64 - FDA 2025 Inspection Operations Manual - What to Expect When You’re Expecting… an FDA Inspection (S19E8)

Welcome, everyone. Today, we're doing a deep
dive into a really crucial document for anyone
in the pharmaceutical world, the FDA's Investigations
Operations Manual. You might hear it called the
IOM. That's right. Think of it as, well, the
FDA's internal roadmap for how they actually
go about inspecting pharmaceutical facilities.
Exactly. And we're going to unpack what this
means for you, especially if you're working in
quality regulatory affairs or compliance. Understanding
the IOM, and we'll focus a lot on chapters five,
which covers inspections, and eight on investigations,
well, it gives you a real edge. It's about getting
inside the inspector's mindset, you know? How
they approach their job. Precisely. And it's
particularly relevant now, given the recent changes
at the FDA. You mean the shift from ORA to OII.
Yes, exactly. The Office of Regulatory Affairs,
ORA, has transitioned into the new Office of
Inspections and Investigations, or OII. Which
sounds like it puts an even bigger spotlight
on the inspection side of things. It certainly
seems that way. Having OII as a standalone office
really underscores how vital these inspections
are for, well, ensuring drug quality and safety.
Makes sense. So our mission today, if you will,
is to arm you with practical insights pulled
straight from the IOM and related guidelines.
the goal, to make you feel more prepared for
that next FDA inspection. OK. Where should we
start? Pre -inspection. Yeah, let's dive into
that pre -inspection phase. Chapter 5 of the
IOM talks about this. What kind of homework are
FDA investigators doing before they even show
up? Oh, quite a bit, actually. It's not like
they just decide to drop by. They meticulously
review a whole range of data points related to
your firm. OK. And it's not just a quick scan.
It's a... a targeted effort to really understand
your compliance history and, importantly, potential
risk areas. So what are they looking at specifically?
Things like past inspection results, any warning
letters, your Form 483s, the Establishment Inspection
Reports, or EIRs. They're essentially building
a preliminary risk profile of your site. Right.
So if a company keeps having issues in, say,
their KPA system, That's definitely going to
be on their radar. They'll likely focus on that
during the inspection. It's about patterns. So
it's not just counting observations. It's the
kind of observations and whether they repeat.
Exactly. They're also looking at other intelligence,
maybe adverse event reports, complaint data,
any recalls you've had. It gives them a more
holistic picture of how effective your quality
system really is. And this risk profile you mentioned.
How does the FDA figure that out? It can't just
be past issues, right? No, it's definitely more
nuanced. Past compliance is a big piece, sure,
but they also consider the complexity of what
you manufacture. Like sterile products versus
oral tablets. Precisely. And the patient population
are these drugs for critical conditions. They
also look at, you know, recent regulatory changes
that might apply to you. So a firm making sterile
injectables might naturally be seen as higher
risk. Generally, yes, because of the inherent
risks involved. This whole pre -inspection risk
assessment really shapes the inspection's depth,
the scope, and even how many resources they assign
to it. Okay, that makes a lot of sense. So they've
done their homework, they arrive, IOM chapter
5 .5 gets into the inspection itself. Can you
walk us through the usual steps? Sure. It almost
always starts with a formal entrance meeting.
Right, they kick off. Yeah. The lead investigator
introduces the team, shows their credentials,
and states the purpose and scope of the inspection
clearly. And this is where the company introduces
its key people, too. Exactly. Your SMEs, the
site head, QA leadership. Setting a collaborative,
professional tone right from the start is, well,
it's usually beneficial. Good advice. What comes
after the meeting? Typically, a facility tour.
Ah, yes, the walkthrough. It can feel a bit like
being under a microscope, Candid. What are they
really looking for? They are. It's a detailed
look at your adherence to CGMP's current good
manufacturing practices. They're observing the
physical plant, the layout, the flow of materials,
personnel flow. To prevent mix -ups or contamination.
Exactly. Also the condition of equipment, general
state of repair, cleanliness. And crucially,
are people actually following procedures in real
time? They're looking for vulnerabilities that
could impact product quality. Like, are the clean
rooms operating correctly? Are materials stored
properly? Yes, all of that. Are environmental
controls working? Are gowning procedures followed?
It's a visual check against the written procedures.
OK, so after the tour, it seems like... a lot
of time gets spent on paperwork. The IOM really
stresses record review. Which documents get the
most scrutiny? Record review is absolutely central.
Documents are the objective evidence of how your
quality system works or doesn't work. They'll
definitely prioritize batch production and control
records. These basically tell the story of every
single batch. From start to finish. Yep. And
validation protocols and reports are also critical.
They need to see proof that your processes are
robust, reliable, and consistently make quality
product. And the IOM specifically calls that
drug -specific protocols, too, in chapters 5
.0 and 8 .3. It does. For drug manufacturers,
things like specific testing data, adherence
to the approved process, that's paramount. Think
of the batch record as the recipe and validation
as proof the recipe works every time. They check
these meticulously against your approved procedures
or they complete accurate any unexplained deviations.
Batch records and validation. Definitely key.
What else is on their checklist? Oh, plenty.
Equipment logs, maintenance, calibration records
to show your equipment is fit for use. Training
records are vital. Is your staff qualified? Makes
sense. Your standard operating procedures, SOP's.
Do they reflect reality? Are they current? And
a big one. Deviation and KP records. How do you
handle problems? Do you fix them effectively?
Do you prevent them from happening again? So
all these documents together should ideally show
a system that's under control and hopefully improving.
That's the goal. It should paint that picture.
Okay, another key part is interviewing people
on site. What should teams keep in mind during
those conversations? Interviews are really the
chance for your team to explain the why behind
the what's in the documents, to provide context.
Right. The IOM really emphasizes gathering accurate
and consistent information. So investigators
might talk to people in different roles, production,
QC, engineering. To see if the story holds together.
Essentially, yes. It's crucial that your team
knows their procedures well and can explain them
clearly and consistently. Inconsistencies, they
definitely raise red flags for an investigator.
And besides talking to people, they're also just
watching operations, right? What are they looking
for then? When they're observing, they're basically
comparing what they see happening on the floor
with what's written in your SOPs. So theory versus
practice. Exactly. Are people following the steps
correctly? Are they using the right equipment,
complying with GMP basics like gowning or line
clearance? They're looking for deviations from
your own established procedures or, you know,
any unsafe practices. Okay, so they're gathering
all this information, documents, interviews,
observations. Now we get to IOM 5 .6, evidence
development. How do they document what they find?
And what's the important difference we need to
grasp here? Right. Investigators are trained
to be objective. They stick to the facts, what
they saw, what the record showed. They document
evidence. Not opinions. Correct. And a key distinction
is between an observation and a violation. An
observation is something they note that might
point to a potential issue. A violation is a
more definite conclusion that a specific regulation
wasn't met. And this leads us to the Form FDA
483. The famous or perhaps infamous 483. Yes.
What does getting a 483 actually mean for a company?
Receiving a form FDA 483, which is officially
titled Inspectional Observations, means the investigators
identified conditions during the inspection that
in their judgment may violate the Food, Drug,
and Cosmetic Act or related regs. So it's not
a final judgment, but it's serious. Very serious.
It's a formal list of concerns that absolutely
requires a timely and thorough response from
the company. It clearly signals where the FDA
sees problems that need And the IOM guides them
on how to write these observations. It does.
It stresses objective evidence. There's even
language in there essentially saying, FDA investigators
must never speculate on compliance status. It
has to be based on facts, on evidence, no guesswork.
Got it. OK. Inspection's over. Maybe a 483 was
issued. What happens next? The reporting stage.
IOM 5 .7. So after they leave your site, the
investigators compile everything into a detailed
establishment inspection report, the EIR. This
is the full story of the inspection. Pretty much.
It outlines all their observations, findings,
evidence collected. This EIR then goes for review
within the relevant FDA center CDER for drugs,
CBER for biologics. And reviewers there look
at it. Yes. Experts at the center assess the
significance of the findings in the EIR. They
look at the potential impact on product quality.
and patient safety. And based on that review,
they determine the final classification of the
inspection. What are the possible classifications
or outcomes? Well, the best case is NAI, no action
indicated. It means they didn't find significant
issues, no further action needed. Then there's
VAI voluntary action indicated. This means some
issues were noted, maybe less serious ones, and
the FDA expects the firm to fix them voluntarily.
You still need to act, though. Right. And the
most serious? That's OAI official action indicated.
This signals significant problems, serious non
-compliance, and OAI classification often leads
to further regulatory actions. Like warning letters.
Exactly. Warning letters are a common outcome
following an OAI classification. And eventually,
the firm usually gets a copy of the EIR itself,
though sometimes redacted. OAI and warning letters
sound like they have major consequences. We see
companies get them. How directly do those flow
from the inspection findings? Very directly.
Warning letters are issued for significant CGMP
violations demanding immediate correction. The
observations documented first on the 483 and
then detailed in the EIR form the basis for that
warning letter. And they spell out the problems.
Clearly. They detail the specific deficiencies
found and require the company to provide a plan
for corrective actions, usually within 15 working
days. And these letters are public, which can
really impact a company's reputation, stock price,
future approvals. Definitely serious. Okay, let's
zoom in a bit on drug manufacturing inspections.
You mentioned IOM 5 .9 on a 8 .3 plus general
CGMPs. What are some unique focus areas there?
For drugs, data integrity is huge right now.
And likely will continue to be. Meaning? Investigators
scrutinize records, both electronic and paper,
to make sure they're accurate, complete, reliable,
attributable, the whole ALCOA plus principles.
Checking audit trails and electronic systems.
Absolutely. They want to see who did what, when,
why. Can data be changed without a record? Are
calculations verified? It's critical. OK. Data
integrity. What else? Batch records, again, a
really meticulous review. Did you follow the
master record exactly? Is every step documented?
Are deviations fully investigated and explained?
Also, validation comes under intense scrutiny.
Process validation. Cleaning validation. Both.
They need to see robust scientific evidence that
your manufacturing processes consistently deliver
quality product and that your cleaning prevents
cross -contamination. It has to be solid proof.
And for sterile drugs. Sterility assurance is
absolutely paramount. They'll dig deep into your
sterilization processes, your environmental monitoring
program, the EM data, your aseptic techniques,
media fills. anything related to preventing microbial
contamination. The stakes are incredibly high
there. Right. OK. To make this feel even more
real, maybe we can walk through a couple of scenarios.
Sort of composite case studies. Good idea. Let's
imagine a company, Proactiv Pharma. They really
took the IOM seriously, studied it, built their
internal systems around its principles. What
might an inspection look like for them? OK. Proactiv
Pharma. They didn't just wait for the FDA. They
used the IOM proactively. They understood the
pre -inspection focus, so they routinely analyzed
their own data deviations, CKPAs, complaints,
looking for the kinds of trends an investigator
would spot. So they tried to anticipate the focus.
Exactly. Their documentation was organized, easy
to find. Their internal audits weren't just checklists.
They focused on objective evidence, just like
the IOM requires. How so? Well, an internal auditor
wouldn't just tick CAP -PA closed. They'd verify
the records proved the corrective action was
effective, that the evidence was there. They
mirrored the FDA approach. So when the real inspection
happened? They were ready. The entrance meeting
was smooth. The facility tour showcased good
practices. Records were pulled quickly and were
complete. Their team members, because they were
trained, gave consistent answers during interviews.
And the outcome. Likely minimal observations,
maybe none significant. A potential NAI or VAI
classification. A direct result of being proactive
and IOM informed. That's the goal. Now the flip
side, a company we'll call ReactiveRx. They didn't
really pay much attention to the IOM's perspective,
what could go wrong. For ReactiveRx, the inspection
could be, well, painful. Maybe their documents
are messy, hard to locate. Batch record reviews
might have been superficial internally, missing
things. Validation might be incomplete or poorly
documented. So when the FDA asks for something...
It takes ages to find it, or it's incomplete.
Maybe different people give conflicting information
because they weren't prepped or aren't consistently
following procedures. They might not grasp the
need for objective evidence. For example, their
batch records might have missing entries or deviations
that weren't properly investigated. Their validation
might lack statistical justification or cover
only best case scenarios. This kind of thing
leads directly to 483 observations, incomplete
records, inadequate poor deviation handling.
And potentially worse. Absolutely. If the issues
are systemic or critical, especially around things
like data integrity or sterility assurance, it
could easily escalate to an OAI and a warning
letter, all because they didn't understand the
framework the investigators were using. Okay,
really useful contrast. Boiling it all down for
our listeners in quality, in RA, in compliance.
What are the absolute key practical takeaways
from this IOM deep dive? Number one. Recognize
the IOMM isn't just an FDA document. It's your
resource, too. It tells you the rules of the
game. Get familiar with chapters five and eight
especially. Know thy inspector's playbook. Essentially,
yes. Second, infuse that IOMM thinking into your
internal systems, particularly your internal
audits. Ask, what objective evidence would an
FDA investigator need to see here? Don't just
check the box. Right. Focus on robust, retrievable
documentation that tells the whole quality story
clearly. And what about preparing the people,
the teams on the ground? Training is key. Train
people on how to interact professionally and
effectively with investigators. Stress accuracy,
consistency, truthfulness. Practice. Mock inspections.
Definitely. Simulate the real thing. Document
requests under pressure. Facility walkthroughs
where you actively look for issues. Practice
interviews. Get key documents organized before
they arrive. And during the inspection itself.
Be professional, cooperative. Respond promptly.
Keep communication clear and open with the inspection
team. Assign scribes. Manage requests centrally.
This has been incredibly helpful. It really drives
home that the IOM, the Investigations Operations
Manual, is far more than just an internal FDA
guide. It's a vital tool for industry. It absolutely
is. Proactive preparation really guided by understanding
the IOM's principles. That's the foundation for
successful FDA inspections. It's about seeing
things from their perspective and aligning your
systems. So maybe a final thought for everyone
listening today. How could really internalizing
the investigator's perspective, the one laid
out in the IOM, fundamentally change how you
approach quality and compliance day to day? Think
about how that shift could ultimately strengthen
your contribution to delivering safe, effective
medicines. Thank you for joining us on this deep
dive.