Compliance Zen

FDA Inspection Handling – 10 FAQs and Tips for 2014

FDA inspections are stressful and worrisome.  Failed FDA inspection costs include sales revenue loss, stock price decline, and public embarrassment from FDA warning letters and FDA-483 observations.

Every so often, it’s good to recalibrate by looking at frequently asked questions when it comes to FDA inspections.  I’ve gathered these questions, answers and tips over the past two years with clients, and with current and retired FDA officials.  When reading through these FDA inspection FAQs, use your own best judgment or that of an FDA expert you’ve hired to help you succeed.

 

1.  Does FDA look at and trend product liability litigation for food, drugs, medical devices, cosmetics, etc. in order to figure out which companies to inspect?

Yes.  The FDA is not blind to reality.  FDA’s charter is to protect public safety.  If people, through product liability litigation, are having to take matters into their own hands to go after companies for putting ineffective or unsafe products on the market, FDA could be seen as not performing its task.  So yes, FDA pays very close attention to product liability litigation.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and Larry Spears, retired FDA Deputy Director for Regulatory Affairs

 

2.  How does an FDA investigator prepare for an inspection?

Prior to an inspection, the investigator(s) will create an inspection plan that is largely based on the following information:

• Any previous establishment inspection reports (EIRs)
• Any previous FDA Form 483 observations, especially those that require follow-up
• Company responses (to FDA-483s) and commitments
• Firm’s website (including product literature, executive profiles, physical location profiles, recent press releases, etc.)
• Consumer complaints that have come in since the last inspection
• Adverse events that have come in since the last inspection
• Any recalls or other field activities that have occurred since the last inspection
• Any product submissions and applications, specifically to find critical components or ingredients or processes that were of concern to FDA reviewers
• Online research through the web.

Online web research can be further broken into three main areas:

• Online videos of your products in use (including if consumers have posted videos comparing/contrasting to other competing products, etc.)
• Social media sites (especially for complaints about your product)
• Searches for your company name or product name(s) along with key words (such as “review” or “fraud” or “FDA”).

- summarized from Rachel Harrington, FDA, Office of Regulatory Affairs and Tim Wells, retired FDA Team Leader for the QSIT Project

An effective, independent FDA compliance gap analysis can help you pinpoint areas to strengthen in your compliance efforts before the FDA investigator arrives.

 

3.  Is a follow-up inspection (a closeout inspection from a warning letter) still a “regular” inspection?

Yes.  FDA investigators treat a closeout or follow-up inspection as a normal inspection.  You can be cited for new or additional items.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs

 

4.  Do pre-approval inspections (PAI) rely upon QSIT, and if so, what level are they?

PAI inspections are Level 2 QSIT inspections by default.  FDA reviewers of a submission will identify areas of concern for the investigator to look at during the inspection (such as GCP data integrity controls).  PAI inspections may cover everything from nonclinical supporting GLP-compliance, through GCP compliance, to GMP compliance, and even delve into how the company will monitor and control the product once it is approved and on the market.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, Erin McFiren, FDA, Office of Regulatory Affairs, and Tim Wells, retired FDA Team Leader for the QSIT Project

A level 2 QSIT inspection is a comprehensive inspection, covering all four major quality system subsystems - management controls, development, CAPA, and production and process controls – as well as reviewing the remaining three subsystems (facilities and equipment controls, materials and supplier controls, and records controls) throughout as these three subsystems cut across all four major subsystems.  Thus, 21 CFR 11 controls will be reviewed and inspected throughout the PAI, not just during review of the design and development (e.g., design control) subsystem.  Learn more about the details of Level 2 QSIT inspections at the FDA:  www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm244267.htm

 

5.  Will FDA investigators ask for supplier audit reports?

FDASIA 2012 expressly granted FDA the power to require supplier audit reports during regular inspections (see Title VII of FDASIA).  That said, by internal policy, FDA discourages investigators from asking for the report in the hopes that this will encourage firms to be more candid and clear in supplier audits.  Unfortunately, as was painfully shown during the recent Heparin scandal, FDA’s hope has not panned out.  Far too many firms conduct “meet and greet” supplier audits with little meaningful impact.  Thus, increasingly FDA investigators are taking advantage of FDASIA’s new powers and requesting copies of supplier audit reports.

It should also be noted that FDA has always requested supplier audit reports under various conditions as identified in the FDA Compliance Policy Guide, section 130.300, FDA Access to Results of Quality Assurance Program Audits and Inspections (www.fda.gov/ICECI/ComplianceManuals/CompliancePolicyGuidanceManual/ucm073841.htm):

• During directed or “for cause” inspections of a sponsor or monitor of a clinical trial
• In inspections where access to such records is authorized by statute (such as FDASIA)
• When public safety is at risk
• In litigation (or in support thereof)
• When executing a search warrant
• When a firm’s internal audit program is insufficient or otherwise deemed ineffective by FDA.

This last point is often overlooked.  Technically, if the FDA investigator writes down a Form FDA-483 observation that a firm’s quality audit program is insufficient, the FDA investigator can then review the firm’s supplier audit reports.  (Note:  Personally, I’m not aware of any incidents where this has occurred, and so I encourage you to be cognizant that an effective quality system audit program is necessary to show FDA you are overseeing your suppliers appropriately.)  It is thus in a firm’s interest to ensure that it has a robust, FDA supplier audit program that can withstand both FDA investigator and product liability litigator scrutiny.

Finally, always remember that FDA counts any corrective actions from supplier audits as CAPA documentation and freely open to review by any FDA investigator.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and Rachel Harrington, FDA, Office of Regulatory Affairs

 

6.  How does computer validation play into regular inspections?

As of the end of 2013, FDA’s special enforcement of 21 CFR 11 (e.g., "Part 11") is still ongoing.

Part 11 will come up throughout an inspection as it is a regulation that cuts across all quality system subsystems. If records are used or kept in digital form, or if a computerized system is used to automate a regulated process (such as production, lab testing, etc.), then the FDA investigator will ask Part 11-relevant questions.

FDA looks to see if you are verifying the functions that you use of a software or a computerized system in your environment, especially those functions related to data integrity.  For instance, with a  spreadsheet macro, the FDA investigator will expect to see a simple verification of your use of the macro in your environment, documented with a validation protocol, document testing, and a summary report.  Do not validate Excel, just the use of the macro within your environment.  Questions that the FDA investigator might ask include:  How do you know the results of the macro are correct?  Are complete?  Did not drop off various data inputs?  and so forth.  These types of Part 11 validation are the ones to concentrate on.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and David Chesney, retired FDA District Director

 

7.  How does FDA handle a situation when – during photo taking during the inspection – confidential patient information and/or trade secret information is accidentally captured in the photograph?

FDA treats all photographs, videos, documents, notes, etc. as confidential.  All such items go through FOIA to redact such sensitive information before they are released.

- summarized from David Chesney, retired FDA District Director

Personally, I suggest you consider making sure to identify in your inspection notes what photographs the FDA investigator took; if possible, take a similar photograph.  Then, in your response to the inspection, make sure to identify the photograph and any specific confidential or trade secret information that may have inadvertently been captured by the FDA photograph.  This will help FDA to redact the appropriate information while providing you some degree of assurance that they understand and acknowledge the situation.

 

8.  Where is FDA on adapting or accepting remote or online/virtual inspections?  Is FDA ready for online/remote inspections like a number of other notified bodies?

FDASIA 2012 granted FDA the power to conduct remote and even online/virtual inspections.  However, FDA is currently not positioned to take advantage of this.  The agency is planning to start a pilot program wherein part of the inspection will be conducted remotely (e.g., remote document review) followed by a briefer onsite inspection portion.

Keep in mind that at its core, FDA is a regulatory enforcement agency.  As such, during inspections, it is technically collecting evidence.  For companies doing all the right things, it is in their interest to have FDA investigators physically visit and see firsthand how well the company is doing.  For firms with more … “soft” …. approaches to compliance, a remote or online/virtual inspection has less of a chance to uncover gaps.  FDA is well aware of this.  In order to address this, expect FDA over the next few years, to take a two-step approach to an inspection:  part one is a remote review of policies, SOPs, etc., (presumably through PDFs sent to the agency); this will then inform and shape part two, the onsite inspection.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, and Rachel Harrington, FDA, Office of Regulatory Affairs

When I conduct FDA compliance gap and remediation analyses, I prefer this two-step approach because it provides a high degree of efficiency, effectiveness, and enhanced ROI for everyone involved.

 

9.  What are “management discussion items” and what are the implications to a firm?

Management discussion items are non-compliance observations not written onto the Form FDA-483.  Management discussion items are compliance deviations that the FDA investigator believes to be of lesser significance than the documented 483s.

However…

Management discussion items can still end up as warning letter citations because the FDA district office or FDA head office believes they are more serious than originally assumed. Thus, if you address management discussion items in your response to FDA, you may want to notify the district that you are working to resolve the items as well as the written 483 observations.

Keep in mind that to FDA, as long as an observation of non-compliance was documented in the FDA investigator’s notes, written on a Form FDA-483, or spoken about to a firm's management, FDA considers the observation “documented by FDA.”  FDA is, at its heart, an enforcement agency collecting evidence when it conducts an inspection.

Finally, be aware that management discussion items can be treated as repeat violations if found again in a follow-up or a second FDA inspection.

- summarized from Rachel Harrington, FDA, Office of Regulatory Affairs, Erin McFiren, FDA, Office of Regulatory Affairs, and David Chesney, retired FDA District Director

 

10.  How long after an inspection will we receive a copy of the EIR (Establish Inspection Report) and/or any warning letter?

Technically, up to 45 days after the inspection.  In reality, depending on the type, depth, and other FDA inspection conditions, it can be up to 3-6 months after the FDA investigator leaves.  Nonetheless, your FDA inspection response and remediation plan is still due to the agency within 15 business days after departure of the FDA investigator.

- summarized from Lori Lawless, FDA, Office of Regulatory Affairs, Tim Wells, retired FDA Team Leader for the QSIT Project, and Larry Spears, retired FDA Deputy Director for Regulatory Affairs

 

If you have any further questions, or need help complying cost-effectively with FDA regulations, please contact me through my consulting firm, Cerulean Associates LLC.

Majority of Mobile Health Apps Class II Devices for FDA

A June interview with FDA’s Bakul Patel, author of FDA's draft guidance on mobile medical apps, revealed that the majority of mobile health apps FDA has reviewed to date are classified as Class II Medical Devices.  Of the 27,000 medical apps available today, FDA has reviewed less than .003%.  Classifying even ten percent of the 27,000 medical apps as Class II Medical Devices risks bringing FDA to its knees, dramatically increasing the number of inspections and enforcement actions FDA needs to take each year.

As more developers around the world jump into the fast paced medical app business, the problem will get worse.  Compounding this is the lifespan of the average mobile app:  14 months.  And during that time, the app will be significantly revised or completely rewritten 3-4 times.  In device terms, that’s a new model every 3-4 months. And yet FDA needs an average of 67 days to review a medical app.  So by the time FDA has finished its review and clearance, the version the agency reviewed may well be obsolete.

This is going to be problematic if the majority of mobile medical apps are classified as Class II Devices as suggested by FDA's draft guidance on mobile medical apps.

Class II Medical Devices are higher risk than Class I devices.  Example Class II devices today include powered wheelchairs and infusion pumps.  Class II devices require their maker to fully comply with FDA's Quality System Regulation (21 CFR § 820) and the Medical Device Reporting (21 CFR § 803) rules, from design control to supplier (including distributor) qualification to postmarket monitoring.  Assuming a firm takes a traditional approach to compliance with the QSR and MDR, their cost of doing business will increase an average 30%.

Many questions about QSR and MDR compliance for medical apps abound.  Is Apple a distributor of the medical mobile app?  What about Google’s Android store?  Or Amazon.com?  How should a maker of a mobile health app qualify Google or Amazon.com or Apple?  If a user posits a poor review and bug problems he/she had on the app store’s reviews section, what responsibility does the developer – or Apple or Google – have to consider that user review for postmarket reporting?  How strict will FDA be in inspecting and enforcing design controls when device models completely change every 3-4 months.  Far too few firms today get design control right with an 18 month development lifecycle.  What is the agency’s compliance expectation for a 90-day development lifecycle?  And for apps that include the ability for a healthcare provider to enter patient data and track treatment plans, for instance, who is responsible for ensuring the app is 21 CFR § 11 compliant such that any data within it has integrity, much less remains confidential and private?

FDA’s current draft guidance on mobile medical apps is woefully short of such practical specifics.  And yet it’s these specifics that will get even the most forthright medical app developer in trouble with FDA-483s and Warning Letters.  Warning Letters have been shown to reduce product sales by at least 8% the first year and for three years thereafter.  For many of these developers, a Warning Letter might be the kiss of death and bring a painful chill to the innovation marketplace.

FDA will need to tread carefully in its final guidance.  I am less concerned about apps that clearly turn a smartphone into a medical device or diagnostic tool (a perfect example is the recent “It Has Come to Our Attention Letter” to Biosense Technologies in California for its mobile medical app, uChek Urine Analyzer).  I am more concerned about missteps in two areas:

1.  Misinterpretations around technological capabilities vis-à-vis wellness versus treatment versus diagnosis.  Many mobile medical apps help healthcare providers and patients track conditions – from weight loss to insulin levels.  It seems to me that FDA’s draft guidance identification of apps doing calculations as Class II devices is extremely broad.  After all, if my weight loss app calculates my body mass index, doesn’t that technically meet the criteria defined by FDA:  “Apps that act as calculators or utilize algorithms to produce an index, score, scale, or other similar calculations.”  And what if my doctor decides to rely upon that to prescribe a weight loss drug or exercise regimen?  Or a clinician, in the midst of a clinical trial, decides that this is how he/she is going to verify and track dosing?

2.  Enforcement of the QSR and MDR requirements.  How will FDA enforce these regulations given the enormous numbers of medical apps and the comparative dearth of FDA investigators and reviewers?  Few app developers today use anything like design control for their rapid development and release cycle.  And many medical app developers are virtual companies.  What is the actual likelihood they will comply versus simply shutdown shop after 14 months (the lifespan of their app) only to re-open under another name?  Think about how the video game development industry operates.  Game studios open and close all the time.  Individual developers jump ship to form a new studio, release a game, and then shut down the studio, only to reform with a slightly different group of developers and reopen a new studio 30 days later.  I can easily foresee this happening in the mobile medical app space, particularly as more and more overseas developers join the fray.  FDA can clarify all it wants that app developers need to register as device makers and comply with the QSR and MDR, but enforcement needs to be realistic to work.  The ability of an app maker to open up, develop the app, sell it for 14 months, and then close up shop faster than FDA can realize the app even existed is going to make for a lot of frustration in FDA, in the marketplace, and among patients and providers.

While FDA continues its case-by-case enforcement and tries to craft guidance-based rules in which to understand and frame the fast-paced mobile health landscape, the market marches forward at double time.

Let’s hope mobile medical app makers are not surprised when FDA finalizes the rules of the game.

FDA Training Records - Three Risky Challenges

Companies train their personnel in all sorts of FDA-related activities, from quality system SOPs to core regulatory requirements to company policies. Training is a common requirement of nearly all FDA regulations, from Part 11 to 21 CFR 820.

• What about training should be documented?
• What should be retained and for how long?
• Should training records be tied to individual personnel files or can we simply record group training?
• How do I go about figuring out who should be trained on what?

These questions carry with them significant risks - for FDA compliance, for product liability litigation, and for personnel-related allegations. When I give FDA compliance training workshops, webinars and speeches, many questions about training and training records often boil down to these tricky issues. Below, I'll answer a few aspects:

 

What specifically does FDA require us to document about training?

In only one place does FDA spell out specific items to document, in 21 CFR 111.14(b)(2) Current Good Manufacturing Practices for Dietary Supplements. FDA states:  “You must make and keep the following records:  Documentation of training, including the date of the training, the type of training, and the person(s) trained.”

At minimum, I suggest that ALL firms, irrespective of industry, follow the minimum specifics listed in 21 CFR 111.14. All the other regulations provide a summary statement similar to the one in 21 CFR 820.25(b):  “Training shall be documented.”

Unfortunately, in part because of these ambiguous requirements, a bad habit of using group attendance sheets has arisen over the years. Such group attendance sheets are easy, they get passed around, people sign their name, and voila – regulatory requirements met…right?

No.

Group sign-in sheets have multiple inherent weaknesses that - as many firms have discovered -  undermine compliance. For instance:

•  When did the individual sign?  Did they walk into training 5 minutes before the session ended and sign the sheet?   Did they walk out of training as soon as they signed the sheet to “take a quick call” and never return?
•  Was it actually that individual?  How often does someone match the signatures against a signature log?
•  How does signing a group “I showed up” sheet prove “I understand the training and I agree to abide by the training” with any level of accountability?

The reality is that most group attendance sheets go into a file drawer and are never seen again. FDA investigators understand that group attendance sheets prove little. In fact, in 32% of product recalls, FDA traced the root cause to ineffective training (US Federal Register, Vol 78, Iss. 11, 16 January 2013).

The proposed 21 CFR 117 specifically ties training to individual personnel records, eliminating the ability to use group sign-in sheets to prove FDA compliance. Supervisors are to be trained differently than line workers. And supervisors will have a responsibility to “ensure” that employees understand their obligations. Group sign-in sheets will not accomplish this.

Group sign-in sheets carry further risks for a company in two increasingly common situations:

• Product liability litigation
• Personnel discrimination or wrongful termination allegations.

Multiple US laws and regulations tie retention of training records to individual personnel files and roles performed. A 2008 SCOTUS ruling (CBOCS West, Inc. v. Humphries) on the statute of limitations in Section 1981 of Title VII (42 USC 1981) determined that job-related training records – such as training on SOPs – are examples of proof that can be used to show a company discriminated (or conversely, used to prove that a company did not discriminate) for several years after an employee's departure. As a result, firms now keep job-related training records for the duration of an employee’s term with the company plus at least two years (e.g., "date of departure + 2 years").

So how does your Quality group track the employment durations of each individual with your company?  Or perhaps they are planning to keep every single group sign-in sheet for at least 30+ years?

These are just some of the reasons why group sign-in sheets for training now cause more risks and problems than they solve.

 

What record(s) should I retain to prove personnel were trained appropriately and understood the training?

With my clients that I help either in FDA quality system consulting or in FDA recordkeeping consulting, I recommend retaining two record types:

1. Training Matrix
2. Individual Certificate of Acknowledgement

 

About the Training Matrix

A Training Matrix can be as simple or as complex as you desire, from a basic Excel spreadsheet to an Oracle or SQL database of some sort. Using an Excel spreadsheet, the left-hand column should list all the organization’s personnel; the top row should list all the potential training that could be received (specific SOPs or policies, regulations, etc.). The grid is then filled in either with the date last trained or with a shaded cell to indicate “not necessary.” Feel free to come up with other designations for date scheduled, type of training (“in person” vs. computer-based vs. “read-and-review”), and so on.

The purpose of the Training Matrix is two-fold:

1. Tracking who needs to be trained on what versus who has already completed training; AND
2. Quickly and easily showing an outside auditor or regulatory investigator the current “state of training.”

From a retention standpoint, the Training Matrix is what’s termed a “living” document. It’s constantly updated.

That said, from a risk-mitigation standpoint, I suggest my clients take an annual snapshot of the Training Matrix and archive that annual snapshot for a period of years equal to their local state statute of limitations such as 3 years or 6 years. Such a snapshot of a "living document" is not required under any regulation, it’s simply a precaution to allow the firm to quickly and easily trace who had training on what and when without having to cull through individual personnel records. It's a reminder that the Training Matrix is designed to be practical and user-friendly throughout.

With any luck, the Training Matrix is as far as the FDA investigator will need to go. However, deeper dives into specifics of what a person was trained on within a particular training session as well as the how the supervisor ensured the training was effective look to Individual Certificates of Acknowledgement.

 

About Individual Certificates of Acknowledgement

In each individual personnel record is the Individual Certificate of Acknowledgement.

An example Certificate of Acknowledgement documents the following items:

•  Topic of training session
• Date of training session
• Key responsibilities/requirements covered in the session
• Individual’s acknowledgement that he/she understands his/her obligations
• Individual’s agreement to comply with the requirements/obligations
• Supervisor’s review and agreement to supervise the individual to the requirements/obligations.

Not only does this comply with both the intent of the regulatory requirements, it also has a critical added benefit:  since the 1950s, studies have shown that this type of written, individual acknowledgement consistently improves compliance by up to 89%.

This is why the individual Certificate of Acknowledgement (or “Commitment” or “Understanding” or whatever word you want) is so powerful:

• Improves compliance by 89%
• Complies with all current US laws, court interpretations and regulations associated with training records.

One tool to comply with multiple regulations and strengthen compliance at the same time:  that’s a lean compliance technique.

 

How do I begin to create role-based training assignments when there might be hundreds or thousands of SOPs and policies?

The key challenge is to avoid getting lost in the details. Training everyone on everything is nice in theory, but breaks down quickly in practice; the larger an organization, the more unwieldy and ineffective the training will become.

Traditionally, there are two choices in how to tackle role-based training:

• Work with your local HR/personnel department to idenfity overall training requirements for each functional group; OR
• Work with each functional leader (department heads, team leads, etc.) to do the same.

I advocate a more practical, flexible lean compliance approach:

Assemble a temporary, working group of representatives from each functional area and HR to carve out initial sets of "buckets." In essence, everyone in functional group X gets trained on SOPs 1 and 2; everyone in functional group Z gets trained on SOPs 2, 3, and 4; everyone in functional group A, gets trained on SOPs 4, 5, and 6; and so on.

That's the core initial population of the Training Matrix.

Then, I take that initial populated draft of the Training Matrix and go to each department head to review, tweak, answer questions, and verify. After the quick verification sessions with the department heads, the Training Matrix is now fully populated, the functional heads and their direct reports are happy, and so is HR. It's a win-win-win.

And I don't worry about "is the Training Matrix perfect?" because it is - as I noted above - a "living document" that will get modified as time goes on.

This can also help reduce the drag of training on productivity. The more time spent in training, the less revenue-generating work is completed. Thus, the goal of the business is to have the minimum amount of training necessary; in other words, to balance compliance with profitability.

 

FDA lean compliance provides a company defensibility with records while reducing overhead, strengthening compliance, and improving profitability.

To learn more, visit my firm's website at www.ceruleanllc.com or read previous client stories and testimonials.

From the Pharma Contracting and Outsourcing Conference

This past week I was invited to speak at the Contract Pharma Contracting and Outsourcing Conference in New Jersey, where I spoke on how to sell compliance to senior management.

All too often we assume that compliance is an essential requirement when choosing a critical supplier. And the yet, when cost becomes the deciding factor, compliance becomes compromised or even forgotten for the sake of the bottom line.

Given that more people are hurt each year by toilets than receive FDA warning letters or FDA-483s, the threat of FDA enforcement is hardly a credible compliance encouragement. And so I opened day two of the conference by speaking on how lean FDA compliance can:

• save money
• enable greater revenue and profitability
• simplify compliance
• and generate easy metrics to both support those results and prove effective compliance to FDA.

I was followed by Addam Reynolds, a Consumer Safety Officer with FDA's New Jersey district office who spoke on recent FDA inspectional findings and trends. Mr. Reynolds summarized a number of trends in FDA-483s, comparing the previous year to this one. I've reproduced two of his summary tables below.

As we looked at the data, Mr. Reynolds made several explanatory comments of what was behind the numbers.

First, many of the new investigators now with FDA are well-versed in laboratory and manufacturing operations. A number of new hires have come from those laid off by the pharma industry - an irony not lost on attendees. With increased familiarity of modern-day manufacturing and laboratory settings comes increased scrutiny. Thus the increases in citations for noncompliance with 21 CFR 211.63 and 211.160(b)(4). Mr. Reynolds noted that "Firms are either not qualifying their equipment and instruments at all, or are not doing it right."

Second,the number of citations for 21 CFR 211.68(b), controls over computerized systems, is, in Mr. Reynolds insight to FDA thinking, "really about data integrity and data security." This continues FDA's special enforcement of Part 11 as a rule governing electronic data and records integrity; an enforcement approach that was officially announced in 2010. As Mr. Reynolds noted, most Part 11-relevent 483s happen because firms continue having systems "with little to no data integrity controls."

As I've written about extensively, been interviewed on, and consulted on, Part 11 is less about validating computers per se, and more about ensuring data integrity. To that point, validation is simply a means to an end. The most recent issue of my client newsletter, SmarterCompliance #68, explains in-depth how to use data mapping as a technique to simplify and streamline Part 11 compliance.

The rest of Contract Pharma's conference featured more excellent speakers on various contracting and supplier management issues, including site selection criteria, what to do when your CMO goes bankrupt, and more. If you've not attended this two-day conference before, I encourage you to do so next September. Attendees and speakers are focused on frank conversations about overcoming real-world challenges. I'll be there speaking. I'm thinking of doing something on parallels between choosing a puppy and choosing a supplier - lessons learned and puddles cleaned.

If you're looking for more lean compliance events, check my upcoming workshops and speaking events page on my website. In the near term, I'll be speaking:

• September 25 - webinar on overseeing and verifying Part 11 compliance of your records at critical suppliers
• October 3 - Part 11 enforcement today for OTC manufacturers
• October 11 - webinar on best practices for quality system management reviews (a new requirement under the new EU GMPs Chapter 1 going into effect in January)

I hope you'll join me at one of these events.