European Industrial Pharmacists Group (EIPG) NCA Archives - European Industrial Pharmacists Group (EIPG)

by Giuliana Miglierini

The European Federation of Pharmaceutical Industries and Associations (EFPIA) has published its Annual Regulatory GMP/GDP Inspection Survey 2021, highlighting the more recent trends in inspections and how the pandemic affected this critical verification process of pharmaceutical productions. Meanwhile, UK’s regulatory authority MHRA launched the Compliance Monitor Process pilot, aimed to use eligible consultants as Compliance Monitors to supervise companies in the delivery of actions identified in the Compliance Protocol agreed with the regulatory authority.

Main trends in inspections

The main effect of the lockdowns has been the implementation of new ways to run inspections. The recommendation resulting from EFPIA’s report is now for virtual tools combined with onsite presence; to this instance, data gathered in 2021 show that the two modalities of inspection have a similar duration (2.9 days for on-site inspections vs 2.8 days for virtual ones). The report also indicates there is still a backlog of inspections due in 2020, the critical period of the pandemic; suggestions to manage expiring GMP/GDP/ISO-certificates include a one-year prolongation of current certificates, a dedicated communication process between the industry and regulators in the case of issues with the registration in third countries, and a planning of inspections based on the quality history of the site.

Domestic inspections confirming the trend observed since 2016, are almost double of the number of foreign inspections. These last ones focused in 2021 on only 23 countries, compared to the 44 countries visited by inspectors in 2017. EU’s countries were the most visited ones, with some 350 inspections reported vs the 150 of US, confirming the importance of European pharmaceutical manufacturing. According to the report, 2021 saw an increased attention to GDP inspections, while the percentage of sites with no inspections remains stable for six years.

A new mix of inspection tools

The use of new tools, additional to physical on-site presence, has now become a routine possibility accepted by many regulatory authorities. Many different approaches have been tested during the pandemic, including different inspections tools. Different combinations of tools cannot be considered to be equivalent, according to EFPIA. In general, a mixture of physical presence, document review and virtual presence flanked by the sharing of experience, collaboration and reliance is deemed suitable to confirm compliance and capability while supporting a risk-based efficiency.

Data show that the number of virtual inspections was higher in 2020 compared to 2021; the last year saw an increase of on-site presence vs 2020 and a mixture of virtual and on-site inspections. According to the report, only seven European countries have experience with the implementation of virtual inspection tools (Germany, Denmark, Finland, Ireland, Italy, Poland and Sweden). As a consequence, the impact of mixed virtual and on-site domestic inspections in 2021 was lower in EU member states that, for example, in the US, Brazil, Russia and Singapore.

There is still space for improvement

EFPIA’s survey presents the respective advantages and disadvantages of on-site inspections vs virtual tools. The implementation of the new modalities is far from being accomplished, the process is still on the learning curve, says the document.

While the remote, virtual interaction allows for a greater flexibility of the inspection process, it may result stressful for some people; furthermore, it impacts on the way work is organised, as it needs a flexible schedule and time to prepare for the next day meetings. Also, the style of communication changes to become less natural and more focused. Overall, virtual inspections appear to be more efficient when performed in real-time, as it would be for on-site inspections. While being less costly, due to avoiding extensive travelling, virtual inspections require a careful preparation, including the availability of a suitable IT infrastructure and connectivity. Documents are also often required in advance of the meetings to be shared with regulators.

How to further improve inspections

According to EFPIA, the future of inspections calls for improved collaboration and reliance in order to increase the knowledge shared by the different inspectorates and overcome the limits intrinsic to self-dependency. The expected final outcome of the new approach to inspections is an improvement in the decision-making process. Inspection frequency may be set every 1 to 5 years on the basis of a risk-based evaluation.

Collaboration, reliance and delegation appear to be the new mantras to guide the actions of regulators: the focus suggested by EFPIA is on inspections run by domestic authorities, coupled to the implementation of Mutual Recognition Agreements (MRA) to avoid duplication of efforts. According to the report, it would be needed to harmonise the scope of existing MRAs and to establish new ones between the EU and PIC/S participating authorities (e.g. Argentina, Brazil, South Korea, Turkey and UK). The European legislation should be also updated to include the concept of listed third countries, as already in place for the importation of active substances under the provisions of the Falsified Medicines directive.

The report also suggests a qualitative tool that would fulfil the legal requirements for “inspections” and may prove useful to support inspection planning on the basis of the knowledge of the GMP compliance history of the site, the footprint history of critical and major deficiencies and the type of inspection to be run. These elements lead to the identification of the hazards to be considered, including the intrinsic risk and the compliance-related one. The final output of the tool takes the form of a risk-ranking quality metric, to be used to establish the frequency of inspection for a certain site and the number and level of expertise of the required inspectors, as well as the scope, depth and duration of routine inspections.

All these items may form the basis for the drafting of a GMP inspection “Reliance Assessment Report”, which would also include the statement about the name of the hosting national competent authority and the basis on which country reliance has been established. Such a document may be then used to support regulatory decisions. According to EFPIA, the suggested approach would benefit of a better knowledge of the site inspected by the local NCA, a better insight in the local culture and less barriers to the interaction, with optimisation of resources. A better transparency of the inspection process is also expected, as a non-compliant site may negatively impact on the reputation of local inspectorates. Identified pre-requisites to allow the implementation of such an approach are the availability of high-quality standards at the local level and the evaluation of national regulatory systems by and independent body (e.g. PIC/S or the WHO Global Benchmarking Tool).

UK’s pilot of a Compliance Monitor Process

A new approach that may represent a first example towards the new paradigm of collaboration and reliance has been undertaken in the UK, where the Medicines and Healthcare products Regulatory Agency (MHRA) launched in April 2022 a pilot project focused on the Compliance Monitor (CM) Process (see more here and here). The pilot is part of MHRA’s delivery plan 2021-2023 and will focus on the CM supervision process for appropriate GMP and GDP Inspection Action Group (IAG) cases.

According to the MHRA, the new process would allow companies to concentrate on the delivery of the required improvements without the need to use resources to manage MHRA supervision inspections to assess compliance remediation activities. On the regulatory side, the MHRA should be able to concentrate on the delivery of the routine risk-based inspection programme. The risk-based approach to supervision and monitoring is also expected to limit the number of potential shortages of supply.

The CM process is based on the figure of eligible consultants acting as Compliance Monitors (CM) in charge of working with the company to deliver the remediation actions identified in a Compliance Protocol (CP) agreed with the MHRA. The supervision by the CMs is expected to contribute to lower the need of on-site inspections with respect to the current process managed by the IAG. The CP also includes the transmission to MHRA of high-level updates at fixed intervals of time, which should include only exceptions to the agreed timelines or significant related compliance issues which were identified. Once completed the CP protocol, the CM informs the regulatory authority that the company is ready for inspection, so that the MHRA can verify onsite the possibility of its removal from IAG oversight.

CMs will be selected by the involved company from a dedicated register and accepted as suitable for that case by the MHRA. At least five years’ experience in independent audits of GMP/ GDP companies is needed to be eligible as CM. Furthermore, not having been personally the subject of MHRA regulatory action and/or significant adverse findings in the previous three years, a suitable CV and the completion of a MHRA training as CM. All details on requirements for the CM role and application are available at the dedicated page of the MHRA website.

Suitability criteria to act as a CM for the specific case include as a minimum a sufficient experience of the dosage form manufactured, testing activities being performed, or distribution activity being carried out and a written confirmation of absence of Conflict of Interest. These criteria will be assessed by the company selecting the CM.

BIA’s view of the reliance in the UK medicines regulatory framework

The UK’s BioIndustry Association (BIA) contributed to the debate on the reliance in the UK medicines regulatory framework with a Reflection Paper. According to BIA, the MHRA has a well recognised status and history as a valued contributor to the global regulatory ecosystem and a point of reference for the regulatory decision-making which should be preserved also in the future.

BIA recalls the role played by the MHRA in the development of the concept of regulatory reliance at the EU level, as a way to support the agile management of resources and simultaneously focusing on core and innovative national activities across all stages in the product lifecycle. The central concept sees regulators from one country to rely on the decision and assessments of trusted authorities from another country in order to speed up the timeline of regulatory procedures. At the end of the process, each regulator remains fully responsible and accountable for all its decisions.

BIA also highlights the contribution of reliance to the advancement of good regulatory practices and international networks of regulators, so to better allocate resources potentially taking into account also the respective fields of specialisation. The proposal is for a list of accepted reference regulatory authorities as a way to recognise the evolution of partnerships over time. Examples of recognition pathways already active in the UK are the EC Decision Reliance Procedure (ECDRP) and international work-sharing through the Access Consortium and Project Orbis, through which the MHRA may act as the reference regulatory agency in many procedures.

BIA also warns about the risks of a sudden interruption at the end of 2022 of the reliance pathway, that would have a highly disruptive impact on companies and patients.

by Giuliana Miglierini

The last two years saw the implementation of a high degree of regulatory flexibility as a mean to respond to the many challenges posed by the travel bans consequent to the pandemic. After this “experimental” phase, regulatory authorities are now considering the possibility to allow the routine implementation of some remote procedures in the field of pharmaceutical production.

It is the case of the remote certification/confirmation of batches by the Qualified Person (QP): after the publication of a draft guideline in the form of Q&As (EMA/INS/169000/2022), the European Medicines Agency (EMA) has launched a short public consultation which will remain open up to 13 June 2022. Comments may be sent by email.

The guideline offers EMA’s point of view on the requirements for the physical attendance at the authorised manufacturing site applying to QPs in order to routinely run the remote certification of batches, outside emergency situations. The document has been drafted by the GMDP Inspectors Working Group; it is composed of four questions and their relative answers and it addresses some considerations arising from the experience gained on the application of the guidelines for human and veterinary medicines issued during the pandemic. These last ones were elaborated in cooperation between the European Commission, the Coordination group for Mutual recognition and Decentralised procedures – human (“CMDh”), the Inspectors Working Group, the Coordination group for Mutual recognition and Decentralised procedures – veterinary (“CMDv”) and EMA.

The Agency also warns that the contents proposed by new Q&As’ guideline may be subject to any other interpretation by the European Court of Justice, which is the ultimate responsible for the interpretation of the EU legislation.

The contents of the Q&As

The routine remote certification or confirmation of batches may in future apply to the activities carried out by the QPs within the EU and European Economic Area (EEA), with reference to manufactured or imported human and veterinary medicinal products and investigational medicinal products.

The first answer clarifies that it could be possible for the QP to routinely run remote batch certification or confirmation only if this type of practice is accepted by the relevant national competent authority (NCA) of the member state where the authorised site is located. To this instance, it should be noted that some NCAs may request some specific requirements to authorise the routine remote certification procedure, for example with reference to the location of the QPs.

Should the remote certification be allowed on a routine basis, specific requirements should be met in order to validate this practice, starting from its full compliance to the EU legislation and EU GMP guidelines.

The answer to question 2 specifies that all activities should take place in an EU/EEA country, and that the time spent by the QP at the authorised site “should be commensurate with the risks related to the processes” hereby taking place. To this instance, it is of paramount importance the ability to demonstrate that the QP acting from remote has maintained full knowledge of the products, manufacturing processes and pharmaceutical quality system (PQS) involved in the remote certification/confirmation of batches. That also means that the QP should be highly reliant on the PQS of the authorised site, and this would be only possible by spending an adequate time on-site to verify the adequacy of the PQS with respect to the processes of interest. The pharmaceutical quality system should also include details of all the procedures used for the routine remote certification/confirmation of batches. The possible use of this type of remote procedure by the QP should be also clearly mentioned in the technical agreement governing the relationship between the authorisation holder and the QP, which should also specify all cases requiring the presence on-site of the QP. A robust IT infrastructure should be in place to guarantee the remote access of the QP to all the relevant documentation in the electronic format needed to achieve bath certification/confirmation, according to the provisions described in Annex 16 to the GMPs (Certification by a Qualified Person and Batch Release). To this instance, presence on-site should be always considered to solve issues that cannot properly be addressed from remote. The demonstration of the presence on-site of the QP falls under the responsibility of the Manufacturing/Importers Authorisation (MIA) holders.

These are also responsible to make available to the QPs all the hardware and software needed to guarantee the remote access to the relevant documentation (e.g. manufacturing executions systems, electronic batch records system, laboratory information systems etc.) as well as batch registers. All IT systems used for remote batch release should comply with the requirements of Annex 11 to the GMP (Computerised Systems).

On the same basis, it should be possible for NCAs to contemporaneously access for inspection all documentation and batch registers involved in routine remote certification/confirmation at the authorised site of batch release. MIA holders should also guarantee the QP is the only allowed person to access the batch certification/confirmation function and batch register, that the transferred data are complete and unchanged, and that an adequate system for electronic signatures is in place.

Question 3 simply clarifies that some members states may have some specific requirements about the country of residence of the QP, for example it should be the same where the authorised site involved in the remote certification procedure is located.

The last question discusses technical requirements linked to IT-security and data integrity for remote access, a type of procedure presenting a higher intrinsic risk in comparison to the same activities carried on-site. Here again, the main reference is Annex 11; all equipment and software used for remote certification of batches should always reflect the current technological developments.

Among the suggestions made by the Q&A draft guideline is the precise identification of all hardware transferred off-site to the QP, that should be inventoried and kept updated. Hard disks should be encrypted, and ports not required, disabled.

Attention should also be paid to the configuration of any virtual private network (VPN) used by the QP to improve the security of the connection to the IT infrastructure of the authorised site and to prevent unauthorised accesses. Authentication should be based on recognised industry standards (e.g. two-factor or multifactor authentication, with automatic date of expiry). The transfer of data should be secured by strong transport encryption protocols; assignment of individual privileges and technical controls falls under the responsibility of the MIA holder

NCA Archives - European Industrial Pharmacists Group (EIPG)

Current inspection trends and new approaches to the monitoring of post-inspection activities

EMA’s consultation on draft Q&As on remote certification of batches by QP

News from EIPG