risk based ebrs implementation using gamp® 5 · of data from production ... etif argentina –...

ETIF Argentina – Risk-based EBRS Implementation using GAMP® 51 G. Rossi

CTP SYSTEMINTEGRATED COMPETENCES

Risk Based EBRS Implementation using GAMP® 5

Gilberto Rossi



Risk management - why do we need it?

…and mismanaging risk

Taking risk… managing risk

http://bp0.blogger.com/_taPC-1l2iog/R9Q_Vys3O5I/AAAAAAAAaBg/Jpz440rRWpU/s1600-h/10.jpg



Risk-based EBRS Implementation using GAMP® 5

Based on ICH Q9 and GAMP® 5 Key Concepts

Business model and URS based on production process with interfaces to SAP, LIMS & Trackwise

Electronic Batch Record for manufacturing and packaging

Scientific risk assessment using HACCP method

Risk mitigation for GMP and the business

Review by exception and electronic signatures



1. Product & Process Knowledge

2. Integrated Life Cycle Approach in a QMS Environment

3. Flexible & Scalable Life Cycle Activities

4. Quality Risk Management

5. Massimize Supplier Involvment & partecipation

5 Key Concept



ICH Q9 – EU GMP Annex 20

Risk management tools are chosen according to the needs of the project:FMEA - FTA - HACCP -

HAZOP

We chose the HACCP tool to build on product and

process understanding and support identification of

critical control points



EBRS Project Life Cycle Overview (GAMP®5 )

Business Process

GMP Requirements

Company QMS

Requirements (URS)

Specification, Design &

Configuration

Verification(IQ & OQ)

Acceptance & Release

Operation & Continuous

Improvement

Risk Management

Design Reviews

Change Management

Good Practice



System Life Cycle Phases



EBRS Project – General Overview

New electronic system, integrated with SAP and LIMSNew electronic system, integrated with SAP and LIMS

Replacement of current paper based systemReplacement of current paper based system

Intended to improve Intended to improve –– ProcessProcess’’ Performances & Compliance–– Batch Review Process, Batch Review Process, with Review By Exception– Management & Storage of Data from productionof Data from production

Includes both Includes both Manufacturing Manufacturing and and PackagingPackaging

Single site Single site –– Approx 10.000 batches per year, Approx 10.000 batches per year, –– Approx 10 bulk formulations, Approx 10 bulk formulations, –– Approx 1000 packaging presentationsApprox 1000 packaging presentations



EBR used for Manufacturing and Packaging: Key Point

Electronic Master Batch Records Electronic Master Batch Records (EMBR / MBR)(EMBR / MBR)

Electronic Batch Records Electronic Batch Records (EBR / ER) ((EBR / ER) (

Dispensing, Production and packagingDispensing, Production and packaging

Material Tracking Material Tracking (ER)(ER)

Shop floor control and equipment managementShop floor control and equipment management

Deviations, Exceptions and Event Management Deviations, Exceptions and Event Management (ER)(ER)

Electronic Signatures Electronic Signatures (ES)(ES)

Review By Exception Review By Exception (RBE)(RBE)

Key Performance IndicatorsKey Performance Indicators



Example of Business

Flow (& indication of Potential CCP)



Interface SAP / EBRS



Scientific Risk Assessment - HACCP

1.1. Conduct Hazard analysis for each step of the processConduct Hazard analysis for each step of the process

2.2. Determine critical control points (CCP)Determine critical control points (CCP)

3.3. Establish target levels and critical limitsEstablish target levels and critical limits

4.4. Establish a monitoring system for each CCPEstablish a monitoring system for each CCP

5.5. Establish corrective actions when monitoring shows Establish corrective actions when monitoring shows that CCP is out of controlthat CCP is out of control

6.6. Establish verification procedures or methodsEstablish verification procedures or methods

7.7. Establish a recordEstablish a record--keeping systemkeeping system



1. Hazard Analysis

List hazards at each step of List hazards at each step of business flowbusiness flow

–– Description of hazard Description of hazard (what could go wrong?)(what could go wrong?)

–– Cause of hazard Cause of hazard (What caused the problem?)(What caused the problem?)

Reference hazards to Reference hazards to –– Business flow diagrams with Subject Business flow diagrams with Subject

Matter Experts from Production, QA, ITMatter Experts from Production, QA, IT–– URS and intended use of EBRSURS and intended use of EBRS–– GMP regulations from EU, FDA, Part 11GMP regulations from EU, FDA, Part 11



1. Intrinsic risk of hazards

Low: ACCEPTABLELow: ACCEPTABLE within the context of the project - managed according with procedures

Medium: UNACCEPTABLEMedium: UNACCEPTABLE CORRECTIVE ACTION REQUIRED - reduce risk according to identified control points

High: COMPLETELY UNACCEPTABLEHigh: COMPLETELY UNACCEPTABLE RISK MUST BE ELIMINATED using at least two independent control mechanisms

Minor Moderate Major

High M H H

Medium L M H

Low L L M

Negligible L L L

Severity

Prob

abili

ty



1. Examples of hazard analysis

Hazard Severit y

Probability Risk Measure

Major network failure leads to unavailability of system and production stops

Major Medium H Continious network management.

Product recipes, MBR and other industrial secrets are compromised

Major Low M System must be closed.

Business Hazards

Hazard Severity Probability Risk Measure

Contamination of product from damaged containers Major Low M

System must be designed to require that damage to containers of materials is followed up by production supervisor and the results of the investigation recorded

Calculated IPC results are outside the defined range in the processing or packaging instructions but no alarm is generated or recorded

Major Medium H

System must be designed to compare the calculated value of the IPC with the predefined limits, and produce an alarm if there is a discrepancy. System must force an authorising signature from a responsible person in Production if the IPC is outside the acceptable range

GMP Hazards



2. Determine critical control points (CCP)

Controls to prevent or eliminate a pharmaceutical quality Controls to prevent or eliminate a pharmaceutical quality hazard or reduce it to an acceptable levelhazard or reduce it to an acceptable level

Only for High and Medium risk hazardsOnly for High and Medium risk hazards

No CCP for Low risk hazardsNo CCP for Low risk hazards

Controls classified as Controls classified as –– Critical Control Points (CCP)Critical Control Points (CCP)–– Good Practice (reference to procedure to be followed)Good Practice (reference to procedure to be followed)



3. Examples of CCP & Critical Limits

Cause CCP Critical Limit

Inadequate network planning, management or configuration

Ensure adequacy of network design with redundancy and built-in failsafe operational modes. Ensure rigorous system testing and validation of critical network functions and controls

Network manager with defined job responsibilities with problem escalation process for the business

Unauthorized persons have access to EBR functions

Only authorized persons within the organization have access to critical functions

Security compared to access control list defined by system owners

GMP Risk

Business Risk

Cause CCP Critical Limit

Damaged containers not detected and investigated

Software must force supervisor to document and explain damage to product containers if recorded by operator, on receipt into manufacturing

As defined in SOP for the process; check container status

Out of SPEC - IPC NOT DETECTED

System must generate a warning message when calculated IPC result is equal to or more than the quality limit

Calculated value compared to upper and lower quality limits from MBR

GMP Risk



4. Monitoring system for each CCP

Measurement of CCP against critical limitsMeasurement of CCP against critical limits

Types of monitoring:Types of monitoring:–– operator entries compared to limits operator entries compared to limits ALARMALARM–– input value read from a input value read from a

barcode compared to Expected value barcode compared to Expected value ALARMALARM

Results of monitoring recorded and included in batch Results of monitoring recorded and included in batch recordrecord

Alarms are managed as deviationsAlarms are managed as deviations



5. Corrective actions in case of deviations

Determination and correction of the cause of nonDetermination and correction of the cause of non--compliancecompliance

Determination of the disposition of the nonDetermination of the disposition of the non--compliant productcompliant product

Recording of the corrective actions that have been Recording of the corrective actions that have been takentaken



6. Verification procedures

Monitoring of CCP in software development life cycleMonitoring of CCP in software development life cycle

–– traceability to FS done by Suppliertraceability to FS done by Supplier

–– document results in IQ document results in IQ

–– verify in OQverify in OQ

–– verify in PQ, including interfacesverify in PQ, including interfaces

Residual control, not included in system of system scope Residual control, not included in system of system scope will be monitored and managed under SOP will be monitored and managed under SOP



7. Documentation and record keeping

DeviationsDeviations

Corrective actionsCorrective actions

CCP monitoring activity logCCP monitoring activity log

Changes to process stepsChanges to process steps

Changes to associated hazardsChanges to associated hazards

Changes to critical limitsChanges to critical limits

Verification procedures and schedulesVerification procedures and schedules



Benefits of HACCP Method

Close integration with known business process flowsClose integration with known business process flows

Focus on hazards that lead to riskFocus on hazards that lead to risk

Feed back to URS and system developmentFeed back to URS and system development

Prioritize risks in a systematic mannerPrioritize risks in a systematic manner

Reduced validation activityReduced validation activity

Clear Evidence so, Strong acceptance from managementClear Evidence so, Strong acceptance from management



Residual risk

After completion of HACCP, assess the residual After completion of HACCP, assess the residual risk from each hazardrisk from each hazard‒‒

The CCP must have been implemented as indicatedThe CCP must have been implemented as indicated

‒‒

Monitoring of the CCP must have been implementedMonitoring of the CCP must have been implemented‒‒

Corrective actions must have been implementedCorrective actions must have been implemented

‒‒

Verification of the above 3 conditions must have been done for Verification of the above 3 conditions must have been done for each CCPeach CCP

‒‒

Records must be keptRecords must be kept

Examples Examples residual risk, mitigated via SOP‒

MBR does not match the registration dossier

‒

Data not protected by backing-up at regular intervals at a separate and secure location



Review by Exception (RBE)

Electronic system allows filtering toElectronic system allows filtering to

–– IncludeInclude critical exceptions and deviations to the processcritical exceptions and deviations to the process

–– ExcludeExclude normal operational datanormal operational data

Verification of RBE functionality is directly linked to Verification of RBE functionality is directly linked to scientific risk assessment as part of system designscientific risk assessment as part of system design

Regulatory guidelines allow QA review of Regulatory guidelines allow QA review of exception reportsexception reports for batch recordsfor batch records



Regulatory Expectations for Review by Exception (RBE)

FunctionalityFunctionality is clearly defined in is clearly defined in RRequirements and equirements and specification documentsspecification documents

Reference data is retainedReference data is retained for the appropriate periodfor the appropriate period

The computerized means of review is at least as The computerized means of review is at least as comprehensive and accurate as comprehensive and accurate as thethe manual reviewmanual review

AAccuracy and reliability is demonstrated ccuracy and reliability is demonstrated through through QQualificationualification and Vand Validationalidation



Benefits of Review by Exception (RBE)

Production resources and QA are focused on issue Production resources and QA are focused on issue resolution and investigationresolution and investigation

Time consuming verification of complete batch Time consuming verification of complete batch record is not needed, as critical control points are record is not needed, as critical control points are monitored and controlled by validated systemsmonitored and controlled by validated systems



Tineke Bos

Philp Rees +[39] 348 5479178 –[email protected]

Gilberto Rossi

+[39] 348 7216946 – [email protected]

mailto:[email protected]

mailto:[email protected]

risk based ebrs implementation using gamp® 5 · of data from production ... etif argentina –...

Documents