What is FDA doing about Part 11? Is the regulation for electronic records and electronic signatures still in force? – The answer is YES – What, if anything, should my company or clinical site be doing about it. Strict compliance can be very expensive- almost as expensive as no compliance at all! Here are three tips on Part 11 compliance from veteran consultants and regular GxP Perspectives contributors, Emma Barsky and Len Grunbaum. I first met Len at the last FDA training course I attended as an FDA field inspector. He is still training FDA and Industry on computerized systems. Given that FDA is focusing more and more on the automated processes and integrity of the data collected using automated means, Part 11 is more important than ever.
Carl Anderson, GxP Perspectives
GUEST COMMENTARY
Three things you need to know about 21 CFR part 11
by Emma Barsky & Len Grunbaum
Fifteen years after becoming effective, 21 CFR part 11 seems to generate as much controversy as it did when it was first implemented. At this point in time, we cannot think of another regulation that sparks as many disagreements with respect to its interpretation and generates as many discussions. Why is that?
Since the inception of the regulation as of August 1997, compliance has been, in our view, analogous to the story of Goldilocks and the Three Bears: compliance in some companies has been too hot (i.e., too restrictive and expensive); compliance in some companies has been too cold (i.e., minimal if any at all); and, compliance in some companies has been just right (i.e., cost-beneficial and based on an effective risk assessment). So, while we do not in any way want to equate compliance with the regulation to a bowl of porridge, we hereby offer three main things that you need to know about 21 CFR part 11 to help you make your compliance just right:
1. You need to know how to assess risks when it comes to 1) developing a validation approach regarding a given system and 2) implementing controls (e.g., audit trails, logical/physical security) to help ensure the trustworthiness and reliability of the records. As indicated in the Scope and Application guidance, the FDA’s “current thinking” on the subject, the agency will expect you to have a justified and documented risk assessment regarding these items. However, in order for the respective strategies and controls to be cost-beneficial in context of the potential of the system to affect product quality and safety, and record integrity, a combination of knowledge of system functionality, regulatory understanding, financial prudence and a healthy dose of common sense are required. Take one of these elements out of the equation and the resulting risk assessment will be neither practical nor useful.2. You need to know the minimum documentation that must be available to support compliance with 21 CFR part 11. Irrespective of the development model employed (e.g., waterfall, Agile/Scrum), the software delivery model employed (e.g., software-as-a-product, software-as-a-service) or data hosting model employed (e.g., internal data center, outsourced hosting), as applicable, a documentation suite that truly supports compliance should encompass the following:
• User/functional requirements, including 21 CFR part 11 requirements, to describe what the system is supposed to do;
• Technical specifications to define how the system is built and how it works, and which is the critical component in supporting effective system maintenance (e.g., troubleshooting problems, assessing the impact of planned bug fixes and enhancements);
• Development/validation SOPs, and evidence of compliance (e.g., required documentation, required approvals, developer-level and user acceptance testing), to define the process for developing and deploying a system that operates as intended and meets regulatory requirements;
• Traceability between test evidence and all requirements;
• Change control SOP and supporting change request/change control records to ensure that the system continues to operate as expected;
• Training SOP and supporting training records to support staff qualifications regarding system development, maintenance and use;
• IT infrastructure SOPs (e.g., logical/physical security, back-up and recovery, etc.) and supporting records to evidence on-going protection and availability of records.
3. You need to know that, for a given system, the quality of testing and quality of reviews are of paramount importance because they may compensate for ineffective development and/or validation SOPs. In other words, the devil (or in this case the saving angel) is in the details. Therefore, it is important that
• Testing is complete and reflective of true system risks;
• Test evidence is supportive of test results/conclusions and/or does not raise “red flags”;
• Reviews are timely and reasonable (e.g., only a realistic number of detailed test scripts should be reviewed in one day);
• Incident reports are reviewed and approved by appropriate individuals promptly.
If testing practices, testing evidence and/or testing reviews are questionable, they will constitute a serious gap from a risk-based perspective because 1) one may not be able to rely on the given system’s operation, results, etc., and/or 2) data quality and integrity may be viewed as being compromised.
While there are other aspects to 21 CFR part 11 that one should know (e.g., how to determine if 21 CFR part 11 even applies to you and, if not, how to document such a conclusion), the three items discussed above represent those areas where, in our view, compliance tends to be too hot (i.e., potential business risk in that the cost of doing business may be higher than it should be) or too cold (i.e., a potential regulatory risk in that regularity requirements may not be met which, in turn, may result in business risks based on the operational impact of FDA enforcement actions).Emma Barsky and Len Grunbaum
Partners of The Practical Solutions Group, LLC
609.683.0756
Practical Solutions
====
Join the GxP Perspectives Linkedin Group Here
Or get an email subscription (on the right sidebar)
====



Posted by GxP Perspectives 

























FDA 483s: Effective Responses to Avoid Warning Letters
October 16, 2011Effective Responses to Form FDA 483
Guest Commentary: One Way to Avoid a Warning Letter … Maybe
The following sentence fragments represent but a very small sample of trumpet calls heralding that a firm may have fumbled an opportunity to avoid a Warning Letter after receiving an FDA-483:
• “We have reviewed your response and have concluded that it is not adequate because…”
• “The adequacy of the response cannot be determined because the response did not include…”
• “Your response does not address…”
• “We have reviewed your firm’s response and note that it lacks sufficient corrective actions regarding…”
• “We have reviewed your firm’s responses; however we continue to have concerns related to your firm’s compliance…”
• “The adequacy of your firm’s response cannot be determined at this time…”
• “Your response is inadequate because…”
We say this because of the following: while a response to an FDA-483 is not mandatory and does not represent a final Agency determination regarding firm’s compliance, a firm’s voluntary response often does impact the Agency’s conclusion of the need for follow-up actions, one of which may be the much feared and dreaded Warning Letter. How so, you ask? Here is how….
"FDA will conduct a detailed review"
This brings us to the quality of the response itself. In this context, the higher the “quality” of the response, the more likely the FDA will consider the response as “adequate” and, as a result, may not issue a Warning Letter. Since the firm’s management controls the quality and timeliness of everything that goes on, we suggest that the following guidelines be used to craft the response to the FDA-483 to increase the firm’s chances of avoiding the Warning Letter:
• Train the individuals involved in the FDA-483 response effort regarding what information should be included in the response and the format chosen to present the response.
• Assign someone to review recent FDA Warning Letters to identify those items where the FDA indicates that the response to the respective FDA-483 was not adequate and include these items in the training to ensure that known mistakes/failures are not repeated.
Focus Your Response
• Establish the true root cause of the observation. In doing so, look for the operational gap (e.g., inefficient project management oversight) that resulted in the regulatory deficiency (e.g., lack of timely document reviews and/or approvals) so that it can be fixed properly and permanently.
• Provide specifics regarding any corrective actions taken or proposed. It is not adequate to state that the problem was or will be corrected. Details regarding 1) what was/will be corrected (e.g., development of a remediation plan), 2) when it was/will be completed and 3) if applicable, the timeframe for training (e.g., as in case of a revised procedure) should be provided.
• Describe preventive actions that will minimize or eliminate the chance of recurrence of the problem in the future.
• Provide supporting documentation for every claim made.
• Show commitment regarding implementing all of the proposed activities by 1) specifying activities to be taken and target dates for their completion, 2) assigning accountability for the actions, 3) ensuring proper completion of each respective activity though internal audits.
The Importance of a Quality Response to FDA 483s
The firm can request that its FDA-483 response be published along with the FDA-483 itself, in which case the response should be such that it gives confidence not only to the FDA but also, where applicable, to existing and potential clients, that non-conformities have not and do not impact data integrity.
The bottom line is this: Do not ever get yourself in trouble with the FDA. But if you do, avoid unforced errors by 1) taking the time and making the effort to respond to the FDA-483, if you get one, in a timely fashion, 2) using the guidelines above in doing so, or 3) consulting with an expert to assist.
By Emma Barsky and Len Grunbaum, the partners of The Practical Solutions Group, LLC
Contact Emma & Len
====
ExL Pharma has announced that FDA’s Dr. Leslie Ball will give the Keynote Address at the 2nd annual Developing CAPAs in the GCP Environment conference held 19-20 January in Arlington, VA. GxP Perspectives is a media sponsor.
====
Read FDA Warning Letters A suggested practice is to search Warning Letters by topic or issuing office. Then sort by “Letter Issue Date – Desc” to find the most recent Warning Letters.
19 October 2011 update: FDA posted a Warning Letter to SmithKline Beecham (GSK), West Sussex, UK for serious cGMP violations stating: “Your firm has not established appropriate written procedures designed to prevent microbiological contamination of drug products purporting to be sterile.”
Read the Warning Letter
====
You can help out GxP Perspectives! Please let your colleagues and friends know about GxP Perspectives. I also encourage you to get an email subscription (on the sidebar to your right) or join the GxP Perspectives LinkedIn Group (below).
====
GxP Perspectives LinkedIn Group
GxP Perspectives on twitter: @GxPPerspectives

====
On The Blogroll: Rebar Interactive (twitter: @rebarinte) has an excellent blog for clinical sites. If nothing else you MUST check out their post on:
“Patient Recruitment: Think That You Might Be Wrong,”
if for nothing else than the photo. A great blog post by Rahlyn.
—-
Share this:
Like this: