"Your firm failed to exercise appropriate controls over computer or related systems to assure that only authorized personnel institute changes in master production and control records, or other records (21 CFR 211.68(a))"
In general, comprehensive control of CGMP data is expected to ensure that all changes, deletions and additions of information to electronic records are authorized and documented.
Observations
The laboratory equipment used to generate analytical data for the release of finished medicinal products has no access protection and no further controls.
There are no adequate controls to prevent data deletion and record alteration
There is no definition of unique user names and passwords
Laboratory staff have administrator rights that allow uncontrolled access to delete or modify HPLC files
There is no way to track individuals who have deleted or modified data generated by the IT system
There are no adequate backup copies of the data generated by the laboratory equipment
Response from the company
The company's responses to this observation were inadequate. Why?
The company stated that it had found a supplier for the management of equipment data and that the HPLC management system was being assessed by this supplier. They had a process in place to address data integrity issues. The FDA was not satisfied with these statements. No interim measures were taken to protect patients and ensure drug quality, e.g.
Notification of customers
Recall of products
Conducting additional tests
Inclusion of batches in the stability program
Increased monitoring of complaints
What does the FDA expect when responding to this Warning Letter?
A complete assessment of the documentation systems used throughout the manufacturing and laboratory operations to determine where documentation procedures are inadequate
A detailed CAPA plan that comprehensively corrects the company's documentation practices to ensure that the company maintains assignable, legible, complete, original, accurate and timely records throughout the operation
A comprehensive, independent assessment and CAPA plan for the security and integrity of the computer system
Interim controls should also be described and details provided of when the procedures for the CAPAs will be implemented
No comments:
Post a Comment