Tuesday, July 18, 2017

Coping with Scoping Your CSV/Part 11 Audit

You know you need a computer systems audit, but that’s literally the extent of what you know.
Has this ever been you?

Yes, you use computers on a daily basis, and you may even use the system that needs to be audited. But you don’t spend your day thinking about where all the system components are located, how services and software are combined, and what Part 11 requirements apply. Terms like “cloud computing” make you feel slightly queasy. You’d rather get a root canal than discuss “distributed processing.” Your expertise is in manufacturing. Or clinical research. Or non-clinical lab operations. And somehow it’s your job to make sure an effective and properly-sized system audit is conducted. Great.

Yet your Quality Assurance colleagues -- whether they’re from your internal QA department or an external compliance company -- need your input. They need to understand what software is being purchased, what services are being contracted, how and where components of the system are being implemented, and how the system will be used.

The good news is that the QA auditors can help you. They know that FDA favors a risk-based approach to validation and Part 11 implementation, and they even know what that means. They love to talk about configuration management and change procedures. They love gathering evidence that demonstrates your system works correctly and is in a state of control, and they know what rocks they should look under to find and fix vulnerabilities.

What follows are examples of the types of information you need to convey to QA – and that they should be asking you about – to properly size and scope an audit.

How do You Plan to Use the System?

Suppose you need to audit the supplier of a new Document Management System. The first thing an auditor would need to understand is how you plan to use the system. How mission critical are the documents you’re looking to store?  Are they covered under regulatory scope?  Maybe you plan to use the system as a collaboration environment for developing new SOPs. That would require a relatively low level of scrutiny, especially if you only plan to print

out the finalized documents for wet ink signature. (As a point of comparison, if you plan to use the system to finalize SOP approval, the auditor would need to check that Part 11 requirements for electronic signatures are properly implemented.) What if the Document Management System will be housing critical GxP documents, such as Trial Master Files, Master Schedule Sheets, or Master Batch Records? In these cases, the validation would have to be far more thorough, and Part 11 electronic record features, such as audit trails and archiving functionality, would have to be implemented and verified.

Here’s another “use” example. Similar to the term “Document Management System,” the term “Analytics System” does not tell the whole story. From a business perspective, study start up (SSU) metrics may be vital for sponsors and CROs to collect and analyze. But since they have no regulatory impact, the FDA would not require an SSU analytics system to be validated. (That doesn’t necessarily mean you might not want to, though.) On the other hand, a system that performs statistical analysis on study data for regulatory submission is about as critical as it gets, and would require thorough validation and Part 11implementation. Other analytics systems, such as dashboards that pull data from critical systems, might fall somewhere between these two extremes.

What is the Vendor Providing? And How? And Where?

If you need to audit a complex system, the questions QA will ask you will go beyond system use. The auditors will need to understand the combination of software and services the vendor is providing, and where the software and data reside.

  • Does the software and data reside internally at your company or does the vendor provide a hosting service?
    If the vendor is hosting, the auditor needs to tour the facilities and review SOPs and records to evaluate physical security, staff training, environmental controls, backup procedures, disaster recovery plans, data retention, computer infrastructure, and change control.

  • Does the hosting vendor own its own servers or does it, in turn, outsource that function to a 3rd party hosting company, (possibly even in the cloud)?
    If the hosting is outsourced, ideally an auditor would be able to visit the hosting site. Failing that, the auditor would ask questions about the vendor’s qualification processes and review SOPs that govern vendor selection/management procedures. If the vendor outsources other services beyond hosting, those services might need to be considered, as well.

  • Is the vendor providing any other services?
    Many EDC vendors will provide study-specific services such as screen development and data entry validation edits. Auditors would need to review SOPs for providing these services and understand how the vendor tests and manages modifications to these components as the study proceeds.
    Sometimes computer systems vendors provide ancillary services, such as help desk functions and user account management. That would mean additional SOPs and training records for the auditor to look through.

Other Considerations

There are many. For example, where are you in the product life cycle? You ask different questions about a new system than you would about one that has been operating for a few years. Is the product Commercial off-the-shelf (COTS) or highly customized? COTS systems vendors often have their own validation package which auditors would review, and then ensure proper operation in the sponsor/CRO’s specific environment. A highly customized or custom-built system would require a more extensive validation process.


The Take Away

CSV/Part 11 audits will never be standardized, cookie cutter type activities; there are simply too many factors -- in too many combinations -- to consider. You want your QA efforts to be worth the money you spend and be able to answer the questions FDA says you need to be asking. If you’re unsure how to do that, that’s ok. Other people know, as long as you can help them understand how you plan to use the system, what software and services are being supplied, and how components of the system are being implemented.

In case you missed it, our previous post was Notes 2 Fix Your Notes 2 File.
Many thinks to Lisa Olson for sharing her insights with me.

Monday, May 22, 2017

Notes 2 Fix Your Notes 2 File

Q: If Notes to File can be regulatory red flags, should we quit using them?
A: No, and here's why...

Regulatory inspections are often conducted long after the conclusion of the study. When an FDA investigator asks you a question about an anomaly five years after it’s happened, will anyone recall the circumstances well enough to satisfy the regulator’s concerns? You’ll be doing yourself a huge favor if you write NTFs that answer the questions regulators might one day be asking you.

NTFs can be used to effectively explain an irregularity, locate a document, or note a change in procedures. While there are no regulations or guidances that govern NTFs per se, ICH E6(R2) 2.10 states “All clinical trial information should be recorded, handled, and stored in a way that allows its accurate reporting, interpretation and verification.” A well-written NTF will not only describe an event, but will document who made the notation and when, why the problem occurred, what was done to fix it, and what changes were made to keep it from happening in the future. That’s a lot, so it’s a good idea to develop an NTF template to remind authors to include these elements.

Example of a poorly written NTF:
Informed Consent for study BH-90210 was revised by the IRB 01/7/2017. Subject 867-5309 was not re-consented at her next study visit, as per IRB instructions.

This NTF does nothing more than document the deficiency.

Improved NTF:
Informed Consent for study BH-90210 was revised by the IRB 01/07/2017 to include lab procedures on Visit 5. IRB instructions required a re-consent for all enrolled subjects at next study visit. Subject 867-5309 was not re-consented at her next (2nd) study visit, but was re-consented at her 3rd visit.

This version of the NTF gives us a little more context and lets us know that the subject was re-consented before the new lab procedures were performed. The oversight was corrected in time to preserve Jenny’s* rights, but we still don’t know why it happened; there’s not enough information to satisfy a regulator that failure to re-consent was not a pervasive problem. What were the site’s re-consenting procedures at the time of this study? Were they being followed? Who do we ask?


Complete NTF Using Template

Since the subject was consented before the additional lab procedures were performed, there was no violation of informed consent regulations. This was an oversight with no ill-effects, not a significant break with procedures. Discussing it at the departmental meeting is an appropriate, proportional response. (Note that if the subject had not been re-consented before the new lab procedures were performed, the site would have been in violation of consent regulations and an NTF would not have been sufficient. Both the IRB and the sponsor would have needed to be informed of the failure to consent.)

A poorly written NTF – one that doesn’t provide enough information, one that identifies a problem but no solution, one that is inadequately standing in for proper record keeping – won’t satisfy a regulator’s concerns. These are the sorts of NTFs that can actually do more harm than good. A well-written NTF, on the other hand, is something your future self will thank you for.

In case you missed it, our last post was about how GMP activities affect GCP study procedures.

* If you know why Subject 867-5309 goes by “Jenny," one of your friends wore a pink tux with shoulder pads to prom.

A version of this article originally appeared in InSite, the Journal of the Society for Clinical Research Sites.

Tuesday, April 4, 2017

When GCP & GMP Meet

Developing safe and effective drugs requires a coordinated effort across a diverse set of disciplines. This is easier to observe at some points in the process than at others. Once a product is well into human trials, it can be easy to forget that developments on the manufacturing side of the house can affect the clinicians who are conducting the studies.

Trialed Drug vs Marketed Drug

Once researchers are satisfied that animal studies show that an Active Pharmaceutical Ingredient (API) is effective and nontoxic at initial doses, there’s an urgency to get it into the clinic and begin human studies as soon as possible. Though the ultimate product may be marketed in one form, a different form may take less time to manufacture, and so would be the form given to human volunteers in earlier clinical trials.

A tablet, for example, is much harder to manufacture than a 2-piece hard shell capsule because determining the appropriate compression for a tablet takes time. (Tablets that aren’t sufficiently compressed will break apart in the bottle; tablets compressed too tightly may not dissolve as they should, earning themselves the entertainingly accurate moniker “bedpan bullets.”) Rather than wait until a tablet form of the drug can be fully developed, to save time, sponsors would likely begin human studies using a hard shell capsule version.*

To ensure that clinical trial data for the Investigational Product (IP) are applicable to the ultimately marketed product, clinicians run bioequivalence for dosage form studies. These small pharmacokinetics studies may result in changes, such as dosage amount or frequency, if people do not metabolize the studied formulation and the final formulation the same way.

Stability Test Failures

When we hear of a pharmaceutical company having to “pull its product,” we typically think of a recall scenario that involves consumers, distributers, and retailers.  Recall procedures fall under the GMP umbrella, and are spelled out in great detail in 21 CFR Part 211. However, similar procedures may very well be required of clinical site staff, long before the product ever sees its first drugstore.

Before any clinical trials begin on a drug, manufacturers would have been conducting stability tests for months. But stability testing may continue for years after the start of human trials, and analysts could detect a variety of troubling conditions in the course of their work. Product can change color or break apart. Capsules can crack and leak. Microbes could begin to grow, especially in moister product. The container closure system itself could be problematic; it could leech contaminating material into the product, introducing impurities, or it could extract material from the product, diminishing its potency. Any of these finding could mean that study drug would need to be pulled from clinical sites.

No one expects site staff to have detailed quarantining and recall procedures; the Sponsor will tell site staff exactly what they need to do. But what would this look like?

(1) Adulterated product that cannot be dispensed will need to be moved to a separate, secure area so it won’t be confused with good product. It might need to be stored there for a period of time or shipped back to the Sponsor.

(2) For certain, a site’s drug accountability procedures will be center stage. The only way a site can successfully recall bad product is if it has -- all along -- closely tracked the amount of IP it has received, dispensed, and still has on hand.


(3) Study participants who have any quantity of the bad product will need to be contacted, told not to use it, and told how to return it. (Note that this pertains to participants on the placebo arm as well, otherwise the blind will be broken.) Phone calls may not be sufficient; sites may need to invoke lost-to-follow-up procedures, such as sending registered letters. Remote, virtual trials, which often ship IP to participants, need to be designed to allow for the tracking and retrieval of bad product.

(4) What should be done if it turns out some participants have already used the bad product? Unfortunately, that’s one SOP you can’t write in advance; it would completely depend on the nature of the IP and the problem it has, the vulnerability of the patient population, the protocol, the participant’s proximity to the site, etc. Perhaps a careful case review to look for AEs associated with affected participants would suffice. More critical situations may require participants to undergo physical examinations or special testing. In many cases, study data associated with the use of the tainted IP would need to be identified and removed from the efficacy analysis.

(5) These quarantining and recall activities must be carefully recorded. IRBs and regulators will want written proof that all suspect IP has been accounted for. Sponsors might consider sending a CRA to ensure adequate documentation.


Stability tests don’t have to fail to trigger action for clinical staff. Should a chemist discover a condition that requires a labeling modification -- a new expiry date**, for example – all the labels on existing product held at clinical study sites would need to be replaced. In these situations, the Sponsor may dispatch CRAs to replace the labels themselves, or negotiate with individual site staffs to do it instead. 

No GxP is an Island…

GMP professionals manufacture, package, and label biopharmaceutical products. GCP professionals conduct clinical trials on those same products. These roles are very different from each other, yet they don’t work in isolation. Formulation changes, stability testing, and re-labeling requirements represent three examples in which activities performed by GMP folks impact their GCP counterparts. Have you experienced any additional examples? Feel free to share them in the Comments section.

In case you missed it, our last post was about how attributes of the Study Drug influence the Site Selection and Feasibility process.


* “By the time clinical trials start, they know what ingredients go in the cookie, they just don’t know how the cookie is going to turn out yet.”
       - Rosanne Sylvia-Heeter, Polaris Director of GMP Compliance and phenomenal cook

** Expiry dates are not required but are sometimes included on IP labels.

Tuesday, February 7, 2017

Site Selection: Don't Forget About the Study Drug

Study Drug IV
As a sponsor or CRO, you understand the importance of a thorough site selection process. A site needs to be able to meet enrollment targets and time frames, protect the rights and safety of study participants, execute the protocol, deliver quality data, and maintain GCP compliance. That’s what your site feasibility surveys and pre-study visits are designed to evaluate. And as you’re assessing a site’s abilities, the site is conducting its own feasibility process. They’re mining their patient database and assessing inclusion/exclusion criteria. They’re reviewing staff credentials and ensuring they have adequate resources to manage the number of subject visits and collect the data the protocol requires.

But when we conduct GCP audits, we find there’s one perspective that is sometimes overlooked by both sides: the needs of the study drug itself.

Tuesday, December 6, 2016

When is a Customer NOT a Customer?

While patients are consumers of healthcare services, they can’t be considered customers in the traditional sense. The same is true of students. Over many years of teaching, I’ve noticed this parallel between the healthcare and education professions; both require significantly more “customer participation” to achieve desired outcomes than other industries do. That’s one reason it’s difficult to measure the quality of these institutions and the skills of their practitioners. That’s also why both industries focus so intently on engaging our communities; we simply can’t be successful unless we do.

Math Confusion
“Can You Hear Me Now?”
As the old joke goes, there are 3 types of people in this world: those who are good at math and those who aren’t. Many students believe themselves to be permanent denizens of the 2nd camp. They find mathematical concepts confusing and the terminology inscrutable, so they tend not to ask questions. They’re afraid they’re being judged, so they’re not always truthful. Tests and exams fill them with anxiety, and sometimes even panic (no doubt waking to nightmares of trains leaving stations at varying rates of speed). These are the students who need my help the most. Our success in overcoming these challenges together will depend heavily on the student/teacher connection we can establish, yet few students are actually able to choose the teacher with whom they are asked to connect. Sound like healthcare yet?

Tuesday, October 11, 2016

Avoiding Protocol Deviations

Year in and year out, protocol deviations are the most common FDA Site Inspection finding. Why does this keep happening?

If you’ve seen FDA’s Inspectional Observation Summaries, you know that in 2015 the most frequently cited violation in clinical research by far was “failure to conduct research in accordance with the investigational plan.”  Do you know this finding also topped the list the year before that?  And the year before that?  In fact, deviating from the protocol has been the most common observation every year for the last decade.

Why does this keep happening?

Tuesday, September 6, 2016

Optimizing Outsourcing Options for Small Sponsors

Question Mark
What can small sponsors do to secure the outsourcing resources they need as large CROs form strategic alliances with Big Pharma?

Partenships between large pharmaceutical companies and large CROs have become the norm.  The advantages for sponsor companies include shared risk, knowledge transfer, dedicated resources, shorter time to market, and the ability to implement the massive data integration that clinical development requires.  Strategic alliances are arguably as advantageous for their outsourcing partners, providing a steady pipeline of work that’s larger in scope and longer in duration than is typical under traditional arrangements.