Compliance Zen

Featured Reading: The Starfish and The Spider

 

Based on more than five years of research, this book compares decentralized organizations (“starfish”) and centralized organizations (“spiders”), with an emphasis on how decentralized organizations are changing the competitive landscape.

The book is full of insights for any CEO, much less compliance executives in regulatory affairs and quality systems.

There are several worthy points:

First, the authors make the case that the hybrid organization, like eBay, IBM, Google, Sun, Apple, Amazon, Intuit and GE, represents the corporate structure of the future.

For those in compliance, studying the profile of GE and its decentralization within a central structure will provide multiple strategy clues.

Second, self-enforcement of norms is inevitably more powerful than rules because norms are based on trust, commonality and shared purpose.

And third, Toyota (download the PDF of my article, “Elucidation: Lessons from the Auto Industry,” June 2007, BioProcess International) is used as an example of an organization that has found the profitable middle ground between decentralization and sufficient structure and controls to ensure quality and consistency.

If you’re planning your long-term strategy, The Starfish and the Spider is a required (albeit, quite enjoyable) pre-read.

 

Postmarket FDA Surveillance: The New Rules

Adverse events and recalls have increased over the past five years, leading the US Food and Drug Administration (FDA) to consider total product lifecycle in its analysis of product safety and efficacy information.

In other words, did the company developing the product in question take a Quality by Design approach?

 

Quality by Design and Design History Files

With my clients, I suggest adopting Quality by Design (QbD) as early as possible in the product development cycle, preferably starting in preclinical.  Earlier this year, I wrote a four-part series in my compliance newsletter on Quality by Design and collaborating with universities in preclinical, clinical and the postmarket phases; an excerpt has been published on PharmaQbD under the title Back to School: Six Ways Universities can Aid Quality by Design Efforts.

In the case of products already on the market, I undertake a retrospective Quality by Design review of the design history file to highlight relevant preclinical and clinical information to identify critical quality attributes (CQAs) that support the safety and efficacy of the product.

While such a post-approval, retrospective QbD effort might seem too little, too late, there are four benefits:

1.       Much of the highlighted information can be re-used as part of the next product or incorporated into a new iteration of the current product, saving money, time and effort;

2.       The QbD information can be summarized and used during periodic product reviews (such as in your quality systems management review) to demonstrate continuous improvement;

3.       The information gathered simplifies the assessment required when an adverse event occurs; and

4.       The information can be used to implement process analytical technology (PAT) to streamline production operations and cut costs, all while improving end-product quality.

Ideally, a retrospective Quality by Design survey also documents evidence of management’s determination to ensure the product’s safety and efficacy.  In the event of the worst case, a product liability lawsuit against the company, Quality by Design (whether retrospective or not) can help justify decisions taken.

 

Quality by Design and Product Liability

Encourage your legal team to view Quality by Design as a means to provide protection from liability in product misuse lawsuits.

Through this liability lens, your Legal department can join forces with Quality, Regulatory Affairs, and product development teams to implement a Quality by Design strategy that identifies, documents and tracks a new product’s safety and efficacy characteristics as it moves through the development and commercialization lifecycle (see my seminar, Introduction to Speeding New Drug Development with Quality by Design, for more).

Because liability often focuses on the condition of the product at the time it left the manufacturer’s control (e.g., into distribution), Quality by Design should be extended to identify and control risks stemming from packaging and labeling.  This will further enhance a company’s liability shield under product misuse cases.

 

Quality by Design and a Postmarket Matrix

One recommendation that consistently delivers results for my clients is the creation of a postmarket matrix—with attendant summary metrics—to track postmarket issues and patient complaints, whether they result in an adverse event report, a recall, or otherwise.

The matrix provides solid proof of:

·         Continuing concern for safety and efficacy;

·         Quality controls to incorporate into development of the next generation of the drug or device;

·         Critical quality attributes that can transfer from one product to its follow-on without duplicating work or paying for unnecessary testing; and

·         Potentially new critical quality, safety and efficacy attributes that arise over time (and thus can support additional claims).

Such a matrix can be a simple table, similar to the one used to record your preclinical literature survey results.

 

Final Thoughts

The proliferation of new medicines, devices and diagnostic technologies, combined with the increasing pace of globalization, will continue to force the FDA into relying upon postmarket surveillance as a cornerstone of public health.

Retrospective Quality by Design can help you stay out of the spotlight and the courtroom.

Are you ready?

Featured Reading: Six Thinking Hats

 

Used by organizations around the world, from IBM to Microsoft, DuPont to NTT, NASA to Federal Express, the “Six Hats Method” of problem-solving and conceptual thinking is a crucial tool for those organizations seeking a way to balance compliance with the bottom line and encourage Quality by Design implementation and innovation.

For the busy executive, a single cross-country airline flight is all that is needed to review the book and put its elements into play.

The main premise of the methodology is that we all try to do too much when  thinking—we juggle emotions, information, logic, hope, creativity, analysis, reactions and so on.  This then prevents us from using our minds efficiently...or effectively.

The colored hats are metaphors for these types of thinking.  By consciously stating “Now we are going to do ‘black hat’ thinking” (e.g., critique an idea), you free up everyone in the meeting to concentrate on that one task, thereby eliminating defensiveness, egos, and so on.  In this way you provide a structure with plenty of flexibility and creativity to encourage innovation and compliance.

Six Thinking Hats is a tool that seems so simple—  even silly with its colored hat metaphors—and yet, for more than 22 years, it has yielded incredibly powerful results.  If you've not relied upon it in brainstorming and problem-solving sessions - including CAPA resolutions - then maybe it's time you structured your thinking with a little bit more color.

FDA Quality Systems Records Integrity

More than 90% of all FDA regulatory enforcement hinges on 1 point:  the integrity—or lack thereof—of your records.  What are the steps to prepare for an inspection of records and document integrity?

 With my clients, I use a practical approach reliant on four themes:

1.       Clarity of accountabilities

2.       Clarity of expectations

3.       Simplicity of risk control

4.       Transparency of knowledge

 

Clarity of Accountabilities

As a company leader, you are in charge of setting out the accountabilities of each department within your firm.  Set down these accountabilities in writing.  This does not need to be detailed job descriptions, but rather, brief statements on who is accountable for what aspects of capturing, maintaining and archiving information.

At a minimum, you will want to identify the roles of your information technology (IT/ICT) group, your regulatory affairs and quality teams, your records management and archival group, and your legal department.

As simple as this sounds, I’ve repeatedly found that companies struggle with this aspect of record integrity.  As you develop your document and data handling procedures and policies, continue to check-in with your teams to ensure mutual agreement on accountabilities and expectations.

When the inspection or the lawsuit is announced, it's too late to figure out who should have been acountable.

 

Clarity of Expectations

Hand in hand with an understanding of accountability, you—with your teams—need to lay out expectations for your company’s level of confidence when it comes to data quality.  Consider adopting, at minimum, the same standards of confidence you expect from your product, whether that’s 95% accuracy and reliability, 98% accuracy and reliability, etc.

Do not make this any more complicated than it needs to be.  If nothing else, this confidence level can be your starting point, leaving room for continuous improvement.

 

Simplicity of Risk Control

The challenge here is not to “dumb down” your firm’s risk management methods, but rather to identify those elements applicable to each group’s set of information accountabilities.  Each of your teams (and their individual members) should know enough to recognize a potential risk when an unknown unknown (or “unk-unks” as they are called in product development) arises.  At that point, your documented risk management and control policies kick in.

 

Transparency of Knowledge

Finally, you will still be left with two challenges:

1.       Ensuring you have data and accountability transparency; and

2.       Ensuring each of member of your company has the know-how to recognize and tackle new situations as your business evolves.

Data and accountability transparency can be addressed by combining the concepts of flowcharts and organizational charts.  For instance, take your organizational chart and trace the proof of patient safety and product efficacy through various levels of management and personnel.  This defines who is accountable.  Next, make a flowchart of where the data sits on various systems in use throughout your company (or in outsourced providers).  This is where the data is located.  Then, correlate the two charts to draw relationship lines between them.  This will allow you – and your team – to identify, at any time in the information’s life, who in your organization is accountable.

Ensuring your teams have the know-how to recognize and tackle new situations as your business and marketplace evolve is a long-term commitment inherent in information’s long lifespan.  Tactics to handle this will depend upon each group’s accountability, but several principles apply.  Training may be an obvious one, but so is continued awareness of industry trends and best practices.

If you are running lean and cannot devote the time constantly assessing industry trends and best practices, consider asking a third-party for a summary document of items that might be applicable to your company and the information you guard.  I recently put together a report and set of recommendations for a client who was trying to improve their inventory control and the management of their supply chain.

 

Final Thoughts

For companies whose entry of new products into the regulated marketplace hinges upon a review of information proving product safety and efficacy, record integrity is the quiet elephant lurking in the corner.

Have you put in place an FDA records management program yet?  Does it support the record integrity and data quality of your submissions?  Can it withstand a pre-approval inspection?  Know the answers before the inspector shows up.

Are you ready?

Featured Reading: Why Smart Executives Fail

 

For six years, the author and his team conducted hundreds of interviews, reviewed thousands of documents, and analyzed small companies and multinational Fortune 10 conglomerates.

Their research reveals common reasons why successful companies and business strategies implode, from executives who deal with warning signs through avoidance to those who ignore their own reports to choose the worst strategy for the capabilities of their organization.

While the lessons in the book are important for any executive or business owner, there are four qualities in an executive that will lead to disaster when it comes to FDA compliance:

1.       Identifies his/her personal goals as the company’s goals;

2.       Believes he/she has all the answers;

3.       Plays politics to eliminate individuals and sources of information that do not support his/her agenda; and

4.       Obsesses over the company’s image.

Each of these four executive characteristics invariably results in weak risk taking, poor gambles, sloppy decision-making, and inept execution.

Three sections in the book—the last two chapters and the introduction— discuss potential remedies.  Highlighting a relevant section and sliding it under someone’s door is not recommended.

If you’re worried about failing, make sure you and your colleagues are not to blame.  Take the lessons from Why Smart Executives Fail to heart.

 

Continuous Improvement Components

Auditors increasingly look for proof of “continuous improvement.”   Depending on the type of audit—financial, regulatory and so forth—improvement varies in the eye of the beholder.  Given all the other demands of  business, how do you show progress across the board?

In my work helping executives and organizations with lean FDA compliance, I’ve identified three crucial components that prove to any auditor your commitment to continuously improve your controls,  your product quality and the safety and well-being of your employees and consumers.

 

Risk Management

Simply put, you need some type of documented—and followed—risk assessment and mitigation process.

Firms in the software and the medical device industries often use Failure Mode and Effects Analysis (FMEA).  The FMEA process identifies the failure, its effect and then probes for either solutions to fix the problem or mitigations to contain the risk.  FMEA, however, is not for everyone and certainly not for every risk.

An internet search will give you plenty of additional risk assessment tools to choose from; select something appropriate to your company, its product and your industry’s litigation environment.  In my work with small to midsize firms, I often suggest a simplified version of the Hazards Analysis and Critical Control Points (HACCP) risk method.

For most small to midsized firms (and for sake of argument, let’s consider a separate division of a large multi-national company as a midsized firm), a single risk assessment and management tool in use by everyone is far more cost-efficient and effective than multiple techniques targeted at varying specific  types of risk.

 

Corrective Action

Now that you have a process in place to identify problem areas and potential risks, you need to document the actions taken to resolve or mitigate the issues, plus independent verification that the action worked.  It is important to remember that risk mitigation is not risk elimination.  Risk mitigation is simply reducing a risk to a level wherein you have confidence in your ability to control any situation that might arise as a result of the risk (thus the need for independent verification).  Risk elimination is one type of risk mitigation, but do not let yourself become stuck on “elimination” as the ideal state for any given risk.

Use of corrective action and preventative actions (CAPA) to achieve continuous improvement in a risk-based decision-making environment requires documenting three items:

·         How the action will prevent or mitigate similar issues in the future;

·         Why you chose that particular action over others that might also have resolved future problems; and

·         What monitoring you have put in place to verify the positive long-term impact.

 

Preventative Checks & Balances

When I conduct a mock FDA audit or Part 11 inspection, one of the first document sets I like to look at is the firm’s history of preventative checks and balances.  Incomplete reporting – even at the dashboard level – typically indicates problems with continuous improvement.

When looking at such records, there are two questions I frequently get asked:

1.       Preventative checks and balances seem like a Gordian knot – where and how do we start?  Isn’t easier to just let “sleeping dogs lie”?

2.       How do we put proactive checks and balances in place without using a heavy hand or being “big brother”?

Rather than getting tied into knots over questions of how much, where, how often, and so on (what one of my clients referred to as “analysis paralysis”), focus first on the checks and balances you can put in place without negatively impacting your business or the morale of your staff.

Ideally, you already have a holistic view of your organization and its compliance infrastructure (processes, control points, weaknesses, and so on), and thus can identify two or three possible areas to target for preventative controls.  Chances are though, if you’re struggling to demonstrate continuous improvement, a mature holistic view isn’t in place yet.  In that case, go back to a recent CAPA.

Assess the effort it took you to identify and then resolve the issue.  Measure that against the anticipated effort a proposed preventative check and balance will take.  Example:  If it took 14 hours to resolve a mistaken purchase order and shipment, how much time would an independent review and approval of purchase orders take?

 

Final Thoughts

Demonstrating continuous improvement is also demonstrating awareness of your firm’s limitations.  Your creativity is called for to find ways to continuously improve year after year.  One attendee of my seminar on quality systems management review best practices has her team make a “Top 10” list of continuous improvement ideas at the end of every review session.  Over the course of the next year, one by one, they either complete the ten items or document (with a memo to the file) why that could not undertake the improvement.

When you target – and document – the improvements you can make, you show the auditor that when it comes to compliance and quality, you do “get it.”

 

Do you have tips on how to demonstrate continual improvement?  Add them in! 

Featured Reading: Blue Ocean Strategy

 

A definite “must read” for anyone interested in innovation, product development, and growing their business.  Blue Ocean Strategy introduces a number of innovative strategy formulation and execution tools.  When I speak at local business schools and entrepreneurship clubs, I point to this book (along with Gerber’s The E-Myth Revisited and the Heath brothers' Made to Stick ) as one of the three most critical books any budding entrepreneur must read.

In terms of compliance and quality systems, what caught my eye is the method the authors label Fair Process, used to gain voluntary cooperation across an organization to execute to the new strategy.

Based upon mid-1970’s research into what makes people trust a legal system such that people comply willing with laws, the three principles of Fair Process—engagement, explanation, and expectation clarity—are incredibly relevant to governance boards, compliance officers and CEOs struggling to balance compliance and quality systems buy-in with business growth.

Using Fair Process promotes employee trust to “do the right thing” and acknowledges individual expertise and opinions.  Employees who feel such appreciation typically go beyond the call of duty for their organization; such employees are the difference between the successful business and the also ran.

Put Blue Ocean Strategy your reading list today.

Internal Quality Audits as a Competitive Advantage

Most quality system internal auditors mistake their core role as verification of policy and procedure implementation.  As a result, the business never gets to take advantage of the most powerful capability of any FDA quality system:  improving product quality to a level noticeable by the consumer (and the regulator).

The simplest way to encourage both a standard operating procedure (SOP) audit and a consumer-oriented quality review is to design a set of tests or internal audits centered solely on the product and its relationship to the consumer.

In this context, rather than assessing if the procedure has been followed, the auditor looks at the product’s quality itself as perceived by a hypothetical customer.

 

Build Better Medicines

The core value of this focus shift is its end result:  better quality results in the lab, in the design phase, in the  prototype phase, and in final production; in essence ... you're testing to ensure you’ve built quality into your medicine all along the way from conception to distribution.  In other words, did you or did you not adopt Quality-by-Design?

Craft a single checklist of consumer-oriented product quality components that are tested all along the path of the product’s design, from start to finish.  For instance, you might examine the fit and appearance of seams in a device's hardware.  If the engineers and assemblers followed procedures, seams should be near perfect; if the seams and welds are sloppy, then you know someone didn't do his / her job.

In this way, you help force a better product and a patient-oriented quality system.

 

Test Continuously

Automate the tests by looking for common features that a computer program can test.  For example, with design files, look to ensure that all the corner points of the drawing meet; with formulations, verify the compounds, ensure that the molecule sizes are within  range and that the viscosity meets target parameters expected by the final consumer.

Once you have a standard battery of tests, you can automate them and gain the zero-cost efficiencies.  At that point, there is no good reason not run them frequently.  In the case of medical device software, thousands of test scripts can be run for several hours every night with the results waiting for you in the morning.

 

Resolve Problems Cheaply

Most drugs have side effects, most medical devices have drawbacks, most production processes have problems.  The questions are:

·         which do you know about?

·         when do you find them?

·         how much will they cost to resolve?

As a general rule, the more you test regularly, the sooner you find problems, and the cheaper they are to resolve.  The “surface area” covered since the last testing will be small, the number of areas to examine will be limited.  This is particularly critical as your design evolves and progresses.  You want to be able to rationally limit your impact assessments whenever you make an adjustment or fix.

You can also use these tests to revisit on-going high-risk areas to ensure risk-mitigation controls function as expected.

 

Control Flexibility

Many quality professionals like the consistency provided by SOP-focused audit.  Yet SOP controls often fly in the face of the cultures of scientists, engineers, and designers.  Because you’re more concerned with the end product and its impact on the consumer, with consumer-oriented testing you allow for a balance between control and flexibility to built into your SOPs and your audits.

By utilizing repeated, automated testing, your teams will move faster as they are able to test out new ideas and changes, respond to market changes quicker, and provide a stronger end product.

 

Make Consumers, Investors and Regulators Smile

Testing results can be shown to your investors, directors, consumer focus groups, and even clinical trial investigators.  Every company has a quality manual, but how many have regular testing routines and results all along the product path?

Continuous testing and improvement will give individuals comfort in your company, your product, and your controls.  That comfort will translate into higher revenue for you.

 

Share your better way to start turning compliance into competitive advantage….