No Increase in Risk

EU Annex 11 (proposed revision) excerpt

I was preparing a presentation today on my flight east, and was re-reading the proposed Annex 11 revision for some fresh ideas.  Right away I focused on section 2.8, which by the way was also in the existing regulation but rarely discussed (in my experience).  This requirement reads easy and I imagine most folks skim through without much reflection, but meeting this regulation is not as easy as it first may appear.  In fact it can be quite difficult or impossible if you do not fully acknowledge the keyword “risk”.  Take the example of the paper to electronic batch record transition that most of us have experienced at some point.  In my experience at sites around the world, this transition is rarely executed without significant complaints from front-line employees, which includes the digitalization of GXP forms as well…  This transition should be widely celebrated and result in a significant drop in errors, but alas – it don’t. 

Here it is: If management’s idea of “risk” is not aligned with reality, actual reality and not the Truman Show reality, the transition will be a disaster.  Digital solutions are not a magical solution to error/DI prevention.  They certainly can be, but this requires serious expertise in good GXP design principles.  Simply cutting/pasting a paper record format into a digital flow without re-examining “risk” will likely cause you to be out of compliance with section 2.8. 

Why/How?  Because the interaction of the human with a machine is significantly different than with paper/pen.  Risks are different because the process is different.  Initialing a paper record may take me less than 2 seconds with little cognitive stress, but entering a username and password (e-sig) will take 10 seconds and cause significant cognitive stress, especially if I make a keystroke error!  Entering 25 e-sigs in 15 minutes will cause a near mental meltdown. 

Another example: I make an error that requires correction.  This requires 20 seconds using paper/pen, but perhaps an hour to get someone from IT to open the closed module in the eBR – unless it’s night shift… then we are really cooked.  Perhaps we figure out a way to cheat the system so we can actually get our jobs done?  Ring the Warning Letter Bell, the regulator is here; and don’t dare blame the operators!  This is management’s failure to read and comply with Annex 11!

Introduce the human condition in your understanding and management of risk – ditch FMEA along with quality metrics and focus your energies on reducing vulnerabilities in your GXP workflows from the human perspective.  The new EU GMP Chapter 4 is an excellent as a guide.  As Dr. Deming taught us a long time ago: all employees have the right to joy at work, so let’s get to work.

Pete