FDA In Brief > FDA In Brief: FDA advances policies related to bolstering security of drug products in the U.S. supply chain

FDA issues drug supply chain guidances to alert industry of changes to pharmaceutical product identification and tracing procedures.
— Read on www.fda.gov/NewsEvents/Newsroom/FDAInBrief/ucm621095.htm

Today, the FDA is finalizing two guidance documents and making available one draft guidance to help ensure that prescription drug products are identified and traced properly as they move through the supply chain in compliance with federal law.

Computer system changes and the GAMP5 framework

Appropriate controls shall be exercised over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel. Input to and output from the computer or related system of formulas or other records or data shall be checked for accuracy. The degree and frequency of input/output verification shall be based on the complexity and reliability of the computer or related system. A backup file of data entered into the computer or related system shall be maintained except where certain data, such as calculations performed in connection with laboratory analysis, are eliminated by computerization or other automated processes. In such instances a written record of the program shall be maintained along with appropriate validation data. Hard copy or alternative systems, such as duplicates, tapes, or microfilm, designed to assure that backup data are exact and complete and that it is secure from alteration, inadvertent erasures, or loss shall be maintained.

21 CFR 211.68(b)

Kris Kelly over at Advantu got me thinking about GAMP5 today.  As a result I went to the FDA’s Inspection Observations page and was quickly reminded me that in 2017 one of the top ten highest citations was against 211.68(b), with the largest frequency being “Appropriate controls are not exercised over computers or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel. ”

Similar requirements are found throughout the regulations of all major markets (for example EU 5.25) and data integrity is a big piece of this pie.

So yes, GAMP5 is probably one of your best tools for computer system validation. But this is also an argument for having one change management system/one change control process.

When building your change management system remember that your change is both a change to a validated change and a change to a process, and needs to go through the same appropriate rigor on both ends. Companies continue to get in a lot of trouble on this. Especially when you add in the impact of master data.

Make sure your IT organization is fully aligned. There’s a tendency at many companies (including mine) to build walls between an ITIL orientated change process and process changes. This needs to be driven by a risk based approach, and find the opportunities to tear down walls. I’m spending a lot of my time finding ways to do this, and to be honest, worry that there aren’t enough folks on the IT side of the fence willing to help tear down the fence.

So yes, GAMP5 is a great tool. Maybe one of the best frameworks we have available.

gamp5

 

FDA issues new guidance on Post Approval Changes

This past week the FDA issued a draft guidance “Post Approval Changes to Drug Substances” from the Center for Drug Evaluation and Research on post-approval changes for drug substances to provide clarity to holders of drug master files and holders of new and generic drug applications on which reporting category manufacturing changes fall into as well as the information required to support these changes.

Like any guidance this is supposed to “describe the Agency’s current thinking on a topic” and in this case this is a pretty important guidance as it is the first on the subject of change management published after the draft of Q12. It also clearly builds on the concepts of Q11 and is the first time the agency has published a guidance on drug substance post approval changes.

The guidance covers changes to facility; scale and equipment changes; specification changes to starting materials; synthetic manufacturing process changes; and, changes to the container closure systems for the drug substance.

It uses the traditional breakdown of major changes (prior approval supplement category), Moderate changes (changes-being-effected-30 (CBE-30) category) and Minor changes (annual report).

The guidance provides some solid requirements for risk assessments, and requires the risk assessment be included with the filing of change. This will require some companies to improve their risk management process, and may cause some to question decision making about their internal formulas for level of effort and the formality of risk management.

The deadline for public comment on the draft is Nov. 13. Submit comments to the docket at: https://www.regulations.gov/docket?D=FDA-2018-D-3152.

What Closing A Government Radio Station Would Mean For Your Clocks – Start contingency planning

Many clocks sync with a government radio station that’s been proposed to be closed. Scott Simon talks with Thomas Witherspoon of the website The SWLing Post.
— Read on www.npr.org/2018/08/25/641835302/what-closing-a-government-radio-station-would-mean-for-your-clocks

NIST’s full Fiscal Year (FY) 2019 budget request to Congress calls for the agency to “discontinue the dissemination of the US time and frequency via the NIST radio stations in Hawaii and Fort Collins, Colorado.” The agency noted, “These radio stations transmit signals that are used to synchronize consumer electronic products like wall clocks, clock radios, and wristwatches, and may be used in other applications like appliances, cameras, and irrigation controllers.” The specific cut, which would come from the NIST Fundamental Measurement, Quantum Science, and Measurement Dissemination budget, would amount to $6.3 million.

This is the type of thing to add to your SWOTs and other risk management/contingency planning activities. I, too, would like to have confidence it will not be in the final bill, but now is the time to take appropriate actions for your organization.