Validation

Regarding “Validation” in the context of GMP:

Let us start with the definition.  After querying Merriam-Webster, I was able to find two meaningful extracts relevant to this blog:

1.       To support or corroborate on a sound or authoritative basis, and

2.       To confirm the validity of.

If we look to the regulations (Parts 11/211), we find a total of eight instances where a variation of the word “validate” is cited.  For this blog, we will focus on those two instances specifically referring to what we have now come to term Computer System Validation “CSV” – Part 11.10(a) and Part 211.68(b).  These regulations refer to expectations for commercial manufacturing, and we will use the concepts of FDA’s Process Validation Guidance (specifically stage 3 “Continued Process Verification” (CPV)) for this discussion.  CSV, in actuality, is a term used to describe the individual activities of software/hardware “Qualification” (e.g., IQ/OQ/PQ), in an attempt to facilitate a systematic means for compliance with these regulations.  It is assumed that once these individual software qualification actions have been performed successfully according to a pre-defined protocol, the system is “validated” and can be used in commercial manufacturing.  Decades of past regulatory action and public health tragedies including drug shortages, however, lead us to believe this is a false assumption.

Let’s go back to basics for a moment and simplify what has become (in my opinion) a large contributor to the ~62% of drug shortages attributable to “manufacturing and quality issues” =  failure to embrace the true principles of stage 3 process validation (CPV) and instead focus on individual compliance tasks within disparate department siloes all the while making unfair assumptions in high risk manufacturing areas.  We have failed in our attempt “to support or corroborate on a sound or authoritative basis” that our products are safe and effective!  Why?  Because we have only completed 50% of the job.  During inspection, the regulator will be looking for two things during an evaluation of any given process:

·       System Qualification (Hardware and Software)

·       Workflow Validation (Hardware, Software, Personnel and Documentation)

Note that the Workflow Validation simply references the System Qualification when necessary, while addressing in detail the Personnel and Documentation components.  For a detailed explanation of Workflow Validation expectations, check out Q3 of FDA’s Data Integrity Guidance.  Once we break it down into these two concepts, and finally align with regulatory guidance (e.g., CPV), we can now properly define the efforts needed at the design, operation, and monitoring stages within routine commercial manufacturing that need to be addressed with regard to both bullet points.  Old school CSV has a healthy serving of System Qualification, but zero Workflow Validation.  The inspection grade is 50% (an F). 

Folks in the CSA camp have tried to define the reduced efforts needed at the System Qualification stage via a risk-based approach, but I fear they are missing the scientific justification: a link to the Workflow Validation.  Without this link, the intended use is unknown, and therefore a risk-based approach cannot be justified.  This will be seen as an opinion by the regulator (without the link), which may be the reason CDER did not sign off on the guidance: perhaps is tries to simplify and standardize a concept that requires critical thinking and a case-by-case evaluation…? 

The two concepts are attached at the hip and fully reliant on each other to provide your scientific rationale during inspection.  Don’t be fooled here, CSA cannot be used as a means to standardize your qualification efforts via a decision-tree!  As humans we LOVE checklists, flowcharts, and really anything that make our lives easier (TNTC examples here).  I’m afraid, however, that there are no shortcuts available here: don’t fall into the trap.  We will have to use critical thinking and proceed on a “case by case basis” – to steal the working from Q9. 

I am feeling bold this evening as I fly somewhere over West Virginia: I would propose we scrap the concept of CSV altogether.  Leave it in the back storage room alongside the dot matrix printers we used to print and weigh chromatography peaks.  Looking forward to 2024, they should both exist in glass cases within your local technology museum.  I am not questioning the value of Qualification, but rather the assumptions that come with “CSV”.  Regarding these assumptions, and to provide further evidence, I see a direct conflict with two existing FDA Guidance Documents:

1)      Process Validation (2011): “The goal of the third validation stage is continual assurance that the process remains in a state of control (the validated state) during commercial manufacture.” CSV is generally a one and done activity.

2)     Data Integrity (2018): “Controls that are appropriately designed to validate a system for its intended use address software, hardware, personnel, and documentation.” CSV only addresses hardware/software.

3) 21 CFR Part 11.10(a): “Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.” CSV does not consider the intended performance (aka workflow).

I struggle to find any significant modern regulatory publication/guidance related to pharmaceutical manufacturing that aligns with CSV.  As an investigator, I was provided with countless examples of industry publications on the matter, however, as a regulator I was not interested in an opinion of what CSV should or should not entail (with the exception of the lunch breaks); there is no time for such discussion during a time sensitive inspection.  I simply used the guidance listed above to determine if the processes that were directly influencing patient safety were under a sufficient level of control according to risk management principles outlined in ICH Q9.  This is demonstrated via an evaluation of the following components of any given process: hardware, software (Qualification), personnel and documentation (SOPs/training/batch records/forms/etc.).

I understand that this is a paradigm shift, and as humans even small shifts are terrifying – but we must tackle this misunderstanding (with best efforts to be as non-invasive as possible) and re-calibrate the way we as an industry understand and implement “validation”.  The concepts of true validation as outlined by the regulators are not hard to understand, but anytime change is necessary we must see value to create motivation.  Success is determined by a combination of resources and motivation.  Resources are provided by executive management, and motivation must be self-generated by staff tasked with executing the work.  In theory, motivation should be easy for us considering the life-saving products we manufacture, but we have allowed compliance to spoil it.  Some may place this blame on the regulators, but the concepts of risk management have been around for over a decade.  Every site I visit around the world is filled to the brim with potential and motivation.  Don’t let an outdated interpretation of compliance get in the way of world class manufacturing.

Never implement significant organizational change without careful planning, which almost always should include execution of a pilot study.  The pilot is performed not only to evaluate the immediate result of the change, but equally important evaluate its effect on employee motivation and reduce the anxieties that come with significant change.  It’s a simple litmus test: did the change create an environment that will motivate staff to find purpose and meaning in labor?  If yes, let’s go!  If not, it’s back to the whiteboard.

Now back to validation…  When Workflow Validation and System Qualification come together to form our control strategy for CPV, we can achieve the following, which I have no doubt will improve motivation:

System Qualification: The least burdensome (aka risk-based) qualification approach is taken (including screen shots/etc.) based on those areas within the workflow that are of highest risk to our patients.  When a script is executed or a screen shot grabbed, it is because it matters, a confirmation is needed because our patients depend on a right first time strategy.  This lack of dilution brings purpose and meaning to the activity = motivation.

Workflow Validation: Procedures, logbooks, training, worksheets, batch records, and other control strategies are established using the least burdensome (aka risk-based) approach.  When an audit trail review is required, it is because it matters, a review is needed because our patients depend on a right first time strategy.  This lack of dilution brings purpose and meaning to the activity = motivation.

Further Reading: Paste into Google (or your preferred search engine): “FDA Warning Letter Inter and Intra Batch Variability”

Once critical thinking and motivation is allowed to flourish, and executive management are on board, now we can talk “Quality”

-          Pete