Achieving FDA Compliance in a Virtual Biopharma Company

Jason E Moore, MS, MBA, RAC

Minimize Risks, Maximize Development Success

THE “VIRTUAL COMPANY”

• The “virtual company” model is increasingly used as a cost-containment approach for many start-up and development-stage life science companies

• Allows access to needed development expertise and research/development resources, without creating own infrastructure

• Achieved through use of contract research organizations (CROs), consultants, and other service providers

• Can be a very smart and effective approach to achieving efficiencies; particularly desirable if the technology/product(s) are to be partnered

• Brings a particular set of business and compliance challenges that are often under-appreciated

• Requires a special set of talents for the virtual company executive to effectively manage

2

Lack of alignment, or frank conflicts, lead to dissonance and

execution failures

CLINICAL CROs

Method development, validation, and QC testing critical

ANALYTICAL LABS

Seek vendors that have regulatory and “mechanical” expertise in

regulatory submissions

eCTD VENDORS

Bad consultants have far-reaching effects. How can one tell the difference between a good consultant and bad?

REGULATORYCONSULTANTS

Compliant execution of targeted studies is key to IND activation,

NDA approval

NONCLINICAL CROsOnce committed, difficult to “break up”. Often rate-limiter/critical path for IND, clinical studies, NDA readiness, and commercial launch.

CMOs

MANAGING A CONSTELLATION OF EXTERNAL PARTIES

Virtual CompanyExecutive

THE VIRTUAL COMPANY MODEL CARRIES RISKS

• Two primary risk classes: o FDA Compliance Risk: ie, the risk that programs will not be conducted according to required

regulatory standards (eg, GXP)o Deliverable Quality Risk: that delivered work products will be of inadequate quality, or

otherwise will not be suitable to support IND or approval

• There are also execution risks when a third-party is asked to develop ‘your’ producto Can they adhere to timelines?o Stay on budget? (Inherent conflict of interest?)o Adequate transparency, predictability, and clarity of issues/solutions?

• Legal/business risks matter here too (eg, product liability exposure)

EFFECTIVE VIRTUAL MANAGERS HAVE A DUAL CHALLENGE

Regulatory/Compliance

• Determine what responsibilities are to be delegated to contractors

• Conduct an appropriate level of due diligence on each potential vendor or consultant

• Assess the ability of vendors to conduct delegated activities in a compliant manner

• Determine the level of documentation that is needed for both business and compliance purposes

• Assess the interplay among various quality systems, as applicable

• Determine ongoing compliance oversight and audit responsibilities/plans

5

Business Needs and Execution• Define and articulate a strategic

vision/intent• Define corresponding scopes of work,

timelines, budgets• Identify and engage cost-effective

contractors and consultants• Seek, exploit efficiencies and economies

of scale• Ensure vendor oversight and

financial/timing accountability• Ensure the regulatory/development

strategies that the vendor pursues are in-line with your corporate strategies

• Identify and proactively manage risks• Integrate and orchestrate to successful

outcomes• Get the job done

THE COMPLIANCE CHALLENGE – WHO ME??

6

“I am delegating manufacturing to a CRO; their SOPs cover me.”

“I don’t need to visit the vendor or do any audits prior to getting on with the development work.”

“What’s a Quality Agreement?”

“I don’t need to audit.”

“My product is early-development; I’ll deal with all of that [Quality stuff] later.”

“They are an established CRO operating under GXP. I’m covered.”

DELEGATION IS NOT ENOUGH

7

What is required? • Sponsors may delegate certain

obligations to CROs, but they never delegate complete responsibility

• When obligations are delegated, the Sponsor must inform the FDA in writing

• Prior to transferring obligations, business due diligence should not be considered enough

• Virtual company executives need a model for assuring compliance, and documenting their diligence and oversight

WHY? – CLINICAL CRO

8

Clinical CROs• Clinical CROs can be responsible

for… o Site identification and

qualificationo IRB submissions and approvalso Site initiation, interim monitoring,

and close-outo Medical Monitoring and SAE

management and reportingo Study drug management/

accountabilityo Ensure study conduct per

protocol and IND regulations

Scenarios to Consider• SAE resulting in patient death• Interim monitoring reports

suggest quality/compliance issues• End-of-study QA review of clinical

database shows high error rate• Quality issues/concerns emerge

as clinical data reported out• FDA BIMO inspection of a clinical

site, and a 483 or Warning Letter issued

• Study execution poor (eg, late, over budget)

• Fraudulent clinical trial data

9

CLINICAL TRIALS, PARTICIPANTS, AND PROCESSES

Potential Participants• FDA• Sponsor• Investigator• IRB• Subjects/Patients• CROs• Clinical and “Core” Labs• Academic & Government Institutions• Monitors (CRAs)• Auditors

Operations/Process• Hypothesis formulation• Protocol, IB, IC Development• Site/Study Feasibility • Site/Investigator Recruitment• FDA/IND• IRB approval• Site initiation/CTM shipment• Subject screening• Subject randomization, treatment, data collection• Site monitoring• Site close-out• Study data analysis • Study data reporting

10

US IND REGULATIONS – FORCE & EFFECT OF LAWYou are responsible…

21 CFR 50: PROTECTION OF HUMAN SUBJECTS

• Subpart A--General Provisions § 50.1 - Scope. § 50.3 - Definitions.

• Subpart B--Informed Consent of Human Subjects § 50.20 - General requirements for informed consent. § 50.23 - Exception from general requirements. § 50.24 - Exception from informed consent requirements for

emergency research. § 50.25 - Elements of informed consent. § 50.27 - Documentation of informed consent.

• Subpart C [Reserved]

• Subpart D--Additional Safeguards for Children in Clinical Investigations

§ 50.50 - IRB duties. § 50.51 - Clinical investigations not involving greater than

minimal risk. § 50.52 - Clinical investigations involving greater than minimal

risk but presenting the prospect of direct benefit to individual subjects.

§ 50.53 - Clinical investigations involving greater than minimal risk and no prospect of direct benefit to individual subjects, but likely to yield generalizable knowledge about the subjects' disorder or condition.

§ 50.54 - Clinical investigations not otherwise approvable that present an opportunity to understand, prevent, or alleviate a serious problem affecting the health or welfare of children.

§ 50.55 - Requirements for permission by parents or guardians and for assent by children.

§ 50.56 - Wards.

21 CFR 56: INSTITUTIONAL REVIEW BOARDS

• Subpart A--General Provisions § 56.101 - Scope. § 56.102 - Definitions. § 56.103 - Circumstances in which IRB review is

required. § 56.104 - Exemptions from IRB requirement. § 56.105 - Waiver of IRB requirement.

• Subpart B--Organization and Personnel …

• Subpart C--IRB Functions and Operations § 56.108 - IRB functions and operations. § 56.109 - IRB review of research. § 56.110 - Expedited review procedures for certain

kinds of research involving no more than minimal risk, and for minor changes in approved research.

§ 56.111 - Criteria for IRB approval of research. § 56.112 - Review by institution. § 56.113 - Suspension or termination of IRB approval of

research. § 56.114 - Cooperative research.

• Subpart D--Records and Reports § 56.115 - IRB records.

• Subpart E--Administrative Actions for Noncompliance

…

21 CFR 312: INVESTIGATIONAL NEW DRUG APPLICATION [truncated]

• Subpart A--General Provisions

• Subpart B--Investigational New Drug Application (IND)

• Subpart C--Administrative Actions

• Subpart D--Responsibilities of Sponsors and Investigators

§ 312.50 - General responsibilities of sponsors. § 312.52 - Transfer of obligations to a contract research

organization. § 312.53 - Selecting investigators and monitors. § 312.54 - Emergency research under 50.24 of this chapter. § 312.55 - Informing investigators. § 312.56 - Review of ongoing investigations. § 312.57 - Recordkeeping and record retention. § 312.58 - Inspection of sponsor's records and reports. § 312.59 - Disposition of unused supply of investigational

drug. § 312.60 - General responsibilities of investigators. § 312.61 - Control of the investigational drug. § 312.62 - Investigator recordkeeping and record retention. § 312.64 - Investigator reports. § 312.66 - Assurance of IRB review. § 312.68 - Inspection of investigator's records and reports. § 312.69 - Handling of controlled substances. § 312.70 - Disqualification of a clinical investigator…

WHY? – CLINICAL CRO

11

Questionable Clinical Data Submitted to FDA• Can trigger FDA’s “Application Integrity

Policy”, where FDA investigates potentially false data submitted in an application

• Results in delays during the investigation• If fraudulent or substantially incorrect data

are submitted, or there are other material omissions or misstatements of fact, the NDA can be invalidated (ie, rejected)

• Includes submitting data that may be unreliable due to, for example, a pattern of errors whether caused by incompetence, negligence, or a practice such as inadequate standard operating procedures or a system-wide failure to ensure the integrity of data submissions

• One or more (pivotal) studies can be thrown out (requiring their repetition)

• Other civil and criminal penalties can result

WHY? – CMO

12

Contract Manufacturers• CMOs can be responsible for…

o GMP production of clinical trial materials (study drug) to be administered to patients

o CTM testing and releaseo Process development, scale-up,

clinical- and commercial-scale production

o Labeling and distributiono Analytical method development

and validationo Stability testing

• Subject to Pre-approval Inspections (PAIs)

Scenarios to Consider• Defective drug product identified

by pharmacist/clinical site(s) (eg, leaking capsules)

• Lot failure at time of planned release for use in clinical trial (ie, does not conform to release specifications)

• Patient injury due to adulterated drug product

• PAI shows GMP deficiencies leading to NDA Complete Response (non-approval)

WHY? – NONCLINICAL CRO

13

Nonclinical CROs• These CROs can be responsible

for… o Conducting IND-enabling GLP

pharm-tox studieso Conducting other GLP

toxicology studies for NDA (eg, carc studies)

o Qualifying impurities and degradants

• Subject to PAIs

Scenarios to Consider• Failure to…

o Complete stability assessment of test article

o Fully validate bioanalytical methods

o Use validated/Part 11 compliant LIMS for study data collection

o Utilize a properly constituted IACUC

• IND-enabling study raises quality questions at study read-out

• Major compliance issues found during PAI

Plan & Identify CROs Triage Qualify Contract Oversee Audit

APPROACHGenerally, one should employ a semi-structured, step-wise process for identifying, qualifying, overseeing, and auditing key vendors. A virtual company executive definesobjectives and outcomes; identifies, triages, and qualifies potential CROs/vendors; contracts with each, including potentially establishing one or more Quality Agreements;monitors and oversees the vendor and its adherence to obligations; and periodically audits. It is wise to develop documentation to support that each activity was diligentlycompleted throughout the life of the project or program.

A PROCESS TO ENSURE COMPLIANCE

STEP-WISE APPROACH

15

Plan and Identify Potential CROs• Plan

o Seek input from internal resources and key consultants

o Define scopes of work and objectives

o List desired outcomes and work products

o Enumerate any applicable regulatory frameworks/specific requirements

o Prepare RFP (if the structure facilitates interactions*)

• Identify Potential CROs

Triage• Review company’s representations

concerning capabilities• Have initial discussion with BD

contact at vendor• Utilize any word-of-mouth

available/seek references• Assess whether capabilities match

need• Look for evidence of GXP

compliance/noncompliance (eg, debarment, Warning Letters/483s)

• Look for evidence there could be a good cultural match/working relationship

* Many small companies find that preparing lengthy RFPs is not necessary; however, being able to be explicit is a critical factor for success.

STEP-WISE APPROACH

16

Qualify• Vendor qualification can be a highly

structured, formal process• Calibrate the level of diligence to the

potential risks the engagement poseso Ancillary vendors can receive less scrutinyo Core/key vendors should receive more

• Consider pre-engagement qualification site visits (audits)

• Request/review all available Quality documentation (eg, SOPs, org chart, EIRs, Warning Letters, 483s)

• Develop and utilize structured questionnaires

• Maintain records of qualification• Consider independent auditor with

expertise if needed

Contract• Ensure relationships of the parties,

including core responsibilities, are spelled out

• Define explicit scope of work, deliverables, timelines

• Include provisions for critical activities (ie, batch failure, vendor non-performance)

• Be explicit on which regulated activities (obligations) are to be transferred, and how this is to be documented

• Consider a separate Quality Agreement for manufacturing activities that will be part of scale-up to commercial/launch (eg, process validation, registration lots, launch stock)

STEP-WISE APPROACH

17

Oversee for Execution & Compliance• Set expectations for continual updates,

issue management, and oversight• Regular meetings; don’t ‘sign and forget’

until an issue arises• Assume there will be issues, and

determine how you will detect and address

• Be present for key events, or send a representative (eg, key GMP manufacturing runs, sac days at GLP CRO)

• Plan for periodic audits; include in budgets

• Yes, audit the auditors (ie, clinical monitors)

• Be deeply engaged in the event of any Health Authority inspection related to your product(s)

STEP-WISE APPROACH

18

Audit

• Auditing is a formalized process for reviewing an entities compliance with applicable laws and regulations

• Conducted by experts in the technical discipline (eg, nonclinical, clinical, CMC) who also deeply know the regulations (eg, GLP, GCP, GMP) and Quality science

• Select skilled audits; don’t do this yourself

• Provide input into audit plan; facilitate scheduling/access; expect written Audit Report; take action if there are findings

• Don’tso Assume that the CROs Quality

organization has assured adequate compliance

o Believe that clinical site monitoring is adequate; audit all high-enrolling sites and those with any compliance signals

o Decide that the additional auditing expense is not worth it; could prove to be “the best money you ever spent”

o Fail to take action if there are significant findings; use data to prepare site for PAI/BIMO inspection

o Fail to document that you conducted audits/exercised proper diligence (eg, via Audit Certificate)

Minimalist Quality System

Intermediate Quality System

Comprehensive,Mature Quality System

Minimalist: Few SOPs; activities performed ad hoc by various staff; no Quality Policy; no Quality group. Minimal documentation.

Comprehensive: Full range of SOPs across all applicable domains; activities performed ad hoc by dedicated staff; established Quality Policy; Quality function staffed, funded, and with articulated mandate. Comprehensive documentation related to Quality functions (eg, staff, training, vendor qualification, audits)

Intermediate: Modest number of SOPs; activities performed by identified staff; may have simple Quality Policy and organizational charts (for Quality purposes); no Quality group. Some requirements for documentation.

Virtual Companies have some leeway in determining how much of a Quality System and associated documentation is enough

POTENTIAL ELEMENTS

DOCUMENTATION: HOW MUCH IS ENOUGH?

A

B

C

A

B

C

Answer: While a comprehensive Quality System may not be necessary/desirable, companies must embrace at least an intermediate level of diligence, documentation, andoversight. Failing to do so creates myriad liabilities that you don’t want to regret later.

B

It’s not enough to rely on the representations, SOPs, policies, or activities of other regulated entities. To do so invites risk, and creates opportunities for very significant delays, increased costs, loss of investor confidence, and litigation. Consider a right-sized quality system and vendor management approach to be a normal, essential part of “GBP – Good Business Practices”.

Don’t regret failing to complete and document the described activities; “if there’s no documentation, it didn’t happen!”

TRUST BUT VERIFY

Document Activities & FindingsImplement, maintain, invest, and consider these activities part of normal business operations

Operationalize

Use the outlined approach to create one suited to your business needs

Define a Tailored ProcessEmbrace the need for a modest quality system; invest in a targeted way; advocate internally

See the Necessity

Cost-EffectiveApproach

MitigatedRisks

SmartDocumentation

TailoredProcess

CONCLUSIONS

Phase 1,2,3 Clinical Trials

FDA Meetings

Compliance & Inspections

Portfolio Management

Federal Grants(NIH, DoD)

20+ years leading drug-development programs, company operations, and strategy formulation

Program Management

Financial Modeling

FDA Submissions

eCTD

INDs

Rx

OTC

Monograph

Combination Products

Technologies

Oncology

Cardiovascular

Gastroenterology

Rheumatology

Infectious Disease

EXPERIENCE COUNTS

NDAs

BLAs

Therapeutic Areas Regulatory and Operational Experience Regulatory Class, Dosage Forms

Pain

Psychiatry

Gene Therapy

Small Molecules

Immunotherapy

JASON E MOORE, MS, MBA, RAC

How can I help you?

Phone Number:281.989.9064

E-Mail:jasonmoore715@gmail.com

Website:https://www.linkedin.com/in/jason-moore-ms-mba-rac-b0b1b69

Jason E Moore, MS, MBA, RACCincinnati, Ohio

EXPERIENCE COUNTS