API Focussed MHRA Inspections at Dosage Form Manufacturers Background The Medicines and Healthcare products Regulatory Agency

(MHRA) are the United Kingdom (UK) Competent Authority responsible for implementation of European Union (EU) medicines legislation in the UK. MHRA are also responsible for inspection against and enforcement of the legislation in the UK and inspection of 3rd country sites supplying final dose form drug products to the UK. In October 2005 new legislation was passed in the European Union requiring that Active Pharmaceutical Ingredients (API) used as starting materials in dose form pharmaceutical manufacture must have been manufactured in compliance with Good Manufacturing Practice (GMP). The relevant legislation is:
Amended This

EU medicines legislation Directive 2004/27/EC (2001/83/EC as amended).

was transposed into law in each member state (in UK as Statutory Instrument S.I. 2005/2789, October 2005). Article 46(f) of 2004/27/EC introduced an obligation (by law via S.I. 2005/2789 in UK) for Manufacturing Authorisation holders (EU manufacturers or importers of the final dose form) to use as starting materials only active substances, which have been manufactured in accordance with the detailed guidelines on Good Manufacturing Practice for active substances. Such Manufacturing Authorisation holders may be European Economic Area (EU plus Lichtenstein, Norway and Iceland) based manufacturers or EU based importers of medicinal products from outside the European Economic Area (EEA). In addition, from this date Marketing Authorisation Applications and variations to change the source of the active substances used as starting materials have had to be supported by a declaration of GMP Compliance of the active substance manufacturer by a Qualified Person (QP) of the dosage form manufacturer.

Inspections by EU Competent Authorities Compliance with the above legislation is assessed during inspections of Manufacturing Authorisation holders by EU Competent Authorities. As such MHRA are responsible for such assessments in United Kingdom (UK) inspections. In some cases the Manufacturing Authorisation holder may delegate agreed responsibilities for demonstration of API GMP to 3rd Country (Non EEA) manufacturing sites and in such circumstances MHRA would inspect the work carried out at 3rd Country sites. In such situations the Manufacturing Authorisation holder retains overall accountability for compliance with the legislation. The current inspection program for Manufacturing Authorisation Holders in the UK is conducted on a two yearly cycle with 3rd country sites inspected every 3 years.

Manufacturing Authorisation holders are inspected for compliance with the requirement to use APIs, as starting materials, which are manufactured to GMP. However API compliance forms only a portion of the inspection typically less than 5% of available time (depending on type of site and nature of findings). As such this section of the inspection is focussed on the presence of specific quality systems to deliver the requirements of the legislation and availability of supporting documented evidence. Expectations of Manufacturing Authorisation Holders MHRA will look for evidence of effective systems during inspections. Manufacturing Authorisation holders must have a supplier evaluation and approval program covering APIs (this must be in place irrespective of whether a QP declaration has been required i.e. it applies to all existing drug products as well as new applications). This program must accumulate a body of evidence which enables the GMP compliance status of each API supplier to be determined. The program must also include periodic reevaluation of each suppliers status. A number of key pieces of evidence are typically required by MHRA:

Approved manufacturers and supplier listings must be in place, be current, readily available and be supported by documented evidence gained through the above evaluation program. Addresses of manufacturing sites should be requested to be displayed on Certificate of Analysis and/or product containers to allow comparison to the approved list; this is particularly important where API manufacturers may have more than one API facility. Procurement systems must only allow purchase and receipt of APIs that are approved or undergoing controlled assessment (through change control). Supply/quality agreements with API manufacturers/suppliers must unequivocally identify the approved site(s) of manufacture. The entire supply chain for a supplied API must be defined and approved by the Manufacturing Authorisation holder. This must include all steps from input of the starting material to the API process through intermediate stages of manufacture and any subsequent Agents, Brokers, Traders, Distributors, Repackers and Relabellers i.e. all steps within the scope of the EU GMP Guide part II. The precise role and responsibilities of any Agents, Brokers, Traders, Distributors, Repackers and Relabellers must be understood to ensure that the quality of API leaving the manufacturing site is maintained. Additionally the temperature conditions during transportation must be confirmed as appropriate to the needs of the particular API or intermediate. It is expected that in order to approve an API source an audit(s) will have been conducted by or on behalf of the Manufacturing Authorisation holder.

All steps in the supply chain of the active substances in use by a Manufacturing Authorisation holder will have been audited, including those in third countries, by or on behalf of the Manufacturing Authorisation holder. Audits of API sites must be conducted against the requirements of the EU GMP Guide part II (ICHQ7a) by auditors with suitable knowledge and experience in API manufacture. Qualified auditors must have demonstrable evidence that they: Have been trained in the techniques of auditing Have sufficient training or experience in API manufacture to support a capability to audit effectively in the environment. This is particularly important as API plants and GMP issues are very different to a dose form facility. Have specific knowledge and experience of the requirements of the EU GMP Guide part II. Any deficiencies identified through the audit(s) must be risk assessed, classified and appropriate action taken. Should high risk deficiencies be identified with existing suppliers consideration must be given to immediate correction to prevent impact on patient safety e.g. quarantining batches, recall of product. Any deficiencies identified must be managed to conclusion via an effective Corrective and Preventive Action (CAPA) management system. The audit report should be available for inspection by MHRA at the Manufacturing Authorisation holder site. The report, and appropriate follow up records, should be sufficiently detailed and confirm the following information: Date(s) performed Auditors (their qualifications should be available separately for inspection) The scope of the inspection The outcome i.e. number and category of deficiencies. Any deficiencies that could threaten patient safety must be declared Current status of deficiencies/ CAPA Period of validity of the audit (depends on circumstances but nominally three years is expected.)

Conclusion/recommendations for supplier approval. A Technical Agreement (Supply/Quality Agreement) must be in place with the API manufacturer/supplier(s). Contents of the Technical Agreement (TA) should be compliant with Chapter 7 of the EU GMP Guide and specifically include: Arrangements for change control and agreement that the API site will notify the Manufacturing Authorisation holder of any changes or deviations that could impact the quality of the supplied API or alter the typical profile. Requirement to notify the Marketing Authorisation holder of any changes submitted to the Drug Master File. Agreement to allow access to audit the API site Documentation of the agreed specification Agreement that sub contracting will not be allowed without the Manufacturing Authorisation holders consent An incoming goods inspection program must be in place that documents: Requirement for confirmation checks on source of API (manufacturer and supplier) and a visual inspection of goods. Sampling plans Testing arrangements/ Certificate of Analysis (C of A) requirements Non conforming goods process. Requirement to fully investigate any anomalies e.g. atypical test data, unusual C of As, different packaging. API audits by 3rd Party Auditors are regarded as suitable by MHRA on the following basis: The scope of the audit must be clearly defined with the auditor and must include appropriate/defined elements of the supply chain. A 3rd party auditor may provide audit reports to multiple manufacturing authorisation holders. Manufacturing Authorisation holders may make

use of such a report as far as the scope is fully pertinent to the APIs in question.

If auditing as a 3rd party a Technical Agreement should be in place between the auditor and the contract giver complying with Chapter 7 of the EU GMP Guide and auditors must have no vested interests in the outcome. If using 3rd party auditors Manufacturing Authorisation holders should consider the impact of absence of personal contact with and knowledge of the API manufacturer. This can make discussions on any future quality problems or changes more challenging and potentially less effective. Where Competent Authority inspections reports or GMP certificates are available these can provide useful information to Manufacturing Authorisation holders in the assessment of API suppliers. However, these alone cannot fulfil the statutory obligations of the manufacturing authorisation holder or the requirements of section 5.25 of the GMP Guide. The results of inspections may be used together with other supporting information in a risk-based approach by the manufacturer in establishing priorities for its own audit programme of active substance suppliers. Where used extreme caution should be taken that the scope of any Competent Authority inspection covers the specific API and supply chain applicable to the Manufacturing Authorisation holders product(s). It should be noted that as inspection of an API manufacturer by a Competent Authority is not compulsory the majority of APIs manufacturers will not have been inspected. Should an API supplier be identified by audit or other means as not fully GMP compliant appropriate action must be taken by the Manufacturing Authorisation holder and dependent on specific circumstances may include: A risk assessment of the deficiencies identified and effect on the supplied APIs. Consideration of suspension of approved status and discontinuation use of applicable APIs. Consideration of product recall and notification of same to local Competent Authority. Increased testing of API to focus on particular risks. Repeat audit or coaching of API supplier to improve GMP compliance. Consideration of notification to a Competent Authority of API site details (to allow assessment against other licenses that may name the API source or as preventive information for new submissions). This may trigger an

inspection of the API manufacturer by a Competent Authority as allowed for in the new legislation. Output of MHRA Inspections of Manufacturing Authorisation Holders Any deficiencies identified by MHRA are addressed via the inspection reporting system. Required action will vary between member states but could in circumstances of serious deficiencies involve:
-

Requirement to recall product. Refusal to grant variation to a Marketing Authorisation

Removal of the API site from a Marketing Authorisation Suspension or removal of a Manufacturing Authorisation Warning to a Qualified Person related to conduct/responsibilities or withdrawal of QP from a Manufacturing Authorisation Inspection of the API site by the Competent Authority

In less significant deviations Manufacturing Authorisation holders would be required to improve their quality system within an agreed timeframe. Dosage Form Manufacturers Inspections - MHRA Inspection program findings

Deficiency category definitions used by MHRA are as per the EMEA Compilation of Community Procedures.

Potential contributors to deficiency categories could be: CRITICAL Findings of actual or potential threat to patient safety from the drug product containing a particular API. No supplier evaluation/ audit of API supplier and no receipt testing conducted (API at most receipted on C of A with no supporting information) Continued failure to demonstrate adequate compliance with the EU regulations on use of GMP compliant APIs. MAJOR Significant deficiencies within the API compliance program but each batch of API fully tested on receipt and no immediate threat to patient safety.

API audit conducted with major deficiencies identified but current status of deficiencies and overall approval status unknown by Manufacturing Authorisation holder.

OTHER Minor deficiencies in API compliance program but general confidence that the API is GMP compliant. Technical agreement does not include all requirements. Experience to date of Compliance of Manufacturing Authorisation Holders with the Legislation In General:

Dosage form manufacturers have or are working towards fully compliant programs to demonstrate APIs are manufactured to GMP. The requirements are a particular challenge for generic manufacturers with a wide API supply base taking additional resources and time to complete required activities. Many large pharmaceutical companies have had programs in place prior to the introduction of the legislation and were already generally complaint. Most companies are aware of their responsibilities and are at varying stages of compliance.

Examples of specific findings in MHRA inspections:

No adequate system in place to verify the source of each delivery of API. No (or inadequate) Technical Agreements in place with API suppliers. No audits conducted of some or all API supplier sites. Importers not taking responsibility themselves for GMP compliance of APIs used in imported dose form. Importers assuming 3rd country dose form manufacturer are conducting audits etc but importer not specifically aware of actual activities at 3rd country site. Importers delegate responsibility to 3rd country but do not retain accountability to ensure that the work has been done in a compliant manner. Brokers/Traders not included in supplier approval program. Auditors not experienced/trained in API manufacture.

GMP of Atypical APIs The legislation referred to earlier applies to all registered Active Pharmaceutical Ingredients. It is a requirement for all registered drug products that an active ingredient is named on the Marketing Authorisation Application. In some cases materials named as the active ingredient may not be pharmacologically active and may be commercially manufactured for uses other than in drug products. An Atypical API is one that falls into this latter category. Difficulties facing dose form manufacturers in assuring GMP of certain Atypical APIs is understood by MHRA. It may be that the primary use of the material is not for drug product use and the primary use may not require standards fully equivalent to GMP. The pharmaceutical user of the material may be a very small customer and does not have the necessary influence to demand or guide the manufacturer toward full GMP manufacturing standards. In worst cases suppliers may not provide access to audit manufacturing facilities. This situation has also been highlighted through a European Commission survey of implementation of the new regulations that was conducted by the European Medicines Agency (EMEA) via Competent Authorities in 2006/2007. The EMEA are to convene a working party to develop proposals as to how to manage expectations for these Atypical APIs. To date MHRA has taken a pragmatic approach to GMP compliance of these materials and as such considered each case on its own merits. Appropriate elements of the EU GMP guide part II are expected to be applied by the API and dose form manufacturer. As a principal such controls must provide confidence that the Atypical API is fit for purpose and will not negatively impact on the safety and efficacy of the drug product. QPs should justify the controls in place on a scientific basis and record a risk assessment on a product specific basis for use of such Atypical APIs for which GMP compliance can not be demonstrated or is known to be incomplete Summary Inspections of dose form manufacturers by EU Competent Authorities are routinely assessing the companys API GMP compliance programs. Expectations of programs are based on the requirements of Directive 2004/27/EC and interpretation by EMEA http://www.emea.europa.eu/Inspections/GMPfaqAS.html MHRA will expect to see evidence of specific elements of a supplier approval program, a key element of which is considered to be an audit(s) of all steps in the supply chain. The Manufacturing Authorisation holder is responsible for taking appropriate action to ensure API sources are GMP compliant. Adverse findings from inspections may result in various action steps taken by MHRA. In general since the introduction of the new legislation dose form manufacturers are taking steps to assure GMP compliance of the API supply chain.

Written by: Graeme R McKilligan GMP Inspector MHRA York, UK