Quality Systems and Risk Management Approaches for Networked

Quality Systems and Risk Management Approaches for Networked Drug Development David A. Moyer VP, Regulatory Compliance Programs Fulcrum Pharma Developments, Inc. PDA Sci. Tech Summit Orlando, Florida March 10, 2004

Tailored Networked Team Project Team Advisory Boards Sponsor Regulatory/QA CMC Contract Manufacturing Organizations Project Manager Project Leader Clinical Preclinical Project Manager Preclinical Contract Labs Project Manager Clinical Contract Research Organization

How do Regulators View Network Prepared Submissions? > Submission sponsor bears ultimate responsibility - no difference! > Expectation is to have an integrated approach to quality even though many quality systems are involved – – Preclinical Supplier must meet GLP – CRO(s) must meet GCP – Drug Substance and Drug Product CMOs must meet GMP – Electronic data must meet appropriate 21 CFR Part 11 security and retrieval requirements

Quality System Foundation > It is essential to have a quality system in place at the core of a drug development program that complements, but does not interfere with the suppliers’ programs.

Components of the Core Program > > > > Project Quality Plans Vendor qualification and approval system Document control and record retention policy Regulatory inspections policy Staff training program Program management procedures Standardized audit plans for major development activities > Procedures for electronic records management, including secure data sharing with clients

Quality Pyramid Qual System Project Quality Plan Project Plan Standard Operating Procedures

Standard Operating Procedures > > > > Quality Policy Document Control (Internal & External) Employee Training Project Plan and Protocol Development Supplier Evaluation and Approval IT Security Data QA Generation of Regulatory Documentation

Quality Policy > > > > Generation and execution of Project Quality Plan (PQP) Performance of supplier audits and assessments in accordance with PQP Conduction of internal audits on an annual basis Statement of quality and ethical standards Statement and standards for suppliers Review and approval of deliverables Policy for data access to regulatory authorities and third party consultants Commitment to ensure internal and external (supplier) compliance with applicable regulations

Document Control Essential Elements > A set of procedures to guide internal generation of critical documentation to satisfy regulatory guidelines > A system for integrating internally and externally generated documents to ensure consistency while still protecting supplier proprietary information > Also covered by Supplier and Quality Agreements in most cases

Planning for Quality > Begins with development of project plan – Gain complete understanding of project objectives from: • Sponsor project information • Information in Master Service and Quality Agreements • Supplier capabilities and performance history > Risk Assessment Using M. I. R. S – i. e. Capturing the Issues

Issues: Capturing and Providing Context Message, Issue, Response, Support > Prepared based on team input and documented in tables > MIRS supports planning and communication based on identifying objectives and issues at the beginning and then regularly reviewing and updating > MIRS tables are a useful and simple way of structuring and recording project information > MIRS tables are a communication tool and support preparation of documents

M. I. R. S. to Define, Capture and Communicate Information Message Issue What do we want or need to say and what can we say? What stands in the way of the message? Response/ Rationale Support How do we Where are overcome the data? the issue? / What reasoning supports our message?

The MIRS Knowledge Process Message Issues Response/ Rationale Support Claims Issues New Studies Designs/data Features and benefits Challenges Refutation Risks Scientific precedent Completed/ ongoing studies Advantages Interpretations Conclusions Comparisons Conflicting Results Questions Re-analysis Expert opinion Publications Guidelines Precedents

M. I. R. S. Example Message Issues Response/ Rationale Support Final purification a) Why was a) Polymorph A a) Lab data step is controlled, polymorph A is the most (thermoresulting in the selected stable form. dynamic and consistent form? stability data) b) Current production of b) Would recrystallizb) LIMS data polymorph A, which polymorph B ation (Polymorph B, is stable and alter the process which is doesn’t change in outcome of ensures specified, has drug substance or bioconsistent not been seen drug product. availability? formation of since the Optimized polymorph A. current purification method of procedure leads to synthesis was the highest quality. established).

Project Quality Plan > Project Quality Plan is a fully integrated subset of the Project Plan. It defines: – Quality expectations for each drug development project – Processes and activities to be completed to ensure quality expectations are achieved at the internal project management level and by suppliers – Rationale for specifying internal review criteria and external supplier assessment methodology

Building Supplier Relationships Supplier Evaluation Supplier Qualification Master Service Agreement Supplier Audit • • Culture and goals Strategic fit Overall expertise Services provided • Specific expertise and previous experience • General capabilities e. g. facilities equipment, staff and workload • Organization structure, staff turnover and affiliation • Financial stability • Project management, communication and reporting • Audit of Quality systems • Tailored project audits

Planning Onsite Audits SUPPLIER TASKS ALLOCATED AREA TARGET AUDIT DATES EXPECTED DURATION CMO 1 > QC testing of API and Drug Product > Drug Product Release > Packaging, Labeling & Distribution > Supply of CTM Tablets GMP December 2003 2 days onsite CRO 1 >Study Monitor / Drug Safety Follow-up GCP February 2004 1 day onsite

Issue and Resolution Log SUPPLIER CMO 1 CRO 1 DATE OF AUDIT SIGNIFICANT ISSUES RESOLUTION DETAILS December 10 -11, 1) Frequent 1) Review 2003 problems with methods dissolution transfer testing package/run comparative 2) Packaging tests area material control 2) Send auditor concern to monitor packaging February 12, 2004 No significant issues identified Not Applicable

Risk Management and the New FDA “The CGMP regulations for drugs have not been updated in 25 years. . . Continuous quality improvement in manufacturing hasn’t been the subject of as much attention in the pharmaceutical industry. . . FDA’s broad-based program is working on developing new guidance based on the latest science of risk management and quality assurance. ” Quotes by Mark B. Mc. Clellan, M. D. , Ph. D. FDA’s Strategic Action Plan – August 2003

Process Analytical Technology The goal of PAT is to understand control the manufacturing process, i. e. , quality cannot be tested into products; it should be built-in or should be by design. Fantastic solution to promote innovation given appropriate resources, but what risk management/quality improvement options are available to “little pharma” and companies with existing products?

Risk Management for the “Little Guy” Hazard Analysis at Critical Control Points (HACCP) An Old Tool with a New Purpose

Back to the Future – Ahead to the Past > HACCP is a tried and tested methodology for monitoring and managing processes > Used by the FDA to protect US food supply since the 1970 s – Since December 1995, FDA requirement for seafood producers to use HACCP principles - estimated to prevent 20 - 60, 000 seafood poisonings/year > HACCP is: – Simple by design – Proactive in practice – Easily incorporated into pharmaceutical compliance programs

Steps for Building the HACCP Plan I. III. IV. Define potential hazards (hazard analysis) Identify measurable critical control points Determine critical limits for control points Establish control point monitoring procedures V. Develop corrective action strategies for critical control point deviations VI. Design effective documentation system VII. Verify effectiveness of plan - periodically

Preliminary Steps for Development of Hazard Analysis Plan > Establish a HACCP Team, including Manufacturing, Quality, Engineering, Validation, Development and the Laboratory > Develop Master Scope Document describing the process or processes to be covered > Create Process Flow Diagram(s) > Group similar/equivalent processes together for consistency

STEP I - Conduct a Hazard Analysis > If you have a formal Corrective Action/Preventive Action (CAPA) Program - just harvest the data > What are the hazards? – – – – Equipment Failures Critical Utility Failures Process Failures Computer Automation Failures Documentation System Failures Operator/Analyst Errors Training System Shortfalls Testing and Measurement Shortfalls

STEP II - Identify the Critical Control Points (CCPs) > A GMP-compliant company has a head start on Step II. Most CCPs for equipment, process, utilities, and computer automation are (should be!) documented in validation files > Challenge is to study CAPA data to learn about the most variable component – PEOPLE > What do you look for? Repetitive errors: – – Batch records Process steps Pieces of equipment Test procedures > Determine root cause of errors – this identifies CCPs

Step III - Establish Critical Limits for Each Critical Control Point > Like Step II, most CCP limits for equipment, process, utilities, and computer automation are established and documented in validation files > Creativity needed to cover the rest of your operation - examples of miscellaneous control limits based on deviations from normal trends: Control Parameter Source of Control Limit Check Point Calibration Deviations Calibration Database Calibration Log Yield Fluctuations Annual Batch Record Review Batch Review Raw Material Variations Vendor Quality Program QC Insp & Release Mechanical Failures Preventive Maintenance Pgm Maintenance Log Training Failure CAPA Program Batch Review

Step IV - Establish Monitoring Procedures (1) "If you can't describe what you are doing as a process, you don't know what you're doing" – W. Edwards Deming > Step IV ties all the GMP control systems together and creates a very powerful proactive tool > Monitoring procedures are standard activities done routinely - by an employee or by mechanical means (including computer controls) - that measure the process at a given CCP and create a record for future use

Step IV - Establish Monitoring Procedures (2) > Elements of the process: – Requires input from cross-functional team – Intervals of measurement determined by considering potential corrective action responses – Team must determine impact of a "critical HACCP finding", i. e. , does process need to stop? – Format for reporting findings to a centralized point must be established

Worksheet for Determining Monitoring Procedures HACCP PLAN DEVELOPMENT FORM: MONITORING PROCEDURES AND FREQUENCY Process or System Category: Process Step/CCP Critical Limits Monitoring Procedures (Who, What, When, How)

Step V - Establish Corrective Actions (1) > CAPA program and HACCP come together at Step V by which time the team has determined the: – Critical Control Points (CCPs) – Critical Limits for each Control Point – Means of Measuring Performance at the CCPs > Step V requires team to answer: 1. Has the cause of a deviation been identified and eliminated? 2. Will the CCP be under control after corrective action has been taken? 3. Have measures to prevent recurrence of the deviation been established? 4. Do corrective action procedures ensure that no product which is injurious to health or otherwise adulterated because of the deviation enters commerce?

Step V - Establish Corrective Actions (2) > Tools for getting the job done: – Meaningful statistical feedback from CAPA Program – Root cause analysis techniques – Responsible employees trained in the principles of c. GMP

STEP VI - Establish Record Keeping Procedures > Comprehensive list of all CCPs monitored plus electronic and/or paper raw data collection files > Quarterly summary of findings by type of hazard > List of batches potentially affected by CCP deviations > Reports formal root cause analysis evaluations

STEP VII - Establish Verification Procedures > HACCP process built on foundation and principles of total quality system – Objective is continuous process improvement – Only achievable by becoming master of every step in your process – no one else can/should know it better > The verification process confirms that HACCP plan is working and involves: 1. Validation of initial phase in which plan is tested and reviewed to determine that CCPs are effective and relevant to a wellcontrolled process 2. Ongoing verification to ensure that monitoring activities provide necessary data without negatively impacting the process 3. Annual reassessment (and modification, if necessary) of HACCP plan to ensure continued relevance of CCPs

Summary > FDA quality expectations for drug development are the same for “big” and “small” pharma irrespective of outsourcing used. > The organization responsible for management of a drug development project must have a core quality program that serves as a foundation for applying quality principles across the project. > Supplier selection and management are key components of drug development project quality. > M. I. R. S. and HACCP are two simple risk management tools that can be applied to any size project.