Questions to ask when contemplating data integrity

Here are a set of questions that should be evaluated in any data integrity risk assessment/evaluation.

Do you have a list of all GxP activities performed in your organization?
Do you know which GxP activities involve intensive data handling tasks?
Do you know the automation status of each GxP activity?
Have you identified a list of GxP records that will be created by each GxP activity?
Have you determined the format in which the official GxP records will be maintained?
Have you determined if a signature is required for each GxP record?
Do you have controls to ensure that observed, measured or processed GxP data is accurate?
Do you have controls to ensure that GxP data is maintained in full without being omitted, discarded or deleted?
Do you have controls to ensure that naming, measurement units, and value limits are defined and applied consistently during GxP data handling?
Do you have controls to ensure that GxP data is recorded at the same time as the observation/measurement is made or shortly thereafter?
Do you have controls to ensure that GxP data is recorded in a clear and human readable form?
Do you have controls to ensure that data values represent the first recording of the GxP data or an exact copy of an original data?
Do you have SOP(s) addressing management of GxP documents and records and good documentation practices?
Do you have SOP(s) addressing the escalation of quality events that also cover data integrity breaches?
Do you have SOP(s) addressing self-inspections/audits with provisions for data integrity?
Do you have SOP(s) addressing management of third parties with provisions for the protection of data integrity?
Do you have SOP(s) for Computerized Systems Compliance?
Do you have SOP(s) for training and does it include training on data integrity for employees handling GxP data?
For GxP activities that generate data essential for product quality, product supply or patient safety, do you have controls to prevent or minimize:
- Process execution errors due to human inability, negligence or inadequate procedures?
- Non-compliance due to unethical practices such as falsification?
Do you have controls to ensure that only authorized employees are granted access to GxP data based on the requirements of their job role?
Do you have controls to ensure that only the GxP activity owner or delegate can grant access to the GxP data?
Do you have controls to eliminate or reduce audiovisual distractions for GxP activities with intensive data handling tasks?
Do you assess the design and configuration of your computerized GxP activity to minimize manual interventions where possible?
Do you have controls for review of audit trail data at relevant points in the process to support important GxP actions or decisions?
Do you have controls, supervision or decision support aids to help employees who perform error-prone data handling activities?
Do you have controls to ensure business continuity if a GxP record essential for product quality, product supply, or patient safety is not available? Both for when there is a temporary interruption to GxP activity or during a disaster scenario?
Do you have a process for ensuring that data integrity requirements are included in the design and configuration of GxP facilities where data handling activities take place?
Have you assessed the compliance status of computerized systems used to automate GxP activities?
Do you have controls to prevent data capture and data handling errors during GxP data creation?
Do you have controls to ensure the accuracy of date and time applied to GxP data, records and documents?
Do you have controls to ensure that changes to GxP data are traceable to who did what, when and if relevant why during the lifecycle of the GxP data?
Do you have controls to ensure that – when required – legally binding signatures can be applied to GxP records and its integrity are ensured during the retention period of the GxP record?
Do you have controls to ensure that GxP computerized systems managing GxP data can:
- Allow access only to employees with proper authorization?
- Identify each authorized employee uniquely?
Do you have controls to ensure that GxP data can be protected against accidental or willful harm?
Do you have controls to keep GxP data in a human readable form for the duration of the retention period?
Do you have controls to ensure that the process for offline retention and retrievals is fit for its intended purpose?

Changes become effective

Change Effective, implementation, routine use…these are all terms that swirl in change control, and can mean several different things depending on your organization. So what is truly important to track?

regulatory and change

Taking a look at the above process map I want to focus on three major points, what I like to call the three implementations:

When the change is in use
When the change is regulatory approved
When product is sent to a market

The sequence of these dates will depend on the regulatory impact.

	Tell and Do	Do and Tell	Do and Report
Change in use	After regulatory approval. When change is introduced to the ‘floor’	When change is introduced to the ‘floor’	When change is introduced to the ‘floor’
Regulatory approval	Upon approvals	After use, before send to market	Upon reporting frequency (annual, within 6 months, within 1 year)
Sent to market	After regulatory approval and change in use	After regulatory approval and change in use	After change in use

I’m using ‘floor’ very loosely here. “Change in use” is that point where everything you do is made, tested and/or released under the change. Perhaps it’s a batch record change. Everything that came before is clearly not under the change. Everything that came after clearly is.

You can have the same change fit into all three areas, and your change control system needs to be robust enough to manage this. This is where tracking regulatory approval per country/market is critical, and tracking when the product was first sent.

A complicated change can easily look like this (oversimplification).

building actions

Is this 1, 2 or 3 processes? More? Depends on so many factors, the critical part is building the connections and make sure your change control system both receives inputs and provides outputs. Depending on your company, the data map can get rather complicated.

29 questions to ask about your change management/change control system

While these questions are very pharma/biotech specific in places, they should serve as thought process for your own system checkup.

Is there a written SOP covering the change control program that has been approved by the Quality Unit?
Do procedures in place describe the actions to be taken if a change is proposed to a starting material, product component, process equipment, process environment (or site), method of production or testing or any other change that may affect product quality or reproducibility/robustness of the process?
Does the SOP ensure that all GMP changes are reviewed and approved by the Quality Unit?
If changes are classified as “major” or “minor,” do procedures clearly define the differences?
Does your change management system include criteria for determining if changes are justified?
Are proposed changes evaluated by expert teams (e.g. HSE, Regulatory, Quality…)?
Is there a process for cancelling a change request prior to implementation? And Is a rationale for cancellation included?”
Does your Change control management site procedure describe clearly the process to close a change request (After all regulatory approvals…)?
Are any delays explained and documented?
Is there a written requirement that change controls implemented during normal or routine maintenance activities be documented in the formal change control program?
Is your change management system linked to other quality systems such as CAPA, validation, training?
Does your change management system include criteria for determining if changes will require qualification/requalification, validation/revalidation and stability studies?
Are “like for like” changes (changes where there is a direct replacement of a component with another that is exactly the same) clearly defined in all aspects (including material of construction, dimensions, functionality,,,) ? Are they adequately documented and commissioned to provide traceability and history?”
Is there an allowance for emergency and temporary changes under described conditions in the procedures?
Are the proposed changes evaluated relative to the marketing authorization and/or current product and process understanding?
Does your change management system include criteria to evaluate whether changes affect a regulatory filling?
Are appropriate regulatory experts involved? Does the regulatory affairs function evaluate and approve all changes that impact regulatory files?
Are changes submitted/implemented in accordance with the regulatory requirements?
Is there a defined system for the formalization, roles, and responsibilities for change control follow-up?
Is the effective date of the change (completion date) recorded and when appropriate the first batch manufactured recorded?
Is there a periodic check of the implementation of Change controls?
Following the implementation, is there an evaluation of the change undertaken to confirm the change objectives were achieved and that there was no adverse impact on product quality?
Is all documentation that provides evidence of change, and documentation of requirements, controlled and retained according to procedure?
When necessary, are personnel trained before the implementation of the change?
Are change controls defined with adequate target dates?
If the change control goes beyond the target date, is there a new date attributed, evaluated and documented by Quality Assurance?
Are there routine evaluations of the Change controls and trends (number, Change controls closure, trends as defined)?
Are changes closed on due date ?
Are the Change controls and follow-up formalized in a report and/or periodic meetings?

These sort of questions form a nice way to periodically checking up on your system performance and ensuring you are moving in the right direction.

Data Integrity Thoughts

At the MHRA Blog, a GDP Inspector has posted some thoughts on Data Integrity. As always, it is valuable to read what an agency, or a representative, of an agency in this case, is thinking.

The post starts with a very good point, that I think needs to be continually reiterated. Data Integrity is not new, it is just an evolution of the best practices.

Data Integrity

It is good to see a focus on data integrity from this perspective. Too often we see a focus on the GCP and GMP side, so bringing distribution into the discussion should remind everyone that:

Data Integrity oversight and governance is inclusive of;
- All aspects of the product lifecycle
- All aspects of the GxP regulated data lifecycle, which begins at the time of creation to the point of use and extends throughout its storage (retention), archival, retrieval, and eventual disposal.

Posts like this should also remind folks that data integrity is still an evolving topic, and we should expect more guidance from the agencies from this in the near future. Make sure you are keeping data integrity in your sites and have a process in place to evaluate and improve.

I recommend starting at the beginning, analyzing the health of your current program and doing a SWOT.

data integrity SWOT

Value of the ASQ

If I were to ask a hundred of my peers “How did you get into quality,” I would probably hear 100 different stories (with of course some commonalities). And yet, quality is definitely a distinct set of expertise and practice.

When I try to describe my job, I often find myself breaking down what I do into categories (I’m a project manager, a trainer, a problem solver, risk manager, a facilitator, a puzzle solver, a detective, etc). some of these are professional paths on their own, others not so much.

It is for this reason that I am a huge fan of the ASQ’s Quality Body of Knowledge, as it does a good job of uniting what we do. Sure, it’s not perfect but it is an excellent framework to build an understanding of just what a quality professional can bring to the table, as well as great development path.

One of the many things I love about this is the ability to learn from folks no matter what their industry. This cross-pollination is vital to innovation. And having the QBOK there gives a framework for common discussions.

With the QBOK goes a technical knowledge bolt-on. For example, in my case pharmaceuticals (strong) and medical devices (average).

The ASQ certification board I believe gets it wrong by calling these specific technical certifications “Leadership.” There is nothing leadership centric by getting the CPGP, for example.

I think we’re better breaking these certifications into QBOK core (e.g. quality improvement associate, quality process analyst, manager of quality), specific skills (e.g. six sigma, haccp, quality auditor, reliability and calibration) and then industry specific (e.g. CPGP, biomedical auditor)

As the ASQ goes through its current transformation, I hope the leadership and members remember the strength of the QBOK, work to enshrine it in everything the organization does, and continues to refine it. This is the value of my ASQ membership.