FDA Warning Letter - Microsoft Excel Spreadsheet

Date: 13 June 2012
Link FDA 483 (New Window)

Observation

5. Your firm has not established and documented the accuracy, reliability and performance of your computer systems employed in the release of drug products [21 C.F.R. 211.68 (a)]

For example, your firm did not verify the accuracy of Excel spreadsheets used to calculate product assay analytical results, for all products manufactured for the US market, in order to verify the accuracy of the results obtained.

This is very similar to a observation from 2010 in the use of Microsoft Excel Spreadsheets which stated

6. Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 C.F.R § 211.68(b)].


a) Your firm's laboratory analysts have the ability to access and delete raw chromatographic data located on the (b)(4) of (b)(4) used to conduct HPLC testing. Due to this unrestrictive access, there is no assurance that laboratory records and raw data are accurate and valid.

b) Your firm's laboratory analysts have the ability to access and modify the formulas in the Excel spreadsheets used to calculate assay results for Guaifenesin and (b)(4) drug products. Due to this unrestricted access, there is no assurance that the formulas in the Excel spreadsheets are accurate and valid.

Comment

Microsoft Excel Spreadsheets are used throughout the pharmaceutical industry, generally installed on every desktop computer. However when using spreadsheets to make calculations that are used to support product release and quality based decisions then the spreadsheet must be controlled and verified to ensure that the spreadsheet is secure and that the calculations are accurate across the range.

The security of the spreadsheet should ensure that users of the spreadsheet can only enter data in to specific cells and that the calculations cannot be modified. Basic Excel security can be used to ensure this.

Calculations should be verified across the data range against manually calculated results. Care should be taken relating to rounding errors and resolution..

The spreadsheets should be maintained within a document management system or other secure location to ensure that the files can be access but cannot be modified or overwritten. Changes to the spreadsheets should be managed by Change Control.

FDA Warning Letter - Raw Data

Date: 23 February 2012
Link FDA 483 (New Window)

Observation

4. Your firm has not established appropriate controls over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel. Your firm also fails to maintain a backup file of data entered into the computer or related system [21 CFR § 211.68(b)].

FDA Warning Letter - Automated System Validation

Date: 03 February 2012
Link FDA 483 (New Window)

Observation

Although this observation does not directly relate to 21CFR211.68 for computerised systems it still has an impact on the validation requirements of an automated system within a tablet manufacturing and packing line.

4. Equipment used in the manufacture, processing, packing or holding of drug products is not of appropriate design to facilitate operations for its intended use. [21 C.F.R. § 211.63) For example,

a. Our review of the equipment qualifications for multiple automated Tablet Testing System (TTS) machines, used to conduct in-process tablet testing (weight, hardness and thickness) revealed that performance qualification was not conducted to ensure the accuracy of the machine at the various available speed settings. A February 2010 investigation of OOS tablet weights for Digoxin tablets revealed that the TTSs were giving incorrect tablet weights for lighter weight ( < 200 mg) tablets when run at the default speed of (b)(4) and concluded it would give accurate results only when run at a speed of (b)(4) However, your firm failed to make a further assessment of the overall reliability of the TTS machines, including evaluating their accuracy with other products and other tablet weights at other speeds.

b. Your firm has not adequately qualified the in-line Pressure Control Device (PCD)-2 Automatic Tablet Weight Control System on the (b)(4) and (b)(4) tablet press machines. Your firm did not Qualifications (PQ) that are representative of all of the products run on the tablet presses to assure proper functioning, including evaluating the reject station timing in relation to tablet press rpm. There is no assurance that the PCD-2 system is accurately rejecting the "marked" OOS tablets throughout the compression run.

FDA Warning Letter - Alarm Management

Date: 25 May 11
Link FDA 483 (PDF - New Window)

Observation

b. During routine operations, if there is an alarm event (e.g., time out, high and low temperature for washing and siliconizing, instrument line failure, jacket gauge failure and steam header failure) during the wash and depyrogenation process, the [redacted] Stopper Washer captures the alarm condition via a print out and the data is retained with the / manufacturing batch record. The Quality Compliance Manager confirmed that the alarmed events are not periodically reviewed or trended to assure that the [redacted] stopper washer and/or wash and depyrogenation process is not drifting from the validated state of control;

Comment

This is an interesting observation relating to the management of alarms and the use of periodic review and / or trending to demonstrate that the system is not drifting from the validated state. This can relate to almost any automated or monitoring computerised system.

When specifying and designing an automated control or monitoring system careful consideration should be given to the alarms generated by the system. A process for identifying and prioritising alarms is critical to the success.

In very general terms those alarms that have quality impact will be set to operate at the point of Out-of-Specification which should result in a quality related deviation. Normally when there are Quality Critical Alarms then then there will be associated warnings, with a setpoint at a level appropriate to take action, before the Quality Critical Alarm is tripped.

The trip points are alarm setpoints should be clearly rationalised and approved by the Quality Unit.

Periodic Review / Trending
To demonstrate the process is operating within the specified range a review of the alarms generated during the process should be reviewed routinely. This should initially be performed during the initial performance monitoring (performance qualification) of the system. This should ascertain that the warning levels are appropriate (provides operators with sufficient opportunity to rectify the problem before a breach in quality limits) and if the process is controlling within the quality critical limits.

Following the PQ, all breaches in specification must be reported through the batch record / deviation system. This should provide a trend of the critical alarms.

For the warnings a periodic review should be performed, which may use statistical analysis based on an acceptable number of alarms (process capability) to ensure that the system is continuing to operate in control and without degradation of performance.

The frequency of review and the depth of the review should be based on the impact of the computerised system and the operating history.

As stated at the start of the comment by building the alarm management in to the requirements and design of the system, the statistical analysis can be performed by the control system or the alarms stored within a database to ensure that they can be access for trending and review purposes.

Useful information

ANSI/ISA–18.2–2009 - Management of Alarm Systems for the Process Industries
EEMUA 191 - Alarm Systems- A Guide to Design, Management and Procurement

FDA Warning Letter - Change Control

Date: 25 Aug 11
Link: FDA Warning Letter (New Window)

Observation

This observation relates to the revalidation following changes of a Cutting and Packing Machine, however it could be applied to any computerised system. 2. Your firm failed to ensure that the automatic, mechanical, or electronic equipment, or other types of equipment including computers or related systems, will perform a function satisfactorily [21 C.F.R. § 211.68(a)]. For example:

a. The initial qualification for the (b)(4) Cutting and Packing Machine, Model (b)(4) was completed on June 7, 2007. Approximately 25 major and minor changes were implemented between June 14, 2007, and July 15, 2010, before your approval of the re-qualification report for equipment (b)(4).

In your response, your firm states that (b)(4) Cutting and Packing Machine is a custom-made unit. The unit consists of subunits that perform functions independently of one another and that modification to one subunit does not necessarily adversely impact other subunits or the equipment as a whole. You added that the requalification requirement was documented in each approved Change Control. Your response, however, is inadequate because you have neither provided documentation to demonstrate your claims of independently functioning subunits, nor have you provided your rationale why each equipment change did not necessitate a re-qualification and/or a re-validation of the (b)(4) Cutting and Packing machine.

In addition, your firm states that further system enhancement will be made to validation procedures. However, it is not clear as to your estimated completion date because the content of your proposal entitled, “(b)(4),” is so broad. Furthermore, we are not able to evaluate the adequacy of your corrective actions without sufficient details of your proposed enhancement.

Comment

Although this change may relate to mechanical and / or software changes the FDA regulatory requirement could apply to any Computerised System (automation, laboratory or IT system).

It is rarely practical or possible to perform a full revalidation following a change, particularly for large automation systems. However each change should be Risk Assessed to determine the potential impact on the overall system. For software systems the modularity of the software can be used to support mitigation, but a sound rationale must be provided to determine that the correct level of verification has been performed for each change and that the impact to patient safety, product quality and data integrity have been maintained.

Following a Risk Based approach to the validation and control of the system the risk assessments performed during the design phases should have identified the Quality Critical Attributes. This also should be used to support the approach to the verification following a change. Should a change be performed that has the potential to impact a Quality Critical Attribute of the system then the risk assessment for the change should identify consider the potential impact. Following the commissioning of the change (to demonstrate that the change functions as required) then re-verification of the critical attribute should be tested; this may be as simple as running the initial test script.

Managing risk and formally documenting the risk assessment process will provide sufficient detail to demonstrate that the change to a computerised system has been implemented and the risk to quality controlled and minimised.

A formal periodic review process should also consider the cumulative impact of change, along with quality events (incidents / deviations) to determine whether further controls or verification are required to maintain the computerised system within a qualified state.

Comments are always welcome.

Related Posts
Computer System Periodic Review
FDA Warning Letter - Computer System Periodic Review

FDA Warning Letter - Secure Desktop

Observation

Date: 25 April 11
Link FDA Warning Letter (New Window)
4. Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 C.F.R 211.68(b)].

For example, your firm lacks control of the (b)(4) computer system which monitors equipment, room differential pressure, room humidity, and stability chambers. Although the system is password protected for temperature and humidity set points, all employees have access to the room where the (b)(4) computer system is located and the external hard drive is not password protected. During the inspection we observed that an employee was able to alter or delete data without a password and save the changed file.

In your response, your firm states that additional controls were implemented including validating the remote access to the (b)(4) computer, password protecting the room where the computer is stored, and limiting the (b)(4) control room to authorized personnel only. Although your corrective actions may adequately address the protection of the (b)(4) computer from non-traceable changes, your firm has not taken a global approach to this deficiency. It is our expectation that your other manufacturing and laboratory computerized systems will be reviewed to ensure similar deficiencies do not exist.

Comment

This warning letter is a common observation relating to the security control of a computerised system, which can include Automation and Laboratory Systems. There are a number of ways controls can be established to ensure a secure environment and stop users having access to the computer hard drive either internal or external.

Generally computerised systems used to interface with users (including Automation Systems, SCADA, Monitoring Systems and Laboratory)  are rarely configured to secure the operating system.  The configuration must be configured to secure data and records stored on it. A standard Windows desktop allows the user to access the internal and external hard drives, USB drives and networked drives.

This FDA warning letter could have been cited against FDA 21 CFR Part 11 as the concern is to the integrity of data and records stored on the computerised system. It is a regulatory requirement that data generated by computerised systems are secure and the integrity of the data is maintained.

Computer Settings
Windows can be configured to lockdown the desktop. The secure environment can be established using Group Policy and Windows Registry settings to ensure that users have access to the application. However this has configuration difficulties and requires significant effort to verify the settings.

Secure Desktop
A third party application such as Visual Automations Secure Desktop can provide a simple desktop tool that can be configured to ensure that users only have access to applications they are authorised to use. The application is simple to configure and performs the windows registry edits simply from the selection. It is capable of only delivering the applications that are required by the user (remove access to windows explorer, etc.) to provide a secure environment.

The application also allows for the configuration of access to USB ports and combined key strokes.

Using a Secure Desktop (such as Visual Automations Secure Desktop) can reduce the development time for locking down the Windows XP / Windows 7 environment. In addition with well-defined installation procedures will reduce the validation effort. The configuration of the Secure Desktop application can be verified to demonstrate that the system provides the required functionality and then the deployment controlled via approved installation and configuration documentation (Standard operating Procedure / Works Instruction).

In the FDA warning letter it was stated that

Although your corrective actions may adequately address the protection of the (b)(4) computer from non-traceable changes, your firm has not taken a global approach to this deficiency. It is our expectation that your other manufacturing and laboratory computerized systems will be reviewed to ensure similar deficiencies do not exist.

The use of third party applications with common configuration can provide a cost effective solution to demonstrate that the controls have been implemented and that a common approach has been adopted.

Note
The author is not affiliated in any way to Visual Automation and the application is provided as an example of using third party applications to secure the Windows Desktop of a computerised system used within the pharmaceutical environment to improve the security and compliance (of the computerised system).

Comments on other available tools or solutions for securing the Windows Desktop for use in a pharmaceutical environment are welcome.

FDA Warning Letters - Risk Assessments

Introduction

Although to date I have not found any references within the FDA warning letters directly relating to computerised systems and risk assessments within the pharmaceutical / biotechnology industry it is interesting to review inspection findings where risk assessments have been detailed.

In this post there is a review of two FDA warning letters which reference the use of documented risk assessments.

CSV FDA Warning Letters : Electronic Records

Date: 28 Jan 11
Link: FDA Warning Letter (New Window)

Observation

In addition, we remain concerned that your (b)(4) adverse drug experience reporting system has not been fully validated, and may have resulted in inaccurate assessment and untimely submission of 15-day alerts. The current application was released into production on November 9, 2009 using an Interim Validation report (IVR) that is still not final. Critical issues (deviations) identified in your interim validation report during the inspection included the following, but is not limited to: lack of training for your (b)(4)support team, incomplete SOPs and Work Instructions, and inaccurate data migration of legacy adverse experience cases from your previous adverse drug experience database, (b)(4). Currently, your (b)(4) system does not display accurate clock dates on MedWatch forms for cases which were initially entered in (b)(4) and later entered into (b)(4) due to the receipt of additional information (follow-up) for the same cases. MedWatch forms printed out from (b)(4) for these migrated cases are documented as initial 15-day reports, instead of follow-up reports. Also, the report date in Block B5 of the MedWatch form is the print date, not the actual date of submission. Shortcomings such as these affect the accuracy, reliability, consistency of the system and your firm’s ability to discern invalid or altered electronic records or make timely submissions to FDA as required.

Comment

This audit observation (FDA 483) was made during an inspection of a pharmaceutical facility by the FDA focusing on the compliance with Postmarketing Adverse Drug Experience (PADE) reporting requirements. These are critical electronic records for any pharmaceutical company.

This observation relates to 21 CFR Part 11 and the integrity of electronic records. There are three interesting parts to this observation.

Validation

The validation of the system was criticised for not being complete and that critical issues (deviations) had not been closed. We have all been involved in projects where the system must go live due to project constraints and yet the system is either not finished or has not successfully completed the validation. Understanding the issues, documenting within a risk assessment with respects to patient safety and record (data) integrity to make an informed decision as to whether the system can be released to production.

If the system fails to meet the acceptance criteria, where significant risks to patient safety or record integrity cannot be controlled (technically or procedurally) then the quality unit must ensure that the system does not go in to production.

Clock

Within the FDA 483 it was observed that

Currently, your (b)(4) system does not display accurate clock dates on MedWatch forms for cases which were initially entered in (b)(4) and later entered into (b)(4) due to the receipt of additional information (follow-up) for the same cases.

The accuracy of clocks used within electronic record systems is imperative to ensuring accurate records. Within 21 CFR Part 11 the inclusion of date and time is quoted, including for creation, modification and deletion of records, audit trails and electronic signatures.

To ensure the accuracy of the time source for meeting electronic record requirements the computer time must be synchronised with a master clock. Where multiple countries are involve the time should also include the time zone.

Record Integrity

Although not citing against 21 CFR Part 11 directly this observation brings in to question the integrity of the record. The quote your firm’s ability to discern invalid or altered electronic records or make timely submissions to FDA as required is a direct quote from 21 CFR Part 11 (validation).

Care must be taken with electronic record systems to ensure that the integrity of the record is not compromised. The clock issue is one that should be simple to fix, synchronising PC clocks across the IT network.

The reporting of the migrated data should have been picked up during the testing prior to the system going live either with controls put in place to ensure that the records were accurate or the system not released for use until the issue was resolved.

CSV FDA Warning Letters : Laboratory Systems Security

Date: 20 April 2010
Link: FDA Warning Letter (New Window)

Observation

This is a follow up letter from an inspection in 2009 where the security of laboratory systems had been raised within the FDA 483.

6. Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 C.F.R § 211.68(b)].

a) Your firm's laboratory analysts have the ability to access and delete raw chromatographic data located on the (b)(4) of (b)(4) used to conduct HPLC testing. Due to this unrestrictive access, there is no assurance that laboratory records and raw data are accurate and valid.

b) Your firm's laboratory analysts have the ability to access and modify the formulas in the Excel spreadsheets used to calculate assay results for Guaifenesin and (b)(4) drug products. Due to this unrestricted access, there is no assurance that the formulas in the Excel spreadsheets are accurate and valid.

Your response appears to be adequate, but the effectiveness of the security features on your laboratory equipment will be verified at the next inspection.

Comment

This is a regular theme that pharmaceutical companies fail to have appropriate security controls over laboratory equipment. This again links with the approach in 2009 not to cite against 21 CFR Part 11 but against 21 CFR 211. As discussed in a previous post  the FDA are planning to perform investigations against 21 CFR Part 11.

In part (a) of the observation the requirement is to ensure that users of laboratory systems do not have access to the operating system, to ensure that the raw data is secure.

In part (b) is is interesting that spreadsheets get a direct mention in the observation. Security controls over the spreadsheets should be employed to ensure that the formulas within them cannot be modified (either accidently or maliciously). A general rule should be to avoid using spreadsheets as much as possible, but where they are used they must be controlled and validated (see Spreadsheet Validation post).

As part of an inspection readiness program or periodic review a review of security controls within the laboratory areas should be performed. Ensure that controls are in place and that they are followed. Technical controls must be in place to ensure that users of the system do not have access to the operating system which would give them in turn access to the electronic records.

Comments are always welcome.

CSV FDA Warning Letters : Security / Audit Trail

Date: 12 August 2008
Link: FDA Warning Letter (New Window)

Observation

6. Failure to establish appropriate controls over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel as required by 21 CFR 211.68 (b).
For example, the [redacted] data acquisition system for the [redacted] UV/Visible spectrophotometers allows your analysts to modify, overwrite, and delete original raw data files. The spectrophotometers are used for dissolution testing of finished product, stability samples, and process and method validation studies. All laboratory personnel were given roles as [redacted] Managers, which allowed them to modify, delete, and overwrite results files. This system also does not include an audit trail or any history of revisions that would record any modification or deletion of raw data or files. Your laboratory computer system lacks necessary controls to ensure that data is protected from tampering, and it also lacks audit trail capabilities to detect data that could be potentially compromised.

Comment

Refer to previous security notes from previous posts. The thing that is most noticeable from these posts ranging from 2007 to 2009 is that the FDA continues to quote only 21 CFR 211.68 (a) and (b) and does not directly quote 21 CFR Part 11.

The FDA Guidance (2003) states:

The Agency intends to exercise enforcement discretion regarding specific part 11 requirements related to computer-generated, time-stamped audit trails (§ 11.10 (e), (k)(2) and any corresponding requirement in §11.30). Persons must still comply with all applicable predicate rule requirements related to documentation of, for example, date (e.g., § 58.130(e)), time, or sequencing of events, as well as any requirements for ensuring that changes to records do not obscure previous entries.

Even if there are no predicate rule requirements to document, for example, date, time, or sequence of events in a particular instance, it may nonetheless be important to have audit trails or other physical, logical, or procedural security measures in place to ensure the trustworthiness and reliability of the records.6 We recommend that you base your decision on whether to apply audit trails, or other appropriate measures, on the need to comply with predicate rule requirements, a justified and documented risk assessment, and a determination of the potential effect on product quality and safety and record integrity. We suggest that you apply appropriate controls based on such an assessment. Audit trails can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.

From this guidance it is clear that while the agency will exercise enforcement discretion in the implementation of audit trails there is an expectation that the regulated company will risk assess and demonstrate the integrity of the electronic record.

It is also worth noting that this observation is against configuration files and raw data and not against the final record / result, which I assume would be a printed record.

A Good Electronic Record Management (GERM) policy with a risk based approach to ensuring record integrity and based on the FDA final guidance should provide sufficient quality assurance for GMP Records and Associated Raw Data. This policy should include management of security and audit trails.

CSV FDA Warning Letter : Periodic Review

Date: 21 May 2010
Link: FDA Warning Letter (New Window)

Observation

6. Your firm failed to check the accuracy of the input to and output from the computer or related systems of formulas or other records or data and establish the degree and frequency of input/output verifications [21 CFR § 211.68(b)].

For example, the performance qualification of your (b)(4) system software (Validation No. 4000-03-PQ-0002) failed to include verification of the expiration date calculations in the (b)(4) system. In addition, there is no established degree and frequency of performing the verification. Discrepancy reports have documented that product labeling with incorrect expiration dates have been created and issued for use.

Your response states that you opened Investigation T-139 and you provide a January 29, 2010 through February 26, 2010 completion timeline. You have not provided a response to correct this violation and establish a corrective action plan to assure that computer systems are properly qualified.

Comment

This observation by the FDA relates to both the inadequacy in the initial validation of the computerised system and the failure to perform requalification.

With respects to the initial qualification of the computer system a risk assessment should have identified the potential risk of the failure to calculate the expiry date (a significant failure) and performed validation. However the challenges put on the software may not have generated the circumstances that the failure occurs, but would have provided a level of quality assurance that the function would operate correctly. The risk assessment may have also determined that due to the potential risk further detection methods should be in place to ensure that the incorrect expiry dated product did not move forward in to the supply chain.

Periodic Review of the computer system should have identified trends in failures of the control system to meet its requirements via trending incidents and deviations relating to the system. Where major failures are detected, then a process of redesign and process improvement should be implemented, to remove the risk of failure.

A Periodic Review of critical computer systems provides the most efficient method of assuring that the system is operating within its validated state and determining the level of revalidation required.

The Periodic Review should identify trends in system failure incidents or deviations are detected then a Corrective Action Preventative Action (CAPA) should be put in place to resolve the issue.

The Periodic Review should consider a number of things which I will add to a future article.

CSV FDA Warning Letter : Security Controls

Date: 14 Jan 2008
Link: FDA Warning Letter (New Window)

Observation

3. Failure to have a validated and secure computerized system. Additionally, there were no written protocols to assign levels of responsibilities for the system.

It was noted that the [redacted] instrument model [redacted] used for the analysis of [redacted] failed to have password control for the analysts and the supervisor. It was observed that the data stored on the computer can be deleted, removed, transferred, renamed or altered.

While your firm's management stated that they would like to implement certain improvements in order to establish a security system, no documentation or commitment has been provided.

Please note that computerized systems should have sufficient controls to prevent unauthorized access or changes to data. There should be controls to prevent data omissions and assure back-up. There should be a record of any data change made, the previous entry, who made the change, and when the change was made.

Comment

This is a clear observation against 21 CFR part 11. The 21 CFR part 11 observation identifies the following flaws in the management of electronic records and raw data

• Validation of the Computer System (21 CFR part 11.10(a))
• Security management (control of access 21 CFR part 11.10(d))
• Failure to protect records (21 CFR part 11.10(c))

Compliance with 21 CFR part 11 should remain a priority for regulated companies, the challenge is to develop processes that ensure the integrity of the record and data that does not provide excessive overhead to the regulated company.

The regulated company must define its approach to electronic records including.

• Validation
• Audit trails
• Security (including techincal and procedural controls)
• Retention of Electronic Records and Raw Data
• Backup and Archiving

The article Electronic Records provides an introduction to implimenting a risk based approach to Good Electronic Record Management.

CSV FDA Warning Letters : Security

Date: 16 April 2007
Link: FDA Warning Letter (New Window)

Observation

6. Appropriate controls are not exercised over computers or related systems to assure that changes in analytical methods or other control records are instituted only by authorized personnel [21 CFR 211.68(b)]. Specifically,
a) There was a failure to validate the [redacted] software to assure that all data generated by the system was secure. This software runs the laboratory HPLC equipment, generates and stores data, and performs calculations during testing of raw materials, in-process materials, finished products, and stability samples.
b) User access levels for the [redacted] software were not established and documented. Currently, laboratory personnel use a common password to gain access to the system and there are no user access level restrictions for deleting or modifying data. Furthermore, your system does not have an audit trail to document changes.

Comment

This is a similar observation to CSV FDA Warning Letters : Security in that the integrity of the record and the associated security was not considered at the time of the planning and installation of the system.

A Good Electronic Records Management (GERM) procedure with a risk based approach to ensure the integrity of records within the system should be deployed by the regulated company. A policy for managing user access to systems and verification of the security during Installation Qualification is critical to the validation process.

CSV FDA Warning Letters : Audit Trail

Date: 14 January 2010
Link: FDA Warning Letter (New Window)

Observation

6. Your firm has not exercised appropriate controls over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel [21 CFR 211.68(b)].

For example, your firm lacks systems to ensure that all electronic data generated in your Quality Control laboratory is secure and remains unaltered. All analysts have system administrator privileges that allow them to modify, overwrite, and delete original raw data files on the (b)(4) used (b)(4) in the High Performance Liquid Chromatography (HPLC) units. There are no procedures that address the security measures in place for generation and modification of electronic data files for these instruments used for raw material, in-process, finished product and stability testing. In addition, your firm's review of laboratory data does not include a review of an audit trail or revision history to determine if unapproved changes have been made.

Your September 17, 2009 response states that you replaced the (b)(4) HPLC systems operating on (b)(4) software with (b)(4) new qualified HPLC units from (b)(4) software. This validation information will be reviewed at the next inspection. In addition, your response is inadequate because it lacks a retrospective evaluation of the data from the former HPLC units. This will prevent an alteration of data prior to implementation of your corrective actions. Further, your response does not address security procedures to ensure that the data generated using the new HPLC units is secure and remains unaltered.

Comment

Again this post cites 21 CFR 211.68 although it could easily be a reference a violation of 21 CFR Part 11.

While the FDA has stated in the 21 CFR Part 11 Guidance to Industry that enforcement discression would be shown in the implimentation of audit trails the agency has shown through a number of warning letters that the regulated company must be able to demonstrate the integrity of the electronic record, both through the use of security measures and audit trails.

It appears that the agency is using 21 CFR 211 with guidance from 21 CFR Part 11 to drive the violations within the 483 Warning Letters.

An audit trail is a key function to ensuring the integrity of the electronic record and raw data. The audit trail requirements are detailed clearly within 21 CFR Part 11.

It is also clearly (from this observation) that having an audit trail is not enough, a process is required to ensure the data integrity through security procedures and review of the audit trail.

This requirement to review the audit trail needs to be carefully considered. Having a sweeping policy to review all audit trails routinely will be extremely labour intesive. A risk assessment considering access to the system, a process for ensuring critical parameters are not changed and a level of audit trail review may prove to be the most efficient, cost effective way of achieving compliance.

CSV FDA Warning Letters : Operational Compliance

Date: 21 December 2009
Link: FDA Warning Letter (New Window)

Observation

19. Automatic, mechanical, or electronic equipment is not routinely calibrated, inspected, or checked according to a written program designed to assure proper performance [21 CFR 211.68(a)]. For instance, the mixer, scales, filling/dispensing machine, water distiller, foil heat sealing machine, drying chamber, and tablet press are not calibrated and inspected in accordance with a written program.

Comment

The regulated company must have a maintenance program including calibration. At Installation Qualification (Verification) assurance should be sought that the maintenance program has been put in place. A check should ensure that the calibration frequency is established and that a mechanism is in place (Maintenance Planning and Reporting System) to ensure that the calibrations are performed and the calibration data recorded.

CSV FDA Warning Letters : Qualification

Date: 27 April 2009
Link: FDA Warning Letter (New Window)

Observation

8. Failure to maintain a written record and appropriate validation data of computer or other automated processes used to perform calculations in connection with laboratory analysis [21 CFR 211.68(b)]. Refer to FDA 483, Observation 12. For example, the accuracy of calculations performed by the [(b)(4)] Spectrophotometer has not been verified.

Comments

This is a typical failing within the validation of standard laboratory instrumentation, the failure to provide documented evidence that the software performs within specification.
Whenever possible the supplier, as the Subject Matter Experts (SME) should be employed to provide this documented evidence, either at the factory or during the on site qualification.
An alternative method of ensuring quality could include a Supplier Quality Audit, with verification over the suppliers design, source code review process and testing. While this does not provide direct testing it provides sufficient relative quality assurance that the laboratory instrument is fit for purpose.

CSV FDA Warning Letters : Security

Date: 07 May 2009
Link: FDA Warning Letter (New Window)

Observation

5. Your firm has not exercised appropriate controls over computer or related systems to assure that changes in control records or other records are instituted only by authorized personnel [21 CFR 211.68(b)J. For example, one user account is established for two analysts to access the laboratory instrument's software on the computer system attached to HPLC systems (b)(4) and . The user account provides full system administrative rights, including editing of the methods and projects. In addition, data security protocols are not established that describe the user's roles and responsibilities in terms of privileges to access, change, modify, create, and delete projects and data.

Comment

This is one of many inspection findings relating to the security of computerised systems. In this instance it relates to laboratory instruments within a pharmaceutical manufacturer of over-the-counter (OTC) drug products.

Regulated companies must put in place sufficient controls to ensure that users have access to only the functions that they require and that the electronic records, either for developing methods and management of electronic records.

A Good Electronic Records Management (GERM) procedure with a risk based approach to ensure the integrity of records within the system should be deployed by the regulated company.

This policy should then be deployed throughout the validation lifecycle (to risk assess and assure the integrity of the data) with controls in place for the operational compliance including the review of audit trails.

CSV FDA Warning Letters : ERP and Calibration

Date: 07 May 2009
Link: FDA Warning Letter (New Window)

Observation

4. Failure to routinely calibrate, inspect, or check according to a written program designed to assure proper performance of automatic, mechanical, or electronic equipment, including computers, used in the manufacture, processing, packing and holding of a drug product. [21 CFR 211.68]

Part A
A. The Enterprise Resource Planning System known as the firm's Systems Applications and Products (SAP) computer database allows rejected batches of drug product to be in Unrestricted Status (to be released for distribution). Refer to Form FDA 483, Observation #3.

Part B
B. Failure to retain original calibration data for [(b)(4)] used in the re-qualification of the [(b)(4)]. Refer to Form FDA 483, Observation #4b.

Comment

Both parts of this observation could have been allocated to the ruling for Electronic Records, Electronic Signatures 21 CFR Part 11, however the agency chose not to cite against this rule, favouring 21 CFR 211.

This is a trend that has been observed when reviewing warning letters.

Part A for the SAP Enterprise Resource Planning (ERP) System relates to the security of the data and the ability for transactions to be made by unauthorised personnel on rejected batches. This is a serious product quality issue as it is possible for a Rejected Batch to be released for use.

The key to avoiding this pit fall is to ensure that documented risk assessments are performed. For an ERP system a number of assessments may need to be performed against various functional aspects. Also the security privileges should have been assessed and the access list should have also covered what roles have access to each function.

Verification through testing should be performed to ensure that the configured user settings provide the required controls and that a Standard Operating Procedure (SOP) is developed for the control and maintenance of user access.

Part B relates to calibration records, and the retaining of raw data. This is an interesting observation as many companies transcribe the raw data (calibration results) to a calibration management system and then discard the paper copies. When taking this approach it is important to have a Standard Operating Procedure (SOP) in place which will document what is the primary calibration record, how the record will be verified (within a calibration database) and the role of the quality organisation.

CSV FDA Warning Letters : Qualification

Date: 08 April 2010
Link: FDA Warning Letter (New Window)

Observation

7. Your firm failed to routinely calibrate, inspect, or check automatic, mechanical, or electronic equipment according to a written program designed to assure proper performance [21 C.F.R. § 211.68(a)].
For example, your firm has not conducted performance qualification for the (b)(4) unit-dose packaging machine (b)(4)™ to ensure its proper performance. Your firm has also failed to provide documentation to establish that the (b)(4)™ or (b)(4)“Bingo Card” repackaging equipment (for liquid and solid oral doses, respectively) has been qualified before use.
In your response of January 18, 2010, you stated that your firm has completed “machine validation” on several pieces of repackaging equipment used in production and will complete the process by the end of February 2010. This response is inadequate in that it fails to adequately describe how and on which pieces of equipment qualification will be performed. Your response provides an intended future date of completion, but fails to address whether manufacturing operations will continue before the machine qualifications are finalized, and, if so, what additional controls will be implemented during this interim period.

Comment

This observation is a failure to provide documented evidence that a system (in this case a machine) is fit for purpose. Although the initial observation relates to Performance Qualification (PQ) the process of ensuring a system is fit for purpose (Qualification) should be ensured through the design and installation of the equipment.
The regulated company should have a Site Validation Master Plan (VMP) or Computer Systems Validation policy which clearly defines the process for the definition of requirements, design documentation and testing strategy is fundamental to ensuring compliance with the agencies (FDA, MHRA, etc) rulings and expectations.