What are the GMP Requirements for Consultants?

 FDA warning letters, the FDA sometimes advises the employment of a consultant in order to remedy the deficiencies addressed. But what are the requirements regarding such consultants from a GMP perspective?

The FDA's CGMP guidelines provide instructions on this in 21 CFR 211.34:

"Consultants advising on the manufacture, processing, packing, or holding of drug products shall have sufficient education, training, and experience, or any combination thereof, to advise on the subject for which they are retained. Records shall be maintained stating the name, address, and qualifications of any consultants and the type of service they provide."

Fortunately, the EU GMP Guideline Part I includes almost the same requirements in chapters 2.23 and 2.24:

Consultants should have adaquate education, training and experience, or any combination thereof, to advise on the subject, for which they are retained.

Records should be maintained stating the name, adress, qualification, and type of service providide by these consultants.

So far, so good. However, in a recent warning letter, the FDA explicitly points out that even if a consultant who meets the aforementioned requirements (21 CFR 211.34) is employed, the company itself is still responsible for GMP compliance.

The warning letter particularly and explicitly mentions the executive management as being responsible for dealing with all deviations and deficiencies in order to comply with CGMP.  

Interestingly, the FDA recommends that the consultant should audit the company according to the 6-system audit system. This 6-system audit system was once intended as an inspection model for FDA inspections as described in the 2006 Quality Systems Approach to Pharmaceutical CGMP Regulations. To date, this model has not been widely adopted for FDA inspections. It is therefore all the more surprising that it is now recommended for clarification of GMP deficiencies.  

Access here

Update in ICH Q8,Q9,Q10

The ICH Secretariat announced the publication of the updated Q9(R1) Annex 1- Q8/Q9/Q10 Questions & Answers (R5) related to ICH Q9(R1) Quality Risk Management (QRM). The ICH Assembly approved the updated Annex on 30 October 2024.

The Q&As have been updated by removing outdated text and rephrasing the Q&As considered in view of the implementation of ICH Q8, Q9 and Q10, with minor additions to address minor content gaps in the document. Furthermore, minor edits have been made to improve the readability of the document.

Since reaching Step 4 and publication within the ICH regions, experiences by all parties with the implementation of the ICH Q8(R2), Q9 and Q10 Guidelines have resulted in the need for some clarification. The Questions and Answers developed by the Quality Implementation Working Group (IWG) are intended to facilitate the implementation of the Guidelines, by clarifying key issues.

Besides the core topics Pharmaceutical Development, Quality Risk Management, Pharmaceutical Quality Systems, the topic of Knowledge Management is further elaborated and how the implementation of ICH Q8, Q9, and Q10 has changed the significance and use of knowledge management.

FDA 483 in QRA n Process Validation

The topic of "risk" appears 16 times in FDA's Process Validation Guidance. Annex 15 to the EU GMP Guidance clearly states: "As part of a quality risk management system, decisions on the scope and extent of qualification and validation should be based on a justified and documented risk assessment of the facilities, equipment, utilities and processes." In their guidance, the FDA also recommends a risk-based approach to determining critical parameters. But how should inadequately validated processes be handled in retrospect? The FDA comments on this in a recent Warning Letter.

The FDA criticized Outin Futures Corp. for failing to validate the homogeneity of the API in an intermediate for its over-the-counter (OTC) drugs. Deficiencies in the cleaning validation were also criticized.

In response, Outin sent a validation protocol to the FDA to demonstrate the homogeneity of the active ingredient. A validation protocol for cleaning validation was also included in the response letter.

However, the FDA found that Outin omitted a risk analysis of the batches already distributed without adequate process validation. The specification of the acceptance criterion for cleaning validation was also insufficient. In addition, there was no cleaning method validation to demonstrate API recovery.

Further FDA requests

The FDA further requests an evaluation of each medicinal product to ensure that a scientific and data-driven program is in place to identify and control all causes of process variability in order to meet specifications and manufacturing standards. This includes the qualification of equipment, sufficient detectability of monitoring and testing systems, the quality of input materials and the reliability of each manufacturing step.

Improvements in the cleaning validation program are also required, with particular emphasis on worst case scenarios in pharmaceutical manufacturing. This applies in particular to the identification and evaluation of worst cases: 

drugs with higher toxicities

drugs with higher drug potencies

drugs of lower solubility in their cleaning solvents

drugs with characteristics that make them difficult to clean

swabbing locations for areas that are most difficult to clean

maximum hold times before cleaning

In addition, the FDA requires:

An overview of the updated operating procedures that ensure an appropriate cleaning process verification and validation program are in place for products, processes and equipment.

A description of the steps that still need to be implemented in the change management system before new equipment or a new product is introduced.

Conclusion: Risk analyses should not only be used prospectively before validation, but also retrospectively if processes have not been fully validated.Access FDA 483 here

European Shortages Monitoring Platform ESMP Live

The European Shortages Monitoring Platform (ESMP) has gone live with a core set of functionalities. Using this first version of the ESMP, marketing authorisation holders (MAHs) can now submit data to routinely report shortages of centrally authorised medicines. This marks the start of a transition period that will end on 2 February 2025, when the use of the platform becomes mandatory. Marketing authorisation holders can now use the platform to report shortages of centrally authorised human medicines.

The launch of the functionality for routinely reporting shortages will be followed by the release of the second version of the ESMP in February 2025 with the full scope of functionalities for MAHs and national competent authorities (NCAs). By then MAHs and NCAs will also be able to submit data on the supply, demand and availability of centrally and nationally authorised medicines during crises and preparedness actions led by EMA's Executive Steering Group on Shortages and Safety of Medicinal Products (MSSG). These preparedness actions are taken to monitor and mitigate shortages of a subset of medicines.

What happens if the CSP does not allow audits

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

Basics of Cloud Computing Technology

Regulations and Expectations of Inspectors

Customer-Supplier-Relationship

Requirements for Cloud Service Providers (CSP)

Requirements for Supplier Evaluation and Supplier Audits

Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks

If quality-related services are outsourced by the pharmaceutical company to third parties, the contractors must be assessed for their competence and suitability; this assessment must be available in writing. Such obligation also extends to service providers in the cloud area, where a summarized assessment might also have to be presented to the pharmaceutical inspector. Unfortunately, global cloud service providers (CSP) are often quite arrogant and do not accept audits, in particular, if the pharmaceutical company is small.

An alternative is a postal audit, where a detailed questionnaire is sent to the CSP hoping that it will be returned completed. Answering such a list of questions is quite complicated for the CSP and takes a lot of time, provided that precise and complete answers to the individual questions are given. Once the completed questionnaire has been received, the individual elements are evaluated in a (short) summary, where the CSP is classified (e.g. approved, approved with restrictions, not approved) by the relevant department, with the involvement of quality assurance.

Furthermore, it is sometimes possible to clarify important questions during a short assessment in a telephone conversation with the quality manager of the CSP. Then they are summarized in a memo/statement, together with other documents, allowing at least a reliable and GMP compliant classification of the provider.

If the CSP is not prepared to make any compromises, documents available on the Internet must be used. Information proving that the CSP has worked in the GMP area and provided services to other pharmaceutical companies is particularly useful. In this context, reference could be made to the Microsoft Azure GxP Guidelines (White paper, July 2020), where the most relevant quality elements are outlined on around 100 pages. Amazon Web Services (AWS) is also providing similar single documents, but unfortunately only after the contract has been signed, which is too late for the classification. In this case, too, the reviewed documents must be evaluated in summary form to enable the classification of the CSP.

Access Q&A here

Updated GDP Guide for Excipients

In October 2024, the IPEC (International Pharmaceutical Excipients Council Europe (IPEC Europe) asbl) announced on its website the new version 3 of its GDP guide 'Good Distribution Practices Guide for Pharmaceutical Excipients'. The document is currently only available in the IPEC member area. The updated guide is to be published after a period of three months (probably at the beginning of 2025). It can be assumed that this will be available as usual under the 'Resources' section in the 'Guidelines' area of the IPEC website. You can currently view a summary and table of contents of the revised guide.

The table of contents of the new version is as follows:

1 INTRODUCTION
   1.1 Purpose
   1.2 Scope 
   1.3 Principles Adopted
2 PHARMACEUTICAL GRADE EXCIPIENTS
3 GOOD DISTRIBUTION ACTIVIES FOR PHARMACEUTICAL EXCIPIENTS
Table 1 Matrix of Applicability
Table 2 Applicability for Supply Chain Activities 
   1. Quality Management
   2. Organisation and personnel
   3. Premises
   4. Procurement, warehousing and storage
   5. Equipment
   6. Documentation
   7. Repackaging and relabelling
   8. Complaints
   9. Recalls
  10. Returned Goods
  11. Handling of non-conforming materials
  12. Dispatch and Transport
  13. Contract activities
4 REFERENCES

This largely corresponds to the table of content of the previous version from 2017, although subsections 1.1-1.3 have been added.

Batch Production and Control Record discarded Unexo Lifesciences, India.

Torn batch production records were found in plastic bags on the rooftop. These included missing batch production records, which allegedly could not be found during an FDA inspection. Furthermore, duplicate, incomplete batch records with the same batch numbers and issuance dates as the batch records presented during the inspection were found among the torn records. Batch records were "retrospectively prepared" in order to present them to the inspectors.

Unfortunately, it happens again and again that pharmaceutical companies do not archive their documentation but discard it, a violation of basic GMP requirements. Occasionally this is discovered during inspections. The number of unreported cases is certainly higher. Now Unexo Lifesciences, an Indian manufacturer, has been caught by the FDA.

Access here US FDA WL