How Able Are You?

The FDA performed an inspection of Able Laboratories, a New Jersey-based generic pharmaceutical manufacturer between 2 May and 1 July 2005. This was prompted by an employee notifying the agency about the "interesting" business practices at the company. As a result of finding discrepancies between paper and electronic records in the analytical laboratory and because of the firm's failure to investigate "out-of-specification" results, the company ceased manufacturing operations, recalled 3184 batches of product (its entire product line) and withdrew seven abbreviated new drug applications. The resulting problems and a failure to resolve the issue with the US Food and Drug Administration (FDA) resulted in a $100 million bankruptcy filing in October 2005 and a fire sale of the company's assets.

The issues raised by this inspection and the failure of the quality unit and senior management to spot and resolve the issue, highlights some lessons that all chromatographers, laboratory management and quality assurance (QA) personnel need to learn to ensure that the issues are prevented from occurring again.

The material in this article has been interpreted from the FDA Form 483 observations, dated 6 July 2005 presented to the company at the end of the inspection plus associated newspaper articles after the case available on the Internet.¹ This case also highlights a major problem of using hybrid computerized systems (electronic records with signed paper results) coupled with lax procedural controls, lack of operator training — coupled with a liberal amount of fraud. Of course, this will never happen in your laboratories will it?

Form 483 Observations

The issues involved with this inspection centred on a chromatography data system (CDS) that was used in the quality control (QC) laboratories. This is a networked data system supplied by a major CDS vendor. However, the use of the system was such that the controls developed by the vendor were either not used or ignored when analysing the results from analysis of routine batches of production material. In contrast, the same CDS features developed to ensure compliance with regulations appeared to have been very helpful to the FDA inspectors in their investigation. The system contained all the data necessary to uncover the multiple discrepancies between the paper and electronic records from each individual analysis.

There were 12 observations on the Able Laboratories Form 483; only the relevant ones to the CDS are discussed in this article as being directly relevant to the issue of electronic records and hybrid systems.

Observation 1: The QC Unit Lacked Authority to Investigate Errors

The main issue is that ALL drug products distributed by Able Laboratories failed to have the safety, identify, quality and purity that they are represented to have. The Quality Unit failed to

• Review electronic data as part of batch release.

• Review computer audit trails in the chromatography data system.

• Provide adequate training to analytical chemists.

As a result, a product was released when it failed to meet specifications. This appeared to be a systematic failure across all analysis performed by the quality control (QC) laboratories, coupled with the issue of fraud. The examples quoted in the 483 covered in-process, finished product and stability testing samples. More importantly, data generated by the laboratories was submitted to the FDA in seven abbreviated new drug applications (ANDAs). This observation triggered the ceasing of manufacturing, complete recall of all batches for all products and withdrawal of the abbreviated new drug applications by Able Laboratories.

We also have to understand the differences between the FDA and European Union (EU) good manufacturing practice (GMP). In this context, there is a clear distinction between QC and quality assurance (QA) under EU GMP in contrast to the "Quality Unit" within US GMP. Under EU GMP, the qualified person (QP), the head of production and the head of quality control have specific responsibilities for GMP and compliance with the marketing authorization for products. However, there are requirements for quality assurance under US GMP, but there is not an equivalent to the qualified person (QP).

Observation 2: Products Failing Specifications were not Rejected or Investigated

A major problem was that samples were routinely re-sampled, re-injected or reanalysed when out-of-specification (OOS) results were obtained. This is virtually the same observation as made by the FDA when it inspected Barr Laboratories in the early 1990s.²

The CDS helped the FDA inspectors identify these problems following a review of the CDS audit trail entries for each batch of material assayed. It was helped considerably by the fact that the data system retains within its database the individual results each time a data file is reprocessed: no data are overwritten but each result is retained and uniquely identified within the CDS database. For example, if a data file is reprocessed three times there will be three individual results with corresponding entries in one of the audit trails of the system. The saving of these intermediate results, each uniquely identified, allows the reconstruction of all events that have occurred from the initial acquisition of the data file. In contrast, if the CDS only saved the final result, then the inspectors would have had to recreate the data processing method as it was on the day of test and then reprocess the data to see all the results that were identified in the 483.

However, when a result was not within specification, the QC laboratory took the existing chromatographic data, which were reinterpreted to an acceptable result. If this did not work, then the same sample was reanalysed; and if this failed, a new sample was taken and analysed.

After the Barr ruling, the FDA issued a draft Guidance for Industry for the Investigation of Out-of-Specification Results in 1998 that was issued as a final version last year.³ Although the QC Laboratories had a standard operating procedure (SOP) for the investigation of OOS, as we shall see later it was not effective, not used or more probably ignored totally. However, Able Laboratories did not perform the required OOS investigation, but instead chose to test compliance into their products. Again, like Barr, any OOS results were not reported and ONLY the within-specification results for in-process, final product analysis and stability study testing were documented in the reports for these analyses. Some of the discrepancies documented in the Form 483 were:

• Acetaminophen and codeine tablets: The original result for codeine phosphate content uniformity was 8.3% RSD (relative standard deviation) versus a specification of <6.0%, but the result that was finally reported was 5.5%.

• Atenolol tablets: The dissolution test had a specification of no less than 85%, one original result was 30.9%, but when finally reported was 102.8% and within specification!

• Diphenoxylate and atropine tablets: In-process blending had a specification for one stage of 85–115%. The original results were in the range of 117.6–158.3%, but miraculously data in the range of 99.5–108.3% were reported.

The 483 lists three pages of discrepancies similar to the three examples above. These were not just isolated instances, but a systematic issue of abuse and fraud. Given the Barr ruling dates from 1993 plus the draft FDA Guidance on OOS and the general chapter <1010> from the US Pharmacopeia 28 on OOS testing,⁴ why did this occur? Were there management threats to staff? What was QA doing all this time?

Observation 3: Annual Reports did not Contain Investigations about the Safety or Effectiveness of a Drug

As a result of the failure to investigate any OOS results, information about material that should have been in Annual Product Reviews and submitted to the FDA was not there. As the Form 483 notes, only passing data points were submitted. Examples quoted included:

• Propoxyphene napsylate tablets had a dissolution specification for the stability samples of not less than 80%. For one batch the initial results were 72.8% and 73.2%; but were reported as 98.5% and 96.9%. This is not merely checking the positioning of baselines or the modification of integration parameters within the CDS, but something far more significant.

Therefore, the immediate impact was the withdrawal of a number of pending ANDA submissions and all existing approved ANDAs. As a result, the company now had no licensed products.

Observation 5: Laboratory Records do not Include Complete Data

The US GMP regulations §211.194 require that laboratory records contain "complete data" in contrast to production records (§211.188) that only require complete information. The citation in the Form 483 states laboratory records do not include complete data derived from all tests, examinations and assay necessary to assure compliance with established specifications and standards.

This observation is a simple compounding of the initial issue where OOS results were not investigated. To quote the 483: The QC Laboratory notebooks and binders lacked data from all analytical testing conducted in the QC laboratory. Laboratory records did not include all data such as out-of-specification results (OOS), chromatograms, sample weights and processing methods.

However, there was much more uncovered by the Inspectors. OOS results were substituted with passing results by analysts and supervisors. The substitution of data was performed by cutting and pasting of chromatograms, substituting vials, changing sample weights and changing (CDS) processing methods.

Here is where the CDS helped the inspectors:

• OOS results not documented in laboratory records. Unreported OOS results were found in electronic data files.

• Changed chromatogram headers by cutting and pasting, so during review all sample injections would appear to be in sequence.

• Original sample weights not recorded in notebook. Sample weights were changed by the analyst until a passing result was obtained.

• Processing methods changed by analyst until the processing method resulted in a passing result. Original processing method not recorded in the laboratory notebook.

For a regulated method, it can be argued that if you reprocess the data for the active compound then the method is out of control, with the exception of impurity testing. However, you do need a SOP that states where analysts can reintegrate chromatograms and where they cannot.⁵ The situation at Able Laboratories appears to be somewhat different in that there was a regime dedicated to passing material regardless.

When discussing the level of compliance to implement within any regulated function, there is always an argument that we rely on the ethics and integrity of the staff. However, ethics and integrity appear to be conspicuous by their absence in this instance from reading this 483 observation.

Observation 6: Inputs and Output from the Computer are not Checked for Accuracy

This is a GMP predicate rule citation from section 21 CFR Part 211.68(b) which states Input to and output from the computer or related system of formulas or other records or data shall be checked for accuracy. The degree and frequency of input/output verification shall be based on the complexity and reliability of the computer or related system.

However, there is also a requirement in the laboratory records section that has an implication, and this is section 21 CFR Part 211.194(a)(8). The initials or signature of a second person showing that the original records have been reviewed for accuracy, completeness, and compliance with established standards. Typically, the check required by this section is performed by the QC laboratory staff and there is no stated requirement for QA to do anything. In many organizations, QA staff do not wish to review electronic records and are quite content to review the signed paper output from a computerized system.

However, the 483 observation notes that audits were not conducted of the CDS used to control the chromatographs and acquire the data during the analysis of products. Sample injections, processing methods and sample weights were not reviewed or verified for accuracy of reported sample results during testing of samples from in-process, product and stability samples.

Therefore, as we become more and more electronic, there will be a requirement to review electronic records and documentation electronically and not on paper. Perhaps this is a wake-up call for QA to gear-up and acquire the skills for this new direction.

Observation 8: Failure to Train Employees in cGMP

Employees were not given training in cGMP and written procedures required by the regulations: QC Laboratory analysts were not routinely trained in Quality Control procedures such as SOP QC–011–03, Laboratory Deviation Investigations and SOP QC–021–06, Acceptance/Rejection criteria for OOS Analytical Test Results. This lack of training and oversight by management contributed to the non-reporting of OOS results in QC Laboratory.

Lessons Learnt

There are a number of checks and balances that are required to be present that appear to have failed in the case of the QC department of Able Laboratories. We need to look at this and think about the ways that we use computerized systems in the laboratory.

Reliance on paper records: If not immediately apparent to every chromatographer, the regulated world is going to be electronic sooner or later and paper will no longer be the master of the house. The reasons for this are two-fold:

• Regulatory drivers are moving to electronic submission of new drug applications (electronic Common Technical Document (eCTD)) or serious or life-threatening adverse events (E2B). This is as much to avoid re-entering data by regulatory authorities as removing the mountains of paper from their facilities. This will only extend to other areas. In the future regulatory inspections could be conducted remotely via the Internet to review the records in conjunction with a video link with the healthcare facility staff.

• Business drivers: healthcare margins are under pressure as providers such as governments seek to reduce the price paid for medicinal products. Effective electronic processes with electronic signatures where appropriate are faster, cheaper and less error-prone than any corresponding paper-driven process.

Therefore, hybrid systems need to be managed from three perspectives:

1. Paper records and their integrity.

2. Electronic records and their integrity.

3. Linkage and integrity between the paper and electronic records.

To do otherwise is "ostrich" quality assurance. Furthermore, hybrid systems should be replaced as firms go electronic in both research and development (R&D) and manufacturing. Otherwise, there is the ludicrous situation of using an electronic system to create paper records that are scanned into a document management system to create an electronic submission. Good business sense all round?

Fear of Auditing Computer Systems

The Form 483 notes that the quality unit failed to review electronic data and the associated audit trail entries. However, let us look in a wider context than just Able Laboratories. There is an unspoken fear among QA personnel about auditing electronic systems because they are much happier dealing with paper. In part this is because paper is a tangible medium and is a known quantity rather than the intangible media that constitute electronic records (see Table 1 for some comparisons between paper and electronic records).

Table 1: Comparison of paper and electronic media.

Instead of a linear pile of paper that can be audited to check data integrity, there are hyperlinked electronic records that appear to disappear into a database. This is compounded by the failure of system vendors and developers to design audit trails that facilitate effective auditing. The audit trail in many applications is apparently gibberish, unless the reader has a good understanding of the overall application, which is often unrealistic. Therefore, many CDS applications are not really designed to facilitate effective quality auditing.

Ironically, the CDS system at the heart of the QC department at Able Laboratories can be set up by a trained administrator to highlight where human intervention in the chromatographic process has occurred.⁵ However, this served merely to help the inspectors rather than the laboratory that it was originally designed to serve.

Definition of Complete Data

When working to GMP in chromatography laboratories there is the requirement, as noted earlier, for complete data. When working with a hybrid system, this can be difficult if not explicitly defined and documented. Therefore, as a minimum, laboratories need to define what constitutes complete data in a hybrid situation to comply with the regulations. In contrast, however, when working electronically and using an appropriately designed database application, complete data can be automatically collected and stored within the database. All that is required is the definition of electronic records captured and maintained by the system.

Trust Us — Our Employees are Trained

When looking at any debate on how detailed the controls should be for any electronic system there is always a human element. A number of technical controls of various degrees of complexity can be implemented within a system to ensure data integrity; it just depends on how paranoid a company is, and how deep their budget runs. However, technical controls can only go so far, as computerized systems need to be operated by humans.

Here the combination of education, experience and training of individuals comes to the fore. Users need to understand not only the operation of the computer system as required by their access privileges, but also the ethics and integrity required operating under any of the GMP or GLP quality systems.

Therefore, there is a need, in the words of Ronald Reagan, to "trust but verify" and here the twin roles of line management coupled with independent audit are the keys to success. Obviously in the instance of Able Laboratories, there was a failure in this process. As noted in the 483, both management and quality failed in their tasks to ensure integrity of the laboratory operations.

References

1. Able Laboratories, FDA Form 483 Inspectional Observations, 6 July 2005.

2. United States District Court For The District Of New Jersey, United States Of America V. Barr Laboratories Inc., Civil Action No. 92-1744, Opinion 4 February 1993.

3. FDA Guidance for Industry, Investigating Out of Specification (OOS) Test Results for Pharmaceutical Production (2006).

4. US Pharmacopeia 28, General Chapter <1010> Outlier Testing, US Pharmacopeial Convention Inc., Rockville, Maryland, USA (2005).

5. R.D. McDowall, Validation of Chromatography Data Systems: Meeting Business and Regulatory Requirements, Royal Society of Chemistry, Cambridge (2005).

R.D. McDowall is principal at McDowall Consulting, Bromley, Kent, UK. He is also a member of the Editorial Advisory Board for LCGC Europe.