Compliance Zen

From the Pharma Contracting and Outsourcing Conference

This past week I was invited to speak at the Contract Pharma Contracting and Outsourcing Conference in New Jersey, where I spoke on how to sell compliance to senior management.

All too often we assume that compliance is an essential requirement when choosing a critical supplier. And the yet, when cost becomes the deciding factor, compliance becomes compromised or even forgotten for the sake of the bottom line.

Given that more people are hurt each year by toilets than receive FDA warning letters or FDA-483s, the threat of FDA enforcement is hardly a credible compliance encouragement. And so I opened day two of the conference by speaking on how lean FDA compliance can:

• save money
• enable greater revenue and profitability
• simplify compliance
• and generate easy metrics to both support those results and prove effective compliance to FDA.

I was followed by Addam Reynolds, a Consumer Safety Officer with FDA's New Jersey district office who spoke on recent FDA inspectional findings and trends. Mr. Reynolds summarized a number of trends in FDA-483s, comparing the previous year to this one. I've reproduced two of his summary tables below.

As we looked at the data, Mr. Reynolds made several explanatory comments of what was behind the numbers.

First, many of the new investigators now with FDA are well-versed in laboratory and manufacturing operations. A number of new hires have come from those laid off by the pharma industry - an irony not lost on attendees. With increased familiarity of modern-day manufacturing and laboratory settings comes increased scrutiny. Thus the increases in citations for noncompliance with 21 CFR 211.63 and 211.160(b)(4). Mr. Reynolds noted that "Firms are either not qualifying their equipment and instruments at all, or are not doing it right."

Second,the number of citations for 21 CFR 211.68(b), controls over computerized systems, is, in Mr. Reynolds insight to FDA thinking, "really about data integrity and data security." This continues FDA's special enforcement of Part 11 as a rule governing electronic data and records integrity; an enforcement approach that was officially announced in 2010. As Mr. Reynolds noted, most Part 11-relevent 483s happen because firms continue having systems "with little to no data integrity controls."

As I've written about extensively, been interviewed on, and consulted on, Part 11 is less about validating computers per se, and more about ensuring data integrity. To that point, validation is simply a means to an end. The most recent issue of my client newsletter, SmarterCompliance #68, explains in-depth how to use data mapping as a technique to simplify and streamline Part 11 compliance.

The rest of Contract Pharma's conference featured more excellent speakers on various contracting and supplier management issues, including site selection criteria, what to do when your CMO goes bankrupt, and more. If you've not attended this two-day conference before, I encourage you to do so next September. Attendees and speakers are focused on frank conversations about overcoming real-world challenges. I'll be there speaking. I'm thinking of doing something on parallels between choosing a puppy and choosing a supplier - lessons learned and puddles cleaned.

If you're looking for more lean compliance events, check my upcoming workshops and speaking events page on my website. In the near term, I'll be speaking:

• September 25 - webinar on overseeing and verifying Part 11 compliance of your records at critical suppliers
• October 3 - Part 11 enforcement today for OTC manufacturers
• October 11 - webinar on best practices for quality system management reviews (a new requirement under the new EU GMPs Chapter 1 going into effect in January)

I hope you'll join me at one of these events.

 

From the Medtech QA/RA Global Conference

New European medical device regulations are due within 18 months. The new rules will update the current Medical Device Directives (MDDs) for the 21st century, and close the gaps so brutally uncovered by the PIP scandal and the metal-on-metal issues. Industry is proactively adjusting their quality systems and regulatory compliance programs while key executives are encouraging EU regulators to avoid US-style over-regulation.

These were the principle themes infusing the two-day Medtech QA/RA Global Access 2012 conference hosted by the Irish Medical Device Association (IMDA) in Galway, Ireland last week. With over 250 medical technology companies calling Ireland home, including 11 of the top 13 device firms in the world, Ireland has become Europe's center of excellence for devices. And IMDA's Medtech meeting is Ireland's flagship conference.

Much of Day One was devoted to discussions of the planned MDD revisions, with speakers from the European Commission, the European Parliament, the Irish Medicines Board (IMB), Eucomed (the Advamed of Europe), and industry. Europe encourages "responsible innovation" by relying more upon vigorous postmarket surveillance, inspections and adverse event reporting rather than any pre-approval scheme such as the FDA's 510k. Instead, the EU has only pre-market assessments and the CE mark. IMB's Ann O'Conner noted that 65% of vigilence reporting leads to product recall and removal. This state of affairs, with its regulatory burden primarily on the postmarket stage, allows for rapid inclusion of new technology, and new scientific and engineering innovation, an approach I advocated in my latest book, Get to Market Now.

The EU's new MDDs will require a number of elements that are outlined in Global Hamonization Task Force (GHTF) guidelines such as:

• Summary technical evaluation document (STED);
• Unique device identifiers; and
• Adoption of the GHTF's four risk categories for medical devices.

For readers of my client newsletter, SmarterCompliance, adoption of GHTF guidelines should come as no surprise. FDA is moving to GHTF inclusion as well, albeit a bit more slowly than Europe. Whether FDA's "slowly but surely" pace of harmonized rule adoption will inadvertently put US-based device makers at a disadvantage on the global marketplace remains to be seen. European parliamentary elections are scheduled for June 2014, so expect the new MDDs to be in place by then if not sooner.

In addition to a high-level presentation by FDA on "possible, eventual 510k updates," the rest of Day One was taken up with surveys of the state of device regulations in India, China, Russia, the Middle East and North Africa.

Day Two of the conference saw speakers delve more deeply into practical implications and challenges behind the new rules. One set of challenges will be the new clinical rules in the updated MDDs. The IMDA is hosting a two-day conference later this year to address the new EU clinical evidence rules.

I had the privilege of presenting on elements of a defensible record-keeping program for complaint handling and medical device reporting. The message I had for attendees was two-fold:

First, it is clear that complaint handling records and complaint files hold both regulatory and legal risks. Focusing only on quality system compliance can leave a firm vulnerable to disgruntled customers increasingly willing to file a lawsuit to get monetary compensation. Thus, quality auditors must also assess the content of complaint records to help minimize risk to their companies.

Second, complaints can come into a device company through more than just "official" channels. Whether a complaint is made to the saleswoman manning a conference booth or to the company vice-president speaking to a patient advocacy group, each person dealing with the public must receive some level of complaint handling training.

As with any in-person compliance speech or workshop I provide, I gave attendees handouts to help with both of these issues:  an internal quality auditor checklist for reviewing complaint files and a list of complaint documentation do's and dont's.

The next IMDA Medtech conference is scheduled for 2014 just as the new EU MDDs come into force. It promises to be an exciting event, so keep an eye out for announcements.

In the meantime, consider attending some of these events where I'll be offering advice on optimizing your quality system and regulatory compliance programs:

• June 14 teleconference on defensible documents
• June 22 speech on the role of IT departments in effective regulatory compliance
• July 25 teleconference on effectively managing an FDA inspection
• July 31 workshop on 21st century supplier management and qualification

More upcoming lean compliance events can be found on my upcoming events page on the Cerulean website.

Lowering Product Liability Risk with Supplier Due Diligence

Earlier this year, I spoke with medical product liability expert and lawyer, Sara Dyson, now an executive with MedMarc Insurance Group. As part of March's SmarterCompliance newsletter, her interview focused on ways to reduce drug and device product liability risks through effective supplier due diligence and vendor qualification.

Some excerpts:

 

SmarterCompliance:  Does a product liability lawsuit emerge fairly quickly once the product is distributed or a clinical trial is run?

Dyson: On average, it takes about two years after the original problem for the lawsuit to materialize. This is why companies are so easily caught off guard. It’s not the most recent batch or lot that rolled off the production floor that is the subject of a lawsuit; it’s an historical lot or batch.

The lawsuit may resurrect a problem that the company has already otherwise addressed. Firms without an effective records retention schedule and policy will suffer as far too many old documents that were eligible for destruction were, instead, kept and are now available to the plaintiff to make his/her case.

 

SmarterCompliance:  What makes the discovery phase of a lawsuit so dangerous? Is it because records, data, emails, samples, and so on from at least two years ago have to be turned over to the plaintiff’s lawyers?

Dyson:  Yes. That’s why both the initial due diligence and ongoing monitoring of suppliers is so important. You want to have a good track record of documents showing your efforts to consistently evaluate and oversee your suppliers.

Additionally, too frequently, companies have not implemented document management plans or have out-of-date record retention rules, meaning that there is an abundance of documents that must be sorted through to locate relevant information. This then bogs down the discovery process and increases costs.

 

It takes about two years after the original problem for a liability lawsuit to materialize.

 

SmarterCompliance:  What are some steps – beyond looking at additional research points during initial supplier evaluation – that supplier due diligence and oversight teams need to take?

Dyson:  You may want to hire a third-party expert to show your supplier oversight team members how to review supplier oversight records to find hidden gaps and risks. For instance, a sponsor of a clinical trial run by a contract research organization (CRO) might want to hire a third party to train their clinical project managers on how to review the CRO’s qualification of various clinical sites, sort of a train-the-auditor type of session.

 

To read the rest of the interview and see all nine critical points that Ms. Dyson recommends be incorporated into your supplier management and qualification program, you'll need to subscribe to the monthly regulatory intelligence and quality system newsletter, SmarterCompliance.

You can read more ways to reduce medical products liability risks at MedMarc.

FDA Compliance Training - Onsite Workshop or Offsite Class?

Which is better - hiring a consultant to come and conduct an onsite workshop for my team or sending folks out to various third-party classes and industry conferences?  Well, to paraphrase the FDA, it depends.

There are three typical considerations:  cost, time, and customization. Some folks add "networking" and while I think there is truth to this, valuable networking is often outside the scope of your control. The person you send to the conference or class could be rather introverted, or the other attendees are not that interested, and so on. Thus, in terms of weighing the considerations, I don't add "networking," and instead add "expert advice specific to me."

Any measure of return on investment (ROI) has to address all four of these - and especially so for FDA compliance training or FDA quality systems training wherein cost control is a simple business reality. So let's look at each in turn, and use this to help make the determination.

 

Cost

The cost of training - whether an internal workshop or sending a team to external training - boils down to the following:

• Per attendee registration fee
• Per attendee travel
• Per attendee training material

All things being equal, if we treat the trainer(s) as an "attendee" then the cost of an inhouse workshop is always cheaper than the cost of sending a team to an external activity.

Example

Assume a team of 10 and 1 trainer.

To send the team out will require 10 registration fees, 10 travel expense sets, and 10 sets of training material.

To bring the trainer internally will require 1 "registration fee" (workshop cost) that may be equal to the cost of 10 different registrations, so we should expect only a small savings here (if the registration fee is $500 per person and the internal workshop is $5,000, it's equal). The 10 sets of training material will still have to be purchased, so no savings here. But savings does come from reducing travel from 10 people down to 1. Unfortunately, for many companies, this comes out of a different budget (travel vs. training line items) and thus may not serve as a true savings to a department (although it is an overall company savings).

If we look at computer-based training such as attending a compliance teleconference/webinar or purchasing a recorded version, we can often get the cost down for the "registration" and eliminate the travel. As we'll see below, though, this eliminates the ability to achieve the other 3 factors, starting with timing.

 

Time/Schedule

To put it simply, to have someone out of the office - regardless of the technology tools you give them - costs productivity. Most of us view travel time as (some degree of) time away from the office or, at minimum, reduced work intensity level. Thus, while we check email and might work on Word or Excel or Powerpoint documents, by and large, we are not as productive traveling as are when we're plugged in at the office, available for spur of the moment questions, meetings, informal discussions, and so on.

Thus, time spent traveling to training acts as a drag on productivity.

There is also the additional challenge - and a very real one in today's fast-paced business climate - the schedule. If an external class or conference, or a webinar, is not held when we need it, then we don't go. Or the timing of the event might be incredibly inconvenient - maybe only 2 of the 10 team members can attend.

Conversely, with an onsite workshop, the timing and scheduling is up to you. You are in complete control. And this degree of control is hard to beat.

The only exception is IF - and that's a big IF - a pre-recorded FDA compliance/quality system webinar or teleconference happens to have taken place before you needed it (so it's available). At best, this is a 50-50 proposition.

Thus, we can see that in terms of timing and scheduling (and productivity), more often than not, an onsite workshop is better than waiting for the right external class at the right time and hoping it comes before it's too late. I have a friend who tells a great - albeit tragic - story about registering and waiting to attend an upcoming webinar on step-by-step FDA inspection readiness only to have the FDA show up on the morning of to begin their inspection. Needless to say, she and her team missed the webinar.

 

Customization

Simply put, for anything external - attendance at a class or industry conference or a generic compliance webinar - customization does not exist. Period. You get what the webinar, conference, and third-party planners involved believe will bring them the greatest amount of attendees (i.e., revenue) so it's always hit-or-miss as to how helpful any external event will be to your specific questions, concerns and needs.

On the other hand, an onsite workshop can be just as generic if you fail to work with the trainer/consultant to ensure customization that you need.

Here's the process I usually go through:

1. Initial discussion - this could be through email or phone
2. Draft high-level outline and agenda of the workshop - the goal here is to make sure I'm hitting all the big issues of concern and to get my host to think "Hmm...what else?"
3. Second discussion - often this is a teleconference with the host and his/her colleagues to discuss very specific questions within those bigger items they need answers on
4. Draft the workshop presentation - this gets sent to the host to review
5. Finalize the presentation and handouts

The point is that by the time I arrive to conduct the workshop, my host and his/her colleagues knows that they will get all the answers to their questions. This is a great feeling to have heading into an FDA compliance training session.

I also like to make sure to leave time on the agenda to do more than just Q&A, I love to get hands-on walkthrough of their processes and facilities in order to really bring home the points I made. This is what I'll call the fourth consideration, "Free Consulting."

 

Free Consulting

One topic I'm often asked to speak on is 21 CFR 11 or Part 11 compliance - what it looks like today, how to go about it cost-effectively, how FDA enforces Part 11 today, etc.

So, invariably, I run the workshop, and then, as part of the agenda, I spend a few hours with the team walking around to their various points of concern - in the factory, in the labs, in the offices. In essence, I'm taking them on a walkthrough of a mock FDA inspection.

And it's fascinating watching folks who, just minutes ago were nodding their heads at "don't share passwords," go to a computer system to login, announce "Oh, this is Mike's login - no problem, here's his password" (and they lift up the keyboard to reveal a sticky note of userIDs and passcodes).

Of course, I raise my eyebrows and say, "ahem." And everyone pauses, confused for a split second - and then, voila, the training sinks in. "Ohh...."

This is what I call "free consulting" - spending a few hours doing a real-world walkthrough of issues and questions in your environment when all you've paid for is an FDA compliance training workshop.

 

Final Thoughts

When you bring in someone to conduct an onsite workshop, make sure that individual comes with good recommendations - don't just pick someone because they spend $10,000 a month on Google advertising and their ad popped up first. Look at their previous attendee testimonials (there should be more than three or four), ask to see the trainer's resume/CV. Find out if they are willing to sign your non-disclosure agreement (it is your information, questions, etc., afterall).

Make sure that you and your team will have real-world, tangible - and accomplishable - next steps to take home as part of the training. Ensure that helpful handouts - checklists, article reprints, etc. - will be provided. And find out if the trainer is willing to be contaced over the next few weeks after the training with follow-up questions.

All of these will help customize your training experience and help you rapidly show a positive ROI.

 

Upcoming Events

Don't forget to join me:

April 26: How to Captivate Your Audience with Compliance Training

April 30: Step-by-Step Guide to FDA Inspections

May 23: FDA and Qualifying Virtual Suppliers

From the NIH - Biotechnology Landscape 2020

Last week I spoke to the NIH biotechnology business leadership in Bethesda, Maryland. To the standing room only crowd, I laid out the challenges that we face over the next decade - the rising cost of new drug development, the increasingly poor odds of success using traditional development methods, and the insidious risks associated with a push for more and more revenue while being slow to adopt more modern, proven (at least outside the biopharmaceutical industry) means of new product development.

Here are some the statistics I provided based on years of research and information gathering:

• From lab to market, the chance of success is 1 in 205
• And only 1 in a 1,000 to turn a profit
• And only 1 in 5 will break even
• 75% of all prescriptions in the US are for low-cost generics
• Only 33% of all biopharmaceutical firms are based in the US
• 47% of all R&D in US biotechnology companies is completely outsourced - those firms have zero labs
• Over the next 18 months, the 8 big pharma/biotech companies will lose - from loss of patent protection - more money than the entire GDP of the continent of Africa and 90% of the continent of Latin America

As you can see, looking to "emerging markets" (such as Africa and Latin America) is not going to make up for the lost revenue. In addition, countries from China to Germany to Italy are mandating cuts in pricing to all drugs - new and old.

I then discussed potential ramifications:

• Big bio/pharma firms stuck with organizational structures and departmental fiefdoms may be too slow to adapt, leading to constant rounds of cost-cutting (i.e., layoffs and outsourcing) and mergers
• Small, nimble and largely virtual companies - biotechs, combination device firms, small pharmas - will fill the void left by struggling big pharma

These are not new predictions - others have made them before - but then I went on to discuss some impacts to the job market for biotechnology. Here, on the blog, I'll simply mention that over the next decade, we should plan for:

• Project-based employment (such as a contractor/consultant/outsourced vendor)
• LIttle company loyalty for those not vested in the small pharma, virtual biotech startup
• Need to keep our job skills honed - technology/scientific skills are easily atrophied and in a global economy, it is more likely a small business employer will hire a different contractor/outsourced vendor rather than spend money on training anyone not part of the small company
• The increasing adoption of new product development methodologies such as quality by design
• A serious need for data integrity expertise for all the various clinical trials and studies
• The need for cost-effective, streamlined quality systems - you can't comply inefficiently in a small company

A number of the attendees asked superb questions and offered some really great insights. One discussion we had revolved around how to lower the cost of healthcare overall, which in turn would then help lower the cost of medicines in a more controlled manner (rather than the precipitous patent cliff). One scientist visiting from Mexico noted that when a patient goes to the hospital, in order to keep overhead low, patients are given the opportunity to buy any drugs needed themselves rather than going through the hospital.

I look forward to talking with the group again next year. It's always quite energizing to layout the challenges and see folks willing to roll up their sleeves, get creative and get problem solving. For all the worries around the landscape ahead, I think we're growing a cadre of entrepreneurial scientists and engineers who will surmount the hurdles ahead.

From the Annual Personal Care Products Council Science Symposium

Last week, I served as the keynote quality speaker at the international Personal Care Products Council's 2011 Science Symposium in Newark, New Jersey. The turnout was very impressive - every where I went, rooms were packed - more so than any conference I've attended in recent years. A great number of the attendees had a solid grasp of the challenges they faced and were looking for real-world solutions and advice. It's always a good sign when the majority of conference attendees are managers, directors and vice-presidents.

One positive comment that came up with everyone I spoke to was an appreciation for how the PCP Council had organized the symposium. Far too many conferences force attendees to choose amongst specialized niche tracks - quality issues just for device makers, quality issues just for biologics, quality issues for supplier management, and so on. It's always been my opinion that while such niche specialty tracks have the potential to better focus the advice provided, the reality is that an attendee ends up missing out on far too many cross-industry best practices and missing key learnings from how other industries are tackling similar challenges.

The PCP Council's symposium consolidated the tracks into two options:  one focused just on scientific-oriented challenges and speakers, and one focused on quality and regulatory issues and speakers. Breaks and lunches were timed together to ensure that attendees mingled and networked with each other, the speakers and the sponsors in one central refreshment area.

Not being a microbiologist, I happily attended the quality and regulatory workshop and listened to several fantastic talks on cleaning validation best practices and the current state of GMPs in the EU. Now, cleaning validation is not exactly a topic that grabs my interest, but I have to admit that the two speakers were not only excellent but they really brought to life the challenges and the available solutions with stories, diagrams, and step-by-step suggestions.

Karyn Campbell from the FDA gave a superb overview of the new process validation guidance, discussing not only the structure of how process validation should be conducted (from process design to process qualification to continuous process verification), but the intent behind the revisions. She noted that the new process validation really takes as its core an almost quality-by-design-"esque" mindset that focuses on controlling the process from its initial conception through on-going monitoring and continuous improvement. She noted that FDA really likes how some companies are using continuous process verification through "out of trend" results to avoid "out of spec" problems, to continuously monitor processes to correct for process drift over time.

There were, of course, the usual presentations on current challenges such as dealing with suppliers, but these didn't arouse that much audience interest because I think we all recognize the challenges we face. Personally, I'd like to see more speakers stop delving into just the challenges and start offering specific supplier quality tips, advice and solutions. Now, let me step off my soapbox and contrast that with an experience I'd had the day beforehand, serving on a supplier quality management expert panel at the Intermountain Biomedical Association's annual conference in Salt Lake City, Utah.

Myself and the other two panel members (a former FDA director and a current biomedical firm director) walked attendees through a number of specific steps to take to improve supplier oversight programs from the 20th century to the 21st century. We covered a lot of ground, from key tactics stemming from the heparin scandal (see my newsletter, SmarterCompliance #43, July 2010) to making better use of the Internet when it comes to supplier due diligence and monitoring. If you attended the risk-based supplier management workshop I gave in August with my friend Dan O'Leary, then you know exactly the type of "do-this, don't-do-that, this-seems-to-work-better-than-that-tactic" type of advice that we started to get into at the IBA conference panel discussion.

As a side note, if you were unable to attend either the August workshop or the IBA panel discussion, you can request the workshop for your company by contacting me directly.

As I thought about the IBA panel experience while listening to several of the speakers simply review supplier management challenges at the PCP symposium, I realized that a conference planner has to walk the same sort of line that a good speaker treads:  you need to give enough valuable information that you satisfy attendees, keep them interested and encourage them to come back, but not too much so that an attendee interacts with you once, never to contact you again. It's a line that's impossible to balance across without slipping to one side or the other.

I look forward to attending the PCP symposium and the IBA conference next year. I hope I'll see you there.

Results from Annual FDA Supplier Quality Congress

Supplier quality management is complicated enough.  Yet, too often, we shoot ourselves in the foot, making supplier qualification and oversight more complicated, more removed from business realities than necessary.  This was the common theme amongst speakers and attendees at FDAnews' third annual Supplier Quality Management Congress.

I was fortunate enought to chair the three day event, from August 9th-11th, with speakers from FDA, pharma and device firms, and suppliers to the industry. To start the conference, my friend, Dan O'Leary, and I provided a half-day workshop on practical approaches to cost-effective supplier qualification and management.  A standing-room only event, the workshop went extremely well and far too quickly, with a good mix of conversation, Q&A, and laughter.  Below are two slides excerpted from our workshop:

We provided attendees with a set of implementation tools in PDF, Word and Excel format:

• Supplier quality ranking radar chart
• Overall process map for supplier qualification
• Sample SOP for supplier selection and qualification
• Audit checklist
• Base questionnaire for all suppliers
• A more comprehensive questionnaire for more critical suppliers
• Supplier re-evaluation form

Throughout the half-day pre-con workshop, we worked through various excercises and questions, and provided copies of multiple regulatory guidance documents as well as items used internally by FDA to train their inspectors.  The workshop was very lean compliance-minded.  We focused on how to actually implement compliant and effective vendor qualification and oversight to meet FDA, GHTF, and ICH harmonized requirements (with a little ISO thrown-in).

We also discussed differences and expectations - including cost ranges - for mock FDA audits versus more laser-focused, single process audits.  While many of us are aware of mock FDA inspections, one tactic I'm increasingly advocating as a more cost-effective, more risk-based approach for supplier oversight is critical process audits.  As I conceive of it, a critical process audit of a supplier is much like a mock FDA audit or third-party supplier qualification audit, but is ONLY focused on one or two critical processes at the supplier.  Thus, it provides the same level of third-party, independent verification, but at lower cost because it only looks at supplier processes critical to your product or compliance status.

As an example, think of a supplier such as a contract sterilizer.  Do you really need to know about their CAPA process and their training procedures?  Maybe.  But put this in the context of what you're using that supplier for - sterilization services - and the context of your business and available budget.  Is it better to spend your budget on one big mock FDA audit of a single supplier, OR spend your money on multiple audits of the critical processes that you are using multiple suppliers for?  In other words, should you spend $10K on a mock FDA audit of a contract sterilizer when, for that same $10K, you could hit five different suppliers by spending $2K to audit the contract sterilizer's sterilization processes, then another $2K on a different supplier's critical activity for you, then another $2K on a third supplier and their critical activity, and so on.

By relying on a judicious  mix of remote qualification (e.g., a supplier qualification), contractual agreements and monitoring, and laser-focused audits of the critical processes actually directly relevant to your product, you minimize your risk, meet FDA, GHTF and ICH requirements, AND maximize your funds.  It's a win for you, a win for your company (and your management team), a win for compliance, AND a win for the suppliers (because they don't need to devote multiple days to hosting your audit team).

The key is to select processes strictly on the basis of current and/or intended use of the supplier using a risk-analysis of their impact to your product (and your compliance).

Some of the other key learnings fro the conference included:

• FDA has really stepped up its border enforcement and product holds (and such holds can be based solely upon "appearance")
• When it comes to supplier agreements, FDA is increasingly examining the concept of "authority" - did the person approving and signing the quality agreement have the authority to commit the company and the capability to enact the terms of the agreement
• Counterfeiting of medical devices is growing (as anticipated in Get to Market Now!, pp. 106-108)
• Do not write into your SOPs that all suppliers will have a quality agreement as some suppliers will simply refuse (even if you are the 800-pound gorilla in the relationship) and you will then be in non-compliance with your own SOPs
• Courts are increasingly looking at the preamble of the regulations as a means test to determine the intent behind the written regulations
• FDA is growing increasingly frustrated with companies who hire consultants whose only qualification is that they are "ex-FDA" or "former FDA" (as one FDA safety officer noted, "Just because someone worked for FDA does not mean they are experts or that they understand current rules and expectations - how many of your former employees would you suggest someone pay as an 'expert' on your company?")
• When dealing with virtual suppliers, your internal supplier controls are paramount
• In any agreement with a supplier make sure you work with your legal department to define a "material breach" - is a material breach a deficiency in the supplier's quality system? Is it more than 3 days of a shipping delay? Is it a reject rate greater than 20%?
• For any supplier qualification process and supplier management process, plan ahead to determine what documented evidence you will want to retain to prove compliance AND limit your liability
• Make sure you understand the document retention requirements for both FDA and other associated regulations - firms need to have an FDA records retention policy, and ideally one that can also meet EU lifecycle document management expectations

Obviously, in three days' time, with a dozen different expert speakers, there was far more information and insight into compliant supplier qualification than I can cover here.  More analysis and recommendations will be in several of my regulatory intel newsletter issues later this year.

60 Helpful Pharma Sites

Based on the acclaim received for my sold-out presentation on the best 60 websites for device professionals earlier this year, FOI Services is hosting me for a special presentation on the best 60 websites for pharma and biotech executives on May 24.

I'll be running through 60 of the most useful sites - including some specific subsections of the FDA site - that I've found over the past 11 years. I'll show you each site and discuss it's most helpful aspects (IMHO). Along the way, I'll impart tips and tricks on how, in less than 15 seconds, to judge if a website is going to be helpful.

For instance, check out laboratoryretriever.com, a site dedicated to contract labs, CROs, and so on. Here's my slide for laboratoryretriever.com  [editor note - as of January 2015, this site no longer was functioning]:

As you can see, I'm quickly communicating the key benefits to a site on the slide, leaving me free to discuss some of the more subtler uses of the site and other tips. The trick is understanding what a site is useful for, and then how best to share the site and use it in your environment.

I've divvied up the presentation into five main sub-sections:

• New drug development and open innovation sites
• Marketing insights
• Regulatory compliance advice and help
• Industry organizational sites
• Reference and miscellaneous sites

Plus I have several bonus "creative downtime" sites you can enjoy (at work or at home).

Registration for the special pharma session is now open through FOI Services. Learn more, read testimonials from attendees of the device website session, and register at: http://www.foiservices.com/tc-docs/moreinfo/may2411.html

Between now and then, if you have a favorite site to suggest - pass it along!

FDA Expectations of Senior Management Webinar

ExpertBriefings is hosting me giving a 1 hour condensed version of my half-day workshop on FDA expectations of senior management in overseeing quality management systems.

I'll be discussing specific FDA warning citations around poor management oversight, identifying the most common challenges faced by executives and firms, the core components of an effective management oversight program, and then examples of each.

• What are the key elements of a management controls SOP?
• Which mistakes are so grave that they will generate a warning letter?
• How extensive does my involvement need to be?

These and other very logical questions are voiced by executives at many FDA-regulated firms.  And this widespread confusion only underscores how regulations do not provide pragmatic answers.  Take advantage of this webinar to learn practical answers that FDA inspectors, shareholders and executives alike all agree upon.

The webinar will take place this Tuesday (March 29) at 2:00 PM eastern time. More information from ExpertBriefings follows:

FDA is increasingly citing companies and naming executives for failure to ensure an effective quality system, failure to ensure SOPs are being followed, and failure to enforce policies and procedures. Under FDAAA 2007, the agency has the power to levy civil penalties on individual executives and withhold approval of new drugs and devices.

What You Will Learn:

• What the FDA expects of senior management when it comes to quality system and compliance infrastructure oversight
• Five crucial challenges to overcome to avoid FDA enforcement action
• How the inspector will determine if a quality system is being managed effectively
• What will prompt FDA to publicly name you … and how to avoid it
• Seven steps to take every year to prove effective oversight of SOPs and policies
• How to ethically limit your personal exposure as an officer of the company

You will receive the ICH Q10 guidance with emphasis on management accountability, FDA warning letter samples that cite poor executive oversight, and OIG’s compliance program guidance for executives.

You can register on-line here.

If you can't make the webinar this Tuesday, consider purchasing the recorded version either through ExpertBriefings.com or Ceruleanllc.com.

Find details on my other upcoming FDA compliance speaking events here.  And if you'd like to request my speaking services - either at your own event or to run a corporate FDA compliance workshop, you can do so through the Cerulean FDA workshop and training website section.

Reminder: Virtual Supplier Webinar March 22

Just a friendly reminder that Elsevier will host me speaking on the challenge of qualifying and monitoring virtual suppliers. I will provide a five-step lean compliance strategy that has worked in multiple industries, not just for pharma and device firms.

The webinar will take place this Tuesday (March 22) at 1:00 PM eastern time. More information from Elsevier follows:

In early 2010, Congress sent the FDA a letter detailing its concerns about how they were not adequately overseeing the industry’s use of suppliers. The letter particularly focused on suppliers that are "virtual" companies. These companies have no physical, brick-and-mortar facility. The suppliers who were involved in the Heparin scandal are one such example. Since that time, the FDA has increased its scrutiny of the supplier qualification processes.

Last year, John Avellanet, based on his decades of working in and with virtual suppliers, taught officials from the FDA and Health Canada the essential elements of an effective virtual supplier selection, qualification and oversight program.

Now is your chance to get a look at some of the same information that was given to FDA directors and inspectors.

You can register here.

Find details on my other upcoming FDA compliance speaking events here.