Is Cloud Computing Open or Closed System according to 21 CFR Part 11?

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

Basics of Cloud Computing Technology

Regulations and Expectations of Inspectors

Customer-Supplier-Relationship

Requirements for Cloud Service Providers (CSP)

Requirements for Supplier Evaluation and Supplier Audits

Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks.

Question 24: If the pharmaceutical user has data in the cloud, what type of system is it? Is this an open or closed system according to 21 CFR Part 11? - Basics of Cloud Computing Technology

This is easy to answer using the definition below, even if it is an "on-premise" application: "It is an open system". The cloud provider carries out the compliance checks. The pharmaceutical company can only introduce the corresponding controls via contracts and check them via audits. Therefore, direct control is not possible!

Definition 21 CFR Part 11 § 11.3:

(a) The definitions and interpretations of terms contained in section 201 of the act apply to those terms when used in this part.

(b) The following definitions of terms also apply to this part:

 - (4) Closed system means an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.

- (9) Open system means an environment in which system access is not controlled by persons who are responsible for the content of electronic records that are on the system.

For Latest Updates Click here

FAQ here

EDQM publishes new FAQ on System Suitability Test (SST)

The EDQM has announced the addition of a new FAQ to its existing series, addressing the system suitability test (selectivity) in chromatographic assay procedures. This update comes in response to user inquiries received via the HelpDesk.

The new FAQ specifically references the phrase, “as described in the test for related substances with the following modifications,” which appears in many monographs. The answer clarifies that in such assays, the SST is part of the analytical procedure. Consequently, "the reference solution prepared for the selectivity test, as part of the purity test, must be analysed in the assay even if this solution is not expressly mentioned under ‘ASSAY’."

In a press relase dated 17 December 2024, the EDQM writes: "This addition is expected to enhance the support to users by clarifying the SST requirements that apply to assays by chromatographic procedures when an analytical procedure similar to the related substances test is used."

Click here for Latest Updates

CMDh/EMA: Update of Appendix 1 for Nitrosamines

Latest update on 08.01.2025

The nitrosamine Q&A document 'Questions and answers for marketing authorisation holders/applicants on the CHMP Opinion for the Article 5(3) of Regulation (EC) No 726/2004 referral on nitrosamine impurities in human medicinal products' of the EMA/CMDh contains three annexes (Appendix 1-3) in the current version of July 2024. These documents are published on the EMA website and can be viewed under 'Questions and Answers'.

Appendix 1 was compiled by the 'Non-clincal Working Party (NcWP)' and the information provided there for the acceptable intakes (AIs) is based on the 'Carcinogenic Potency Categorisation Approach (CPCA)'. InDecember 2024, new substances were added to Appendix 1, which consists of a tabular list of substances, and some existing entries in the list were updated. These are marked in red in the list of Acceptable Intakes (AIs) and are clearly recognisable. These include

New

N-nitroso-anabasine

N-nitroso-anatabine

N-nitroso-desmethyl-chlorphenamine

N-nitroso-desmethyl-eletriptan

N-nitroso-desmethyl-galantamine

N-nitroso-desmethyl-rizatriptan

N-nitroso-desmethyl-zolmitriptan

N-nitroso-ivacaftor

N-nitroso-nilotinib

N-nitroso-nornicotine

N-nitroso-nor-oxycodone

Updated

N-nitroso-bupropion

N-nitroso-ketamine

Browse Here for full text 

Join here for Regular cGMP updates

Subscribe here to get regular updates 

Get Regular updates here

FDA Expectations in Qualification

There is relatively little information on FDA requirements for equipment qualification. You can find guidance in the FDA Guidance for Industry General Principles and Practices: Process Validation on 'DQ', 'IQ' and 'OQ'. However, the terms 'DQ', 'IQ' and 'OQ' are not mentioned there. A footnote refers to the ASTM standard E2500. But what does the implementation look like in practice in companies? A current Warning Letter gives some clues. 

What is it about?

An over-the-counter (OTC) drug manufacturer is criticised under 21 CFR 211.113 for finding germs in water monitoring. This water was used to manufacture OTC drugs and to clean the equipment.

Among other things, the FDA criticised the inadequate qualification of the water system. It refers to installation and functional qualifications carried out by the manufacturer in 2019, whereby data collection was only completed three years later. However, the data was not analysed. Subsequently, the company presented a PQ to the FDA, but did not check all parameters in accordance with the pharmacopoeia specifications. The company's own specifications (test for the absence of gram-negative microorganisms) were also violated as part of the PQ. This is also described by the company in the PQ report that was sent to the FDA. The company committed to set up a new validation of the water system.

This is not enough for the FDA. It emphasises the importance of a water system and demands a solid design and effective operation, maintenance and monitoring of the system. It also requires:

• A comprehensive corrective action plan for the design, control and maintenance of the water system.  
• A report on the validation of the water system. This report should also include a summary of any improvements to the system design and the monitoring and maintenance programme. 
•  The total bacteria count limits used to monitor whether the system is producing water that is suitable for the intended uses for each of the OTC products. 
• A detailed risk assessment that addresses the potential impact of the inadequately qualified water system with respect to batches of drug products currently distributed in the U.S. or within the expiration date 
• An indication of the actions that will be required in response to the risk assessment, such as customer notifications and product recalls.

Conclusion: Although the qualification levels DQ, IQ, OQ, PQ are not named in the FDA Guidance for Industry: Process Validation General Principles and Practices, they are still present in the industry. The addressee of the Warning Letter performed IQ, OQ and PQ activities. The FDA additionally required consideration of the design of a water facility. Which is equivalent to a DQ.  

What are the GMP Requirements for Consultants?

 FDA warning letters, the FDA sometimes advises the employment of a consultant in order to remedy the deficiencies addressed. But what are the requirements regarding such consultants from a GMP perspective?

The FDA's CGMP guidelines provide instructions on this in 21 CFR 211.34:

"Consultants advising on the manufacture, processing, packing, or holding of drug products shall have sufficient education, training, and experience, or any combination thereof, to advise on the subject for which they are retained. Records shall be maintained stating the name, address, and qualifications of any consultants and the type of service they provide."

Fortunately, the EU GMP Guideline Part I includes almost the same requirements in chapters 2.23 and 2.24:

Consultants should have adaquate education, training and experience, or any combination thereof, to advise on the subject, for which they are retained.

Records should be maintained stating the name, adress, qualification, and type of service providide by these consultants.

So far, so good. However, in a recent warning letter, the FDA explicitly points out that even if a consultant who meets the aforementioned requirements (21 CFR 211.34) is employed, the company itself is still responsible for GMP compliance.

The warning letter particularly and explicitly mentions the executive management as being responsible for dealing with all deviations and deficiencies in order to comply with CGMP.  

Interestingly, the FDA recommends that the consultant should audit the company according to the 6-system audit system. This 6-system audit system was once intended as an inspection model for FDA inspections as described in the 2006 Quality Systems Approach to Pharmaceutical CGMP Regulations. To date, this model has not been widely adopted for FDA inspections. It is therefore all the more surprising that it is now recommended for clarification of GMP deficiencies.  

Access here

Update in ICH Q8,Q9,Q10

The ICH Secretariat announced the publication of the updated Q9(R1) Annex 1- Q8/Q9/Q10 Questions & Answers (R5) related to ICH Q9(R1) Quality Risk Management (QRM). The ICH Assembly approved the updated Annex on 30 October 2024.

The Q&As have been updated by removing outdated text and rephrasing the Q&As considered in view of the implementation of ICH Q8, Q9 and Q10, with minor additions to address minor content gaps in the document. Furthermore, minor edits have been made to improve the readability of the document.

Since reaching Step 4 and publication within the ICH regions, experiences by all parties with the implementation of the ICH Q8(R2), Q9 and Q10 Guidelines have resulted in the need for some clarification. The Questions and Answers developed by the Quality Implementation Working Group (IWG) are intended to facilitate the implementation of the Guidelines, by clarifying key issues.

Besides the core topics Pharmaceutical Development, Quality Risk Management, Pharmaceutical Quality Systems, the topic of Knowledge Management is further elaborated and how the implementation of ICH Q8, Q9, and Q10 has changed the significance and use of knowledge management.

FDA 483 in QRA n Process Validation

The topic of "risk" appears 16 times in FDA's Process Validation Guidance. Annex 15 to the EU GMP Guidance clearly states: "As part of a quality risk management system, decisions on the scope and extent of qualification and validation should be based on a justified and documented risk assessment of the facilities, equipment, utilities and processes." In their guidance, the FDA also recommends a risk-based approach to determining critical parameters. But how should inadequately validated processes be handled in retrospect? The FDA comments on this in a recent Warning Letter.

The FDA criticized Outin Futures Corp. for failing to validate the homogeneity of the API in an intermediate for its over-the-counter (OTC) drugs. Deficiencies in the cleaning validation were also criticized.

In response, Outin sent a validation protocol to the FDA to demonstrate the homogeneity of the active ingredient. A validation protocol for cleaning validation was also included in the response letter.

However, the FDA found that Outin omitted a risk analysis of the batches already distributed without adequate process validation. The specification of the acceptance criterion for cleaning validation was also insufficient. In addition, there was no cleaning method validation to demonstrate API recovery.

Further FDA requests

The FDA further requests an evaluation of each medicinal product to ensure that a scientific and data-driven program is in place to identify and control all causes of process variability in order to meet specifications and manufacturing standards. This includes the qualification of equipment, sufficient detectability of monitoring and testing systems, the quality of input materials and the reliability of each manufacturing step.

Improvements in the cleaning validation program are also required, with particular emphasis on worst case scenarios in pharmaceutical manufacturing. This applies in particular to the identification and evaluation of worst cases: 

drugs with higher toxicities

drugs with higher drug potencies

drugs of lower solubility in their cleaning solvents

drugs with characteristics that make them difficult to clean

swabbing locations for areas that are most difficult to clean

maximum hold times before cleaning

In addition, the FDA requires:

An overview of the updated operating procedures that ensure an appropriate cleaning process verification and validation program are in place for products, processes and equipment.

A description of the steps that still need to be implemented in the change management system before new equipment or a new product is introduced.

Conclusion: Risk analyses should not only be used prospectively before validation, but also retrospectively if processes have not been fully validated.Access FDA 483 here

European Shortages Monitoring Platform ESMP Live

The European Shortages Monitoring Platform (ESMP) has gone live with a core set of functionalities. Using this first version of the ESMP, marketing authorisation holders (MAHs) can now submit data to routinely report shortages of centrally authorised medicines. This marks the start of a transition period that will end on 2 February 2025, when the use of the platform becomes mandatory. Marketing authorisation holders can now use the platform to report shortages of centrally authorised human medicines.

The launch of the functionality for routinely reporting shortages will be followed by the release of the second version of the ESMP in February 2025 with the full scope of functionalities for MAHs and national competent authorities (NCAs). By then MAHs and NCAs will also be able to submit data on the supply, demand and availability of centrally and nationally authorised medicines during crises and preparedness actions led by EMA's Executive Steering Group on Shortages and Safety of Medicinal Products (MSSG). These preparedness actions are taken to monitor and mitigate shortages of a subset of medicines.

What happens if the CSP does not allow audits

The trend in the pharmaceutical industry is also moving towards cloud computing. Financial but also organizational advantages speak for the cloud. At the same time, however, potential dangers and regulatory restrictions should also be taken into account. Nine experts from the pharmaceutical industry and regulatory authorities answer a comprehensive catalog of questions from the following GxP-relevant topics:

Basics of Cloud Computing Technology

Regulations and Expectations of Inspectors

Customer-Supplier-Relationship

Requirements for Cloud Service Providers (CSP)

Requirements for Supplier Evaluation and Supplier Audits

Requirements for Qualification / Validation

The following question is one of a series of questions that we will publish in further GMP News articles on this site in the coming weeks

If quality-related services are outsourced by the pharmaceutical company to third parties, the contractors must be assessed for their competence and suitability; this assessment must be available in writing. Such obligation also extends to service providers in the cloud area, where a summarized assessment might also have to be presented to the pharmaceutical inspector. Unfortunately, global cloud service providers (CSP) are often quite arrogant and do not accept audits, in particular, if the pharmaceutical company is small.

An alternative is a postal audit, where a detailed questionnaire is sent to the CSP hoping that it will be returned completed. Answering such a list of questions is quite complicated for the CSP and takes a lot of time, provided that precise and complete answers to the individual questions are given. Once the completed questionnaire has been received, the individual elements are evaluated in a (short) summary, where the CSP is classified (e.g. approved, approved with restrictions, not approved) by the relevant department, with the involvement of quality assurance.

Furthermore, it is sometimes possible to clarify important questions during a short assessment in a telephone conversation with the quality manager of the CSP. Then they are summarized in a memo/statement, together with other documents, allowing at least a reliable and GMP compliant classification of the provider.

If the CSP is not prepared to make any compromises, documents available on the Internet must be used. Information proving that the CSP has worked in the GMP area and provided services to other pharmaceutical companies is particularly useful. In this context, reference could be made to the Microsoft Azure GxP Guidelines (White paper, July 2020), where the most relevant quality elements are outlined on around 100 pages. Amazon Web Services (AWS) is also providing similar single documents, but unfortunately only after the contract has been signed, which is too late for the classification. In this case, too, the reviewed documents must be evaluated in summary form to enable the classification of the CSP.

Access Q&A here