OR WAIT null SECS
The concluding part of the article from last month's "Question of Quality" on what "complete data" actually means in practice.
US Good Manufacturing Practice (GMP) regulations for quality control (QC) laboratories require that laboratory records shall include complete data derived from all tests. In this second instalment of "Questions of Quality" we will look at paper versus electronic records in the context of complete data, what happens when things go wrong, and what is the European approach?
In part 1 of this column (1) we looked at the interpretation of the US Good Manufacturing Practice (GMP) regulations for quality control laboratories that require that laboratory records shall include complete data derived from all tests (2). We explored what was meant by "complete data" in the context of a chromatography data system and, with an analysis of the United States Food and Drug Administration (FDA) 483 citations, looked at the problems when a laboratory fails to understand this phrase (3). We will now consider if complete data includes the electronic files generated during the course of a chromatographic analysis or just the signed paper printouts.
Even before the publication of the FDA's regulation on electronic records and electronic signatures regulations (21 CFR 11) (4), there was a debate about what constitutes the raw data or primary record. Are paper printouts or the underlying electronic records that were used to produce the paper output the primary record or raw data? The FDA has produced a publication that stops the debate once and for all and makes it impossible to justify using paper as the primary record or raw data. Interested? Then read on. I have adapted the rest of this section from an earlier "Questions of Quality" column on defining raw data (5) that some readers may find interesting if they want a wider discussion of this topic.
In 2010, the FDA issued more detailed guidance aimed at chromatography data systems (CDS) used in quality control (QC) laboratories that work to GMP. The principles that were outlined can be applied to virtually any computerized laboratory system used for regulated work. This was published on the FDA website under the concise title: "Questions and Answers on Current Good Manufacturing Practices, Good Guidance Practices, Level 2 Guidance - Records and Reports" (6). Item 3 is a question concerning the interpretation of the GMP predicate rule (1) and the applicability of Part 11 (6) to chromatographic data systems.
The web page posed the question: "How do the Part 11 regulations and predicate rule requirements for GMP apply to the electronic records created by computerized laboratory systems and the associated printed chromatograms that are used in drug manufacturing and testing?" Although the FDA's answer to the question is based on chromatography data systems, it is applicable to all computerized laboratory systems. If in doubt, take a look at the question that the FDA posed and substitute chromatogram for spectra or any other laboratory record and the answer is applicable to non-chromatographic instruments and the associated data systems that generate electronic records. The FDA starts by stating that "some in industry misinterpret lines 164 to 171 from the Part 11 Guidance (7) to mean that in all cases paper printouts of electronic records satisfy predicate rule requirements in 21 CFR Part 211."
Therefore, the key to the debate is this: What do the GMP predicate rules state and how should they be interpreted for a computerized laboratory system? The FDA comment that for a CDS and other computerized systems used in a QC laboratory involving user inputs, outputs, or audit trials, that there are two clauses from the GMP regulations applicable for the interpretation of paper versus electronic raw data debate. These are §211.68 and §211.180(d) (2).
The FDA then makes the following statement which is reproduced below in its entirety; I have just added the bullet points to aid readability and understanding:
Why the lengthy debate on this point? The reason is that electronic records contain much more information than the corresponding paper printouts of the same chromatographic run. Consider an Excel file as a simple example, under the properties tab there is information about the file creation and printing dates that a typical printout does not contain unless specifically configured to do so. In this simple case the electronic record contains more information than the paper one. Think about an analytical run: Who prints out the audit trail? However, the audit trail contains critical information to demonstrate the integrity of the analytical run including the interpretation of the raw data files and their conversion into the final reportable value. It also identifies critical operator interactions that involve manual data entry, interpretation or modification of data, or carry out calculations. Therefore, the electronic records from a data system contain much more information than the paper printout. That is why the FDA want electronic records. Printed chromatograms do not satisfy the predicate rule requirements in 21 CFR 211.
In summary, a paper printout does not meet the requirements of the predicate rule and the chromatographic system must therefore be considered either a hybrid system (electronic records with signed paper printouts) or a fully electronic system. Regardless of the way a chromatographic system is used (hybrid or homogeneous system), the electronic records must be maintained and are key to meeting the predicate rule requirements.
However I think that the FDA have missed a trick in this discussion because the key regulatory requirement for the QC laboratory is §211.194(a) (2) which states that "Laboratory records shall include complete data derived from all tests necessary to assure compliance with established specifications and standards." For example, an audit trail is part of the complete data regardless of whether the system is a hybrid or a fully electronic one. Therefore, if you use the argument that your laboratory records are paper, then you do not have a leg to stand on, because paper records can never be complete.
As a result of several cases of fraud and falsification identified over the past few years by the FDA, all FDA inspectors have undergone training in data integrity by Monica Cahilly (Green Mountain Quality Assurance). Now, during inspections, they will focus on the system and the electronic records contained within it, rather than the paper outputs. Paper is now incidental to the integrity of the underlying electronic records generated by any computerized laboratory system used in a regulated laboratory. It should also be noted that complete data includes the audit trail entries created during the generation, interpretation, and modification that occur during an analysis.
Of course, there are always worthy organizations whose sole purpose in life is to serve as an example for others not to follow. In this section I will present only those laboratories that have had a difference of opinion with the FDA inspectors over their interpretation of complete data. Or perhaps that should be incomplete data? This list is obviously not exhaustive but merely illustrative of my aim in this column.
The first example is Compania International de Comercio in Mexico (8) and looks at a failure to have complete data and being rather selective in documenting the results.
Example 1: Your firm has not established appropriate controls designed to assure that laboratory records include all data secured in the course of each test, including graphs, charts, and spectra from laboratory instrumentation, properly identified to show the specific component, drug product container, closure, in-process material, or drug product, and lot tested [21 CFR 211.194 (a)(4)].
Specifically, the inspection revealed that your firm has not established written procedures to control and account for electronically generated worksheets used by analysts to record analytical test results. Analysts in your QC laboratory print an uncontrolled number of worksheets from computers throughout the QC laboratory without supervision. For example, (a) The investigator found a certificate of analysis (COA) for <redacted> oz, lot number <redacted>, dated January 19, 2011, in a trash container in the office used by QC personnel. This COA reported an assay value for <redacted> of <redacted>%.
A second COA, dated January 21, 2011, filed with the analytical package for lot <redacted>, reported an assay value of <redacted>%. (b) An analytical worksheet for <redacted>oz, lot <redacted>, dated January 21, 2011, with no approval signature, was found in a trash container in the office used by QC personnel. This analytical worksheet shows calculations of content uniformity for active ingredient <redacted> of <redacted>%. The COA dated January 21, 2011 filed with the analytical package reports a content uniformity (CU) value of <redacted>%. The CU value in the reference COA represents the analytical testing performed on a single in-process sample after the product has been <redacted>. (c) The calculations for <redacted> in <redacted> Lot <redacted> were conducted using two (2) of three (3) injection areas. The FDA investigator's review of the HPLC (# C003) raw data verified the existence of three (3) HPLC chromatograms generated from batch <redacted>. However, only two (2) injection areas were used in the calculations.
Here we have selective use of results, a selected "complete data" in item (c) above and also the use of multiple copies of certificates of analysis: perhaps, if a back is out of specification the analyst has gone back to reinterpret the data?
The second example comes from Gulf Pharmaceutical Industries from February 2012 (9) and concerns failures to retain the electronic CDS files and reliance on paper. The warning letter citation reads:
Example 2: Your firm has not established appropriate controls over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel. Your firm also fails to maintain a backup file of data entered into the computer or related system [21 CFR § 211.68(b)].
Recently, the FDA has issued a warning letter to RPG Life Sciences Ltd (10) that also highlights both issues with complete data and overall integrity of the data generated by the laboratory. The FDA inspection covered two sites and at both there were citations for lack of complete data:
With these comments the integrity of any data generated by the laboratory is destroyed because of testing into compliance, falsification, and selection of passing results. The remedial actions required by the FDA is very onerous but could have been avoided if the company worked in a compliant way.
Of course, problems like these can never happen in your laboratory, can they?
One aspect of the discussion of paper versus electronic records is the use of PDF reports. In some cases, a laboratory may think that a PDF report can be substituted for paper printouts. Let us discuss this further. If there is only a PDF report and no information about the sample information, sample weights, details of the preparation of reagents or standards, and no chromatographic data files the report is incomplete. This is exactly the same argument that the FDA shot down in flames for a paper report, as discussed in the last section. The only difference is that instead of a paper printout the same information is found in an electronic report.
The only time, in my view, that a PDF report is acceptable as part of the complete data for an analysis is when:
Therefore, a laboratory relying solely on a PDF report file is totally inadequate because it does not comply with the regulations for complete data, even if printed or PDF copies of the underlying chromatograms are attached.
Think this through with all your laboratory operations: What happens if you use a third-party supplier to do your instrument qualification? What output from the process could you get? A PDF report (either on paper or electric version) and the service engineer walking out of the laboratory with the chromatography data files used to generate the report on their PC? Try explaining this to an inspector. How much of an idiot do you wish to appear?
As well as the need to retain the electronic data, the data flow used by the engineer from the start of the process to the generation of the PDF report (and the traceability of any embedded electronic information) must be clearly understood by you — because you will need to defend it during an audit or an inspection. What you need to consider is:
No? I thought not.
Up to now this column has focused exclusively on the FDA GMP regulations for regulated laboratories, we also need to consider that we work in a global environment and there are other regulations to consider. At the start of July 2013 the new version of EU GMP Chapter 6 for Quality Control (11) will go into effect. Here, the main changes are the inclusion of a new section on technical transfer of testing methods and other items such as out of specification results. (There are five new clauses specifically on method transfer).
However, the main portion of the regulation is unchanged and the pertinent sections dealing with laboratory records are shown below. The requirements in the EU are essentially similar to those in the USA, although there are some differences between US and EU regulations for QC laboratories such as:
Therefore, data must be trended under EU GMP, but this is only contained in the OOS Guidance for Industry from the FDA (12).
However, the main requirements for laboratory records are shown below:
Although the section on laboratory records in Chapter 6 is relatively brief compared with the 21 CFR 211, the EU GMP regulation is implicit in requiring complete data and is not as detailed as the FDA GMP. However, there are some further requirements of the batch records required in Chapter 4 on documentation (13) that I do not have space to go into, but when all requirements in Chapter 6 and Chapter 4 on documentation are combined their impact is similar to US GMP.
In this column we have looked at what requirements there are for "complete data" for laboratories working under the FDA GMP regulations and also looked at the mistakes that are made by reviewing the 483 observations made by inspectors over 2006–2012. The problem is that elementary analytical science mistakes are made by staff and laboratory management that are a result of poor education, laziness, or incompetence. We have also looked at whether paper printouts or electronic records are adequate to meet GMP regulations and, conclusively, it is not paper.
"Questions of Quality" editor Bob McDowall is Principal at McDowall Consulting, Bromley, Kent, UK. He is also a member of LCGC Europe's editorial advisory board. Direct correspondence about this column should be addressed to "Questions of Quality", LCGC Europe, 4A Bridgegate Pavilion, Chester Business Park, Wrexham Road, Chester, CH4 9QH, UK, or e-mail the editor-in-chief, Alasdair Matheson, at firstname.lastname@example.org
(1) R.D. McDowall, LCGC Europe 26(6), 338–343 (2013).
(2) Current Good Manufacturing Practice for Finished Pharmaceutical Products, 21 CFR 211, 2009.
(3) Inspections, Compliance, Enforcement, and Criminal Investigations http://www.fda.gov/ICECI/EnforcementActions/ucm250720.htm
(4) Electronic Records; Electronic Signatures final rule (21 CFR 11), 1997.
(5) R.D. McDowall, LCGC Europe 25(4), 194–200 (2012).
(6) Questions and Answers on Current Good Manufacturing Practices, Good Guidance Practices, Level 2 Guidance - Records and Reports. Part 3 (2010) http://www.fda.gov/Drugs/GuidanceComplianceRegulatory Information /Guidances/ucm124787.htm
(7) FDA Guidance for Industry, Part 11 Scope and Application, 2003.
(8) FDA Warning Letter, Compania International de Comercio, June 2012.
(9) FDA Warning Letter, Gulf Pharmaceutical Industries, February 2012.
(10) FDA Warning Letter, RPG Life Sciences Limited, May 2013.
(11) EU GMP Chapter 6 (2013).
(12) FDA Guidance for Industry, Out of Specification Results, 2006.
(13) EU GMP Chapter 4, Documentation.