Q&As Archives - European Industrial Pharmacists Group (EIPG)

Lessons learnt to transition from Horizon 2020 to the new FP10


by Giuliana Miglierini The European Commission published the ex post evaluation of Horizon 2020 (H2020), the FP8 framework programme for research and innovation (R&I) run in years 2014-2020. The report identifies several areas of possible improvement, which may be taken into Read more

Approvals and flops in drug development in 2023


by Giuliana Miglierini Approvals and flops in drug development in 2023 The European Medicines Agency published its annual highlights, showing 77 medicines were recommended for marketing authorisation, and just 3 received a negative opinion (withdrawals were 19). In 2023 some highly expected Read more

Webinar: Oral Colon Drug Delivery - Design Strategies


EIPG webinar Next EIPG webinar is to be held on Wednesday 21st of February 2024 at 17.00 CET (16.00 GMT) in conjunction with PIER and University College Cork. Anastasia Foppoli, will discuss on the various approaches and the general aspects Read more

The first Union list of critical medicines

, , , , , , , , , , , , , , , , , , , , ,

by Giuliana Miglierini

The first version of the Union list of critical medicines was published on 12 December 2023 by the European Commission, the European Medicines Agency (EMA) and the Heads of medicines Agencies (HMA).

The initiative is part of the actions planned according to the Pharmaceutical Strategy and the Communication on addressing medicine shortages in the EU. A Q&As documentwas also published to illustrate the main features of the list, together with the methodology to identify critical medicinesto be included in the list (see the dedicated webpage of EMA’s website). The first version of the Union list of critical medicines is comprehensive of approx. 200 active substances, selected starting from a pool of more than 600 referred to in the national lists of critical medicines of Finland, France, Germany, Portugal, Spain, and Sweden. These six countries were chosen as their lists were based on criteria aligned with those agreed for the Union list. The process also comprised consultations of key stakeholders, including patients and healthcare professionals’ organisations and industry associations.

The list will be updated annually, and further references will be added in 2024. The final list will also include the separate assessment of the vulnerability of the supply chains to be run by the European Commission.

The Union list will not replace existing national lists of critical medicines, that will continue to support national policy decisions. EU member states may also use the Union list to create their own national lists, if not yet available.

Ensuring an uninterrupted supply of critical medicines is essential for a strong European Health Union. With the publication of the first Union list of critical medicines today, we are delivering on our promise to accelerate work in this area and to take every possible measure to avert the risk of shortages for our citizens”, said Stella Kyriakides, Commissioner for Health and Food Safety.

A list to prevent shortages

The Union list of critical medicines represents a warning about the importance of avoiding shortages for specific medicines, as they would highly impact both patients and healthcare systems. No immediate effect is expected on shortages, but the risk might decrease in the longer term.

The Union list specifies human medicines (both innovators and generics, vaccines, and medicines for rare diseases) those continued supply is considered a priority in the EU. It will be used by the EU Commission, EMA and HMA for the definition of proactive measures to strengthen the supply chain and minimise the risk of supply disruptions (see more on EMA’s webpage on Availability of critical medicines).

The Union list of critical medicines will also serve as the basis for the Commission to run the analysis of vulnerabilities, followed by recommendation of suitable measures in consultation with the Critical Medicines Alliance (we wrote about this part 1 and part 2). The Commission may issue recommendations for companies to diversify suppliers or increase production within the EU. Incentives to invest may also be used to favour the resilience of European manufacturing. As for procurement, strong contractual obligations for delivery may apply.

Medicines included in the Union list will also be prioritised for actions by the European medicines regulatory network, in charge of monitoring their availability and implementing measures to minimise the risk of supply disruptions. To this instance, existing processes and structures will be used as defined in the mandate of EMA’s Medicine Shortages Single Point of Contact (SPOC) Working Party and EMA’s Executive Steering Group on Shortages and Safety of Medicinal Products (MSSG).

No additional obligations have been introduced by now for marketing authorisation holders and national competent authorities. This will be a topic of discussions during the final phase of negotiations on the proposed revision of the EU pharmaceutical legislation.

The methodology to select critical medicines

The therapeutic indication and the availability of alternative medicines are the two main criteria for the insertion of a certain medicinal product in the Union list of critical medicines. Additionally, it has to be classified as critical in at least one-third (33%) of EU/EEA (European Eco-nomic Area) member states.

National lists of critical medicines may differ from one another, reflecting differences of the internal evaluation criteria used to assess criticality. For example, some products are marketed just in some countries, or alternatives are available in some countries and not in others. Furthermore, the Union list is still incomplete, as some important medicines have not yet been assessed at the central level. The Union list does not include as well products mentioned in the WHO list of essential medicines. Orphan medicines are included in the Union list if they meet the above-mentioned assessment criteria.

The document on methodology further clarifies the governance of the process and the matrix for identifying medicines to be included in the Union list of critical medicines. The methodology was created starting in 2021 (European Commission Structured Dialogue initiative), finalised by the HMA/EMA Task Force on the availability of authorised medicines for human and veterinary use (HMA/EMA TF-AAM), and finally adopted in June 2023.

The medicinal product criticality is evaluated on the basis of a risk assessment. As for therapeutic indications (criterion 1), all authorised medicines in a member state should be classified, irrespective of their marketing status. Criterion 2 refers to the availability of alternatives, and only authorised medicines marketed in the respective member state should be classified.

A low, medium or high-risk level is assigned for each of the two above-mentioned criteria, thus resulting in a risk matrix. The exercise allows to assign the medicine in one of the following categories: critical medicines, medicines at risk, other medicines.

Medicines considered at high risk with respect to their therapeutic indication refers to products those use may have very serious implications for the health of individual patients or public health (general life-threatening acute conditions, specific life-threatening acute conditions, or irreversibly progressive conditions). Evaluation parameters include the fact the disease is potentially fatal, irreversibly progressive or, if left untreated, will pose an immediate threat to the patients. Furthermore, the treatment must be administered immediately or within regular dosing intervals, and the product has to be part of a national disease control program.

Appropriate alternatives are identified according to the fact they are authorised for the same therapeutic indication and are available on the market in the respective member state. Furthermore, alternative treatment has to be clinically possible, without negative impact on the patient’s health and providing the same quality of care standard. As for criterion 2, high risk cri-tical medicines refer to products for which no appropriate alternative is available, or only one appropriate alternative (product) on ATC level 4 or 5 (same active substance or alternative is within the same ATC level 4 group or in another ATC level 4 group) is available.

Public consultation for the review of HERA

We inform all interested EIPG’s members that the public consultation for the review of the Health Emergency Preparedness and Response Authority (HERA) is open until 19 February 2024 and it can be accessed through the dedicated webpage of the EU Commission website.

The consultations aim to assess how HERA’s mandate and tools contributed to achieve EU’s political objectives, and how the Authority complements the work of other EU bodies and responds to the current health challenges.


Swissmedic’s technical interpretation of Annex 1

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

by Giuliana Miglierini

New insights on the interpretation of the new Annex 1 to Good manufacturing practices (GMPs) comes from the Swiss regulatory authority Swissmedic, that at the end of October 2023 published the first revision of its Q&As document (you can find it on the Swissmedicines Inspectorate webpage)

The technical interpretation refers to the revised Annex 1 to the PIC/S GMP Guide (PE 009), adopted on 9 September 2022 and entered into force on 25 August 2023 (with the exception of point 8.123 on lyophilisation, which will enter into force on 25 August 2024). The Q&As follow the same scheme and chapters of Annex 1.

Scope and Premises

According to Swissmedic, for certain types of advanced medicinal products (e.g. ATMPs or allogenic and autologous cell therapy products) specific considerations are required with respect to the fact they cannot be terminally sterilised or filtered. The unsterile patient material should also be considered. Requirements of Annex 2A, paragraph 5.29(b) should be followed for aseptic processing, that should be maintained from the time of procurement of cells through manufacturing and administration back into the patient.

Exceptions to the application of Annex 1 need to be always justified: the Contamination Control Strategy (CCS) is the appropriate tool to detail all risk analysis performed on the basis of the specific manufacturing processes under consideration.

As for the Premises, segregated unidirectional flow airlocks for material and personnel for grade A and B cleanrooms are expected in the case of new facilities. Temporary separation of the flows in the airlocks is the minimum requirement for existing facilities, together with a detailed risk analysis to assess the need for additional technical or organisational measures.

The transfer of materials in and out of a critical grade A cleanroom should be based on the careful definition of the technical and procedural measures associated with it. For example, prior introduction of materials in an isolator followed by decontamination is considered possible only for small batches and for materials resistant to VHP treatment. In all other cases, materials have to be sterilised before entering the already sterile isolator. The transfer process is also subject to a risk analysis to be included in the CCS, as well as to measures to control the maintenance of the integrity and functionality of the systems (also with respect to aseptic process simulation, APS).

Swissmedic specifies that the cleanroom sequence for the transfer of materials via airlocks or passthrough hatches is expected to be fulfilled for zones A and B. In the case of the passage from grade A to C, qualification is needed to prove adequacy of the established systems and procedures. The corresponding risk analysis has to be included in the CCS.

Updating equipment to reach full compliance with the new Annex 1 may require high investments. According to the Q&As, older barrier technologies should be subject to an in-depth internal evaluation to assess the need for new technical measures. The document underlines that starting from 25 August 2023 all barrier technologies not compliant with the new Annex 1 are considered deficient, thus companies should start projects to evaluate the upgrading of background cleanrooms and to define CAPA plans and interim measures to reduce risks.

The risk assessment should also include the evaluation of all automated functionalities and processes associated with the use of the isolator and the activities taking place in it. To this instance, Swissmedic highlights that robotic systems may help improving the reproducibility of operations and minimising both errors and manual interventions. Automatic processes are also expected for the decontamination of isolators, while for RABS manual processes might be used, provided they are designed to ensure reproducibility and are subject to validation and regular monitoring. The absence of negative effects on the medicinal product associated to the cleaning or biodecontamination substances used should also be validated.

As for barrier technology systems with unidirectional air flow, air velocity must be defined so that uniform airflow conditions prevail at the working positions where high-risk operations take place. Alternative air speed ranges or measurements at different heights in the system have to be scientifically justified in the CCS.

Utilities and Personnel

The section on Utilities offers additional guidance on systems used for water generation, that should be designed to allow for routine sanitisation and/or disinfection. Procedures are needed to define regular preventive maintenance of the reverse osmosis system, including the regular change of membranes. A suitable sampling schedule should be in place to regularly check water quality. More stringent controls are needed for the sampling of water-for-injection distribution systems, including daily microbial and bacterial endotoxin testing. The monitoring of the process gas should be performed as close as possible before the sterilisation filter.

Adequate training and qualification of all people working in grade A and B areas, including aseptic gowning and aseptic behaviors, is essential. According to Annex 1, this should include an annual successful APS. Swissmedic adds that, even if not explicitly required, practical process simulations, including manual interventions, should be carried out under the supervision of qualified trainers/QA; the company can choose if to integrate these process simulations into the APS.

Production and specific technologies

As for lyophilisation, initial loading patterns must be always validated, and revalidated annually. The Q&As specify cases where revalidation can be skipped, adding that a theoretical reference load is not acceptable. Revalidation has also to include temperature mapping for moist heat sterilisation systems.

Should a closed system be opened, this should be followed by cleaning (if required) and a validated sterilisation process. Alternatively, the system can be opened in a decontaminated isolator; a class A cleanroom with a class B background might be considered only for exceptional cases.

Non-aseptic connections can be carried out for coupling closed systems, provided a validated sterilisation cycle (SIP) occurs prior to use. Sterile aseptic connectors can be used if the supplier was checked and validated; data from the supplier can be used to file the relevant documentation, but handling of these parts has to be included in the APS.

Swissmedic also underlines that piercing a septum with a needle is to be regarded as a breach of the sterile barrier, and thus avoided for ascetic steps. Should this not be possible, temporary measures should be undertaken to prevent contamination.

Tube welding has also to be qualified and validated, and included in the APS if it is part of the aseptic filling process. The advice is to use more reliable systems, to avoid risks of undetected integrity deficiencies.

Critical single use systems (SUS) should always be tested for integrity by the end user on site before they are used in production. In case of difficult to test, small single use systems, the decision not to test their integrity must be justified in the CCS, as well as the decision to make use of test results provided by suppliers. To this instance, Swissmedic underlines that the comprehensive assessment (including quality system, etc.) should cover the SUS manufacturer/ s, as well as any subcontractors involved in critical services or processes.

Furthermore, the intended use of a SUS in the specific manufacturing process represents the basis for setting the respective acceptance criteria. The Q&As also detail the modalities for the visual inspection of SUSs and the possible acceptance of validation data provided by their suppliers.

As for extractables, the end user is expected to assess the data provided by the suppliers in order to define the need for additional evaluation or leachable studies. A redundant filtration step through a sterile sterilising grade filter, to be included as close to the point of fill as possible, is also encouraged, and its absence has to be justified. A risk analysis is required to justify the choice not to include pre-use/post-sterilisation integrity testing (PUPSIT) of sterilising grade filters used in aseptically processes.

Environmental and process monitoring

According to ICH Q9 (R1), the frequency of the risk review should be based on the level of risk determined for the specific process under consideration, as well as on the level of uncertainty of previous assessments. The recommendation of Swissmedic for new plants is to review the risk assessment after the first year of operations, so to take into due consideration the acquired experience. The document also suggests cases where more stringent action limits may be needed, and the type of statistics to be used to establish alert levels.

The use of rapid microbiological methods (RMM) requires validation and demonstration of equivalence with more traditional approaches. Details on the frequency of the interventions and their inclusion in the APS are also discussed, as well as the container/closure configuration and the distinction between liquid filling and lyophilisation.

The APS of campaign manufacturing represents a complex case for Swissmedic, for which the start-of-campaign (including aseptic assemblies if the case) and end-of-campaign studies should be both conducted. The Q&As also confirm that any contaminated unit with a contamination > 0 CFU results in a failed APS and requires the activation of the consequent actions. Production should resume only after completion of a successful revalidation.

Quality control

A university degree or an equivalent diploma in the field of microbiology (or other natural sciences, or medicine) together with a good understanding of the manufacturing processes under consideration are required for the person in charge of supporting the design of manufacturing activities and environmental monitoring.

As for raw materials, the need for microbiological testing should be evaluated taking into consideration their nature and respective use in the process. All specifications should be discussed and justified in the CCS.

Swissmedic also confirms that the bioburden has to be tested on each batch of raw material as incoming control as well as on the compounding solution in which it is formulated before sterile filtration. In the case of products with short shelf life, should an out-of-specification (OOS) event appear after release of the batch, a procedure is needed to inform doctors, patients, and health authorities, and to assess the connected risks and define remediation actions.


PIC/S new guidance documents for GDP inspectors

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

By Giuliana Miglierini

Two new guidance documents for GDP inspectors have been issued by the Pharmaceutical Inspection Cooperation Scheme (PIC/S) Expert Circle on GDP, and are available on the PIC/S’ website.

The ‘AideMemoire on the Inspection of Good Distribution Practice for Medicinal Products in the Supply Chain’ (PI 0441) and a ‘Questions & Answers (Q&A) document regarding the PIC/S GDP Guide’ (PS/INF 22/2017) both entered into force on 1 February 2023.

Main contents of the AideMemoire

The AideMemoire aims to support GDP inspectors in the understanding the process of GDP inspections. The document is expected to be used for training and planning of inspections. Its adoption is voluntary, as the PIC/S GDP Guide for inspections is a legally nonbinding document unless it has been declared a legal standard in the jurisdiction of a PIC/S Participating Authority. The AideMemoire addresses inspections in wholesale distribution sites of entities holding a wholesale distribution licence according to national legislation (i.e. including importing, exporting, holding, or supplying distributors), as well as manufacturers performing any distribution activities. GDP inspections should be thorough and conducted under normal operating conditions.

The AideMemoire is organised in the form of 10 tables that could be used by inspectors as check lists of items to be investigated during inspections of manufacturers and wholesale distributors.

The first table addresses general aspects of GDP inspections, such as the accuracy of the Licence/ application in detailing relevant activities and products. Lists of prescription only medicines (POM), sales without prescription (P), or General sales list/Over the counter (GSL) products are some examples, together all other possible items that may be handled by wholesales distributors, including medical gases, products requiring storage at low temperature and controlled drugs according to national laws.

Preliminary activities also include the review of previous inspections and the assessment of corrective/preventative actions (CAPAs) outlined in the company response. Change should also be verified, namely in the case of high risk operations that may affect the risk profile of the organisation.

Table 2 lists items referred to Quality management. Inspectors should check, for example, the availability of procedures and logs for change control and deviation management. Quality Risk Management (QRM) principles should have been applied to outsourced activities, leading to the definition of specific activities falling under GDP rules, approval, auditing of suppliers, etc. An appropriate procedure should be available also for activities referring to Management review and monitoring and QRM.

Issues referring to personnel are discussed in table 3. An organisation chart and job descriptions should be available, the latter reflecting also key responsibilities and indication of Designated Responsible Persons. Inspectors should verify GDP training received by personnel, also with reference to specific aspects such as falsified medicines or temperaturesensitive products. Availability of a regular GDP training programme and training records should be checked. Personnel should have received specific training in SOPs relevant to their role, to be adequately assessed and documented. These should also include aspects relative to health, hygiene and clothing requirements.

The check list referred to Premises and Equipment is detailed in table 4. It includes among others items reflecting segregation requirements (e.g. identification, design and management of segregation areas) for hazardous or radioactive products, falsified medicines, products not authorised for the approved market, expired products, etc.

Cleaning and pest control procedures are also addressed in this section, as well as temperature and environmental controls and the appropriate monitoring of fridge or cold storage conditions. As for the equipment, inspectors should verify planned maintenance and calibration and their respective records. Alarms should also be checked, as well as computerised systems including validation, security and access restrictions. Appropriate qualification and validation procedures should be in place for all relevant equipment according to QRM principles, and risk assessment should be also available.

Table 5 lists all items referring to documentation management, including procedures and records. The qualification and approval of suppliers and customers according to QRM principles is addressed in Table 6, discussing Operations. This section also addresses the availability of goods receipts to be checked against purchase orders, including details of the temperature conditions during transportation and checks at receipt for products with special storage requirements or nonconforming products. Stock rotation according to the First Expiry First Out principle (FEFO) should be verified by inspectors, among items referred to storage. Aspects referring to the security of the premises also fall under this section, as well as the destruction of expired/ obsolete goods. Inspectors should address also picking operations, supply notes and records and procedures for import/export.

Table 7 refers to the management of complaints, returns, suspected falsified medical products and recalls, which should all be handled according to relevant procedures. Requirements and documentation to be verified for outsourced activities are listed in table 8. These include for example the availability of quality agreements, and contracts including clear responsibilities and audits schedules.

Procedures, plans and records referring to selfinspections are listed in table 9. Items to be verified by GDP inspectors include among others the selection of auditors, their training and independence, CAPAs implementation and verification. The last table addresses issues relative to transportation, including planning, outsourcing, temperature monitoring, GDP training of drivers, etc.

Q&As on PIC/S GDP Guide (PE 0111)

The second document published by PIC/S consists in a list of Questions & Answers specifically referred to the PIC/S GDP Guide (PE 0111). Contents are organised in the form of a table detailing the relevant chapter number and title, paragraph number, question and answer. The latter also make reference to other paragraphs of the GDP Guide to be considered. The sequence of topics is similar to that of the previously examined guidance document for inspectors.

Questions referred to Chapter 1 address issues referred to Quality management and Quality system, outsourced activities, management review and monitoring. Effectiveness of the QS, for example, may be measured by inspectors with reference to deviations and CAPA analysis or to the impact of QRM functions. Frequency of periodic review and responsibilities for ensuring GDP compliance of outsourced activities are also addressed.

Personnel and definition of responsibilities, including key positions and delegation, are detailed in Chapter 2, while Q&As referred to Premises and Equipment go deeper in contents of Chapter 3 (i.e. including the definition of “acceptable temperature limits” and use of Mean Kinetic Temperature for monitoring).

The following chapters and related Q&As address the proper management of Documentation (Ch. 4) and Operations (Ch. 5). The later details some aspects of suppliers and customers qualification, storage, picking. The management of complaints, returns and particular categories of medicinal products refers to Chapter 6. As for outsourced activities (Ch. 7), Q&As addresses onsite auditing, while selfinspections are treated in Chapter 8. Q&As referred to Transportation (Ch. 9), for example, refer to national legislations as for the need for the transportation company to hold a wholesaler licence.


EMA’s consultation on draft Q&As on remote certification of batches by QP

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

by Giuliana Miglierini

The last two years saw the implementation of a high degree of regulatory flexibility as a mean to respond to the many challenges posed by the travel bans consequent to the pandemic. After this “experimental” phase, regulatory authorities are now considering the possibility to allow the routine implementation of some remote procedures in the field of pharmaceutical production.

It is the case of the remote certification/confirmation of batches by the Qualified Person (QP): after the publication of a draft guideline in the form of Q&As (EMA/INS/169000/2022), the European Medicines Agency (EMA) has launched a short public consultation which will remain open up to 13 June 2022. Comments may be sent by email.

The guideline offers EMA’s point of view on the requirements for the physical attendance at the authorised manufacturing site applying to QPs in order to routinely run the remote certification of batches, outside emergency situations. The document has been drafted by the GMDP Inspectors Working Group; it is composed of four questions and their relative answers and it addresses some considerations arising from the experience gained on the application of the guidelines for human and veterinary medicines issued during the pandemic. These last ones were elaborated in cooperation between the European Commission, the Coordination group for Mutual recognition and Decentralised procedures – human (“CMDh”), the Inspectors Working Group, the Coordination group for Mutual recognition and Decentralised procedures – veterinary (“CMDv”) and EMA.

The Agency also warns that the contents proposed by new Q&As’ guideline may be subject to any other interpretation by the European Court of Justice, which is the ultimate responsible for the interpretation of the EU legislation.

The contents of the Q&As

The routine remote certification or confirmation of batches may in future apply to the activities carried out by the QPs within the EU and European Economic Area (EEA), with reference to manufactured or imported human and veterinary medicinal products and investigational medicinal products.

The first answer clarifies that it could be possible for the QP to routinely run remote batch certification or confirmation only if this type of practice is accepted by the relevant national competent authority (NCA) of the member state where the authorised site is located. To this instance, it should be noted that some NCAs may request some specific requirements to authorise the routine remote certification procedure, for example with reference to the location of the QPs.

Should the remote certification be allowed on a routine basis, specific requirements should be met in order to validate this practice, starting from its full compliance to the EU legislation and EU GMP guidelines.

The answer to question 2 specifies that all activities should take place in an EU/EEA country, and that the time spent by the QP at the authorised site should be commensurate with the risks related to the processes” hereby taking place. To this instance, it is of paramount importance the ability to demonstrate that the QP acting from remote has maintained full knowledge of the products, manufacturing processes and pharmaceutical quality system (PQS) involved in the remote certification/confirmation of batches. That also means that the QP should be highly reliant on the PQS of the authorised site, and this would be only possible by spending an adequate time on-site to verify the adequacy of the PQS with respect to the processes of interest. The pharmaceutical quality system should also include details of all the procedures used for the routine remote certification/confirmation of batches. The possible use of this type of remote procedure by the QP should be also clearly mentioned in the technical agreement governing the relationship between the authorisation holder and the QP, which should also specify all cases requiring the presence on-site of the QP. A robust IT infrastructure should be in place to guarantee the remote access of the QP to all the relevant documentation in the electronic format needed to achieve bath certification/confirmation, according to the provisions described in Annex 16 to the GMPs (Certification by a Qualified Person and Batch Release). To this instance, presence on-site should be always considered to solve issues that cannot properly be addressed from remote. The demonstration of the presence on-site of the QP falls under the responsibility of the Manufacturing/Importers Authorisation (MIA) holders.

These are also responsible to make available to the QPs all the hardware and software needed to guarantee the remote access to the relevant documentation (e.g. manufacturing executions systems, electronic batch records system, laboratory information systems etc.) as well as batch registers. All IT systems used for remote batch release should comply with the requirements of Annex 11 to the GMP (Computerised Systems).

On the same basis, it should be possible for NCAs to contemporaneously access for inspection all documentation and batch registers involved in routine remote certification/confirmation at the authorised site of batch release. MIA holders should also guarantee the QP is the only allowed person to access the batch certification/confirmation function and batch register, that the transferred data are complete and unchanged, and that an adequate system for electronic signatures is in place.

Question 3 simply clarifies that some members states may have some specific requirements about the country of residence of the QP, for example it should be the same where the authorised site involved in the remote certification procedure is located.

The last question discusses technical requirements linked to IT-security and data integrity for remote access, a type of procedure presenting a higher intrinsic risk in comparison to the same activities carried on-site. Here again, the main reference is Annex 11; all equipment and software used for remote certification of batches should always reflect the current technological developments.

Among the suggestions made by the Q&A draft guideline is the precise identification of all hardware transferred off-site to the QP, that should be inventoried and kept updated. Hard disks should be encrypted, and ports not required, disabled.

Attention should also be paid to the configuration of any virtual private network (VPN) used by the QP to improve the security of the connection to the IT infrastructure of the authorised site and to prevent unauthorised accesses. Authentication should be based on recognised industry standards (e.g. two-factor or multifactor authentication, with automatic date of expiry). The transfer of data should be secured by strong transport encryption protocols; assignment of individual privileges and technical controls falls under the responsibility of the MIA holder