FDA Approaches to Laboratory Data Integrity

Guidance: Data Integrity and Compliance With Drug cGMP 2018

Bob McDowall
R D McDowall Limited

©R D McDowall Ltd 2021 www.rdmcdowall.com 1

 Data Integrity
Guidance

Food and Drug Industry

European World Health
Administration PIC/S Guidance
Regulators Organisation
Documents

Good Practices
Guidance on PDA TR80 European APIC
Inspection of CPG 7346.832 MHRA EMA for Data GAMP
Good Data and Lab DI Compliance Practical Risk
Pharmaceutical Pre-Approval GMP DI Q&A: Management and Records &
Record Management Academy Based Guide
QC Laboratories Inspections Guidances GMP D I Integrity Data Integrity
Management System DI & DG v2 for DI
1993 2012 2015 2016 Draft 2: 2016 2017
Practices 2016 2018 2018 2019
Draft 3: 2018

MHRA Good Practices Not shown are Guidance documents issued by:
Data Integrity
Level 2 Guidance
and cGMP
GXP DI for Data 3 Good • Russia 2018,
on the FDA Web
Compliance
Guidance Management and Practice Guides • China 2020,
Site 2010
2018
Rev 1 Integrity 2018 - 2020 • OECD GLP 2020 (draft)
2018 Final 2021 • WHO 2020 (draft)

©R D McDowall Ltd 2021 www.rdmcdowall.com 2

Laboratory Data Integrity Concerns
• FDA compliance program guide 7346.832 for Pre-Approval Inspections
effective May 2012
• Updated after Able Laboratories fraud case in 2005
• Three objectives with data integrity in all
• Updated again in September 2019
• More detail on where inspectors should look to discover any DI problems
• R D McDowall, Focus on Quality, December 2019
• Objective 3 Data integrity audit
• Audit the raw data, hardcopy or electronic, to authenticate the data submitted
in the CMC section of the application. Verify that all relevant data (e.g., stability,
biobatch data) were submitted in the CMC section such that CDER product
reviewers can rely on the submitted data as complete and accurate.

©R D McDowall Ltd 2021 www.rdmcdowall.com 3

 ALCOA+
Criteria
ALCOA
Criteria
Who acquired data or performed an All data / metadata including any
action? repeat or reanalysis performed.
When was the activity performed? Attributable Complete Includes any excluded data and all
Q1a: FDA use
Identity of instrument and method. changes. No deletions or unofficial
Location may be required. tests. Second person review checks ALCOA criteria for
data integrity
Can you read and understand All records follow in the expected
written entry. Can a data file be sequence with supporting dates or
read and understood? (May require Legible Consistent time stamps Remaining ALCOA+
contextual metadata). Readable Enforcement by computer systems
after system upgrades or migrations with technical controls criteria are from
the EMA concept
Documented or recorded at the
ALCOA Further Reference:
paper on GCP
time of the activity. Real time data Contem-
capture and processing. & WHO Good Records and Data electronic source
Time and date (time zone) recorded poraneous Management Guidance
data 2010
Use of scribes needs justification. ALCOA + Appendix 1 (TRS996 Annex 5, 2016)

First written observation, e-record Many + criteria can

Record on official & durable media.
or printout. No unathorised copies.
Synchronise hybrid records. be inferred from
True or verified copies are OK. Original Enduring No use of envelopes, cigarette
Blank forms and master templates
packets, Post-It notes or body parts
ALCOA or GMP
controlled.

No errors or editing without Accessible for review, audit or

documented amendments.
Instruments calibrated/qualified.
Software & methods validated
Calculations and rounding correct.
©R D McDowall Ltd 2021
inspection over the record lifetime.
Accurate Available Applied to any media used for GXP
records. Dynamic data remains
dynamic. Migrated data readable.
www.rdmcdowall.com 4
©R D McDowall with input from Ulrich Köllisch
Laboratory “Complete Data”
• 21 CFR 194 (a): Laboratory control records should include complete data
derived from all tests conducted to ensure compliance with established
specifications and standard, including examinations and assays, as
follows…
• Definitions:
• complete: having every necessary part or entire
• data: a series of observations, measurements, or facts.

©R D McDowall Ltd 2021 www.rdmcdowall.com 5

Q1d. How does FDA use the terms “static” and
“dynamic” as they relate to record formats?
• Static Data
• … static is used to indicate a
fixed-data record such as a
paper record or an electronic
image.
• No interaction with the record
• Values can be averaged or trended
©R D McDowall Ltd 2021 www.rdmcdowall.com
• Dynamic Data
• … dynamic means that the record
format allows interaction between
the user and the record content
• For example, a dynamic
chromatographic record may allow the
user to change the baseline and
reprocess chromatographic data so
that the resulting peaks may appear
smaller or larger.
6
Paper: Controlled Blank Forms (Q6)
• Integrity: laboratory notebook pages numbered
• BUT major problems with uncontrolled blank forms: how many times has
work been performed?
• Controlled sheets with accountability:
• Blank forms MUST be uniquely numbered
• Distribution and reconciliation
• Damaged forms retained with rationale for reissue of a new form
• High administrative overhead: Get rid of paper
• See Burgess and McDowall, Questions of Quality, Sept 2016

©R D McDowall Ltd 2021 www.rdmcdowall.com 7

FACTA Farmaceutici S.p.A. FDA WL January 2017
• 2. Your firm failed to establish an adequate quality control unit with the
responsibility and authority to approve or reject all components, drug product
containers, closures, in-process materials, packaging materials, labeling, and
drug products (21 CFR 211.22(a)).
• Our investigator observed many copies of uncontrolled blank and partially-
completed CGMP forms …. without any accountability or oversight of your
quality unit.
• … a supervisor said he photocopied a blank OOS form and transcribed the
information because he had made mistakes in the original document.
Although your procedures required correcting mistakes on the original form, he
made a new copy of a blank OOS form and rewrote the data.
• Our investigator documented that your employees used paper shredders to
destroy critical laboratory and production records without the appropriate
controls and procedures. Shredded documents included High Performance
Liquid Chromatography (HPLC) chromatograms and a partially-completed OOS
form.
©R D McDowall Ltd 2021 www.rdmcdowall.com 8
Computerised Systems: Paper v Electronic Records?
• Some laboratories still think that paper printouts from a
computerised system are the GMP record
• Wrong!
• FDA are focusing on e-records and have been trained in assessing
electronic data integrity (Q10 and Q17)
• Paper records incidental to e-records
• E-records are the raw data for hybrid and electronic systems (Q10)
• Inspectors require access to your computerised systems (Q17)
Refusing a request means your products are adulterated
• How will you handle this?

©R D McDowall Ltd 2021 www.rdmcdowall.com 9

 Hybrid System (Q10)
• Paper Records
• Work recorded in laboratory
notebook
• Signed paper printouts from IT
system
• Identifies the user who did the
analysis
• Identifies the files created
• Identifies the library used
• Electronic Records
• Time and date stamp accurate
• User uniquely identified
• Analysis files uniquely identified
Synchronise • Files backed up
• Comparison with library correct
• Library maintained correctly
• Audit trail entries

Spreadsheets are a hybrid system and high regulatory risk e.g.

Tismore Health and Wellness Pty Ltd, Dec 2019, FDA WL

Instrument logbook matches work in the system and printouts

©R D McDowall Ltd 2021 www.rdmcdowall.com 10
Electronic System e.g. CDS
• Validated system: workflow and calculations
• Users uniquely identified with appropriate access privileges
• File creation and management via CDS
• Signed electronic report and records
• Minimal paper printouts (e-signed report)
• Audit trail entries reviewed
• Time and date stamp accurate

©R D McDowall Ltd 2021 www.rdmcdowall.com 11

CDS Data Integrity Issues 2005 - 2021
• Unofficial testing (test, prep etc)
• Data deletion and time travelling
• Adjustment of sample weights to pass
• Shared user identities
• Selective reporting
• Conflicts of interest: all users have admin privileges
• Turning audit trail on and off
• Peak integration: Integrating into compliance,
• Short runs / aborted runs (instead of unofficial testing)
• Invalidating out of specification results

©R D McDowall Ltd 2021 www.rdmcdowall.com 12

Second Person Review
• Checks to ensure that work has performed correctly
• Includes review of applicable audit trail entries (Q7 & Q8)
• This is a QC NOT a QA function
• Checks to ensure that data have not been falsified (Q16)
• Use technical controls in software to enable a rapid second person
review:
• Restrict where an analyst can store data
• Restrict user privileges
• Formal data integrity investigation if falsification found (Q15 & Q18)

©R D McDowall Ltd 2021 www.rdmcdowall.com 13