12/14/

2 Topics GMP regulatory requirements for data integrity Laboratory processes & Complexity Applicability of data integrity Why is data integrity so important? Case Studies 2

3 What is Data Integrity? It Refers to Completeness Consistency Accuracy of data Guidance Document MHRA, FDA, WHO, & Other ALCOA A Attributable to the person generating the data L Legible and permanent C Contemporaneous O Original (or true copy ) A Accurate FDA Guidance Document - Data Integrity and Compliance With CGMP Guidance for Industry, April 2016 MHRA GxP Data Integrity Definitions and Guidance for Industry, Draft, July

4 Data Integrity- ALCOA Attributable The identity of the person completing a record (paper vs electronic record) (d), , , (b)(11), and (c)(10) Legible The data is readable, understandable, traceable, permanent allowing for a clear picture of the activities that occurred (e) and (b) Contemp oraneous The data is recorded at the time it (data) is generated or observed. No back or forward dating For contemporaneously recorded (at the time of performance) (b) and (a) Original Original records must preserve data accuracy, completeness, content and meaning. Data as the file or format (paper or electronic) in which it was initially generated and (a) Accurate The data recorded must be accurate whether paper or electronic It must be exact, true and free from error. Where necessary, this might require a second verification (a), , , and (g) 4

5 Regulatory Requirements 5

6 Why is Data Integrity so Important? The Basics It s a cgmp requirement Do not discard original or quality data Data (paper or electronic) must be recorded in such a way that the source is traceable and persons responsible and timing are identified Complete, accurate records of manufacturing and support activities Testing including raw data, calculations and audit trails Calibration and Maintenance records Training records SOPs, Test methods Investigate deviations, document lab investigations & conclusions Do not think it is isolated incident, perform due diligence investigation No Trial injections 6

7 Data Integrity FDA Regulatory Inspections Outcome Laboratory System 60% of WL citations Audit trails Trial injections Testing into compliance No controls to prevent omission/editing/ deletion of data Quality System (QA Oversight) 25% of WL citations Inadequate or no QA review Data/records Investigations Failure to implement controls/procedures to prevent recurrence Enforcement of Regulations Production System 15% of WL citations Unofficial and official inprocess results Unreported quality defects Unreported rejected units Multiple maintenance and production logbooks Uncontrolled manufacturing batch records Inspectors are trained on Laboratory Systems Focus on laboratory processes, systems & data 7

8 Impact Regulatory citations Warning Letters Approval Delay Warning Letter Suspension Order Change in Business Priority Field Action Revenue Loss 483 Lost Trust (External & Regulatory bodies) Criminal and Civil Penalties Seizure and Injunction 8

9 Laboratory Process Example: Raw/package material Environment monitoring In process material Finish goods Stability Ad Hoc Samples Key inputs Lab Quality system Lab Operation Quality Systems: Sample management Procedures Test Methods LCM People Training/ Qualification Facility/ Environment Contract Lab Management Documentation & Record Mgmts. OOS, CAPA Key outputs Instrument LCM Software LCM Technology Instruments & Software 9

10 Laboratory Processes- Scope Holistic Approach! Details! 10

11 Data Complexity Paper-based record manual observation Record from equipment Validation effort Risk & Complexity of Data Integrity validation for intended purpose 11

12 Components of Data Quality (per <1058>) Analytical methods validation, alone, is insufficient to ensure the generation of quality data. It is one piece of the system. Quality Control Check Samples System Suitability Tests Verify that the instrument qualification has been performed to meet the ranges / capabilities required by the individual assay. Analytical Methods Validation Analytical Instrument Qualification Intended purpose- Instrument LCM 12

13 Human Error Data entry and transcription Lack of training and understanding of GMP / GLP Requirements Lack of due diligence when meeting Metrics/ metrics driving wrong behaviors Selection of good or passing results to the exclusion of those that are poor or failing Unauthorized changes to data made post-acquisition Errors of data transmission between computers or systems Software issues (e.g., defects or configuration errors) Hardware failures (e.g., disk crashes, network failures) Archived data process, data irretrievability, and impact of technology obsolescence 13

14 Data Lifecycle Create Data Recording Data Usage Data Retention Archive/ Retrieval Destroy All phases in the life of the data (including raw data) from initial generation and recording through processing (including transformation or migration), use, data retention, archive / retrieval and destruction (MHRA January 2015) 14

15 Applicability Laboratory Processes Why? Software Issuance & Control of Documents (e.g, Notebooks, Logbooks, Datasheet, etc.) Documents Reconciliation Process Issuance & Control of Documents Tracking Sample Management & Chain of Custody Test preparations Documentations Traceability (e.g. equipment, standards and reagents expiry, etc.)? Data Transcription Printout vs Visual record transfer Data Review & Approval Process (e.g. Paper record, electronic Record, Notebook, Logbooks, etc.) Traceability to the original/source data Completeness Accuracy Timeliness Validity Consistency Access Control Audit Trail Time Stamp Data Analysis & Review System Administration Validation Change Management Training Data Storage, Backup & Recovery Data Storage, Retention & Destruction Process 15

16 Case Study 1- Documentation A pharmaceutical company has received the approval of new products, which has very high demand in the market. After product launch company had several challenges to release product in market as per demands. As a result leadership team decided to initiate project to investigate further, scope of the project is to evaluate all processes including laboratory testing that can improve cycle time. Team comes to conclusion that analyst spending more time on documentation during testing. Further evaluation of laboratory data sheet, it is concluded that 50% information is not relevant to calculate final results What issues do you see with this situation and what could be done to correct and improve it? Team decided to update their data sheet which is used for Assay & Impurity testing execution. This effort is part of an ongoing project to improve readability of data sheets so that review time would be reduced and improved overall test cycle time. There have been a number of OOS results for Assay & Impurity testing, some of which were confirmed laboratory errors and some of which were confirmed as OOS results and escalated into a nonconformance.. QA Manager was reviewing quarterly trending report and noticed that increase in number of laboratory investigations has no assignable cause. On further evaluation Manager found that there are several instances where testing was repeated without assignable cause and products were released. 16

17 Case Study 1- Documentation cont. Instrument Test Preparations Data processing NC/OOS Traceability Initial Assessment: Laboratory SME indicated that new form is limited to document only sample information, Standard and sample weigh information Root Cause: The new form does not include complete data derived from testing to assure compliance with established specifications and standards: No documentation or traceability to lot numbers, dates of manufacturing, dates of retests No data or reference that describes sample preparation & standard preparation No traceability to the instruments used during method execution No traceability between analysts and work performed 17

18 Case Study 1- Documentation cont. Corrective Action: Revised data sheet form to include data required and train on its usage Ensure traceability between samples and test data Establish and require instrument use logs Review Standard and Sample preparation process. If preparation is recorded in a laboratory notebook or other data collection device, ensure that there is traceability between the preparation data and the result worksheet Data entries should be recorded promptly when actions are performed Preventive Action: Review all other Test Method Data Forms to ensure testing forms contain all required data and/or reference to data location 18

19 Case Study 1- Documentation cont. Training Analyst (Manpower) Solutions Preparation - Accuracy - Dilution - Technique - Expiry - Storage Condition - Segregation Qualification Instruments (Machine) Electrical Spike Analyst Interview - Procedure Followed - System Verification - Data Review Setting & Parameters - Flow Rate - Detector - Temperature - Sample Set Performance - Lamp Energy - Leaks Calibration Test Method and Samples (Method) TM Validation - Solution Stability - Robustness Auto-sampler - Vial Positions - Vial Labeling - No of Injections/Vial Additional Experiments Sample Condition - Chain of Custody - Storage - Damage OOS/OOT Result Glassware - Contamination - HPLC/GC Vials - Extraction Tube - Volumetric glassware System Suitability - %RSD - Tailing Reference Std and Reagents - Bracketing Std - Purity - Grade - Alternate Vendor Materials Guidance/Regulation: Column - Usage - Condition Detector - Performance (Noise, spike) Data Review & Calculation (Measurements) DAS System (Empower) - Integration Parameter - Calculation - Degradation - Late Eluting peaks - Trend Other Data Review - Other Test (Assay/DCU/Elution) - Additional Batches - Historical Data The selected method should ensure that data of appropriate accuracy, completeness, content and meaning is collected and retained for its intended use There should be a procedure which describes the process for the review and approval of data, including raw data. Data review must also include a review of relevant metadata, including audit trail. 19

20 Case Study 2 - Documentation Control Excelsior Laboratories uses an electronic document management system that provides only the current effective version of a Test Method Data Sheet available to system users. Kim has just completed testing 10 samples. She prints the test method data sheet form from the document system and takes the data notes back to her desk to complete. While there, she becomes distracted and spills coffee on the partially completed test data form. The form doesn t look good because of the spill. Kim like her documentations to be neat and clean so decided to reprints the test data sheet form from document system and begins to transfer the data from the Original data sheet form. When the reprinted (second) form is completed, she discards the original form. During data review process reviewer noted that the standard weight is missing from the data sheet form. What issues do you see with this situation and what could be done to correct and improve it? 20

21 Case Study 2 - Documentation Control cont. Root Cause: Use of the Laboratory Worksheets are not issued/controlled to ensure the reliability and integrity of the data Failed to ensure laboratory data included complete data derived from all tests necessary to assure compliance with established specifications and standards Recording of test data was not performed at the time of testing Original records were not maintained Supervisor was not notify of incident 21

22 Case Study 2 - Documentation Control cont. Corrective Action: Implement a process for the issuance and control of Laboratory Train and monitor analysts to ensure that recording of data is done at the time of testing Implement a process for record management that ensures both paper and electronic records are maintained and can be archived and accessed when needed Preventive Action: Establish a process to monitor the effectiveness of the issuance and control of Laboratory Worksheets (e.g. establish a reconciliation process for distributed Laboratory Worksheets) Guidance/Regulation: Data as the file or format in which it was originally generated, preserving the integrity (accuracy, completeness, content and meaning) of the record, e.g. original paper record of manual observation, or electronic raw data file from a computerized Free access to blank paper for raw/source data recording should be controlled where this is appropriate. Reconciliation may be necessary to prevent recreation of a record. 22

23 Document Issuance & Control There must be document controls in place to assure product quality ( , (a), , (d), and (g)) Blank forms (including, but not limited to, worksheets, laboratory notebooks, controlled by the quality unit or by another document control method Blank forms may be issued as appropriate and should be reconciled upon completion of all issued forms Incomplete or erroneous forms should be kept as a part of the permanent record along with written justification for their replacement ( , , (a), and (f)(1)(vi)). 23

24 Case Study 3 Electronic Laboratory Data Management Systems Access Control Due to recent cutbacks because of loss of business, Excelsior Laboratories now down to a small staff. They still are using the validated Chromatographic Data Management System that was in place when the laboratory was larger. The system currently has an analyst role and a system administrator role. Two analysts currently have access as both an analyst and an administrator. What issues do you see with this situation and what could be done to correct and improve it? The analyst role allows the analyst to either RUN or REVIEW, but not both. The administrator role allows the analyst to RUN, REVIEW and makes SYSTEM CHANGES. During an annual internal audit, the auditor requested the audit trail log of the system. The auditor noted that there are several instances where an analyst logged in as an administrator and performed the analysis. Also the same analyst log in as analyst and perform the data review of the same analysis. 24

25 Case Study 3 Electronic Laboratory Data Management Systems Access Control cont. Root Cause: The system allows the user to run and review the sample as an administrator. The system did not prevent an administrator from analyzing a sample Corrective Action: Remove administrator privileges which allow the administrator to run the analysis and review the data Procedure needs to be established to review the audit trail after each analysis as part of the data review process Establish a process to perform a System Audit Trail on a periodic basis Train analysts on importance of independent review of data 25

26 Case Study 3 Electronic Laboratory Data Management Systems Access Control Cont. Preventive Action: Review all other electronic data management systems in the laboratory to ensure the issue is not systemic. Guidance/Regulation: System Administrator rights (permitting activities such as data deletion, database amendment or system configuration changes) should not be assigned to individuals with a direct interest in the data (data generation, data review or approval). Where this is unavoidable in the company structure, a similar level of control may be achieved by the use of dual user accounts with different privileges. All changes performed under system administrator access should be visible to, and approved within, the quality system. 26

27 Access Control Internal & External Security Why? Password-protect individual accounts. Review Account access levels / shared accounts/ shared access Configure computer system to require manual login and logout. Process for failed login / unauthorized login Automatically limit number of failed login attempts. Automatic log off Automatically password protect computer systems when idle for short periods Restrict access to computer system and data via external software applications by encrypting data as it is transferred and/or using a firewall. Maintain cumulative record that indicates names of authorized personnel, their titles, and a description of their access privileges. Controls of external personnel access Maintain list of historical uses ensure accounts are properly disabled. Prevent, detect and mitigate effects of viruses and other harmful software code Adequate procedures are in place defining administration of the system (e.g. periodic review of users access People have access only to functionality that is appropriate for their job role System Administrator rights should not be assigned to individuals with a direct interest in the data Can All changes performed be visible and approved within the quality system. Have colleague's moved departments and still maintained access to the various systems, i.e. potentially working in production with access to QC data? Do vendors have a shared admin account, used by multiple individuals, on multiple sites Can a vendor upgrade software without approval in a quality system 27

28 Case Study 4 - Logging/ Monitoring & Audit Trails Sam, senior scientist at Omega Laboratories performs the routine testing in Quality laboratory. His manger speaks highly about his work since he rarely made mistake and complete the work on time. Sam assigned to work on drug product assay test for 10 batches. While him preparing samples, Pam a newly hired scientist, asking clarification on another test method. After discussion was over Sam continued his preparation and started his HPLC analysis. Sam usually monitors his analysis before he leave. What issues do you see with this situation and what could be done to correct and improve it? While reviewing, he notices there were some unknown peaks in some of the sample chromatograms. Sam realized that he used incorrect solvent for sample preparation. He immediately aborted the run and prepared new samples. Sam started new sequence and concluded the analysis. He s done this a few times before on other product analysis jobs without it being noticed. During quarterly audit of the system it revealed that there were several sample analysis sequences which never processed and results were not reported. 28

29 Case Study 4 - Logging/ Monitoring & Audit Trails Cont. Root Cause: There is a deviation process but it was not followed There is lack of guidance on data review process to address abnormal/ results or unknown peak Reviewer not able to detect the incidence by reviewing audit trail Corrective Action: Open laboratory investigation / NC to address the problem Implement a SOP that provides clear guidance on data review process Train all personnel on the deviation process and how to handle OOS results Establish a process for periodic monitoring of audit trails 29

30 Case Study 4 - Logging/ Monitoring & Audit Trails Cont. Preventive Action: Review other electronic systems and ensure that audit trails enabled (if available by system function) or implement a manual audit trail logging process Guidance/Regulation: There should be a procedure which describes the process for the review and approval of data, including raw data. Data review must also include a review of relevant metadata, including audit trail. Audit trails need to be available and convertible to a generally intelligible form and regularly reviewed. Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand. 30

31 Case Study 5 - Data Reprocessing & Audit trail review Sam, senior scientist at Omega Laboratories performs the routine testing in Quality laboratory. He is one of the senior most people in laboratory and knows the process very well. Sam is SME for training the new analysts in the laboratory. He rarely makes mistake and complete the work on time. Sam assigned to work on serval 12 month pull stability samples which is stored at 25c/ 60% RH. After completion of analysis, Sam is reviewing data. He notices that parameter used for processing are not optimal since he found few peaks which are not recognized. What issues do you see with this situation and what could be done to correct and improve it? Sam knows that this product has no stability issues in a past, so he decided to change the processing parameter and process data several times. Finely Sam tweak processing method and get the result which is he expected. 6 month later Sam performing analysis on 18 month stability samples on same lot, he found similar challenges on processing. Since Sam knows the product so he followed the similar approach and processes the data several times. Sam reported data which meets the stability specification. There is serval completions received from field about this product. A task was assign to QC manager to review the historical data and ongoing stability data. Manager notice that on several occasion some the peaks are not integrated, after further evaluations Manager found that all analysis are associated with stability samples. 31

32 Case Study 5 - Data Reprocessing & Audit trail review Cont. Root Cause: There is lack of guidance on data review process to address abnormal/ results or unknown peak Reviewer not able to detect the incidence by reviewing audit trail Corrective Action: Open laboratory investigation / NC to address the problem Implement a SOP that provides clear guidance on data review process. Train all personnel on how to handle abnormal results. Establish a process for periodic monitoring of audit trails. 32

33 Case Study 5 - Data Reprocessing & Audit trail review Cont. Preventive Action: Review other electronic systems and ensure that audit trails enabled (if available by system function) Individual changes Compliance! Be Aware! Testing in to Compliance Data Reprocessing Guidance/Regulation: Final Results There should be adequate traceability of any user defined parameters used within data processing activities. Audit trails and retained records should allow reconstruction of all data processing activities regardless of whether the output of that processing is subsequently reported or otherwise used. If data processing has been repeated with progressive modification of processing parameters this should be visible to ensure that the processing parameters are not being manipulated to achieve a more desirable end point. 33

34 Audit Trail Audit Trail Why? Audit trail availability Original Entry maintain & not over written Assess Date and time configuration Identity of Individual Prevent from modification or deletion Audit Trail Review Process Archive data are locked Deleting records Manual Data Processing Creations Modifications Prevent from Deleting records Deletions History (Who did what, when, etc.) Data manipulation Tested in to Compliance (e.g. manual integration) Accidental data processing Audit Trail Review: Change to Sample run sequences, Sample identification, Critical process parameters, History of test results 34

35 Data Handling Data Backup & Recovery Data Analysis & Review Life Cycle Management Process Established Manual vs Automated Process Process Validated Protection against Data loss Process to avoid data manipulation Changes are Visible Management of manually process data Trial Run/ Injection Analysis Amendment Data lock after final review Authorization requirement for correction Validated to meet Requirements Change management Maintainenance Operational Procedures Quality Oversight System Investigation Documentation, SOP, Training 35

36 Case Study 6 Excel Spreadsheets Excelsior Laboratories uses a series of Excel Spreadsheets to perform complex analytical calculations for test results. These spreadsheets have been validated; however, they are not stored in the Electronic Document Management System because the system renders all controlled documents to a pdf format, which makes the spreadsheet unusable. The spreadsheets are stored on a shared drive. It is common practice to keep a copy of the most current spreadsheet on local drives for ease of use. What issues do you see with this situation and what could be done to correct and improve it? Some spreadsheets require the input of less variable data than other spreadsheets. In these cases, used spreadsheets are overwritten with the new variable data to eliminate unnecessary data input. As a corrective action to an internal audit observation, it was required that the analysts inventory spreadsheets to reconcile each spreadsheet with a set of test results. It was found that the laboratory was missing about 45% of the spreadsheet files that were associated with released test reports. It was also found that the spreadsheet file on User A s computer gave results that differed from User B s file. 36

37 Case Study 6 Excel Spreadsheets Cont. Root Cause: The use of Excel Spreadsheets in calculations are neither controlled nor prevented from modifications or deletions Spreadsheets were stored on local drive and accessed to generate test results Files were overwritten and test data was lost Spreadsheets became corrupted though unintentional edits/modifications 37

38 Case Study 6 Excel Spreadsheets Cont. Corrective Action: Test the Master Spreadsheet file to ensure that it is continues to meet the user requirements set forth in the validation Perform a risk assessment for all release data impacted by missing or corrupted spreadsheets. Take appropriate corrective action if the risk is not acceptable. Load spreadsheets into a system that enforces Part 11 Compliance Train and enforce the use of spreadsheets only from the source and not from the local drive. Establish clear naming conventions and establish a secure destination drive to store all spreadsheet data As part of data review, confirm the Excel file exists on the secure destination drive and that the spreadsheet source confirmation in data sheet is signed and dated by analyst Preventive Action: Review all spreadsheet master files on the common drive to ensure they have not been corrupted. Enhance and enforce security of spreadsheet master files on the common drive Guidance/Regulation: Where relevant audit trail functionality does not exist (e.g. within legacy systems and spreadsheets) an equivalent level of control may be achieved for example by the use of log books, protecting each version and change control 38

39 Data Integrity- Control Intentional Unintentional Knowingly reporting incorrect information Deliberate deviation from procedure(s) Control over intentional and unintentional changes Not recording all data (due to Systems and/or Procedures being inadequate or inadequate training) Human errors during recording and/or data entry Requirements are made to appear acceptable during reporting Discarding data or records believed to be no longer needed 39

40 Q&A 40