Reasoning Behind the Rules
It’s no secret that we humans struggle with Rules. We desire autonomy, likely a result of some underlying survival advantage gained over countless generations. We prefer Reasoning. Tell me the “why” behind the rule, and it is much more likely that I will comply.
A good case study for this phenomenon in the GXP world is the issuance of “forms”. According to the PIC/s Guidance on Data Integrity: “The use of uncontrolled documents should be prohibited by local procedures.” Without a “unique identifier”, the form is considered uncontrolled and should not be used within a GXP environment.
One of the main problems with controlled forms is the drain on efficiency. Let’s be honest - it slows things down, when all we hear from management is “…faster”. If the risks (the “why”) of using uncontrolled forms are not fully understood on the floor, it would be no surprise to anyone when uncontrolled forms (paper or electronic) are found on any given site walk-through. Folks know they should “technically” not use these forms, but this is simply a rule without reasoning – it makes no sense and prevents me from meeting management’s goal for “faster”. I get it.
So… why is this requirement included in the PIC/s guide and why does it matter? The primary risk that cannot be adequately managed when forms are uncontrolled is orphan data. We often associate orphan data with QC testing results, for good reason, but the concept applies to each of the six-systems or scope of GXP operations. Orphan Data can be defined as “data relevant to a GXP decision that were not considered when the GXP decision was made.” There are other risks involved such as accidental transcription errors/etc., but orphan data is the alpha. This is why “Original” (first-capture) is a core ALCOA component. Tossing away original records (forms/sticky notes/personal notebooks) is not acceptable as the risk for GXP decision-making using partially compiled information cannot be controlled. No level of procedural controls will be considered acceptable risk acceptance by any regulator in 2026.
Many folks in our industry still believe that risk management is still not really a regulatory requirement – which was largely true pre-2015ish. If the regulator does not find orphan records then we can “pass” the inspection and this is evidence that our acceptance of this risk is just fine. These folks are the old-schoolers. Only what we see represents the product quality reality:
‘If the QC test results are passing and all final paperwork compiled and signed off – the product is good. If there is a product quality issue, it will manifest itself within this framework.’
For these folks, quality is simple. Pass/Fail. Dr. Deming warned us of this over-simplification decades ago, stating that this strategy will eventually lead to a collapse of the quality system. When the sources of variability (aka risks) are not understood:
Random root causes are assigned and burdensome CAPAs implemented, eventually leading to 100-page SOPs and unintelligible batch records
Employees take shortcuts in an attempt to meet management efficiency expectations (e.g., uncontrolled forms)
It is painful for me as a consultant (and consumer) to see this old-school mindset still hanging around our industry. The transformation starts with management understanding the reasoning behind the rules, which only comes with grasping the concepts outlined in ICH Q9. If management does not understand the reasoning behind the rules, under no circumstances will the floor follow the rules. The “why” behind any GXP rule must be viewed from a risk perspective, which often have no objective metrics to measure, and no immediately visible benefits to the business. This is why embracing this organizational strategy is difficult for management, who are also under pressure... The benefits of a QRM organizational strategy can only be measured over the long-term (perhaps year over year at best) – not quarter over quarter. Are you working within an organization who is focused on the reasoning behind the rules? If yes, congratulations! If not, it might be time to start exploring new opportunities – during your interview ask management to explain their “knowledge management” (KM) program (see ICH Q10). If you receive a clear answer and view some representative examples of the KM program in action – that’s the place for you!
Pete
