Increased FDA Scrutiny of Purchasing/Supplier Controls

Multiple perspectives on shifting regulatory burdens

By Braulio Ortiz, Michael Neaves, Jim Dabbs and Peter Stein
BioTeknica, Physio-Control and Admedes Schuessler

In a recent industry conference, FDA Commissioner Margaret Hamburg told manufacturers unequivocally that they bear responsibility for every step in their global supply chain. The responsibility for manufacturers is daunting, as it impacts more than 330,000 suppliers in 150-plus countries worldwide.1 The Agency is backing its regulations with enforcement action — in 2009, 12% of 483 observations and 16% of Warning Letters issued were all related to inadequate supplier qualification.2

How did we get here? Critical components — such as printed circuit boards (device) or Active Pharmaceutical Ingredients (APIs) — were once manufactured internally by Finished Goods Manufacturers (FGM). In an effort to reduce costs and/or regulatory scrutiny, many pharmaceutical and medical device FGMs began outsourcing to suppliers nationally and globally. An increase in failures of these critical components led to recalls and patient safety issues, catching the attention of the FDA and Congress. Some of these incidents, like the 2008 event where a contaminant was found in Heparin API that was sourced from a supplier in China3, resulted in hundreds of serious adverse reactions, scores of deaths and enormous public outcry.

The FDA is not only concerned with failure of some U.S. manufacturers and suppliers to comply with the U.S. Code of Federal Regulations, but also with overseas suppliers. Hence, the Agency recently hired over 700 inspectors to ensure that the FDA performs overseas inspections on a timely basis4.

Regulatory Compliance Expectations – Consultant Perspective (120 Degrees) Regulations and Guidance Documents

An appropriate component supplier and services quality assurance program includes a combination of assessment techniques, including inspection and test. Manufacturers should remember that the purpose of assessing the capability of suppliers is to provide a greater degree of assurance beyond that provided by receiving inspection and test, that the products received meet the finished goods manufacturer’s requirements5.

One recent regulatory enforcement trend is supplier process validation. Although suppliers will most likely use their processes for conducting validation activities – it is imperative that FGMs ensure that validation processes employed by their suppliers meet the minimum requirements of the validation processes of the FGM as part of either:
a)the qualification of the supplier by the FGM, and/or

b)through the review of validation protocols conducted by the supplier for the manufacturer.

This would include all aspects of the validation process, including process output performance levels (i.e., acceptance criteria), statistical requirements, review/resolution of deviations, etc.

Remember: the supplier may own the process, but the manufacturer owns the product.

For pharmaceuticals, the expectation of an API supplier — the equivalent of a critical component supplier for medical devices — is much more clearly defined in “Guidance for Industry Q7A Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients,6” and closely mirrors the same GMP regulations applied for Finished Goods Manufacturers, i.e., CFR 21 Part 211. Additionally, the requirements for API supplier validation are comprehensive, from equipment and facilities qualification to analytical test methods, cleaning, and process validation.

The “gray” area is that the application of the guidance and cGMP requirements depends on the type of manufacturing (e.g., chemical vs. API derived from animal or plant sources vs. biotechnology), cell culture and degree of manufacturing (e.g., cutting, mixing, and/or initial processing vs. isolation and purification), where more complex and final processing of material has a higher degree of applicability.

Under the “Guidance for Industry Quality Systems Approach to Pharmaceutical cGMP Regulations,” the quality systems approach also calls for periodic auditing of suppliers based on risk assessment. The audit should include an examination of the supplier’s quality system to ensure that reliability is maintained and quality is built-in throughout its component manufacturing.7 Although this is only a guidance, it is up to the FGM to provide rationale, through a risk assessment, as to why such an approach was not used, or risk being cited for inadequate establishment of the reliability of the supplier’s analyses (§ 211.84 d(2)).

In addition, the guidance recommends that changes to materials (e.g., specification, supplier, or materials handling) be implemented through a change control system, with certain changes requiring review and approval by the Quality Unit per § 211.100(a). It is also important to have a system in place to respond to changes in materials from suppliers so that necessary adjustments to the FGM’s process can be made — and validated if appropriate, and unintended consequences avoided.

Theoretical Application

So where do we draw the Quality Systems Regulation (QSR) applicability line? Certainly the criticality of the component from a product function perspective and patient safety risk perspective plays an important role as described by the regulations and guidances cited above. However, even a non-critical component — let’s say an excipient in a pharmaceutical — could have a contamination issue through supplier processing and shipping that could lead to patient injury or deaths.

Based on enforcement trends, the base applicable quality systems that all suppliers should have are Change Control (Design and Process), Process Control (including Process Validation where the product quality attributes including stability cannot be fully verified), and Supplier QA for critical raw material suppliers. Other aspects of the FGM’s QS may also apply —Complaint Handling, Statistical Requirements, etc.

Ultimately, manufacturers need to think of their suppliers as if suppliers were part of their in-house production facility.

Pragmatic Realism

The reality is that it will continue to take the industry years to come up to speed on the latest cGMP requirements. The FDA and global regulatory bodies have raised the bar on expectations for supplier controls through recent enforcement actions and issuances of guidances, in particular in the area of supplier process validation.

Manufacturers must identify high-risk component suppliers through a documented risk management process, typically design and process FMEAs (Failure Mode Effects Analysis) that call out the function and effects of failure of the component design or process output and detection controls. Methodologies may include component category risk grids that prioritize remediation efforts based on degree of customization and impact to function and/or safety.

In the end, FGMs will need to balance risk, cost, and quality while maintaining regulatory compliance.

Manufacturer Perspective (240 degrees)

The challenges presented by the stricter interpretation and enforcement of the supplier control regulations are increasingly dynamic for established firms with long-standing supplier relationships and historical paradigms and practices to overcome. These challenges include ensuring that the established quality system elements continue to evolve to meet the stricter interpretation of the regulations around supplier controls.

The continued improvement of established supplier controls includes extending the detailed monitoring of supplier production and process control parameters and ensuring that the supplied part realization processes are validated to the guidelines established by the Global Harmonized Task Force. The suppliers that produce the components or ingredients that present the highest risk to the operation of the finished product are prioritized for first consideration and, when necessary, updated to current standards.

As an interim and mitigating control, a review of the supplier’s process monitoring data gathered during production can be performed by the manufacturer as part of Incoming Quality Assurance (IQA) Inspection activities to ensure that the processes are maintained in their pre-established state of control before using the supplied ingredients. Alternatively, the FGM may choose to increase IQA internal test sampling using a tightened inspection plan. These interim control(s) can be discontinued once the revalidation work has been successfully completed.

Partnering with each supplier ensures that the process validations are successful. The development of the plans and protocols is a joint activity and approvals from both firms are required prior to execution. The burden of cost associated with these revalidations to the current standards should be shared between the firm and the suppliers, as the benefit is mutual and the requirement common to both the pharmaceutical and medical device industries.

The benefits of institutionalizing increasingly rigorous supplier controls goes well beyond sustained regulatory compliance and extends into tangible business outcomes by improving customer satisfaction through fewer supply chain interruptions of commitments and increasing operational leverage by lowering the overall cost of quality.

Supplier Perspective (360 Degrees)

Manufacturers’ increased quality system purchasing controls requirements are creating unique challenges for suppliers. These include:

• Balancing the role of being both a customer and a supplier. In many cases, suppliers may also receive critical components and/or supplies from what would be considered sub-tier suppliers.

• As FGMs react to the expectations from the FDA, many are hastily putting into place new controls – which may vary significantly in requirements from one manufacturer to another. These variations in requirements can, in some cases, manifest themselves into significantly different internal requirements for the supplier. At a minimum, this can add costs to suppliers’ internal processes and can also create confusion for staff.

• Finally, significant new control requirements must come at a cost – and the pressure frequently comes as suppliers to absorb these costs. Although the increased controls will ultimately benefit both the suppliers and the FGMs, the implementation costs need to be shared.

One very practical way to resolve the challenges outlined above is the development, approval, and implementation of a common Supply Quality Agreement (SQA). These Supply Quality Agreements initiate from a common template for all customers that meet the applicable international and U.S. regulatory (QSR) requirements. The common template is then customized to take into account unique customer requirements — including reference to the manufacturer’s quality system requirements.

Once completed, the SQA establishes clear definitions of responsibilities for the supplier and the FGM. Key topics included in the SQA are:

• Ownership of Product Specifications

• Inspection Plans

• Audit Functions

• Complaint Handling

• Change Control

• Process Validation

• Process Controls

• Design Controls

• Control of Sub-Tier Suppliers

• Legal Aspects

• Key Personnel Responsibilities

Although all of the elements listed above are critical to the success of the FGM-supplier relationship, one of the most challenging elements is Change Control. The challenge frequently comes from poorly worded agreements, which often include language such as “significant changes” or “changes that could impact the finished product.” Many times the supplier may be asked to make these decisions for changes that originate in its processes, but in many cases it may not be fully qualified to make such decisions. To ensure effective change control processes are fully implemented requires:

• Clear language within the SQA agreements

• Effective supplier quality system change control processes

• Consistent provision of change control information to the FGM

• Oversight by both the supplier’s and manufacturer’s audit processes

Another important element from the Design Control requirements is design transfer. This is always a critical phase for the supplier because once the customer receives FDA clearance to market its product, there is always a significant push to move from a pre-production/development environment to full production.

Process controls have to be implemented and demonstrated to the customers as required by QSR. As mentioned above, the initial cost of validating a process can be significant, but it inevitably adds value by ensuring a stable process that consistently achieves desired results with a high degree of assurance. Once a validated state is achieved, process controls then need to be established to ensure processes remain in a state of control.

One very important topic for suppliers and for FGMs is the subject of remediation. All of the practices outlined above are challenging enough to implement on a go-forward basis, but the retrospective application of these requirements can be daunting. Although there is not a one-size-fits-all solution here, some key considerations should include:

1. Under whose quality system requirements will the work be performed?
The process of becoming an approved supplier involves demonstrating that quality system processes meet all applicable international quality systems and U.S. regulatory requirements. As such, all work should be performed under the requirements of the supplier’s quality system requirements. The extent of the oversight (review and approval) by the customer should be defined by the SQA.

2. When resources are provided by the FGM, which is responsible for managing the overall resource effort?
Since the work is being performed under the requirements of the supplier’s quality system, and in most cases, the work is being performed at the supplier’s site, it is recommended that the effort be managed by the supplier. As with most resources, the cost of managing the project should be shared.

3. Who will fund the retrospective review and implementation activities?
There is no simple answer here, but since there is a shared benefit to bringing older processes into current requirements, these costs should also be shared. There are also other ways to resolve cost situations, such as negotiating additional product volumes.

Conclusions

With the FDA’s focus on purchasing controls, the following is clear:

• The FDA does not see this as a new requirement, and as such, is expecting FGMs to conduct remediation — where required — within aggressive timelines.

• The bar is rising quickly. Finished good manufacturers that do not take the issue seriously are likely to face regulatory action.

• Where remediation is required, it is very appropriate to utilize a risk management approach to prioritize work, but not to eliminate work. Manufacturers cannot “risk-manage” away the regulatory requirements.

• Develop a detailed SQA that accounts for the FGM’s quality system requirements and clearly defines the FGM’s and supplier’s areas of responsibility.

• Suppliers should not necessarily wait for direction from their FGM customers in this area.

• Collaboration between manufacturers and suppliers is critical to success.

The time to act is now. Depending upon the number of products a manufacturer has on the market, the complexity of the processes that are outsourced, and the depth of the supply chain, the effort required to come into full compliance can be significant. Manufacturers and suppliers that heed to regulatory compliance requirements avoid regulatory action, improve business outcomes, and most important, decrease patient safety issues.


References

1. FDAnews [enewsletters@fdanews.com] on June 26th, 2010.

2. FDA Drug Enforcement: An Analysis of Warning Letter Trends, John Avellanet, FDANews, March 2010.

3. New Data Link Heparin Deaths to Chinese Batches, FDA Says, by Marc Kaufman, Washington Post, April 22, 2008.

4. Seventh Annual Medical Device Quality Congress, June 2-4, 2010, Bethesda, Maryland.

5. Medical Devices; Current Good Manufacturing Practice (cGMP) Final Rule; Quality System Regulation [Federal Register: October 7, 1996 (Volume 61, Number 195), Supplementary Information, Section V. Response to Comments and Rationale for Changes, comment no. 107.

6. Guidance for Industry Q7A Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients, U.S. Department of Health and Human Services Food and Drug Administration, Center for Drug Evaluation and Research (CDER) Center for Biologics Evaluation and Research (CBER), August 2001 ICH.

7. Guidance for Industry Quality Systems Approach to Pharmaceutical CGMP Regulations, U.S. Department of Health and Human Services Food and Drug Administration Center for Drug Evaluation and Research (CDER), Center for Biologics Evaluation and Research (CBER), Center for Veterinary Medicine (CVM), Office of Regulatory Affairs (ORA), pg. 16, September 2006, Pharmaceutical CGMPs.

This article presents the perspectives of three sets of experts:
regulatory compliance consultants, a finished goods manufacturer (FGM) and a supplier. While the FGM and supplier co-authors hail from the device industry, their insights apply to pharmaceutical FGMs and their suppliers. Braulio Ortiz is co-founder and project manager of BioTeknica, Inc. Michael Neaves is senior quality engineer at BioTeknica. Jim Dabbs is vice president of QA at Physio-Control, Inc., a division of Medtronic, Inc. Peter Stein is director of QA at Admedes Schuessler GmbH.