Compliance Zen

Five FDA Part 11 FAQs

As part of my work with FDA data integrity and Part 11 compliance, I typically address dozens of unique client questions around data integrity and cost-effective Part 11 compliance. And yet, in nearly every consulting engagement, conference speech, or private data integrity corporate workshop, people naturally end up asking a handful of fairly similar questions.

Below are five frequently asked questions that I often receive around Part 11 and data integrity:

 

1. What are some specific trigger events that should cause us to re-evaluate - or at least take a quick review of - our progress on data integrity and Part 11 compliance?

Clearly one trigger event is when the FDA (or a sister agency such as EMA) publishes a new regulatory guidance document related to Part 11 or data integrity, even if it may not appear - at first blush - that the guidance applies to your business. A perfect example is the 2013 FDA guidance, Blood Establishment Computer System Validation in the User's Facility.

Another trigger event might be if your organization makes a major policy or process change related to record retention. For instance, if your firm moves away from a traditional "print and retain" model of keeping required records to a more electronic archiving model. This would be a point wherein you would want to review your FDA recordkeeping policies and procedures, update them as necessary, and then pair them with a review of your data integrity controls around long-term data archival. Do you have the right policies in place? A good data archival retrieval auditing and sampling process? Has the process for data archival been validated?

A third trigger event to consider is if your organization undertakes a new business partner or a new supplier that will be creating regulated data on your behalf, storing regulated data on your behalf, or otherwise manipulating and processing regulated data on your behalf. Typical examples include a new contract research organization or a new contract manufacturing organization. Getting a data integrity audit of critical suppliers is increasingly a "must-do," especially for firms dealing with clinical data.

 

2. If our data is completely electronic - we use no paper source data at all - is there a requirement to print out our data in order to retain it for long-term storage?

No. Organizations are allowed to retain their data in a completely digital format. You can verify this by reviewing the various US-based data integrity regulations and FDA recordkeeping regulations (this list is valid as of January 2015). In the US specifically, the Uniform Electronic Transactions Act (UETA) and the Federal Rules of Civil Procedure (FRCP) require courts and government agencies to accept original source data and original signatures that are digital as long as some level of controls have been put in place to ensure the data (and any signatures) have integrity; thus, for FDA, those controls are spelled out in 21 CFR 11 Electronic Records; Electronic Signatures.

 

3. If we have some records in other languages and we do internal translations - including manual verifications by native speakers of that language - do the systems on which we do the translation work need to be Part 11 compliant?

No, in part because you are doing manual verifications of the translations by individuals fluent in that language. If your translation process was completely automated - say you were using Google Translate - and really had no clue if the translation was proper, accurate, grammatically correct, etc., and this was for records required under FDA statutes or regulations, Part 11 compliance would probably be the least of your issues. Part 11 is only designed to ensure that a digital record and signature are just as trustworthy as a similar paper record and ink signature.

If you had a paper, typed record translated by someone and you had no way to know or verify that the person's translation was correct, proper, grammatically logical, etc., you'd still have the exact same issues. Since you don't know the trustworthiness of the original record in its original language, you don't know whether the translated version of the record is accurate, complete, etc. That's one of the reasons that translation services use multiple translators to double- and triple-check each translation, and provide a certificate of accuracy.

It's my opinion that leaving the translation of a regulated record up to an automated translation software - no matter how good - without some level of post-translation verification is a huge risk, especially for FDA required records and records dealing product safety, efficacy and regulatory compliance.

 

4. In six months, we're moving to a new electronic system that will be validated for our complaint handling and CAPA handling processes - can we just tell the FDA investigator this and not worry about showing progress toward meeting Part 11 compliance?

Technically, if this was the only system that the investigator decided needed to be validated, and you could show some level of proof of purchase, the project plan, the vendor qualification status, and so on, then you *might* not need to worry. In reality, however, it is exceedingly unlikely that the FDA investigator will only see the need to confine Part 11 compliance and data integrity controls to just your complaint and CAPA data.

If you review both Part 11 and its preamble, as well as nearly all the Part 11 guidance that FDA has published since 2000, it should be clear that FDA consistently expects all the electronic records that you rely upon to make decisions around product safety, efficacy, and regulatory compliance to have integrity. In addition to validation, other data integrity controls need to be in place (validation cannot, by itself, for instance, prevent data fraud). Thus, you will want to have a plan - such as a site master validation plan or site master data integrity compliance plan - on which you can show progress and show how you ensure data integrity across the record lifecycle, from initial data creation to long-term data archival.

Lastly, it's important to always keep in mind that an audit or inspection is simply a "snapshot in time." So not having any progress on Part 11 will still likely net you a Form FDA-483 observation, but the proof you can show of impending validation completion plus all the current additional data integrity controls you do have might be able to mitigate that 483 enough so that you do not receive a Warning Letter citing poor data integrity. When I hold data integrity workshops, one of the significant section we always discuss is around all of the various data integrity controls that you can have beyond just "validation." Ironically, it's been my experience that many organizations do have multiple data integrity controls operating, they just don't realize it - or call them out as such - and so they do not get credit from FDA.

 

5. Is there any guidance available from FDA for qualifying or validating Excel spreadsheets?

Yes, although it's not a "guidance for industry" per se. FDA has published it's internal policy for how it expects Excel spreadsheets used for scientific calculations, formulations, macros, etc., to be validated. So one activity my clients undertake with is to review the FDA process Development and Validation of Spreadsheets for Calculation of Data, and then craft a reasonable, pragmatic spreadsheet macro validation SOP. It's important not to go overboard when applying controls to spreadsheets and trying to validate macros. If you review that FDA process, you'll see that if it takes you more than a day or two to validate a typical spreadsheet, you're probably doing too much - and that's a clear indication that you will save money, reduce your risk, and benefit from expert help on how to streamline and simply Part 11 compliance and FDA data integrity.

 

 

Are there any questions you frequently find come up in your organization around Part 11 or digital data integrity?  Comment below or contact me directly.

FDA Training Records - Three Risky Challenges

Companies train their personnel in all sorts of FDA-related activities, from quality system SOPs to core regulatory requirements to company policies. Training is a common requirement of nearly all FDA regulations, from Part 11 to 21 CFR 820.

• What about training should be documented?
• What should be retained and for how long?
• Should training records be tied to individual personnel files or can we simply record group training?
• How do I go about figuring out who should be trained on what?

These questions carry with them significant risks - for FDA compliance, for product liability litigation, and for personnel-related allegations. When I give FDA compliance training workshops, webinars and speeches, many questions about training and training records often boil down to these tricky issues. Below, I'll answer a few aspects:

 

What specifically does FDA require us to document about training?

In only one place does FDA spell out specific items to document, in 21 CFR 111.14(b)(2) Current Good Manufacturing Practices for Dietary Supplements. FDA states:  “You must make and keep the following records:  Documentation of training, including the date of the training, the type of training, and the person(s) trained.”

At minimum, I suggest that ALL firms, irrespective of industry, follow the minimum specifics listed in 21 CFR 111.14. All the other regulations provide a summary statement similar to the one in 21 CFR 820.25(b):  “Training shall be documented.”

Unfortunately, in part because of these ambiguous requirements, a bad habit of using group attendance sheets has arisen over the years. Such group attendance sheets are easy, they get passed around, people sign their name, and voila – regulatory requirements met…right?

No.

Group sign-in sheets have multiple inherent weaknesses that - as many firms have discovered -  undermine compliance. For instance:

•  When did the individual sign?  Did they walk into training 5 minutes before the session ended and sign the sheet?   Did they walk out of training as soon as they signed the sheet to “take a quick call” and never return?
•  Was it actually that individual?  How often does someone match the signatures against a signature log?
•  How does signing a group “I showed up” sheet prove “I understand the training and I agree to abide by the training” with any level of accountability?

The reality is that most group attendance sheets go into a file drawer and are never seen again. FDA investigators understand that group attendance sheets prove little. In fact, in 32% of product recalls, FDA traced the root cause to ineffective training (US Federal Register, Vol 78, Iss. 11, 16 January 2013).

The proposed 21 CFR 117 specifically ties training to individual personnel records, eliminating the ability to use group sign-in sheets to prove FDA compliance. Supervisors are to be trained differently than line workers. And supervisors will have a responsibility to “ensure” that employees understand their obligations. Group sign-in sheets will not accomplish this.

Group sign-in sheets carry further risks for a company in two increasingly common situations:

• Product liability litigation
• Personnel discrimination or wrongful termination allegations.

Multiple US laws and regulations tie retention of training records to individual personnel files and roles performed. A 2008 SCOTUS ruling (CBOCS West, Inc. v. Humphries) on the statute of limitations in Section 1981 of Title VII (42 USC 1981) determined that job-related training records – such as training on SOPs – are examples of proof that can be used to show a company discriminated (or conversely, used to prove that a company did not discriminate) for several years after an employee's departure. As a result, firms now keep job-related training records for the duration of an employee’s term with the company plus at least two years (e.g., "date of departure + 2 years").

So how does your Quality group track the employment durations of each individual with your company?  Or perhaps they are planning to keep every single group sign-in sheet for at least 30+ years?

These are just some of the reasons why group sign-in sheets for training now cause more risks and problems than they solve.

 

What record(s) should I retain to prove personnel were trained appropriately and understood the training?

With my clients that I help either in FDA quality system consulting or in FDA recordkeeping consulting, I recommend retaining two record types:

1. Training Matrix
2. Individual Certificate of Acknowledgement

 

About the Training Matrix

A Training Matrix can be as simple or as complex as you desire, from a basic Excel spreadsheet to an Oracle or SQL database of some sort. Using an Excel spreadsheet, the left-hand column should list all the organization’s personnel; the top row should list all the potential training that could be received (specific SOPs or policies, regulations, etc.). The grid is then filled in either with the date last trained or with a shaded cell to indicate “not necessary.” Feel free to come up with other designations for date scheduled, type of training (“in person” vs. computer-based vs. “read-and-review”), and so on.

The purpose of the Training Matrix is two-fold:

1. Tracking who needs to be trained on what versus who has already completed training; AND
2. Quickly and easily showing an outside auditor or regulatory investigator the current “state of training.”

From a retention standpoint, the Training Matrix is what’s termed a “living” document. It’s constantly updated.

That said, from a risk-mitigation standpoint, I suggest my clients take an annual snapshot of the Training Matrix and archive that annual snapshot for a period of years equal to their local state statute of limitations such as 3 years or 6 years. Such a snapshot of a "living document" is not required under any regulation, it’s simply a precaution to allow the firm to quickly and easily trace who had training on what and when without having to cull through individual personnel records. It's a reminder that the Training Matrix is designed to be practical and user-friendly throughout.

With any luck, the Training Matrix is as far as the FDA investigator will need to go. However, deeper dives into specifics of what a person was trained on within a particular training session as well as the how the supervisor ensured the training was effective look to Individual Certificates of Acknowledgement.

 

About Individual Certificates of Acknowledgement

In each individual personnel record is the Individual Certificate of Acknowledgement.

An example Certificate of Acknowledgement documents the following items:

•  Topic of training session
• Date of training session
• Key responsibilities/requirements covered in the session
• Individual’s acknowledgement that he/she understands his/her obligations
• Individual’s agreement to comply with the requirements/obligations
• Supervisor’s review and agreement to supervise the individual to the requirements/obligations.

Not only does this comply with both the intent of the regulatory requirements, it also has a critical added benefit:  since the 1950s, studies have shown that this type of written, individual acknowledgement consistently improves compliance by up to 89%.

This is why the individual Certificate of Acknowledgement (or “Commitment” or “Understanding” or whatever word you want) is so powerful:

• Improves compliance by 89%
• Complies with all current US laws, court interpretations and regulations associated with training records.

One tool to comply with multiple regulations and strengthen compliance at the same time:  that’s a lean compliance technique.

 

How do I begin to create role-based training assignments when there might be hundreds or thousands of SOPs and policies?

The key challenge is to avoid getting lost in the details. Training everyone on everything is nice in theory, but breaks down quickly in practice; the larger an organization, the more unwieldy and ineffective the training will become.

Traditionally, there are two choices in how to tackle role-based training:

• Work with your local HR/personnel department to idenfity overall training requirements for each functional group; OR
• Work with each functional leader (department heads, team leads, etc.) to do the same.

I advocate a more practical, flexible lean compliance approach:

Assemble a temporary, working group of representatives from each functional area and HR to carve out initial sets of "buckets." In essence, everyone in functional group X gets trained on SOPs 1 and 2; everyone in functional group Z gets trained on SOPs 2, 3, and 4; everyone in functional group A, gets trained on SOPs 4, 5, and 6; and so on.

That's the core initial population of the Training Matrix.

Then, I take that initial populated draft of the Training Matrix and go to each department head to review, tweak, answer questions, and verify. After the quick verification sessions with the department heads, the Training Matrix is now fully populated, the functional heads and their direct reports are happy, and so is HR. It's a win-win-win.

And I don't worry about "is the Training Matrix perfect?" because it is - as I noted above - a "living document" that will get modified as time goes on.

This can also help reduce the drag of training on productivity. The more time spent in training, the less revenue-generating work is completed. Thus, the goal of the business is to have the minimum amount of training necessary; in other words, to balance compliance with profitability.

 

FDA lean compliance provides a company defensibility with records while reducing overhead, strengthening compliance, and improving profitability.

To learn more, visit my firm's website at www.ceruleanllc.com or read previous client stories and testimonials.

From the Pharma Contracting and Outsourcing Conference

This past week I was invited to speak at the Contract Pharma Contracting and Outsourcing Conference in New Jersey, where I spoke on how to sell compliance to senior management.

All too often we assume that compliance is an essential requirement when choosing a critical supplier. And the yet, when cost becomes the deciding factor, compliance becomes compromised or even forgotten for the sake of the bottom line.

Given that more people are hurt each year by toilets than receive FDA warning letters or FDA-483s, the threat of FDA enforcement is hardly a credible compliance encouragement. And so I opened day two of the conference by speaking on how lean FDA compliance can:

• save money
• enable greater revenue and profitability
• simplify compliance
• and generate easy metrics to both support those results and prove effective compliance to FDA.

I was followed by Addam Reynolds, a Consumer Safety Officer with FDA's New Jersey district office who spoke on recent FDA inspectional findings and trends. Mr. Reynolds summarized a number of trends in FDA-483s, comparing the previous year to this one. I've reproduced two of his summary tables below.

As we looked at the data, Mr. Reynolds made several explanatory comments of what was behind the numbers.

First, many of the new investigators now with FDA are well-versed in laboratory and manufacturing operations. A number of new hires have come from those laid off by the pharma industry - an irony not lost on attendees. With increased familiarity of modern-day manufacturing and laboratory settings comes increased scrutiny. Thus the increases in citations for noncompliance with 21 CFR 211.63 and 211.160(b)(4). Mr. Reynolds noted that "Firms are either not qualifying their equipment and instruments at all, or are not doing it right."

Second,the number of citations for 21 CFR 211.68(b), controls over computerized systems, is, in Mr. Reynolds insight to FDA thinking, "really about data integrity and data security." This continues FDA's special enforcement of Part 11 as a rule governing electronic data and records integrity; an enforcement approach that was officially announced in 2010. As Mr. Reynolds noted, most Part 11-relevent 483s happen because firms continue having systems "with little to no data integrity controls."

As I've written about extensively, been interviewed on, and consulted on, Part 11 is less about validating computers per se, and more about ensuring data integrity. To that point, validation is simply a means to an end. The most recent issue of my client newsletter, SmarterCompliance #68, explains in-depth how to use data mapping as a technique to simplify and streamline Part 11 compliance.

The rest of Contract Pharma's conference featured more excellent speakers on various contracting and supplier management issues, including site selection criteria, what to do when your CMO goes bankrupt, and more. If you've not attended this two-day conference before, I encourage you to do so next September. Attendees and speakers are focused on frank conversations about overcoming real-world challenges. I'll be there speaking. I'm thinking of doing something on parallels between choosing a puppy and choosing a supplier - lessons learned and puddles cleaned.

If you're looking for more lean compliance events, check my upcoming workshops and speaking events page on my website. In the near term, I'll be speaking:

• September 25 - webinar on overseeing and verifying Part 11 compliance of your records at critical suppliers
• October 3 - Part 11 enforcement today for OTC manufacturers
• October 11 - webinar on best practices for quality system management reviews (a new requirement under the new EU GMPs Chapter 1 going into effect in January)

I hope you'll join me at one of these events.

 

From the Medtech QA/RA Global Conference

New European medical device regulations are due within 18 months. The new rules will update the current Medical Device Directives (MDDs) for the 21st century, and close the gaps so brutally uncovered by the PIP scandal and the metal-on-metal issues. Industry is proactively adjusting their quality systems and regulatory compliance programs while key executives are encouraging EU regulators to avoid US-style over-regulation.

These were the principle themes infusing the two-day Medtech QA/RA Global Access 2012 conference hosted by the Irish Medical Device Association (IMDA) in Galway, Ireland last week. With over 250 medical technology companies calling Ireland home, including 11 of the top 13 device firms in the world, Ireland has become Europe's center of excellence for devices. And IMDA's Medtech meeting is Ireland's flagship conference.

Much of Day One was devoted to discussions of the planned MDD revisions, with speakers from the European Commission, the European Parliament, the Irish Medicines Board (IMB), Eucomed (the Advamed of Europe), and industry. Europe encourages "responsible innovation" by relying more upon vigorous postmarket surveillance, inspections and adverse event reporting rather than any pre-approval scheme such as the FDA's 510k. Instead, the EU has only pre-market assessments and the CE mark. IMB's Ann O'Conner noted that 65% of vigilence reporting leads to product recall and removal. This state of affairs, with its regulatory burden primarily on the postmarket stage, allows for rapid inclusion of new technology, and new scientific and engineering innovation, an approach I advocated in my latest book, Get to Market Now.

The EU's new MDDs will require a number of elements that are outlined in Global Hamonization Task Force (GHTF) guidelines such as:

• Summary technical evaluation document (STED);
• Unique device identifiers; and
• Adoption of the GHTF's four risk categories for medical devices.

For readers of my client newsletter, SmarterCompliance, adoption of GHTF guidelines should come as no surprise. FDA is moving to GHTF inclusion as well, albeit a bit more slowly than Europe. Whether FDA's "slowly but surely" pace of harmonized rule adoption will inadvertently put US-based device makers at a disadvantage on the global marketplace remains to be seen. European parliamentary elections are scheduled for June 2014, so expect the new MDDs to be in place by then if not sooner.

In addition to a high-level presentation by FDA on "possible, eventual 510k updates," the rest of Day One was taken up with surveys of the state of device regulations in India, China, Russia, the Middle East and North Africa.

Day Two of the conference saw speakers delve more deeply into practical implications and challenges behind the new rules. One set of challenges will be the new clinical rules in the updated MDDs. The IMDA is hosting a two-day conference later this year to address the new EU clinical evidence rules.

I had the privilege of presenting on elements of a defensible record-keeping program for complaint handling and medical device reporting. The message I had for attendees was two-fold:

First, it is clear that complaint handling records and complaint files hold both regulatory and legal risks. Focusing only on quality system compliance can leave a firm vulnerable to disgruntled customers increasingly willing to file a lawsuit to get monetary compensation. Thus, quality auditors must also assess the content of complaint records to help minimize risk to their companies.

Second, complaints can come into a device company through more than just "official" channels. Whether a complaint is made to the saleswoman manning a conference booth or to the company vice-president speaking to a patient advocacy group, each person dealing with the public must receive some level of complaint handling training.

As with any in-person compliance speech or workshop I provide, I gave attendees handouts to help with both of these issues:  an internal quality auditor checklist for reviewing complaint files and a list of complaint documentation do's and dont's.

The next IMDA Medtech conference is scheduled for 2014 just as the new EU MDDs come into force. It promises to be an exciting event, so keep an eye out for announcements.

In the meantime, consider attending some of these events where I'll be offering advice on optimizing your quality system and regulatory compliance programs:

• June 14 teleconference on defensible documents
• June 22 speech on the role of IT departments in effective regulatory compliance
• July 25 teleconference on effectively managing an FDA inspection
• July 31 workshop on 21st century supplier management and qualification

More upcoming lean compliance events can be found on my upcoming events page on the Cerulean website.

Lowering Product Liability Risk with Supplier Due Diligence

Earlier this year, I spoke with medical product liability expert and lawyer, Sara Dyson, now an executive with MedMarc Insurance Group. As part of March's SmarterCompliance newsletter, her interview focused on ways to reduce drug and device product liability risks through effective supplier due diligence and vendor qualification.

Some excerpts:

 

SmarterCompliance:  Does a product liability lawsuit emerge fairly quickly once the product is distributed or a clinical trial is run?

Dyson: On average, it takes about two years after the original problem for the lawsuit to materialize. This is why companies are so easily caught off guard. It’s not the most recent batch or lot that rolled off the production floor that is the subject of a lawsuit; it’s an historical lot or batch.

The lawsuit may resurrect a problem that the company has already otherwise addressed. Firms without an effective records retention schedule and policy will suffer as far too many old documents that were eligible for destruction were, instead, kept and are now available to the plaintiff to make his/her case.

 

SmarterCompliance:  What makes the discovery phase of a lawsuit so dangerous? Is it because records, data, emails, samples, and so on from at least two years ago have to be turned over to the plaintiff’s lawyers?

Dyson:  Yes. That’s why both the initial due diligence and ongoing monitoring of suppliers is so important. You want to have a good track record of documents showing your efforts to consistently evaluate and oversee your suppliers.

Additionally, too frequently, companies have not implemented document management plans or have out-of-date record retention rules, meaning that there is an abundance of documents that must be sorted through to locate relevant information. This then bogs down the discovery process and increases costs.

 

It takes about two years after the original problem for a liability lawsuit to materialize.

 

SmarterCompliance:  What are some steps – beyond looking at additional research points during initial supplier evaluation – that supplier due diligence and oversight teams need to take?

Dyson:  You may want to hire a third-party expert to show your supplier oversight team members how to review supplier oversight records to find hidden gaps and risks. For instance, a sponsor of a clinical trial run by a contract research organization (CRO) might want to hire a third party to train their clinical project managers on how to review the CRO’s qualification of various clinical sites, sort of a train-the-auditor type of session.

 

To read the rest of the interview and see all nine critical points that Ms. Dyson recommends be incorporated into your supplier management and qualification program, you'll need to subscribe to the monthly regulatory intelligence and quality system newsletter, SmarterCompliance.

You can read more ways to reduce medical products liability risks at MedMarc.

FDA Compliance Training - Onsite Workshop or Offsite Class?

Which is better - hiring a consultant to come and conduct an onsite workshop for my team or sending folks out to various third-party classes and industry conferences?  Well, to paraphrase the FDA, it depends.

There are three typical considerations:  cost, time, and customization. Some folks add "networking" and while I think there is truth to this, valuable networking is often outside the scope of your control. The person you send to the conference or class could be rather introverted, or the other attendees are not that interested, and so on. Thus, in terms of weighing the considerations, I don't add "networking," and instead add "expert advice specific to me."

Any measure of return on investment (ROI) has to address all four of these - and especially so for FDA compliance training or FDA quality systems training wherein cost control is a simple business reality. So let's look at each in turn, and use this to help make the determination.

 

Cost

The cost of training - whether an internal workshop or sending a team to external training - boils down to the following:

• Per attendee registration fee
• Per attendee travel
• Per attendee training material

All things being equal, if we treat the trainer(s) as an "attendee" then the cost of an inhouse workshop is always cheaper than the cost of sending a team to an external activity.

Example

Assume a team of 10 and 1 trainer.

To send the team out will require 10 registration fees, 10 travel expense sets, and 10 sets of training material.

To bring the trainer internally will require 1 "registration fee" (workshop cost) that may be equal to the cost of 10 different registrations, so we should expect only a small savings here (if the registration fee is $500 per person and the internal workshop is $5,000, it's equal). The 10 sets of training material will still have to be purchased, so no savings here. But savings does come from reducing travel from 10 people down to 1. Unfortunately, for many companies, this comes out of a different budget (travel vs. training line items) and thus may not serve as a true savings to a department (although it is an overall company savings).

If we look at computer-based training such as attending a compliance teleconference/webinar or purchasing a recorded version, we can often get the cost down for the "registration" and eliminate the travel. As we'll see below, though, this eliminates the ability to achieve the other 3 factors, starting with timing.

 

Time/Schedule

To put it simply, to have someone out of the office - regardless of the technology tools you give them - costs productivity. Most of us view travel time as (some degree of) time away from the office or, at minimum, reduced work intensity level. Thus, while we check email and might work on Word or Excel or Powerpoint documents, by and large, we are not as productive traveling as are when we're plugged in at the office, available for spur of the moment questions, meetings, informal discussions, and so on.

Thus, time spent traveling to training acts as a drag on productivity.

There is also the additional challenge - and a very real one in today's fast-paced business climate - the schedule. If an external class or conference, or a webinar, is not held when we need it, then we don't go. Or the timing of the event might be incredibly inconvenient - maybe only 2 of the 10 team members can attend.

Conversely, with an onsite workshop, the timing and scheduling is up to you. You are in complete control. And this degree of control is hard to beat.

The only exception is IF - and that's a big IF - a pre-recorded FDA compliance/quality system webinar or teleconference happens to have taken place before you needed it (so it's available). At best, this is a 50-50 proposition.

Thus, we can see that in terms of timing and scheduling (and productivity), more often than not, an onsite workshop is better than waiting for the right external class at the right time and hoping it comes before it's too late. I have a friend who tells a great - albeit tragic - story about registering and waiting to attend an upcoming webinar on step-by-step FDA inspection readiness only to have the FDA show up on the morning of to begin their inspection. Needless to say, she and her team missed the webinar.

 

Customization

Simply put, for anything external - attendance at a class or industry conference or a generic compliance webinar - customization does not exist. Period. You get what the webinar, conference, and third-party planners involved believe will bring them the greatest amount of attendees (i.e., revenue) so it's always hit-or-miss as to how helpful any external event will be to your specific questions, concerns and needs.

On the other hand, an onsite workshop can be just as generic if you fail to work with the trainer/consultant to ensure customization that you need.

Here's the process I usually go through:

1. Initial discussion - this could be through email or phone
2. Draft high-level outline and agenda of the workshop - the goal here is to make sure I'm hitting all the big issues of concern and to get my host to think "Hmm...what else?"
3. Second discussion - often this is a teleconference with the host and his/her colleagues to discuss very specific questions within those bigger items they need answers on
4. Draft the workshop presentation - this gets sent to the host to review
5. Finalize the presentation and handouts

The point is that by the time I arrive to conduct the workshop, my host and his/her colleagues knows that they will get all the answers to their questions. This is a great feeling to have heading into an FDA compliance training session.

I also like to make sure to leave time on the agenda to do more than just Q&A, I love to get hands-on walkthrough of their processes and facilities in order to really bring home the points I made. This is what I'll call the fourth consideration, "Free Consulting."

 

Free Consulting

One topic I'm often asked to speak on is 21 CFR 11 or Part 11 compliance - what it looks like today, how to go about it cost-effectively, how FDA enforces Part 11 today, etc.

So, invariably, I run the workshop, and then, as part of the agenda, I spend a few hours with the team walking around to their various points of concern - in the factory, in the labs, in the offices. In essence, I'm taking them on a walkthrough of a mock FDA inspection.

And it's fascinating watching folks who, just minutes ago were nodding their heads at "don't share passwords," go to a computer system to login, announce "Oh, this is Mike's login - no problem, here's his password" (and they lift up the keyboard to reveal a sticky note of userIDs and passcodes).

Of course, I raise my eyebrows and say, "ahem." And everyone pauses, confused for a split second - and then, voila, the training sinks in. "Ohh...."

This is what I call "free consulting" - spending a few hours doing a real-world walkthrough of issues and questions in your environment when all you've paid for is an FDA compliance training workshop.

 

Final Thoughts

When you bring in someone to conduct an onsite workshop, make sure that individual comes with good recommendations - don't just pick someone because they spend $10,000 a month on Google advertising and their ad popped up first. Look at their previous attendee testimonials (there should be more than three or four), ask to see the trainer's resume/CV. Find out if they are willing to sign your non-disclosure agreement (it is your information, questions, etc., afterall).

Make sure that you and your team will have real-world, tangible - and accomplishable - next steps to take home as part of the training. Ensure that helpful handouts - checklists, article reprints, etc. - will be provided. And find out if the trainer is willing to be contaced over the next few weeks after the training with follow-up questions.

All of these will help customize your training experience and help you rapidly show a positive ROI.

 

Upcoming Events

Don't forget to join me:

April 26: How to Captivate Your Audience with Compliance Training

April 30: Step-by-Step Guide to FDA Inspections

May 23: FDA and Qualifying Virtual Suppliers

Results from Annual FDA Supplier Quality Congress

Supplier quality management is complicated enough.  Yet, too often, we shoot ourselves in the foot, making supplier qualification and oversight more complicated, more removed from business realities than necessary.  This was the common theme amongst speakers and attendees at FDAnews' third annual Supplier Quality Management Congress.

I was fortunate enought to chair the three day event, from August 9th-11th, with speakers from FDA, pharma and device firms, and suppliers to the industry. To start the conference, my friend, Dan O'Leary, and I provided a half-day workshop on practical approaches to cost-effective supplier qualification and management.  A standing-room only event, the workshop went extremely well and far too quickly, with a good mix of conversation, Q&A, and laughter.  Below are two slides excerpted from our workshop:

We provided attendees with a set of implementation tools in PDF, Word and Excel format:

• Supplier quality ranking radar chart
• Overall process map for supplier qualification
• Sample SOP for supplier selection and qualification
• Audit checklist
• Base questionnaire for all suppliers
• A more comprehensive questionnaire for more critical suppliers
• Supplier re-evaluation form

Throughout the half-day pre-con workshop, we worked through various excercises and questions, and provided copies of multiple regulatory guidance documents as well as items used internally by FDA to train their inspectors.  The workshop was very lean compliance-minded.  We focused on how to actually implement compliant and effective vendor qualification and oversight to meet FDA, GHTF, and ICH harmonized requirements (with a little ISO thrown-in).

We also discussed differences and expectations - including cost ranges - for mock FDA audits versus more laser-focused, single process audits.  While many of us are aware of mock FDA inspections, one tactic I'm increasingly advocating as a more cost-effective, more risk-based approach for supplier oversight is critical process audits.  As I conceive of it, a critical process audit of a supplier is much like a mock FDA audit or third-party supplier qualification audit, but is ONLY focused on one or two critical processes at the supplier.  Thus, it provides the same level of third-party, independent verification, but at lower cost because it only looks at supplier processes critical to your product or compliance status.

As an example, think of a supplier such as a contract sterilizer.  Do you really need to know about their CAPA process and their training procedures?  Maybe.  But put this in the context of what you're using that supplier for - sterilization services - and the context of your business and available budget.  Is it better to spend your budget on one big mock FDA audit of a single supplier, OR spend your money on multiple audits of the critical processes that you are using multiple suppliers for?  In other words, should you spend $10K on a mock FDA audit of a contract sterilizer when, for that same $10K, you could hit five different suppliers by spending $2K to audit the contract sterilizer's sterilization processes, then another $2K on a different supplier's critical activity for you, then another $2K on a third supplier and their critical activity, and so on.

By relying on a judicious  mix of remote qualification (e.g., a supplier qualification), contractual agreements and monitoring, and laser-focused audits of the critical processes actually directly relevant to your product, you minimize your risk, meet FDA, GHTF and ICH requirements, AND maximize your funds.  It's a win for you, a win for your company (and your management team), a win for compliance, AND a win for the suppliers (because they don't need to devote multiple days to hosting your audit team).

The key is to select processes strictly on the basis of current and/or intended use of the supplier using a risk-analysis of their impact to your product (and your compliance).

Some of the other key learnings fro the conference included:

• FDA has really stepped up its border enforcement and product holds (and such holds can be based solely upon "appearance")
• When it comes to supplier agreements, FDA is increasingly examining the concept of "authority" - did the person approving and signing the quality agreement have the authority to commit the company and the capability to enact the terms of the agreement
• Counterfeiting of medical devices is growing (as anticipated in Get to Market Now!, pp. 106-108)
• Do not write into your SOPs that all suppliers will have a quality agreement as some suppliers will simply refuse (even if you are the 800-pound gorilla in the relationship) and you will then be in non-compliance with your own SOPs
• Courts are increasingly looking at the preamble of the regulations as a means test to determine the intent behind the written regulations
• FDA is growing increasingly frustrated with companies who hire consultants whose only qualification is that they are "ex-FDA" or "former FDA" (as one FDA safety officer noted, "Just because someone worked for FDA does not mean they are experts or that they understand current rules and expectations - how many of your former employees would you suggest someone pay as an 'expert' on your company?")
• When dealing with virtual suppliers, your internal supplier controls are paramount
• In any agreement with a supplier make sure you work with your legal department to define a "material breach" - is a material breach a deficiency in the supplier's quality system? Is it more than 3 days of a shipping delay? Is it a reject rate greater than 20%?
• For any supplier qualification process and supplier management process, plan ahead to determine what documented evidence you will want to retain to prove compliance AND limit your liability
• Make sure you understand the document retention requirements for both FDA and other associated regulations - firms need to have an FDA records retention policy, and ideally one that can also meet EU lifecycle document management expectations

Obviously, in three days' time, with a dozen different expert speakers, there was far more information and insight into compliant supplier qualification than I can cover here.  More analysis and recommendations will be in several of my regulatory intel newsletter issues later this year.

Building Compliance in India

This Spring I was invited to an International Informatics summit in Hyderabad, India with the aim of discussing global harmonization as a means to a competitive edge, especially when it comes to lab informatics. Hosted by the Waters corporation out of Germany, the two-day summit was an enlightening experience in which to participate and observe the sharing of knowledge about FDA-regulated data integrity inspections, informatics best practices, and the challenges faced by laboratories and manufacturers in an increasingly globalized marketplace.

Waters kindly distributed my latest book on turning FDA compliance to competitive edge to all the attendees as I gave the keynote address. My talk turned on how to take advantage of FDA’s increasing reliance on regulatory harmonization with the ICH, GHTF and PIC/S.

I noted how the FDA and the EMA have begun a pilot program to coordinate their reviews of quality-by-design submissions. Set to last until 2014, the pilot program is designed to ensure regulatory reviewers have calibrated their review criteria. If successful, companies can expect two things:

1. FDA will require quality by design-based submissions by 2015 or so; and
2. Companies will then need only compile one core submission (quality by design-based) with minor additions to meet both FDA and EMA requirements for marketing authorization for a new drug or biologic

Thus, given the time the required for a new drug to wend its way through the pipeline, now is the time to start collecting the data in the labs and in pilot plant manufacturing to enable such a harmonized submission.

To understand how important this simplified submission will be, a number of the speakers from local Indian pharmaceutical firms discussed their challenges when it came to informatics in their labs – both nonclinical setting and in manufacturing quality control.  Which data rules are important? If a test fails, some regulatory authorities allow a certain number of retests; others allow none. Which to abide by? Going by the most stringent would seem to be the most prudent, but it is also the most costly. And cost is a critical consideration given the revenues of most Indian pharma firms have fallen more than 30% since the worldwide economic struggles began in 2008. With no end in sight to economic malaise in the Western world, Indian pharmas are slowly turning their attention to the developing world and emerging economies of Latin America, Africa and the rest of Asia.

Informal discussions with Indian pharma CEOs and directors made me realize that this shift does not bode well for European and US Big Pharma dreams of entering and dominating these new regions. Indian pharma firms are much better positioned from a cost standpoint and an intuitive understanding of operating in up-and-coming economies than their Western counterparts. And given that most India pharmas are already manufacturing both brand name drugs and their low cost alternatives, the idea of Big Pharma – with its big costs, big overhead, big bureaucracies and 20^th century business practices – competing successfully in 21^st century emerging markets against the more lean, more hungry Indian pharmas must be met with some degree of skepticism.

To succeed, pharmaceutical firms in the US and Europe will need to take a page or two from India. The enthusiasm of Indian pharmaceutical executives, managers, and line workers is palpable. There is a tremendous desire in India to catch up with (and surpass) the West, and to stay at least one step ahead of the Chinese. This double pressure perception, from the top and the bottom, manifests itself in Indian pharmas aggressively scanning the horizon for every advantage they can grab – from new cutting-edge laboratory equipment to simplified, streamlined SOPs designed for ICH, GHTF and PIC/S compliance.

That said, Indian pharmas may – in some instances – be outrunning their compliance infrastructures. The May FDA Warning Letter to Aurobindo Pharma Limited found that environmental monitoring controls and finished product packaging and labeling operations were “inadequate.” While the FDA has few inspectors in India, that the agency can so readily find such inadequacies indicates that Indian pharmaceutical firms still have some ways to go to surpass their US and European counterparts.

From what I saw in Hyderabad, however, such a time is not far off. Indian pharmaceutical firms are taking advantage of India’s decades-old expertise in software development and innovation to re-apply quality lessons learned from IT into drug and biologics innovation.  And just as the Indian government provided tremendous subsidies and IT-based R&D tax benefits to Indian firms in the 1980s and 1990s, the Indian government has begun to offer similar such benefits to Indian firms and startups such as the Translational Health Science Technology Institute (THSTI). The THSTI was established in 2009 to speed the development of new drugs using a strategy taken directly from my book:  a collaborative drug development strategy, fostering collaborations among healthcare providers, hospitals, academic researchers and biotech companies. This 21^st century development collaboration is already gaining tremendous funding and support from healthcare foundations around the world, the most recent being from the Gates Foundation.

As Big Pharma struggles to shed layers of overhead and redundant sales forces while desperately casting about for ways to invigorate stale pipelines, Indian pharmaceutical firms are racing to succeed in the 21^st century, embracing quality by design, new laboratory equipment, cutting-edge software and lean compliance techniques. I look forward to watching their progress.

Cost of Drug Development Criticized

The journal BioSocieties has published a study critical of the cost estimates of new drug development used by PhRMA and the Tufts Center for the Study of Drug Development.  The article, Demythologizing the High Costs of Pharmaceutical Research, notes that PhRMA and Tufts claim costs 18 times higher than those analyzed and verified by the authors:  $43.4 million versus Tufts' $802 million and PhRMA's $1.3 billion.

While perfectly accurately costs are unlikely to ever appear without an international, agreed-upon set of "R&D accounting standards" followed by completely open books at thousands of small biotechs and Big Pharmas around the globe, the new medicine cost trend is clearly getting worse.  But is cost the *real* issue?

Some key facts (from Is Quality by Design Right for My Organization?):

1. The average time to market for a new biologic or drug is 10-15 years (1-2 years for discovery, 3-6 years for preclinical, 3-6 for clinical, 1-2 years for review and approval)
2. Only 8% of new biopharma compounds ever make it to market
3. Less than one-third of all approved new drugs ever recoup their investment costs
4. And once a generic hits the market, revenue from the drug declines 80%

So let's put this all in investment terms.   Pretend I want to offer you stock in a new company I'll call "Miracle Drug Inc" (MDI).  Now, there is only an 8% chance of this company (and your investment) surviving more than 10-15 years.  Would you like to invest?

Well, what if I told you that IF MDI survived, your stock will only have a 30% chance to be worth as much as you invested or to make money?  Otherwise, you have a 70% chance to just lose money.  Still want to invest?

And what if I told you that 8-12 years AFTER your stock actually broke even or made money, it would - guaranteed - lose 80% of its value (and never recover).

Which would give you a more reliable return-on-investment for your money?  Investing in MDI and its new miracle drug or hiding your money under your mattress?

This is the real problem - not whether it really costs $43.4 million or $802 million or $1.3 billion to bring a new drug to market - but how to improve the odds of success.  Ultimately, it doesn't matter how much a new medicine costs to bring to market as long as the company can make money.  But how many of us would give our money away with only an 8% chance divided by another 30% chance just to earn it back?

As I note in my latest book, Get to Market Now! Turn FDA Compliance into a Competitive Edge in the Era of Personalized Medicine, there are really eight powerful factors underlying all of this, and cost is only one:

1. Healthcare Cost.  Let's be blunt:  with declining birth rates, aging retirement populations, debt laden societies, and struggling economies, Western countries cannot afford the best of everything any longer. And those patients in emerging markets - from Latin America to China and India - do not make up a wealthy enough consumer base yet to reliably provide the revenue Big Pharma (much less Big Biotech) has grown used to.  In other words, the industry is facing customers who cannot afford the latest and greatest products.


2. Knowledge Specialization.  In my lifetime alone, we've gone from just general toxicologists to neurotoxicologists to proteomic-neurotoxicologists.  Knowledge - and information - has become so complex, so focused, that I count it as a miracle every drug on the market isn't immediately pulled off as every day seems to bring a new scientific advance that questions safety assumptions we held even two or three years ago.  This means that putting together a development strategy is like assembling a puzzle that grows more and more pieces every time you sit down.


3. Virtual Companies.  The advent of the Internet has allowed more and more firms to operate without an actual headquarters, without a manufacturing site, and so on; it's all contracted out or doesn't exist.  In the real world, how do you ensure that your new medicine is being manufactured safely or its distributors are storing the medicine properly when your manufacturer or distributor has no physical presence other than a website?


4. Generations and Demographics.  Demographics are working against biopharma companies and will continue to do so for the next two decades.  It may seem that lobby groups like AARP and other senior citizen associations help advocate for new biopharma drugs, but then you have to look at the articles in their newsletters and magazines to see their ratings of Internet pharmacies to get drugs cheap.  And make no mistake, there is a growing knowledge gap as experienced regulatory professionals retire all over the globe just as biopharma demands cutting-edge, personalized medicine regulatory experience.  Think of it this way:  Is it easier to simply retire or to have to spend your last few years getting up to speed on this new thing called "quality by design" and how it relates to personalized medicine?


5. Rapid Rate of Technology.  Technology is a two-edged sword.  On the one hand, it's wonderful that biopharma firms can so rapidly plow through lab testing of new molecular entities.  Conversely, because of the rapid rate of technological advancement, two challenges occur:  first, automated testing puts people (i.e., future customers) out of work, and second, the regulations can't keep up.  For the former, if your customer doesn't have a high-paying job, he/she can't afford your high-priced products.  And when it comes to regulations - did you know that when FDA was starting to write 21 CFR 11 on electronic records and computer validation, ALL the computer power on planet earth was LESS THAN the power in today's iPhone?  'Nuff said.


6. Globalization.  Let's face it, we have supply chains that go around the world at least once.  And if I can buy a new medicine for LOT less over the Internet, why wouldn't I?  How long will it be before a service exists that conducts random quality tests on Internet-purchased medicines to provide a guaranteed level of purity?  And let's add to that the dramatic increase in medical tourism.  When it's cheaper for customers to fly overseas to get an operation and medicine than it is to get the products and services from the hospital and pharmacy 3 miles down the road, our business model is not on the right path.


7. Increased Compliance Burden.  This isn't about more regulations or less regulations; companies have been complaining about regulations since the days of Hammurabi.  This is about the fact that the more I have to customize, tailor and personalize my new products to smaller and smaller sub-populations, the more clinical trials I have to conduct, the more quality audits I have to undertake, the more CAPAs and complaints I'll have to deal with, and so on.  In other words, the regulatory affairs and quality system approaches of last century seem increasingly out of touch with today's needs.


8. Overly Rigid Quality Systems.  In light of all of the above, more and more SOPs and policies seem out of step with business requirements in the 21st century:  flexibility, cost efficiency, and real risk reduction.  My goal with my lean compliance workshops and consulting is to at least tackle and solve this one issue outright (much less try to walk professionals and managers through solving the other challenges associated with FDA, ICH and/or GHTF compliance).

These eight real challenges inhibit new medicine success in the life sciences today. Don't get sidetracked with just one issue. And while there are no easy answers, I've outlined 113 specific tactics that do work in my latest book, along with the examples and case studies that show why these work.

If you'd like to learn more about the book, the publisher is allowing free downloads of the first chapter.  You can download the first chapter free of charge at the book's website, http://www.Get2MarketNow.com.  The site has links for ordering, as well as reader resources such as downloadable checklists, templates, mini-tutorials, helpful links and so on.

I look forward to hearing your thoughts.

 

FDA Expectations of Senior Management Webinar

ExpertBriefings is hosting me giving a 1 hour condensed version of my half-day workshop on FDA expectations of senior management in overseeing quality management systems.

I'll be discussing specific FDA warning citations around poor management oversight, identifying the most common challenges faced by executives and firms, the core components of an effective management oversight program, and then examples of each.

• What are the key elements of a management controls SOP?
• Which mistakes are so grave that they will generate a warning letter?
• How extensive does my involvement need to be?

These and other very logical questions are voiced by executives at many FDA-regulated firms.  And this widespread confusion only underscores how regulations do not provide pragmatic answers.  Take advantage of this webinar to learn practical answers that FDA inspectors, shareholders and executives alike all agree upon.

The webinar will take place this Tuesday (March 29) at 2:00 PM eastern time. More information from ExpertBriefings follows:

FDA is increasingly citing companies and naming executives for failure to ensure an effective quality system, failure to ensure SOPs are being followed, and failure to enforce policies and procedures. Under FDAAA 2007, the agency has the power to levy civil penalties on individual executives and withhold approval of new drugs and devices.

What You Will Learn:

• What the FDA expects of senior management when it comes to quality system and compliance infrastructure oversight
• Five crucial challenges to overcome to avoid FDA enforcement action
• How the inspector will determine if a quality system is being managed effectively
• What will prompt FDA to publicly name you … and how to avoid it
• Seven steps to take every year to prove effective oversight of SOPs and policies
• How to ethically limit your personal exposure as an officer of the company

You will receive the ICH Q10 guidance with emphasis on management accountability, FDA warning letter samples that cite poor executive oversight, and OIG’s compliance program guidance for executives.

You can register on-line here.

If you can't make the webinar this Tuesday, consider purchasing the recorded version either through ExpertBriefings.com or Ceruleanllc.com.

Find details on my other upcoming FDA compliance speaking events here.  And if you'd like to request my speaking services - either at your own event or to run a corporate FDA compliance workshop, you can do so through the Cerulean FDA workshop and training website section.