Quality Assurance Implications for Computerized Systems following the Able Laboratories FDA Inspection

Transcription

1 Quality Assurance Implications for Computerized Systems following the Able Laboratories FDA Inspection R. D. McDowall* McDowall Consulting, 73 Murray Avenue, Bromley, Kent BR1 3DJ, UK Summary The quality assurance implications for hybrid systems (electronic records with handwritten signatures on the paper copies) following an inspection of a computerized system by the United States Food and Drug Administration (FDA) are explored. The major compliance problem occurred because the paper copies differed, sometime radically, from the electronic records contained within a chromatography data system. These non-compliances ultimately caused the inspected company to go bankrupt. Copyright # 2006 John Wiley & Sons, Ltd. Key Words: Able Laboratories FDA Inspection; 483 observations; differences between paper and electronic records; chromatography data system records Introduction The FDA carried out an inspection of Able Laboratories, a New Jersey-based generic pharmaceutical manufacturer between 2 May and 1 July As a result of finding discrepancies between paper and electronic records in the analytical laboratory and due to the firm s failure to investigate out-of-specification (OOS) results, the company ceased manufacturing operations, recalled 3184 batches of product (its entire product line) and withdrew seven abbreviated new drug applications (ANDAs). The resulting problems and a failure to resolve the issue with the United States (US) Food and Drug Administration (FDA) resulted in a USD 100 million bankruptcy filing in October 2005 and a fire sale of the company s assets. *Correspondence to: R. D. McDowall, McDowall Consulting, 73 Murray Avenue, Bromley, Kent BR1 3DJ, UK. r d mcdowall@compuserve.com The issues raised by this inspection and the failure of the quality unit and senior management to spot and resolve the issue highlights some lessons that all companies need to learn to ensure that the issues are prevented from occurring again. The material in this paper has been interpreted by the author from the FDA Form 483 observations, dated 6 July 2005 presented to the company at the end of the inspection [1]. This case highlights a major problem of using hybrid computerized systems (electronic records with signed paper results) coupled with lax procedural controls and lack of operator training. Form 483 Observations The issues involved with this inspection centered on a chromatography data system (CDS) that was used in the quality control (QC) laboratories. This is a networked data system supplied by the major vendor of these systems. However, DOI: /qaj.357

2 16 R D McDowall the use of the system was such that the controls developed by the vendor were either not used or ignored when analyzing the results from analysis of routine batches of production material. In contrast, the same CDS features developed to ensure compliance with regulations appeared to have been very helpful to the FDA inspectors in their investigation. The system contained all the data necessary to uncover the multiple discrepancies between the paper and electronic records from each individual analysis. There were 12 observations on the Able Laboratories Form 483; only seven are discussed in this paper as being directly relevant to the issue of electronic records and hybrid systems. There are five other observations on the Form 483, but these are not directly relevant to the debate and have not been presented and discussed in this article. Observation 1: The QC unit lacked authority to investigate errors The main issue is that ALL drug products distributed by Able Laboratories failed to have the safety, identify, quality and purity that they are represented to have. The Quality Unit failed to: * review electronic data as part of batch release; * review computer audit trails in the CDS; and * provide adequate training to analytical chemists. As a result, product was released when it failed to meet specifications. This appeared to be a systematic failure across all analysis carried out by the QC laboratories. The examples quoted in the 483 covered inprocess, finished product and stability testing samples. More importantly, data generated by the laboratories was submitted to the FDA in seven ANDAs. This observation triggered the ceasing of manufacturing, complete recall of all batches for all products and withdrawal of the ANDAs by Able Laboratories. There is a difference between the FDA and European Union (EU) good manufacturing practice (GMP) in this context, there is a clear distinction between QC and quality assurance (QA) under EU GMP in comparison to the quality unit within US GMP. Under EU GMP, the qualified person (QP), the Head of Production and the Head of Quality Control have specific responsibilities for GMP and compliance with the marketing authorization for products. However, there are requirements for QA under the Code of Federal Regulations (CFR), but there is no equivalent to the QP. Observation 2: Products failing specifications were not rejected or investigated A major problem was that samples were routinely resampled, reinjected or reanalyzed when OOS results were obtained. This is virtually the same observation as made by FDA when they inspected Barr Laboratories [2] in the early 1990s. The CDS helped the FDA inspectors identify these problems following a review of the CDS audit trail entries for each batch. It was helped considerably by the fact that the data system retains within its database the individual results each time a data file is reprocessed: no data are overwritten but each result is retained and uniquely identified within the CDS database. For example, if a data file is reprocessed three times there will be three individual results with corresponding entries in one of the audit trails of the system. The saving of these intermediate results, each uniquely identified, allows the reconstruction of all events that have occurred from the initial acquisition of the data file. In contrast, if the CDS only saved the final result, then the inspectors would have had to recreate the data-processing method as it was on the day of test and then reprocess the data to see all the results that were identified in the 483. However, when a result was not within specification, the QC laboratory took the existing chromatographic data, which were reinterpreted to an acceptable result. If this did not work, then same sample was reanalyzed; and if

3 Quality Assurance Implications for Computerized Systems 17 this failed, a new sample was taken and analyzed. After the Barr ruling, the FDA issued a draft Guidance for Industry for the Investigation of OOS results [3]. Although the QC laboratories had a standard operating procedure (SOP) for the investigation of OOS, as we shall see later, it was not effective. However, Able Laboratories did not carry out the required OOS investigation, but chose instead to test compliance into their products. Again, like Barr, any OOS results were not reported and ONLY the withinspecification results for in-process, final product analysis and stability study testing were documented in the reports for these analyses. Some of the discrepancies documented in the Form 483 were: * Acetaminophen and codeine tablets: The original result for codeine phosphate content uniformity was 8.3% RSD (relative standard deviation) versus a specification of 56.0%, but the result that was finally reported was 5.5%. * Atenolol tablets: The dissolution test had a specification of not less than 85%, one original result was 30.9%, but when reported was 102.8%. The Form 483 does not make it clear, if the final result was obtained by reintegration, reanalyzing or resampling. * Diphenoxylate and atropine tablets: In-process blending had a specification for one stage of %. The original results were in the range of %, but miraculously data in the range of % were reported. There are three pages of discrepancies as shown above listed in the Form 483 showing that this was not just an isolated instance, but a systematic issue. Given the Barr ruling dates from 1993 plus the draft FDA Guidance on OOS and the general chapter h1010i from the United States Pharmacopoeia 28 [4] on OOS testing, why did this occur? It is incompetence at best or fraud at worst. Observation 3: Annual reports did not contain investigations about the safety or effectiveness of a drug As a result of the failure to investigate any OOS results, information about material that should have been in Annual Product Reviews and submitted to the FDA was not there. As the Form 483 notes, only passing data points were submitted. Examples quoted included: * Propoxyphene napsylate tablets had a dissolution specification for the stability samples of not less than 80%. For one batch the initial results were 72.8 and 73.2%; but were reported as 98.5 and 96.9%. This is not merely checking the positioning of baselines or the modification of integration parameters within the CDS, but something far more significant. Therefore, the immediate impact was the withdrawal of a number of pending ANDA submissions and all existing approved ANDAs. As a result, the company now had no licensed products. Observation 4: Failure to file field alerts As required by the FDA, NDA field alerts were not submitted within three working days when one or more distributed batches of a drug failed to meet the specifications established for it in the application. This was partly due to the fact that when a specification failed it was retested until it passed, but also due in part to Able Laboratories not having a SOP for issuing field alerts. Observation 5: Laboratory records do not include complete data The US cgmp regulations (21 CFR Part ) require that laboratory records contain complete data in contrast to production records (21 CFR Part ) that only require complete information. The citation in the Form 483 states laboratory records do not include complete data derived from all tests, examinations and assay necessary to assure compliance with established specifications and standards.

4 18 R D McDowall This observation is a simple compounding of the initial issue where OOS results are not investigated. To quote the 483: The QC laboratory notebooks and binders lacked data from all analytical testing conducted in the QC laboratory. Laboratory records did not include all data such as OOS results, chromatograms, sample weights, and processing methods. However, there was much more uncovered by the inspectors. OOS results were substituted with passing results by Analysts and Supervisors. The substitution of data was performed by cutting and pasting of chromatograms, substituting vials, changing sample weights and changing (CDS) processing methods. Here is where the CDS helped the inspectors: * OOS results not documented in laboratory records. Unreported OOS results were found in electronic data files. * Changed chromatogram headers by cutting and pasting, so during review all sample injections would appear to be in sequence. * Original sample weights not recorded in notebook. Sample weights were changed by the analyst until a passing result was obtained. * Processing methods changed by analyst until the processing method resulting in a passing result. Original processing method not recorded in laboratory notebook. For a regulated method, it can be argued that if you reprocess the data for the active compound then the method is out of control, with the exception of impurity testing. However, you do need a SOP that states where and where not an analyst can reintegrate chromatograms [5]. The situation at Able Laboratories appears to be somewhat different in that there was a regime dedicated to passing material regardless. When discussing the level of compliance to implement within any regulated function, there is always an argument that we rely on the ethics and integrity of the staff. However, ethics and integrity appear to be conspicuous by their absence in this instance from reading this 483 observation. Observation 6: Inputs and output from the computer are not checked for accuracy This is a GMP predicate rule citation from section 21 CFR Part (b) which states Input to and output from the computer or related system of formulas or other records or data shall be checked for accuracy. The degree and frequency of input/output verification shall be based on the complexity and reliability of the computer or related system. However, there is also a requirement in the laboratory records section that has an implication, and this is section 21 CFR Part (a) (8): The initials or signature of a second person showing that the original records have been reviewed for accuracy, completeness, and compliance with established standards. Typically, the check required by this section is performed by the QC laboratory staff and there is no stated requirement for QA to do anything. In many organizations, QA staff does not wish to review electronic records and are quite content to review the signed paper output from a computerized system. However, the 483 observation notes that audits were not conducted of the CDS used to control the chromatographs and acquire the data during the analysis of products. Sample injections, processing methods and sample weights were not reviewed or verified for accuracy of reported sample results during testing of samples from in-process, product and stability samples. Therefore, as we become more and more electronic, there will be a requirement to review electronic records and documentation electronically and not on paper. Perhaps this is a wakeup call for QA to gear-up and acquire the skills for this new direction. Observation 8: Failure to train employees in cgmp Employees were not given training in cgmp and written procedures required by the regulations: QC laboratory analysts were not routinely

5 Quality Assurance Implications for Computerized Systems 19 trained in QC procedures such as SOP QC , Laboratory Deviation Investigations and SOP QC , Acceptance/Rejection criteria for OOS Analytical Test Results. This lack of training and oversight by management contributed to the non-reporting of OOS results in QC laboratory. Lessons Learnt There are a number of checks and balances that are required to be present that appear to have failed in the case of the QC department of Able Laboratories. However, rather than focus on a laboratory-centric discussion, the author believes that a discussion covering the wider perspective and issues will develop a set of QA principles that can be applied to any regulated process. Reliance on paper records If not immediately apparent to every reader of this article, the regulated world is going to be electronic sooner or later and paper will no longer be the master of the house. The reasons for this are two-fold: * Regulatory drivers are moving to electronic submission of new drug applications (electronic Common Technical Document (ectd)) or serious or life-threatening adverse events (E2B). This is as much to avoid re-entering data by regulatory authorities as removing the mountains of paper from their facilities. This will only extend to other areas. In the future regulatory inspections could be conducted remotely via the Internet to review the records in conjunction with a video link with the healthcare facility staff. * Business drivers: healthcare margins are under pressure as providers such as governments seek to reduce the price paid for medicinal products. Effective electronic processes with electronic signatures where appropriate are faster, cheaper and less error-prone than any corresponding paper-driven process. Therefore, hybrid systems need to be managed from three perspectives: 1. Paper records and their integrity. 2. Electronic records and their integrity. 3. Linkage and integrity between the paper and electronic records. To do otherwise is ostrich QA. Furthermore, hybrid systems should be replaced as firms go electronic in both research and development (R&D) and manufacturing. Otherwise, there is the ludicrous situation of using an electronic system to create paper records that are scanned into a document management system to create an electronic submission. Good business sense all round? Fear of auditing computer systems The Form 483 notes that the quality unit failed to review electronic data and the associated audit trail entries. However, let us look in a wider context than just Able Laboratories. There is an unspoken fear among quality professionals about auditing electronic systems because they are much happier dealing with paper. In part this is due to the fact that paper is a tangible medium and is a known quantity rather than the intangible media that constitute electronic records (see Table 1 for more detail of the comparison between paper and electronic records). Instead of a linear pile of paper that can be audited to check data integrity, there are hyperlinked electronic records that appear to disappear into the database. This is compounded by the failure of system developers to design audit trails that facilitate effective auditing. The audit trail in many applications is apparently gibberish, unless the reader has a good understanding of the overall application, which is often unrealistic. Therefore, many computerized systems are not really designed to facilitate effective quality auditing. Ironically, the CDS system at the heart of the QC department at Able Laboratories can be set up by a trained administrator to highlight where human intervention in the chromatographic

6 20 R D McDowall Table 1. Comparison of paper and electronic media Paper media Tangible medium Robust medium Known and defined long-term storage conditions Standardization (except size letter/a4) Quality review follows paper trail Electronic media Intangible medium Friable magnetic media (disks) Lack of standards for optical media, e.g. DVD Short-term storage known (magnetic media) Long-term storage unknown (optical media) Proprietary standards for most electronic records Quality review being developed or unknown process has occurred [5]. However, this served merely to help the inspectors rather than the laboratory that it was originally designed to serve. Definition of complete data When working to GMP in laboratories there is the requirement, as noted earlier, for complete data. When working with a hybrid system, this can be difficult if not explicitly defined and documented. Therefore, as a minimum, laboratories need to define what constitutes complete data in a hybrid situation to comply with the regulation. In contrast, however, when working electronically and using an appropriately designed database application, complete data can be automatically collected and stored within the database. All that is required is the definition of electronic records captured and maintained by the system. Trust us our employees are trained When looking at any debate on how detailed the controls should be for any electronic system there is always a human element. A number of technical controls of various degrees of complexity can be implemented within a system to ensure data integrity; it just depends on how paranoid a company is, and how deep their budget runs. However, technical controls can only go so far, as computerized systems need to be operated by humans. Here the combination of education, experience and training of individuals comes to the fore. Users need to understand not only the operation of the computer system as required by their access privileges, but also the ethics and integrity required operating under any of the GXP quality systems. Therefore, there is a need, in the words of Ronald Reagan, to trust but verify and here the twin roles of line management coupled with independent audit are the keys to success. Obviously, in the case of Able Laboratories, there was a failure in this process. As noted in the 483, both management and quality failed in their tasks to ensure integrity of the laboratory operations. References 1. Able Laboratories. FDA Form 483 Inspectional Observations. 6 July United States District Court for The District of New Jersey, United States of America. Civil Action No , Opinion 4. V. Barr Laboratories Inc., February Draft FDA Guidance for Industry. Investigating Out of Specification (OOS) Test Results for Pharmaceutical Production, United States Pharmacopoeia 28. General Chapter h1010i Outlier Testing. United States Pharmacopoeial Convention Inc., Rockville, MD, McDowall R D, Validation of Chromatography Data Systems: Meeting Business and Regulatory Requirements. Royal Society of Chemistry: Cambridge, 2005.