Jonathan Wilkins of European Automation examines the implications of the latest update CFR21/11 to 21 CFR part 11 of Code of Federal Regulations made by the US Food and Drug Administration (FDA). The FDA requires anyone designing, manufacturing and testing pharmaceuticals to abide by these rules. Since the enforcement of 21 CFR part 11 a few years ago, chemicals and pharmaceuticals manufacturers have had to adapt and improve automated procedures at their manufacturing plants across the US and Europe.
When 21 CFR part 11 came into effect, significant discussions followed among manufacturers, contractors, systems integrators and the FDA concerning the interpretation and implementation of the regulations. The discussions specifically focussed on electronic records, electronic signatures, validation, time stamps, maintenance of electronic records and traceability.
The audit trail is central to the control imposed by the FDA. The guides state that:
‘Even if there are no predicate rule requirements to document, for example, date, time, or sequence of events in a particular instance, it may nonetheless be important to have audit trails or other physical, logical, or procedural security measures in place to ensure the trustworthiness and reliability of the records. We recommend that you base your decision on whether to apply audit trails, or other appropriate measures, on the need to comply with predicate rule requirements, a justified and documented risk assessment, and a determination of the potential effect on product quality and safety and record integrity. We suggest that you apply appropriate controls based on such an assessment. Audit trails can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.’
Though initially met with scepticism, the regulation has actually brought significant benefits by encouraging better electronic record keeping in good manufacturing practice (GAMP).
Robotics and robot vision can help record keeping and positively contribute to improving procedures. In addition, the data acquired through robotic vision can be fed to a PLC (Programmable Log Controller), HMI (Human Machine Interface) or SCADA (Supervisory Control and Data Acquisition) system to be analysed. This data can also be easily interrogated and acted upon in the event of a recall.
The validation requirements of the pharmaceutical industry mean that when a component breaks down, simply introducing a new part from a different manufacturer, even if it achieves the same objective, isn’t really an option. Similarly, re-designing the system is not only expensive but also causes complex traceability and validation issues.
European Automation offers to the pharmaceutical sector the capability to find and deliver nearly any component in a record time, irrespective of its rarity or obsolescence since the original installation.
The audit trail
A comprehensive audit trail is compulsory when generating data; it also has to be completely secure, automated and time-stamped so that it records the date and time of entries.
The criteria described by CFR21/11, which include standardisation, increased use of electronic transactions and automation can translate to significant cost reductions for manufacturers. Abiding by these requirements also boosts the credibility of the entire pharma industry. Regulating issues such as serialisation, electronic pedigree and authentication, the CFR21/11 update welcomes electronic submissions in new drug applications alongside electronic logs for safety purposes.
In 2007 the FDA managed to get the National Drug Code (NDC) passed in the United States. This type of serialisation has since been applied to all pharmaceuticals. The NDC contains a unique numeric or alphanumeric code not exceeding twenty characters, which allows for the creation of an electronic pedigree and helps trace the product’s journey from the point of manufacture to the point of dispensing.
The European Federation of Pharmaceutical Industries and Associations (EFPIA) is also recommending that manufacturers use a data matrix containing a unique serialisation number for each secondary packaging unit distributed and sold in Europe.
Designed to protect both end users (patients) and manufacturers, the regulation compels manufacturers to create robust procedures and controls to guarantee the authenticity, integrity and confidentiality of electronic records.
From a lean perspective, CFR21/11 also offers minimum guidelines for Current Good Manufacturing Practice (CGMP) for preparation of drug products. The key areas for CGMP are aseptic processing, automated procedures, scans and cleanroom environments.
A risk based approach
Pharmaceuticals manufacturers wishing to comply with CFR 21/11 can sometimes over-engineer their procedures, with negative consequences on staff and productivity. Manufacturers fall into the over-validation trap when they try to test and assess every aspect of the traceability procedures at hand.
A healthier, risk-based approach should be considered by the manufacturers. Instead of using a bottom-up approach, manufacturers are advised to focus on critical records and thus identify and define electronic records and signatures. The next steps are based on the predicate rules, criticality of the process and risk to product and patient safety.
The risk-based approach leaves out the testing of areas or systems that have been pre-qualified by their manufacturer, making room for more important areas and in which failures would result in downtime or significant infringement of GAMP. It also offers manufacturers the opportunity to improve their systems and comply with regulations while recognising that zero risk is impractical and unattainable.
Though CFR 21/11 is a US regulation, it must be observed by any company wishing to sell medical devices, components or pharmaceuticals to North America and Europe. In a globalised market, manufacturers cannot afford to ignore product quality and safety guidelines. Embracing them and further improving one’s procedures is the only way to remain competitive in an ultra-tough market.