Oos, Oot & Data Integrity
Oos, Oot & Data Integrity
UNEXPECTED RESULTS
Karen Ginsbury
PCI Pharmaceutical Consulting Israel
Lab Week San Diego, Dec 2016
DISCLAIMER
2
Keywords – List…
■ ALCOA+
■ Compliance
■ Notification
■ Trust
■ Patient safety
■ Dollar signs – silly stuff
OOS Keywords
■ OOS ■ Batch release
■ OOT ■ Investigation
■ Questionable / unusual / ■ Laboratory error
atypical result ■ Production error
■ Reportable result ■ Sampling error
■ Retest ■ Data integrity
■ New test ■ Data quality
■ Invalid test ■ Averaging
■ Aborted test ■ Training, qualification, education
■ New test ■ COA
■ Resample ■ Reporting Results
■ Data Integrity
Objective
5
What are the two latest “hotties”
fresh off the press guidance?
6
What are the two latest “hotties”
fresh off the press guidance?
7
Metrics FDA is collecting
Tie in with: OOS, DI and Quality Culture
8
Shaming into compliance?
Or Rewarding the good?
9
Integrity …but I am HONEST
10
How many opportunities for cheating?
…but she is an HONEST person!
■ Karen Ginsbury is a London, UK trained pharmacist with a second degree in Microbiology. With close to 30
years’ experience in the pharmaceutical industry, Karen is a quality practitioner with a passion for doing things
right and once only. She runs a boutique quality systems consultancy offering services to companies who want
to set-up, maintain and constantly improve their quality management systems. Regularly lecturing in Israel and
around the world, Karen also serves on international professional committees and is co-chair of PDA’s
pharmacopoeial interest group. In these and other capacities Karen benchmarks best practices around the
globe in order to share them with her audiences. Double space or single space? Cherry picking???
11
Any resemblance to the previous slide?
12
Before… and After
Truth / Lie
Good/Bad
■ Is not enough
■ We need PREVENTIVE measures and
BARRIERs
■ LONG TERM only FULLY automated
systems will PREVENT data integrity
issues
ל"ה – ל"ו: ויקרא י"טLeviticus 19:35 – 36
Calibrate your decision making process
ׂשּורה
ָ תַ עֲׂשּו עָ וֶ ל בַ ִּמ ְׁשפָ ט בַ ִּמ ָדה בַ ִּמ ְׁש ָקל ּובַ ְׁמ-לה ֹלא
צֶ ֶדק אֵ יפַ ת צֶ ֶדק וְׁ ִּהין צֶ ֶדק יִּ ְׁהיֶה לָכֶ ם-לו מֹאזְׁ נֵי צֶ ֶדק ַאבְׁ נֵי
15
) יד,(יט " ויראת מאלקך,"ולפני עור לא תתן מכשול
16
It can’t be left to chance - Data Governance
■ Policy
■ Educate
■ Communicate
■ Technology and IT
■ Audit and CAPA
18
STRATEGY – DEFINE, EDUCATE, COMMUNICATE
ALCOA+
Accurate Accurate
Legible Complete
Contemporaneous (real Consistent
time)
Original Secure
Attributable
19
OOS / Data Integrity timeline
22
Barr: The outcome
Draft 1998; final 2006
■ FDA OOS Guide
■ OOS SOPs
■ Later…OOT etc.
23
And along came Able…
17/08/2005 –
■ Troubled generic drug manufacturer Able
Laboratories has conceded defeat in its
bid to get products back onto the market
and elected to sell off the assets of the
business
FDA Stops Them Manufacturing
March 2015 MHRA: Data Integrity Definitions and Guidance for Industry 16 pages
Altering time and date stamps
WHO guidance
33
Independent IT personnel as
administrators?
WHO guidance
34
QU evaluate configuration settings
data annotation tools…
WHO guidance
35
Rename, copy, delete local files
on stand alone system?
WHO guidance
36
Q#1 What is an OOS
43
Q#6: What is an Unusual, Questionable, “Atypcial” Result
■ Q#7 Is it a problem?
What is an Unusual, Questionable, “Atypcial” Result
49
STRATEGY – DEFINE, EDUCATE, COMMUNICATE,
COMMUNICATE VERIFY AND CHECK FROM TIME TO TIME
Performed by….
Defined in an SOP
■ To perform the action
■ 100% responsible for the action and all activities
associated with its performance and documenting
its performance (may be electronic documentation)
50
STRATEGY – DEFINE, EDUCATE, COMMUNICATE,
COMMUNICATE VERIFY AND CHECK FROM TIME TO TIME
Verified by…
Defined in an SOP
■ To verify that the action was performed according to
the current, written approved instructions
■ 100% responsible for verifying that the action was
performed correctly including all activities associated
with its performance and the documentation of these
■ MUST BE PRESENT THROUGHOUT AND WITNESS, THE
PERFORMANCE OF THE ACTION AND ITS
DOCUMENTATION before signing as verifier
51
STRATEGY – DEFINE, EDUCATE, COMMUNICATE, VERIFY AND CHECK FROM TIME TO TIME
52
STRATEGY – CULTURE, CLOSING THE DOOR OF OPPORTUNITY
54
PIC/s Guidance
Does have limited mention of PLCs
55
Data Integrity
56
STRATEGY – EDUCATE, COMMUNICATE
57
STRATEGY – EDUCATE, COMMUNICATE
Backdating
■ Our investigators found backdated batch production records
dated February 10 to February 25, 2014, signed by your
Production Manager and Technical Director in the “Batch
Manufacturing Record Reviewed by” section.
■ The Technical Director stated that he was not in the facility on
these dates and was “countersigning” for another person who
allegedly performed these review activities. However, these
records did not contain signatures (contemporaneous or
otherwise) of the alternate reviewer who purportedly
conducted the review.
■ Furthermore, the Technical Director backdated his own
signature to the date the quality unit (QU) reviewed and
released your drug product. You released these batches before
the Technical Director returned to the facility and backdated his
signatures.
58
STRATEGY – EDUCATE, COMMUNICATE
Failure to record activities at the time
they are performed and destruction of
original records
■ Specifically, your employees completed batch production records
entries days after operations had ended, released lots before the
proper approvals, and failed to maintain original manufacturing data
for critical steps in the batch production records. For example, Our
investigators found that some of your operators used “rough notes”
(unbound, uncontrolled loose paper) to capture critical
manufacturing data and then destroyed these original records after
transcription into the batch production records
■ For example, the (b)(4) chemist recorded original manufacturing data
as rough notes and left these rough notes for the (b)(4) chemist to
transcribe into the batch production records. The next morning, the
chemist signed the batch production records and destroyed the
original rough notes. We interviewed employees during the
inspection who confirmed your firm’s practice of transcribing data to
batch records and destroying original records.
59
STRATEGY – EDUCATE, COMMUNICATE
Shared Passwords
■ 6. Your firm failed to establish appropriate controls over computers and related
systems to assure that changes in master production and control records or
other records are instituted only by authorized personnel (21 CFR 211. 68(b))
■ You lacked audit trails or other sufficient controls to facilitate traceability of the
individuals who access each of the programmable logic controller (PLC) levels
or Man-Machine Interface (MMI) equipment. You had no way to verify that
individuals have not changed, adjusted, or modified equipment operation
parameters. Access to production equipment used in parenteral manufacturing
and solid dosage forms used a password shared by four or five individuals to
gain access to each individual piece of equipment and access level.
■ During our inspection, your Executive Production and QA manager confirmed
that the password was shared. During our inspection, firm officials also
confirmed that you had not established or documented a control program to
describe the roles and responsibilities of production equipment system
administrators. There was also no record documenting the individuals who
have access to the production equipment or the manner in which individual
personnel access production equipment.
60
STRATEGY – DEFINE, EDUCATE, COMMUNICATE
Data Integrity:
Paper / hybrid / Electronic
■ Data is precisely recorded. On retrieval, the data is the
same as when originally recorded, complete, consistent,
accurate, attributable throughout the lifecycle (archiving,
retrieval)
■ The accuracy and consistency of stored data, indicated by
an absence of any alteration in data between two updates
of a data record. Data integrity is imposed on a system at
its design stage through standard rules and procedures,
and maintained through error checking and validation
routines.
■ Critical aspect in the design, implementation and usage of
any system which stores, processes or retrieves data
61
STRATEGY – EDUCATE, COMMUNICATE
62
STRATEGY – DEFINE, EDUCATE, COMMUNICATE
MetaData
63
MetaData
64
STRATEGY – DEFINE, EDUCATE, COMMUNICATE
65
STRATEGY – DEFINE, EDUCATE, COMMUNICATE
Original record vs True copy
■ Raw data generated by electronic means may be retained
in a paper or pdf format. The data retention process must
be shown to include verified copies of all raw data,
metadata, relevant audit trail and result files, software /
system configuration settings specific to each analytical
run*, and all data processing runs (including methods and
audit trails) necessary for reconstruction of a given raw
data set. It would also require a documented means to
verify that the printed records were an accurate
representation. This approach is likely to be onerous in its
administration to enable a GMP compliant record.
■ * computerised system configuration settings should be
defined, tested and ‘locked’ as part of computer system
validation. Only those variable settings which relate to an
analytical run would be considered as electronic raw data.
Some risks
■ Paper based: missing signatures, details
■ Excel spreadsheets
■ Stand alone software
■ Log on / log off
■ Printouts vs unintegrated data
68
STRATEGY - CONTROL
Risk Mitigation
Or one step?
69
STRATEGY – CULTURE – EDUCATE UP – RESPONSIBLE
MANAGEMENT – PROVIDE TOOLS (NO WRITING ROOM)
70
STRATEGY – PLAN, DEFINE, IMPLEMENT, MAINTAIN, AUDIT
71
STRATEGY – SEGREGATE DUTIES
TO MAXIMIZE OBJECTIVITY
Minimize threats to DI by:
• Segregation of Duties (SOD)
• Configuration of systems
• Backing up data regularly
• Controlling access to data via security mechanisms
• Designing user interfaces that prevent the input of invalid data
• Using error detection and correction software when transmitting
data
• Audit trail Review
Segregation of duties
Roles and Responsibilities allowing a conflict of interest that
would allowalteration of data.
For example, the QC Lab Manager acting as system
administrator for Empower would violate segregation of duties 72
Data Governance Policy
■ Values:
The Officers of this company expect every employee
to provide accurate, complete and contemporaneous
(real-time) records of activities and to perform all
tasks with integrity especially when no one is looking
■ Tools:
Managers are expected to provide staff with the means
to allow them to perform their tasks with integrity, to
collect, analyze and report data accurately, completely
and on real-time including but not limited to:
73
Data Governance
74
Data Integrity Code of Conduct
75
Warning letters
a. The inspection documented that HPLC processing methods (including
integration parameters) and re-integrations are executed without a pre-defined,
scientifically valid procedure. Your analytical methods are not locked to ensure
that the same integration parameters are used on each analysis. A QC operator
interviewed during the inspection stated that integrations are performed and re-
performed until the chromatographic peaks are “good”, but was unable to provide
an explanation for the manner in which integration is performed. Moreover, your
firm does not have a procedure for the saving of processing methods used for
integration.
76
Warning letters
• the use of the Excel® spreadsheets in analytical calculations are neither controlled nor
protected from modifications or deletion. The investigator noticed that the calculation
for residual solvent uses an Excel spreadsheet that has not been qualified. We are
concerned about the data generated by your QC laboratory from non-qualified and
uncontrolled Excel spreadsheets.
77
Computerized Spreadsheets
78
STRATEGY – PDCA
■ Traceability
■ Transparency – document, date and sign with
reason for ANY amendment recorded
81
Links to guides
■ EMA Data Integrity Guidance Q&A
http://www.ema.europa.eu/ema/index.jsp?curl=pages/regulation/q_and_a/q
_and_a_detail_000027.jsp#section17
■ PIC/s Data Integrity Guidance
https://www.picscheme.org/useruploads/documents/PI_041_1_Draft_2_Gui
dance_on_Data_Integrity_2.pdf
■ MHRA: GxP Data Integrity Definitions and Guidance
https://www.gov.uk/government/uploads/system/uploads/attachment_data/f
ile/538871/MHRA_GxP_data_integrity_consultation.pdf
■ WHO: guidance on good data and record keeping
http://www.who.int/medicines/areas/quality_safety/quality_assurance/Guida
nce-on-good-data-management-practices_QAS15-624_16092015.pdf
■ FDA Data Integrity and Compliance with cGMP
http://www.fda.gov/downloads/drugs/guidancecomplianceregulatoryinforma
tion/guidances/ucm495891.pdf
■ MHRA: GMP Data Integrity Definitions and Guidance
https://www.gov.uk/government/uploads/system/uploads/attachment_data/f
ile/412735/Data_integrity_definitions_and_guidance_v2.pdf
82
THANK YOU FOR PARTICIPATING
?
Questions ? ?
Find me
[email protected]
83