Conducting a Gap Analysis on your Change Control

Conducting a Gap Analysis on your Change Conducting a Gap Analysis on your Change Control SystemControl System

Presented By Miguel Montalvo, President, Expert Validation Consulting, Inc.

2

Standards, Regulations, Guidelines Standards, Regulations, Guidelines related to Change Control Management related to Change Control Management

SystemsSystems

21 CFR 21121 CFR 820FDA Guideline – ICH Q7 GMPs for APIsFDA Guidelines on Pharma. Development (ICH Q8) and PATFDA Guideline - Quality Risk Management (ICH Q9)FDA Guideline – QS Approach to Drug GMPs

3

21 CFR 211 Change Control 21 CFR 211 Change Control ReferencesReferences

21 CFR 211 FDA considers that the requirement for Change Control is implied across the regulations:

Archiving of obsolete procedures is necessaryEvery function and operation requiring documentation should function under a formal change control procedure

21 CFR 211.100:Procedures, including any changes, are drafted and approved by the organizational units and reviewed and approved by the quality control unit

21 CFR 211.160:Scientifically sound specifications, standards, sampling plans, test procedures and other laboratory control procedures and any changesshould be drafted by the appropriate organization and approved by Q.C.

21 CFR 211. 180(e) – Annual review to determine whether “changes in specification or manufacturing procedures are needed”

4

Change ControlChange Control

Statutory and GMP References:Section 506A(b) FD&C Act, “Manufacturing Changes”, post marketing report – requires validation of the effects of a change on the identity, strength, quality, purity and potency

FDA Compliance Program Guidance Manual 7346.843: Post Approval Audit Inspection:

“… A centralized approach could also be used for auditing records of the QC Unit’s s change control operations. For those changes identified for products of inspectional interest, the records and supplements related to the changes would be audited for compliance with the requirements…”

5

21 CFR 820 QSR (Device 21 CFR 820 QSR (Device GMPsGMPs) ) Requirements for Change Requirements for Change

ControlControl820.30 - Design Changes - Establish and maintain procedures for the identification, documentation, validation, or where appropriate,verification, review, and approval of design changes before their implementation.820.40 – Document Changes:

Changes to documents shall be reviewed and approved by individuals in the same function or organization that performed the originalreview and approval, unless otherwise specified.Approved changes shall be communicated to appropriate personnel in a timely manner.Maintain records of changes to documents.Change records shall include a description of the change, identification of the affected documents, the signatures of the approving individuals, the approval date, and the date the change becomes effective.

6

21 CFR 820 QSR (Device 21 CFR 820 QSR (Device GMPsGMPs) ) Requirements for Change Requirements for Change

ControlControlProduction and Process Controls:

Establish and maintain procedures for changes to a specification, method, process, or procedure.Changes shall be verified or validated before implementation and the activities shall be documented.Changes shall be approved in accordance with document control requirements.

Process Validation:When changes or process deviations occur, the process shall be reviewed and evaluated. Revalidation should be performed where appropriate. These activities shall be documented.

7

ICH Q7 for APIICH Q7 for API’’ss

“… a formal change control system should be established to evaluate all changes that may affect the production and control of the intermediate or API…”“… the potential impact of the proposed change on the quality of the intermediate should be evaluated. A classification procedure may help in determining the level of testing, validation and documentation needed to justify changes to a validated process. Changes may be classified (e.g. minor or major) depending on the nature and extent of changes, and the effects these changes may impart on the process …”

8

ICH Q8 Guideline on ICH Q8 Guideline on Pharmaceutical DevelopmentPharmaceutical Development

“The aim of pharmaceutical development is to design a quality product and its manufacturing process to consistently deliver the intended performance of the product. The information and knowledge gained from pharmaceutical development studies and manufacturing experience provide scientific understanding to support the establishment of the design space*, specifications, and manufacturing controls.”“Changes in formulation and manufacturing processes during development and lifecycle management should be looked upon as opportunities to gain additional knowledge and further support establishment of the design space.”

9

Q8 Concept on Design SpaceQ8 Concept on Design Space

The design space is the established range of process parameters that has been demonstrated to provide assurance of quality. In some cases design space can also be applicable to formulation attributes. Working within the design space is not generally considered as a change of the approved ranges for process parameters and formulation attributes. Movement out of the design space is considered to be a change and would normally initiate a regulatory post approval change process.

10

FDA on Design SpaceFDA on Design Space

The multidimensional combination and interaction of input variables (e.g., material attributes) and process parameters that have been demonstrated to provide assurance of quality

Traditional one dimensional process range doesn’t meet Q8 definition and will not lead to “regulatory flexibility”

Working within the design space is not considered as a changeMovement out of the design space is considered to be a change and would normally initiate a regulatory post-approval change processDesign space is proposed by the applicant and is subject to regulatory assessment and approval

11

Quality Risk Management Quality Risk Management (ICH(ICH--Q9) relation to Change Q9) relation to Change

ControlControl

Use Risk analysis to determine requirements after change implementationUse Impact (Direct, Indirect) concepts to determine impact and requirements/testsMake that evaluation part of the Change Control procedure and documentation – rationale for decisionEvaluation that changes did not create new hazards

12

Quality Systems Approach to Quality Systems Approach to Pharmaceutical Pharmaceutical GMPGMP’’ss ––

Guidance from FDA (Sept. 2006)Guidance from FDA (Sept. 2006)

Implementation of Quality Systems, when coupled with manufacturing process and product knowledge, can handle changes without a need for regulatory submissions - changes in facility, equipment or even processesQuality by Design Concept Application of risk analysisChange Control must be controlled and documented:

“managing change to prevent unintended consequences”Warranted when data analysis reveals areas for improvementEffect evaluated after implementation

“According to CGMP regulations, the QCU has the responsibility ofreviewing and approving all initial design criteria and procedures pertaining to facilities and equipment and any subsequent changes (see 211.22(c))…”

If design issues are found during process experience, the entire design (facility/equipment/process/laboratory controls) has to be evaluated

13

Personnel Training under the Personnel Training under the Quality SystemsQuality Systems

Personnel should also understand the effect of their activities on the product and the customer. Quality personnel should be selected based on their scientific and technical understanding, product knowledge, process knowledge and/or risk assessment abilities to appropriately execute certain quality functions Typical quality systems training should address the policies, processes, procedures, and written instructions related to operational activities, the product/service, the quality system, and the desired work culture (e.g., team building, communication, change, behavior).

14

Quality Systems Quality Systems -- ElementsElements

Management Responsibilities:

CommitmentStructure – roles and responsibilitiesEnvironment –CommunicationFormal process for change requestsContinuous Improvement

Resources:Training/Qualifications

Manufacturing Operations – changes to improve controls over sources of variability

“a manufacturer is empowered to make changes subject to the regulations based on the variability of materials used in manufacturing and process improvements resulting from knowledge gained during a product’s lifecycle.”

Evaluation Activities (Management):Change Control Management EffectivenessRevise procedures as neededResulting action plans may involve changes

15

ICH Q10 QS ElementsICH Q10 QS Elements

Knowledge Management and Risk Management as Enablers of QS – change management will be dependent on the knowledge management and adequate process/product knowledgeQuality Manual – Policy, Scope, Structure of QS and Management ResponsibilitiesManagement Responsibility as “Ultimate Responsible for QS” –Commitment, Quality Policy, Planning, Resources, Communication and Review Continual Improvement of Process Performance and Product Quality – Monitoring, CAPA, Change Management and Management ReviewContinual Improvement of the Pharmaceutical Quality System

16

What is Change Control? What is Change Control?

Change Control is the implementation of, and adherence to, a formal process that documents any change to a (specified/qualified/validated/approved) piece of equipment, system, process or document that can affect the identity, strength, quality or purity of a drug product.

17

Why is Change Control Why is Change Control Important?Important?

COMMON SENSEChange Control is a key component of the Quality System of an organization (systems based approach to FDA inspections and QS Guideline)

“managing change to prevent unintended consequences”Encouraging change towards continual improvement

Need to evaluate effect of changes starting at the specifications level for the Direct and Indirect Impact SystemsChanges must be documented for future reference even during Design and earlier Qualification stages

18

When Should Change When Should Change Control Be Implemented?Control Be Implemented?

Need a policy for Change Control Management which will include applications at different points Define application for new and/or modifications to facilities, utilities, equipment and systemsFormal QA Change Control procedures MUST be implemented upon completion of the Qualification / ValidationImplement change control for all Direct and Indirect Impact systems –level of detail/depth of impact determination will be commensurate with the impact level of the system/processOnce the system / equipment is identified and specified (approved documents), it falls under some level of change control

19

Change Control Levels early in Change Control Levels early in Projects Projects –– Impact Determinations and Impact Determinations and

Application of RiskApplication of Risk

Direct Impact Systems – more documentation required and a formal risk assessment done for changesIndirect Impact Systems – basic procedure and form to be completed. No need for formal risk assessment as part of the change impact analysis.Responsibilities must be defined for each project phaseUser functions to be involved – Quality (at a defined level)

20

Change Control Policy/Procedure Change Control Policy/Procedure Requirements with respect to Requirements with respect to

Specifications, Design, Construction, Specifications, Design, Construction, Commissioning and QualificationCommissioning and Qualification

Purpose/ObjectiveScopeResponsibilitiesProcedure:

Describe Change and ImpactApprovalImplementationVerification

Forms for each stage in the process or a generic formSummary Report at project completion – including changes to specifications

21

Applications of a formal QA Applications of a formal QA Change Control SystemChange Control System

DocumentsSOPs, Qualification/Validation documents, batch production records, regulatory filings

FacilitiesUtilities, systems (WFI, HVAC, etc.), environmental conditions

EquipmentControl systems, mechanical systems, computer systems (software), instrument calibration, maintenance

ProcessesCleaning (not SOPs – changes in products/formulas), analytical methods, manufacturing, packaging

22

Developing a formal Developing a formal QA Change Control SOPQA Change Control SOP

SOPs Should Be:ClearConciseDesigned to prevent problemsSufficiently detailed to ensure everyone performs his/her part in a reasonably consistent manner

Different SOPs for types of changes – documents versus equipment/systems?

23


ComponentsResponsibilities

How initiated?Who reviews?Who approves?Who trains?Who owns?

24


Components (cont.)

What is a change?Like for Like Definition – is it applied consistently?Planned vs. UnplannedNormal vs. EmergencyTemporary Changes – careful!

How to complete forms?Information to be recorded

25


Components (cont.)

How to track changes? Unique identifierTrack from start to finishConstant monitoring of open changesFiling / archiving system

26


Components (cont.)

How to define system?Required information

How to document change?Detailed description of changeLevel and degree of testing requiredIdentify any special procedures that need to be followed during change implementation

27


Components (cont.)

Is there additional impact?DocumentationEquipmentSystems

What is the closure mechanism?Qualification/Validation summary reportFinal approval of change control form

28


Components (cont.)

What is the appropriate notification system?Timely and appropriateChange implementation successfulFinal approvals / Release for production

Required QA/QC pre- and post-approvalImpact assessment

29


Less is BetterOne corporate policy vs. one for each site/department

May need specific site procedures for each type of change

Assures consistencyDocument control is less burdensomePresent a clear message of upper management commitment

30

““NormalNormal”” SituationsSituations

Initiate Change Control FormDocument equip/system affectedIdentify needed changeSign/date form

Route proposed change for review and approval

31

““NormalNormal”” Situations Situations (cont.)(cont.)

Determine whether change requires revalidationSubstantiated “like for like” changes may not require revalidation

Once approved, implement changeTest changed system as required

32

““NormalNormal”” Situations Situations (cont.)(cont.)

Generate final reportChange control formQualification/Validation summary report

Route for final approvalArchive change control documentation

33

Emergency SituationsEmergency Situations

Preparation Prevents ProblemsFollow guidelines established in SOP

Fill in as much information as possibleIdentify problem / change requiredsign/date formNotify as many approvers as possibleGain verbal approvalContinue with Change / testingDocument all stepsQUARANTINE system

34

Emergency SituationsEmergency Situations

Emergency changes must be closed appropriately

Within specified time limit provided by procedureProvide IdentifierFormal routing procedureContinued trackingProper approval, closure and notification through appropriate channels

35

Implement the ProgramImplement the Program

Have Qualification / Validation baseline in placeProvide comprehensive training - level of comprehension assessment detail will be commensurate with level of controlProvide Effective Date for SOPs

36

How to Determine the level How to Determine the level of competency assessment required of competency assessment required

for training on change control?for training on change control?

Based on Product Quality Impact and other risk considerations:Is the operation/process affected by change purely manual?Are there detection capabilities to verify effectiveness of process/procedure execution?Who Reviews/Approves the change before implementation? Is there a “physical” barrier or control impeding change implementation?

Need to include the decisions on formal training plans

37

Changes in DocumentationChanges in Documentation

Categorization of SOPs – different levels of changesOperational SOPs – critical versus non-critical steps/operationsMaintenance – critical pieces of equipment/systemsCleaning – Manual versus automatedQuality Functions – basic responsibilities

Specifications:Critical quality AttributesRaw materials/Components – critical impact on process

38

Changes in Process Changes in Process –– Batch Batch ManufacturingManufacturing

Controls commensurate with criticality –parameters and stepsDesign space – in or outRegulatory submittal

39

Change Control Change Control -- EquipmentEquipment

Weaker system – level of control is personnel dependentAdequate and Effective –training and full-commitment are keys to the programPre and post approval of changes by pertinent functionsApply process appropriately for each type of change – definitions are critical

Impact of Change determined –adequate personnel to evaluate Documentation of results and modified documents and drawings included in packageQuality review Change does not require re-qualification - evaluation of change impact will determine need for it or any additional validation test

40

Definitions Definitions –– How to Verify How to Verify their Applicationtheir Application

Like for Like versus Change:Verify Work Orders for replacements, repairs Definitions clear in procedure – interview related personnel to verify interpretation

Planned versus Un-Planned Changes:Verify forms for compliance with procedure –approvals by pertinent functions, timing, completion

Training evaluation – if previous areas show gaps

41

Changes on Software Changes on Software ––Upgrades or UpdatesUpgrades or Updates

Specific (per system or control type) procedure to handle those changesProcedure/Forms to address frequent types of changes in consistent manner

42

Maintaining the ProgramMaintaining the Program

Provide reinforcement training to address deficiencies in the correct use of the change control systemProvide separate Procedures for the conduct of annual review of all system changes to determine if the system should be subjected to a full or modified revalidation

43

Maintaining the Program Maintaining the Program (cont.)(cont.)

Annual QA/QC ReviewProduction Problems / FailuresProcess ChangesAssess impact on product qualityIdentify otherwise undetected changesDetermine when revalidation is necessary

When changes affecting the process are not controlled, the process may no longer be truly valid

Gap Analysis ProcessGap Analysis Process

45

Gap Analysis DefinitionGap Analysis Definition

The assessment of differences or discrepancies between a set of standards (regulations/guidelines) and the current procedures in place to determine the criticality of such and theactions required for remediation (Risk Based decisions)

Evaluation of a specific program or process to determine how it compares to a pre-defined set of objectives, goals, or standards.Defining the specific objectives or expectations to be met is the most difficult part of the GAP Analysis. Required or Recommended?

Gap Analysis is usually conducted in order to determine the steps needed to bring a system into compliance with the applicable regulations/guidelines/policies

Then, What is it?Then, What is it?

The GAP Analysis is simply a comparison of the current system, its supporting

documentation, and the people/resources qualifications/training against the defined

requirements.

47


Identify standards (Quality Systems Guides/Regs. Or internal policies) and familiarize with requirements:

Change Control Management Policy/ProceduresProvide training on conducting a Gap Analysis and the specific requirements to be verified – define responsibilitiesAssess current practices against standardsIdentify needs for remediation plans (immediate and long term action plans) – based on criticality/riskImplement remediation plans

48

Gap Analysis TeamGap Analysis Team

Gap Analysis Team Selection – qualified members and lead personDevelop Checklist – provide reference material to team members (regulatory and industry standards, local policies and procedures)Discuss adequate Documentation - record what was reviewed, what was seen, who was talked to, observations made, etc Discuss procedure for documentation of observations/gaps, handling of response and communication of results to management

Define priorities and criticality levels for gaps

49


General Things to Assess for each defined “Requirement”Do the Procedures, Policies, Forms and Templates for the system/program meet the defined requirements per the standard? (establish)Have the requirements been met in actual practices? Documentation shows that the procedure is being executed as written (implement)Do employees understand the program, expectations, etc? Are they trained? Are resources necessary to support the program appropriate (support)

50

How to Conduct the Gap How to Conduct the Gap AnalysisAnalysis

Conduct an opening meeting with areas to be verified/assessed and the gap analysis team

Discuss the process, times, deliverablesList the areas, processes to be assessed based on the selected priorities Discuss and document the categorization strategy for the observations and remediation plans Ensure people will be available when neededEnsure that documentation will be available

Conduct a Wrap-Up meeting at the end of the audit

51

GAP Analysis GAP Analysis ““DOsDOs”” and and ““DONDON’’TSTS””

The gap analyst: Do prepare. Know the objectives and scopeDo be objective, but thoroughDo get opinions and ideas from the employees in the area effectedDon't go beyond the scopeDon't be judgmentalDon't focus on listing errors or defects, but determine why the errors or defects occurred

Employees in the area being analyzed:

Do communicate problems or quality issues that you know about to the analyst, so they can be recorded and correctedDo provide open and honest answersDo share ideas for improvementsDon't be defensiveDon't place blame

52

Focus of review Focus of review

Change Control Procedures:AdequateCompliantEffectivePersonnel is committed to perform as describedReviewed/Updated

Training:EffectiveComprehension Assessment ToolProperly documented

Execution:Adequate DocumentationHandling of Deviations/ExceptionsRequired Reviews/Approvals

53

Classification of Observations Classification of Observations gathered during the assessmentgathered during the assessment

Critical:The procedure or program is considered inadequate – lacks basic elements or requirementsThe gap could place the product quality on risk of being non-conforming

Major:The procedure needs revisions to make it compliant but the gap will not have a significant effect on product quality or the effectiveness of the overall system

Minor:Documentation has to be correctedProcedure must be modified without a critical effect on the systems/process or product quality

54

Example OutcomesExample Outcomes

Typical Observations:Lack of Standards, Processes, Procedures or those are not applied at allFailure to comply with Standards, Regulations, guidance documents, Processes, Procedures – not being executed as writtenShortfalls in documentation and recordsLack or inadequate reviews/impact assessment/approvals Procedures state one way, but documentation reflects a differentactionLack of or inadequate definitions of roles and responsibilitiesDefinitions are not used consistently – changes versus like-for-like, etc.

55

Typical Areas of Concern Typical Areas of Concern --OutsourcingOutsourcing

Suppliers – changes in their process/materialsContract Manufacturers – change control management within their operation and communication to process owner (Contract giver)Contract Services providers:

LaboratoriesCalibrations

Keys to control:Agreements – key contacts/responsibilitiesInternal Quality System/Function and Adequate ProceduresResponsiveness – Communication and TrustPlanningAuditsFiling (if applicable)

56

Gap Analysis Assessment Gap Analysis Assessment Report, Remediation Plan Report, Remediation Plan

and Followand Follow--upup

The Gap Analysis team leader shall issue a report within a reasonable time after completion of the assessment The report should describe the findings in sufficient detail to assure corrective action can be accomplished by the organizationThe responsible manager investigates the cause of the problem noted as a noncompliance and proposes a remediation action to be taken (plan)Indicates the date by which the remediation will be fully implementedThe team leader reviews and approves the proposed actionReport the effectiveness of the program to managementRe-audit areas of concern or deficiencies.

57

Remediation PlansRemediation Plans

Critical gaps versus action plans for longer term resolutionsSOP non-conformances – revise as needed to comply with the standardsRevise Documentation – to reflect what the SOP requiresTraining – adequate implementation of the revisions and changes due to the remediation actions

58

ConclusionsConclusions

Change Control Management will be a critical enabler of the new Quality Systems approach to GMPs as the FDA expects the industry to manage changes internally with the application of your process/product knowledge and the objective to continuously improve your processesProcedure, Training and Documentation are the key to an effective Change Control Management System Apply a risk factor after the gap analysis/assessment to determine the need for immediate resolutions versus a long term remediation plan

59

Questions?Questions?

60

Interactive ExerciseInteractive Exercise

Develop Gap Analysis Checklists for:SOP Change Control SystemFacility/Utilities/Equipment Change Control SystemManufacturing Batch Record Change Control System

61

THANK YOU!!!THANK YOU!!!

Contact Info.: Miguel MontalvoExpert Validation Consulting, Inc.Mobile Phone +1(407) 587-6540Email: [email protected]