How To Reduce Data Integrity Risk

1 How to Guide How To Reduce Data Integrity Risk Bob McDowall, PhD Data integrity problems continue to plague the pharmaceutical industry – especially in regulated laboratories – with violations still being identified by health authority inspectors over 18 years after the Able Laboratories fraud case.1 This is despite guidance issued by various regulators2,3,4,5,6 and industry bodies7,8,9,10,11 that include advice for ensuring that data and records are protected and comply with applicable regulations. The aim of this guide is to provide practical advice on how to reduce data integrity risk and ensure GxP compliance. We will learn from those in the industry who are expert at failing to comply with data integrity regulations and who have been on the receiving end of an FDA inspection. We will use citations from a recent and extensive 483 observation issued to a single organization in December 2022.12 We will present and analyze selected citations to identify the reasons for failure. We will then suggest ways to prevent reoccurrence or, for readers who are more proactive, prevent the issue from arising in their own laboratories. Some remediation suggestions will involve laboratory automation. Before senior management has collective heart failure in response to this proposal, know that automation will be accompanied by improvements in business benefits that will more than offset the cost, including validation. The approaches outlined here could also be useful for non-regulated laboratories to improve efficiency. Manual colony counting Observation 1 item 2 in the citation targeted the practice of manual colony counting on microbiological plates. This process is slow and error prone and inevitably generates regulatory interest. The relevant section of the citation reads: Laboratory records do not include complete data derived from all tests … to assure compliance with established specifications and standards. For example, 1. Environmental monitoring samples were not counted accurately. On November 22, 2022, review of plates from QC1 that had been counted by one analyst and checked by a second analyst found the reported result to be less that the number of colonies on the plate. …. 2. Microbiology personnel reported the laboratory practice was to count colonies that merge together, with similar morphology, as one colony. Review of plates showed this practice resulted in under counting of colonies. 12 HOW TO REDUCE DATA INTEGRITY RISK 2 How to Guide Under reporting of colonies means that potential out of specification (OOS) results are hidden and failing batches are passed or rooms that are meant to be clean become potential sources for microbiological contamination. After manual counting and a second-person review, the plates are thrown away after with no record other than what is written down in the analytical batch record. This provides no objective record for an inspector or an auditor to assess if the recorded value is correct. The inspectors were able to review current plate counting on a specific day before the plates were discarded. What the citation does not state is by how much the counts were under reported or if it was deliberate. However, counting merged colonies is unscientific and deliberate falsification. A solution is to use an automated colony counter that also produces a photographic record for each plate counted. Simple manually fed colony counters can read and photograph one plate at a time. Depending on the number of plates to be read, an automated plate feeder in combination with a bar code reader to positively identify plates would be a better option as it removes labor from the process. Instrument purchase and validation costs will be offset with the gains in productivity. Lack of instrument printouts An apocryphal good manufacturing practice (GMP) saying is that if it’s not written, it’s a rumor, which can be modified for this example, to if it’s not printed, it’s a rumor, as seen in the next 483 citation from observation 1 item 3: b) pH printouts and recording of description associated with the <redacted> and <redacted> samples from <redacted> could not be provided. 12 This is gross incompetence indicating a lack of basic GMP training and a total failure of the pharmaceutical quality system. Systematic failures here were: 1. The analyst failed to document their work and failed to print the pH values obtained for an instrument check and sample analysis. 2. A failure of design in the analytical batch record, which should have prompted the analyst to document these results. 3. The second-person reviewer failed to identify the lack of documented evidence. 4. Training of the performer and reviewer has failed totally. 5. Procedures were not followed or not created in the first place. 6. Quality oversight is conspicuous by its absence. If this is the situation for pH measurement, what other data chasms exist in this laboratory, especially for more complex analyses? I’m not convinced that retraining analysts and reviewers would work and therefore automation is a pre-requisite to solve the problem. Long-term remediation requires an informatics solution to automate and enforce working practices and ensure that data are collected from any interfaced instruments. The analyst would not be able to proceed with the analysis unless the instrument measurement was captured by the application. A solution should not require an analyst to press a SEND button on the instrument, as this allows them to select a “correct” result and all that is gained is electronic data falsification. Automate the whole process. HOW TO REDUCE DATA INTEGRITY RISK 3 How to Guide Paper records would also be eliminated by taking this approach, which would speed the analysis and review but also enable verifiable quality oversight. Uncontrolled manual chromatographic peak integration In chromatography, peak integration is a critical process requiring control of manual integration parameters due to multiple instances of falsification found during inspections since 2005.1 This is an area of great regulatory interest. Inspection of chromatograms and peak integration revealed inconsistencies that led to observation 2, item 1: There is no procedure describing the use of manually entered integration events, including baseline points, tailing sensitivity and peak slice for processing chromatography data. …. The reviewers only review the final chromatogram and do not review the processed chromatogram to ensure that the manually entered integration events are justified. Procedure SE/BQC/00165 Interpretation of Chromatograms requires manual integration be documented clearly stating the reason the manual integration was performed and the initials of the section head for approval. But when analysts manually enter integration events to force the software to integrate in a specific way, there is no similar documented justification and approval process ... For example (this is one of several observations that has been selected for discussion here): ... Additionally, the 6-month accelerated time point for the same lot <redacted> was integrated manually by adding a fronting sensitivity and a tailing sensitivity factor to the peak for impurity <redacted> but not for the standard of the same impurity. This reduced the area of the impurity compared and gave a result of <redacted>% compared to a limit of <redacted>%. When the fronting and tailing sensitivity factors are removed to ensure integration of the impurity compared with the standard, the reportable result changes to <redacted>%, a value that would have required an investigation. 12 First and foremost, there needs to be a procedure for integration of chromatographic peaks that is applicable to all laboratory staff. Changes made by an analyst must be justified. The journey from first to last processing must be traceable and complete to ensure data integrity. While there is a procedure, it was not followed. The major problem with the laboratory work is a failure to be scientifically sound as required by 21 CFR 211.160(b): … the establishment of scientifically sound and appropriate specifications, standards, sampling plans, and test procedures….13 Chromatography is a comparative and not an absolute analytical technique, therefore standards and samples must be integrated the same way. As the inspectors found, treating samples and standards differently has hidden an out-of-specification result and avoided an investigation. This is data falsification. We have moved on from test injections in the early days of data integrity violations to subtle changes in integration that may be difficult for an auditor or inspector to identify unless they take sufficient time to look in detail at manual peak integration. Resolution may be found by using technical controls to limit manual integration for main assays within a chromatography data system. However, there is a problem with impurity analysis as we may be very close to limits of quantification and manual integration may be the only way of measuring peaks. Training is essential along with effective review and quality oversight, coupled with management leadership about what are acceptable and unacceptable practices. However, there is much doubt if this company can achieve this. HOW TO REDUCE DATA INTEGRITY RISK 4 How to Guide Instrument logbooks are critical for data integrity Instrument maintenance and use logbooks are mandatory under both US and EU GMP regulations13,14 and are the unsung heroes of data integrity. Logbooks provide corroborating evidence of activities performed with instrumentation and are also used to correlate activities in the controlling computerized system including the audit trail entries with printouts from the system. If the system is electronic or there are only printouts from an instrument, the role of the logbook remains the same. The 483 observation 3 item 1(a) is quoted at some length for you to understand that instrument logs must be completed and analysts must be trained to do this every time with no exceptions. Reviewers also must be trained to ensure that entries are complete and consistent. As for QA and Management they are conspicuous by their absence except when it comes to making excuses. There were no weight-specific entries in your LIMS Instrument Usage Logbook for the time recorded in any of the balance printouts. Your Associate Executive Vice-President of Corporate Quality and Compliance and Manager of QC stated that the weighing activities recorded on the Instrument Usage Log is not a true representation of samples weight with start and end time for each weighing activities for a specific lot of a product. Further, there is no consistency among QC employees in term of recording information in LIMS logbook pertaining to a total number of lots tested. Some QC employees may enter this information whereas others may not, leaving no traceability for the exact number of lots tested and their start and end time of analysis. This issue is applicable to all analytical instrument in your QC laboratory …. For example, the time stamp on each of the balance printout and <redacted> spectrum did not match with your LIMS Instrument Usage Log record for samples weighed and analyzed. There follows a list of time differences, torn balance printouts, suspicious balance weights between “real” and torn printouts. 12 To have an associate executive vice-president of corporate quality and compliance state to an FDA inspector that only some analysts complete logbook entries implies that the individual knows of the problem. The individual is in a senior management role with the power to do something but has done nothing about it. The main problem is that instrument logbooks are still paper and must be completed manually. A suggested fix involves incorporating automatic instrument logs, like audit trails, into instrument data systems but software suppliers only respond to market forces. Have you got a GMP shredder? I leave the worst citation to the last as Observation 3, item 1 has the following citation: The responsibilities and procedures applicable to the quality control unit are not fully followed. As we shall see this is a vast understatement. Specifically, there is a cascade of failure in your Quality Unit’s lack of oversight on the control and management of GMP documents that are critical in ensuring the drug products manufactured and tested at your site are safe and effective. Summarizing the observation: QC, Production and Engineering employees destroying GMP documents by tearing it into pieces and disposed in scrap areas. Additionally, we found a truck full of transparent plastic bags containing shredded documents and black plastic bags containing document torn randomly into pieces….12 HOW TO REDUCE DATA INTEGRITY RISK 5 How to Guide This is industrial-scale destruction and falsification of records for which there are no excuses. The 483 obervation identifies several torn records in detail as well as attempts to hide destroyed evidence and lying to the inspectors. My resolution for this violation is very simple. Fire all employees and raze the facilities to the ground. Summary There is an apocryphal phrase never assume malice when stupidity will suffice. However, the citations in this 483 Form provide ample evidence of both malice and stupidity.12 This conclusion arises from evaluating the systematic problems with the pharmaceutical quality system, lack of record keeping, inconsistent documents, inadequate review in the lab coupled with abysmal quality and management oversight highlighted in the 483 observations. Many of the observations discussed suggest incompetence, and we have highlighted how automation can be used to remediate these processes. However, peak integration manipulation, manual colony counting, hiding destroyed records, lying to inspectors and the evidence of a truck full of shredded and torn GMP records being driven off-site shows that malice in the form of industrial scale falsification is abundantly present. Learn from this company to avoid data integrity citations. Sponsored by References 1. United States Food and Drug Administration. Able Laboratories Form 483 Observations. Silver Spring, MD: United States Food and Drug Administration. 2005. Available from: https://www.fda.gov/media/70711/download 2. Medicines and Healthcare products Regulatory Agency. MHRA GMP Data Integrity Definitions and Guidance for Industry 2nd Edition. London: Medicines and Healthcare products Regulatory Agency. 2015. Available from: https://assets.publishing. service.gov.uk/government/uploads/system/uploads/attachment_data/file/697053/Data_integrity_definitions_and_guidance_ v2_Withdrawn.pdf 3. Medicines and Healthcare products Regulatory Agency. MHRA GXP Data Integrity Guidance and Definitions. London: Medicines and Healthcare products Regulatory Agency. 2015. Available from: https://www.gov.uk/government/publications/ guidance-on-gxp-data-integrity 4. World Health Organisation. WHO Technical Report Series No.996 Annex 5 Guidance on Good Data and Records Management Practices. Geneva: World Health Organisation. 2016. Available from: https://www.who.int/publications/m/item/trs-966---annex-5-who-good-data-and-record-management-practices 5. United States Food and Drug Administration. FDA Guidance for Industry Data Integrity and Compliance With Drug CGMP Questions and Answers. United States Food and Drug Administration. Silver Spring, MD: United States Food and Drug Administration. 2018. Available from: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers 6. Pharmaceutical Inspection Convention / Pharmaceutical Inspection Cooperation Scheme. PIC/S PI-041 Good Practices for Data Management and Integrity in Regulated GMP / GDP Environments Draft. Geneva: Pharmaceutical Inspection Convention / Pharmaceutical Inspection Cooperation Scheme. 2021. Available from: https://picscheme.org/docview/4234 7. International Society for Pharmaceutical Engineering. GAMP Guide Records and Data integrity. Tampa, FL: International Society for Pharmaceutical Engineering. 2017. Available from: https://ispe.org/publications/guidance-documents/gamp-records-pharmaceutical-data-integrity 8. International Society for Pharmaceutical Engineering. GAMP Good Practice Guide: Data Integrity - Key Concepts. Tampa, FL: International Society for Pharmaceutical Engineering. 2018. Available from: https://ispe.org/publications/guidance-documents/gamp-good-practice-guide-date-integrity-key-concepts HOW TO REDUCE DATA INTEGRITY RISK 6 How to Guide 9. International Society for Pharmaceutical Engineering. GAMP Good Practice Guide: Data Integrity by Design. Tampa, FL: International Society for Pharmaceutical Engineering. 2020. Available from: https://ispe.org/publications/guidance-documents/gamp-rdi-good-practice-guide-data-integrity-design 10. Parenteral Drug Association (PDA). Technical Report 80: Data Integrity Management System for Pharmaceutical Laboratories. Bethesda, MD:Parenteral Drug Association (PDA). 2018. Available from: https://www.pda.org/bookstore/product-detail/4542-tr-80-data-integrity-management 11. Active Pharmaceutical Ingredients Committee. Practical risk-based guide for managing data integrity, version 1. Brussels: Active Pharmaceutical Ingredients Committee.2019. Available from: https://apic.cefic.org/pub/Data_Integrity_Best_Practices_Guide_for_API_FINAL_March-2019.pdf 12. United States Food and Drug Administration. Intas Pharmaceuticals Limited Form 483 Observations. Silver Spring, MD: United States Food and Drug Administration. 2022 Available from: https://www.fda.gov/media/164602/download 13. United States Food and Drug Administration. 21 CFR 211 - Current Good Manufacturing Practice for Finished Pharmaceuticals. Silver Spring, MD. United States Food and Drug Administration. 1978. Available from: https://www.ecfr.gov/current/ title-21/chapter-I/subchapter-C/part-211 14. European Commission. EudraLex - Volume 4 Good Manufacturing Practice (GMP) Guidelines, Chapter 4 Documentation. Brussels: European Commission. 2011. Available from: https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en