1. THE FUNDAMENTALS OF QUALITY ASSURANCE AND VALIDATION

2. IMPLEMENTATION OF VALIDATION3. HOW VALIDATION GETS DONE4. THE VALIDATION MASTER PLAN5. REVALIDATION AND CHANGE CONTROL6. AUDITS

7. PROCESS VALIDATION8. VALIDATION OF PACKAGING9. RECEIPT, HANDLING AND USE OF

MATERIALS10. QUALITY ASSURANCE INVESTIGATIONS11. DOCUMENTATION RESPONSIBILITIES

OF QUALITY ASSURANCE

12. RECALL PROCEDURE13. ELECTRONIC RECORDS14. CORRECTIVE AND PREVENTIVE

ACTIONS

A central concept is that quality cannot be tested for!

◦ Testing programs are based on testing a statistically significant number of samples

However to be absolutely sure that all of your product meets specifications you would have to test everything.

◦ Testing by itself will not insure quality and is inefficient

◦ Testing is required under the GMP’s Raw materials In-process samples Final Product

◦ Quality (identity, safety, efficacy, potency, purity, stability, consistency) must be designed into the production process

◦ Begins with predetermined specifications Raw material specifications In-process material specifications Final Product Specifications

Validation – An Essential Part of GMPs!

Validation is the scientific study of a system To prove that the facility/system/equipment/method is

consistently doing what it is supposed to do (i.e., that the process is under control).

◦ We want to make decisions based on good science and not hunches and assumptions!

To determine the process variables and acceptable limits for these variables, and to set-up appropriate in-process controls.

◦ Is it ok if the wash from a chromatography column is pH 6.8 vs. 7.0 ?

Biomanufacturing is a complex process involving multiple unit operations many of which are critical to insuring patient safety

and product efficacy

InoculumSeed

FermentationProduction

FermentationHarvest

Ultrafiltration1

Chrom. 11

Ultrafiltration2

Chrom. 2

Viral Filtration

Chrom.3

Ultrafiltration3

Final Formulation/

Sterile Filtration

Sterile Fill

UPSTREAM

DOWN-STREAM

VIRAL

NON-VIRAL

Block Flow Diagram of a typical Production Process

A central concept in quality is that quality cannot be tested for. Quality must be designed and built into the production process.

Requires careful attention to raw material specifications, in process material specifications, and final product specifications.

The FDA’s definition of validation:

“Validation is a process of demonstrating, through documented evidence, that a process, procedure, method, piece of equipment, or facility will consistently produce a product or result that meets predetermined specifications and quality attributes.”

Identity

◦ 21 CFR 211.84 (d) at least one test shall be conducted to verify the identity of each component of a drug product.

◦ Chemical, biological, immunological◦ Raw materials, in-process intermediates, final products.

Safety◦ 21 CFR 600.3 (p) safety as the relative freedom from harmful effect to persons affected, directly

or indirectly, by a product when prudently administered, taking into consideration the character of the product in relationship to the condition of the recipient at the time. Activity of active ingredients Activity of the excipients or additives Activity of process related impurities

Efficacy◦ Effectiveness of the product in achieving its medicinal purpose (therapeutic, prophylactic,

diagnostic). Gathered at Phase II and Phase III trials. Potency

◦ 21 CFR 600.3 (s) specific ability or capacity of the product, as indicated by its appropriate laboratory tests or by adequately controlled clinical data obtained through the administration of the product in the manner indicated to effect the given result.

Purity◦ 21 CFR 600.3 (r) relative freedom from extraneous matters in the finished product, whether or

not harmful to the recipient or deleterious to the product. Cleaning Procedures

Stability◦ 21 CFR 211.137 (a) to assure that a drug product meets applicable standards of identity, quality,

and purity at the time of use; it shall bear an expiration date determined by stability testing. Drugs may use accelerated time studies, biologics must use real time studies.

Consistency◦ The ability of the product and/or process to reliably possess specified quality attributes on an

ongoing basis. 3 consecutive batches of product meeting predetermined specifications is accepted as proof that a process is consistent. However, in NDA data from up to twenty batches may be submitted.

Validating the performance of unit operations, analytical methods, and critical process points (sterilization, viral inactivation, cleaning procedures) is essential in ensuring that the process generates a quality product.

Assumptions concerning virus inactivation resulted in ten deaths and 200 children becoming paralyzed, from a supposedly “inactivated” polio vaccine.

Assumptions about sterilization caused severe infections among burn victims given supposedly sterile solutions.

Validation eliminates assumptions and relies on experimental proof!

Validation does not replace testing, but it does reduce the testing burden for raw materials, in-process materials, and final product

Validation itself is a process that evolves with the product.

Validation requirements for production of pre-clinical material much less stringent then for phase III clinical material.

Critical operations: raw materials, analytical methods, viral clearance, sterilization, cleaning.

Some operations are more critical than others. ◦ Viral filtration, sterilization, cleaning, analytical

methods.

◦ These operations will require greater validation efforts then less critical operations (media blending).

How critical is the system being validated to final product quality?

◦ Media blending systems for cell growth vs. final fill & finish operations

Demonstrating that the device which fills, labels, and caps the final product will require more extensive validation then the blenders used to prepare media for bioreactors.

Validation of complex devices can take years!

Proceeds in stages with new facilities / equipment.

Planning for validation should start with the design process.

Leaving validation to the last minute is asking for trouble.

Starts with Design & Receipt:◦ Does the equipment meet the needs (is the autoclave big

enough?)◦ Do you have the manuals, spare parts, can you plug it in? ◦ Is it installed properly (drain lines, vents, etc)

Does it work? ◦ Does the autoclave reach the necessary temp. and

pressure? ◦ Can the autoclave sterilize your equipment (worse case

situation)? How does it work in the manufacturing process?

◦ Can it handle production quantities? ◦ Will failure compromise product quality?

What parameters are critical to sterilization?

◦ Temperatures, pressures, time, pore size (filtration), radiation dosage, chemical concentration.

Must demonstrate that your autoclave reaches the temperatures, pressures, and times necessary for sterilization.

Must demonstrate that items representing real world samples achieve those conditions (20 ft of 1 ½ hose; a 20 L carboy; a 500 ml bottle).

Must challenge with worse case scenario (may take place in pilot plant if scalability demonstrated).

21 CFR 211 Subpart F –Production and Process Controls 211.100 –Written procedures; deviations (a) Requires written procedures for production and process control designed to assure that products

possess the quality attributes that they purport or are represented to possess. (b) Requires that any deviations from written production and process control procedures be

recorded and justified. 211.101 – Change in of components 211.103 – Calculation of yield 211.105 – Equipment identification 211.110 – Sampling and testing of in-process materials and drug products “Requires that control procedures be established to monitor the output and validate the

performance of those manufacturing processes that may be responsible for causing variability of in process material and drug product.”

211.111 – Time limit on production 211.113 – Control of microbiological contamination “Requires that sterilization processes be validated” 211.115 – Reprocessing21 CFR 211 Subpart H- Holding and Distribution 211.165 – Testing and release for distribution “Requires that the accuracy, sensitivity, specificity, and reproducibility of test methods employed

by the firm shall be established and documented. Such validation and documentation may be accomplished in accordance with 21 CFR 211.194 (a)(2)”

21 CFR 211 Subpart I- Laboratory Controls21 CFR 211 Subpart J – Record and Reports21 CFR 820 Quality Systems Regulations

Sec. 211.113 Control of microbiological contamination.

(a) Appropriate written procedures, designed to prevent objectionable microorganisms in drug products not required to be sterile, shall be established and followed.

(b) Appropriate written procedures, designed to prevent microbiological contamination of drug products purporting to be sterile, shall be established and followed. Such procedures shall include validation of any sterilization process.

A fully validated process is “locked in” Any change outside of the validated space

invalidates process

Change must be evaluated for effect on patient safety and product efficacy

Validated Production Process

Δ

Monitor

Monitor

Revalidate

ValidateOr

Revalidate

Specific protocols (SOP’s) that provide detailed information on what is to be validated.

Validation Protocols consist of: ◦ A description of the process, equipment, or

method to be validated.◦ A description of the validation method.◦ A description of the sampling procedure

including the kind and number of samples.◦ Acceptance criteria for test results. ◦ Schedule or criteria for revalidation.

Validation Protocols may consist of multiple SOP’s each describing specific steps in the validation process

Starts with Design & Receipt:◦ Does the equipment meet the needs (is the autoclave big

enough?)◦ Do you have the manuals, spare parts, can you plug it in? ◦ Is it installed properly (drain lines, vents, etc)

Does it work? ◦ Does the autoclave reach the necessary temp. and

pressure? ◦ Can the autoclave sterilize your equipment (worse case

situation)? How does it work in the manufacturing process?

◦ Can it handle production quantities? ◦ Will failure compromise product quality?

Installation Qualification (IQ)A process used to document that the piece of equipment was supplied and installed properly and that appropriate utilities, i.e., electrical, steam, gas, etc. are available to operate the equipment according to the manufacturers specifications.

Operational Qualification (OQ)A process designed to supply the documented evidence that a piece of equipment operates as it is intended through all anticipated operational ranges.

Performance (Process) Qualification (PQ)Verifies that a process / piece of equipment performs as it is intended to in the manufacturing process and produces product (in process or final) meeting predetermined specifications.

Example of a protocol for the IQ component of validating apH meter

As with all other SOP’s this document will contain an Objective, Scope, and ResponsibilitySection.

Name and description of equipment, including model numbers

Identification, including model and serial numbers Location of the equipment Any utility requirements, i.e. electrical voltage,

steam or water pressure, etc. Any safety features of the equipment, including

alarms, interlocks, or relief valves. That all documentation, including manufacturers

contact information, spare parts inventory, operational manual, and installation drawings are available on site.

Example of a protocol for the OQ component of validating apH meter

As with all other SOP’s this document will contain an Objective, Scope, and ResponsibilitySection.

O

Example of a protocol for the OQ component of validating anautoclave

As with all other SOP’s this document will contain an Objective, scope, and responsibilitySection.

Objective Responsibility Equipment required (Calibration verification

& Traceability) SOP(s) used Equipment Identification Parameters measured (Specifications) Documentation

Ideally validation takes place prior to actual production runs, however in some cases validation may take place as product is produced, or past production runs may be used to provide validation data.

Prospective Validation

Concurrent Validation

Retrospective Validation

IQ

OQ

Calibration

PQ protocol approval

PQ protocol execution

Data Analysis

Validation Report

Approve Conclusions

Are systems

qualified?

NoCalibrations Correct ?

Data Analysis

Qualify systemCalibrate system

No

Yes

Yes

Approval

UserRequirementsSpecification

(URS)

FunctionalSpecification

Detail Design

Implement/Build

InstallationQualification

OperationalQualification

PerformanceQualification

Related to

Related to

Related to

37

Project PlanAgreed by team membersDetails phases, activities, and milestones Gantt Chart most commonly used

ID Task Name Start Finish DurationJan 2003

1/12 1/19

1 15d1/31/031/13/03Design

5 5d3/28/033/24/03Obtain Funding

6 15d4/18/033/31/03Construct

7 10d5/2/034/21/03Commission

10d6/5/035/23/03Validate

2 10d2/14/032/3/03Prepare Quality Plan

3 5d2/21/032/17/03Prepare URS

4 20d3/21/032/24/03Prepare Project JustificationDocument

Feb 2003 Mar 2003 Apr 2003 May 2003

1/26 2/2 2/9 2/16 2/23 3/2 3/9 3/16 3/23 3/30 4/6 4/13 4/20 4/27 5/4 5/11

9

8

1d6/6/036/6/03Turnover - Project Complete

Putting it all together

39

GoodEngineering

Practice

TheCompliance

Pyramid

Organizations must define an approach towards validation

◦ What is to be validated ◦ How is it to be validated◦ Who is to validate it ◦ Who is to approve the validation◦ When it must be revalidated

Regulatory agencies (FDA, EMEA, WHO, etc) identify minimum components of validation.

“Industry standards” (the c in cGMP) can increase validation requirements.

New & Novel processes / equipment require greater scrutiny then established processes / equipment.

Validation requirements increase as a product moves through development (phase I, phase II, phase III).

The Validation Master Plan

◦ A high level document that outlines the organizations philosophical approach to validation and revalidation. The validation master plan becomes a guideline by which individual validation protocols are developed and implemented.

◦ May contain a flow chart or other diagram of the validation process

Is the initial validation for a piece of equipment the end? ◦ No! ◦ Periodic revalidation may be necessary

depending on the criticality of the equipment◦ Changes need to be evaluated for their impact

on validation◦ Deviations from specifications may require

revalidation◦ Revalidation should be spelled out in Validation

Master Plan

Changes that require revalidation

Software changes; Controllers Site changes; Operational changes Change of source of material Change in the process Significant equipment change Production area changes Support system changes

Must assess impact of changes on FDA compliance and validation state.

Change control is a formal process defined in company SOP on how process/equipment changes are evaluated.

Any change that takes place outside the change control process can jeopardize product quality (patient safety).

VMP should contain change control statement

Policy and procedure

Risk assessment

Authorization

Failure to properly document changes to the

system means invalidation of the process

I. IntroductionII. What is an Audit?

III. What is an Internal Audit?IV. What is an External Audit?V. The Quality Systems ApproachVI. Example of a Quality AuditVII. Medical Device RegulationsVIII.Detecting Potential ProblemsIX. The Audit Program

QUARANTINE

APPROVEDEXPERIMENTAL

REJECTED

COLOR CODING FOR QUARANTINE SYSTEM

CHAPTER THIRTEEN

Purpose

To understand the requirements that apply to records that are created, maintained, archived, retrieved or transmitted in electronic form.

21CFR – Part 11Electronic Records; Electronic Signatures

Electronic Record Inspection

Record-keeping requirements Relevant procedures System security System validation DeficienciesCorrective actionsTechnical personnel training

Trustworthy Reliable Generally paper equivalent Legally binding

21CFR 11.1

Digital Signature (21CFR 11.3(b)(5))- an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified.

Electronic Record (21CFR 11.3(b)(6))- any combination of text, graphics, data, audio, pictorial, or other information representation in digital form that is created, modified, maintained, archived, retrieved, or distributed by a computer system.

Electronic Signature (21CFR 11.3(b)(7))- a computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature.

Handwritten Signature (21CFR 11.3(b)(8))- the scripted name or legal mark of an individual handwritten by that individual and executed or adopted with the present intention to authenticate a writing in a permanent form. The act of signing with a writing or marking instrument such as a pen or stylus is preserved. The scripted name or legal mark, while conventionally applied to paper, may also be applied to other devices that capture the name or mark

Meta Data- Data about data- Gives factual information based on the raw data

Biometrics- Means of identifying individuals based on measurement of the individual’s physical features. Those physical features must be unique to that individual and they must be measurable.

Hybrid Systems - Semi-automated systems using both

electronic and paper-based records Most batch records

Laboratory data, e.g. from chromatography

Legacy System - A system in use and already compliant

with existing standards or regulations prior to the advent of new standards or regulations.

Records and Documents - Protection - Controls - Archiving Access Control - Limited access - Authority checks - ID & Password loss - Breach prevention practices Audit trails - Secure time and date stamp - Technical requirements

System Performance - Operation and use checks - Location check - Device check Electronic Signature - Unique - Linked to records - Actions Training Change Controls &

Procedures Computer Validation Written policies FDA inspection-ready

Closed System RequirementsAccess is controlled by the person responsible for the content of the record

21CFR 11.10

Open System RequirementsAccess is not controlled by the person responsible for the record’s content

21CFR 11.30

Maintained in electronic format in place of paper format

Maintained in electronic format in addition to paper format and relied upon to perform regulatory activities

Submitted to the FDA in electronic format Affecting electronic signatures intended to

be the equivalent of handwritten signatures

Provide measures to assure: - Distinct identification components - Limited access by authorized persons - Genuine owner use - Detection of unauthorized use - Prompt reporting of use - Breach controls

Provide controls: - Distribution - Revision - Access - Use

NetworkSystem

PC

PC

PCExternal

PC

Procedures to ensure accurate retrieval throughout retention:

- Limited access - Secure data - Printable data - Archived audit trail - Meta data storage - Preferred XML file format - Data migration plan

Batch records Maintenance records Laboratory records Training Procedures Financial Legal Other predicate rule documents

•Use the same retention times as used for

hardcopy documents.•Test the system

periodically.

Identification Password Individual accountability and responsibility

Biometrics - Thumb scan - Retina scan - Voice recognition Without biometrics - ID Code - Password

Confirms log-in authorization for the transaction

21CFR 11.10(g)

Data File orSystem Access

Authority C

heckAuthority Check

Provide periodic checks, recalls and revisions Unique Lock out Time out ID and password inactivation Prevent alterations Unauthorized use detection and reporting Breach reporting and investigation Audit trail continuity

Security: unique to one identified individual Legally binding equivalent of hand-written

signature FDA certification of electronic signature

21CFR 11.100

Limited Access Authorized Individuals Qualified Persons Security Individual Accountability Consequences of Violation

Management

Design Controls Production &Process Controls

Corrective & Preventive Actions

MaterialControls

Equipment &Facility ControlsRecords,

Documents, &Change Controls

Controls

Corrective Action

Action taken to eliminate the causesof an existing non-conformity, defect

or other undesirable situation inorder to prevent recurrence.

[ISO 8402]

“Correction” refers to repair, rework, or adjustment and relates to the

disposition of an existing non-conformity

“Corrective action” relates to the elimination of the causes of non-conformity [ISO 8402]

• Correction: Devices returned because of out-of-box failures are repaired and put back into inventory• Corrective action: Defective components damaged by ESD

(electrostatic discharge) during assembly caused out-of-box failures. ESD controls instituted; operators are

trained in ESD controls

Action taken to eliminate the cause of a potential non-conformity, defect, or other undesirable situation in order to prevent occurrence [ISO 8402]

SPC (Statistical Process Control) charts indicate process is drifting toward upper limit for diameter of injection molded part. Investigation determines cause of drift is wear to mold. Replace mold, and verify/validate that process yields parts meeting specifications.

Correct (“correction”) nonconforming product and other quality problems

Prevent recurrence (“corrective action”) of nonconforming product and other quality problems

Eliminate the cause of potential (“preventive action”) nonconforming product and other quality problems

1. ID existing problems (Corrective Actions) – Quality data sources are identified– Data from sources are analyzed

2. ID potential problems (PreventiveActions)– Quality data sources are identified– Data from sources are analyzed

3. Data challenge– Complete– Accurate– Timely

4. Statistical and non-statistical techniques– Detect recurring quality problems– Results of analyses

» compared across different data sources

» identify and develop extent of problems

5. Appropriate action taken6. Actions

– Were effective– Were verified or validated– Do not adversely affect the finished device, pharmaceutical or biologic

7. Actions– Implemented– Documented

8. Information dissemination– Individuals directly responsible for

» assuring product quality» prevention of quality problems

– Management review