audits, inspections and management of suppliers in india ... · fda cgmp requirements (continued)...

Audits, Inspections and Management of Suppliers in India and China

John McKay – ASQ CMQ/OE, CQA

India China

John McKay - ASQ CMQ/OE, CQA - Quality/Compliance/Operational Excellence Executive October 24 , 20191

Presentation for the FDA Inspections Summit

October 24, 2019Presenter:John McKay – ASQ CMQ/OE, CQA;

Exemplar Global Lead QMS Auditor (ISO 9001), Lead ISO 13485 Medical Device Auditor; Lead

EMS Auditor (ISO 14001);

NREP Registered Environmental Manager (REM), Certified Environmental Auditor (CEA)

Topic: Audits, Inspections and Management of Suppliers in India and China

Agenda:

1. Supplier Management Needs

2. Supplier Management Benefits

3. Quality Policy (7 Principles)

4. Data Integrity Policy (8 Principles)

5. Top 20 FDA 483s for India and China

6. Methods for Supplier Management

7. Plan-Do-Check-Act (PDCA) Cycle

8. Preventive Actions for Suppliers

9. Conclusions and Recommended Next Steps2

John McKay - Bio American Citizen – born, trained in United States with international management experience

Former SVP Global QA and Chief Compliance Officer for Hisun Pharmaceutical, Hisun-SIPCO

Current: CEO and Chief Compliance Officer for Q1 Associates LLC

BS Chemical Engineer (Penn State University), Graduate of Wharton Management Program at Wharton Business School (University of Pennsylvania), Completed Project Management Institute at Katz Business School (University of Pittsburgh) Completing courses for: Master's Degree (MS) of Regulatory Affairs/Quality Assurance (RA/QA) at Temple University, Graduate School of Pharmacy

Expertise: 34+ Years international management experience in Chemical Engineering, Quality Assurance, Quality Control, Compliance, Technical Services, Operations, Manufacturing, Supply Chain Management, Regulatory Affairs, Operational Excellence, Clinical Affairs, GMP, GCP, GLP, GDP, CSV, ICH Q7, Q8, Q9, Q10, Q11, CRO, CDMO, CMO, CLO

Companies worked for: Rohm and Haas, ARCO Chemical Company, Lyondell, Bayer, Stryker, Biomimetic Therapeutics, Pathfinder Therapeutics, CTI BioPharma, Hisun-SIPCO, Q1 Associates LLC

Industries worked in: Pharmaceutical, Medical Device, Combination Products, Biotechnology, In Vitro Diagnostic (IVD), Chemicals, Energy, Automotive, Aerospace

Countries with Work Experience In: completed various Projects, Product Approvals/Launches, Audits, Implementations in the following countries: US, Mexico, Canada, UK, Ireland, Wales, Czech Republic, Austria, France, India, Brazil, Australia, Germany, Netherlands, Italy, Belgium, Indonesia, Japan, China, Taiwan, Singapore, Israel, Portugal, Switzerland, Macau, and South Africa.

ISO Standards implemented: ISO 9001, ISO 13485, ISO/IEC 17025, ISO 14971, ISO 14001, OHSAS 18001, ISO 45001, ISO/TS 16949, ISO 15189, AS9100

Professional Certifications:

1. ASQ CMQ/OE - Certified Manager of Quality/Organizational Effectiveness

2. ASQ CQA - Certified Quality Auditor

3. Exemplar Global Certified Lead Quality Management System (QMS) Auditor (ISO 9001)

4. Exemplar Global Certified Lead Medical Device ISO 13485 Auditor

5. Exemplar Global Certified Lead Environmental Management System (EMS) Auditor (ISO 14001)

6. NREP REM - Registered Environmental Manager

7. NREP CEA - Certified Environmental Auditor

8. ASQ CPGP – Certified Pharmaceutical GMP Professional (preparing for the certification examination) 3

Suppliers in India and China

1. Company Manufacturing Facilities

2. CRO: Clinical Research Organization

3. CDMO: Contract Development and Manufacturing Organization

4. CMO: Contract Manufacturing Organization

5. CLO: Contract Laboratory Organization

6. IRB: Institutional Review Board

7. Ethics Committee

8. API Suppliers

9. Starting Material Suppliers, Raw Material Suppliers

10.Excipient Suppliers

11.Medical Device Parts Suppliers

12.Equipment Suppliers

13.Software Suppliers

14.Warehouse and Storage Companies

15.Distribution and Shipping Companies

16.Packaging Companies4

Experience with Suppliers in India

1. Worked for a large global Pharmaceutical and Medical Device Company with:

a. Asia Headquarters in India

b. 4 world-class manufacturing facilities in India

c. Supported audits and action items for certification to ISO 9001, ISO 13485

d. Prepared sites on Inspection Readiness for FDA and EMA Inspections

e. Developed and implemented site systems for Operational Excellence

2. 19 years of experience supporting company facilities in India, and managing

CDMOs, CMOs, CLOs in India, with Business Visa

3. 3 years of dedicated Supplier Management for a CDMO in India with:

a. Monthly Meetings with 2 different facilities

b. Onsite Audits at the 2 facilities in India every 6 months

c. Annual Person-In-Plant Oversight Events at the 2 facilities in India

4. Ensured FDA Inspection and EMA Inspection Readiness for Suppliers in India

5. Provided Support for Suppliers in India for: CAPA, Deviation Management,

Change Control, Data Integrity, Root Cause Analyses, Effectiveness Checks,

SPC, SQC, Quality Agreement, Management Review, APR, Training, QMS.5

Experience with Suppliers in China

1. Worked for a large global Specialty Chemical Company with:

a. 1 world-class manufacturing facility in China

b. Supported audits and action items for certification to ISO 9001

c. Developed, implemented, and audited site systems for Operational Excellence

2. Worked 3 years in China for a large global Chinese Pharmaceutical Company:

a. 3 world-class manufacturing facilities in China: API, Excipients, Drug Products

b. Supported audits and action items for certification to ISO 9001, ISO 14001

c. Prepared sites on Inspection Readiness for FDA, EMA, WHO Inspections

d. SVP Global QA and Chief Compliance Officer responsible for QA, RA, Clinical

Affairs, Supply Chain Management, Compliance, Training, QMS, LMS, DCS

e. Supported audits from Pharma customers for services: CRO, CDMO, CMO, CLO

3. 26 years of experience supporting company facilities in China and managing CDMOs,

CMOs, CLOs in China, with Business Visa, then with Residence Permit and Work

Permit. Management Representative for Quality Management System.

4. Provided Support for Company Sites and Suppliers in China for: CAPA, Deviation

Management, Change Control, Data Integrity, Root Cause Analyses, Effectiveness

Checks, SQC, SPC, Quality Agreement, Management Review, APR, Training, Clinical

Affairs, Supply Chain Management, Internal Audits, Supplier Audits, LMS, QMS, DCS.6

Supplier Management Needs1. India provides the U.S. with 25% of its generic drugs.

2. 80% of the global APIs are sourced from India and China.

3. Most CDMOs, CMOs from India obtain some raw materials from China.

4. Combined, India and China, are the largest pharmaceutical and medical device

markets in Asia.

5. Laws, Regulations from USA FDA

6. Laws, Regulations from China National Medical Products Administration (NMPA)

7. Laws, Regulations from India Central Drugs Standard Control Organization

(CDSCO )

8. Majority and Highest Severity of FDA Inspection Deficiencies in China, India

9. Industry Standards: i.e. Toxic Impurities

10.Regulatory Agency Inspections for Products

11.Risk Management: largest impacts from Asia Suppliers

12. ICH Standards: Q7 to Q11

13.Data Integrity, Data Manipulation are frequent issues in China and India

14.Historical harmful raw material substitutions at Chinese API Suppliers (Heparin)

15.Recent Recalls due to carcinogenic raw materials in Chinese API products

16.CDMOs, CMOs in the US and EU may have API or Excipient Suppliers in India or

China 7

ISO Standards

ISO Standards (Quality, Risk Management, EHS, Laboratory, Industry):

1. ISO 9001:2015, Quality management systems – Requirements

2. ISO 13485:2016, Medical devices - Quality management systems - Requirements for regulatory

purposes

3. ISO 14971:2007, Medical Devices – Application of Risk Management to Medical Devices

4. ISO 14001:2015, Environmental Management Systems – Requirements with Guidance for Use

5. ISO 45001:2018, Occupational Health and Safety Management Systems – Requirements with

Guidance for Use

6. ISO/IEC 17025:2005, General Requirements for the Competence of Testing and Calibration

Laboratories

7. ISO 15189:2012, Medical Laboratories – Requirements for Quality and Competence

8. ISO 29001, Petroleum, petrochemical and natural gas industries -- Sector-specific quality

management systems -- Requirements for product and service supply organizations

If the key suppliers are certified to any of these ISO Standards, this:

a. improves reliability, performance, risk management, CAPA, follow-up, and compliance

b. includes periodic checks from Notified Body Audits.

c. provides a more robust, capable and sustainable Quality Management System (QMS)

8

Supplier Management Benefits1. Need successful Inspections at Suppliers to obtain approval for NDA, ANDA,

PMA, 510(k), BLA.

2. Need successful Inspections at Suppliers to prevent Import Alerts, Drug

Shortages, Device Shortages, Recalls; Issues can cause Clinical Hold

3. Successful Product Development relies on successful, capable, reliable API

and Excipient Suppliers.

4. APIs and Excipients sourced from India and China could be the weakest link

in the Supply Chain.

5. Laws, Regulations, Industry Standards for toxic impurities or raw materials:

need to be traced, identified, minimized, monitored, controlled

6. Compliance with Laws, Regulations, ICH Standards, Quality Agreements

7. Onsite Audits help identify, correct, improve, or remove bad or weak suppliers

8. Risk Management, Change Control, Deviation Management, CAPA

9. Continuous Improvement: reliability improvement and cost reduction

opportunities – prevent the high costs of Quality Problems in supply chain

10.Track the Site Inspection History, Results, CAPA, to check progress, and

prevent interruptions to supply9

Top 20 FDA 483s in Last 5 Years for India:

1. Data Integrity 2. Investigations3. Process Validation4. Laboratory Controls5. Cleaning Validation6. Procedures7. Environmental Monitoring8. OOS (Out-of-Specification)9. Facilities – Design and Construction10. Training11. Contamination12. Methods Validation13. Equipment – Cleaning and Maintenance14. Product Stability15. CAPA (Corrective Action and Preventive Action)16. Microbiological Contamination17. Aseptic Processing18. Product Safety19. Sanitary Operations20. Media Fills

John McKay - ASQ CMQ/OE, CQA - Quality/Compliance/Operational Excellence Executive October 24, 2019 10

Source: FDAZilla

Top 20 FDA 483s in Last 5 Years for China:

1. Data Integrity 2. Process Validation3. Investigations4. Laboratory Controls5. Procedures6. Cleaning Validation7. CAPA8. Environmental Monitoring9. Training 10. Facilities – Design and Construction11. Contamination12. OOS (Out-of-Specification)13. Product Stability14. Equipment Qualification15. Methods Validation16. Product Stability17. Sanitary Operations18. Raw Materials and Suppliers19. Equipment – Cleaning and Maintenance20. Risk Management


Source: FDAZilla

Quality Policy and Data Integrity Policy Questions

1. Does your Supplier have a Quality Policy?

2. Does your Supplier have a Data Integrity Policy?

3. Does your Supplier have a Quality Manual?

4. Does your Supplier have a Data Integrity Procedure?

Should encourage and help ensure suppliers develop and implement these documents for compliance, QMS.


FDA cGMP Requirements 21 CFR Part 211, CURRENT GOOD MANUFACTURING PRACTICE FOR FINISHED PHARMACEUTICALS

Subpart A - General Provisions (§§ 211.1 - 211.3)

Subpart B - Organization and Personnel (§§ 211.22 -211.34)

Subpart C - Buildings and Facilities (§§ 211.42 - 211.58)

Subpart D - Equipment (§§ 211.63 - 211.72)

Subpart E - Control of Components and Drug Product Containers and Closures (§§ 211.80 - 211.94)


FDA cGMP Requirements (continued)

21 CFR Part 211, CURRENT GOOD MANUFACTURING PRACTICE FOR FINISHED PHARMACEUTICALS

Subpart F - Production and Process Controls (§§ 211.100 -211.115)

Subpart G - Packaging and Labeling Control (§§ 211.122 -211.137)

Subpart H - Holding and Distribution (§§ 211.142 - 211.150)

Subpart I - Laboratory Controls (§§ 211.160 - 211.176)

Subpart J - Records and Reports (§§ 211.180 - 211.198)

Subpart K - Returned and Salvaged Drug Products (§§ 211.204 - 211.208)


ICH cGMP Requirements (Quality)ICH Q7 to Q11International Conference on Harmonisation (ICH)(of Technical Requirements for Registration of Pharmaceuticals for Human Use: Regulations)

ICH Q7 - GMP Guide for Active Pharmaceutical Ingredients

ICH Q8(R2) - Pharmaceutical Development

ICH Q9 - Quality Risk Management

ICH Q10 - Pharmaceutical Quality System

ICH Q11 - Development and Manufacture of Drug Substances (Chemical Entities and Biotechnological/Biological Entities)


ISO Standards that Pharmaceutical, Medical Device, CMO, CDMO, CLO, CRO companies may certify to which includes Supplier Management requirements: ISO 9001:2015, Quality Management Systems

ISO 13485:2016, Medical Devices, Quality Management Systems - Requirements for regulatory purposes

ISO 14971:2007, Medical Devices - Application of risk management to medical devices

ISO/IEC 17025:2017, General requirements for the competence of testing and calibration laboratories

ISO 15189:2012, Medical Laboratories – Requirements for Quality and CompetenceJohn McKay - ASQ CMQ/OE, CQA - Quality/Compliance/Operational Excellence Executive October 24, 2019 16

Quality Policy 7 Principles (Critical Elements)

1. Management Commitment

2. Quality Culture

3. Compliance

4. Continual Improvement

5. Participation

6. Ownership

7. Customer Satisfaction


Data Integrity Policy 8 Principles (Critical Elements)

1. Management Commitment

2. Data Integrity

3. Data Management

4. ALCOA

5. Honesty Culture

6. Data-Based Decision Making

7. Participation

8. Ownership


Quality Policy and Data Integrity Policy Shared Principles (Critical Elements)

Management Commitment

Participation

Ownership


Data Integrity Policy

ALCOAALCOA: Do you ensure that all source data is attributable, legible, contemporaneous, original, and accurate (ALCOA)?

• Attributable — who acquired the data or performed an action and when?

• Legible — can you read the data and any laboratory notebook entries?

• Contemporaneous — documented at the time of the activity• Original — written printout or observation or a certified copy

thereof• Accurate — no errors or editing without documented

amendments


Data Integrity Policy Honesty Culture

Honesty Culture:1. Is there an Honesty Culture?2. How is an honesty culture of truth and accuracy fostered and supported?3. What is the relationship of an Honesty Culture to the objective of developing, manufacturing, and providing products and services with accurate and truthful data?4. Is your data trusted and preferred by customers?5. How are mistakes handled, reviewed, investigated? 6. How are corrections confirmed, explained, documented?


Data Integrity Policy Data-Based Decision Making

Data-Based Decision Making: 1. Is data used to make decisions?2. How are data-based decisions ensured from the discussion, analysis, and review of objective evidence?3. How are data and objective evidence used in all Problem Solving Processes and Root Cause Analysis Methods?


Data Integrity Policy and Process

1. How is the Data Integrity Policy implemented?

2. What systems ensure Data Integrity?

3. How is Data Integrity checked and verified?

4. Are electronic systems validated?


Plan-Do-Check-Act:Quality/Compliance Key Action Items

• Quality Policy – approved, signed, posted on walls, training

• Data Integrity Policy – approved, signed, posted on walls, training

• Quality Manual

• Data Integrity Procedure

• Complete GMP Training Modules for all staff

• Add Data Integrity topics to the Internal Audit Process.

• Implement Lessons Learned from Audit Findings, Warning LettersJohn McKay - ASQ CMQ/OE, CQA - Quality/Compliance/Operational Excellence Executive October 24 2019 24

Plan-Do-Check-Act (PDCA) Cycle

1. Plan: Review Warning Letters

2. Do: Develop/Implement Corrective Action and Preventive Action Plans

3. Check: Use Audits, Monitoring, Dept. Self-Inspections to check readiness

4. Act: a. Fix any issues from the Checksb. Confirm effectivenessc. Assess during Management Reviewd. Adjust the Annual Risk Based Audit Programe. Repeat from the Plan Step


GxP Quality Management System 1. Management Commitment = Resources, Accountability, Expectations, Quality/Compliance Culture

2. Professional, Trained, Empowered QA-GxP Personnel and Resources

3. Identification of GxP Requirements and Needs

4. Gap Analyses to GxP Requirements (FDA Regulations, EMA Regulations, Country Regulations, ICH Standards)

5. Close Gaps, Build and Implement Quality Management System (SOPs, Processes, Forms)

6. Quality Agreement, QA-GxP SOPs, Quality Manual, Quality Policy, Data Integrity Policy, Data Integrity Procedure, Documents, Forms, Records, Files

7. Corrective Action and Preventive Action (CAPA) Process

8. Deviation Management

9. Change Control

10. Internal Audit Program

11. GxP Supplier Audit Program (CROs, Investigator Sites, IRBs; CDMOs, CMOs, CLOs, All Key Suppliers)

12. Management Review Process, Annual Product Review Process

13. Review, Learning, CAPA from FDA Warning Letters, Audits

14. Training, Requirements, Accountability for Sponsors, CROs, Investigator Sites, IRBs, Monitors, CDMOs, CMOs, CLOs

15. Informed Consent, Protocol Management, Site Initiation, Clinical Monitoring, Data Monitoring Committee, Trial Management, Medical Expertise, Reports and Recordkeeping, Drug Accountability, Device Accountability


GxP = GLP, GCP, GMP

Preventive Actions for Sponsors Built Quality and Compliance Systems for GCP Compliance to US FDA requirements

Implement, support, demonstrate a strong, effective Quality and GCP Culture

QA and Compliance Management Team for GCP: QA-GCP Department

Lead, Mentor, Train and Develop Staff for GCP Knowledge

Quality Policy

Data Integrity Policy

Quality Manual

Quality Management System (QMS) – QA-GCP SOPs, Forms, Records

Document Control System (DCS) – SOP, Files, Records, Reports, Data Management

Learning Management System (LMS) – electronic, cloud based, or paper based LMS

FDA GCP Training Modules – full implementation for Company, CROs, Investigator Sites

Periodic Review of FDA Warning Letters and implement associated CAPA Action Plans

Compliance with FDA GCP Regulations – Gap Analysis, Plan-Do-Check-Act

Compliance with ICH GCP Standards – Gap Analysis, Plan-Do-Check-Act

Strong and effective Monitoring Program with Professional Clinical Monitors

Risk Based QA-GCP Audit Program

QA-GCP Audits of Key GCP Suppliers: CROs, Investigator Sites, IRBs, any Clinical Labs

Medical Expertise, Personnel, Oversight, Review, Engagement for all Clinical Trials 27

Lessons from Warning Letters, Audits, Management Review1. All FDA Warning Letters are Preventable with a Plan-Do-Check-Act Process

2. Important to learn from other's FDA Warning Letters, prevent compliance issues

3. Preventing FDA Warning Letters and Compliance Issues by building Quality

Management Systems has many benefits, cost savings

4. The FDA Warning letters are an important training and teaching tool for GxP

Compliance

5. Management Commitment to providing resources, expectations, and accountability

is vital and most important

6. Training on and Knowledge of GxP Requirements is essential

7. Auditing, Monitoring, Gap Analyses are key processes for correction

8. Document Control and Management is very important to ensure compliance

9. Sponsors, CROs, Investigator Sites, IRBs have connected requirements to ensure

GCP Requirements and the Protection of Subjects

10. The consequences of GCP non-compliance are severe and can cause irreversible

damage to a company’s success, including:

a. Clinical Hold

b. Cancellation of the Clinical Study

c. Clinical Study Data not allowed for submission

d. Rejection of the NDA, ANDA, PMA, BLA

28John McKay - ASQ CMQ/OE, CQA - Quality/Compliance/Operational Excellence Executive October 24, 2019

Conclusions and Recommended Next StepsOperational Excellence Methods:

• Ensure Training to Suppliers Staff Personnel on Quality Policy and Data Integrity Policy

• Share Good and Best Practices among company and supplier organization sites

• Gap Analyses on new regulations and standards; Close Gaps

• Ensure effective and efficient Utilization of Personnel and Equipment

• Dashboard to monitor, improve, optimize: Input, Process, Output Parameters

• Investigate, Determine Root Cause(s), Close Audit Findings

• CAPA Plan: Create, Get Input, and Implement

• Quality Improvement Plans

• Product Development: Ensure frequent communication and checks

• Lean Six Sigma: Define-Measure- Analyze-Improve-Control

• Vigilant reporting and evaluation of Closure Activities for Audit Findings

• Supplier Management Scorecards

• Monthly Meeting Process with Suppliers to ensure efficient and effective deployment, and

to provide mentoring, coaching, leadership, Follow-up, Tracking, Closure (FUTAC)

• Implement effective Quality Agreements, maintain and periodically review

• Obtain objective evidence of closure to Audit Findings

• Check live Audit Trails, use visual observation of all supplier facilities, production, storage

• Effective Supplier Management with Supply Chain Companies: CLOs, CROs, CDMOs,

CMOs29

Thank you very much.Question and Answers

John McKay - ASQ CMQ/OE, CQA; Exemplar Global Lead QMS Auditor (ISO 9001), Lead ISO 13485 Medical Device Auditor; Lead EMS Auditor (ISO 14001); NREP Registered Environmental Manager (REM), Certified Environmental Auditor (CEA)[email protected]

30