Risk Management through

Electronic Enforcement

FDA Regulatory and Compliance Symposium

Managing Risks From Pipeline to Patient

Life Science Manufacturing Realities?

WHAT WE HAVE:
A collection of manufacturing assets, products and technologies, that continue to be insufficient,
and are by design, incapable of meeting the new challenges.

Weve had a few problems scaling up from the lab

Source: Medical Manufacturing, New Technology Imperative, James Bradburn, IBM Life Sciences

2006

FDA Regulatory and

Introduction

Risk

Hazard
Hazard

Potential source of harm

Probability of the
occurrence of harm and the
severity of that harm.

Definitions

Hazard

Potential source of harm

Risk

Probability of the occurrence of harm and the severity of that

harm

Risk Analysis

Systematic use of available information to identify hazards and

estimate risk.

Risk Evaluation

Based on the risk analysis, a judgment of whether a risk is

acceptable based on societal values.

Risk Assessment

Process of completing risk analysis and risk evaluation.

Risk Control

Process through which decisions are reached and protective

measures are implemented for reducing or maintaining risks
within specified levels.

Residual Risk

Risk remaining after protective measures have been taken.

Risk Management

Systematic application of management policies, procedures,

and practices toward analyzing, evaluating, and controlling
risk.

2006

FDA Regulatory and

Time to focus on Operational Excellence Basics

The cost of nonconformance extends beyond the direct costs of quarantining,
recall and rework, and fines to the destruction of brand equity.
Compliance strategy needs to be centrally developed and coordinatedit cannot
be delegated to individual manufacturing sites.
The silos of quality and manufacturing must be broken down, and a tighter
integration of technology is required to sense, correct, prevent, and report
effectively on manufacturing nonconformance events.
This problem is endemic to the pharma and life science industry. Disconnects
exist between different parts of the manufacturing product supply, regulatory,
and commercial functions.
This is primarily a business process problem, as process requirements and
written procedures are not consistent throughout the organization. But many
pharma and life science organizations still have not reengineered their
processes and organizational structures, relying on inconsistent and manually
enforced compliance processes.
Source: AMR Research, Compliance Trouble at Boston Scientific: An Isolated Incident or Part of a Growing Industry Liability?, February 09,
2006; Hussain Mooraj, Colin Masson, Roddy Martin

2006

FDA Regulatory and

Multiple Compliance Fronts

Sarbanes
Oxley

Regulatory
Affairs

Ex Com

SEC

21
CFR
Part 11

Management
of
Regulatory
Compliance
EPA
EPA

QA/QC

cGMP
Source: AMR Research, Compliance Webinar, Roddy Martin, Joseph Vinhais, May 2004

2006

HIPAA

FDA

Chief
Compliance
Officer

OIG

FDA Regulatory and

CAPA

CIO / IT

Who are the stake holders?

How do you drive Governance and Compliance into Manufacturing?

Drive Compliance

Share Holder Value

Time to Market
7

2006

FDA Regulatory and

Synchronizing change, execution, and enforcement

Compliance and process improvement are
both based on following documented
processes. Three mechanisms need to
be coordinated:
Execute process Train employees on the
process, assess their performance, and,
if necessary, take steps to improve their
performance and adherence to it by
improving training or other actions.
Enforce controls Compliance adds a duty
to control the process actively, perhaps
by technical means, such as workflow.
Companies must also audit the results to
ensure that the controls work and detect
any changes in the process, systems, or
people that affect compliance. In
addition, companies must constantly
evaluate the controls to see if they are in
fact meeting the desired control
objectives.
Change process For both compliance and
business improvement purposes,
companies need to evaluate their
processes constantly and look for ways
to improve them. This starts a new cycle
of process design, followed by a project
to implement the changed process.
Source: AMR Research, 2003

2006

FDA Regulatory and

cGMP Compliance

FDAs 5 Part Strategic Plan

Pharmaceuticals

1.1. Efficient
EfficientScienceScienceBased
BasedRisk
Risk
Management
Management
2.2. Patient
Patient&&
Consumer
ConsumerSafety
Safety
3.3. Better
Informed
Better Informed
Customers
Customers
4.4. Counterterrorism
Counterterrorism
5.5. AAStrong
StrongFDA
FDA

cGMPs for the 21st Century

A Risked-Based Approach

Quality Systems-based Inspections

Medical Devices
ISO 14971, Application of Risk
Management to Medical Devices

2006

1.1. Quality
QualitySystem
System
2. Facilities &
2. Facilities &
Equipment
Equipmentsystem
system
3.3. Materials
System
Materials System
4.4. Production
ProductionSystem
System
5.5. Packaging
&
Packaging &Labeling
Labeling
System
System
6.6. Laboratory
LaboratoryControl
Control
System
System

FDA Regulatory and

1.1. Management
Management
Responsibility
Responsibility
2.2. Design
DesignControl
Control
3.3. CAPA
CAPA
4. Production and Process
4. Production and Process
Control
Control
5.5. Records/Document
Records/Document
Change
ChangeControls
Controls
6.6. Materials
MaterialsControls
Controls
7.7. Facilities
&
Facilities &Equipment
Equipment
Controls
Controls

Global Medical Devices - Quality System Requirements

Source: ISO13485:2003 An Overview (Bangkok, Thailand, June 2005), Gunter Frey, GHTF SG3

2006

FDA Regulatory and

ICH Q9 Quality Risk Management

2006

FDA Regulatory and

EU14971:2003 Corporate Risk Management Program

RM
Policy
An Integrated Risk
Management Process
(for all phases of the life of the product)

Culture on Risk
Communication

Training
Of
Personnel

ImplementationResidual
of
Verification
Post
Of
Risk ControlRisk
Effectiveness Production
Measures
Monitoring

Source: ASQ Biomedical 09 December 2004, Alfred M. Dolan

2006

Risk
Hazard
Risk
Cause
Graph

FDA Regulatory and

GAMP 4 and Part 11

The GAMP 4 Risk Model for Electronic Records and
Electronic Signatures (ERES)
Step 1

Identify the electronic records and signatures

Step 2

Assess impact of records and signatures

Low impact

Medium impact
Identify generic
hazards

Step 3

High impact
Identify generic & specific
hazards
Assess severity &
likelihood
Assess probability of
detection

Consider risks

Step 4

Step 5

Select good IT
practice

Select generic controls

Periodic review and evaluation

Source: FDANews, 2005

2006

FDA Regulatory and

Derive risk priority

Select generic & specific
controls

GHTF Risk Management Activities in Design &

Development

2006

FDA Regulatory and

How risk management can be integrated into the CAPA

process

Source: GHTF. 2005

2006

FDA Regulatory and

Aligning Risk Management Tools

Risk Analysis

Risk
Assessment

Intended Purpose Identification

Hazard Identification
Risk Estimation

Preliminary Hazard
Analysis
Fault Tree Analysis
Functional Analysis

Risk Evaluation

Risk Acceptability Decision

Tolerability of Risk
Cost-Benefit Analysis
Socio/Ethical Analysis

Risk
Management

Risk Control

Options analysis
Implementation
Residual Risk Evaluation
Overall Risk Acceptance

FMECA
HACCP
HAZOP
PAT

Post-production Information

2006

Post-production experience
Systemic Procedures
Identification of new Hazards
Change Control & Feedback Loop

FDA Regulatory and

Six Sigma
SPC
CAPA
Complaint Mgmt.

Risk Chart for Communicating Internal Risk

Management Activities

Source: GHTF. 2005

2006

FDA Regulatory and

Site Risk Potential (SRP)

Desired State
Product quality and performance achieved and
assured by design of effective and efficient
manufacturing processes
Product specifications based on mechanistic
understanding of how formulation and process
factors impact product performance
Continuous "real time" assurance of quality

Source: The Process Analytical Technology Initiative: PAT and the Pharmacopeias, Ajaz S. Hussain, Ph.D. Deputy Director Office of Pharmaceutical Science CDER, FDA

2006

FDA Regulatory and

Know your processes!

all critical sources of variability
identified and explained

variability managed by the process

product specifications based on understanding of how

formulation and process factors impact product performance

product quality attributes can be accurately and reliably predicted

Source: PDA, PAT & Risk Based Initiatives, Implementation Issues: C. Cambell

2006

FDA Regulatory and

Process Variation - Seven (7) Ms

Materials
Man

Methods

Process
Output
Management

Input

Measurement

Medium
Machine

Source: PDA, The Harmonized PAT Solution: Application of Risk-Based Tools & PAT Strategies in Pharmaceutical Product Manufacture: J. Priem

2006

FDA Regulatory and

Sources of Variability
Machine

Man - People

I
N
Machine - Equipment
P
U
Measurement
T
S
(x) Method - Process

Defects per

Spec Limit

Methods

+/- 1 sigma
+/- 2 sigma
+/- 3 sigma
+/- 4 sigma
+/- 5 sigma

Materials

+/- 6 sigma (near

perfect)

Materials

Example
50 Products
30.23
X
10 Operations
69.13
X
10 Orders per Year
93.32
X
(most companies)
10 Lots/Batches/Units
per Order
X
99.379
12 Months (30
days per order)
X
10 Transactions99.97670
per Unit per Operation
=
6,000,000 Transactions per year

y = f(x)

Measure System

Prior Ops

Percent

Inputs to the process

Opportunity
control variability
of the(traditionally
output
PPM)

99.9997
(top companies)

697,700
308,700
66,810
6,210
233

Output
3.4

Man

Variability - source of the Process risks to the product

Medium - Environment

Source: Risk Reduction in Pharmaceutical Manufacturing using Process Analytical Technology, Brian Davies, Thermo Electron Corporation

2006

FDA Regulatory and

Evaluation of Process Steps

Work
Processes
Normal

Value Add

Abnormal

Non Value Add

Necessary

Unnecessary

Flow

Reduce

Eliminate

place the value-added

processes into a
natural sequence

reduce the non-value

added but necessary,
e.g. regulatory

eliminate the abnormal

and the unnecessary
non- value added tasks

2006

FDA Regulatory and

Value-Stream Mapping
Identifying value added and non-value added
Value-creating tasks: Actions necessary for
making products, such as welding or
drilling.
Incidental work: Actions necessary to make
products, but that dont create value
from the customers standpoint. Such
actions include reaching for a tool or
clamping fixture.
Waste: Actions that (a) create no value from
the customers perspective and (b) can
be eliminated from a process; e.g.
walking to get tools that can be
positioned within reach of a worker.

In a typical company, the greatest percentage of time is spent

on tasks that are pure waste. Source: Lean Advisors Inc.

Source: Manufactures Get Lean to Trim Waste, William Leventon, Medical Device & Diagnostic Industry, September 2004

2006

FDA Regulatory and

PAT Conceptual Framework

LT

Development/Optimization/Continuous Improvement
(DOE, Evolutionary optimization, Improved efficiency)

Incoming
Materials.
Specifications
Relevant to
Process-ability

Control of process critical

control points (PCCP).
Process end point (PEPs) range
based on performance attributes.

Multivariate
Systems
Approach
Risk
Classification
and
Mitigation
Strategies

PAC
PAC

PCCP

PEPs

At-line

In/On-Line
Process Analytical
Chemistry Tools

Incoming material attributes

used to predict/adjust
optimal processing parameters
within established bounds
(more flexible bounds)

CM
IT
Chemometrics (CM)
and IT Tools
for real time
control and decisions

Source: ACPS, Process Analytical Technologies (PAT) Sub-Committee Report: T. Layloff, Ph.D

2006

FDA Regulatory and

PAC

LT

Laboratory
or other
tests

Direct or inferential
assessment of quality
and performance (at/on-line)

PAT Example
Raw
Material

Dispensing

Granulation

Identity
__ System
__ Subsystem
__ Component

Potency
Function

Potential
Failure
Mode

Ishikawa

Q u antity

10
Cause

FMECA

9
8
7
6
5
4
3
2
1
0

Milling

Quality

Potential
Failure Mode and Effects Analysis
(Design FMEA)

Purity

FME A N umber:
Page 1 or 1
Prepared by: Lee Dawson
FME A D ate (Orig.):

Design Responsibility
Ke y Da te:

Potential
Effect(s) of
Failure

C
S L
E A
V S
S

Failure
Mode

Potential
Cause(s)/
Mechanism(s)
Of Failure

O
C
C
U
R

Current
Design
Controls
Prevention

Current
Design
Controls
Detection

D
E R. Recommended
T P.
Action(s)
E N.
C

Action Results
Actions
Taken

S O D R.
E C E P.
V C T N.

Effect

III. Marginal
II. Critical
I. Catastrophic

Criticality Matrix

B. High

C. Moderate

D. Low

E. Remote

Probability of Occurance

DOE
Multivariate Analysis
SPC
Source: ISPE-Boston, Feb. 2005

2006

Responsibility
& Target
Completion
Date

IV. Minor

A. Very High

Mixing

Strength

Model Year/Vehicle(s):
Core Team:

Item

Drying

FDA Regulatory and

Tabletting

Coating

FDAs SRP Hierarchy (Sept. 04)

Site Risk Potential

Top Level
Components

Categories of
Risk Factors

Product
CD1

CD2

Process
CP1

Facility
CP2

CF1

CF1

Risk Factors
(quantitative
or qualitative
variables)

Dosage form; intrinsic

chemical properties

2006

FDA Regulatory and

Measuring; mixing;
compression; filling

Poor cGMP compliance

history

Physical Risk
cGMP Impact Assessments
Systems
Direct

Indirect

Non

gep

gep

gep

Critical

Non Critical

comm.

comm.

gmp

qual.

Source: PDA, PAT & Risk Based Initiatives, Implementation Issues: C. Cambell

&

Components

2006

FDA Regulatory and

Functional Risk
IEC
Functional Safety: safety-related systems

Class-I

Intolerable
Risk cannot be
justified
except in
extraordinary
circumstances

Class-II

Class-III

Undesirable

Tolerable

Negligible

Tolerable if the
cost of the risk
reduction
would exceed the
improvement
gained

Tolerable if the
cost of the risk
reduction
would exceed the
improvement
gained

Tolerable only
if risk reduction is
impracticable or
the costs are grossly
disproportionate
to the improvement
gained

Source: PDA, PAT & Risk Based Initiatives, Implementation Issues: C. Cambell

2006

FDA Regulatory and

Class-IV

Process Risk

Risk Class

Risk Priority

Probability

Risk Class
High
Impact

Medium
Impact

Low Impact

High
Detection

Medium
Detection

Low
Detection

High

Medium

Low

Class f (probability, impact)

Source: PDA, PAT & Risk Based Initiatives, Implementation Issues: C. Cambell

2006

FDA Regulatory and

Priority f (class, detection)

Risk Integration

Standard
Components

Standard
Operations

Standard
Parameters

Physical
Risk

Functional
Risk

Process
Risk

II

III

SRP
Mitigation
Plan
Source: PDA, PAT & Risk Based Initiatives, Implementation Issues: C. Cambell

2006

FDA Regulatory and

IV

Risk Dividend

Physical
Risk

Functional
Risk

Process
Risk

C
N
I
II
III
H
M
L

DQ

IQ

OQ

X
X

Source: PDA, PAT & Risk Based Initiatives, Implementation Issues: C. Cambell

2006

FDA Regulatory and

PQ

PV

?
X
X

PAT QA FDA

Electronic Enforcement

Execution Systems Orchestrate Production

Enterprise

Plant

Line

Machine

Set points

Production
Orders

Parameters

Equipment

Controls

ERP

Execution System
Status

Data Readings

Production
Status

Product
& process
data
definitions

Shop Packet

PAT
PACPCCP
PACPCCPPEPs
CM
IT

People

Work Status

Product
& process data
definitions

PLM/EDM
Inventory

Consumption
Traceability
Picklist

Manufacturing Process

Source: IBM Life Sciences, James Bradburn

2006

FDA Regulatory and

Product
& process
data
definitions

Align Enterprise Applications

(change, execution, and enforcement)
ERP

QMS

Training

CAPA
Inspection
NCR
Test
(CAR, SCARs) Complaints
Statistical
Process Control

WIP Tracking

Equipment
Management

Work Order Management

MBOM

Data Collection,
Reporting, Metrics/KPIs

Auditing

Alarms & Escalations

AQP

Process Planning

Operational/Transactional Control
2006

CRM

Inventory

Service Oriented Architecture & Integration Framework

Risk Management File

Batch
Control

Manufacturing Execution
Work Instructions & Procedures
Operator Tracking

Line
Monitoring

Weigh &
Dispense

Material Flow
& Lot Tracing

Container
Management

Process & Equipment Optimization Layer

Raw
Material

Order
Fulfillment

BOM

Financials

Machining

Cleaning

Assembly

Automation and Data Capture

FDA Regulatory and

Testing

Packaging

Enterprise Manufacturing Compliance

PLM

Existing Regulatory Process Control

Complaint Submission Process

REGULATION

Reporter
Client

Paper Trail begins,

Notifications to
appropriate parties

CRM Sys.

CORPORATE
POLICY

PROCEDURE

Complaint Coordinator Process

Acknowledgement
Letter to Customer

SOP

Issue a CAPA to
Plant

Closure Letter
To Client
Plant Complaint
Coordinator

Review
Edit/
Close

Request for
CAPA Plan
Initiate
Root Cause
Complaint
Analysis
Coordinator

Initiate
Containment
Action
Regulatory Submission
( Such as 30 day MDR
5 day MDR, Summary)
Initiate

CAPA
Process

2006

FDA Regulatory and

Review
CAPA
Plan
CAPA Plan
Approved?
Initiate
Implementation

Close
CAPA
Verify
Effectiveness
Implement
&
Sign-Off

Electronic Enforcement

2006

FDA Regulatory and

Regulatory/Compliance Process Management

Start jobs based upon:

Web service external event
Web service start job request
Repository updates (filtered) from MES,
MCS or other data sources
Scheduled start

Manufacturing Compliance Framework

Multiple workflow paths depending on event

Run Rules and Reports for decision support
Context filtering and evaluation
Synchronization with multiple start events or
wait for events

2006

FDA Regulatory and

Multiple responses possible depending on

flow path
Execute web service calls to external systems
such as MES, ERP, CAPA and others
Execute email, logging, exporting SQL,
external applications, and other executions

Sources

GHTF, Implementation of risk management principles and activities within a Quality Management System, May 20, 2005

FDANews, Introduction to GAMP Good Practice Guide: A Risk-Based Approach to E-Record Compliance, Per Olsson

FDA, A Risk-Based Approach to Pharmaceutical Current Good Manufacturing Practices (cGMP) for the 21st Century

PAT & Risk-Based Initiatives: Implementation Issues; PDA New England - 08 Dec 2004, Cliff Campbell B.E., C.Eng

The Harmonized PAT Solution: Application of Risk-Based Tools & PAT Strategies in Pharmaceutical Product Manufacture; PDA New England 08 Dec 2004, Jeffrey A.
Priem

Process Analytical Technologies (PAT) Sub-Committee Report ACPS Meeting 21 October 2002, Tom Layloff, Ph.D.

Risk Management, From Basic to Advanced; RAPS 11 October 2004, Kevin P. Bassett; Matthias M. Buerger; Oliver P. Christ

Importance and Impact of ISO 13485:2003, RAPS 13 October 2004, Ed Kimmelman, JD

Risk Management of Medical Devices: Implementation, ASQ Biomedical 09 December 2004, Alfred M. Dolan

Implementation of Risk Management Principles within a Quality Management System, 09 December 2004, Kimberly Trautman

ISO 14971:2000, Essentials 1st Edition, A practical handbook for implementing the ISO 14971 Standards for medical devices, Canadian Standards Association

IEE Tolerability of Risk Framework hsc36, Health and Safety Briefings - October 2000

FDA, A perspective on Risk Analysis for the GMP Initiative - April 2003, H. Gregg Claycamp, Ph.D., CHP

Risk Reduction in Pharmaceutical Manufacturing using Process Analytical Technology, Brian Davies

Risk-Based Method for Prioritizing cGMP Inspections September 2004, Department of Health and Human Services U.S. Food and Drug Administration

Pharmaceutical Manufacturing: New Technology Opportunities 16 November 2001, G.K.Raju, Ph.D

PAT Progress Report: 13 April 2004 ACPS Meeting, Ajaz S. Hussain, Ph.D. Deputy Director Office of Pharmaceutical Science CDER, FDA

Guidance for Industry, PAT - A Framework for Innovative Pharmaceutical Manufacturing and Quality Assurance DRAFT GUIDANCE

Process Analytical Technology (PAT): Whats in a name? 09 April 2004, D. Christopher Watts, Ph.D. Office of Pharmaceutical Science, CDER, FDA

2006

FDA Regulatory and

Thank You
Joseph Vinhais
Joseph.vinhais@brooks.com
978.262.7868
http://lifesciences.brookssoftware.com