Ensure Data Integrity Compliance Enterprise-Wide

Transcription

1 Ensure Data Integrity Compliance Enterprise-Wide PharmaQual 360 º Conference February 24, 2017 Chris Wubbolt QACV Consulting, LLC 1

2 Objectives What is data integrity and the definition of data? Original and true copy Audit trails and raw data Metadata Data Integrity Observations Data Integrity Program Development Awareness and training Data Integrity Assessments and Remediation Audit Trail Review What to review User account and access Completeness of data 2

3 Current Regulatory Requirements and Guidance March 2015 MHRA - GMP Data Integrity Definitions and Guidance for Industry September 2015 WHO - Guidance on Good Data and Record Management Practices April 2016 FDA Data Integrity Guidance and Compliance with CGMP 3

4 Current Regulatory Requirements and Guidance July 2016 MHRA - GxP Data Integrity Definitions and Guidance for Industry August 2016 PIC/S - Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments August 2016 EMA Data Integrity Guidance Q&A 4

5 What is data integrity? Data Integrity Completeness, consistency, and accuracy of data. Attributable Legible Contemporaneous Original (or true copy) Accurate Enduring Complete Consistent Available 5

6 Data Integrity - Paper Legible Original Accurate and Complete Attributable Contemporaneous 6

7 Data Integrity - Electronic Attributable Legible Contemporaneous Original Accurate and Complete 7

8 Data Integrity - Electronic Legible Attributable Contemporaneous Original Event User ID Previous Value New Value Date Time Reason Data Entry DOCon NA /17/ :42 EST NA Approval Cwubb NA NA 1/18/ :45 EST NA Data Change DOCon /19/2007 8:45 EST Calculation Error Approval Cwubb NA NA 1/19/2007 9:33 EST NA Accurate and Complete 8

9 Original Records & True Copies 21 CFR (d) Records required under this part may be retained either as original records or as true copies such as photocopies, microfilm, microfiche, or other accurate reproductions of the original records. 9

10 MHRA Guidance - Data Original record Data as the file or format in which it was originally generated, preserving the integrity (accuracy, completeness, content and meaning) of the record, e.g. original paper record of manual observation, or electronic raw data file from a computerised system True Copy A copy of original information that been verified as an exact (accurate and complete) copy having all of the same attributes and information as the original. A true copy may be retained in a different electronic file format to the original record, if required, but must retain the equivalent static/dynamic nature of the original record. 10

11 FDA Guidance It is not acceptable to record data on pieces of paper that will be discarded after the data are transcribed to a permanent laboratory notebook. Similarly, it is not acceptable to store data electronically in temporary memory, in a manner that allows for manipulation, before creating a permanent record. Electronic data that are automatically saved into temporary memory do not meet CGMP documentation or retention requirements. 11

12 Complete Records 21 CFR Batch production and control records shall be prepared for each batch of drug product produced and shall include complete information relating to the production and control of each batch. 21 CFR 194 (a) Laboratory records shall include complete data 12

13 Complete and Accurate Define data for each system, including each file type. Chromatography Systems Raw Data File Integration Parameters Quantitation Sequence File Other Laboratory Instruments Raw Data File Separate Audit Trail Log 13

14 MHRA Guidance Terms and Definitions Metadata Data that describes attributes of other data, and provide context and meaning. Without metadata, data has no meaning. Example 3.5 sodium chloride batch 1234, 3.5 mg. J Smith 01/07/

15 Static FDA Guidance Static & Dynamic Records Fixed-data document such as a paper record or an electronic image. Dynamic Format that allows interaction between the user and the record content. Chromatographic Record Allows user to change the baseline. Reprocess chromatographic data. Resulting peaks may appear smaller or larger. Spreadsheet User modification of formulas or entries used to compute test results. 15

16 Static / Dynamic Data 16

17 Static / Dynamic Data System Suitability: %RSD < 2.0% %RSD 3.9% X 17

18 Q&A on CGMP, Good Guidance Practices, Level 2 Guidance - Records and Reports (August 2010)* How do the Part 11 regulations and "predicate rule requirements" (in 21 CFR Part 211) apply to the electronic records created by computerized laboratory systems and the associated printed chromatograms that are used in drug manufacturing and testing? For HPLC and GC systems (and other computerized systems involving user inputs, outputs, audit trials, etc.), the predicate rules, such as 21 CFR and 21 CFR (d), require the electronic records themselves to be retained and maintained in accordance with those regulations. 21 CFR (d) requires records to be retained either as original records or true copies The printed paper copy of the chromatogram would not be considered a true copy of the entire electronic raw data used to create that chromatogram, as required by 21 CFR (d). *

19 Q&A on CGMP, Good Guidance Practices, Level 2 Guidance - Records and Reports (August 2010) The printed chromatogram would also not be considered an exact and complete copy of the electronic raw data used to create the chromatogram. The chromatogram does not generally include, for example, the injection sequence, instrument method, integration method, or the audit trail, of which all were used to create the chromatogram or are associated with its validity. Therefore, the printed chromatograms used in drug manufacturing and testing do not satisfy the predicate rule requirements in 21 CFR Part 211. The electronic records created by the computerized laboratory systems must be maintained under these requirements

20 Data Integrity Assessments Non-Standard Build Standard Build X Date/time stamp controls Network backup Access controls Audit logs not backed up User access not controlled 20

21 Data Integrity Assessments Material Weight 21

22 Data Integrity Assessments ALCOA Attributable EDC System Issue system response is slow at times Cause batch jobs being run cause slow system response Type of batch jobs? Principle Investigator approval of ecrfs How long of a delay? 2-3 hours, sometimes next day What date/time is applied for electronic signature? Answer: When batch is run. Data integrity issue date and time stamp is not the same as when PI entered electronic signature user ID and password. 22

23 Proactively Identify Data Integrity Risks ELISA Data Process Flow ELISA SOftware Company Network LIMS Protocol (.xyz file) Setup Run Sample Analysis.db File archived Secure Network Location Data Flow Data File (.db file) Save.db Data File Secure Network Location.db File backed up Backup Location Export.txt Data File Secure Network Location.txt File backed up Import.txt file to LIMS LIMS Database 23

24 Understand Data Integrity Processes and Controls 24

25 MHRA Guidance Control Measures Access to clocks for recording timed events. Accessibility of records at locations where activities take place so ad hoc data recording and later transcription to official records is not necessary. Free access to blank paper forms for raw/source data recording should be controlled where this is appropriate. Reconciliation may be necessary to prevent recreation of a record. User access rights that prevent (or audit trail) unauthorized data amendments. Automated data capture or printers attached to equipment such as balances. Control of physical parameters (time, space, equipment) that permit performance of tasks and recording of data as required. Access to raw data for staff performing data checking activities. Specify Design Configure Generate Modify Review / Approve Use Retain / Retrieve Destroy Verify 25

26 FDA Guidance Validation of workflows A workflow, such as creation of an electronic master production and control record, is an intended use of a computer system to be checked through validation. If you validate the computer system, but you do not validate it for its intended use, you cannot know if your workflow runs correctly. 26

27 Validation MHRA Guidance Terms and Definitions Comply with EU GMP Annex 11. Requires an understanding of the computerised system's function within a process. The acceptance of vendor-supplied validation data in isolation of system configuration and intended use is not acceptable. In isolation from the intended process, vendor testing is likely to be limited to functional verification only, and may not fulfil the requirements for performance qualification

28 Data Integrity Vendor Supplied Validation Documentation Approval of Records Internal assessment of Stability LIMS Vendor Supplied Documentation Provided User Requirements Specification User Acceptance Test URS Included statement the system has a configurable option for.. electronic signatures. Requested configuration specification none available Reviewed configuration within system esigs turned off Requested system demonstration approval by pressing approve button Reviewed UAT documentation esigs functionality passed First step of test turn on esig functionality Last step of test turn off esig functionality Record integrity issue lack of approved stability protocols

29 Warning Letter Cadila Healthcare (Dec 2015) Your firm failed to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to data. Our inspection team found that the laboratory manager had the ability to delete data from the Karl Fischer Tiamo software. We found that one file had been deleted. However, because the audit trail function for the Karl Fischer Tiamo software was not activated, and because eight different analysts share a single username and password, you were unable to demonstrate who performed each operation on this instrument system. The inspection also found that a file containing the moisture content results for (b) (4) API batch (b)(4) had been deleted. This deletion was not identified and reviewed as part of your batch release decision. 29

30 Warning Letter Cadila Healthcare Duplicate records were in the engineering office. One of your firm s representatives stated that the records were rewritten for clarity. Our review of the original and rewritten records found discrepancies in cleaning dates and cleaning personnel. 30

31 Sekisui Warning Letter November 8,

32 Sekisui Warning Letter November 8,

33 Sekisui Warning Letter November 8,

34 Sekisui Warning Letter November 8,

35 MHRA Guidance Data integrity is fundamental in a pharmaceutical quality system which ensures that medicines are of the required quality. The data governance system should be integral to the pharmaceutical quality system

36 MHRA Guidance Data Governance System Data Lifecycle Policies and procedures Training Initial generation to archival / destruction Risk Degree of effort should be commensurate with data criticality. 36

37 Data Governance Data ownership throughout the lifecycle Control over intentional & unintentional changes Consider Design Operation Monitoring of processes / systems 37

38 Data Lifecycle Specify Design Configure Generate Modify Review / Approve Use Retain / Retrieve Destroy Verify Validation 38

39 Data Integrity throughout the Lifecycle Generate Modify Review / Approve Use Retain / Retrieve Destroy 39

40 Data Integrity throughout the Backup and Restore Lifecycle Bioanalytical Laboratory Backup and Restore SOP Failed backup required a help desk ticket 3 failed backups require notification to Director of Infrastructure Technology 5 failed backups require notification to CTO Requested backup logs for three months No successful backups for June or first two weeks of July No help desk tickets generated for month of June Director and CTO were not notified Director and CTO were not aware of failures Potential Data Integrity Issue 40

41 Incorporate the Data Integrity Program with the Quality System Policies and Procedures Data Integrity Policy Good Documentation Practices Raw Data Definition Operational Procedures Handling of data Roles and Responsibilities Review and approval of data 41

42 Incorporate the Data Integrity Program with the Quality System Policies and Procedures Validation Security and Administration Record Retention Backup and Restore Disaster Recovery Monitoring Data Integrity Program Audits Reviews 42

43 FDA Guidance Terms Audit Trail Who, what, when, why E.g., integration parameters, reprocessing, etc. Attempts to access system, delete or rename files CGMP-compliant record-keeping practices prevent data from being lost or obscured. 43

44 FDA Guidance Audit Trails Generate Modify Review / Approve Use Retain / Retrieve Destroy Audit trails that capture changes to critical data be reviewed with each record and before final approval of the record. FDA recommends routine scheduled audit trail review based on the complexity of the system and its intended use. 44

45 FDA Guidance Audit Trails - Finding Upon review of the audit trail configuration within LIMS, audit trails were turned off for many of the tables within the XXX Module. Documentation was not available to justify why the audit trails for these tables was turned off. For example, The audit trail was not turned on for the XXX table, which is used when jobs, such as stability time pulls, are cancelled or suspended. This was observed by reviewing the audit trail configuration within the system. Audit trail configuration is documented within Design specification, XXX, YYY, version 2.0, approval date 11-Mar

46 Summary What is data integrity and the definition of data? Original and true copy Audit trails and raw data Metadata Data Integrity Observations Data Integrity Program Development Awareness and training Data Integrity Assessments and Remediation Audit Trail Review What to review User account and access Completeness of data 46

47 Questions Chris Wubbolt QACV Consulting, LLC Telephone: