Top 10 Key Audit Failures

1. No annual review of Environmental Monitoring data and assessment of the continued appropriateness of current action and alert limits.
2. Environmental monitoring programs which do not establish investigations or actions for a number of alert limit excursions which occur during a discrete time period.
3. Supplier qualification processes which are based criticality of supplier on annual procurement $ spend rather than GxP criticality dimensions such as safety, quality, identity, purity or potency.
4. Supplier qualification processes which allow too long a time period between initial qualification audits and subsequent re-qualification audits.
5. Supplier qualification processes which do not take into account supplier performance history and the need for adjustments to defined audit frequencies.
6. Process qualification of critical quality attribute ranges which are not scientifically justified based upon DOE or other science based rationale.
7. Computer systems validation of key systems used to support quality or production systems which does not include a periodic review process following initial validation to evaluate the collective impact of change controls and the maintenance of the validated state of control.
8. Recall procedures which do not include provisions for a mock recall to verify lot genealogy/traceability.
9. IT back-up processes which utilize automated tools/utilities with no manual review of backup logs to verify that there were no failures or files skipped.  No process for investigation or escalation of backup failures to IT management.
10. Failure of cleaning validation to consider limit of detection, limit of quantification, various materials of construction and risk parameters such as worst-case model compound, solubility, number of difficult to clean areas and total product contact area.  

About the Author:
Robert (Bob) Lesnefsky is the Global Vice President of Quality Assurance and Regulatory Compliance and Auditing at USDM Life Sciences.  He is a seasoned quality assurance and regulatory compliance professional with 30+ years of experience in quality assurance and regulatory compliance in the pharmaceutical, biotechnology, medical device, nuclear and petrochemical industries.  Bob is sought out as the GMP/DEA compliance expert in providing compliance opinions and interpretations of cGMP to manufacturing, operations, quality and client services to ensure compliant drug product manufacturing operations.

USDM Life Sciences has a combination of over 100 years in regulatory compliance, Quality Assurance, Quality Systems and auditing. USDM’s auditors in the Global Audits Practice Team perform audits on Pharmaceutical, Biotech and Medical Device companies in the US and abroad.

What Would Happen if You Change Your Barcode Standard?

USDM Life Sciences has quite a bit of experience with this. Let’s say you chose to move to GS1 standards, you're effectively changing the label.  You would have to sunset, retire, and create a new record associated with the GS1 standard as your device identifier.

There are some ways to do this that are a bit more flex, if you haven't already submitted the record, that we've helped some clients with. So if you've already submitted, then you're going to have to end date and then create a new record. If you haven't submitted, then take advantage of the primary and secondary DIs that are associated with the product so that you don't have to create new records downstream.

USDM Life Sciences will help you assess, plan and execute the changes and enhancements necessary to meet UDI regulations. Our team of UDI experts will assess your products, the markets where they are sold and determine an implementation strategy for the changes that need to be made. USDM’s assessment methodology is extensive and includes the labels and packaging, the management of identification changes to each product, the changes to PLM, ERP, EPCIS and packaging systems, changes to printing, vision inspection and warehouse/inventory management systems and interfaces to the GUDID.

How are Healthcare Providers Managing their Pharmaceutical Data?

Generally, the information that's coming from the distributor is very well-managed by the distributor through to the hospitals, but using a solution is still a benefit. Where providers have more difficulty with keeping up with the documentation is for their orders that go direct to the smaller companies. That's where the magnitude comes up, but it's probably an 80/20. They order most of their product through a distributor, so it's covered, but they can order from up to 50 smaller manufacturers. They have to have a process in place with each individual manufacturer, and that is very cumbersome.

USDM Life Sciences offers healthcare a comprehensive assessment, strategy and solutions to implement end to end traceability of pharmaceutical and medical devices from point of receipt through to the electronic health record.

What are Healthcare Providers Doing to Implement DSCSA Requirements?

Healthcare providers approach to implementing the Drug Supply Chain Security Act (DSCSA) varies. Some providers have teamed up with a solution provider that helps them to track pharmaceutical information. Others are using manual processes and keeping paper copies of the information. It really varies by organization. However, a paper process in any manner is not sustainable. It's a start. It helps to build the process. It will help the provider to understand the complexity and how having a solution is really going to help them to manage this data much better than a paper process.

USDM Life Sciences offers healthcare a comprehensive assessment, strategy and solutions to implement end to end traceability of pharmaceutical and medical devices from point of receipt through to the electronic health record.

If Not Using the Kit Exception, Does the Kit Itself Need a UDI?

The kit exception doesn't work in reverse. So what the kit exception says is that if you have a UDI on the kit (assuming that it's a kit that meets the intent of the UDI Rule and the regulatory definition that's there now) then the device components are exempt from having to have a UDI on them. And we probably should use the term "component". The devices within the kit do not need to have a UDI on them.

The collection of medical devices, or the kit, in this case, is still a medical device and subject to UDI. So even if each of the devices within the kit have their own UDI, the kit itself is still a medical device and still needs its own UDI that identifies the kit itself. So it doesn't work in reverse.

USDM Life Sciences will help you assess, plan and execute the changes and enhancements necessary to meet UDI regulations. Our team of UDI experts will assess your products, the markets where they are sold and determine an implementation strategy for the changes that need to be made. USDM’s assessment methodology is extensive and includes the labels and packaging, the management of identification changes to each product, the changes to PLM, ERP, EPCIS and packaging systems, changes to printing, vision inspection and warehouse/inventory management systems and interfaces to the GUDID.

Will There be More Changes in the Expectations for Reporting Adverse Events Based on the Implementation of UDI?

Jean Sargent, Vice President of Healthcare Strategy and Implementation at USDM Life Sciences says adverse events reporting will become more and more imperative for all of the healthcare providers, as well as the medical device manufacturers. The FDA doesn't regulate the hospitals, so they can take it to a certain point. I'll liken it back to 2000. In 2000, being on the central service side, I was very involved when the FDA said "You can no longer manufacture your own product."

The FDA actually did start going into hospitals and making sure that the hospitals were not manufacturing their own product. There's going to be some way that the FDA is going to work with hospitals, to make sure they are capturing this information and therefore, reporting this information.

Now whether they end up using the joint commission or they end up using Medicare that demands having that UDI information for reimbursement - there will be methods that will be coming up down the road that will drive the adoption and implementation of the UDI within the hospitals.

USDM Life Sciences offers healthcare a comprehensive assessment, strategy and solutions to implement end to end traceability of pharmaceutical and medical devices from point of receipt through to the electronic health record.

Do All Justifications for Direct Marking on Implants Have to be Submitted to the FDA or Can They be Documented in a Device History File for Inspection by the FDA?

The UDI Rule says that you need to have a permanent UDI on the device itself.

Direct Part Marking (DPM), is a set of technologies that are used both in medical device space, and widely in the DoD space, to apply typically bar codes to often metal or hard surfaces. One of the technologies to apply barcodes to surfaces is laser etching. There’s a number of different technologies that are out there.

But direct part marking is one way to meet the direct mark requirement. Obviously, there are permanent labels, tags, other ways as well, and some of this is discussed as well in the FDA's guidance on the topic.

On the issue of exceptions built into the Rule, I didn't touch on them today, but just like the single-use vice packaging and convenience kit exception, integral to the UDI Rule are a number of direct marking exceptions. They are listed there. And just like the single-use device packaging exception or the convenience kit exception, these exceptions are noted in the DHF of the particular device. So if you decide, for example, that it is not technologically feasible to directly mark your device, this is something you note yourself. All of these exceptions are things, all the exceptions that are integral to the Rule are things that you note yourself and do not have to request from the FDA.

There is an exception and alternative process that is built into the Rule, so if for some reason you believe you can't meet the Rule as we just talked about it and the exceptions that are integral to it are not sufficient, you can request from FDA a specific exception alternative. We've done a number of those for clients. There's some more information on FDA's website. If you have questions about it, please let us know.

USDM Life Sciences will help you assess, plan and execute the changes and enhancements necessary to meet UDI regulations. Our team of UDI experts will assess your products, the markets where they are sold and determine an implementation strategy for the changes that need to be made. USDM’s assessment methodology is extensive and includes the labels and packaging, the management of identification changes to each product, the changes to PLM, ERP, EPCIS and packaging systems, changes to printing, vision inspection and warehouse/inventory management systems and interfaces to the GUDID.