In recent years, FDA has increasingly observed current good manufacturing practice (cGMP) violations involving data integrity during cGMP inspections. This is troubling because ensuring data integrity is an important component of industry’s responsibility to ensure the safety, efficacy, and quality of drugs, and of FDA’s ability to protect the public health. These data integrity-related cGMP violations have led to numerous regulatory actions, including warning letters, import alerts, and consent decrees. The underlying premise is that cGMP sets forth minimum requirements to assure that drugs meet the standards of the Federal Food, Drug, and Cosmetic Act (FD&C Act) regarding safety, identity, strength, quality, and purity. To address these concerns, FDA has recently released a guidance on data integrity.
The guidance includes 18 questions and answers on data integrity, alongside well-defined terms on data as they relate to cGMP records, as well as recommendations on when workflows on computer systems need to be validated, and how to ensure electronic master production and control records (MPCR) are monitored and can only be used by authorized personnel.
Guidance Questions and FDA Answers
Addressing whether it is permissible to exclude cGMP data from decision making, FDA states any data created as part of a CGMP record must be evaluated by the quality unit as part of release criteria and maintained for CGMP purposes. Electronic data generated to fulfill CGMP requirements should include relevant metadata. To exclude data from the release criteria decision-making process, there must be a valid, documented, scientific justification for its exclusion (see the guidance for industry Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production). The requirements for record retention and review do not differ depending on the data format; paper-based and electronic data record-keeping systems are subject to the same requirements.
FDA also recommends implementing appropriate controls to manage risks associated with each element of the system. Controls that are appropriately designed to validate a system for its intended use address software, hardware, personnel, and documentation.
To restrict access to CGMP computer systems, exercise appropriate controls to assure that changes to computerized MPCRs, or other records, or input of laboratory data into computerized records, can be made only by authorized personnel. FDA recommends restricting the ability to alter specifications, process parameters, or manufacturing or testing methods by technical means where possible (for example, by limiting permissions to change settings or data). FDA suggests that the system administrator role, including any rights to alter files and settings, be assigned to personnel independent from those responsible for the record content. To assist in controlling access, FDA recommends maintaining a list of authorized individuals and their access privileges for each CGMP computer system in use.
Regarding audits, FDA recommends that audit trails that capture changes to critical data be reviewed with each record and before final approval of the record. Audit trails subject to regular review should include, but are not limited to, the following: the change history of finished product test results, changes to sample run sequences, changes to sample identification, and changes to critical process parameters. FDA recommends routine scheduled audit trail review based on the complexity of the system and its intended use.
Additionally, audit trails are considered part of the associated records. Personnel responsible for record review under CGMP should review the audit trails that capture changes to critical data associated with the record as they review the rest of the record. For example, all production and control records, which includes audit trails, must be reviewed and approved by the quality unit. This is similar to the expectation that cross-outs on paper be assessed when reviewing data.
FDA explains that an electronic data becomes a CGMP record when it is generated to satisfy a CGMP requirement. Document or save the data at the time of performance to create a record in compliance with CGMP requirements. FDA expects processes to be designed so that quality data required to be created and maintained cannot be modified. For example, chromatograms should be sent to long-term storage (archiving or a permanent record) upon run completion instead of at the end of a day’s runs.
FDA says it is not acceptable to record data on pieces of paper that will be discarded after the data are transcribed to a permanent laboratory notebook. Similarly, it is not acceptable to store data electronically in temporary memory, in a manner that allows for manipulation, before creating a permanent record. Electronic data that are automatically saved into temporary memory do not meet CGMP documentation or retention requirements.
A combination of technical and procedural controls can also be employed to meet CGMP documentation practices for electronic systems. For example, a computer system, such as a Laboratory Information Management System (LIMS) or an Electronic Batch Record (EBR) system, can be designed to automatically save after each separate entry. This would be similar to recording each entry contemporaneously on a paper batch record to satisfy CGMP requirements. The computer system could be combined with a procedure requiring data be entered immediately when generated. For PET drugs, see the “Laboratory Controls” section of the guidance for industry PET Drugs — Current Good Manufacturing Practice (CGMP).
Finally, FDA addresses recommendations regarding data integrity problems identified during inspections, in warning letters, or in other regulatory actions. FDA encourages demonstrations of effectively remedied problems by: hiring a third party auditor, determining the scope of the problem, implementing a corrective action plan (globally), and removing at all levels individuals responsible for problems from CGMP positions. FDA may conduct an inspection to decide whether CGMP violations involving data integrity have been remedied.
These expectations mirror those developed for the Application Integrity Policy. For more detailed guidance, see the “Points to Consider for Internal Reviews and Corrective Action Operating Plans” public document available on the FDA website.