Compliance Zen

February SmarterCompliance Published

The February issue of my FDA newsletter SmarterCompliance has been published.  Contents include:

• Challenges in Choosing an Auditor
• Designing a Records Management Training Program
• Drug and Biotech Warning Letter Trends
• Three Threshold Part 11 and Record Archiving Questions
• Managing Project Risk Proactively
• Featured Reading:  The Imposter

Downloads for subscribers include:

• EMA Site Master File guidance
• FDA guidance on using bayesian statistics in clinical trials
• FDA guidance on proprietary drug name submissions
• FDA guidance on cGMP dissolution calibration
• Article on reimbursement considerations for device firms in preclinical
• Article on 28 points to consider to protect clinical trial patient privacy

Also, don't forget - if you pre-order a copy of my new book, Get to Market Now!  Turn FDA Compliance into a Competitive Edge, you can save 32% at Barnes & Noble.  The book will be on bookstore shelves on May 1.

CMOs and Records Risks

After a couple of different pharmaceutical firms received complete response letters from the FDA over the past few months, the editors at Contract Pharma asked me to write some general advice on how pharma firms that use contracted services like manufacturers and clinical sites can avoid running risks stemming from the contracted service and poor records management controls.

You can see my article here:

http://www.contractpharma.com/expertsopinion/2010/02/12/cmos_and_complete_response_letters

In summary, it's been my experience that firms really have two choices, neither of which is particularly easy or 100% perfect:

1.       Write a contract that specifically spells out how your CMO is to retain records, what records it is to retain, what oversight and reviews of records your CMO is to conduct, by whom, how often, and so on – in other words, require in the contract that the CMO implement all the aspects of what you believe go into a good records retention program for FDA compliance – and then audit that regularly with dedicated records review due diligence; OR

2.       Expect your CMO to already have an FDA-compliant records management program in place and conduct your on-site due diligence and quality system audits to verify compliance with this as it relates to records relevant to your product and company.

You can get some good advice along with insights into building your own FDA records control programs by taking a look at my recorded seminar on records retention and management for FDA compliance.  If you need outside help, consider my private FDA records consulting service.

When it comes to managing critical suppliers' records, if you've got a more ideas than the two I've listed above, I'd love to hear it.  Just bear in mind - coming up with good compliance ideas is easy; coming up with enforceable good compliance ideas is definitely a bit more challenging.

Three Tips to Elevate Your Compliance Communications

Good communication is a hallmark of trust.  If people know they can count on you to communicate well, to articulate thoughts in ways that are understandable to any listener, then people will see you - and the programs you champion - as worth paying attention.  And when it comes to dealing with the FDA or the EMA or Health Canada or any other regulatory agency, communications speak volumes about the levels of trust and competence that regulatory authorities should assume about you.

Three tips to elevate your communications when it comes to regulatory compliance and quality systems:

1. Equate email with image.  Think of email as tiny bits of a virtual company image.  At a minimum, use spell check (but don't rely solely upon it), keep the number of recipients to a minimum, do not flag items as urgent or high priority if they really aren't, and understand that email is not private.  As a colleague once put it in a training session, "Don't put anything in your email that your mother would be ashamed of reading in tomorrow's New York Times."
2. Readability of memos and emails.  When it comes to memos, use your word processing program to check for the ease of comprehension (e.g., readability).  Microsoft Word, for instance, will allow you to check readability levels when you check spelling and grammar.  But when it comes to emails, you'll need to do the work, so some rules to keep in mind:  anything more than 3 paragraphs will encourage skimming so be cautious; when you can, number items rather than bullet point them; keep lists to under 5 items; and make sure to read through any email to a regulatory agency or your boss (at minimum) to ensure you've not inadvertently left out a word or two (something we're all guilty of occasionally).
3. Visit in person.  Know when to write, call, or visit.  If you're having trouble picking just the right words or phrases to use to avoid misunderstandings, that's the signal to step away from the computer and go talk to someone in person or on the phone.

The news is full of pharmaceutical and device firms who've gotten sued or otherwise involved in litigation, and have been forced to divulge their emails and internal business communications.  Don't join in.  Use these tips to help you think twice about recording comments and phrases that might later be taken out of context and used to portray you or your company in a negative, uncaring light.

For more advice you can use on controlling records and handling requests from FDA for records or emails, see my recorded seminar, FDA Quality Systems Records Requirements and Retention for Pharmaceutical, Biotech, and Device Firms - GLPs, GCPs, GMPs, QSRs.  You get a 9-page matrix detailing out various retention requirements under each regulation along with loads of tips and advice on how to build in retaining the right records to prove compliance and product safety, efficacy, and quality.

And if you need more advice, feel free to contact me directly.

Another Pharma Lesson on Having a Records Retention Policy

If GlaxoSmithKine had a records retention schedule which they maintained and enforced, guess which embarrassing documents would not be coming to light in the Paxil litigation?

• 12-year old memo of possible toxicology tests that if they turned out negative, GSK would want to bury
• 29-year old preclinical report with its possible speculations now taken out of context for a jury ready to believe the executives "should have known better"
• 15-year old regulatory affairs report of possible additional safety studies required for any eventual Japanese approval - again, such speculation has been taken out of context

Not a single one of these or any other related documents, memos, emails, presentations, meeting agendas and minutes are required to have been retained this long - if retained at all - by any regulation or statute.

And yet GSK did keep them.  And now the public and the first Paxil jury has gotten the early impression - so hard to dismiss - that GSK knew better and just preferred to follow the money, not the science.

For those of you still don't grasp the impact of this, GSK faces 600+ more lawsuits on Paxil.  Because of these discoveries by the plaintiffs, GSK will not be allowed to toss a SINGLE document, email, presentation, meeting agenda, sticky note, budget, and so on even tangentially related to Paxil - for at least the next 10 years.  Every email that GSK employees write about Paxil, any of the court cases, or even the public perception of these trials will be subject to review and publication by plaintiff's lawyers.

If you want to see your career ruined, your budgets trashed, and your best people leave your company, the best thing you can do is follow in GSK's footsteps.  Skip the records retention schedule and policies.  Just keep everything.

Oh...there is one thing you'll want to do differently, but you don't have much more control over it than crossing your fingers - don't get sued or investigated by the government.

Assuming that last one is just a bit too far for you, then what should you do?

How to Avoid a Mess during Litigation or Investigations

You need to put in place an FDA compliant records retention schedule with supporting policies and SOPs, with training, enforcement, and periodic review to ensure continual improvement.

Sounds like part of any good quality system ... and it is ... at least according to FDA official Deb Autor, who said several years ago, "Companies need to train their personnel on good records handling practices."

Keeping everything is not good records handling.  That's called hoarding.  It's good for things like gold coins, silver ingots, and even canned goods.  It's not good for records, documents, and emails.

This year, I published a 11-step article on putting in place a records retention schedule that meets FDA standards and requirements, How to Meet Compliance and Records Requirements of the US FDA.

I've done a significant amount of public speaking and corporate workshops on the same topic plus how to put in place a "discovery" strategy (e.g., what to do with your records and your retention policies when you get sued).  You can get the recorded version of one of my webinars on my website, under my compliance seminars and toolkits (http://www.ceruleanllc.com/seminars) and the title FDA Quality Systems Records Requirements and Retention for Pharmaceutical, Biotech and Device Firms - GLPs, GCPs, GMPs (I did a similar teleconference for FOI Services earlier this year as well, so you can buy the basic audio version too).

The sooner you put in place a records retention schedule with appropriate policies, enforcement and management reviews, the sooner your quality system will be in compliance and your litigation risks will be lower.

What are you waiting for?

Bulletproof Yourself against FDA Enforcement

I just updated part of my SmarterCompliance Toolkit, the Bulletproof Yourself against FDA Enforcement, to incorporate all the most recent trend analyses and insights from multiple FDA colleagues, including the top areas FDA intends to target for enforcement in 2010.

Here's the low-down on what I cover in the revised session:

• Learn what hot button items FDA is scrutinizing through 2010

• 5 keys to successfully responding to 483s in 15 days or less

• Understand how to determine if you're attracting agency attention

• Warning letter citation trends

• What FDA inspectors expect when examining your CAPA processes

• Be able to answer the #1 question inspectors will ask about your supplier qualification program

• How to maximize your quality systems efforts and productivity

• Supplier due diligence aspects inspectors look for - and how to make sure you've got it right

• Quickly distinguish between critical compliance needs versus "nice-to-have's"

• Appropriately lower costs, risk and liability

• Put in place practical strategies for each area FDA is scrutinizing

• See the three secrets to passing an audit every time

• Develop an action plan to appropriately prepare for, handle, and follow-up from inspections

If you'd like to attend live, you can do so by just visiting http://www.ceruleanllc.com/webinar.  But registration will close this week.

Otherwise, simply click on the Bulletproof Yourself against FDA Enforcement to go to the page where you can buy the recorded version plus still get all the great reference material, checklists, and other toolkit items.

And, as always, if you've any questions on the material, please feel free to contact me.

Dangerous Documents and FDA Compliance

Continuing my efforts to help folks understand that it is their actual records - not their SOPs - that prove whether they've complied or not to FDA regulations, I've teamed up with three other folks to give a pre-conference workshop on October 12 at AdvaMed 2009.

Entitled Dangerous Documents: Avoiding Land Mines in Your FDA Records and Emails, the executive workshop will review four key areas:

• How to teach employees to create documents that reflect your commitment to quality
• How implement an FDA-compliant records control program of policies, SOPs, and retention schedules
• The types of documents your competitors and prospective partners and customers can obtain about your firm (such as 483 observations and meeting minutes) through the Freedom of Information Act
• Advice on implementing an electronic document management system (EDMS)

The session runs approximately three hours and it's FREE ... well, free to attendees of AdvaMed2009.  All you need to do is email mac@advamed2009 no later than October 1 and let him know you plan to attend the workshop.

So, if you're planning to attend AdvaMed 2009, consider joining our workshop.  And like every compliance speaking talk I give, it'll be full of real-world tips, lots of stories and practical advice, plus loads of reference material you use to quickly implement all the learning points.

I hope to see you there!

FDA Quality Systems Records Integrity

More than 90% of all FDA regulatory enforcement hinges on 1 point:  the integrity—or lack thereof—of your records.  What are the steps to prepare for an inspection of records and document integrity?

 With my clients, I use a practical approach reliant on four themes:

1.       Clarity of accountabilities

2.       Clarity of expectations

3.       Simplicity of risk control

4.       Transparency of knowledge

 

Clarity of Accountabilities

As a company leader, you are in charge of setting out the accountabilities of each department within your firm.  Set down these accountabilities in writing.  This does not need to be detailed job descriptions, but rather, brief statements on who is accountable for what aspects of capturing, maintaining and archiving information.

At a minimum, you will want to identify the roles of your information technology (IT/ICT) group, your regulatory affairs and quality teams, your records management and archival group, and your legal department.

As simple as this sounds, I’ve repeatedly found that companies struggle with this aspect of record integrity.  As you develop your document and data handling procedures and policies, continue to check-in with your teams to ensure mutual agreement on accountabilities and expectations.

When the inspection or the lawsuit is announced, it's too late to figure out who should have been acountable.

 

Clarity of Expectations

Hand in hand with an understanding of accountability, you—with your teams—need to lay out expectations for your company’s level of confidence when it comes to data quality.  Consider adopting, at minimum, the same standards of confidence you expect from your product, whether that’s 95% accuracy and reliability, 98% accuracy and reliability, etc.

Do not make this any more complicated than it needs to be.  If nothing else, this confidence level can be your starting point, leaving room for continuous improvement.

 

Simplicity of Risk Control

The challenge here is not to “dumb down” your firm’s risk management methods, but rather to identify those elements applicable to each group’s set of information accountabilities.  Each of your teams (and their individual members) should know enough to recognize a potential risk when an unknown unknown (or “unk-unks” as they are called in product development) arises.  At that point, your documented risk management and control policies kick in.

 

Transparency of Knowledge

Finally, you will still be left with two challenges:

1.       Ensuring you have data and accountability transparency; and

2.       Ensuring each of member of your company has the know-how to recognize and tackle new situations as your business evolves.

Data and accountability transparency can be addressed by combining the concepts of flowcharts and organizational charts.  For instance, take your organizational chart and trace the proof of patient safety and product efficacy through various levels of management and personnel.  This defines who is accountable.  Next, make a flowchart of where the data sits on various systems in use throughout your company (or in outsourced providers).  This is where the data is located.  Then, correlate the two charts to draw relationship lines between them.  This will allow you – and your team – to identify, at any time in the information’s life, who in your organization is accountable.

Ensuring your teams have the know-how to recognize and tackle new situations as your business and marketplace evolve is a long-term commitment inherent in information’s long lifespan.  Tactics to handle this will depend upon each group’s accountability, but several principles apply.  Training may be an obvious one, but so is continued awareness of industry trends and best practices.

If you are running lean and cannot devote the time constantly assessing industry trends and best practices, consider asking a third-party for a summary document of items that might be applicable to your company and the information you guard.  I recently put together a report and set of recommendations for a client who was trying to improve their inventory control and the management of their supply chain.

 

Final Thoughts

For companies whose entry of new products into the regulated marketplace hinges upon a review of information proving product safety and efficacy, record integrity is the quiet elephant lurking in the corner.

Have you put in place an FDA records management program yet?  Does it support the record integrity and data quality of your submissions?  Can it withstand a pre-approval inspection?  Know the answers before the inspector shows up.

Are you ready?