Master and Transactional Data Management

Mylan’s 483 observation states that changes were being made to a LIMS system outside of the site’s change control process.

This should obviously be read in light of data integrity requirements. And it looks like in this case there was no way to produce a list of changes, which is a big audit trail no-no.

It’s also an area where I’ve seen a lot of folks make miss-steps, and frankly, I’m not sure I’ve always got it right.

There is a real tendency to look at the use of our enterprise systems and want all actions and approvals to happen within the system. This makes sense, we want to reduce our touch points, but there are some important items to consider before moving ahead with that approach.

Changes control is about assessing, handling and releasing the change. Most importantly it is in light the validated and regulatory impact. It serves disposition. As such, it is a good thing to streamline our changes into one system. To ensure every change gets assessed equally, and then gets the right level of handling it needs, and has a proper release.

Allowing a computer system to balkanize your changes, in the end, doesn’t really simplify. And in this day of master data management, of heavily aligned and talking systems, to be nimble requires us to know with a high degree of certainty that when we apply a change we are applying it thoroughly.

The day of separated computer systems is long over. It is important that our change management system takes that into account and offers single-stop shopping.

Questions to ask when contemplating data integrity

Here are a set of questions that should be evaluated in any data integrity risk assessment/evaluation.

Do you have a list of all GxP activities performed in your organization?
Do you know which GxP activities involve intensive data handling tasks?
Do you know the automation status of each GxP activity?
Have you identified a list of GxP records that will be created by each GxP activity?
Have you determined the format in which the official GxP records will be maintained?
Have you determined if a signature is required for each GxP record?
Do you have controls to ensure that observed, measured or processed GxP data is accurate?
Do you have controls to ensure that GxP data is maintained in full without being omitted, discarded or deleted?
Do you have controls to ensure that naming, measurement units, and value limits are defined and applied consistently during GxP data handling?
Do you have controls to ensure that GxP data is recorded at the same time as the observation/measurement is made or shortly thereafter?
Do you have controls to ensure that GxP data is recorded in a clear and human readable form?
Do you have controls to ensure that data values represent the first recording of the GxP data or an exact copy of an original data?
Do you have SOP(s) addressing management of GxP documents and records and good documentation practices?
Do you have SOP(s) addressing the escalation of quality events that also cover data integrity breaches?
Do you have SOP(s) addressing self-inspections/audits with provisions for data integrity?
Do you have SOP(s) addressing management of third parties with provisions for the protection of data integrity?
Do you have SOP(s) for Computerized Systems Compliance?
Do you have SOP(s) for training and does it include training on data integrity for employees handling GxP data?
For GxP activities that generate data essential for product quality, product supply or patient safety, do you have controls to prevent or minimize:
- Process execution errors due to human inability, negligence or inadequate procedures?
- Non-compliance due to unethical practices such as falsification?
Do you have controls to ensure that only authorized employees are granted access to GxP data based on the requirements of their job role?
Do you have controls to ensure that only the GxP activity owner or delegate can grant access to the GxP data?
Do you have controls to eliminate or reduce audiovisual distractions for GxP activities with intensive data handling tasks?
Do you assess the design and configuration of your computerized GxP activity to minimize manual interventions where possible?
Do you have controls for review of audit trail data at relevant points in the process to support important GxP actions or decisions?
Do you have controls, supervision or decision support aids to help employees who perform error-prone data handling activities?
Do you have controls to ensure business continuity if a GxP record essential for product quality, product supply, or patient safety is not available? Both for when there is a temporary interruption to GxP activity or during a disaster scenario?
Do you have a process for ensuring that data integrity requirements are included in the design and configuration of GxP facilities where data handling activities take place?
Have you assessed the compliance status of computerized systems used to automate GxP activities?
Do you have controls to prevent data capture and data handling errors during GxP data creation?
Do you have controls to ensure the accuracy of date and time applied to GxP data, records and documents?
Do you have controls to ensure that changes to GxP data are traceable to who did what, when and if relevant why during the lifecycle of the GxP data?
Do you have controls to ensure that – when required – legally binding signatures can be applied to GxP records and its integrity are ensured during the retention period of the GxP record?
Do you have controls to ensure that GxP computerized systems managing GxP data can:
- Allow access only to employees with proper authorization?
- Identify each authorized employee uniquely?
Do you have controls to ensure that GxP data can be protected against accidental or willful harm?
Do you have controls to keep GxP data in a human readable form for the duration of the retention period?
Do you have controls to ensure that the process for offline retention and retrievals is fit for its intended purpose?

Data Integrity Thoughts

At the MHRA Blog, a GDP Inspector has posted some thoughts on Data Integrity. As always, it is valuable to read what an agency, or a representative, of an agency in this case, is thinking.

The post starts with a very good point, that I think needs to be continually reiterated. Data Integrity is not new, it is just an evolution of the best practices.

Data Integrity

It is good to see a focus on data integrity from this perspective. Too often we see a focus on the GCP and GMP side, so bringing distribution into the discussion should remind everyone that:

Data Integrity oversight and governance is inclusive of;
- All aspects of the product lifecycle
- All aspects of the GxP regulated data lifecycle, which begins at the time of creation to the point of use and extends throughout its storage (retention), archival, retrieval, and eventual disposal.

Posts like this should also remind folks that data integrity is still an evolving topic, and we should expect more guidance from the agencies from this in the near future. Make sure you are keeping data integrity in your sites and have a process in place to evaluate and improve.

I recommend starting at the beginning, analyzing the health of your current program and doing a SWOT.

data integrity SWOT

Data Integrity in the quality system

Data integrity has been, for the last few years, one of the hot topics of regulatory agency inspections, one that it has often been noticed seems to be, at times, a popular umbrella for a wide variety of related topics (that usually have a variety of root causes).

Data Integrity is an interesting grab bag because it involves both paper and electronic data. While some of the principles overlap, it sometimes can seem nebulous, Luckily, the MHRA recently published a final guidance on GXP Data Integrity that ties together several threads. This is a great reference document that lays out some key principles:

Organizational culture should drive ALCOA
Data governance is part of the management review process
Data Risk Assessments with appropriate mitigations (full risk management approach)

I love the snarky comment about ALCOA+. More guidances should be this snarky.

The FDA so far this year has been issuing warning letters and 483s in more traditional GMP areas, such as testing and validation. It will be curious if this lessening of focus in a subtle shift in inspection, or just the result of the sites inspected. Either way, building data integrity into your quality systems is a good thing.

Processes and tools for the prevention, detection, analysis, reporting, tracking and remediation of noncompliance to data integrity principles should be integrated into the Quality Management System to:

Prevention of data integrity issues through governance, training, organizational controls, processes, systems underlying and supporting data integrity.
Detection of data integrity issues through leveraging existing Quality Systems, tools and personnel.
Remediation of data integrity issues through leveraging existing Quality Systems that identify and track implementation of corrective/preventive action(s).

Some ways to integrate includes:

Data integrity training for all employees
Include as an aspect of audits and self-inspections
Controls in place to ensure good documentation practices
good validation practices
Computer system lifecycle management (include audit trail reviews)
Ensure your root cause investigators and CAPA people are trained on data integrity
Data integrity as a critical decision point in change management

Data integrity, like many other aspects of a quality culture, are mindsets and tools that are applied throughout the organization. There really isn’t a single project or fix. By applying data integrity principles regularly and consistently you build and ensure. A such, data integrity is really just an affirmation of good quality principles.