CAPA: A Risk Mitigating Quality System

Corrective And Preventive Action

CAPA: A Risk Mitigating Quality System

Conducted by Gamal Amer, Ph.D.PrincipalPrincipal

Premier Compliance Services, Inc.

© All rights reserved. Do not copy without permission. 1

FDA Initiative August 2002

Pharmaceutical CGMP for the 21st Century:A Risk-based Approach

A science and risk-based approach to product quality regulation incorporating an integrated quality system approach


Mitigating Risk

FDA Progress Reports discusses three QA systems to mitigate risk:QA systems to mitigate risk:1. Process Analytical Technology (PAT)2. Corrective and Preventive Action (CAPA)3. Quality by Design (QbD)


Risk

What Is Risk?What Causes It?Risk to Whom?Risk to Whom?

Risk Manifestation?Risk Level?


Quality Events Which May Cause Qu y ve s W c y C useIncreased Risk

• A problem occurs during clinical trials (patient complains/suffers)complains/suffers)

• A deviation occurs during the manufacturingA i f i t f il hil th• A piece of equipment fails while the process is engaged.

• Analytical result is not what was expected


E t P t ti ll I iEvents Potentially Increasing Risk

No negative quality event occurred, but:g q y

• Patient complaints show a negative trend.i d if i / di d i• Operation drifting/trending towards action

limit.• Analytical data trending towards

unacceptable.


These Events Pose:

• Risk to the patient/public• Risk to the productRisk to the product• Risk to the personnel

Ri k h i• Risk to the environement• Risk to the company


What Is Risk?

The combination of the probability ofThe combination of the probability of occurrence of harm and the severity of that harm.*

*Guidance for Industry; ICH Q9 Quality Risk Management; June 2006


What Is The Risk?What Is The Risk?• In Drug Application:

– The pros and cons of the treatment• In Process Design:

– Failure to recognize source of variability and how CPP affect CQA of product

• In Process Qualification:In Process Qualification:– Failure to qualify a critical (high risk) portion of the

process.• In Manufacturing:

– Quality events occurring as the process is engaged


Some Sources of Increased Risk in Manufacturing?

• Processing Deviations and Non ConformanceA ti P i• Aseptic Processing

• Labeling Errors (Majority of drug recalls due to mislabeling)mislabeling)

• Analytical and Measuring Errors D li ith t t d• Dealing with potent compounds

• People Errors


Defining Level of RiskDefining Level of Risk

F i fFunction of:– Severity

F– Frequency– Detectability

• These three factors determine the numerical Risk Priority Number (RPN)Risk Priority Number (RPN)

• Qualitative risk (low, medium, and high)


CAPA = Corrective Action /CAPA Corrective Action / Preventive Action


Risk Within the Context ofRisk Within the Context of CAPA Systemy

• A non-conformance or deviation occurs or a potential problem is identified.p

• These pose risk.• CAPA should define the risk, its level, and means to

mitigate itmitigate it.• CAPA should then implement the actions to mitigate

the risk and track to ensure closure.M i i i ff i d did• Monitor to ensure action is effective and did not introduced new risk(s).


Non-conformance and Deviation

Non-Conformance:Failure to meet a specified requirement.p q

Deviation:Failure to follow or implement an establishedFailure to follow or implement an established requirement. Typically this term is used relevant to processes (as in a “processrelevant to processes (as in a process deviation”).


Risk Level Factors: Severity

• What are the consequences of the non-conformance qor deviation?

• How deleterious is that non-conformance or deviation to the consistent quality of the product?

• How high is the risk to the patient’s well being?


Risk Level Factors: Frequency

• What are the probability of the reoccurrence of the non-conformance or deviation?

• Were attempts made to reduce such frequency and how effective?frequency and how effective?

• Review process history to determine.


Risk Level Factors: Detectability

• What is the probability of the non-conformance or d i i b i d d?deviation being detected?

• Can the effect/result of the non-conformance or d i ti b dil d/ ?deviation be readily measured/seen?


Change Control is an ImportantChange Control is an Important Component of CAPA


Change Control: A Regulatory I iImperative

• Is a regulatory requirementIs a regulatory requirement• 211.68(b) Appropriate controls shall be exercised

over computer or related systems to assure that p ychanges....

• 211.100 (a) ....written procedures, including any ( ) p , g ychanges, shall be drafted, reviewed, and approved by the appropriate organizational units and reviewed and approved by the quality control unit.


211 160( ) h i h ifi ti• 211.160(a) change in such specifications, standards, sampling plans, test procedures, or other laboratory control mechanisms shall beother laboratory control mechanisms, shall be drafted by the appropriate organizational unit and reviewed and approved by the quality control unit.

• Guidance to Industry on Process Validation: The qualification plan for the facility and utilities should identify 1) studies.... 2)Criteria to assess outcome...It should also include the firm's

i t f th l ti f hrequirements for the evaluation of changes.


• ICH Q7-API GMP (13) A formal change control system should be established to evaluate all changes that could affect the production and control of the intermediate or API.A l f GMP l h h ld• Any proposals for GMP relevant changes should be drafted, reviewed, and approved by the appropriate organizational units and reviewed andappropriate organizational units and reviewed and approved by the quality unit(s).


What is a Change ControlWhat is a Change Control System?

It is a formal system which is designed not to prevent change but rather document and control itprevent change, but rather document and control it. Its main purpose is to ensure that a system/process/operation is always in a GMP y p p ycompliant and validated state, regardless of changes made to it. It is usually implemented using a procedure.



ICH Q9 – Quality Risk ManagementT h b d k l d d• To manage changes based on knowledge and information accumulated in pharmaceutical development and during manufacturingdevelopment and during manufacturing.

• To evaluate the impact of the changes on the availability of the final product.availability of the final product.



• To evaluate the impact on product quality of changes to facility equipment materialchanges to facility, equipment, material, manufacturing process or conducting technical transfers.

• To determine appropriate actions preceding the implementation of a change, e.g., additional testing, (re)qualification, (re)validation, communication with regulators.


The Compliance/Validation pLife Cycle

-

Compliant & Validated System

Implement ChangeChange Control SystemSystem

Modified System


Importance of Change ControlImportance of Change Control• Not to prevent change• Not to prevent change.• To control and document change.• Required by the regulations.• Identify GMP and validation implications.y p• Ascertain process remains in a state of

controlcontrol.• Must be implemented using a procedure.


Change Control procedure

Change requiredChange required

GenerateGenerate Change Request

EndGMP

Implications?

No

Yes

Implement Change Maintenance

NoRequalification? Revalidation?

Yes

Implement Change & Insure GMP

Requirements Done

Issue GMP Report

Obtain Approval

Yes

Change is Permanent

Requalify Revalidate & Issue Reports

Obtain Approvals

Change is Permanent

© All rights reserved. Do not copy without permission. 2727End

CAPA: Mitigating Risk

The degree of corrective and preventive action taken to eliminate or minimize actual or potential nonconformities must be appropriate to the magnitude of the problem pp p g pand commensurate with the risks encountered. (ICH Q9)( Q )


Risk Level and Appropriate Corrective Action

Risk Level (RPN) Low Medium HighCorrective Action

No Further Investigation , No Corrective action required

No Further Investigation (Cause Evident), Corrective action required

Further Investigation (Root Cause Analysis), Corrective y ),action required (Immediate; e.g.. Recall), Prevent Cause


What Is CAPA?


CAPA Is:• A quality based system• A quality based system• Uses Non-conformance, Deviations and/or an

Expectation of such as inputExpectation of such as input• Uses many of the quality systems in place as tools:

– Historical Quality Issues and Audit Reports– Environmental and Process Monitoring Data– Product Complaints– Equipment Service & Maintenance Records– Process and scientific Knowledge– Operating Procedures and Methodology


CAPA Uses:• Policies and proced res to in estigate• Policies and procedures to investigate

quality problems.• Policies and procedures to identify and• Policies and procedures to identify and

implement corrective and preventive actionsactions.

• A tracking mechanism to ensure investigation and proper corrective actionsinvestigation and proper corrective actions are conducted and implemented on a timely basis.


CAPA InvestigationCAPA Investigation• Investigate the cause of non-conformity or

deviation as it relates to the product, processes, and the quality system. (reactive)I ti t t ti l i k f t d• Investigate potential risk of an expected or anticipated event. (proactive)

• Depending on risk severity the investigation mayDepending on risk severity, the investigation may need to define the “Root Cause.”

• Use tools such as HAZOP, HACCP, Failure Mode , ,& Effect Analysis, Fault Tree Analysis, What If, etc.


CAPA Identification

• Identify the action needed to correct, reduce, or prevent recurrence of nonconformance of product p pand other quality problems.

• Identify the action needed to correct and preventIdentify the action needed to correct and prevent recurrence of the deviation in the process.

• Identify the action needed to prevent the potential• Identify the action needed to prevent the potential occurrence of an anticipated quality event.


Possible Corrective Actions• Design Changes*• Manufacturing Process Changes*• Removal of product from the market through

recall• Operator Training• Operator Training• Labeling changes*• Patient education• Patient education

________________________________________________________________________________* Keep in mind that making changes must be managed using change control in order to

avoid introducing additional risk.


Tracking CAPA Activities

• What to track?– The quality event and timing for initiating an investigation– Timing for completing assessment– Timing for developing action plan– Timing for implementing all necessary actions (changes,

training, document modification, etc.)– Timing for completing the necessary documentationTiming for completing the necessary documentation– Completion of the actions and closure of the deviation or

nonconformance


Tracking CAPA Activities

• How to track?– Manual TrackingManual Tracking

• Too much paper• Very cumbersome and time consuming• Limited Access

– Software Packages (Part 11 compliant)• Trackwise (MS Outlook)• Livelink (Lotus)


Post CAPA Monitoring

• Ensures actions were effective in mitigating the risk.

• Ensure actions were effective in correcting/preventive the problem.

• Ensures no additional risks were introduced due to the actions taken.

• Required as part of GMP compliance and process validation (FDA Guidance 1/2011).


Typical CAPA Overall ApproachQuality Event

Ri k

Quality Event

Identify Risk Risk Acceptance Document

History

Monitoring

Analyze Risk Risk ReductionTrack& Monitor

Complaints

Science &

Evaluate Risk A i RPN

Risk Elimination/

Communicate Review

Knowledge

Procedures, Service& Maintenance

Assign RPNRisk Assessment/ Investigate

prevention Review

Identify & l A i

Document, Track, Monitor &


Implement Actions Monitor & Communicate

System ComponentsD i ti ti d i ti ti d• Deviation reporting and investigation procedure.

• Rework Procedures.M i d hi i l D li di• Maintenance records, historical Data, quality audit results, etc.P d i t l it i• Process and environmental monitoring programs.

• Change Control Procedure.Ri k A l i P d h HAZOP• Risk Analysis Procedures such as HAZOP, HACCP, Fault Tree Analysis, etc.


CAPASteps to Be Taken


Label and Segregate Non-Label and Segregate Non-conforming Product

• Ensure nonconforming product is properly labeled (for example HOLD REJECTlabeled (for example, HOLD, REJECT, QUARANTINE).E t f i d t• Ensure suspect or non-conforming product is properly labeled and segregated (not

d) t t f th diused) to prevent further use pending disposition.


Document The Issue

• Record nonconformance on a Nonconforming Materials Report. g p

• Record Deviation on a Deviation Reporting FormForm.

• Document all studies and decisions made during the investigation of the quality eventduring the investigation of the quality event.


Segregate Material & EquipmentA h i l ( d ) i• Assure that suspect materials (non-product) is segregated and labeled.

• Assure all suspect lots batches units materials• Assure all suspect lots, batches, units, materials, etc are identified and segregated.

• Assure that the segregation (who, what, where, g g ( , , ,when, how) is documented on the nonconformance report.T d l k ll i d f h• Tag and lock all equipment and parts of the process which maybe suspect.


Evaluate• Review the event, the circumstances surrounding the event.• Document relevant details as part of the nonconformance

or deviation reportor deviation report.• Risk to quality should be linked to protecting the patient.• Use RPN to help determine need for in-depth investigation

and Corrective/Preventive Action (in other words: the effort, formality and documentation should be commensurate with the level of risk and be based on science*).

__________________________________________________________________________*Guidance for Industry; ICH Q9 Quality Risk Management; June 2006


Risk Level and Appropriate Corrective Action

Risk Level (RPN) Low Medium HighCorrective Action

Further Investigation (Root Cause Analysis), Corrective action required (Immediate; e Re ll) P e e t C ee.g.. Recall), Prevent Cause

No Further Investigation (Cause Evident), Corrective action required

No Further Investigation , NoNo Further Investigation , No Corrective action required


Take ActionM k h d i k• Make necessary changes to reduce risk or eliminate it.

• Invoke Change Control• Invoke Change Control.• Track to ensure CAPA closure in a timely fashion.• Evaluate the actions to ensure they were effectiveEvaluate the actions to ensure they were effective

in mitigating the risk as intended. • Monitor the process to ensure it has not been p

negatively affected by changes and that no additional or different risks were introduced.


Benefits of a Robust CAPA System

• Fulfills the promise of continuous improvement• Leads to better customer satisfaction and less risk

h blito the public.• Better use of resources through a structured QA

systemsystem.• Facilitate better and more informed decisions by

manufacturers.• Makes good business and financial sense.• Increasing your compliance quotient.


g y p q

Summaryy• CAPA is a regulatory requirement which makes business sense.• CAPA is a risk mitigating approach, which fulfills the promise of

continuous improvementcontinuous improvement.• Non-conformances, deviations or anticipated quality events are

input to the CAPA program.• All aspects of the CAPA program should be thoroughly• All aspects of the CAPA program should be thoroughly

documented.• Risk level assessment, as part of CAPA:

provides the means for rationalizing the scope and p g pextent of investigation and/or corrective action necessary.helps management assign resources to tasks providing the most al e and ha ing the biggest impact onthe most value and having the biggest impact on quality and customer satisfaction.

• Tracking, reviewing, and monitoring CAPA related activities is an important aspect of the program.


important aspect of the program.

CAPA: A Risk Mitigating Quality System

Health & Medicine

fault tree

corrective

corrective

change control

quality based

quality control

corrective

change control