Lessons of GMP: Step by Step Practical Guide Part 2 of 3

In most major markets, regulatory guidelines govern how and under what conditions medicinal products and active substances must be developed, manufactured, packaged, stored and transported in order to guarantee the high quality of the products and thus their consistent effectiveness and safety.

These guidelines are referred to as Good Manufacturing Practice (GMP). As active ingredients and pharmaceuticals are increasingly manufactured abroad and usually travel long distances on their way to the patient, there are also guidelines for the storage and transport of pharmaceuticals, known as Good Distribution Practice (GDP) rules.

This article will describe how to adhere to these regulations that must be top priority to protect patients. The regulations apply to you if you manufacture, package, test, store or transport pharmaceuticals; or if you are a supplier of excipients, active ingredients, packaging materials, machines or equipment.

Part 1 of this series, Lessons of GMP Failures: Why it’s Everyone’s Business Part 1 of 3, was published 19th September 2019.

Core Components of GMP

In all regulations including GMP and GDP, there is only one thing that matters: the quality of the drugs must be flawless throughout manufacturing and distribution to guarantee safety for the patient.

Thus, GMP regulations cover a wide range of aspects and processes that touch the product, including the chapters below.

• Quality System

• Personnel and responsibility

• Premises and equipment

• Documentation

• Production and packaging

• Quality Control

• Outsourced activities

• Compliants and claims

• Audits and self-inspection

• Storage and Transport

This article will cover chapters 1-3 in detail that you can follow and use for your daily work. Part 3 of this series will cover chapters 4-10.

GMP thus affects every single employee involved in the pharmaceutical manufacturing process chain: from active ingredient suppliers, purchasing, warehousing, technology, processing, packaging, inspection, through to dispatch and transport.

"Quality" is the result of teamwork: every single job must be carried out correctly on a daily basis, even if at first glance it seems "insignificant". In the following, the most important GMP requirements are listed compactly (but not exhaustively).

1. Quality System

1.1 Quality of medicinal products

The quality of medicinal products and active substances must not be a random product, but the result of careful planning, correct implementation, good documentation and systematic monitoring. Quality is not a matter for discussion: the exact quality that must be maintained is described in the approval documents submitted to the authorities. Before a batch of pharmaceuticals is released for sale, the Qualified Person (QP) checks whether all these quality criteria have actually been met exactly. The responsibility for quality does not end at the loading ramp: Storage, transport and distribution must also be planned and controlled in such a way that the drugs cannot spoil or be confused. This is specified and described in detail in the GDP guidelines. 

1.2 Quality Management

Manufacturers of medicinal products or active substances are requested to document in writing how the medicinal products they handled have maintained integrity. Even companies that only carry out individual manufacturing or packaging steps on behalf of others (outsourcing) must describe exactly how they reliably ensure the quality required by GMP and GDP, according to legislation. The client continues to bear the responsibility for ensuring that the contractor delivers the required quality. Quality control is therefore an important part of the quality management system, but not the only one.

Other important elements are for example the careful documentation, the qualification (see point 3.5) of buildings, equipment, machines, personnel and suppliers, auditing, the correct handling of changes and errors as well as the validation of procedures. In order to be able to plan quality in a targeted manner, it is important to constantly record the current data during production, packaging, maintenance, warehousing or testing (on paper or in the computer). This data must be continuously evaluated (Trending, Product Quality Review — PQR) in order to identify weak points, prevent errors and improve processes (Continuous Improvement Process — CIP).

The management of the company (as the responsible body) is informed of the results of these periodic product quality checks (PQR). The aim is to immediately identify and eliminate potential hazards to quality.

1.3 Quality Risk Management

Not all drugs are comparable: Some dosage forms are difficult to manufacture or involve special risks for the patient, e.g. sterile dosage forms (eye drops, injections, infusions). For this reason, every company must tailor its processes precisely to the respective drugs and justify in writing how it controls all quality risks (quality risk management).

It is not enough to concentrate on the production of the final product. Quality can be compromised during the development of active substances, and during drug development processes. Thus, GMP requirements apply throughout a drug’s lifecycle — from inception to consumption.

1.4 Change Control (Management of Changes)

"Compliance" means that everyone must adhere exactly to the valid work instructions, simplified workflows, improvements or other changes that are only permitted with prior written approval. However, before a change can be made to methods, processes, regulations, input materials, rooms or facilities, a team of experts must carefully evaluate what consequences this change could have for drug quality. Inevitably, changes also always have an influence on the product and must be identified, evaluated and documented accordingly. Unplanned changes, for example, within the scope of a repair or a major maintenance task, must also be subsequently checked and evaluated in the same way. This investigation is carried out across deviations and departments and considers not only production but also engineering, validation, quality control, quality assurance and approval. The review will determine whether re-qualification (installations) (see point 3.5), revalidation (procedure) or notification of change to the approval authorities is required. Before each implementation, changes must be approved in writing and defined measures (e.g. requalification) must be taken. The application, review, approval, follow-up and implementation of the change shall be assessed and recorded and all information shall be easily retrievable.

1.5 Deviations, Errors and Out-Of-Specification (OOS)

Despite careful planning and conscientious work, there can be deviations and errors in every company at any time — this is ultimately unavoidable. The decisive factor in such situations is always to act correctly: A documented and investigated deviation or error is not an "infringement"; undiscovered or skipped deviations and unreported errors. On the other hand, violations can lead to significant quality defects — and these, in turn, could put patients at risk or cause costs for delivery failure and destruction (GMP Lessons Failures: Part 1). 

Anyone who discovers a deviation must report it to their superior and document it promptly and comprehensively, regardless of whether they have caused it or not. This applies to even the smallest deviation — no one is allowed to decide for themselves whether something is "probably not so bad". This applies to all deviations, defects or faults detected during production or quality control.

A Standard Operating Procedure (SOP) should clearly regulate and describe who subsequently assesses the deviation and who may or must make further decisions.

Special rules apply if an analytical test result is outside the specified range (specification): there is a special OOS-SOP for this. Under no circumstances should the analyses be repeated as often as necessary until random results are obtained that comply with the specifications (testing into compliance). This can also seriously endanger patient safety and thus endanger life and limb.

1.6 Error Cause Analysis and Corrective and Preventive Actions (CAPA)

All deviations or errors must be thoroughly investigated. The aim is to identify the cause (root cause analysis) and take precautions to avoid repetition. Clearly, this is not about blame. Only if the cause is known, can sensible measures be taken to prevent this or a similar error from recurring. If necessary, the investigations are carried out across departments (e.g. production, quality control, quality assurance, technology, development). If the causes cannot be clearly identified, this must also be documented accordingly. The examinations, as well as any corrective measures determined, are checked by the responsible persons (e.g. expert person, head of production, head of quality control).

All investigations must be completed and reported/documented within a specified reasonable time (Failure Investigation Report — FIR). If the investigation cannot be completed within this period, at least an interim report must be drawn up. Deviations/defective batches must be examined with regard to trends and evaluated within the framework of the periodic Product Quality Review (PQR).

1.7 Protection Against Counterfeit Drugs

International trade in active ingredients and medicines makes it easier for criminals to replace or mix medicines with ineffective or harmful counterfeits. Quality naturally goes unnoticed in counterfeits and this can put patients' lives at risk. Every pharmaceutical company is legally obliged to do everything in its power to make it as difficult as possible to imitate its own products.

Since February 2019, all manufacturers within the EU and US also have to comply with the serialization as a legal requirement. Serialization (i.e. traceability along the entire supply chain) is intended to counteract counterfeit medicines and thus also guarantee patient safety. This is achieved by affixing security features to each individual package (machine-readable, serialized code to identify authenticity at any point and at any time, after database comparison) and by affixing a device making it possible to detect tampering with the outer packaging wrapper.

The regulations for the serialization of drugs are therefore perhaps the most important criteria in the global marketing of drugs and other pharmaceutical solutions. A prerequisite for optimal implementation is a highly up-to-date and complete knowledge of the corresponding obligations for pharmaceutical serialization.

Since active substances and excipients can already be counterfeit, they may only be obtained from reliable sources that have been thoroughly checked beforehand.

The storage and transport of active substances and medicinal products must be well supervised and secure in order to protect them from unauthorised access, theft or exchange. Seal marks, adhesives or wrappings indicate whether a pharmaceutical package has been opened since manufacture and whether its contents have been changed or exchanged.

2. Personnel

2.1 Training (Education)

It is imperative that all persons, including employees of outside companies, are aware of all instructions and regulations that they need for their work. Each individual must understand what they are responsible for and how the quality of the medicines can be compromised. To ensure that everyone receives the training they need on an ongoing basis, there should be a training plan/a qualification matrix.

The training plan specifies how each employee is to be trained in GMP/GDP and the internal operating procedures he/she is to carry out. Training for new personnel is also regulated in the training schedule. All employees must regularly receive GMP training in accordance with the training plan (e.g. on SOPs, hygiene and documentation, CAPA, changes).

It is important to continuously refresh and deepen this knowledge and to point out current changes, e.g. in SOPs. It is also important that employees take part in regular training courses and put what they have learned into practice every working day within the specified time limits. Contents and participants of each training course must be documented. The responsible persons are obliged to check whether the training contents have been understood; this can take place immediately after a training course or later directly at the workplace (success control). In case of non-existence, the training has to be repeated promptly and the success control has to be completed again.

2.2 Responsibility

Each employee is personally responsible for ensuring that he or she is familiar with the GMP and GDP rules, complies with them (GMP/GDP compliance) and behaves hygienically in the manufacturing area. This includes showering, washing and disinfecting hands before starting work, wearing GMP clothing correctly, no jewelry, eating, chewing and smoking in the GMP area, no contact with open products and reporting infectious diseases. Each individual is responsible for ensuring that the task assigned to him is carried out exactly in accordance with the approved regulation (instruction, SOP) and that it is recorded legibly and truthfully. This applies to all work in the GMP area such as; cleaning, maintenance, calibration, control steps, monitoring, activities in warehouses and logistics.

In addition, everyone must document deviations, defects, machine malfunctions, faults or inexplicable observations, irrespective of who caused them, and report them immediately to their supervisor.

No one may make changes to any regulations, protocols, equipment, software or processes until they are expressly approved. The change control procedure must be adhered to. Persons in certain functions (e.g. skilled person, head of production, head of quality control) also bear special responsibility. They must therefore ensure that their instructions are understood and followed and make decisions in the event of deviations.

2.3 Compliance

Compliance means: Compliance with regulations. Every company dealing with pharmaceuticals must comply with the currently valid legal requirements constantly and precisely.

Every employee must therefore comply precisely with the work instructions, SOPs and regulations applicable to his or her workplace on a daily basis — even if no supervisor is present or time is short. During inspections and audits, authorities and customers check whether pharmaceutical companies and their employees comply with all regulations.

3. Premises and Equipment

3.1 Buildings and Rooms

Only sufficiently qualified rooms with suitable and qualified supply systems, e.g. air conditioning, ventilation systems, water pipes, may be used for the production of pharmaceuticals and active substances. A regular maintenance programme must be available for buildings and rooms. Maintenance work carried out must be documented. Responsibilities should be defined in a maintenance plan. The environmental conditions (e.g. temperature, humidity, particle count) must be monitored and controlled; the records must be easy to find and retrieve.

Changes to buildings or rooms that could influence process flows or process conditions must be subject to a change control procedure. In order to avoid contamination of a product with another active substance (cross contamination), only one product per room may be processed. Afterwards, the room must be completely freed from the product, but also from samples and waste, and cleaned before another medicinal product or other active substance is manufactured or packaged in it. All operating rooms must be marked according to their operating condition, e.g. cleaned, in maintenance, in operation (ideally with details of the currently running product/process). In order to avoid mix-ups or undermixing, only those materials may be available in production or packaging areas which are required for the respective processing step.

3.2 Cleaning and Hygiene

Impurities in pharmaceuticals can either directly harm patients, e.g. residues of the preliminary product (cross-contamination), splinters or pathogens, or spoil the product so that it is no longer effective, e.g. microorganisms, dust, residues of water or cleaning agents. Therefore, it is essential that cleaning and hygiene regulations are strictly followed by all persons entering GMP areas.

All areas in production, quality control and storage must be in good, tidy and clean condition and free from pests. All persons in the production area must strictly observe the current clothing regulations (e.g. cleanroom clothing). It is particularly important that the clothing is always worn correctly and completely closed. Even if a hygiene zone is only entered or left for a short time, the prescribed clothing must be put on or taken off. This also applies to employees of external companies and visitors. Precise training and monitoring is therefore essential.

Quality management also includes room hygiene

Cleaning and disinfecting hands is an efficient measure to reduce the spread of microorganisms and viruses. For this reason, careful hand hygiene must be ensured after leaving the sanitary areas and at every entry into GMP zones. A hygiene plan must be drawn up and staff trained and monitored accordingly. Suitable hand hygiene products should be available and changed periodically to avoid resistance.

In clean areas and especially in the vicinity of open products or plant components that come into contact with the product, hygienic behaviour is mandatory. Of course, this includes observing prohibitions such as: do not eat, do not drink or chew, do not scratch, cough or sneeze, do not bend over open containers or plant components. A fresh mouthguard and fresh gloves should always be worn on open plant components.

The cleaning regulations for rooms, installations and equipment specify exactly how often and with which materials/cleaning agents cleaning must be carried out. It is imperative that these regulations are followed precisely, e.g. that detergents are always diluted exactly according to regulations, and that they are cleaned for exactly as long as prescribed. Cleaning utensils used (such as cleaning cloths) must not be stored damp. Disposable items must be disposed of immediately. Multiple articles must be disinfected or sterilized and stored in a dry place. Diluted detergent and disinfectant solutions may only be stored for as long as indicated on the label.

3.3 Devices, Machines, Systems

Only qualified (see point 3.5) systems and equipment with validated processes may be used in production and quality control. All systems, system components and measuring points must be clearly identifiable for this (device ID) and maintained in accordance with the maintenance plan. All maintenance and repair work carried out must be recorded. Equipment logbooks must be filled in immediately and in detail according to the activities carried out and kept up to date. The rules of good documentation practice must be observed here.

The cleaning of the systems is carried out in accordance with detailed regulations (cleaning SOPs). After cleaning containers, equipment and plant components, they must be carefully dried and stored in such a way that they are protected from contamination until reused. Before changes are made to installations and equipment, the impact of the change must be assessed in accordance with change control procedures. This includes the installation of new software (patches, updates) and may require a new validation.

3.4 Maintenance and Servicing

Only regularly maintained or repaired systems fulfil the intended purpose, i.e. are in a sufficiently qualified (see point 3.5) condition. Maintenance must be carried out at the specified time. Critical installations should be adequately protected and, at best, protected by redundancies. The maintenance order shall describe all activities intended for maintenance. All work carried out during maintenance or repair must be documented carefully and in detail. The logs must be archived in such a way that they are easy to find and present.

Software-based systems are also subject to the rules of the Code of Federal Regulation (CFR) 21 Part 11 and must be validated accordingly. Although the CFR is a US regulation, it is now considered to be the state of the art worldwide and must therefore be complied with. Updates and upgrades of software must be strictly regulated and controlled (documentation and validation, if applicable). Maintenance data should be analyzed for tendencies in order to initiate appropriate corrective actions.

Unusual observations of any kind must be reported, evaluated and documented to production and quality assurance. The maintenance and inspection of special tools and format parts (e.g. tabletting tools) must be carried out in accordance with SOP. After maintenance or repair work, parts in contact with the product may have to be cleaned. After repair work, recalibration may be necessary or spare parts may have to be qualified (see point 3.5). The documentation and verification at the end are to be taken for granted.

3.5 Qualification

Qualification basically means proving that someone or something is suitable for a certain task. All buildings, rooms, equipment and machines in the GMP area must therefore be qualified so that they are suitable for the intended purpose. The effort involved can vary.

The objectives and scope of the qualification are clearly defined in the qualification master plan and in the individual qualification plans for the individual stages (design qualification — DQ; installation qualification — IQ; functional qualification, operational qualification  — OQ; suitability and performance test, performance qualification — PQ). Each qualification plan must be approved before its implementation. If changes or extensions to the qualification plan are necessary during qualification, they must also be evaluated, approved and, of course, documented. Every qualification, however, is fundamentally preceded by a risk assessment in which, if necessary, measures are defined before the start of the qualification work.

After the tests specified in the plan have been carried out, a qualification report is drawn up. In this summary report, a conclusion must be reached and approved by the responsible persons. All changes to qualified production facilities or plants may only be carried out in accordance with the change control procedure. Before the change is approved, the responsible persons assess whether a re-qualification is necessary. Risks may also need to be reassessed. Not taken into account are the validation status of the software and, as mentioned above, compliance with CFR 21 Part 11 for computer-based systems.

3.6 Calibration

All measuring instruments or indicators must be regularly calibrated to ensure that the displayed or printed reading is "correct" at all times. Calibrations must therefore be performed and documented by the specified date. Systems with overdue calibration may no longer be used. For a more detailed look at calibrations of monitoring devices, read here.

 The calibration instructions contain the necessary information about calibration standards, permitted tolerances and calibration intervals. References used must be traceable to a national or international measurement standard (accreditation according to ISO 17025). Detailed records of the calibration shall be kept.

If the calibration results differ, production and quality assurance must be notified immediately and measurement results from the previous calibration interval re-evaluated. If the deviation is too large, this can also lead to a callback. Calibration data must be checked for trends and any corrective action required (trending).

Employees who carry out calibrations must have sufficient competence in this area and prove this regularly, e.g. by keeping control charts. References used must also be checked periodically by an accredited body according to ISO 17025. Accordingly, device logbooks are indispensable here as well.

3.7 Computer-Aided Systems (IT Systems)

Hardly any of the work we carry out nowadays can do without computer-aided systems for control, measurement, regulation, data processing, data transmission, data recording or alarming. In order for us to be able to rely on this computer data, it must be proven that the computer system does exactly what we expect it to do (computer validation).

IT (information technology) systems shall be validated in accordance with an approved computer validation plan. Access to IT systems must be controlled. This means that only those persons are granted access rights who are trained for the specific applications. Passwords, tokens, chip keys or other means of authenticating users must never be passed on to other persons or shared by several users.

Changes to the IT systems are also subject to the change control procedure. To comply with GMP, computer data must be treated in the same way as "paper data" and its integrity must be maintained: Deletion, overwriting or modification must not be possible. The latter must at least remain verifiable in an audit trail. Useful backup and disaster recovery procedures must be set up if the system is unavailable for a certain period of time.

The electronic processing and storage of measurements, validation plan data or reports relating to the authorisation of a medicinal product or active substance shall also be based on the following requirements: Code of Federal Regulations: CFR 21 Part 11 and Good Automated Manufacturing Practice (GAMP) 5.

CFR 21 Part 11 is a US regulation that defines criteria for FDA-regulated (FDA – Food and Drug Administration) pharmaceutical industries to ensure that electronic records and electronic signatures on computer-based systems are credible and reliable. This standard applies only to installations and equipment which are connected to a computer and use software; it is regarded and applied worldwide as the state of the art.

GAMP 5, on the other hand, is a guideline and has developed into the standard set of rules for the validation of computer-aided systems in the pharmaceutical industry (manufacturers and suppliers). However, the GAMP regulations are not legally binding here. Therefore, different forms of validation of computerized systems are possible.

This article was first published in the German magazine, PM QM 2019, Edition 02/2019.

To continue learning about further GMP Chapters, including Documentation, Data Integrity, Production Quality, Validation of processes and more, read the last part of this series Lessons of GMP: Step by Step Practical Guide Part 3 of 3.

About the author

Björn Niggemann has been working for ELPRO-BUCHS AG as Chief Quality Officer since April 2016. In 2004, he was initially commissioned to set up and implement GMP system on existing 17025 accreditation. In 2007he built up a GMP system for an existing GLP system as Compliance Manager. From 2009 to 2010 he worked for a pharmaceutical service provider as GLP / cGMP as Quality Compliance Manager. From 2010 to 2016 Bjoern worked in a Swiss biotech company in the role of Head of Operations and Quality. Today he still heads the working group GDP of GQMA - Germany Quality Management Association e.V. and is thus a member of the extended board.

References

[1] "Compact GMP" by Reinhard Schnettler and Dr. Christine Oechslein, 8th edition 2019, PTS Arnsberg. Source of supply: PTS Training Service, Postfach 4308, D-59737 Arnsberg, www.pts.eu, info@pts.eu
[2] Brochure "GMP and Quality Systems"; Published by Dr. Jürgen Werani, Gabriele Czeromin, Susanne Haas (now Susanne Schweizer), Pfizer GmbH, Arzneimittelwerk Gödecke, 1996