1 Regulatory Compliance Basics

Regulatory Compliance - Basics
Kuala Lumpur, October 2007

Dr. Klaus Fritsch
Manager Compliance
Global Business Area LabTec
Agenda
Evolution of GxP‘s
The User‘s View on Compliance
Good Laboratory Practice GLP
Good Manufacturing Practice GMP
Part 11
Lessons learnt
1 © K. Fritsch LabTec Internal usage only

Courtesy Bayer
1
“Cola” contained cocaine till 1906
“Bib-Label Lithiated Lemon-Lime”

contained lithium citrate
from 1929 till 1950; name
changed to “7up” in 1933
2
“Thalidomide” manufactured by West

German company Grünenthal from
1957 till 1961: 12000 foetuses born
with deformations in 46 countries
(“Condergan”)
=> led to the first EC Directive on

Proprietary Medicinal
Products (1965/65/EC)
Cyanide was deliberately added to “Tylenol”

(paracetamol) in Chicago area in 1982
(crime was never solved)
=> led to tamper-proof packaging for

medicines
3
89 children died in Haiti in 1996 from a

cough syrup containing diethylenglycol
(anti-freeze) instead of polyethylenglycol
(Dutch company, manufactured in China)
Diethylenglycol in toothpaste found in

Panama and the Dominican Republic
2004 Chiron flu vaccines licence

suspended (UK and USA)
(bacterial contamination)
4
⇒ Common objective:
Protection of Public
Health and Consumer
Safety
Agenda
Part 11
Lessons learnt

Courtesy Bayer
5
Source: Sam Brooks, Novartis Consumer Health, GAMP Europe

Conference Brussels, December 2006 10 © K. Fritsch LabTec Internal usage only

6

Agenda
Part 11
Lessons learnt
13 © K. Fritsch LabTec Internal usage

Courtesy only
Novartis
7
What is Good Laboratory Practice?
GLP is a quality assurance system,
which is legally binding in many countries
around the world, usually based on the
OECD GLP (slight differences from
country to country apply).
e.g. US law (21 CFR 58)

⇒ mandatory in the US
e.g. OECD Guidelines on GLP

⇒ are implemented in many developing
countries and supported by the WHO
⇒ are implemented in 2004/10/EC on GLP
and thus mandatory in Europe

Courtesy only
Novartis

Scope of Good Laboratory Practice (OECD Principles of GLP)
“These principles of good laboratory practice should be applied to the

non-clinical safety testing of test items contained in
pharmaceutical products,
pesticide products,
cosmetic products,
veterinary drugs,
food and feed additives,
industrial chemicals.
[…] The purpose of testing these test items is to obtain data on their
properties and/or their safety with respect to human health and/or the
environment […] for the purpose of registering and licensing […].

Courtesy only
Novartis
8
Good Laboratory Practice (GLP) – A Definition
OECD Principles of GLP
Good laboratory practice (GLP) is a quality system concerned with

the organizational process and the conditions under which non-
clinical health and environmental safety studies are
planned,
performed,
monitored,
recorded,
archived and
reported.

Courtesy only
Novartis
GLP Requirements: Product Life Cycle

4.2. Apparatus used in a study should
1 be periodically inspected, maintained,

and calibrated according to standard
operating procedures.
9
GLP Requirements: Data Quality and Integrity
7.1 A test facility should have written
2 SOP’s that are intended to ensure

the quality and integrity of the
data generated by that test facility.
GLP Requirements: Data Quality and Integrity

7.1 A test facility should
2 have written SOP’s that are

intended to ensure the
quality and integrity of the
data generated by that test
facility.
10
GLP Requirements: Design and Cleaning
4.1/4.2 Apparatus should be of
3 appropriate design and be

cleaned periodically according to
SOP’s.
GLP Requirements: Qualification and Training

1.1.2. At a minimum [the test facility management] should:
4 (c) ensure the maintenance of a record of the

qualifications, training, experience and job description
for each professional and technical individual;
(d) ensure that

personnel clearly
understand the
functions they are to
perform and, where
necessary, provide
training for these
functions;
11
GLP Requirements: Standard Operating Procedures
7.4. Standard operating procedures should be available for,
5 but not be limited to, the following categories of test facility

activities. The details given under each heading are to be
considered as illustrative examples.
2. (a) Apparatus: use, maintenance, cleaning and
calibration
2. (b) Computerized systems: validation, operation,
maintenance, security, change control and back-up
ISO 9001 – Quality Management Systems

7.6 Control of monitoring and measuring
6 devices
„Where necessary to ensure valid

results, measuring equipment shall
a) be calibrated or verified at specified

intervals, or prior to use, against
measurement standards traceable
to international or national
measurement standards […];
b) be adjusted or re-adjusted as
necessary.“
12
SOP – Standard Operating Procedure
GxP require our customers to test and manufacture their
products according to detailed, written procedures:
SOP‘s: Standard Operating Procedures.
There must be an SOP for everything which is quality

relevant. SOP‘s need to be
1) written,
2) rewiewed and
3) approved,
and any change to an SOP needs the same formal
procedure of writing, reviewing, and approval.
Lab management and QC are involved in this process.
Each quality relevant process step must follow these

procedures and must be documented and signed by two
persons (e.g. lab technician and QC).
If it is not documented, it has not been done!
Quality Assurance and Quality Control
Quality Control
If an activity is carried out to appraise manufacturing outcome or detect

defects it is usually Quality Control.
Group responsible for ensuring that products meet the established

quality specifications and are tested and produced according to SOP‘s
Group responsible for approving SOPs, specifications and validation

documents
Group responsible for actual product testing
13
Quality Assurance and Quality Control
Quality Assurance
If an activity is carried out to prevent the possibility of occurrence of

defects it is usually Quality Assurance.
Group responsible for over-seeing the quality issues of the operations
Conduct internal audits, training and investigations of quality problems
Independent of the production and QC processes
Interact most with the FDA inspectors
“GxP Quality Assurance operates on the principle that quality cannot be

tested into products but must be built in at every step of the life cycle.”
(FDA statement)
Agenda
Part 11
Lessons learnt

Courtesy Bayer
14
What is GMP?
Generate
More
Paper?
Introduction to GMP
What is Good Manufacturing Practice?
GMP is a quality assurance system for consistent
production and control, which is legally binding in many
countries around the world (in the 3rd world commonly
based on the WHO GMP, and in the industrialised
countries sometimes stricter; e.g. in the US and Europe).
e.g. US law (21 CFR 210/211)

⇒ mandatory in the US
e.g. WHO Guides on GMP

(pharma, food, blood,…)
⇒ are implemented in many
developing countries
⇒ Europe: EU Guide on
Manufacture
Courtesy Roche
15
Introduction to GMP
Good Manufacturing Practice (GMP) – A Definition
“Good manufacturing practice (GMP) is that part of quality assurance

which ensures that products are consistently produced and controlled to
the quality standards appropriate to their intended use and as required
by the marketing authorization. GMP are primarily aimed at diminishing
the risks inherent in any pharmaceutical production. Such risks are
essentially of two types: cross-contamination (in particular of unexpected
contaminants) and mix-ups (confusion) caused by, for example, false
labels being put on containers.”
“Good manufacturing practices for pharmaceutical products”, WHO 1992

Courtesy Roche
Key Elements of GMP - Qualification / Training

9.2. The manufacturer should have an adequate number of personnel
with the necessary qualifications and practical experience.
9.4. All personnel should be aware of the principles of GMP that affect
them and receive initial and ongoing training, including hygiene
instructions, relevant to their needs.
10.2. […] Continuing training

should also be given, and its
practical effectiveness
periodically assessed.
Approved training programmes
should be available. Training
records should be kept.
16
Key Elements of GMP - Equipment
13.1. Equipment must be located, designed,
constructed, adapted and maintained to suit
the operations to be carried out. The layout
and design of equipment must aim to mini-
mize the risk of errors and permit effective
cleaning and maintenance in order to avoid
cross-contamination, build-up of dust or dirt,
and, in general, any adverse effect on the
quality of the products.
13.2. Equipment should be installed in such

a way as to minimize any risk of error or of
contamination.
Key Elements of GMP - Equipment
13.5. Balances and other measuring

equipment of an appropriate range and
precision should be available for produc-
tion and control operations and should
be calibrated on a scheduled basis.
17
Key Elements of GMP - SOP’s
15.35 Standard operating procedures should be available for each

instrument and piece of equipment (e.g. use, calibration, cleaning,
maintenance) […].
Agenda
Part 11
Lessons learnt

Courtesy Bayer
18
A Glance at the US Law….
21 CFR Part 11
CFR: Code of Federal Regulations

(=> US law)
21 CFR: „Foods and Drugs“
21 CFR Part 58: „GLP“

21 CFR Part 210/211: „GMP for Pharma“
and of course…..
21 CFR Part 11: „ER/ES“
Purpose of 21 CFR Part 11
To allow the use of electronic records and signatures instead of

having to store and submit paper records
To prevent, or at least reduce the risk of, records being deliberately

manipulated to falsify results
To prevent unauthorized access to data
To ensure traceability to the originator or owner of a record
Of course, our customers still have to comply with all “predicate

rules“ like e.g. GLP or GMP regulations
19
Purpose of 21 CFR Part 11
To allow the use of electronic records and signatures instead of

es
having to store and submit paper records
p ani ere
To prevent, or at least reduce the risk of, records S com deliberately
th
ce the
U being
sin f
manipulated to falsify results
l ies to ever, rts o ut
a o
l y app ; how ther p ng ab l.
To prevent unauthorized access on toedata S i a
11 th
U
n in o n talk ot ide
t o e
Par ing to islati 1 wh ugh n
To ensure traceability
R t g
CF xpor le le Part d, thof
to the originator or 1owner o a record
t 21 e b r
tha aour
a to nda
Oftecourse, n m par still
iescustomers f ershave ttoa comply with all “predicate
No o
rules“ m p e.g.t GLP
like co yr
or GMP
e
s as
regulations
c en od it a
and no rec veryb akes
is rld, e and t
wo /ES
ER
Interpretation of 21 CFR Part 11

21 CFR Part 11 is vague so as not to force new requirements on the
industry
Companies in the regulated environment must define their own

realistic requirements
Each company has a different interpretation
FDA issued various guidelines for interpretation of 21 CFR Part 11,

the latest of them issued August 2003
A new draft part 11 was expected to be published for comment in De-

cember 2006, but the draft was rejected by the FDA legal department
20
Definitions in 21 CFR Part 11
Electronic record
Any combination of text, graphics, data etc. in digital form that is

created, modified, maintained, archived, retrieved or distributed by a
computer system
Electronic signature
Computer data compilation of a series of symbols authorized by an

individual to be the legally binding equivalent to their hand-written
signature
Responsibilities
Compliance is NOT the responsibility of the supplier, but of the user
Suppliers should make it as easy as possible for companies to comply

- provide systems that support compliance where possible
- provide suggestions on how to achieve compliance
Other measures may be necessary from the pharmaceutical

company’s side:
- access control
- SOP’s prohibiting access and documenting required procedures
21
Responsibilities
Compliance is NOT the responsibility of the supplier
,
m ers It is
Suppliers should make it as easy as possible for companies
st o t“. totecomply
cu i an d
- provide systems that support compliance o ur possible
where m pl alida s
o o s
b
- provide suggestions on how to achieve
a t 1 1 c ng a v acce
X tcompliance
gL ar usi ing e,…
p l yin X is p t by y hav plac
Other measures e
may
p Lab
sube „
necessary lian the
pfrom l
b ‘s in
e,pharmaceutical
r y : m p P
e a R sa be co d peo ry SO
company’swside:
hen NEVE as to traine cessa
-W ustcontrol h e
access
m w ho aving the n
e
w- SOPs r h g documenting required procedures
prohibiting access and
e use re, by havin
h
t twa by
sof ntrol,
co
Requirements for complying with Part 11

General requirements
System must be validated

System must be able to generate accurate and complete copies of
records in human readable and electronic form
Key requirements for electronic records
Access control and authority checks

- Possibility to assign access rights
Secure, computer generated, time-stamped audit trail
- Changes shall not obscure previous values
Ability to sign records
- Records shall contain the printed name of the signer, the date and time,
as well as the meaning of the signature
22
Key requirements for Electronic Signatures
Signatures shall employ at least 2 distinct components and must be

unique to one individual
- e.g. ID and password
Controls for ID‘s and passwords

- ID‘s must be unique
- Must be possible to disable accounts
- Must be safegaurds to prevent unauthorized access and such attempts
must be reported

Key requirements for Electronic Signatures
e use
Signatures shall employ at least 2 distinct components h f
w s tandiemust
u o be
unique to one individual all o in l
- e.g. ID and password r t 11 ures ut all
a at b
a nt: P sign ures, ready r.
t ic t l e
Controls for ID‘s and passwords
im por ctron signa flect a ustom
- ID‘s must be uniqueso le n re c
it is and e writte only on a
- Must be possible p
se otorddisable and finally sed u
s accounts
- Must c a u c h
be safegaurds
e to d
prevent o access and such attempts
unauthorized
i n, bebenreported
must ic r ds an art 11 s imp
a o r t
Ag lectr reco s of p men
e r t r e
of pape men equi
e Pr
uir
req ng Gx
sti
exi
23
Agenda
Part 11
Lessons learnt

Courtesy Bayer
Lessons learnt
GxP‘s are quality assurance systems which are legally binding in

many countries around the world
Main objective: Protection of Public Health and Consumer Safety
Documentation, training, testing, qualification and validation,

understanding the process, quality assurance and
control as well as the product life cycle are the key focus areas of GxP
GxP costs the industry a lot of money and work, and failure to comply
with GxP results in regulatory action
24
Lessons learnt
There is no single „THE GxP“; GxP does not dictate every detail, so
every company implements GxP differently
GxP is not a „cooking recipe“; this leads to customer doubts: „Is my

implementation of the GxP requirements compliant?“
Outsourcing responsibilites – and the associated risks – to suppliers is

a common strategy – and is a huge business opportunity for MT, if we
have the right tools in place to help the customer to be compliant and
to be confident that their processes are compliant
Compliance can only be achieved by having the right products, the

right services, the right training and the right expertise. A product
alone never allows our customers to be compliant with the regulations.
Our Opportunity…

25
Regulatory Compliance - Basics
26

1 Regulatory Compliance Basics

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1 Regulatory Compliance Basics

Uploaded by

Copyright:

Available Formats

Regulatory Compliance - Basics

Kuala Lumpur, October 2007

 The User‘s View on Compliance

 Good Laboratory Practice GLP

 Good Manufacturing Practice GMP

1 © K. Fritsch LabTec Internal usage only

 “Cola” contained cocaine till 1906

2 © K. Fritsch LabTec Internal usage only

 “Bib-Label Lithiated Lemon-Lime”

3 © K. Fritsch LabTec Internal usage only

 “Thalidomide” manufactured by West

=> led to the first EC Directive on

4 © K. Fritsch LabTec Internal usage only

 Cyanide was deliberately added to “Tylenol”

=> led to tamper-proof packaging for

5 © K. Fritsch LabTec Internal usage only

 89 children died in Haiti in 1996 from a

 Diethylenglycol in toothpaste found in

6 © K. Fritsch LabTec Internal usage only

 2004 Chiron flu vaccines licence

7 © K. Fritsch LabTec Internal usage only

8 © K. Fritsch LabTec Internal usage only

 The User‘s View on Compliance

 Good Laboratory Practice GLP

 Good Manufacturing Practice GMP

9 © K. Fritsch LabTec Internal usage only

Source: Sam Brooks, Novartis Consumer Health, GAMP Europe

The User‘s View on Compliance

Source: Sam Brooks, Novartis Consumer Health, GAMP Europe

Source: Sam Brooks, Novartis Consumer Health, GAMP Europe

 The User‘s View on Compliance

 Good Laboratory Practice GLP

 Good Manufacturing Practice GMP

13 © K. Fritsch LabTec Internal usage

e.g. US law (21 CFR 58)

e.g. OECD Guidelines on GLP

14 © K. Fritsch LabTec Internal usage

Good Laboratory Practice GLP

“These principles of good laboratory practice should be applied to the

15 © K. Fritsch LabTec Internal usage

OECD Principles of GLP

Good laboratory practice (GLP) is a quality system concerned with

16 © K. Fritsch LabTec Internal usage

GLP Requirements: Product Life Cycle

1 be periodically inspected, maintained,

17 © K. Fritsch LabTec Internal usage only

2 SOP’s that are intended to ensure

18 © K. Fritsch LabTec Internal usage only

GLP Requirements: Data Quality and Integrity

2 have written SOP’s that are

19 © K. Fritsch LabTec Internal usage only

3 appropriate design and be

20 © K. Fritsch LabTec Internal usage only

GLP Requirements: Qualification and Training

4 (c) ensure the maintenance of a record of the

(d) ensure that

21 © K. Fritsch LabTec Internal usage only

5 but not be limited to, the following categories of test facility

22 © K. Fritsch LabTec Internal usage only

ISO 9001 – Quality Management Systems

„Where necessary to ensure valid

a) be calibrated or verified at specified

23 © K. Fritsch LabTec Internal usage only

There must be an SOP for everything which is quality

The User‘s View on Compliance

Good Laboratory Practice GLP

Good Manufacturing Practice GMP

“Cola” contained cocaine till 1906

“Bib-Label Lithiated Lemon-Lime”

“Thalidomide” manufactured by West

Cyanide was deliberately added to “Tylenol”

89 children died in Haiti in 1996 from a

Diethylenglycol in toothpaste found in

2004 Chiron flu vaccines licence

The User‘s View on Compliance

Good Laboratory Practice GLP

Good Manufacturing Practice GMP

The User‘s View on Compliance

Good Laboratory Practice GLP

Good Manufacturing Practice GMP

Group responsible for ensuring that products meet the established

Group responsible for approving SOPs, specifications and validation

Group responsible for actual product testing

The User‘s View on Compliance

Good Laboratory Practice GLP

Good Manufacturing Practice GMP

10.2. […] Continuing training

13.2. Equipment should be installed in such

13.5. Balances and other measuring

15.35 Standard operating procedures should be available for each

The User‘s View on Compliance

Good Laboratory Practice GLP

Good Manufacturing Practice GMP

To allow the use of electronic records and signatures instead of

To prevent, or at least reduce the risk of, records being deliberately

To prevent unauthorized access to data

To ensure traceability to the originator or owner of a record

Of course, our customers still have to comply with all “predicate

To allow the use of electronic records and signatures instead of

Companies in the regulated environment must define their own

Each company has a different interpretation

FDA issued various guidelines for interpretation of 21 CFR Part 11,

A new draft part 11 was expected to be published for comment in De-

Any combination of text, graphics, data etc. in digital form that is

Computer data compilation of a series of symbols authorized by an

Suppliers should make it as easy as possible for companies to comply

Other measures may be necessary from the pharmaceutical

System must be validated

Access control and authority checks

Signatures shall employ at least 2 distinct components and must be

Controls for ID‘s and passwords