Compliance Zen

CMOs and Records Risks

After a couple of different pharmaceutical firms received complete response letters from the FDA over the past few months, the editors at Contract Pharma asked me to write some general advice on how pharma firms that use contracted services like manufacturers and clinical sites can avoid running risks stemming from the contracted service and poor records management controls.

You can see my article here:

http://www.contractpharma.com/expertsopinion/2010/02/12/cmos_and_complete_response_letters

In summary, it's been my experience that firms really have two choices, neither of which is particularly easy or 100% perfect:

1.       Write a contract that specifically spells out how your CMO is to retain records, what records it is to retain, what oversight and reviews of records your CMO is to conduct, by whom, how often, and so on – in other words, require in the contract that the CMO implement all the aspects of what you believe go into a good records retention program for FDA compliance – and then audit that regularly with dedicated records review due diligence; OR

2.       Expect your CMO to already have an FDA-compliant records management program in place and conduct your on-site due diligence and quality system audits to verify compliance with this as it relates to records relevant to your product and company.

You can get some good advice along with insights into building your own FDA records control programs by taking a look at my recorded seminar on records retention and management for FDA compliance.  If you need outside help, consider my private FDA records consulting service.

When it comes to managing critical suppliers' records, if you've got a more ideas than the two I've listed above, I'd love to hear it.  Just bear in mind - coming up with good compliance ideas is easy; coming up with enforceable good compliance ideas is definitely a bit more challenging.

Reimbursement: Plan Early

In an interview I did with Clinica in the UK (which they turned into an article "Device Reimbursement: Plan Early, Says US Compliance Consultant"), I made the case that firms need to incorporate reimbursement evaluation and assessments as early as possible, preferably toward the end of the preclinical stage.

Some points from the article:

• The sooner you can evaluate reimbursement potential, the better your return on investment in clinical trials
• Try to build a reimbursement evaluation into the stage gate review process for moving a new medicine from preclinical to clinical
• Early reimbursement evaluation allows you to determine what potential customers (prospective patients, physicians, hospital administrators, etc.) will need to see when it comes to efficacy and safety claims
• Early reimbursement evaluation gives you the time to better shape your marketing messages to different customers
• Early reimbursement offers you the chance to set better cost controls for production and the rest of development; it will hardly benefit you as the company if you are making a product that costs you more than you will earn back in reimbursement

Key tactics to help incorporate reimbursement planning early in development include stage gates, regulatory affairs road-mapping, and clinical regulatory strategic plans, all of which I discuss in detail in my forthcoming book, Get to Market Now!

Bringing in reimbursement considerations as early as possible in development help demonstrate an integrated, holistic compliance and development strategy - and show how compliance departments such as regulatory affairs and quality management drive value to a company's bottom line.  And that's what I call Lean Compliance.

Are you ready?

Can Charles River Retune its Preclinical Operations?

Today’s news that contract research organization (CRO) Charles River Labs will be suspending its preclinical operations by mid-2010 in hopes of a biotech recovery is being met with the usual hand-wringing about the state of the industry following the near collapse of the global financial system in 2008.  I look at this a bit differently.  This suspension is a wonderful opportunity for Charles River to come roaring back with preclinical services better attuned and better able to take advantage of cutting-edge medicinal product development techniques.

In my book, Get to Market Now (slated for a May 2010 publication through Logos Press), I argue that firms can be making much better use of the preclinical stage through techniques such as:

• Crafting a clinical regulatory integrated strategic plan
• Bookshelving of previous studies into large databases
• Mining the data of those databases as part of an extended literature survey
• Capturing the voice of the customer (e.g., physicians, prospective patients, etc.)
• Summarizing preclinical studies to include potential critical product quality attributes (CQAs) and a risk analysis
• Planning and undertaking Phase 0 feasibility studies

Charles River has a good six months to put in place a strategy that incorporates tactics just like these, and offering them to clients (something that will save their clients money and time as well).  If your firm already has a number of preclinical studies underway - or planned - consider any of these tactics to help you improve R&D productivity and speed time to market.  Recent FDA and ICH guidelines encourage the adopting of many of these tactics through the quality by design philosophy.  Firms that ignore all the new product development options available to them in the 21^st century in the preclinical stage risk staying back at the 1 in 250 success rate of the 20^th century’s preclinical stage.

If you’d like to learn more about these tactics and adopting them into your preclinical development efforts, contact me through my firm.

Have a different opinion?  Share it.

Applying Auto Companies' Lean to Pharma's Woes

News that AstraZeneca is looking to the automotive industry for advice on improving efficiency in its drug manufacturing operations reminds me of Ambrose Bierce's famous quip, "There is nothing new under the sun, but there are a lots of old things we don't know."

I cited Bierce back in early 2007 in an article I wrote for Bioprocess International entitled Lessons from the Auto Industry (click the link to download the PDF).  In it, I advocated that biopharmaceutical firms could learn a lot of lessons inexpensively from the automobile industry's experiences.  Concepts like "lean" and kaizen (continual improvement) are directly applicable to manufacturing, product development, and business support groups like Quality, Regulatory Affairs, IT, and Records Management.

Indeed, it was a year later, in 2008, when FDA officials like Kim Trautman and Deb Autor began to publicly encourage companies to adopt "continuous improvement" as a core component of good FDA compliance.

Examples of this lean, kaizen approach include FDA compliance process mapping, retention of the right records, a focus on electronic data integrity (as the goal as opposed to "computer validation"), cohesive compliance and quality programs, and so on - all strategies I've advocated (and consult on) for years.

If you're going to undertake your own lean project, here is the general outline I suggest you consider along with a few hard won tips:

1. First, do a gap assessment - either yourself or through an independent, outside consultant.  You may not want to do this as an actual mock FDA audit, but rather use the guise but make it more holistic, less QSIT-focused.  You need to get the picture of gaps in your operations and how interwoven compliance is ... or isn't.
2. Second, hold a process mapping workshop.  Most people tends to do this as a stand-alone, "here's how you process map" training session.  I think this is less valuable than dividing time between the basics and then applying it to your real-world.  For instance, with clients, we'll spend 2-3 hours on "how to process map" and then we'll spend the rest of the day actually process mapping at least 2-3 of their current procedures (if you already have SOPs, then doing the process mapping is not only easier, but it will very, very quickly lead to improvements - it's a fantastic feeling to get such a quick ROI).
3. Third, translate the process maps into actual SOPs - that can take a bit of work, but as you start to get in the swing of things, you'll see how much easier ... and more "followable" ... it makes your SOPs and policies.

A couple of further tips to consider:

• Try to keep your process maps at 20 steps or less - you want the map to fit on one page legibly (i.e., not 8 pt font)
• (I know this will upset the apple cart for some) This is not the time to tackle Six Sigma.  It's so tempting but don't do this.  Please.  Here's what will happen:  at best you'll dilute your efforts; at worst, you'll end up bogging down in an unintended, massive Six Sigma project.  Reserve Six Sigma for your next big step - tackle that a year or two down the road when it's time to step up your lean game.

Good luck ... and get lean.

Are you ready?

What I Like about NICE

After reading an interview with Kalipso Chalkidou, director of the international division of the UK's National Institute of Health and Clinical Excellence (NICE), I was reminded what I like about NICE:  its emphasis on trying to handle the cold realities facing us all.  NICE is not loved by the biopharmaceutical industry and I don't blame the industry - I'd be frustrated too if I spent an average $1.2 billion USD to bring a new product to market only to see NICE review it and say, "Naaaah."

Unfortunately, getting mad at NICE is not going to solve the issue.  And that issue is one that came up earlier this year when I spoke at an National Institutes of Health (NIH) function:  how to drive down medicinal product cost while improving innovation.

What I like about NICE is that it reminds me to keep myself grounded in the big picture when it comes to future drug, biologic and device development and trying to contain costs while improving innovation.

NICE reminds me that before I sink $1.2 billion into developing a new medicine, maybe I should find out what the market will bear first.  In other words, NICE reminds me to do my homework; that I can't just follow the science.  That I have to balance science with business; that there is, ultimately, no real difference between the need to balance the books of a business that makes medicines and the books of a business that makes toasters.  Both businesses need products that customers want AND are willing to pay for.

Sounds so simple until you realize two little hitches:

1. The toaster business owner knows his customer is either the person shopping for a home toaster or the person shopping for a commercial toaster (like in a cafe) - medicinal product companies worry about that toaster-shopper plus his/her doctor plus his/her insurer.


2. The toaster business needs to worry about the same regulations that a medical products company does with one difference:  regulatory health agencies (e.g., FDA, NICE, CHMP, EMEA, etc.) - no easy task there.

NICE, Innovation and Effectiveness

As many of you know, I'm working on a book for Logos Press on the role of regulatory compliance departments (Regulatory Affairs teams, Quality groups, Compliance officers, etc.) in fostering new medicine innovation, lowering costs, and improving marketplace success.

Inherent in product innovation is the ability to adopt tenets of new product development innovation like Quality by Design as early as possible in the medicinal development pipeline.  In other words, to know before you spend $1.2 billion - and preferably way before you spend even close to that - whether or not a new drug, biologic or device has a chance not only of FDA approval but of a good reimbursement rate.

As NICE shows us, getting your medicine approved by the FDA or EMEA as safe no longer equals getting your medicine purchased.  Your medicine has to be effective.  And people tend to measure tangible effectiveness (not just statistical significance) with something they know - their pocketbooks:  are they or are they not getting their money's worth?

NICE and Game Theory

If you like game theory - that cynical philosophy that says people tend to act in their self-interest - then you have to at least appreciate NICE.

NICE is simply saying, "Look, just as with all other things in life, so it is with medicines and reimbursement:  at some point, you reach a matter of dwindling returns.  We don't have all the money in the world to buy all the medicines in the world for each of us - there is only so much to go around."  NICE is trying to act in the insurer's best interest and the best interests of all the people covered the insurer (in this case, the UK government is the insurer).

And so we again come to what I like about NICE:  it reminds us to think about the big picture; to remember that ultimately medicine isn't just about curing disease and saving lives, it's about making those extra moments or months or years of life worth the medicine's expense.  It's about ensuring the self-interests of not just the individual patient and the biopharmaceutical maker are served, but so are the interests of all the other prospective patients, the interests of all the other insured, and the interests of the insurer.

My own career experiences and those of my clients over the years have shown that if you can simplify and streamline compliance while pushing innovative product development approaches like QbD upstream in your pipeline, you can, quite clearly, save at least 6% of your total budget and get a far better feel for how likely your product is to get a good level of reimbursement.

So...let's see, 1.2 billion dollars x .06 equals $72 million.  That's a good bit of savings.

The NICE Challenge

Rather than complaining about where NICE is drawing the line on one specific medicine reimbursement versus another, I see NICE offering a challenge to our industry:  Can we figure out how to consistently make those extra moments of life worth the cost of our medicines?  Can we figure out new medicines that help serve everyone's interests?  Can we innovate to save lives AND save money?

I think we can.  But we can't just innovate by following the science; we're going to have to innovate across the product lifecycle, from preclinical development to postmarket monitoring.

Are you ready?

Featured Reading: Training for Dummies

With many quality systems management reviews including an assessment of organizational training needs, my featured reading choice is one of the best books on training I’ve found in 20 years:  Elaine Beich’s Training for Dummies .

The beauty of this book is its simplicity.  For the busy executive faced with leading an upcoming presentation or training session, the book is perfect for finding just the right amount of information to improve your game.

And for compliance executives tasked with continual improvement, the philosophy of the author should appeal:  “The purpose of training is to improve performance” (p. 260).

Three parts of the book I’ve found helpful over the years when I give corporate workshops and training:

·         How to determine if there is a good reason to conduct actual training (versus coaching, e-mailing information, presentations, etc.);

·         How to set reasonable objectives and get employees engaged; and

·         How to create effective visuals, start and end sessions on strong notes, and calm your own anxiety.

Throughout are many tips on improving effectiveness—something crucial to improving performance, compliance and competitiveness.

Skip the webinars and teleconferences on “effective training” and spend less than $15 on Training for Dummies .  You’ll soon know why everyone else can’t get good quality systems training.

Another Pharma Lesson on Having a Records Retention Policy

If GlaxoSmithKine had a records retention schedule which they maintained and enforced, guess which embarrassing documents would not be coming to light in the Paxil litigation?

• 12-year old memo of possible toxicology tests that if they turned out negative, GSK would want to bury
• 29-year old preclinical report with its possible speculations now taken out of context for a jury ready to believe the executives "should have known better"
• 15-year old regulatory affairs report of possible additional safety studies required for any eventual Japanese approval - again, such speculation has been taken out of context

Not a single one of these or any other related documents, memos, emails, presentations, meeting agendas and minutes are required to have been retained this long - if retained at all - by any regulation or statute.

And yet GSK did keep them.  And now the public and the first Paxil jury has gotten the early impression - so hard to dismiss - that GSK knew better and just preferred to follow the money, not the science.

For those of you still don't grasp the impact of this, GSK faces 600+ more lawsuits on Paxil.  Because of these discoveries by the plaintiffs, GSK will not be allowed to toss a SINGLE document, email, presentation, meeting agenda, sticky note, budget, and so on even tangentially related to Paxil - for at least the next 10 years.  Every email that GSK employees write about Paxil, any of the court cases, or even the public perception of these trials will be subject to review and publication by plaintiff's lawyers.

If you want to see your career ruined, your budgets trashed, and your best people leave your company, the best thing you can do is follow in GSK's footsteps.  Skip the records retention schedule and policies.  Just keep everything.

Oh...there is one thing you'll want to do differently, but you don't have much more control over it than crossing your fingers - don't get sued or investigated by the government.

Assuming that last one is just a bit too far for you, then what should you do?

How to Avoid a Mess during Litigation or Investigations

You need to put in place an FDA compliant records retention schedule with supporting policies and SOPs, with training, enforcement, and periodic review to ensure continual improvement.

Sounds like part of any good quality system ... and it is ... at least according to FDA official Deb Autor, who said several years ago, "Companies need to train their personnel on good records handling practices."

Keeping everything is not good records handling.  That's called hoarding.  It's good for things like gold coins, silver ingots, and even canned goods.  It's not good for records, documents, and emails.

This year, I published a 11-step article on putting in place a records retention schedule that meets FDA standards and requirements, How to Meet Compliance and Records Requirements of the US FDA.

I've done a significant amount of public speaking and corporate workshops on the same topic plus how to put in place a "discovery" strategy (e.g., what to do with your records and your retention policies when you get sued).  You can get the recorded version of one of my webinars on my website, under my compliance seminars and toolkits (http://www.ceruleanllc.com/seminars) and the title FDA Quality Systems Records Requirements and Retention for Pharmaceutical, Biotech and Device Firms - GLPs, GCPs, GMPs (I did a similar teleconference for FOI Services earlier this year as well, so you can buy the basic audio version too).

The sooner you put in place a records retention schedule with appropriate policies, enforcement and management reviews, the sooner your quality system will be in compliance and your litigation risks will be lower.

What are you waiting for?

Bulletproof Yourself against FDA Enforcement

I just updated part of my SmarterCompliance Toolkit, the Bulletproof Yourself against FDA Enforcement, to incorporate all the most recent trend analyses and insights from multiple FDA colleagues, including the top areas FDA intends to target for enforcement in 2010.

Here's the low-down on what I cover in the revised session:

• Learn what hot button items FDA is scrutinizing through 2010

• 5 keys to successfully responding to 483s in 15 days or less

• Understand how to determine if you're attracting agency attention

• Warning letter citation trends

• What FDA inspectors expect when examining your CAPA processes

• Be able to answer the #1 question inspectors will ask about your supplier qualification program

• How to maximize your quality systems efforts and productivity

• Supplier due diligence aspects inspectors look for - and how to make sure you've got it right

• Quickly distinguish between critical compliance needs versus "nice-to-have's"

• Appropriately lower costs, risk and liability

• Put in place practical strategies for each area FDA is scrutinizing

• See the three secrets to passing an audit every time

• Develop an action plan to appropriately prepare for, handle, and follow-up from inspections

If you'd like to attend live, you can do so by just visiting http://www.ceruleanllc.com/webinar.  But registration will close this week.

Otherwise, simply click on the Bulletproof Yourself against FDA Enforcement to go to the page where you can buy the recorded version plus still get all the great reference material, checklists, and other toolkit items.

And, as always, if you've any questions on the material, please feel free to contact me.

FDA Calls for Holistic Compliance

On two separate occasions last month, two separate FDA officials - Commissioner Dr. Margaret Hamburg and CDRH's resident expert, Kimberly Trautman - stated simply that just having a quality system was note enough.  Companies need to build a systemic compliance program from preclinical through post-market surveillance.

Commissioner Hamburg called upon biopharmaceutical and device executives to demonstrate "a commitment to compliance backed by a strong compliance program.  Now is a good time to reassess whether you have such an effort in place" (August 6).

And then, at the Supplier Quality Congress, Kim Trautman told executives, "You must have an integrated compliance system - you cannot just rely on Quality.  Everyone must be involved" (August 20).

Both of these statements echo the philosophies in the ICH and the GHTF harmonization efforts.

In my own experiences, some of which you can read about in my free booklet, Ten Ways to Control Compliance Costs, I have found that this type of holistic, systemic approach to compliance can reduce the time, effort, and costs necessary by at least 2% of your entire company's revenue.  And that's just one way that Regulatory Affairs and Quality personnel can directly contribute to a company's bottom line.

Without such a holistic strategy, your costs and risks will continue to multiply.

Practically speaking, you need to develop a long-term strategy to put in place this type of holistic compliance framework.  Don't expect this to happen overnight.  Elements including tying together Regulatory Affairs, Quality Management Systems, Records and Document Management, Data Integrity, and Corporate Compliance.

I review how to establish a cross-functional team to put a strategy in place that fits your company in my newly revised Bulletproof Yourself against FDA Enforcement (in 2010) webinar and recorded seminar.  I try to revise this on a yearly basis to constantly incorporate new analyses, trends, and FDA expectations.

Your corrective and preventative action (CAPA) systems and supplier controls underlie all aspects of compliance; your records retention and management provide proof of your "good faith" and compliance; and your quality management reviews demonstrate executive involvement and proactivity.

Just as FDA inspectors start by examining your CAPA and supplier controls, so too should you use these as your base areas to tie together all aspects of regulatory compliance and quality systems.

In the 21st century, this type of holistic compliance "loop" is how you can best balance bottom line realities with compliance necessities.

Six New FDA Enforcement Policies

This month saw the first glimmers of FDA's new "get tough" policy with the firms it regulates.  FDA Commissioner Dr. Margaret Hamburg laid out six policies that will go into effect over the next few months:

1. Firms are expected to respond to 483 observations within 15 days

This dovetails with the requirement for inspectors to forward their recommendations from the field as to whether or not a firm should get a warning letter or other enforcement action.

Unfortunately for executives who'd rather outsource a response to consulting companies that specialize in helping firms respond to 483s to avoid warning letters (a claim, I'd add, that few consultants back up with a money-back guarantee), 15 days is not a lot of time.  In that short span, you'd have to find the consultant; evaluate and qualify the consulting firm; craft non-disclosure contracts; write, revise, and sign the statement of work ... oh, AND also actually respond to the 483s.

If my experiences hold true of being called in to help clients AFTER the mess created by the "we'll save you with our awesome response" consulting firm back when the response time was 30-90 days, I'm thinking it's going to get a lot worse for drug, device, and biologics companies.  After almost a century of FDA, if you still don't realize you can't spend your way out of non-compliance as if dealing with FDA was a one-time project, maybe this industry isn't for you.

2. Swift and aggressive enforcement action by the FDA

The old days of multiple warning letters may be gone ... at least for the next few years.  FDA leadership is under fire by Congress and the GAO to actual demonstrate its ability to make manufacturers "do the right thing."  There's no point in having laws and regulations on the books if the agency is going to treat them as guidelines.

There's little doubt that one of the precursors for this announcement was the whole peanut debacle, plus the steady increase in consent decrees and corporate integrity agreements.

Again, based on my experiences, FDA says one thing but so often company executives hear something else.  Sometimes this is an excuse not to do something.

But sometimes, what is heard is impossibly  conservative, as in "The FDA says we have to secure our supply chain" being translated into "We need to audit and control every single company in our entire supply chain, from our actual supplier all the way down to the mine in the ground where they originally got the raw minerals that went into their supply chain that eventually found their way into our product."  Yes, really - that's a comment from a medical device executive at the recent FDA Supplier Quality Management conference in D.C.  Frankly, if we want to know where our high cost of healthcare starts, I'd suggest we clearly spell out that drug and device makers are not responsible for the quality of mineral mining operations and ore smelting....

There is a balance.  If you don't understand that balance, or how to derive it, get help before the agency does it for you.  The latter is called a consent decree and comes with millions of dollars of financial penalties and lots and lots of bad publicity.

3. Faster warning letter issuance

Thankfully, FDA will stop having its legal department review every formal enforcement action for wordsmithing, and just confine the legal review to actual legal issues.  This is something that a LOT of companies could copy.  I know I spent years working with a firm where every single SOP and Work Instruction had to be reviewed by the lawyers.  You'd send in a simple 3-page SOP and get back a 30-page SOP full of language like "...including, but not limited to..." and "...as deemed appropriate at the time of the decision with information immediately on hand or otherwise apparent..." and so on....

Turning things into legalese doesn't do much to increase people actually complying with them.

4. Timely inspection follow-up

Basically, instead of getting inspected and finding problems, issuing a warning letter, and then showing up 3-4 years later to see how you're getting on, the FDA will now issue a warning letter and show up sometime in the next 6 months to 2 years (depending on risk, criticality of issues, etc.).  People outside the industry think that's how it's always been.

Assuming that FDA cannot keep this type of timeline, look for the agency to be able to produce metrics showing Congress that "Hey, if you want this type of swift enforcement, it don't come cheap" and pushing for more funding.  What will be interesting to see is how Congress responds.  Earlier this year, I suggested levying civil monetary penalties to reimburse the agency for having to do re-inspections, issue warning letters, etc. - something that most consent decrees already have.  It's a model based on the "do not call" registry as well.  This past summer, members of Congress have started floating a similar idea.

For compliance executives who want to demonstrate bottom line value to their company, there is no easier way than to make a list of previous non-compliance actions that cost XYZ amount of money ... and then put in place controls to prevent those actions.

5. Warning letter closeout process

This has been a long time coming and well needed.  Today, FDA just removes the original warning letter from its website, rendering researching previous FDA enforcement actions a spotty, unreliable means of figuring out how to prioritize your compliance.

As I discuss in my FDA enforcement seminar, Bulletproof Yourself against FDA Enforcement, your job is to provide as much information in both record proof and summary form so that you make it easy for FDA to issue you a close out letter.  Remember, with shareholders and investors increasingly seeing quality systems and regulatory compliance failures "material information" that you need to disclose publicly, getting a "close out letter" is critical to avoiding investor lawsuits.

6. Increasing collaboration with other regulatory agencies

This is NOT just collaboration with international harmonization partners like members of the ICH or GHTF or Health Canada or the EMEA.  This also includes taking a cue from other US agency inspectors like those from OSHA or HHS (ala HIPAA) or SEC, or from state inspectors.  If those inspectors turn up issues, you should be expecting a phone call or knock on the door from the FDA shortly thereafter.

FDA harmonization is one of many issues I offer a lot of insight and advice on in my monthly newsletter, SmarterCompliance.

For instance, the FDA is working to knock down many of its barriers to cross-functional and cross-agency communications and coordination.  Kim Trautman of CDRH told executives from drug, device and biologic firms to stop seeing the GMPs and QSRs as distinct regulations only applicable to one type of firm or another.  And this is on top of last year's announcement that FDA would enforce ICH guidelines (followed promptly by the first warning letters citing ICH rules).  There should be little doubt that GHTF guideline enforcement is not far behind especially since FDA has been instrumental in crafting those rules as well.  FDA inspectors are being trained to look for your compliance with all of these.

To learn more ...

If you'd like to learn more about how to prepare yourself for stricter FDA enforcement in 2010, consider signing up for my September 29th webinar - Bulletproof Yourself against FDA Enforcement.  You can also download the detailed agenda here:  http://www.ceruleanllc.com/Webinar/default.htm

Are you ready?