Industrial Regulation and Quality CHMG 751

1. Industrial Regulation and Quality CHMG 751 Manhattan College Fall 2012 Class 4

2. Agenda • Update on Syllabus • Review Homework Assignment No. 3 QFD Exercise • Review Homework Assignment No. 5 Heparin Case Study • Training • Documentation Systems • Change Control • Quality Audit • Quality Risk Management • Next Week

3. Updates on Syllabus

4. Homework Assignment No. 3 QFD Exercise • Products • Customer Needs • Product Features/Requirements • Process Design Elements • Process Parameters/Key Performance Indicators

5. Homework Assignment No. 5 Heparin Study • What were the main takeaways? • Quality Assurance/Control and Regulatory Affairs • Culture • Governance • Structures • Did you agree or disagree? Why? • How would you improve the author(s) points? • Are there alternative rationales? • How can you broaden or expand the case study?

6. Training • Why do we train personnel in organizations? • People have a large impact on work • Processes in manufacturing, technical areas, administrative have manual tasks that involve people • Ensure individuals understand their responsibilities • Ensure skill sets are initially established, i.e. hiring an engineering student but also continually update skills to meet the demands of the business • Regulatory Compliance i.e. GMPs require personnel to be trained and have the necessary skills to perform their work

7. Training • ISO 9001 and ISO 9002. Both standards state: "The supplier shall establish and maintain documented procedures for identifying training needs and provide for the training of all personnel performing activities affecting quality." Such procedures must be written, and followed by documentation that they have been carried out. • ISO 9001 and ISO 9002 further state: "Personnel performing specific assigned tasks shall be qualified on the basis of appropriate education, training and/or experience, as required." Does your company document its criteria to meet this requirement, and is it able to show compliance? • cGMPs 21 CFR Subpart B Organization and Personnel Part 211.25: • Each person engaged in the manufacture, processing, packing or holding of a drug product shall have education, training or experience or any combination thereof, to enable that person to perform the assigned functions.

8. Training • Training Programs • Leadership Driven • Develop culture norm • Communicate importance • Allocate time in work • Governance Model • Training Organization • Quality Systems • Regulatory Compliance • Types of Training/Education • In house: Organization specific business processes, SOPs, key topics • External: graduate programs, industry society courses • Organizations documenting individual training • Certifications • Lean Six Sigma • Project Management Professional • Licensures • Professional Engineering

9. Training • Training Programs • Delivery Systems • Classroom style • On-Line • On the Job Training

10. Training • Learning Organization • Concept developed P. Senge • Iterative model based of creating shared mental models, act of sharing • Act of sharing and generate behavioral norms • Systems Thinking: thinking of the whole not just subparts

11. Training • Knowledge Management • SECI Model • Developed by Nonaka and Takeuchi • Two Dimensions of Knowledge • Tacit: Individual understood within the mind • Explicit: Able to be documented • Knowledge Flow • Socialization • Externalization • Combination • Internalization

12. Break

13. Documentation Systems • Why does documentation support quality? • Meet customer and stakeholder requirements • Clear expectations made explicit in document form which can be shared and replicated through out the organization • Provide evidence that activities were conducted as they were intended • Need to provide traceability of decisions • Post activity investigations and deviations • Essential part of the quality system and specified by regulations such as cGMPs

14. Documentation Systems • What is covered? • Internal documents • Batch recipes • Standard Operating Procedures • Equipment logs • External documents • Regulatory filings: IND, NDA, memos of understanding (MoU) • Quality Agreements with Contractors and Suppliers

15. Documentation Systems • Good Documentation Practices • Approve, review and update documents with security control • Change and current revision status of documents identified • Relevant versions of applicable documents available at points of use • Documents remain legible and readily identifiable • Document of external origin identified and their distribution controlled • Prevent unintended use of obsolete documents and archiving

16. Documentation Systems • Good Documentation Practices • How are mistakes corrected? • Draw a single line through the error • Make the correction next to the error • Write an explanation of the error • Sign and date the correction.

17. Documentation Systems • Additional Tips on Good Documentation Practices • Records should be completed at time of activity or when action is taken (i.e. Batch record in the pharmaceutical industry) • Superseded documents should be retained for a specific period of time (i.e. product complaints over a year after the product was made) • Record should be retained for at least one year after the expiry date of the finished products • Concise, legible, accurate and traceable • Picture is worth a thousand words • Clear examples • Don’t assume

18. Documentation Systems • How does computers relate to this topic? • Organizations have transitioned to electronic document management systems, i.e. Documentum, Microsoft SharePoint • Required Functionality • Document Lifecycle (creation, review, approval, discontinued) • Usage of the latest version of the document by operations • Automate Good Documentation Practices

19. Change Control • Change: any modification to product, process, equipment, instrument, system, facility, including their documentation • Types of Change • Reactively • Something happened • Trying to catch up • Proactively • Change in customer requirements • Change in regulations • Changes in the competition

20. Change Control • Change Control is process to review, verify, approve and control the execution of the change made to the existing operating system, product, process, facility or documents • Principles of change control are to understand and document • What was done, why, when, where, by whom, how and • Results, including the impact of changes to other processes

21. Change Control • Change Control Management • Written procedures should be established and maintained to control changes for • Process, Facilities, Utilities, Computer Systems • Methods and Validation • Training and training material • Regulatory filings and quality systems • Changes should be justified and documented from several perspectives: • Business (i.e. cost, new revenue, opportunities) • Technical (i.e. technology obsolescence, new technologies, new knowledge) • Regulatory and Quality (i.e. new regulations, improved cGMPs) • Conditions for Change Control • Change management process with approved procedures • Approval to implementation (all relevant groups) • Documentation of the Change

22. Change Control • Change Control Process • Change Request Form • Documentation of approved change • Scope • Tracking System for types, status and need for escalation • Monitor the Change control system to meet the quality system policy

23. Change Control • Change control considerations • Should be realistic and based upon risk (critical, major and minor) associated with each change • SOP and training on change control should provide example to guide the individual requesting a change • Impact assessment following implementation of each change • Approval from respective regulatory authority on the changes which has direct impact on the quality, safety and efficacy of the product but also the process safety and environmental impact

24. Quality Audit • Quality Audit definition an independent review conducted to compare some aspect of quality performance with a standard for that performance • Key Concepts • Independent: Auditor is not the performer • Unbiased picture of performance • Review of the activities (Product audit is different) • Evaluation the quality system not just specific errors or defects in the process

25. Quality Audit • What does it provide to the organization or the supply chain? • Products are fit for use and safe for the users • Standards and regulations defined by government agencies, industry associations, and professional societies are being followed • Conformance to specifications (will discuss later in inspection and statistics) • Procedures are adequate and are being followed • Data system provides accurate and accurate information on the quality (paper based or computer) • Deficiencies are identified and corrective action is taken • Opportunities for improvement are identified and the appropriate personnel alerted. Think about suppliers and contract manufacturing!!!

26. Quality Audit • Audit Program • Should focus both on compliance and effectiveness • Five Principle of an Audit Program • Conclusions based upon facts • Service to line management and senior management assurance • Identify opportunities for improvement • Address human relations (reasons behind the audit, atmosphere of blame, balance reporting, depersonalize the report, post audit meeting) • Competence of auditors

27. Quality Audit • Audit Details • Develop the Audit plan • Legitimacy (sponsorship and customer) • Scheduling • Scope • Audit team (facilitators, SMEs) • Identify/Develop Standards for the audit • Internal specifications • External specifications • Setup meetings • Pre-meeting • Daily meetings • Post audit meeting

28. Quality Audit • Audit Details • Structured Audit Execution • Checklists • Interview Schedule • Document Review Schedule • Data collection/Verify data • Report generation with deviation classification • No solutions development during audit (post only) • Audit close out meeting • Senior management • Local management (part of audit) • Audit team

29. Quality Audit • Post Audit report • Corrective Action Follow-up • Human Perspective • Company wide Impact • Systemic Solutions • External Perspective • Stakeholders • Regulatory

30. Quality Audit • Quality Assessment • Concerned with broader view of quality within the organization • Overall framework to see how the quality system is performing (i.e. Malcolm Baldrige National Quality Awards) • Assessing by published criteria such as ISO 9001 certification or FDA QSIT

31. Quality Audit • Product Audit • Independent evaluation of product quality to determine its fitness for use and conformance to specification. • Product auditing • Estimate the quality level as delivered to customers • Evaluating the effectiveness of the inspection decisions • Provide information useful to improving outgoing product quality level and improving the effectiveness of inspection • Provide addition assurance beyond routine inspection activities

32. Quality Risk Management Process consisting of well-defined steps which, when taken in sequence, support better Decision Making by contributing to a greater insight into risks and their impacts. It includes elements such as risk identification, assessment, mitigation, elimination and communication. Risk= probability and severity

33. Quality Risk Management • Use of Risk Management in Pharmaceutical, Medical Device and Food industries in particular • A Process Risk Assessment Model • The relationship between risk and knowledge and how to apply them pre and post approval (e.g. regulatory scrutiny, post approval changes and GMP’s, etc).

34. Quality Risk Management • Recognize the level of scientific knowledge supporting product applications, process validation, and process capability • Apply a risk based regulatory scrutiny that will relate to • level of scientific understanding of how formulation and manufacturing process factors affect product performance • the capability of process control strategies to prevent or mitigate risk of poor product performance

35. Quality Risk Management • ICH Q9: Quality Risk Management • “Develop a harmonized pharmaceutical quality system applicable across the life cycle of the product emphasizing an integrated approach to risk management and science.” July 2003. • Requiring consensus among all regions and developing a guideline to be used by all ICH parties. • Proceeding with a process oriented, practical, applicable, predictive, flexible, consistent and integrated approach in mind.

36. Quality Risk Management • What is the problem being solved • Product may not be available to patients, when needed • May increase the potential for the release of unacceptable product to the market • New product introductions to the marketplace may be delayed • Delays may occur during implementation of changes and improvements to processes • Safe and effective drugs may be discarded or recalled from the market • Manufacturers may be reluctant to implement new technologies or continuous improvements to the products or processes • Scarce resources may not be optimally allocated • Lack of appropriate data to evaluate risk most effectively

37. Quality Risk Management • Benefits • Enhanced patient confidence in decision making on pharmaceutical quality • Promotes more effective use of regulatory agency and industry resources • Establishes a systematic, well-informed and thorough method of decision making which leads to greater transparency and predictability • Increased knowledge of exposure to risk • Fosters quality by design, continuous improvement and new technology introduction, which generally leads to enhanced product quality

38. Quality Risk Management • Quality Risk Management Process • Initiate Process • Assess • Control • Communicate • Review

39. Quality Risk Management

40. Quality Risk Management • Guiding principles • The evaluation of the risk should ultimately link back to the potential risk to the patient. • The extent of the risk management process should be commensurate with the level of risk associated with the decision. • A more robust data set will lead to lower uncertainty. • It Is essential to have a clear delineation of the risk question. • Risk management should be an iterative process. • People who apply risk management should have the appropriate training, skills and experience. • The risk management process should be appropriately documented and verifiable.

41. Quality Risk Management • Guide to initiating risk management • Defining specifically the risk management problem or question, including the assumptions leading to the question. • Assembling background information and data on the hazard, harm or human health impact relevant to the assessment. • Defining how the assessment information and conclusions will be used by the decision makers. • Identifying the necessary resources, members of the team who have the appropriate expertise, with the leader clearly identified. • Asking the right risk assessment question(s) • Stating clearly the assumptions in the risk assessment • Assessing the quality and sufficiency of relevant data • Specifying a timeline and deliverables for the risk assessment

42. Quality Risk Management • Risk Assessment • What can go wrong? • What is the likelihood (probability) it would go wrong? • What are the consequences? • Risk analysis is a systematic use of information to identify specific sources of harm (hazards) and to estimate the risk. • Risk evaluation compares the estimated risk against given risk criteria using a quantitative or qualitative scale to determine the significance of the risk.

43. Quality Risk Management • Risk Control • Describes the actions of implementing risk management decisions. • What can be done to mitigate and reduce risks? • What options for controlling risks are available? • What are the impacts of current risk management decisions on future options for risk management? • Risk mitigation focuses on a reduction of severity of harm. • Risk reduction focuses on the reduction of probabilities of occurrence of harm and detection of harm. • Risk acceptance is a decision to accept risk, i.e., no additional risk control activities are necessary at that time.

44. Quality Risk Management • Risk Communication • Risk communication is the exchange or sharing of information about risk and risk management between the decision maker and other stakeholders. The information can relate to the existence, nature, form, probability, severity, acceptability, treatment, detectability or other aspects of risks to quality. • The communication among stakeholders concerning quality risk management decisions can be made through existing channels.

45. Quality Risk Management • Risk monitoring and review • All risk management processes are dynamic/iterative. Quality risk management when applied should benefit from new knowledge with each decision cycle and used to enhance future decisions allowing for continuous improvement.

46. Quality Risk Management

47. Quality Risk Management • Risk Management Tools • Process mapping • Preliminary Hazard Analysis (PHA) • Hazard Analysis of Critical Control Points (HACCP) • Hazard Operability Analysis (HAZOP • Fault tree analysis (FTA) • Failure Mode Effects Analysis (FMEA) • Failure Mode, Effects and Criticality Analysis (FMECA) • Risk Ranking and Filtering • Informal Risk Management • Taguchi, variation risk management method

48. Quality Risk Management • Supporting Statistical Tools • Design of experiments (DOE) • Process Capability Analysis • Control charts: • Acceptance control charts. • Shewhart control charts. • Accumulative sum charts)

49. Quality Risk Management • Integration of Quality Risk Management into Design and Operations • Development (e.g. Specification Setting, Test Method Selection and process development). • Regulatory scrutiny during pre and post approval. • As a component of Quality systems ( e.g. Auditing Deviations/Discrepancies, Complaints & Recall Management, Change management) • Facility systems management ( e.g. Design, Hygiene, Qualification, environmental control, Preventative maintenance and Computerized systems) • Materials Management (e.g. Supply chain, Assessment and evaluation of suppliers and contract manufacturers, procurement and release of material)

50. Quality Risk Management • Integration of Quality Risk Management into operations (Continued) • Production (e.g. PAT, Validation, in-process sampling, testing, reporting and trending) • Laboratory controls (e.g. validation, testing, methods development, stability). • Packaging and labeling (e.g. Selection of container closure system and label controls). • Regulatory Authority Activities