49 – Audit Readiness and Advanced Topics (S20E4)

Okay so today we're going to do a deep dive into
something super important for anyone in manufacturing
and especially if you're in any kind of regulated
industry. We're talking about audit readiness.
Yeah and you know what's interesting is that
we hear audit and I think people immediately
get a little tense. But really what we want to
do is flip that script a little bit and think
of it more as an opportunity to showcase how
awesome you are. Exactly. And how strong your
systems are. Yeah. And I think that's really
what audit readiness is all about. It's not just
about passing the audit. It's about really building
that robust operation. Yes. And we're going to
go even a step further and talk about some of
the advanced topics like KPA. corrective and
preventive action and risk management, all these
things that really play a role in making sure
you're truly audit ready. So just to give you
a sense of what we've looked at. We've got those
foundational regulations. Your 21 CFR is like
110, 111, 211. Those are the real core ones for
food and drugs. Absolutely. But we've also gone
deeper. We've looked at specific industry guidelines.
We've even got some transcripts from FDA training
sessions and webinars from experts in the field.
That's great. So a real wealth of information
to pull from. So we're covering a lot of ground
here. Yeah. So let's start with the basics. When
you think about getting ready for an audit, what's
the first thing that pops into your mind? Proactive.
Proactive. Absolutely proactive. This is not
something you can just cram for the night before.
You can't pull an all -nighter for audit readiness.
This needs to be baked into your day -to -day
operations in an ongoing state of mind. And one
of the most effective tools... for really getting
into that proactive mindset is doing mock inspections.
Oh, mock inspections. Yeah. That's like a fire
drill. Exactly. That's like a fire drill for
your quality system. Right. You want to make
sure everyone knows where to go, what to do.
Exactly. And it gives you that opportunity to
find those little weak spots. Yeah, those vulnerabilities.
And a safe environment, right, before the real
pressure is on. Yeah. No one's going to shut
you down based on a mock inspection. Exactly.
So you can really learn and improve. So it's
a learning opportunity. Yeah. Beyond these mock
inspections, what else falls under this whole
idea of being proactive? Well, I think a huge
part of it is this idea of continuous improvement.
Oh, yeah, continuous improvement. It's not just
about meeting the bare minimum. Right. You know,
the regulations set a floor. Yeah, foundation.
But you want to be striving to go above and beyond
that. So it's not just a checklist. No, no, no.
It's about looking at your processes and saying,
how can we make this better? How can we always
be getting better? Exactly. And that's something
auditors really pick up on. They can see that
you're not just complacent. Yeah, they can see
that you're actively engaged in quality. OK,
so we're being proactive. We're always looking
for ways to improve. And I'm guessing this all
really hinges on good documentation. Oh, you
hit the nail on the head there. Documentation
is key. Yeah, we actually looked at the transcript
from this annual GMP refresher training that
the FDA did back in 2022. Oh, interesting. And
they were very clear. Yeah. Bad documentation.
That's a big no -no. Right. It's like the first
impression you make with the auditors. Right.
And if that's bad, it can really set a negative
tone for the whole audit. And it makes their
job harder, too. Exactly. If they can't follow
your trail of thought through your documentation.
Yeah, they're gonna have more questions. Exactly.
They're gonna dig deeper. Right. And that's not
what you want. No, that's not what you want.
So when we're talking about good documentation
practices for audit readiness. What are some
of those key things that we need to be thinking
about? Well, a lot of the sources really highlight
some basic but really important things. So if
you're doing any kind of handwritten records,
make sure you've got enough space for all the
entries. Right. Legible. Legible using permanent
ink. Oh, yeah. So no pencils. Right. And never,
ever overwrite a mistake. Oh, really? Yeah. If
you make a mistake, what you want to do is cross
it out with a single line initial and date it.
So you can see what the original entry was. Exactly.
You want to have that transparency and accountability.
So that's handwritten records. What about those
batch records? Oh, the batch records. Those are
critical. I mean, we looked at six FDA 21 CFR
Part 211 production and process controls and
also the pharmaceutical master validation plan.
Right. And they both really stress that the batch
record needs to tell the whole story of that
particular batch. The life story. The life story,
exactly. So how was it made? What controls were
in place? Or all the materials, right? Right.
was the facility inspected before you started,
everything needs to be documented. And it needs
to be verifiable. Exactly. And 21 CFR 211 .122,
I think you mentioned. Yeah. That's a big one.
It's a big one. It talks about the need for written
procedures for all aspects of material handling.
Oh, wow. OK, so that's a lot of procedures. It
is a lot. It covers everything from receiving
and identifying the materials to how you store
them, how you sample them, how you test them.
Makes sense. And that's not just for the product
itself. It's also for the labeling and packaging
materials. So every component that goes into
the final product. Every single piece. And there
was a YouTube transcript that really drove this
home. It was on 21 CFR 111 GMP laboratory overview.
And they were focusing on dietary supplements.
But the message was the same. You need those
clear written procedures for every single lab
operation. Makes sense. So, okay, we've got our
procedures, we've got our documentation, we've
done our mock inspections, we're feeling pretty
good. We're feeling ready. Yeah, and the audit
team walks in the door. What do we do now? Well,
don't panic. OK. We actually got some really
helpful tips from the FDA's clinical investigator
training course. OK. The CITC, and this was for
the 2024 course. Now, they mentioned that some
inspections, you might get a little heads up.
OK. Like maybe five days in advance. A little
pre -announcement. Yeah. But the length of the
inspection itself, that can really vary. OK.
It often depends on how many protocols they're
looking at. Right. So if it's a more complex
operation, it might take longer. Exactly. And
one really crucial piece of advice they gave
was about those serious non -compliance issues.
OK. If the investigators flag something during
the inspection, you need to take it seriously.
Right then and there so don't wait until the
end to address it. No, no, no, okay Don't think
oh, we'll just fix it later. Got it They actually
suggest you start investigating and correcting
it immediately Wow, okay if that all possible
because if you address those concerns right away
You might be able to keep them off the 483. Oh
the 483 that's the official list of observations,
right? Exactly. It's like their report card.
So you want that to be as clean as possible So
it shows you're being responsive. Yeah, it shows
you take quality seriously. You're taking their
feedback to heart exactly now what What happens
if we disagree with something that the auditor
points out? Well, the good news is you're allowed
to disagree. OK. The CITC transcript actually
addresses this. OK. It's perfectly acceptable
to respectfully disagree with something on that
483. OK, respectfully disagree. Right. It's all
about how you handle it. OK. So when you submit
your KPA response. Yeah, our Corrective and Preventive
Action Plan. Right. You need to include a clear
explanation of why you disagree, your rationale,
and any documentation that supports your position.
So you gotta back it up. Exactly. Okay, the audit
is done, everyone said their goodbyes. Now what's
next? What happens in that follow -up phase?
The follow -up is crucial, and this is where
that KPA process really kicks into gear. Okay,
tell me more about this KPA process. Well, we
saw in season seven, Advanced CGMP Topics, that
KPA is really a cycle. It starts with identifying
the issue, then you take action to correct it,
but then you gotta go further. You gotta prevent
it from happening again. So it's not just a one
and done. No, it's about continuous improvement.
Right. And the book KPA for the FDA -regulated
industry, they actually break down the different
parts of a KPA plan. OK. So you've got your corrective
action. That's the immediate fix. OK. Then you
might have some interim corrective actions. OK.
Those are kind of like band -aids until you can
implement the permanent solution. Got it. And
then you've got those all -important preventative
actions. Right, to stop it from happening again.
Exactly. And they suggest that a good KPA plan
takes about two to four weeks to develop. It
seems reasonable. Yeah, it's not something you
can just rush through. No, you got to really
think it through. You got to do your root cause
analysis. Right. Figure out what went wrong and
how to prevent it in the future. OK, so we've
got our KPA plan. We're working on implementing
it. And I think you mentioned the FDA looks at
the investigators' recommendations. Yeah, that
came up in the Understanding FDA Inspections
and Data YouTube transcript. OK. Apparently,
those recommendations carry a lot of weight.
So the investigator has some influence on the
overall outcome. Oh, yeah. And most companies
respond to the 483 within 15 business days. OK.
But there's this one classification on the FDA
dashboard that you really want to avoid. Oh,
what is it? It's called OAI. OAI. Official Action
Indicated. OK. And basically, it means the FDA
is not happy. Not happy at all. No. They found
some serious GMP issues. OK. And they're probably
going to take some further action. So OAI is
a bad sign. Yeah. It's a sign that you've got
some work to do. OK, so let's talk about risk.
How does risk management fit into this whole
audit readiness thing? Well, risk management
is really becoming a cornerstone of GMP. And
it's all about being proactive instead of just
waiting for things to go wrong. We're trying
to prevent them in the first place. Exactly.
And season three, key elements of good manufacturing
practices. That's a good introduction to risk
management. OK. And it talks about. QRM, quality
risk management. And this involves assessing
your risks, controlling them, communicating them,
and then reviewing them on a regular basis. So
it's a cycle. It is a cycle. And the main guidance
document for QRM is ICHQ9. ICHQ9. Got it. Yeah,
and that lays out the main principles. So what
are those core principles of risk management?
Well, there are two big ones. OK. First, your
risk assessment needs to be based on science.
Makes sense. You've got to understand your processes.
And ultimately, you've got to be focused on protecting
the patient. Of course, patient safety is paramount.
Absolutely. And the second principle is that
your risk management effort should match the
level of risk. So you don't need to go overboard
on something that's a minor risk. So it's a risk
-based approach. Exactly. You want to focus your
resources where they'll have the biggest impact.
That makes sense. So how does all this risk management
stuff play out in real life? Well, we saw a really
good example in the FDA CITC 2024 day three transcript.
They talked about using risk assessments to identify
what they call critical to quality factors. OK.
And these are things that could really impact
the quality of your product. Makes sense. And
they use these risk assessments throughout the
whole lifecycle of a study. Oh, wow. From the
design to the conduct to the analysis. That's
pretty comprehensive. It is. And then there's
a book by Adrian P .G. It's all about cell therapy
facilities. And it gives a really interesting
example of how risk management even affects the
design of the facility itself. Oh, wow. So for
example, they talk about using positive pressure
in manufacturing suites. And that's a risk control
measure. So it's not just about the processes.
It's about the physical environment as well.
Exactly. You're trying to protect the product
from any potential contamination. It's all interconnected.
Yeah. And then there's FMEA. FMEA. Failure Mode
and Effects Analysis. Yeah. And that's a tool
that's often used to figure out where things
could go wrong in a process. OK. So you're proactively
identifying. potential problems. Exactly. And
then you can put in place preventive actions.
To stop them from happening. Right. And we saw
that mentioned in quality risk management in
the FDA regulated industry. So risk management
is really about being proactive and preventing
problems before they even happen. Absolutely.
OK. So we've covered a lot of ground here, but
we got to talk about what's on the horizon. Right.
What are some of those emerging? regulatory expectations
and industry trends. Well, one thing that's been
really clear from the data we've looked at is
that data integrity is a huge focus for the FDA
right now. Data integrity. Yeah, and we're seeing
this reflected in the 483 observations. So citations
for things like 21 CFR 211 .22D, which talks
about the quality control unit's responsibilities,
and 211 .192, which is all about reviewing production
records. Those are way up. So they're really
cracking down on data management practices. They
are, because if your data isn't accurate and
reliable, you setting yourself up for problems.
Right. Garbage in, garbage out. Exactly. And
this ties into the whole trend towards electronic
records and electronic signature. You get 21
CFR Part 11. That's the big one. OK. And there's
also a YouTube video on good documentation practices
for electronic systems. Interesting. And they
all stress the importance of things like audit
trails, control over document issuance, and a
big one is making sure that original data is
recorded directly into the official system. Oh,
okay. So no more scribbling on sticky notes and
then transferring later? No, no, no. That raises
all sorts of data integrity red flags. Right,
because you could lose the sticky note. Exactly.
So get it into the system right away. Got it.
So what other trends are you seeing out there?
Well, there's a lot of talk about advanced therapies.
Oh, yeah. Cell and gene therapy. Exactly. And
we touched on this in season one foundations
and history of CGMPs. But these are really complex
products. They're living systems. Right. And
that means. even stricter controls. Makes sense.
Especially around things like contamination and
chain of custody. Yeah, you got to make sure
you know where those cells have been. Exactly,
every step of the way. And then there's this
new thing that the FDA is doing. Hey, what's
that? It's called a remote regulatory assessment.
OK. Or RRA. RRA. And they talked about this in
the FDA CITC 2024 day three transcript. And basically,
it's a way for them to assess compliance remotely.
Oh, wow. So they don't even have to come to your
site. Yeah, it can be mandatory or voluntary.
Interesting. But it's definitely a trend to watch.
So be prepared for your close -up, even if it's
through a screen. Exactly. And then another big
concept is quality by design. Oh yeah, I've heard
of that. And this is really taking off in clinical
trials. ICHE8R1 talks about it. And so does the
FDA CITC 2024 day one transcript. OK. And the
idea is that you're building quality into the
trial from the very beginning. So it's not just
an afterthought. Exactly. It's part of the design.
Got it. And ICHQ5A. Yes. That one emphasizes
comparability. Especially for biotech and biological
products. If you make any changes to the manufacturing
process, you got to show that the product is
still comparable. So you're not introducing any
unintended changes. Exactly. And finally, there's
this report, a 10 -year analysis of FDA 483 observations.
And their big takeaway was that collaboration
and technology are key. Collaboration in technology.
Yeah, the industry needs to work together and
invest in new technologies to make sure the drug
supply chain is safe and reliable. Okay, so that's
a lot of information. It's a lot. If we had to
boil it all down to the essentials, what are
the key takeaways for our listeners? Well, I'd
say it comes down to a few things. Number one,
proactive audit preparation. Mock inspections
are your friend. Okay. Number two, documentation.
Right, gotta get that right. It's gotta be thorough,
accurate, and complete. Okay. Number three, master
the KPA process. Yeah. Understand how to correct
issues and prevent them from coming back. Prevent
them from coming back. Number four, embrace quality
risk management. Right. Make it part of your
everyday operations. Got it. And number five,
stay informed. Do they inform? The regulations
are always evolving. Yeah. New trends are emerging.
Right. You got to keep up. So it's not just a
one -time thing. No. Audit readiness is an ongoing
journey. It's a way of life. Exactly. So for
our listeners out there, think about what we've
talked about today. Yeah. How can you be more
proactive in your risk management? How can you
implement those continuous improvement principles?
Absolutely. And what about a mock audit? Could
you benefit from a mock audit? I think everyone
could. Or maybe a deep dive into your documentation.
Where could you improve? That's something to
really think about. Some food for thought. Yeah.
This has been another deep dive. It has. Thanks
for joining us. Thanks for having me. We'll see
you next time. See you then. Bye.