Deviations and CAPA from the FDA Perspective Gary Bird, Ph.D. PharmaConsult Global
my
Outline of the Contents • Look at general deviation information • Compare regulatory requirements for
CAPA • Discuss best practices for CAPA
2
By any other name, it’s still a “Deviation” • Incident • Non-conformance, nonconformity • Discrepancy • Atypical situation • Errors • Out-of-specification • Out-of-trend • Failures • Exceptions
Common “other” definitions (company specific)
• Departure from an approved instruction or established standard..
Deviation (ICHQ7)
• The nonfulfillment of a specified requirement. Nonconformity 21 CFR 820(q)
•Unexpected event with potential to adversely affect material or drug product quality, safety, efficacy, purity or stability. Includes unexpected malfunction(s) or issue(s) that may adversely impact reliability of equipment or processes to perform as expected.
Incident (Company)
Common Observations -2015
Citation Observation(s) % on 678
Inspections
Procedures
21 CFR 211.22(d) Not in writing or fully followed 23.6%
21 CFR 211.160(b) Scientifically unsound laboratory controls 19.2%
21 CFR 211.67(b) Written procedures not established/followed 7.82%
21 CFR 211.100(b) SOPs not followed / documented 7.67%
21 CFR 211.113(b) Sterile drug products 15.3%
21 CFR 211.100(a) Absence of Written Procedures 14.0%
21 CFR 211.198(a) Procedures: Complaint Handling Procedure 5.90%
21 CFR 211.160(a) Following/documenting laboratory controls 5.90%
21 CFR 211.192 Deviations: Investigations of discrepancies, failures 18.3%
Common Observations -2015
Citation Observation(s) % on 678
Inspections
21 CFR 211.42(c)(10)(iv) Environmental Monitoring System 12.2%
21 CFR 211.165(a) Testing and release for distribution 11.8%
21 CFR 211.110(a) Monitor and validate performance 10.2%
21 CFR 211.67(a) Cleaning / Sanitizing / Maintenance 10.0%
21 CFR 211.63 Equipment Design, Size and Location 8.26%
21 CFR 211.113(b) Validation lacking for sterile drug products 7.82%
21 CFR 211.25(a) Training--operations, GMPs, written procedures 7.37%
21 CFR 211.192 Written record of investigation incomplete 6.93%
21 CFR 211.194(a) Complete test data included in records 5.75%
21 CFR 211: References to Deviations • Components, drug product containers, and closures approved for use
shall be rotated so that the oldest approved stock is used first. Deviation from this requirement is permitted if such deviation is temporary and appropriate.
Sec. 211.86 Use of approved components, drug product containers, and closures.
• (b) Written production and process control procedures shall be followed in the execution of the various production and process control functions and shall be documented at the time of performance. Any deviation from the written procedures shall be recorded and justified.
Subpart F--Production and Process Controls; Sec. 211.100
Written procedures; deviations.
• When appropriate, time limits for the completion of each phase of production shall be established to assure the quality of the drug product. Deviation from established time limits may be acceptable if such deviation does not compromise the quality of the drug product. Such deviation shall be justified and documented.
Sec. 211.111 Time limitations on production.
• Written procedures shall be established, and followed, describing the distribution of drug products. They shall include:
• (a) A procedure whereby the oldest approved stock of a drug product is distributed first. Deviation from this requirement is permitted if such deviation is temporary and appropriate.
Subpart H--Holding and Distribution; Sec. 211.150 Distribution procedures.
• (a) Any deviation from the written specifications, standards, sampling plans, test procedures, or other laboratory control mechanisms shall be recorded and justified.
Subpart I--Laboratory Controls; Sec. 211.160 General
requirements.
Deviation Investigations/Resolution Process
Does It Function?
Did you try to fix
it???
Will you be in TROUBLE???
Don’t change it
You Idiot!!!
You’re in Deep E. coli
Then there’s no problem
Pretend you don’t know about it
Hide it
Can you blame someone else???
Yes No
Yes
Yes Yes
No
No
Yes
No No
Does anyone
else know about it?
Panic
The impact of deviations can be minimized if…
The events are Captured
The situation is
Investigated
The cause is
Corrected
The activities are Documented
The occurrence
is Reported
The potential impact is
Evaluated across product lots and
product lines
Use of Contractors • Manufacturers that use contract services
are ultimately responsible for ensuring that deviations and failures experienced by contractors are thoroughly investigated and resolved before the is batch released and distributed
The Reference Document – a Quality Agreement
• Any Deviations from the Process must be documented as described in Section X: Deviations and Out of Specification (OOS) Results and Approved by the Sponsor.
Deviations and Out of
Specification (OOS) Results
• The Contractor shall conduct and record failure investigations to ensure root cause identification and document any Deviation(s) from the Approved Manufacturing, Packaging or analytical Process impacting the quality, strength, purity, safety and compliance of the Product.
• Unplanned Deviations will be Approved by The Sponsor prior to Release of impacted Lots.
• The Contractor shall notify The Sponsor of any Deviations that have an impact on the decision to Release the Product into the clinic.
Manufacturing Deviations
Elements of an Investigation: A Reasonable Deviation Investigation Template
• Product Name • Deviation Number • Date of Occurrence • Initiator • Executive Summary • Notebook / Master Batch Record
Reference or SOP Reference • Description of Deviation • Description of Immediate
Corrective Action, if any • Probable Root Cause • Impact Assessment: lot, line,
multiple lines, facility, worldwide • Classification
– Human Error – Instrument Failure – Processing Error
• Description of Deviation • Relevant Data • Impact of Deviation • Root Cause (potential, known,
unknown) • Corrective Action (reference to
other document if necessary) • Preventive Action (reference to
other document if necessary) • Confirm completion • Completion Date • Does a Method or Procedure
have to be updated • Sign-off (Initiator, Investigator,
Management) and dates
An example of a common deviation issue • Protocol MFP #4636 relates to the
validation of the lyophilizer used for freeze drying the final drug product in vials. The study was terminated after 2 of the 6 lots failed moisture acceptance criteria. These failures were not investigated, and the validation report concludes the lyophilization process is valid.
CAPA in the EU, US, and ICH
Different emphasis but
a high level of
consistency in that:
• Expected and required • Companies must investigate
discrepancies • The correction process must be a
routine process • The preventive program is “continuous
improvement” • Information must be assimilated and
acted on • Processes must be in place to address
issues with Management • The CAPA process is a lifecycle process,
continuing even when product is discontinued
14
The Internationalization of CAPA: ICH Q10
System based • CAPA resulting from the investigation
of complaints, product rejections, non-conformances, recalls, deviations, audits, regulatory inspections and findings, trends from process performance and product quality monitoring.
Structured approach • The level of effort, formality, and
documentation of the investigation should be commensurate with the level of risk, in line with ICH Q9.
• CAPA methods should result in product and process improvements and enhanced product and process understanding.
15
US: CFR 21 Part 211 • Sec. 211.192 Production record review.
– All drug product production and control records, … shall be reviewed and approved by the quality control unit …. Any unexplained discrepancy …. shall be thoroughly investigated, … The investigation shall extend to other batches of the same drug product and other drug products that may have been associated with the specific failure or discrepancy. A written record of the investigation shall be made and shall include the conclusions and follow up.
16
We have a deviation, how do we “fix” it?
CAPA is a well-known CGMP regulatory concept that focuses on investigating, understanding, and correcting discrepancies while attempting to prevent their recurrence.
Quality system models discuss CAPA as three separate concepts, all of which are used in this guidance
Root cause analysis with corrective action to help understand the cause of the deviation and potentially prevent recurrence of a similar problem
Preventive action to avert recurrence of a similar potential problem
Remedial corrections of an identified problem
US FDA Quality Systems Approach to Pharmaceutical cGMP Regulations (Sept 2006)
Corrective action is a reactive tool for system improvement to ensure that significant problems do not recur.
SOP(s) to ensure the need for action is evaluated relevant to the possible results
The root cause of the problem is investigated,
Possible actions are determined,
Selected action is taken within a defined timeframe,
Effectiveness of the action taken is evaluated.
Document corrective actions taken
19
US FDA Quality Systems Approach to Pharmaceutical cGMP Regulations (Sept 2006)
Both quality systems and the cGMP (211.192) regulations emphasize corrective actions
Quality systems approaches call for :
FDA Guidance on CAPA continued
• Key sources of information: – Nonconformance reports and rejections – Returns – Complaints – Internal and external audits – Data and risk assessment related to
operations and quality system processes – Management review decisions
20
US FDA Quality Systems Approach to Pharmaceutical cGMP Regulations (Sept 2006)
Preventive Actions are the proactive component of an investigation and is an essential tool in quality systems management
•include succession planning, training, capturing institutional knowledge, and planning for personnel, policy, and process changes are preventive actions that will help ensure that potential problems and root causes are identified, possible consequences assessed, and appropriate actions considered.
“Soft” actions
•include modifications to systems, manufacturing processes, expectations for personnel, monitoring strategies, confirmation that systems are functioning correctly
“Hard” actions
•new problems can be identified by reviewing data and analyzing risks associated with operational and quality system processes, and by keeping abreast of changes in scientific developments and regulatory requirements.
“Proactive”
21
Comments and Cautions • Must have a qualified Quality lead • Is more important than generally acknowledged • May cause all product to be adulterated if not properly
resolved • Can not be dependent upon one person or a small group –
needs many perspectives • Can not be limited to one general direction, must be able to
evaluate multiple scenarios and results • Must be a living process • Multiple processes depending upon which group is
conducting the activity. • Should have the support of the Management team • Ultimately, Senior Management is responsible and will be
held accountable.
22
Key Steps 1. Create the team 2. Identify the problem 3. Evaluate the issues 4. Investigate 5. Analyze the issues 6. Create action plans to address the findings 7. Implement 8. Verify effectiveness 9. Follow-up
23
Create the CAPA Team • Should have a standing Data Integrity Team ready to
function • Never dismisses a potential major or critical issue without
formalized investigation. • The Data Integrity Team:
– Quality should always be chair – Teams should always be expert in the specifics – Avoid conflicts of interest (specific group or individuals should
not be involved in resolution) – Identify appropriate witnesses and knowledgeable personnel – Determine impact of potential data integrity or fraudulent
activities and know a priori what your course of action should be.
• Periodically activate the team to “keep them fresh” by conducting an in-depth review of a potentially “suspect” area.
Identify the problem
Confirm the source of the
information, e.g., deviations,
process changes, unscheduled maintenance,
audits, personnel observations, requests, data mining, third-party reviews, trend analyses
Focus on more than
just the issue at hand =
global
Explain all observations
in great detail but concisely.
Document that the
problem, as identified,
really exists.
25
Evaluate the issues
Confirm likely impact(s) on the product
Is there any
product risk?
Are there any easily
identified, necessary remedial
actions, e.g., Is this a
“quick fix” or a permanent
solution.
Is the issue more far
reaching than a simple repair or solution
Where the remediation
is simple, this may be the end of the
investigation and the CAPA can be closed.
26
Investigate
Should generally include a written plan to address the identified issue(s): • Objective • Team Members • Rationale • Strategy • Extent (boundaries) of
evaluation
Corroborate with experts
27
Must follow the SOP for
investigations
Analyze the issues
Assimilate all results from the investigation and confirm each observation
All potential
causes are properly
identified
Necessary data is
available to drive
the analysis
Data is organized
and formatted for human evaluation
where necessary
Root Cause Analysis • Conduct a
root cause analysis to determine primary cause(s) of the problem.
• List all (but don’t be confused with symptoms)
• List all possible interactions of the potential root causes
28
Create action plans to address the findings
Identify the best methods to correct
the existing issues, it recurrence, or
related activities
Document the action plan • Comprehensive • Interactive • Time lines • Personnel
Requirements and Responsibilities
• How much will it cost • All tasks required to
complete the action • Identify any related
products or processes that will also be impacted
29
Create action plans to address the findings
Identify • Timing • Documents • SOPs • Physical equipment or system
changes • Processing changes • Computer system controls or
validation
Training Needs • Timing and requirements
related to identified changes • Must be comprehensive and
involve all affected personnel.
30
Implement
Personnel • Technical experts own
each of the relevant sections
• A list of all activities is created and documented to support the changes.
Impact • System
interactions are confirmed during implementation
• No “unintended consequences”
31
Plan • Action Plan is
broken into understandable pieces
• All tasks are properly identified and described
Follow-up
Verify • Results • Effectiveness of the CAPA • All objectives met • Changes completed and verified • No reoccurrences of the event
Confirm • Resolved root cause • Any resulting secondary
situations have been corrected • Effective controls in place • No unexpected consequences • Training updated?
32
A Word About Software Based Solutions • Software programs are not CAPA, just a tool • All CAPA programs have something to offer • May be very expensive to install and validate • Should be adopted across the entire company for
them to be effective, often difficult to do • Requires an extremely well defined process • Requires an owner, generally a Quality function • Requires maintenance • Will not provide the “answer” regardless of how
hard it is pushed.
33