Dinesh Parsai, ELC Group examines data integrity – the FDA perspective
Data Integrity 1
Integrity in its true sense is applicable in every walk of life and the pharmaceutical industry is no exception. In recent years, health regulators all over the world have come up with guidelines, certifications, rules and regulations for the effective implementation of cGMP practices in pharmaceutical manufacturing. Essentially, cGMP guidance and regulations allow flexible and risk-based approaches to address product specific needs. In layman terms, cGMP stipulates: “Do what is written and write what is done. If any deviation is observed other than the expected results, then the failure should be investigated, root cause identified and appropriate corrective actions should be taken to get rid of future failures.” This process of compliance with cGMP requirements entails the generation of a number of policies, protocols, reports, observations and so on, which will be used by the pharmaceutical manufacturer as “data” to assure the quality of products.
However, in recent years, during cGMP inspections, regulators have observed that the majority of cGMP violations involve ‘data integrity’. Regulators regard data integrity as an important responsibility of the industry to ensure the safety, efficacy and quality of drugs and safeguard the public health at large. The US FDA has identified that most of its warning letters and import alerts are imposed due to data integrity-related cGMP violations. The FDA, therefore, has proactively taken the initiative to educate the industry in this important aspect and published a draft guideline entitled Data Integrity and compliance with cGMP.
As defined in the guideline, ‘Data integrity refers to the completeness, consistency, and accuracy of data. Complete, consistent, and accurate data should be Attributable, Legible, Contemporaneously recorded, Original or a true copy, and Accurate (ALCOA).’
The FDA also explains the main terminologies used during the cGMP inspections, such as metadata, audit trail, static or dynamic records, back up, systems or computer-related systems.
The guideline recommends that workflows, shared logins or sharing login credentials on computerised systems should be appropriately validated and controlled in order to preserve the integrity of records or data. Shared logins on the same computer system, or sharing login credentials with other personnel, is discouraged by the FDA because a unique individual cannot be identified and shared data can be compromised.
Another key best practice laid out on the guideline is routine, scheduled audit trail reviews. Audit trails that capture changes to critical data should be reviewed with each record and before final approval of the record. Audit trails review should include, for example, the change history of finished product test results, changes to sample run sequences, changes to sample identification, and changes to critical process parameters.
The FDA suggests that firms using electronic signatures should be able to demonstrate that they are able to identify the specific person who signed the records electronically. If this requirement is met then electronic signatures can be used instead of handwritten signatures.
Similarly, if blank forms like worksheets, laboratory notebooks and so on are used, then they should be controlled and issued by the quality unit and reconciliation should be easy.
Within the guideline, the FDA also encourages saving data instantaneously after completion of tests, to create a record in compliance with cGMP requirements. Use of a Laboratory Information Management System (LIMS) or an Electronic Batch Record (EBR) system – which can be designed to automatically save after each separate entry – is encouraged.
The reprocessing of analytical data is discouraged – the FDA instead feels that analytical methods should be accurate, capable and stable.
Finally, the FDA expects regular training of personnel in all aspects of protecting data integrity while performing their assigned duties, and considers this to be an important aspect in order to comply cGMP requirements. Moreover, firms should be willing to hire a third party auditor to identify data integrity-related problems and ensure continued compliance and adherence to best practices.