Understanding the Implications of the 2008 GMP Update and Why the Laboratory Is Not Included

U.S. Good Manufacturing Practice (GMP) regulations (21 CFR 211) have existed unchanged since 1978 (1), although in 1996 a draft amendment was issued but was never implemented (2). However, on December 4, 2007, the FDA issued a Direct Final Rule for 21 CFR 211 that will make changes to GMP for finished pharmaceuticals (3) effective in April 2008 as well as withdrawing the draft 1996 amendment (4). This is the first phase in changes that will be made by the FDA to update and harmonize the GMP regulations over the next few years. In this "Focus on Quality" column, we will look at the overall GMP changes and then ask the following question: Why has the laboratory not been included in the proposed changes?

The usual method of rulemaking by the FDA is a consultative process that involves requesting feedback from industry and other interested parties. For instance, 21 CFR 11 had the following stages before the final regulation became law:

R.D. McDowall

Advance Notice of Proposed Rulemaking (1992)

Draft rule 21 CFR 11 (1994)

Final rule 21 CFR 11 and preamble (1997)

During the first two stages, there was consultation and discussion with the industry.

However, with the GMP regulations, the FDA has jumped straight to a Direct Final Rule, omitting the notice and draft stage because "FDA expects there will be no significant adverse comments on these amendments" (3). The changes will become effective on April 17, 2008, but the FDA is accepting comments up to February 19, 2008, that must be made using the Federal eRulemaking Portal because the Agency will no longer accept e-mail comments.

What Will Change with 21 CFR 211?

In summary, the changes are updating the U.S. GMP regulations and harmonizing them with the U.S. and international regulations and guidance, which cover the following topics:

Plumbing in §211.48(a) to remove the adherence to U.S. EPA regulations.

Aseptic Processing §211.113(b) to bring the regulation into line with existing guidance and industry practice.

Asbestos Filters §211.72.

Verification by a Second Individual is being updated for the following sections of GMP: §211.68, §211.101, §211.103, §211.182, and §211.188, but interestingly, not §211.194, which covers laboratory results.

While many of you will be waiting with bated breath to learn of the wonders of plumbing, asbestos filters, and aseptic processing, I am afraid to disappoint you, but I won't be covering these worthy topics. Instead I'll focus on the major impact for spectroscopy and computerized system design, which is the last subject: verification by a second individual when a computerized system is used to automate a process or workflow.

Verification by a Second Individual

The four eyes approach is a cornerstone of any quality system (GMP, GLP, or ISO 17025): a first person performs a task and a second person checks it. In U.S. GMP, there are several references to a second person check or verification, such as container weights (§211.101), yield calculations (§211.103), cleaning logs (§211.182), batch records (§211.188), and QC analysis for the laboratory (§211.194). These are all key stages of the pharmaceutical manufacturing process, and the checks are to ensure that mistakes can be caught and resolved early in the process. Although this is primarily to ensure patient safety and compliance with the regulations, it is also good business sense as well because you don't want to commit resources to a process that might fail. However, the GMP regulations were written before the extensive computerization we have now within our laboratories and organizations.

The 1978 GMP regulations included §211.68 (1), which outlines the controls required for automated equipment — including computerized systems — that can be used during the manufacture and testing of a drug product. In essence, the controls were to ensure the following requirements:

• Proper system performance

• Changes to records are made only by authorized personnel

• System inputs and outputs are checked for accuracy

• Data are backed up in an appropriate way to protect the electronic records generated.

The key question that has been asked of the FDA several times since the publication of the regulation concerns the need for a second (additional) person check when an automated operation is being performed. Remember that the computerized system will have been validated for the tasks that are automated (validation for intended purpose); therefore, two individuals to check results generated automatically would appear excessive. One of the folk laws of science is Cahn's Axiom: if all else fails — read the instructions. In the preamble to the 1978 GMP regulations, there is a comment by the FDA that if the second individual verifies that the automated system is working properly (1), the regulation can be interpreted to mean the first individual is replaced by a computerized system or other automated process, and only one person is necessary to verify that the automated system is functioning as intended.

The FDA states that they still receive questions periodically about the performance and checking requirements required by §211.101(c) and (d), §211.103, §211.182, and §211.188(b)(11) when the operations are performed by automated equipment, and they are revising these sections (3). "The revisions will clarify our longstanding interpretation and policy that verification by a second individual might not be necessary when automatic equipment is used under §211.68. Rather, in these situations, only one person is needed to verify that the automated equipment is functioning adequately. In cases in which there is an operator for the automated equipment, the verifying individual might be, but is not required to be, the operator." In addition, the FDA is also amending §211.68 to provide a consistent clarification of this point.

Key Changes for Computerized Systems

So focusing on the main changes associated with the second person verification concerning computerized systems, we'll discuss the topic. In the quoted sections, I have added the bold text to highlight the areas pertinent to the discussion.

A new paragraph will be added to §211.68 on automatic, mechanical, and electronic equipment to read as follows:

(c) Such automated equipment used for performance of operations addressed by §211.101(c) or (d), 211.103, 211.182, or 211.188(b)(11) can satisfy the requirements included in those sections for the performance of an operation by one person and checking by another person if such equipment is used in conformity with this section and one person verifies that the operations addressed in those sections are performed accurately by such equipment.

So we now have an explicit statement that only one person is required to check that the system is working. This is good and sensible and should avoid overly enthusiastic interpretation of the regulations.

Section 211.188 covering batch production and control records is amended by revising paragraph (b)(11) to read as follows:

(b) (11) Identification of the persons performing and directly supervising or checking each significant step in the operation, or if a significant step in the operation is performed by automated equipment under §211.68, the identification of the person checking the significant step performed by the automated equipment.

So we can reduce the checks to a single person who must ensure that the validated system is operating acceptably. Another good and sensible approach, but one that could have been avoided if people actually read the preamble to the 1978 GMP regulations! The problem is that many organizations have read the regulations when they were issued and have a rigid institutional interpretation that has gone unchallenged since then.

When the Part 11 Scope and Application guidance was issued in 2003 (5), it should have forced firms to go back to read and reinterpret their understanding of the predicate rules to which they work. Most did not, unfortunately.

Manufacturing Versus Laboratory Computer Systems

Hang on a second, we have been discussing computerized systems, but where is there mention of the analytical laboratory? The changes only appear to impact manufacturing systems (§211.188), and the laboratory is not mentioned (§211.194). So the obvious question is, why the omission?

This debate focuses on the nature of the electronic records that are generated by the two types of computer systems used in manufacturing and the spectroscopy laboratory. Typically, readings of temperature and pressure generated by manufacturing equipment such as an autoclave are not changeable, and therefore you can apply the just the second person check.

Compare this with a spectrometry system software package: at least one spectrum is generated from each sample as well as any standards used in the analysis process, plus the processing parameters and audit trail entries used to generate the final results. There is the need for the spectra to be interpreted by the analyst responsible for the analysis, and this interpretation must be confirmed by a second person. Now we have reportable results. It is because of the interpretation needed for the data that the FDA has not included the laboratory in the revision of GMP, and therefore we still need a second person verification of analytical results.

However, let us pose the following question: Could there be a situation in which just a second person verification would be applied in the laboratory? Yes, I believe there is. This is the situation in which all the test results for a sample are collated to generate an analytical report or a certificate of analysis in a LIMS. All the individual tests have been checked using the four eyes approach, and an authorized user could generate the report or certificate of analysis and then electronically sign it without the need for a second person review.

Electronic Signature Versus Identification of Action

Also, there is explicit statement in the update of the GMP regulations about the identification of persons who are responsible for checking data or key stages of a process. Note the word identification. There is no mention of signing of records in this document (3). Computerized system designers for the laboratory please take note — we want easy-to-use and compliant systems, not ones that require you to input your password every time there is a write to the disk.

The discussion in this direct final rule document also implicitly revisits the debate about whether we need witnesses for computer validation testing. There is no mention of witness in the document, only verification or double-checking. Therefore, in my opinion, there is no need for a witness.

Summary

In this column, I have presented the main changes to the GMP regulations that will be made for the first time in 30 years. I have focused on the need for second person verification when computerized systems are used and why the FDA is changing the regulation for the manufacturing systems but not the laboratory. Also, I discussed the need for identification of actions versus signing of records.

R.D. McDowall is principal of McDowall Consulting and director of R.D. McDowall Limited, and "Questions of Quality" column editor for LCGC Europe. Address correspondence to him at 73 Murray Avenue, Bromley, Kent, BR1 3DJ, UK.

References

(1) Current Good Manufacturing Practice For Finished Pharmaceuticals, Federal Register 43 (1978) 45013–45087.

(2) GMP Federal Register 61 (1996) 20103.

(3) Direct Final Rule: Amendment to the Current Good Manufacturing Practice Regulations for Finished Pharmaceuticals, Federal Register, 72 (2007) 68064–68070.

(4) Current Good Manufacturing Practice; Amendment of Certain Requirements For Finished Pharmaceuticals; Withdrawal, Federal Register 72 (2007) 68111-68113.

(5) FDA Guidance for Industry, Part 11 Scope and Application, 2003.