How Complete Are Your Chromatographic Data? Part 2

US Good Manufacturing Practice (GMP) regulations for quality control (QC) laboratories require that laboratory records shall include complete data derived from all tests. In this second instalment of "Questions of Quality" we will look at paper versus electronic records in the context of complete data, what happens when things go wrong, and what is the European approach?

In part 1 of this column (1) we looked at the interpretation of the US Good Manufacturing Practice (GMP) regulations for quality control laboratories that require that laboratory records shall include complete data derived from all tests (2). We explored what was meant by "complete data" in the context of a chromatography data system and, with an analysis of the United States Food and Drug Administration (FDA) 483 citations, looked at the problems when a laboratory fails to understand this phrase (3). We will now consider if complete data includes the electronic files generated during the course of a chromatographic analysis or just the signed paper printouts.

Paper or Electronic Records?

Even before the publication of the FDA's regulation on electronic records and electronic signatures regulations (21 CFR 11) (4), there was a debate about what constitutes the raw data or primary record. Are paper printouts or the underlying electronic records that were used to produce the paper output the primary record or raw data? The FDA has produced a publication that stops the debate once and for all and makes it impossible to justify using paper as the primary record or raw data. Interested? Then read on. I have adapted the rest of this section from an earlier "Questions of Quality" column on defining raw data (5) that some readers may find interesting if they want a wider discussion of this topic.

In 2010, the FDA issued more detailed guidance aimed at chromatography data systems (CDS) used in quality control (QC) laboratories that work to GMP. The principles that were outlined can be applied to virtually any computerized laboratory system used for regulated work. This was published on the FDA website under the concise title: "Questions and Answers on Current Good Manufacturing Practices, Good Guidance Practices, Level 2 Guidance - Records and Reports" (6). Item 3 is a question concerning the interpretation of the GMP predicate rule (1) and the applicability of Part 11 (6) to chromatographic data systems.

The web page posed the question: "How do the Part 11 regulations and predicate rule requirements for GMP apply to the electronic records created by computerized laboratory systems and the associated printed chromatograms that are used in drug manufacturing and testing?" Although the FDA's answer to the question is based on chromatography data systems, it is applicable to all computerized laboratory systems. If in doubt, take a look at the question that the FDA posed and substitute chromatogram for spectra or any other laboratory record and the answer is applicable to non-chromatographic instruments and the associated data systems that generate electronic records. The FDA starts by stating that "some in industry misinterpret lines 164 to 171 from the Part 11 Guidance (7) to mean that in all cases paper printouts of electronic records satisfy predicate rule requirements in 21 CFR Part 211."

Therefore, the key to the debate is this: What do the GMP predicate rules state and how should they be interpreted for a computerized laboratory system? The FDA comment that for a CDS and other computerized systems used in a QC laboratory involving user inputs, outputs, or audit trials, that there are two clauses from the GMP regulations applicable for the interpretation of paper versus electronic raw data debate. These are §211.68 and §211.180(d) (2).

• 21 CFR 211.180(d) states that manufacturing records must be retained "either as original records or true copies such as photocopies, microfilm, microfiche, or other accurate reproductions of the original records." This clause shows how old the US GMP regulations are because it mentions microfilm and microfiche; this part of the regulation has not been updated since it was issued in 1978 and is firmly grounded in a cellulose world.

• 21 CFR 211.68 further states that: "Hard copy or alternative systems, such as duplicates, tapes, or microfilm, designed to assure that backup data are exact and complete and that it is secure from alteration, inadvertent erasures, or loss shall be maintained".

The FDA then makes the following statement which is reproduced below in its entirety; I have just added the bullet points to aid readability and understanding:

• The printed paper copy of the chromatogram would not be considered a "true copy" of the entire electronic raw data used to create that chromatogram, as required by 21 CFR 211.180(d).

• The printed chromatogram would also not be considered an "exact and complete" copy of the electronic raw data used to create the chromatogram, as required by 21 CFR 211.68.

• The chromatogram does not generally include, for example, the injection sequence, instrument method, integration method, or the audit trail, of which all were used to create the chromatogram or are associated with its validity.

• Therefore, the printed chromatograms used in drug manufacturing and testing do not satisfy the predicate rule requirements in 21 CFR Part 211. The electronic records created by the computerized laboratory systems must be maintained under these requirements.

Why the lengthy debate on this point? The reason is that electronic records contain much more information than the corresponding paper printouts of the same chromatographic run. Consider an Excel file as a simple example, under the properties tab there is information about the file creation and printing dates that a typical printout does not contain unless specifically configured to do so. In this simple case the electronic record contains more information than the paper one. Think about an analytical run: Who prints out the audit trail? However, the audit trail contains critical information to demonstrate the integrity of the analytical run including the interpretation of the raw data files and their conversion into the final reportable value. It also identifies critical operator interactions that involve manual data entry, interpretation or modification of data, or carry out calculations. Therefore, the electronic records from a data system contain much more information than the paper printout. That is why the FDA want electronic records. Printed chromatograms do not satisfy the predicate rule requirements in 21 CFR 211.

In summary, a paper printout does not meet the requirements of the predicate rule and the chromatographic system must therefore be considered either a hybrid system (electronic records with signed paper printouts) or a fully electronic system. Regardless of the way a chromatographic system is used (hybrid or homogeneous system), the electronic records must be maintained and are key to meeting the predicate rule requirements.

However I think that the FDA have missed a trick in this discussion because the key regulatory requirement for the QC laboratory is §211.194(a) (2) which states that "Laboratory records shall include complete data derived from all tests necessary to assure compliance with established specifications and standards." For example, an audit trail is part of the complete data regardless of whether the system is a hybrid or a fully electronic one. Therefore, if you use the argument that your laboratory records are paper, then you do not have a leg to stand on, because paper records can never be complete.

New FDA Emphasis on Data Integrity

As a result of several cases of fraud and falsification identified over the past few years by the FDA, all FDA inspectors have undergone training in data integrity by Monica Cahilly (Green Mountain Quality Assurance). Now, during inspections, they will focus on the system and the electronic records contained within it, rather than the paper outputs. Paper is now incidental to the integrity of the underlying electronic records generated by any computerized laboratory system used in a regulated laboratory. It should also be noted that complete data includes the audit trail entries created during the generation, interpretation, and modification that occur during an analysis.

Aversion Therapy?

Of course, there are always worthy organizations whose sole purpose in life is to serve as an example for others not to follow. In this section I will present only those laboratories that have had a difference of opinion with the FDA inspectors over their interpretation of complete data. Or perhaps that should be incomplete data? This list is obviously not exhaustive but merely illustrative of my aim in this column.

The first example is Compania International de Comercio in Mexico (8) and looks at a failure to have complete data and being rather selective in documenting the results.

Example 1: Your firm has not established appropriate controls designed to assure that laboratory records include all data secured in the course of each test, including graphs, charts, and spectra from laboratory instrumentation, properly identified to show the specific component, drug product container, closure, in-process material, or drug product, and lot tested [21 CFR 211.194 (a)(4)].

Specifically, the inspection revealed that your firm has not established written procedures to control and account for electronically generated worksheets used by analysts to record analytical test results. Analysts in your QC laboratory print an uncontrolled number of worksheets from computers throughout the QC laboratory without supervision. For example, (a) The investigator found a certificate of analysis (COA) for <redacted> oz, lot number <redacted>, dated January 19, 2011, in a trash container in the office used by QC personnel. This COA reported an assay value for <redacted> of <redacted>%.

A second COA, dated January 21, 2011, filed with the analytical package for lot <redacted>, reported an assay value of <redacted>%. (b) An analytical worksheet for <redacted>oz, lot <redacted>, dated January 21, 2011, with no approval signature, was found in a trash container in the office used by QC personnel. This analytical worksheet shows calculations of content uniformity for active ingredient <redacted> of <redacted>%. The COA dated January 21, 2011 filed with the analytical package reports a content uniformity (CU) value of <redacted>%. The CU value in the reference COA represents the analytical testing performed on a single in-process sample after the product has been <redacted>. (c) The calculations for <redacted> in <redacted> Lot <redacted> were conducted using two (2) of three (3) injection areas. The FDA investigator's review of the HPLC (# C003) raw data verified the existence of three (3) HPLC chromatograms generated from batch <redacted>. However, only two (2) injection areas were used in the calculations.

Here we have selective use of results, a selected "complete data" in item (c) above and also the use of multiple copies of certificates of analysis: perhaps, if a back is out of specification the analyst has gone back to reinterpret the data?

The second example comes from Gulf Pharmaceutical Industries from February 2012 (9) and concerns failures to retain the electronic CDS files and reliance on paper. The warning letter citation reads:

Example 2: Your firm has not established appropriate controls over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel. Your firm also fails to maintain a backup file of data entered into the computer or related system [21 CFR § 211.68(b)].

• For example, there is no system in place to ensure that all electronic raw data from the laboratory is backed up or retained.

• During the inspection, you informed our investigators that electronic raw data would not exist for most HPLC assays over two years old because data is not backed up and storage space is limited.

• Data is deleted to make space for the most recent test results.

• You also informed our investigators that printed copies of HPLC test results are treated as raw data. Printed copies of HPLC test results from your firm's systems do not contain all of the analytical metadata (for example: instrument conditions and integration parameters) that is considered part of the raw data. We acknowledge that your response indicates that you have created a procedure in order to implement the backup and retention of HPLC data. This electronic HPLC data supports testing, disposition, and other significant quality control decisions, and it is essential that you maintain this information for each batch.

Recently, the FDA has issued a warning letter to RPG Life Sciences Ltd (10) that also highlights both issues with complete data and overall integrity of the data generated by the laboratory. The FDA inspection covered two sites and at both there were citations for lack of complete data:

• Worksheets and other records were deliberately backdated compared with the date that the worksheet was issued by the quality assurance (QA) department.

• For HPLC analysis there were no raw data related to sample weights and sample solution preparations.

• Chromatographic analysis involved the use of "trial" runs which were not used to calculate the reportable results if the results were outside of the specification. In other words, this was testing into compliance.

• At one site an inspector requested the electronic raw records to review and compare the results with the printouts from the CDS, but the data were not available for review because the company did not have the software program available to view the data.

• Data could be deleted by an analyst by using the administrator password and data could be overwritten in the audit trail.

• At another company site, it states in the warning letter that your analysts demonstrated to our investigators that they could delete any electronic analytical data files from the laboratory computers and external backup hard drives.

With these comments the integrity of any data generated by the laboratory is destroyed because of testing into compliance, falsification, and selection of passing results. The remedial actions required by the FDA is very onerous but could have been avoided if the company worked in a compliant way.

Of course, problems like these can never happen in your laboratory, can they?

Generating PDF Reports Instead of Paper?

One aspect of the discussion of paper versus electronic records is the use of PDF reports. In some cases, a laboratory may think that a PDF report can be substituted for paper printouts. Let us discuss this further. If there is only a PDF report and no information about the sample information, sample weights, details of the preparation of reagents or standards, and no chromatographic data files the report is incomplete. This is exactly the same argument that the FDA shot down in flames for a paper report, as discussed in the last section. The only difference is that instead of a paper printout the same information is found in an electronic report.

The only time, in my view, that a PDF report is acceptable as part of the complete data for an analysis is when:

• The PDF report is generated securely, following a documented, secure, and controlled process (this is required so that the information used to generate the PDF cannot be selectively edited or "enhanced" during the process). Visibility and traceability are key, because the problem with PDF files is that it is possible to open unprotected and even some protected PDF files in the professional version of Acrobat, make changes to the content and then save them. Furthermore, PDF document formats are integrated into Microsoft Office applications that can be used to open, extract the data, edit the files, and then re-render them into a PDF. Even photocopiers include the ability to copy a chromatograph and generate a PDF. So, in an insecure process, the information on a printed paper chromatogram (for example, peak area) could be edited and the data copied to PDF.

• Once generated, PDF reports must be protected throughout the record retention period. This can either be within the laboratory application that generated the file, in a document management system or on a protected directory on a network. The aim is to avoid losing the file from a disk crash or indeed subsequently edit the file.

• The underlying laboratory records used to generate the report must be linked to the report, for example, the raw chromatographic data files from which the result information has been abstracted, audit trail entries, methods and calculations. Even if "final" records are electronically embedded within the report (for example, integrated chromatograms), the PDF needs to provide traceability to the electronic source file. Furthermore, it is essential that the raw data files or electronic records are available in case reinterpretation is required in a laboratory investigation or a regulatory challenge.

Therefore, a laboratory relying solely on a PDF report file is totally inadequate because it does not comply with the regulations for complete data, even if printed or PDF copies of the underlying chromatograms are attached.

Think this through with all your laboratory operations: What happens if you use a third-party supplier to do your instrument qualification? What output from the process could you get? A PDF report (either on paper or electric version) and the service engineer walking out of the laboratory with the chromatography data files used to generate the report on their PC? Try explaining this to an inspector. How much of an idiot do you wish to appear?

As well as the need to retain the electronic data, the data flow used by the engineer from the start of the process to the generation of the PDF report (and the traceability of any embedded electronic information) must be clearly understood by you — because you will need to defend it during an audit or an inspection. What you need to consider is:

• Do you ever look at what the service engineer has done?

• Have you looked at the raw data to see how many attempts have been made to get the instrument to pass?

• Have you inspected the audit trail entries for the CDS for the work undertaken by the engineer?

No? I thought not.

Europe Has New GMP Regulations for QC Laboratories!

Up to now this column has focused exclusively on the FDA GMP regulations for regulated laboratories, we also need to consider that we work in a global environment and there are other regulations to consider. At the start of July 2013 the new version of EU GMP Chapter 6 for Quality Control (11) will go into effect. Here, the main changes are the inclusion of a new section on technical transfer of testing methods and other items such as out of specification results. (There are five new clauses specifically on method transfer).

However, the main portion of the regulation is unchanged and the pertinent sections dealing with laboratory records are shown below. The requirements in the EU are essentially similar to those in the USA, although there are some differences between US and EU regulations for QC laboratories such as:

• 6.9: Some kinds of data (for example, tests results, yields, and environmental controls) should be recorded in a manner permitting trend evaluation. Any out of trend or out of specification data should be addressed and subject to investigation.

Therefore, data must be trended under EU GMP, but this is only contained in the OOS Guidance for Industry from the FDA (12).

However, the main requirements for laboratory records are shown below:

• 6.10: In addition to the information that is part of the batch documentation, other raw data such as laboratory notebooks or records should be retained and readily available.

• 6.16: The results obtained should be recorded, trended, and checked to make sure that they are consistent with each other. Any calculations should be critically examined.

• 6.17: The tests performed should be recorded and the records should include at least the following data: (a) name of the material or product and, where applicable, dosage form; (b) batch number and, where appropriate, the manufacturer or supplier; (c) references to the relevant specifications and testing procedures; (d) test results, including observations and calculations, and reference to any certificates of analysis; (e) dates of testing; (f) initials of the persons who performed the testing; (g) initials of the persons who verified the testing and the calculations, where appropriate; (h) a clear statement of approval or rejection (or other status decision) and the dated signature of the designated responsible person.

Although the section on laboratory records in Chapter 6 is relatively brief compared with the 21 CFR 211, the EU GMP regulation is implicit in requiring complete data and is not as detailed as the FDA GMP. However, there are some further requirements of the batch records required in Chapter 4 on documentation (13) that I do not have space to go into, but when all requirements in Chapter 6 and Chapter 4 on documentation are combined their impact is similar to US GMP.

Summary

In this column we have looked at what requirements there are for "complete data" for laboratories working under the FDA GMP regulations and also looked at the mistakes that are made by reviewing the 483 observations made by inspectors over 2006–2012. The problem is that elementary analytical science mistakes are made by staff and laboratory management that are a result of poor education, laziness, or incompetence. We have also looked at whether paper printouts or electronic records are adequate to meet GMP regulations and, conclusively, it is not paper.

"Questions of Quality" editor Bob McDowall is Principal at McDowall Consulting, Bromley, Kent, UK. He is also a member of LCGC Europe's editorial advisory board. Direct correspondence about this column should be addressed to "Questions of Quality", LCGC Europe, 4A Bridgegate Pavilion, Chester Business Park, Wrexham Road, Chester, CH4 9QH, UK, or e-mail the editor-in-chief, Alasdair Matheson, at amatheson@advanstar.com

References

(1) R.D. McDowall, LCGC Europe 26(6), 338–343 (2013).

(2) Current Good Manufacturing Practice for Finished Pharmaceutical Products, 21 CFR 211, 2009.

(3) Inspections, Compliance, Enforcement, and Criminal Investigations http://www.fda.gov/ICECI/EnforcementActions/ucm250720.htm

(4) Electronic Records; Electronic Signatures final rule (21 CFR 11), 1997.

(5) R.D. McDowall, LCGC Europe 25(4), 194–200 (2012).

(6) Questions and Answers on Current Good Manufacturing Practices, Good Guidance Practices, Level 2 Guidance - Records and Reports. Part 3 (2010) http://www.fda.gov/Drugs/GuidanceComplianceRegulatory Information /Guidances/ucm124787.htm

(7) FDA Guidance for Industry, Part 11 Scope and Application, 2003.

(8) FDA Warning Letter, Compania International de Comercio, June 2012.

(9) FDA Warning Letter, Gulf Pharmaceutical Industries, February 2012.

(10) FDA Warning Letter, RPG Life Sciences Limited, May 2013.

(11) EU GMP Chapter 6 (2013).

(12) FDA Guidance for Industry, Out of Specification Results, 2006.

(13) EU GMP Chapter 4, Documentation.