Regulatory Compliance – Who, Where, What, Why and When!
Authors: Philip G. Clegg, Pharmalink Consulting, UK and Mike Picchioni, Pharmalink
Consulting, UK.
com·pli·ance1
Pronunciation: k&m-'plI-&ns
Function: noun
1 : an act or process of complying with a demand or recommendation
2 : observance of official requirements
Regulatory compliance or compliance of manufacturing activities with the chemistry,
manufacturing and controls detail contained in an approved marketing authorization is
one of the current areas of industry and regulator interest.
What does the legal framework within the European Union have to say on this topic?
Well, Directive 2001/83/EC as amended, states:
within Article 20;
Member States shall take all appropriate measures to ensure that:
(a) the competent authorities verify that manufacturers and importers of medicinal
products coming from third countries are able to carry out manufacture in
compliance with the particulars supplied pursuant to Article 8(3)(d), and/or carry
out controls according to the methods described in the particulars accompanying
the application in accordance with Article 8(3)(h)
and within Article 23;
After an authorisation has been issued…..…The authorisation holder shall forthwith
supply to the competent authority any new information which might entail the
amendment of the particulars or documents referred to in Articles 8(3),………
and within Article 51;
1. Member States shall take all appropriate measures to ensure that the qualified
person……..,is responsible,……..for securing:
(a) in the case of medicinal products manufactured within the Member States concerned,
that each batch of medicinal products has been manufactured and checked in compliance
with the laws in force in that Member State and in accordance with the requirements of
the marketing authorisation;
(b) in the case of medicinal products coming from third countries, irrespective of whether
the product has been manufactured in the Community, that each production batch has
1. American Psychological Association (APA):
compliance. (n.d.). Merriam-Webster's Dictionary of Law. Retrieved March 10, 2009, from Dictionary.com website:
http://dictionary.reference.com/browse/compliance
undergone in a Member State a full qualitative analysis, a quantitative analysis of at least
all the active substances and all the other tests or checks necessary to ensure the quality
of medicinal products in accordance with the requirements of the marketing
authorisation.
What does this mean in non-euro babble?
Simply, it means that the manufacture of medicinal products either inside or outside the
EU must be done according to the details supplied in the CMC section (CTD, Module 3
or equivalent) of the approved dossier and that the Qualified Person will be held
responsible if it is not.
Of course the same principles apply to the USA and other markets and Mutual
Recognition Agreements can be added to the mix.
So, if you have a product which is not manufactured, packed, tested or as stable as
described in the information you have supplied to the relevant national authority what are
the possible consequences if this non-compliance is identified by said national authority
as the result of for example, a cGMP inspection?
In practice this can depend on several factors.
1. The quantity and level of non-compliance.
2. The country concerned.
3. Existing knowledge of compliance status within the Company.
The consequences of being found out of compliance can range from having to rectify the
differences under the scrutiny of the (local) national authority to fines, withdrawal of the
MA or the suspension of product distribution on a National or regional level
.
There have been examples where the results of a local EU authority inspection have been
reported by that local authority to all other EU Member States resulting in punitive action
being taken on an EU wide basis.
So why would we not be compliant?
The majority of organisations that find a level of regulatory non-compliance within their
manufacturing organisation will likely identify the principal cause to be a lack of
robustness in their change control system stretching from the manufacturing quality
organisation to the regulatory affairs functions at manufacturing, corporate and country
based local regulatory functions.
It is also common that diversified responsibilities for post approval regulatory affairs
leads to a greater level of non-compliance in comparison to a mainly centralised
regulatory function.
If the change control system is not robust or the responsibilities for post approval
regulatory affairs are not clear it is possible to overlook changes made at manufacturing
level, at multiple sites to multiple formulations registered across multiple countries and
therefore for manufacturing details and registered details to diverge.
Given the possible consequences of non compliance and the damage to the reputation of
the whole company it is best to prevent non compliance issues developing in the first
place by strengthening the change control system if this is found lacking.
What should I do now?
If you have acquired a portfolio of products you suspect may have compliance issues or if
you suspect your own portfolio may be compromised, maybe by a lack of robustness in
your change control system then you must start a compliance program to identify and
rectify compliance issues immediately before a national authority identifies them for you.
The consequences of an external body identifying non compliance within an organisation
and the damage to the company’s reputation will be mitigated if your company is already
engaged in a thorough and well structured compliance programme.
First things first.
Before starting the compliance program it is always best to define the scope of the
program and assign enough resources to it. The compliance program can be as small as
preparing a single MA in a single country for renewal. At the other end of the spectrum
the scope can include a section of the company portfolio or even the full portfolio in
multiple countries.
It is very important to define the scope and have sufficient resources allocated to the
compliance programme as once the programme is started it must be completed.
It is debatable which is the worst case, identifying a compliance problem and not taking
remedial action or, not having identified an existing compliance issue in the first place.
It is also important to identify clearly the decision makers and agree and define the roles
and responsibilities from the beginning as the compliance programme will likely require
difficult decisions to be made.
Any project of this nature must include the Quality organisation and specifically the (EU)
Qualified Persons (or equivalent) responsible for the release to market of the products in
scope.
Within an organisation the measurement of compliance can give rise to conflicts of
interest as the results can be seen as a measure of a functions performance. The way to
avoid this and ensure impartial comparisons of manufacture versus registered details is to
use external resource providers for the critical parts of the project.
Once a compliance programme is started it must be completed as a compliance program
stopped before its natural completion can outwardly convey a lack of commitment to
legal obligations.
So how compliant are you and what do you do when you know the answer?
A compliance programme can be divided into four steps.
1.
2.
3.
4.
Assemble the registered details for each MA.
Assemble the manufacturing related details for each MA.
Compare 1. with 2. and note any differences.
Asses the differences and prepare an action plan to rectify the non compliance
issues and restore compliance with the MA.
The first two steps require a close collaboration between the project team and the local
market based regulatory representatives (if multiple countries are involved) and the
manufacturing sites to collect all necessary information. Of course, if you have a
centralised post approval regulatory function then the details for each market can all be
found in one place.
It is only relatively recently that all EU markets accepted submissions in English.
Therefore, when considering budgets and timescales it is worth remembering that some
older products may have registered details documented in local language and not English.
Also, the manufacturing plant may be situated in mainland Europe or elsewhere in which
case manufacturing documentation may only be available in local language.
Therefore time and money should be allocated for possible document translations and
travel expenses for face to face meetings.
Remember, a compliance analysis can only be as good as the information it is based
upon.
As pairs of registered details and manufacturing details become available the comparison
work to identify any non compliance issues can begin.
A key point to note is the age of the documentation being used for any analysis. If you
collect all the documents first and then start the analysis some information could be
several months or even years old depending on the size of the product portfolio, before
they are analysed Therefore, as far as practicable always plan to collect information from
both sources at the same time for a single product and start the difference analysis as soon
as possible after collection.
Difference Analysis
This step involves a thorough comparison review of the registered documentation against
the current documented product manufacturing process.
It is important as part of the project scope design to decide and agree what a ‘difference’
is. On one level you may decide that different wording between MAA and manufacturing
documentation, with the same meaning, constitutes a recordable difference. Alternatively
you may want to only identify and record differences which fall within the EU definition
of Type 1 or Type 2 variations.
For the above reasons it is important that you resource any analysis teams with the right
level of experience. In the latter example people that know their high shear mixer from
their HPLC pump and their variation regulations is vital to assess accurately what will
require addressing through variations and what does not.
According to the regulations compliance issues must be rectified as soon as they are
discovered but in some cases this may not be possible due to the need to generate new
data and it may be necessary to prioritise the remediation activities on a licence by
licence basis.
The most important consideration of course is patient safety. It should be noted that any
differences observed which could impact patient safety must be communicated
immediately to senior members of the project team including Quality Assurance (the
concerned Qualified Person for the EU) for evaluation and resolution. It is common for
this team to include a member of the clinical team for complex products.
For example, differences between approved and applied expiry periods could impact
patient safety.
This team should always be cognisant of the Companies product recall procedure and any
requirements in this regard of the National agency that issued the product licence in
question.
Therefore it is paramount that you have people involved at the comparison stage (3 and
4) that understand the implications of any differences that are identified.
An obvious example would be the above difference between the approved shelf life and
that applied to the product during manufacture. One less straight forward example may be
a slight difference in formulation, method of manufacture or analytical methodology.
Any of these examples could be a safety issue or not depending on the dosage form,
clinical indication or available historical data and a critical analysis of each difference is
needed.
Once the difference analysis for a product is complete and documented it is time to
review the findings and decide;
1. Is there a real difference between the MA and manufacturing practice.
2. Does it require immediate action and/or new data to be generated.
It has been known for previously unidentified documentation to be found at this stage and
for differences to become invalid.
For fast resolution and agreement on future strategy it is recommended that the review
team is resourced from the analysis team, manufacturing Quality Assurance and
Regulatory Affairs. If the product is manufactured by a third party it can also be
advantageous to have someone present that can approve additional spend for information
generation e.g. new stability data.
When the comparison and review steps are finished it is time to prepare an action plan to
rectify the non compliance issues and restore compliance with the MA.
Remediation action plan
Any regulatory action required is usually planned and executed by the post approval
regulatory affairs function or for larger projects it is usual for additional temporary
resource to be brought in to enable completion of this phase in a timely fashion.
There may be a lot of new data required or copies of existing documentation and so
priorities should always be assigned so that the various manufacturing sites can deliver
items according to plan.
Consideration should also be given to the impact on the various regulatory authorities
concerned. The remediation plans may require the submission of several hundred or more
variation applications (or CBE’s) which could impact the processing time for other
Company initiatives and will certainly make an impression on the national authorities.
On a more positive note the remediation step of a compliance program across several
National MA’s in several different countries is usually a good opportunity to standardise
the manufacturing practices and the dossier content across the countries involved.
This process of standardisation will help with future change control as well as
simplifying the supply chain.
Staying compliant.
As stated earlier the majority of organisations that find a level of regulatory noncompliance within their manufacturing organisation will identify the principal cause to be
a lack of robustness in their change control system.
If you do not wish to have to repeat the whole compliance investigation again in five
years time it is imperative where a significant level of non-compliance is identified that
any shortcomings in change control systems are tackled and rectified immediately.
It is vital that process change strategy is agreed at senior Company level and that the
implementation team are given the necessary authority to drive the programme to
completion. After all, the solution may be a complete change in the structure and location
of your post approval regulatory affairs functions.