concerns, problems,and difficulties are— those that FDAinspectors look outfor. Then we makesure you know howto address thoseissues properly (seethe “Prepare for anFDA Inspection”sidebar).

Much of aninspection focuseson a company’squality systems. Bydefinition, a qualitysystem is a programthat addresses theneeds and elementsof a specific part of amanufacturing oper-ation. A trainingprogram, for exam-ple, is a qualitysystem — a qualitysystem that definesin detail how thecompany will ensure

that its employees have the proper knowledge tocarry out their responsibilities.

Pharmaceutical and biotechnology companiestypically determine how they are going toclassify their quality systems. Quality systemstypically include standard operating procedures(SOPs), monitoring programs, change controlpolicies, validation programs, training, deviationand investigation programs, and consistent docu-mentation practices.

Our survival guide, therefore, also begins byfocusing on quality systems: on determiningthose quality systems needed and in place, onascertaining how practical particular qualitysystems are, and on checking how well thosequality systems have been implemented andfollowed. It is the responsibility of a company’smanagement to ensure that quality systems are inplace, reviewed periodically, upgraded, imple-mented, and followed.

S TA ND A R D O P ER AT ING P R O C ED U RESSOPs are a critical quality system feature, andthey frequently get inspected — their contents,the quality of their preparation, and how wellthey are followed. SOPs are detailed documentsthat specify operating guidelines and instructionsfor every procedure within the company.

For many companies, coping with anFDA inspection can be a nightmare.Workloads increase significantly before,during, and after an inspection, andthere is always the potential that a majorregulatory economic downfall could bepart of a company’s future if the inspec-

tion yields negative or mixed results.This three-part series addresses common

issues that arise during an FDA inspection andprovides advice on how to prevent those difficul-ties. Part 1 describes those actions and programsthat must be part of routine operations, whetheran inspection is imminent or not. Part 2 focuseson inspection day — and what to do during thatexamination. Part 3 follows the aftermath —responding to inspection results, implementingcorrective actions, and learning from the entireinspection process.

We don’t try to predict all the possiblequestions and concerns that can come up duringan inspection. Even an FDA inspector couldn’tdo that. Instead, we discuss common deficiencies.This survival guide ensures that you know whatan inspection is, what aspects of company opera-tions (equipment, documents, tests) are likely tobe inspected, and what the most common

Would your companysurvive a surprise

inspection? An FDAinspection can be a

nightmare that costsyour company money,time, and reputation.Proactive managersunderstand the logic

behind FDA regulationsand prepare accordingly.

This three-part survivalguide to inspections

(whether from FDA, aclient, an investor, or aEuropean agency) will

sharpen your vision of your company’s

regulatory compliancepicture.

20 BioPharm AUGUST 2002

Massoud Lavian and Paul W. Allen

Figure 1. Validation protocols for a typical softwarelife cycle

BioPharm AUGUST 2002 21

SOPs — two to do. Two types of SOPs arecommon. The first type is corporate or globalSOPs (policies and procedures set forth by thecompany’s highest management level), that de-scribe general company policies. A company’s di-visions, functions, and groups subject to GMPrequirements (that is, all departments excludingfunctions such as finance, marketing, and sales)are required to comply with global SOPs (1–3).

Local SOPs document routine tasks and makeprovisions for nonroutine tasks for all specificfunctions or departments within the company.These documents detail the tasks that must beperformed at each step in the manufacturingprocess. Examples of these tasks include steril-ization, equipment operation, emergencies, anddocumentation practices. Examples of observa-tions that FDA inspectors make about SOPs arelisted in the “SOP Failures” sidebar. Remember,SOPs are the first line of defense during an in-spection: They describe how procedures and situ-ations are supposed to be handled, even those sit-uations, such as an emergency or a contaminatedbatch, that a company has never faced before.

Monitoring systems. Another quality system thatis closely scrutinized during a typical inspection isthe monitoring program. Typically, a productionsite must have a continuous monitoring program ofall critical elements of the manufacturing opera-tion. Critical elements include, for example, build-ing and equipment monitoring, water qualityassessment, environmental monitoring, andmicrobial level measurements in aseptic fill areas.

Monitoring samples. The monitoring programclearly defines what needs to be sampled andwhen, how the sample is taken, and how thesample must be handled and tested. It alsooutlines acceptable results supported by valida-tion studies. Monitoring programs must includeprovisions for test results outside acceptablelimits, assigning action and alert limits, address-ing who needs to be notified, assessing the effectof the out-of-specification (OOS) result, andapproving and implementing a corrective action.Responsibility must be assigned to a specificperson who reviews the results in each area andidentifies trends in the data.

OOS results. FDA observations about monitor-ing programs cite the lack of clear specificationsfor when to sample, the location from which todraw the sample, the number of samples, andpoor handling for OOS or failed test results. It isinevitable that at some point a test result will fail.(In fact, an experienced inspector will doubt thevalidity of test results that remain acceptable overlong periods of time.) Inspectors want to knowhow the failed result was handled, how the effectof the OOS result was assessed, how the correc-tive action was agreed upon, who approved thecorrective steps, what the thought processes werebehind the final decision about corrective action,and how the entire episode was documented.Therefore, before your company is notified thatan inspection is imminent, review your monitor-ing programs and make sure they are sound androbust.

DesignVendor audit

Functionalrequirements

Vendor RFP

Validation master plan

Configuration design

Program designspecifications

21 CFR Part 11assessment

Security plan

Data migration plan

Tool description

Hardware description

Installationqualification

Acceptance criteria

DevelopmentSource code

Configuration

Vendordocumentation

SOP development

SOP validation

SOP system use

Change controlprocess

Audit trailspecifications

TestingUnit testenhancements

Change control

Traceability matrix

System test useracceptance

Problem reportresolution

Training

Operationalqualification

InstallationPerformancequalification

Stress test

Disaster recovery plan

Validation summaryreport

MaintenanceRoutine audits

Back-ups and archive

process is carried out is the best example of howwork is planned, executed, and documented on adaily basis. Therefore, the quality of a company’svalidation program shows an inspector the levelof detail and technical knowledge that thecompany applies to day-to-day operations. Evenif an inspection does not start with validation, italmost always raises issues that can be tracedback to the original validation work.

A comprehensive validation program startswith policies that establish guidelines and respon-sibilities for validation processes. Those policiestypically cover procedures for preparing, review-ing, approving, executing, and completing thevalidation plan.

In separate documents, the validation require-ments for individual areas, such as laboratoryequipment and processes, computers, cleaning,and utilities, among others, must be clearlydefined. This set of documents establishes a com-pany’s commitment to its validation efforts. Thedocuments also establish a requalificationprogram at timely, preestablished intervals toverify the results of the original validation effort.

A validation master plan (VMP) is also essentialbecause it establishes a company’s validationplans for the near future. It should include a listof validation activities that the company plans tocomplete within a reasonable time frame. Once aVMP is approved, periodic reviews will ensurethat validation plans are on schedule assuring in-spectors that the company is committed tocompleting its validation tasks. VMPs do not,however, replace completed validation efforts.

Validation protocols are the most critical elementof a validation program. Figure 1 shows the vali-dation processes in a typical software life cycle.Creating validation protocols is an extremelydetailed process, but as a general rule, companiesshould ask the questions in the “Before an

VAL IDAT ION PROGRAM SAt your next staff meeting, ask your coworkers,“Does our company have a comprehensivevalidation program in place?” Be prepared forseveral interesting responses.

Validation programs are arguably what inspec-tors are most interested in when they visit yourcompany. During validation, critical parametersand acceptable ranges are established forprocesses and equipment. The quality of the vali-dation program indicates how tests are performedand documented, how deviations are handled, andhow conclusions are reached. How a validation

This list of five “To Do or Not to Do” items will help you prepare for anFDA inspection.

Don’t procrastinate. Never wait until the last minute to prepare for a scheduledinspection. At a minimum, examine your quality systems, your training program,how well your SOPs are being followed, your documentation, and yourcorrection processes at departmental levels on a regular basis. This will ensurethat you are current with any changes in your systems and are properlydocumenting them.

Correct issues that FDA has already cited. Make sure that all corrective actions havebeen taken and thoroughly documented. Simply knowing that a problem existsis not a defense. Be proactive, and review public records on actions the agencyhas taken against other companies.

Assign responsibilities. Assign specific responsibilities to departments. Allow thedepartment leader to assign the responsibility to a specific individual or job role,making both the department leader and the individual accountable. Build theresponsibilities directly into job descriptions, and make them part of anemployee’s annual review. There is no substitute for accountability.

Document everything. FDA’s unwritten rule is that if something is not documented,it either does not exist or never took place. Follow good documentationprocedures (GDP). Technology makes it easy to follow established formats andrequirements.

Work with QA, not against it. The QA department is responsible for overseeingquality system implementation and approves final decisions. Ultimately, theresponsibility of producing drugs and devices rests with QA (actually there’s not alot of resting involved). So work collaboratively with them instead of against them.

To Prepare for an FDA Inspection

A proactive manager asks questionsabout the company’s validationprotocols well before an inspection isanticipated. Questions such as thefollowing will shine a light on any fog inyour company’s regulatory compliancepicture.

Is our validation approach sound? Thatis, are we testing what we should betesting? Is our validation approach in linewith current industry practices and withthe latest guidelines?

Are our validation protocols clear anddetailed enough that they can be followedeasily without further explanations?

Are all equipment, computer systems,processes, utilities, and lab equipmentvalidated? Has the final report for thosevalidation activities been reviewed andapproved?

Does our validation effort establishoperation limits? Are those limitsincorporated into our daily operation? Areinstructions in place on what to do whenthose limits are exceeded?

Are all instructions in our general protocol followed? If not, why?

Are all results supported by data andreproducible?

Is our company’s requalification programon track and on time?

Are all our validation documentsassembled, reviewed, and included? What is the quality of our company’sdocumentation?

Are all GMPs included and followed inour validation efforts?

Before an Inspection

22 BioPharm AUGUST 2002

BioPharm AUGUST 2002 23

D EV IAT IO NS A ND C O R R EC T IO NSAnother frequent focus during inspections is acompany’s deviation management and its correc-tive actions. Deviations can occur during manu-facturing, validating, laboratory testing, orprogram monitoring. Deviation management is aprogram under which OOS results are reviewed,analyzed, trended, and corrected. Typical ques-tions that an experienced inspector has in mindwhen inspecting a company’s deviation manage-ment and corrective actions are listed in the“Inspecting Deviations” sidebar.

Deviations can take place when manufacturingequipment breaks down or when operators makeerrors. In these circumstances, it is important toanalyze trends in the deviations and to determinethe reason for the failures. If there is a trend, whatis causing it? Is it user error or improper equip-ment use? If the equipment is being used improp-erly, was there an SOP on the machine, and wasthe SOP being followed? Deviations are red flagsthat can portend even bigger problems.

T R A I N I N GA review of the most recent citations issued tocompanies by FDA shows that many of the issuesthey cite relate to human error (4). The key toovercoming human error problems is proper andfrequent training.

Inspectors examine training records when theyreach the conclusion that improper use of themachinery or human errors are the cause of acited issue. The inspector in these cases will natu-rally ask if proper training was conducted. There-fore, you need to ask the questions first.

When evaluating your company’s trainingprogram, be sure to document your responses totraining questions. Does a formal programmandate training? Does the training programspecify who needs to be trained and on whatequipment or processes? Are training materialspresented properly by a qualified trainer? Do thetraining records indicate who was trained and on

Inspection” sidebar about the company’s valida-tion programs.

BATCH RECORDSThe biopharmaceutical industry generatesmassive batch records (about the size of tele-phone books) full of comprehensive data thatinclude each step taken during manufacturing anda log of the necessary controls, checks, andbalances. These documents are a compilation ofproduction records, test data for raw materials,components, and product integrity. Everything isdocumented in batch records: the vials used, theequipment used, and the product temperaturewhen machines are in operation, among manyother items. Batch records are the ultimate proofthat the batch was prepared using established andpredefined steps.

Batch record violations. Batch records are oftenone of the first items that FDA inspectors examinefor deviations, missing information, the quality ofa company’s documentation practices, and otheroperating weaknesses. Inspectors want to assesswhether the company’s records are comprehensiveenough to reflect all production facts, how thecompany’s quality assurance department reviewsthe records, how deviations are detected and re-sponded to, and whether there is any missing datain such documents. FDA frequently cites compa-nies that fail to properly analyze their batch recorddata, that keep inadequate data, that fail to describedeviations in detail, or that provide insufficientresponses to deviations. If batches are OOS, com-panies must understand why and demonstrate thatthey can correct the problem and prevent recur-rence. Such documents can be long and the analy-sis process tedious, but the process can result incost savings if the company can identify ways tosolve ongoing problems.

Batch records as preventive measures. Batchrecords can clear a company’s name and disprovesuspicions of wrongdoing. In 1982, McNeilConsumer Products, a division of Johnson &Johnson (www.jnj.com) and the maker ofTylenol, was faced with product alteration inwhich Tylenol was laced with cyanide, causingseveral U.S. deaths. McNeil’s batch recordshelped the company defend its procedures andsupported the theory that the problem was not aproduction deviation but postproduction tamper-ing. Therefore, a company should pay closeattention to the contents of its batch records, howthose records are filled out during operation, andhow the documents are reviewed.

Following are typicalquestions that anexperienced inspector hasin mind when inspecting acompany’s deviationmanagement andcorrective action plans.

Is a formal investigationprogram in place to addressdeviations?

Are deviations noticed bychance, or are they detectedin a timely manner duringsystematic evaluation?

How was the effect of thedeviation determined? Whoapproved that determination?

Was trend analysisconducted under a formalprogram or SOP? Was therea global approach todetermining whether adeviation was an isolatedincident? Was a trenddetected?

Was the root cause of adeviation found andcorrected?

Who was involved indetermining correctiveaction? How was thecorrective action decisionreached?

Was the investigation of thedeviation performed andconcluded in a timelymanner?

Was corrective actionuniversal? Was it effective?

What was done to preventthe deviation from happeningagain?

What measures were takento assess the correctiveaction to ensure that it wouldnot be the source of futuredeviations?

Were all of the above actionsproperly documented?

Inspecting Deviations

24 BioPharm AUGUST 2002

glassware, clean gowns, coveralls, and chemicalsor components that are used to manufacture drugsand medical devices.

A receiving and inspection program needs todefine the expectations about each commodity oringredient being received. The SOPs on theprogram should state those steps that need to betaken when ingredients or components arereceived to ensure that the material received meetsexpected quality attributes. The SOPs may includea review of vendor certificates of analysis and oftest results, or they may require internal samplingand testing approved by the quality assurance andquality control (QA/QC) functions within thecompany. When a company conducts sample tests,it must document the results properly. Companiesconcerned about quality standards often considerthird-party organizations that can conduct tests andconfirm the required attributes of the raw materi-als. If this route is chosen, the outside testing labo-ratory should be audited and qualified.

C H A NG E C O NTR O LThroughout the manufacturing operation andwithin all production processes, change isinevitable. New process steps, changes in equip-ment, and improvements or corrected inadequaciesall cause change within a company’s operations.

A formal program must be in place to handlechanges. Inspectors often focus on this facet ofproduction during an inspection. Inspectorsreviewing a company’s change control programswill ask if a formal change control program is in

place, who adminis-ters the program,and whichdepartment has ulti-mate authority overchange control.They will ask howthe effects of achange are as-sessed, what stepsare taken to mini-mize or prevent ad-ditional impacts,how decisions aremade, the thoughtprocesses behind

change, and who approves them. And, as in allother production processes reviewed, an inspectorwill want to know how the entire change event, theactions taken in response to the change, and the de-cisions made regarding the change have been documented.

what equipment or process? Are the recordsavailable for inspection? Was training effectivein preventing further deviations?

Inspectors can choose to determine the effec-tiveness of a company’s training for them-selves. For example, they may observe thegowning procedures for entering classifiedareas when the cause of a contamination prob-lem was determined to be improper gowningpractices. To be proactive and prevent the needfor this type of inspection, companies should setup comprehensive training programs thatclearly define who needs training, what type oftraining they need, and how frequently addi-tional or refresher training will be required.Training programs attended should be docu-mented and attached to each employee’s record.

RECE IV ING AND INSPEC T IO NMost companies have standard procedures inplace for accepting raw materials and consumablecommodities. Receivables include not only activeingredients and excipients but also items such as

Reviewing FDA warning letters (4) to other companies can help ensurethat your company isn’t making the same mistakes. The most frequentlycited SOP failures include:

• Lack of global or corporate policies (at upper management level) for all majorelements of the company’s operation: validation, change control, batch release,and other functions

• Lack of local (departmental or functional) level procedures for every job andtask in all company operations

• Lack of clarity or specificity in SOPs, which must not require or allow individualinterpretations

• Lack of proper training (when employees covered by an SOP are not trained onthe contents of that document)

• Lack of assigned responsible functions for each specific task (SOPs mustassign specific responsibilities, defining who is responsible for carrying out eachparticular task)

• Lack of or incomplete document history file (each SOP must have a history filethat includes the entire history of that document, the reasons for any changes,and approval documentation)

• Use of outdated SOPs (an SOP system must be properly set up to archive andremove outdated SOPs from circulation; audit trails now allow this to happenautomatically, if the information technology (IT) team sets them up properly); amechanism must be in place to ensure that the latest version of each SOP isavailable and in use at all times

• Failure to follow SOPs (all SOP instructions must be followed word for wordwithout exception); in extreme cases of deviation, documentation on whathappened, why it happened, what the effect was, how it was corrected, and whoapproved the corrective action must be provided; SOPs should describe how tohandle deviations, actions that must be taken, and necessary approval levels

A majority of inspection observations relate to SOPs that were not followed andthe lack of appropriate instructions when a deviation occurred.

SOP Failures

Continued on page 49

Corresponding author Massoud Lavian is assistant director

of compliance and Paul W. Allen isthe managing partner responsible forlife sciences at Clarkston Consulting

(a management and IT consulting firmspecializing in FDA and validation

issues), 595 Market Street, Suite 1450,San Francisco, CA 94105,

310.869.4060 or 888.486.1141, ext. 4931, fax 415.354.8743,

mlavian@clarkstonconsulting.com,www.clarkstonconsulting.com.

BioPharm AUGUST 2002 49

D O C U MENTAT ION PRACT ICESPeople in the biopharmaceutical industry oftenjoke that, “In God we trust, everything else mustbe documented.” That phrase speaks for itself —and for the mountains of documents that regula-tory compliance requires.

FDA inspectors insist on reviewing documen-tation processes. Documents are the only proofthat companies have with which to defend theirpractices and operating procedures. Therefore noamount of effort put into preparing proper docu-ments is in vain. Long before an inspection,review your company’s documents . . . and thenreview them again. Find and fill document gaps,obtain approval signatures, be clear — and, mostof all, be factual in your documentation. Alwaysremember, “If you don’t have the proper docu-mentation for an action or item, you don’t havethat item, or no action was taken.”

TO PREPARE . . . PERCHANCE TO SUCCEEDTo biopharmaceutical, pharmaceutical, medicaldevice, outsourcing, or other health care–relatedcompanies, an “inspection” translates to an “FDAinspection.” But inspections come from othersources as well, from your customers as due dili-

gence audits, from European and other nationalinspecting agencies, and from potential merger,acquisition, and investing partners.

Preparation for an inspection is critical.Responsible individuals within the company mustask all the questions listed in this article to deter-mine how the company’s operations are function-ing. Responsibility must be assigned to those whocan ensure success. Rules and regulations can becumbersome and time consuming, but they servespecific purposes. Proactive managers are thosewho understand the logic behind the regulationsbefore they attempt to implement them.

REFERENC ES(1) “Current Good Manufacturing Practice in

Manufacturing, Processing, Packing, or Holding ofDrugs,” Code of Federal Regulations, Food andDrugs, Title 21, Part 210 (U.S. Government PrintingOffice, Washington DC), revised 1 April 2001.

(2) “Current Good Manufacturing Practice for FinishedPharmaceuticals,” Code of Federal Regulations,Food and Drugs, Title 21, Part 211 (U.S.Government Printing Office, Washington DC),revised 1 April 2001.

(3) “Biological Products,” Code of Federal Regulations,Food and Drugs, Title 21, Part 600 (U.S.Government Printing Office, Washington DC),revised 1 April 2001.

(4) FDA Warning Letters. Available at www.fda.gov/foi/warning.htm (accessed May 2002). BP

Survival Guide continued from page 24