Lessons of GMP: Step by Step Practical Guide Part 3 of 3

Time and again, we read about quality defects of medicinal products, APIs or medical devices that have serious consequences for affected patients. The rules for GMP and GDP are intended to prevent these. Although GMPs may be challenging to interpret, they exist to protect the patients and pharmaceutical businesses.

Authorities and legislators often react to cases of quality defects by tightening the rules that must be observed. This sets in motion an unwelcome and costly spiral. This would be relatively easy to stop, if only everyone followed the rules.

This blog article is the continuation of a 3 part series on GMP Regulations.

• Lessons of GMP Part I (was published 19th September 2019):
  "Why it’s Everyone’s Business" gave a historical recount of GMP failures for medicinal products, active ingredients and medical devices.

• Lessons of GMP Part II (was published 06th May 2020):Practical Guide explained in detail GMP Chapters 1. Quality system 2. Personnel 3. Premises and Equipment.

• Lessons of GMP Part III:
  Practical Guide will cover chapters 4-10 in detail that you can follow and use for your daily work.
  
  

This article will cover GMP chapters 4-10:

1. Quality System

2. Personnel and responsibility

3. Premises and equipment

4. Documentation

5. Production and packaging

6. Quality Control

7. Outsourced activities

8. Complaints and claims

9. Audits and self-inspection

10. Storage and Transport

4. Documentation

4.1 Records

True to the motto "What is not documented is not made", careful documentation is essential in the GxP environment. This is the only way to ensure that it is always possible to trace who did what and when and how. This in turn is important for drug and patient safety and therefore also an irrefutable requirement of the GMP guidelines.

Consequently, all documentation must be carried out carefully. The rules of good documentation practice thus become relevant. This in turn means that the documentation must be legible, complete, properly signed, dated, tamper-proof and colorfast. All work steps must be promptly recorded by the person carrying out the activity. For this purpose, exactly what has been performed is recorded.

Under no circumstances may data be written down in the meantime on uncontrolled paper or the popular "sticky notes". There must be no additional "unofficial", "private" or "shadow" documentation. Documents, signatures or entries in minutes must never be dated forward or backward. All activities and work steps carried out must be recorded, dated and signed by the person carrying out the work, accurately and completely. The records are made directly during work in the protocols, logbooks, forms provided for this purpose or in a corresponding validated computer system.

Unforeseen events and errors occur. If work steps could not be carried out exactly as prescribed in the Standard Operating Procedures (SOPs), it is necessary to document how they were carried out instead. It is important that the supervisor or head of quality control (QC) is informed of such deviations from the work instruction and that he/she then decides whether a deviation report must be written. The same applies, by the way, if unexpected measured values are generated during work (Out of Specification Results - OOS) or other unusual observations are made on machines, systems, materials or work processes.

Errors in the actual logging process must be corrected so that the original entry remains legible. If the reason for the correction is not obvious, it must be briefly explained. The correction must be dated and abbreviated.

The subsequent 4-eye-check verifies (checks) all data and calculations in documents and must also be carried out extremely carefully.

Documents and data relating to production and quality control/assurance may not be destroyed. They must always be carefully archived until the legal retention periods have expired. If longer archiving periods have been specified in quality framework agreements, these must be observed. The legal periods are also not the same everywhere and must be considered and observed separately depending on the country.

4.2 Batch documentation

The so-called batch documentation (manufacturing or processing instruction and inspection instruction) is linked to the process documentation. This includes the monitoring and documentation as well as the visualization of the entire manufacturing and processing procedures, including cleaning/disinfection and sterilization. This means that the complete manufacturing process should be fully traceable. This documentation must correspond to an approved master document. Master documents and test instructions must correspond to the submitted approval documents and all subsequent change notifications.

The batch documentation must be easy to understand and clearly formulated to prevent misunderstandings. Under no circumstances may changes to these regulations be made without prior approval in accordance with the change control procedure. Permission to do so must be formally granted in advance by the competent body (quality assurance).

4.3 Standard Operating Procedures (SOPs)

In order to produce medicinal products and active ingredients of uniform quality, there must be no room for interpretation, individual freedom or creativity for individual employees in the performance of any activity. To ensure that everyone does their job correctly at the first attempt, all recurring activities must be described in detail in Standard Operating Procedures (SOPs). These must be simple and clearly formulated and unambiguous. Day-to-day work may only be carried out in accordance with the currently approved SOPs.

Accordingly, the control of these documents is essential, clearly described and strictly adhered to. Often there are paper-based systems, i.e. SOPs, which are available in the original from the quality department and whose copies are distributed in a targeted manner. However, more and more paperless systems are also finding their way into practice, where printing, distribution, etc. is deliberately avoided (paperless means computer-based system, which according to GMP requires qualification and validation). Ultimately, the correct and up-to-date SOPs must be available at the appropriate workstation - either electronically on screen or as a controlled paper version.

The SOPs must be strictly adhered to and followed. Desired changes must be brought to the attention of the responsible person (e.g. supervisor, quality assurance) as suggestions; such changes may only be implemented after they have been approved by persons appointed for this purpose and responsible departments such as quality assurance. The review of the approval must be considered in the same context. It should also be considered that a quality framework agreement may stipulate that third parties must be informed of such changes and that their consent to the change must also be obtained in advance.

Nevertheless, SOPs must be updated/revised regularly. Chronological records must be kept of all changes/revisions to ensure traceability (for example, if years later the question arises as to what has been changed from version 2 to 3, even though version 5 is already valid).

4.4 Data integrity

Huge amounts of data and documents are generated in connection with the development, approval, production, testing and shipment of drugs. These documents and data are important in order to be able to prove the perfect quality of the drugs at any time (traceability). What must not and never must happen is data loss. The data and documents must always be up-to-date and accessible, and may not be conflicting, deleted or (accidentally or even deliberately) changed.

In this context, data integrity means: data is correct and trustworthy because it has been and has been protected from unauthorized access and any kind of modification from its creation to its archiving.

Every company along the value chain of drugs and active ingredients must therefore regulate precisely who has access to which data and documents, who can and may read, modify, copy, approve or otherwise edit them.

Both electronic data and documents and also data on paper must be protected against loss and alteration.

For electronic data and documents, an electronic "audit trail" must also record in the background which user has accessed which data and when, what exactly was done and whether changes were made. The audit trail must only be made accessible to a few people, including access by a regulatory inspector. The audit trail ultimately serves as a monitoring instrument for electronic processes. In the case of paper-based raw data, the audit trail must be observed and updated in writing.

5. Production

5.1 Starting materials: Active substances, raw materials, auxiliary materials or packaging materials

The quality of pharmaceuticals is very much dependent on the quality of the raw materials, including packaging materials. Therefore, all pharmaceutical starting materials/raw materials must be handled with particular care. Starting materials for medicinal products may only be purchased from qualified suppliers, i.e. from suppliers who have made a contractual commitment to quality and have been audited by Quality Assurance.

Inspection in this context means to check the supplier's processes during an on-site audit before starting business activities (initial qualification and release) and then to repeat the audit periodically and risk-based (monitoring). Approved suppliers should be kept in a list for this purpose. The certification status of the supplier must be kept in mind and is ideally also part of a quality framework agreement to be concluded. Make a note of this: The manufacturer is equally responsible for defects that a supplier introduces into his own product. Accordingly, the guiding principle "Trust is good, control is better" applies (comparison Part 1 - History of GMP).

Once a supplier has been approved, a purchase order can be placed. At goods receipt, it must then be checked (e.g. using a checklist) whether the delivery corresponds to the order and whether all containers are clean, undamaged on the outside and correctly labelled. In addition, it is important to check whether the physical environmental conditions (e.g. temperature, humidity) were correctly maintained during transport (compare the rules for Good Distribution Practice - GDP) or whether there were any deviations from these conditions which caused the goods to spoil during transport.

All incoming materials that have an impact on the quality of the end product must be sampled in accordance with SOP and the samples must be forwarded to quality control for evaluation. Materials that have not yet been released and/or rejected must be immediately quarantined and protected from unauthorized access. Only released raw materials/raw materials and end products may be used. An SOP should precisely describe the flow of goods (e.g. first-in, first-out - FiFo) and storage. Environmental conditions must be monitored. All incoming and outgoing goods must be controlled and documented. The use of all outgoing/raw materials must be traceable and traceable at all times.

There is a particularly high risk of mix-up or undermixing in the case of printed packaging materials. For example, a given concentration of an active ingredient can be confused - 20 mg of penicillin is inadvertently packed in a package containing 40 mg of penicillin. Or an outer package that was supposed to contain penicillin suddenly contains ibuprofen. Therefore, printed packaging materials may only be stored in areas with access control systems. Incoming and outgoing goods of printed packaging materials must be monitored, traceable and countable. In addition, a material balance must be drawn up for each use of printed packaging materials (yield limits must also be defined for this purpose).

5.2 Manufacturing and "In-Process Control" (IPCs)

In-process controls (IPCs) are the checks carried out during the course of a production process, which are used and carried out continuously to monitor and control (production) processes. Among other things, this ensures that a product ultimately complies with the defined specifications. At which times IPCs have to be carried out and how many samples have to be taken for this purpose is precisely specified in the manufacturing specification. This is determined primarily by means of a risk assessment (risk-based approach) and is determined using statistical methods (for example, according to ISO 2859, acceptance sampling inspection based on the number of nonconforming units or defects - attributive inspection; Acceptable Quality Level - AQL). IPCs are thus fixed and indispensable mandatory components in the manufacturing process. If IPC samples are taken at a time other than the prescribed time, this must be clearly documented and justified in the manufacturing record (see chapter 4.1 Recording).

Weighing in raw material is a good example of an important IPC.  Errors that occur during weighing can hardly be corrected afterwards and are also difficult to detect. For this reason, weighing must only be carried out by specially trained personnel.

To avoid mix-ups and undermixing, all ingredients, intermediate stages, containers, rooms and machines must also be labeled clearly and legibly at all times. Before any (further) processing, all labels or markings should always be checked again.

5.3 Validation (of manufacturing and packaging processes, analytical methods and cleaning)

All manufacturing and packaging processes, analytical methods and cleaning procedures must be validated, i.e. it must be shown that these methods/procedures can be reproduced to create the intended result.

A risk assessment is appropriate before validation begins. This involves determining which parameters have an impact on the final patient safety and how these can be reduced at the outset.

Following the risk analysis, the validation plan is then created. The result of this risk analysis is directly incorporated into the validation plan. The validation plan defines the objectives, procedure and responsibilities for each validation. It also defines acceptance criteria, test methods and regulatory bases. The actual execution of the validation may only begin once the validation plan has been approved in writing by the responsible persons. If changes/additions to the validation plan are necessary during the execution of the validation, these must be documented, evaluated and also approved in accordance with change management.

After the execution of the checks defined in the validation plan, a validation report is created. The validation report must contain a conclusion about the validation and must finally be approved and released by the responsible persons. If the validation fails, appropriate documentation and evaluation should be carried out. Repeating tests until the expected result is achieved is strictly prohibited ("Testing into compliance"). Therefore, the 4-eye principle must be strictly observed during validation.

5.4 Reference samples and retained samples

GMP specifies that appropriate reference samples of starting materials, packaging materials, critical intermediates and finished medicinal products must be taken during and after production. These should serve to be able to provide evidence of good quality at a later date if stored properly.

Retained samples of packaged medicinal products have the same use and purpose here. After each packaging process, it should be proven that the correct packaging materials, labels and variable data (batch number and expiry date) were used. The number or quantity of reference samples and retained samples as well as the responsibilities must be precisely regulated and described in an SOP. The risk-based approach in conjunction with statistical process control is a good guide to the optimal quantity.

Storage of such reference and retained samples shall be in rooms where the storage conditions (temperature, humidity) are permanently monitored in accordance with the manufacturer's specifications. Basically, this is an archive with limited access only for authorized persons and with corresponding documentation of the data on receipt, monitoring, alarming, removal and use.

6. Quality control

6.1 Specifications

Specifications are descriptions of properties, e.g. of starting materials, intermediate products or end products. They must correspond to the approval documents submitted to the authorities/regulatory bodies and all subsequently approved change applications. In addition, wherever applicable, they must meet or exceed the requirements of local and overarching pharmacopoeias (e.g. Pharmacopoea Europea - Ph.Eur., Pharmacopoea Helvetiva - Ph. Helv.)

The specifications of the starting materials must be clearly formulated and unambiguous for ease of understanding. Again, any change must be made in accordance with the change control process and, accordingly, may only be implemented after approval and documentation.

6.2 Stability

The usability period printed on a pharmaceutical package must be sufficiently documented by stability data (stability in the corresponding packaging). This data must already be determined in the development phase and is then documented in the stability plan. The test intervals and storage conditions must be clearly and unambiguously specified in the stability plan. They must be in accordance with the approval documents and all subsequently approved change applications.

The stability plan must be authorised or released as a controlled document by designated persons (head of quality control, possibly also the qualified person). The stability tests are carried out in accordance with the stability plan and must be completed within the specified time. The stability data must be evaluated for possible deviations and/or tendencies and assessed within the framework of the periodic Product Quality Review (PQR).

Any deviation from the specified storage conditions must be reported immediately to the Quality Control management (possibly also to the competent person) and investigated. Again: Documentation! Because what is not documented cannot be proven and therefore is not made.

6.3 Release

The last quality assurance step is the release. This essential step is ultimately the step that is intended to prevent any defective starting materials from being processed or even defective drugs from being circulated and consequently used by patients. The release of starting materials or end products may therefore only take place when the analysis results comply with all current specifications and the batch documentation has been checked accordingly.

This takes place in the so-called "Batch Record Review" and is done batch by batch. Before release, analysis reports, manufacturing and packaging protocols including IPCs, any deviation reports, raw material certificates, room monitoring reports, etc. are checked for completeness and plausibility.

6.4 Market release

Responsible for the final market release of medicinal products is the qualified person (in Germany according to § 14 of the German Medicines Act). The English term for this person is Qualified Person (QP). In Switzerland, the release of finished medicinal products is the responsibility of the so-called Qualified Person (FvP) - provided that the company's operating license permits its own market releases.

The exact process of the release and thus ultimately the market release must be regulated internally (e.g. by means of an SOP).

7. Outsourced activities

Pharmaceutical manufacturers outsource many activities to external service providers, which could directly or indirectly influence the quality of drugs. These external service companies include:

• Suppliers of active ingredients, excipients, packaging materials or equipment

• Service providers for e.g. qualification or maintenance of rooms and equipment, cleaning, pest control, microbiological monitoring, archiving, IT service, data hosting

• Contract manufacturers and contract laboratories that carry out manufacturing or packaging steps or analysis on behalf of others

• Logistics companies that handle the storage and transport of input materials and products.

The responsibility for outsourced GDP/GMP tasks/processes or activities that are outsourced to external contractual partners always remains with the pharmaceutical entrepreneur or marketing authorisation holder (i.e. the one printed on the pharmaceutical package). The pharmaceutical entrepreneur must therefore ensure that all quality-relevant contractual partners are suitable for performing the intended tasks (supplier qualification). This can be done, for example, by means of audits, comparative analyses, error statistics and contractual agreements.

In addition, the responsibilities between clients and contractors must be contractually precise and clearly defined. To this end, contracts and agreements are concluded; including the Delimitation of Responsibility Agreement, Quality Assurance Agreement, Framework Agreement and a Non-Disclosure Agreement.

After an initial supplier qualification, periodic supplier monitoring (evaluation, assessment, re-qualification) must be carried out in order to check the continuity of quality. Here it is important to check existing certifications (e.g. ISO 9001, 17025, ...) for up-to-date certifications. Deviations, complaints and other Key Performance Indicators (KPI) should be maintained as key figures during the business cooperation and used for a re-evaluation.

In the case of contract manufacturers, it must also be specified in writing whether the competent person of the contracted company will carry out the market release of the finished medicinal product or whether this task will remain with the client.

In order to avoid misunderstandings or problems, the working methods and all necessary information must be described in detail in writing, formally handed over and confirmed by both parties, often called technology transfer.

The contractor, on the other hand, must adhere exactly to the contractual agreements as well as specifications and similar requirements. If there are deviations or changes, he must inform the client, document the deviations or changes, and wait for instructions.

8. Complaints and claims

In the company there must be a responsible body known to everyone, to which all complaints and claims (process and product, internal and external) are forwarded. All incoming complaints must be investigated immediately and answered within a specified period of time (e.g. thirty calendar days) (Note: in quality framework agreements with suppliers/ subcontractors etc., different periods of time may be defined). If the investigation cannot be completed within the defined period, an interim report must be prepared.

An integral part of any investigation of a complaint must be whether a drug that is the subject of a counterfeit complaint. Each complaint, its investigation, any supporting data material and corrective measures must be documented in an error report such as a CAPA or 8D). 8D is a report that examines eight obligatory process steps to investigate a complaint in order to eliminate the original cause of the error and identify measures for correcting the error. All complaints and objections must be analysed with regard to trends (trending) and must be assessed and evaluated within the framework of the periodic Product Quality Review (PQR).

9. Inspections and audits

9.1 Internal audits (self-inspections)

Internal audits serve to identify weak points before damage occurs (preventive quality assurance measure). Audits must be planned, carried out at regular intervals and in all areas and functions. To this end, an audit plan for the coming year should be drawn up at the beginning of the year and list all planned audits. However, there can also be unannounced and thus unplanned audits; these can be added to the plan afterwards and marked as "unannounced".

An SOP should specify and describe the audit system, schedule and categorize of deviations. Audits also serve to identify improvements (continuous improvement process - CIP) and thus to optimize processes. Attention must be paid to the sufficient suitability of the auditors (proof of qualification).

Each audit must be documented in writing. In addition to the documentation of observations, corrective actions and deadlines for these actions must be defined and documented. The implementation of the corrective measures must be monitored; accordingly, corrective measures required from previous audits should also be part of the audit agenda. Failure to meet deadlines for the implementation of corrective actions should lead to a reassessment and, if necessary, to a post-audit.

9.2 Inspections by authorities

Pharmaceutical companies, their suppliers and also logistics partners are regularly inspected by the responsible monitoring authorities. The inspectors check very closely whether the GMP rules have been and are being observed.

In doing so, very conscientious attention is paid to the correct implementation of SOPs, manufacturing instructions, test instructions, etc. Compliance with the regulations is referred to as GDP/GMP compliance.

9.3 Audits of service providers

Anyone who manufactures or outsources activities to external service providers (outsourcing), must carry out an audit of the service provider to ensure that the contractor strictly complies with GDP and GMP regulations and all contractual agreements, so that the service company can continue to be considered a suitable partner. Anyone who manufactures, tests or performs other services on behalf of a customer must be audited and comply with all agreements, as the customer bears the ultimate responsibility. See also chapter 7.

10. Storage and transport

10.1 Stock keeping

Careful storage is the basic prerequisite for ensuring that starting materials, intermediate stages, semi-finished and finished products are protected against spoilage, confusion or mistaken use. For this purpose, the storage areas must be tidy, clean and free of vermin. All material must be stored according to the specified conditions and away from the floor and walls with sufficient clearance to facilitate cleaning, allow circulation and prevent heat accumulation and penetration of moisture or similar.

In areas with controlled storage conditions, environmental controls (temperature, humidity, light) must be carried out and recorded. It is recommended to set up an alarm system in case specified quality levels are exceeded and to store the data electronically to improve data integrity. In case of deviations, measures must be taken in accordance with an appropriate SOP. Stored containers must be correctly labeled and clearly marked according to SOP. Printed packaging materials and quarantine materials must be protected against unauthorized access.

Medicinal products and other materials intended for destruction must be stored separately from all other materials so that they are not used or dispatched in error or intentionally. They must be disposed of properly and without delay. Unauthorized access must be avoided at all costs.

To prevent materials for disposal from falling into the wrong hands, the type of destruction and the quantity disposed of must be documented.

10.2 Transportation

Active ingredients and medicines must be packed for transport in such a way that they are not damaged by heat, frost, impact or falling. For refrigerated and cold chain medicines, the packaging scheme must be followed exactly. Hypothermia, e.g. due to too many cooling elements, can damage the drug in the same way as overheating. Temperature monitoring during transport is essential and must be carried out in accordance with GDP regulations. A transport validation is therefore necessary. A risk analysis should be carried out in advance. To read in detail how to follow Good Distribution Practices for APIs, read this white paper.

In order to avoid theft or replacement by counterfeits as far as possible during transport, only specialised, trustworthy logistics companies should be contracted for the transport. Seal marks, seals, data loggers, GPS (Global Positioning System) tracking or Mobile IoT real-time monitoring are used to detect tampering with containers, vehicles and irregularities during transport.

The article was first published in the German magazine PM QM 2020, Edition 01/2020.

About the author

Björn Niggemann has been working for ELPRO-BUCHS AG as Chief Quality Officer since April 2016. In 2004, he was initially commissioned to set up and implement GMP system on existing 17025 accreditation. In 2007he built up a GMP system for an existing GLP system as Compliance Manager. From 2009 to 2010 he worked for a pharmaceutical service provider as GLP / cGMP as Quality Compliance Manager. From 2010 to 2016 Bjoern worked in a Swiss biotech company in the role of Head of Operations and Quality. Today he still heads the working group GDP of GQMA - Germany Quality Management Association e.V. and is thus a member of the extended board.

References

[1] "Compact GMP" by Reinhard Schnettler and Dr. Christine Oechslein, 8th edition 2019, PTS Arnsberg. Source of supply: PTS Training Service, Postfach 4308, D-59737 Arnsberg, www.pts.eu, info@pts.eu
[2] Brochure "GMP and Quality Systems"; Published by Dr. Jürgen Werani, Gabriele Czeromin, Susanne Haas (now Susanne Schweizer), Pfizer GmbH, Arzneimittelwerk Gödecke, 1996