Considerations on Auditing and GxP Requirements along the Product Lifecycle

1. Regulatory Compliance

Successful approval and marketing of products is based on compliance to quality systems elements (GxP) and a good knowledge of the product as described in the regulatory filing commitments. This supports the appropriate quality and safety of the product. The processes are subject to oversight by both assessors and inspectors on behalf of the patients. An overview of the main current global, regional, and some national regulatory GxP standards and regulatory bodies is given in Table I. While all regulatory authorities write their own standards, to some extent the issues are mostly similar and comparable because patient safety is everyone's ultimate goal.

Audits and inspections are essential to evaluate capability, adequacy of production and control procedures, suitability of equipment and facilities, and effectiveness of the Quality Management System (QMS). They follow in principle the same process of evaluating a list of suppliers, scheduling, planning, performing, reporting, and providing a conformation statement. The purpose is to assure the overall state of control, evaluate compliance with GxP, and link to the registration dossier, as applicable.

Often in the past, fixed-frequency auditing or inspecting for specic supplieres had been followed. By implementing risk-based approaches, the knowledge of the state of control of every supplier should be kept as current as possible. Consequently the frequency and depth when performing an audit or inspection may vary depending on the leval of collaboration. Regulators recently publisehd a recommendation on a risk-based approach in this context (see “A recommended model for risk based inspection planning in the GMP environment,” PIC/S, PI-037-1, 01.01.2012).

2. Research and Development Activities

Research and development activities occur throughout the product lifecycle either at the early stages of research for a new active principle or at a later stage. There are no GxP requirements for the early research stage; also, other rules, regulations, and guidance apply varying from country to country. However, some elements of a quality management system implemented for this stage of the drug lifecycle encouraging good practice as work may be producing material or data for use later in the lifecycle (e.g., quality risk management, knowledge management, change control, corrective and preventive action (CAPA), and process improvement). This will assist in the creation of scientifically sound, well documented, and traceable data/records. Some countries consider to request such topics as Good Research Practices (GRP). This may include documentation requirements (including record/data retention), equipment calibration/maintenance, methods (development and some elements of validation), cleaning methodologies, technology transfer, and management of materials/reagents suitable to the size and type of the research and development facility.

It is not normally expected to have an independent audit at this stage of product development. However, it is considered of value for an organization to audit unregulated parts of its operations for adherence to internal requirements and GxP. The auditing process should be commensurate with the potential impact on later, regulated steps in the product lifecycle.

In the biological/biotechnological industry, often the research laboratories generate the initial seed/cell banks, which are a critical raw material for further production. It is essential to establish procedures to prevent contamination and cross-contamination, as this impacts negatively the rest of the manufacturing lifecycle. Based on the risk profiles, for example, for the prevention of cross-contamination, it is recommended that the cell banking laboratory be audited to the standards mutually agreed upon by stakeholders.

3. Good Laboratory Practice (GLP) (Nonclinical/Preclinical)

As a primary objective Good Laboratory Practice (GLP) are developed to ensure the generation of high quality and reliable test data related to the safety of industrial chemical substances and preparations in the framework of harmonising testing procedures for the Mutual Acceptance of Data (MAD).

Nonclinical (also known as preclinical) research and development studies include pharmacokinetic studies. At these stage not all countries require GLP (e.g., not in the EU). Once the formulation and dose has been selected in Phase I and IIa clinical studies, GLP controls then begin to be applied (i.e., for animal and in vitro studies). Drug safety has to be assessed in toxicological studies, which is governed by the GLPs, which are considered prior to first the in-human studies and during early clinical studies. The laboratory studies may include in vivo and/or in vitro experiments in which the test article (investigational medicinal product candidate) is studied in test systems. It should be recognized that the nonclinical environment GMP is not required. However, most elements of GMP could be taken into account, for example, for the manufacturing and release of the test articles used in the toxicological studies, unless the same lot is going to be used in the clinical trials with patients. This can be linked to the principles agreed by the Organisation for Economic Co-operation and Development (OECD) principles that could led to a Mutual Acceptance of Data (MAD), which states that “data generated in the testing of chemicals in an OECD member country in accordance with OECD Test Guidelines and OECD principles of Good Laboratory Practice shall be accepted in other member countries for purposes of assessment and other uses relating to the protection of man and the environment.” If analytical methods are used in these studies, then they should be proven to be fit for purpose and/or validated as appropriate. Also, although not in scope, the ICH Q2 guidelione on analytical validation may help to support activities in this direction.

Many countries have adopted GLP regulations. In applying GLP regulations, nonclinical laboratories assure compliance for their organizational processes and the conditions under which nonclinical studies are planned, conducted, monitored, documented, reported, and archived.

In some countries GLP regulations mandate periodic inspections of these nonclinical laboratories by the competent regulatory agency. Others (e.g., OECD countries) bar foreign inspections of nonclinical facilities. If the studies are outsourced, audits of the nonclinical laboratory by the contract giver are recommended as a risk control activity. In most countries the study director is legally responsible to assure that these studies are conducted as per the GLP regulations. This very much depends on how risk is managed for the different audit types (e.g., frequency of audits), which is not further discussed in this article. In such a risk-based approach, a company or an inspectorate might accept the information gained by audits performed under a company's quality system and take previous experience into account. Industry could also make use of the results of inspections to update the knowledge of the contractor, as applicable, and this can provide a rational for the confidence expressed in that company.

4. Good Clinical Practice (GCP) (Clinical; Patient & Study)

Clinical trials are defined as “any investigation in human subjects intended to discover or verify the clinical, pharmacological and/or other pharmacodynamics effects of an investigational product(s), and/or to identify any adverse reactions to an investigational product(s), and/or to study absorption, distribution, metabolism, and excretion of an investigational product(s) with the objective of ascertaining its safety and/or efficacy” (ICH E6(R1)). The terms “clinical trial” and “clinical study” are often used as synonyms. However, sometimes they are used as interventional trial versus an observational study; see the U.S. Food and Drug Administration (FDA) homepage: http://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/UCM172001.pdf).

The laws, regulations, and guidance governing these trials are described by GCP (Table I). These requirements define the standards for the design, conduct, performance, monitoring, auditing, recording, analysis, and reporting of clinical trials or studies that provides assurance that the data and reported results are credible and accurate, and that the safety, rights, integrity, and confidentiality of trial subjects are protected. Investigational product and samples for end point/safety assays should be distributed, tracked, and reconciled per the principles of good distribution practice (GDP). The purpose of good pharmacovigilance practice (GPvP) is to monitor the investigational product's safety.

One example among others is the handling and control of each investigational medicinal product (IMP), which is important in order to ensure that the drug is manufactured and controlled under the appropriate conditions. The investigational product should be manufactured and stored following GMP requirements (see, e.g., EU legislation 2001/20/EC, ICH Q7, ICH Q10). Investigational product and samples for end point/safety assay should be distributed, tracked, and reconciled per the principles of GDP. This is linked to GPvP to monitor the investigational product's safety and efficacy over the lifecycle. Consideration could be given to, for example, protocol compliance (following stopping rule, dose modification rule, eligibility, protocol deviation, etc.) and handling and interpretation of trial data.

In summary, it is the responsibility of the clinical trial sponsor {industry, investigators, or institution (any non-profit foundations like academic institutes, e.g., investigator-initiated trials or government)} to ensure—using the internal quality system of the sponsor functions—that their contract research organizations, testing laboratories, and monitors adhere to and comply with the applicable regulations, guidelines, and professional standards of conduct. The audits in these circumstances are used to verify this and identify areas for CAPA.

5. Good Pharmacovigilance Practice (GPvP)

Pharmacovigilance is the science of researching, collecting, monitoring, assessing, and evaluating information beside others from patients and healthcare providers regarding adverse effects of medications, biologic products, herbalism, and traditional medicines. The purpose of GPvP is to monitor the investigational product's safety and efficacy by identifying new information about hazards and risks associated with medicines, with an ultimate goal of preventing harm to patients. The concept of GPvP refers to guidelines for the conduct of pharmacovigilance activities.

Also, pharmacovigilance is not applicable to non-clinical studies in early development (non-human in vivo and in vitro studies); safety information gathered is under strict guidance of GLPs. For these studies, it is the responsibility of the study director and the sponsor to evaluate safety information relating to the investigational medicinal product. Once safety with drug exposure in animals is proven, clinical trials in humans (Phases I–III—pre marketing authorization) can commence. From there, GPvP applies. These in-human clinical trials are conducted under GCPs.

Pharmacovigilance applies throughout the lifecycle from Phase I until product discontinuation (see also Table I). In commercial manufacturing, this can be included in the elements of the QMS, as applicable, to link to GPvP (e.g., complaint management, issue/recall management). Many national competent authorities do inspect against the GPvPs and practices established by the product owner either as a part of the GCP or GMP inspections, or as a stand-alone inspection, if applicable. The typical areas in scope during such audits, if part of the company's practice of a pharmacovigilance function, can include presence of adequate procedures (and compliance to those procedures); documentation of qualified staff; documented roles and responsibilities; validated computerized systems for managing safety data; secure storage and archiving of documents; etc. Note: GCP and pharmacovigilance inspectors are often not the same person. They often follow a different risk-based approach—see, for example, information provided by the UK authority (MHRA, www.MHRA.gov.uk). In order to fulfil GPvP requirements to be accomplished by the Marketing Authorisation Holders, additional aspects have to be taking into account such as individual case reports, signal detection, risk benefit, reporting, and Periodic Safety Update Reports (PSUR) to assess ongoing safety.

6. Good Manufacturing Practice (GMP)

GMPs apply to the manufacturing activities and are controlled by quality assurance activities. This ensures that active pharmaceutical ingredients (drug substance), excipients, if applicable, and drug (medicinal) products are consistently manufactured, controlled, and distributed to the standards appropriate for their intended use. This is an area where regulations by regulatory authorities and harmonized approaches (e.g., ICH, PIC/S, WHO) exist (see also Table I). This is in line with opportunities for inspectorates to implement risk-based concepts, for example, mutual recognition agreements (MRA), confidentiality agreement, memorandum of understanding (MoU), and harmonized training with the PIC/S. This enables discussions, collaboration, and the building of trust among regulators for the purpose of having appropriate oversight of a company's compliance.

In the end it might result in harmonization of the inspection approaches. Industry experts often jointly with experts from regulatory authorities support harmonized interpretations and “best practices” facilitated by individual membership associations (e.g., PDA). Inspections are often performed in intervals as defined in the statutory requirements of the individual regulatory body.

Additional regulations on GMP for excipients come more and more into focus. Most excipients used in pharmaceutical manufacturing are purchased and used with no or little further processing or purification. Impurities present in the excipient will thus be carried over to the finished drug product. The scope of audits is depending on the level of oversight (e.g., acceptance of Certificate of Analysis) as defined in the quality part of the contract. These contracts can be established between the manufacturing or marketing authorization holder and the supplier and/or wholesaler or broker. It has to be kept in mind that equipment and operational techniques at the excipient manufacturer's facilities and processes typically are to the chemical, fine chemical, commodities, or food industry standards and therefore follow different regulations and certification schemes. That said, specific elements of the GMPs should be applied to excipient manufacture, for example, the facility and equipment design should protect the material from contamination, production equipment and controls must be calibrated, inter-product cleaning procedures must be proven to be effective, and test methods must be qualified. The basic concepts of GMP auditing can be used (e.g., on the basis of the guideline provided by the International Pharmaceutical Excipient Council (IPEC), as most excipients are not required to be manufactured under GMP controls and conditions).

While medical device requirements are not completely different from the ones for drug products, in some countries an International Organization for Standardization (ISO) certification is mandatory instead of a regulatory inspection.

7. Good Distribution Practice (GDP)

Good Distribution Practice (GDP) describes the controlled and appropriate storage and distribution of drug products for human use. Storage and distribution should not adversely affect the drug product, should maintain the quality attributes of the drug product, and thereby assure a safe drug product for the end user (patient). GDPs are so far considered part of the GMPs. Note: In some countries these requirements are under the jurisdiction of other regulatory organizations. In the EU GDP guidelines are separate from GMP Guidelines and in some Member States the GDP and GMP Inspectorates are also in separate organizations. GDP is applied by companies in their pharmaceutical supply chain.

Agents, brokers, traders, distributors, repackers, and relabellers have to follow GMP/GDP requirements (see ICHQ7, Chapter 17), if the operations are performed and have to provide the name of the original manufacturer and batch number to customer and regulatory authorities according to the local procedures. Anyhow, the Manufactruing Authorisation Holder is responsible that GDPs are followed accordingly.

Global distribution and criminal activities related to counterfeiting have put an emphasis on distribution practices. There is specific new legislation on this in the EU. The GDPs typically include elements for distribution standards (e.g., on storage facilities, cold chain, transportation vehicles, transport containers, security of transportation, wholesale, and retail), repacking and relabeling, recalls, and salvage of product, imports/exports, and contracts. Even though some countries' regulatory authorities conduct inspections specific to the GDPs, in general it remains the manufacturer's (product owner's) responsibility to ensure adherence to the GDPs. However, trade in product does occur between wholesalers in, and between, a number of countries.

8. Conclusion

While considerable progress has been and continues to be made in terms of harmonization of requirement and interpretations, industry is still far ahead of the regulators in terms of globalization. This in itself complicates the operations for industry in assuring that it remains in compliance with all market needs when individual companies frequently supply 120-plus markets.

The purpose of inspections performed by regulators and audits performed by industry is to confirm adequacy of operations and control procedures, suitability of equipment and facilities, and effectiveness of the quality management system to manufacture product of an appropriate quality and to assure its consistent availability. This is achieved by assuring compliance with and adherence to the regulations. Notably, inspections and audits include the added evaluation of submitted data and link to regulatory dossier (filing) as applicable. Currently there are initiatives on the way to implement risk-based approaches, for example, to the frequency and length of filing or inspections and to combine efforts and exchange information among regulatory authorities.

The GxP requirements over the lifecycle are continually evolving based on, for example, societal, economic, trade, developments, recent events (e.g., heparin case), and expectations on continual improvement. As a consequence, industry and regulators recently increased their activities on implementing and improving quality systems on both sides, the inspectorates (e.g., facilitated by PIC/S) and in industry. Beside inspection oversight, compliance is facilitated by internal audit approaches at different levels (e.g., by headquarter departments, sites, or with support of external consultants).

In addition, regulators and industry are on the way to proceed towards harmonization and recognition of inspections and the potential for acceptance of other agency's inspection findings performed by other inspectorates (e.g., for agencies: MRA, MoU, or countries of reference concepts). Also, on the industry side, there are initiatives to share audit reports (e.g., coordinated by associations like Rx360, the Active Pharmaceutical Ingredients Committee (APIC) and Verband Forschender Arzneimittelhersteller (VFA), Germany).

Last, but not least, driven by global supply chains and violations of laws and ethics (e.g., by counterfeiting), nowadays companies are required to keep and enhance the requirements and control mechanism as best as possible (e.g., coding, serialisation, aggregation). Initial steps have been recognized. A harmonization of applicable requirements all over the world will ensure an appropriate compliance standard in research, development, manufacturing, and distribution of drug products.