The 2008 Update of US GMP — Why Not Include the Laboratory

US Good Manufacturing Practice (GMP) regulations (21 CFR 211) have existed unchanged since 1978,¹ although in 1996 a draft amendment was issued but was never implemented.² However, on 4 December 2007, the FDA issued a Direct Final Rule for 21 CFR 211 that will make changes to GMP for finished pharmaceuticals,³ as well as withdrawing the draft 1996 amendment.⁴ This is the first phase in changes that will be made by the FDA to update and harmonize the GMP regulations over the next few years.

What is a Direct Final Rule?

The usual way for rulemaking by the FDA is a consultative process that involves requesting feedback from industry and other interested parties. For example, 21 CFR 11 had the following stages before the final regulation became law:

• Advance Notice of Proposed Rulemaking (1992).

• Draft rule 21 CFR 11 (1994).

• Final rule 21 CFR 11 and preamble (1997).

During the first two stages there was consultation and discussion with the industry.

However, with the GMP regulations the FDA has jumped straight to a Direct Final Rule, omitting the notice and draft stage because "FDA expects there will be no significant adverse comments on these amendments." The changes will become effective on 17 April 2008 but the FDA is accepting comments up to 19 February 2008 that must be made using the Federal eRulemaking Portal as the Agency will no longer accept e-mail comments.

What will Change with 21 CFR 211?

In summary, the changes are updating the US GMP regulations and harmonizing them with the US and international regulations and guidance and these cover the following topics:

• Plumbing in §211.48(a) to remove the adherence to US EPA regulations.

• Aseptic Processing §211.113(b) to bring the regulation into line with existing guidance and industry practice.

• Asbestos Filters §211.72.

• Verification by a Second Individual covering the following sections of GMP: §211.68, §211.101, §211.103, §211.182, and §211.188.

The major impact on computerized system design and deployment is the last subject: verification by a second individual when a computerized system is used to automate a process.

Verification by a Second Individual

The four eyes approach is a cornerstone of any quality system (GMP, GLP or ISO 17025): a first person performs a task and a second person checks it. In US GMP there are several references to a second person check or verification such as container weights (§211.101), yield calculations (§211.103), cleaning logs (§211.182), batch records (211.188) and QC analysis for the laboratory (§211.194). These are all key stages of the pharmaceutical manufacturing process and the checks are there to ensure that mistakes can be caught and resolved early in the process. Although this is primarily to ensure patient safety and compliance with the regulations, it is also good business sense too because you don't want to commit resources to a process that will fail. However, the GMP regulations were written before the extensive computerization we now have.

The 1978 GMP regulations included §211.68 which outlines the controls required for automated equipment, including computerized systems, to be used in the manufacture of a drug product.¹ In essence these were to assure

• proper system performance

• changes to records are made only by authorized personnel

• system inputs and outputs are checked for accuracy

• data are backed up in an appropriate way to protect records.

The key question that has been posed to the FDA since the publication of the regulation concerns the need for a second (additional) person check when an automated operation is being performed. Remember that the computerized system will have been validated for the tasks that are automated; therefore two individuals to check results generated automatically would appear excessive. In the preamble to the 1978 GMP regulations there is a comment by the FDA that if the second individual verifies that the automated system is working properly¹ the regulation can be interpreted as the first individual is replaced by a computerized system or other automated process, and only one person is necessary to verify that the automated system is functioning as intended.

The FDA state that as they still receive questions periodically about the performance and checking requirements required by §211.101(c) and (d), §211.103, §211.182, and §211.188(b)(11) when the operations are performed by automated equipment, they are revising these sections. The revisions will clarify our long-standing interpretation and policy that verification by a second individual may not be necessary when automatic equipment is used under §211.68. Rather, in these situations, only one person is needed to verify that the automated equipment is functioning adequately. In cases where there is an operator for the automated equipment, the verifying individual may be, but is not required to be, the operator. In addition, the FDA is also amending §211.68 to provide a consistent clarification of this point.

Key Changes for Computerized Systems

We will now focus on the main changes associated with the second person verification concerning computerized systems. In the quoted sections, I have added the bold text to highlight the areas pertinent to the discussion.

A new paragraph will be added to §211.68 on automatic, mechanical and electronic equipment to read as follows:

(c) Such automated equipment used for performance of operations addressed by §211.101(c) or (d), 211.103, 211.182, or 211.188(b)(11) can satisfy the requirements included in those sections for the performance of an operation by one person and checking by another person if such equipment is used in conformity with this section and one person verifies that the operations addressed in those sections are performed accurately by such equipment.

So we now have an explicit statement that only one person is required to check that the system is working OK. This is good and sensible and should avoid overenthusiastic interpretation of the regulations.

Section 211.188 covering batch production and control records is amended by revising paragraph (b)(11) to read as follows:

(b) (11) Identification of the persons performing and directly supervising or checking each significant step in the operation, or if a significant step in the operation is performed by automated equipment under §211.68, the identification of the person checking the significant step performed by the automated equipment.

So we can reduce the checks to a single person who must ensure that the validated system is operating acceptably. Another good and sensible approach but one that could have been avoided if people actually read the preamble to the 1978 GMP regulations! The problem is that many organizations have read and interpreted the regulations at the time they were issued and have a rigid institutional interpretation which has gone unchallenged since.

When the Part 11 Scope and Application guidance was issued in 2003,⁵ it should have forced firms to go back to read and reinterpret their understanding of the predicate rules to which they work to. Most did not unfortunately.

Manufacturing versus Laboratory Systems

Hang on a second, we have been discussing computerized systems but where is there mention of the analytical laboratory? The changes only appear to impact manufacturing systems (§211.188) and the laboratory is not mentioned (§211.194).

However, this concerns the nature of the electronic records that are generated by the two types of computer system used in manufacturing and the laboratory. Typically readings of temperature and pressure generated by manufacturing equipment such as an autoclave are typically not changeable and therefore you can just apply the second person check.

Compare this with a chromatography data system (CDS) where a data file of each injection is generated along with the associated files such as the sequence, processing parameters and audit trail. These need to be interpreted by the chromatographer responsible for the analysis and this interpretation must be confirmed by a second chromatographer. Now we have reportable results.

However, could there be a situation where just a second person verification can be applied in the laboratory? Yes I believe there is. This is the situation where all the test results for a sample are collated to generate an analytical report or a certificate of analysis in a laboratory information management system (LIMS). All the individual tests have been checked using the four eyes approach and an authorized user could generate the report or certificate and then sign it.

Electronic Signature versus Identification of Action

Also there is explicit statement in the update of the GMP regulations about the identification of persons who are responsible for checking data or key stages of a process. Note the word identification. There is no mention of signing of records in this document.⁵ Computerized system designers for the laboratory please take note, we want easy-to-use and compliant systems not ones that require you to input your password every time there is a write to the disk.

The discussion in this direct final rule document also implicitly revisits the debate about whether we need witnesses for computer validation testing. There is no mention of witness in the document only verification or for double checking. Therefore there is no need for a witness in my opinion.

Summary

In this column I have presented the main changes to the GMP regulations that will be changed for the first time in 30 years. I have focussed on the need for second person verification when computerized systems are used and why the FDA is changing the regulation for the manufacturing systems but not the laboratory. I also discuss identification of actions versus signing of records when using computerised systems.

Bob McDowall PhD is principal at McDowall Consulting, Bromley, Kent, UK. He is also a member of the Editorial Advisory Board for LCGC Europe.

References

1. Current Good Manufacturing Practice For Finished Pharmaceuticals, Federal Register 43, 45013–45087 (1978).

2. GMP Federal Register, 61, 20103 (1996).

3. Direct Final Rule: Amendment to the Current Good Manufacturing Practice Regulations for Finished Pharmaceuticals, Federal Register, 72, 68064–68070 (2007).

4. Current Good Manufacturing Practice; Amendment of Certain Requirements For Finished Pharmaceuticals; Withdrawal, Federal Register, 72, 68111–68113 (2007).

5. FDA Guidance for Industry, Part 11 Scope and Application (2003).