Top 11 FAQs about GMP Guidelines for Quality Management Systems
The GMP guidelines are mandatory in most countries for pharmaceuticals, medical devices, and food industries. Companies that fail to comply with these guidelines can face severe regulatory consequences. For this reason, GMP certification is an essential prerequisite to be in the life science industry. If you are working on building a robust GMP-compliant Quality Management System (QMS) for your organization, then keep scrolling through the article. We will examine the top 11 FAQs about GMP guidelines for a Quality Management System.
1. What is a GMP-compliant way forward for handling old devices if an audit trail is unavailable or a "user login" is not possible?
As per Annex 11 and 21 CFR Part 11, the audit trail must be available concerning GMP-relevant data and their modification in a computerized system. Suppose this functionality was unavailable when the system was acquired. In that case, check if the audit trail functionality is available for the system now. If not, EU GMP Annex 11 or 21 CFR Part 11 does not describe the alternatives.
However, an option is suggested by the PIC/S in the document titled PI 041 GOOD PRACTICES FOR DATA MANAGEMENT AND INTEGRITY IN REGULATED GMP/GDP ENVIRONMENTS, which states, "If no electronic audit trail system exists a paper-based record to demonstrate data changes may be accepted until an audit trail enabled (integrated system or independent audit software using a validated interface) system becomes available. These hybrid systems are permitted where they achieve equivalence to an integrated audit trail, such as described in Annex 11 of the PIC/S GMP Guide."
2. What could be GMP-compliant practice to move from a hybrid QMS to a Smart QMS or e-QMS when the former does not support Audit Trail upgrade?
We suggest having procedural measures driven by documented risk assessment in such cases. The risk assessment must lead to an action plan which specifies the sequence in which systems without an audit trail are to be replaced. In addition, procedural measures must ensure that changes to GMP-relevant data are documented by following the rules of Good Documentation Practice.
3. How does the FDA recommend addressing data integrity problems according to GMP?
The FDA encourages demonstrating effective remediation of data integrity problems through root cause analysis followed by a mitigation plan to eliminate the identified root cause or causes. In addition, it is advised to conduct a scientifically sound risk assessment of its potential effects.
For example, the risk involved will be more severe if the data is used to support clinical study submissions to the FDA. The management strategy to mitigate such a high-risk data integrity breach may include hiring a third-party auditor and removing individuals responsible for data integrity lapses. It may also include improvements in quality oversight, procurement of enhanced computerized systems such as smart QMS or e-QMS, and the creation of mechanisms to prevent recurrences and address data integrity breaches (e.g. anonymous reporting system, data governance officials, and guidelines).
4. What could be the potential GMP consequences of deleting data?
Deleting data without completing the mandatory data retention period will be considered a data integrity breach. However, deleting the data that is no longer required is allowed, provided a well-documented data deletion Standard Operating Procedure is followed. There are very few exceptions regarding when data may be deleted before its retention period. An example of such an exception is data migrated to another system.
5. What is a GMP compliant regulatory pathway to implement PAT in our manufacturing facility?
FDA's 'Guidance for Industry PAT - A Framework for Innovative Pharmaceutical Development, Manufacturing, and Quality Assurance’, published in 2004, states that companies interested in implementing PAT should carry out general correspondence with FDA's PAT team on PAT@cder.fda.gov. Relevant supplements (Changes Being Effected, Changes Being Effected within 30 Days or Prior Approval Supplement) can be submitted to the Agency before implementation. A PAT Team or PAT-certified Investigator can perform an inspection before implementation. A comparability protocol may be submitted to the Agency outlining PAT research, validation and implementation strategies, and timelines. Following the Agency's approval of this comparability protocol, one or a combination of the above regulatory pathways can be adopted for implementation. It should be noted that when certain PAT implementation plans neither affect the current process nor require a change in specifications, you can consider several options. Therefore, you should evaluate and discuss with the Agency the most appropriate option for their situation.
6. How to become a Qualified Person?
Article 49 of Directive 2001/83 and Article 53 of Directive 2001/82 (for veterinary medicinal products, please read) define a Qualified Person or Qualified Person's qualification level and the necessary professional experience. The EU requirements specified in these Directives must be transferred to national law in each EU Member State. However, there are several differences in the EU Member States because each Member State can implement the directives into national law with slight modifications. Therefore we recommend discussing the matter with the respective Member State authority you plan to work as a Qualified Person.
7. Is a Qualified Person responsible for all activities under the Quality Management System, such as approval of all kinds of documents, forms, reports, etc.
The role of a Qualified Person should be distinct from the Head of a Quality Management System, Head of Quality Assurance, or Head of a Quality Control Unit. Although one person may be responsible for multiple roles in smaller companies, it may not be the case with companies that can hire a separate resource for each position.
The Qualified Person must ensure that the prerequisites described in Annex 16 to the EU GMP Guide are fulfilled. However, there is no requirement in the European regulations and Guidelines that the Qualified Person must approve any other documents than the release documentation. In summary, a Qualified Person should be involved in implementing and maintaining the Quality Management System. But the Qualified Person is not obliged to implement and run the Quality System.
8. Can a quality issue, such as potential data falsification, be handled informally outside the documented CGMP quality system?
No. Irrespective of the intent, manner, or source of the information, suspected or known falsification of the records required under parts 210, 211, and 212 must be thoroughly investigated under the CGMP-compliant quality system to determine the effect of the event on patient safety, product quality, and data reliability; to determine the root cause; and to ensure the necessary corrective actions are taken (see §§ 211.22(a), 211.125(c), 211.192, 211.198, 211.204, and 212.100).
Additionally, the FDA invites individuals to report suspected data integrity issues that may affect drug products' safety, identity, strength, quality, or purity at DrugInfo@fda.hhs.gov. Individuals should include "CGMP data integrity" in the email's subject line. This reporting method does not supersede other FDA reports, such as field alert reports or biological product deviation reports to identify drug products that pose potential safety threats.
9. Is it essential to study multivariate interactions of all parameters to develop a design space for Quality by Design?
Not always, as the Quality by Design workflow requires applicants to carry out a risk assessment of all possible material and process attributes that can influence the critical quality attributes of the drug product; therefore, in cases where only a single material attribute or a process attribute is found to be critical to achieving desired product quality, then a univariate study can be sufficient to develop design space.
However, given the complexity of pharmaceutical operations, it is seldom possible to have a single critical material attribute or critical process parameter that influences the product's critical quality attributes. Therefore, if the manufacturer needs more flexibility to change several critical material attributes and critical process parameters for scaling up the process or to make post-approval changes in the manufacturing process, then it is recommended to study multivariate interactions of the concerned parameters.
10. What tools are acceptable to use in quality risk management?
None of the GMP guidelines limit the use of tools for quality risk management. However, one can refer to several EU GMP Part III examples. You can also use combinations of tools for a good risk assessment.
11. What is the role of the Qualified Person in the validation?
The Qualified Person does not have a formal role in the validation. But including a Qualified Person is recommended as the Qualified Person is responsible for finally releasing the manufactured product. This release can only be authorized knowing the quality systems used for the proper validation.
Conclusion
We know that GMP is a vast topic, and what we have covered in the top 11 FAQs is only the tip of the iceberg. However, we still hope these FAQs and the answers will help you prepare better for meeting the key GMP challenges faced most frequently by your industry peers.
Looking for a GMP-Compliant QMS? Discover how Scilife Smart Quality Platform can help you!
