Questions on FDA Registration and 510(k) by an Asian client on a facility move:

QUES 1) The unit which we are delisting, will this be subjected to any USFDA
audit for the production done so far ?

 

ANS:  All production is subject to review / audit by the Agency, usually if there are problems. Once the facility is shut down, such review is only done on the existing records, lot / batch records, logs, validation test reports, etc.  I recommend you do a shut down verification per one of my previous e-mails I just sent you, to verify that everything was operating in specification for the last lot / last item in the last lot produced.

   
QUES 2) The US FDA 510K was first given to the XXXX unit and now is also
available to the YYYY unit. The 510K is very important for us and I am assuming that even if we remove the old unit it will not affect the 510K given to our company.

 

ANS:  The 510(k) remains with the company, unless it's sold with the device. The company's address can change, but that doesn't change the 510(k)'s  ownership.  The FDA however currently has no way to update old 510(k)s on file with them, 'tho they recognize that's a problem.

 

However whenever you change production locations, equipment, processes tied to a 510(k), you are responsible to revalidate the things that changed or moved to prove that the product is still being made the same (and as documented in the 510(k) - see the two guidance documents on changes to devices and the 510(k)') and no quality issues have arisen as a result of the move / changes.

-- jel@jelincoln.com 

 Some European Companies Selling in the US Aren't Playing By the Rules

As a consultant working with clients all over the world, I sometimes get push-back to a recommended action using reasoning similar to the following:

Most of the pharma facilities in this area are not following the cGMP rules, even though they sell to USA market.  This happens when if they bring in new equipment. The facilities here are almost 20-30 years old and they all seem to have the understanding that if they print the batch record on a paper then they are free from Part 11 requirements. They don't do cleaning after each run.  They claim they only use a paper system, and aren't under 21  CFR Part 11. Some companies are doing API manufacturing in a non-sterile environment, not good aseptic processing . Some are installing new equipment, but with no proper (or only haphazard)  verification / validation, and many other non-conformances. It doesn't appear that the FDA has been here for inspections. So, if my competitors are not obligated to follow the cGMPs, why should I?

I usually answer similarly to the following:

If the companies sell in the US they are required to follow the US FDA CGMPs for their
industry, e.g., 21 CFR 820 for devices, and 21 CFR 210, -211plus for drugs.  They don't need 

to follow 21 CFR11 if they used paper records and manual signatures, BUT all their people 

have to do that.  If some are using the e-records / e-signatures to do CGMP activities / 

records, then it doesn't matter what they say their policy is, they're viewed as under Part 11 

by the US FDA.  

The FDA has 11 resident posts located world-wide, outside the US, 3 in mainland China.  They

are still backlogged due to COVID19 in inspections, and they base the frequency of

those inspections on the company's products' risk to patient.  But I have worked with some 

EU companies that have had US FDA inspections and gotten Warning Letters, ditto Asia, so 

the FDA is currently inspecting some companies in the EU and Asia.  Those companies had 

previously had greatnotified body audits, incidentally.  The CGMP disconnects I see are usually with the biggest 

problems in CAPA, Trending, andthe definition of risk (the FDA focuses on patient safety, many EU and Asian companies also include      

financial, regulatory, schedules under risk as well).  I see a lot of problems with V&V all over the 

world, including in the US.Some validations not holding variables constant, e.g., with written P/Ns and specs, change control,

key variables not validated, no predetermined acceptance criteria set before running the V&V, et al.

Sad to say, I see the same things that you've mentioned.  As a consultant, I usually get called after 

an FDA Inspection, when the company gets a lot of 483 observations and/or a Warning Letter for

for things they should have been doing all along but weren't.

Some current Covid 19 vaccine start-up production issues, drug 

shortages, and baby formula shortage problems here in the US were due to failures in cross-

contamination controls, basic CGMPs. In some cases, they've been misinformed by another consultant.

I try to educate such companies and their personnel, but some feel I'm only requiring some document

to "pad my fee", so, sad to say they'll find out the hard way when they finally are inspected and get a 

Warning Letter, or are shut down after some of their customers in the field get sick or die.

-- jel@jelincoln.com

 Equipment Software / Firmware V&V, Part 11 Issues

QUES:  I read some of your articles on IVT network. Content of the articles are very clear and informative. I still have some questions though. Can I ask if you don't mind ? For medical device manufacturing industry, we follow 21 cfr 820, 21 cfr 11. Under 21 cfr 820 there is Device Master Record, Device History Record & Device History File.

 Let's say there are 3 machines used for manufacturing a FDA regulated medical device. 1. Inspection Machine, 2. Assembly Machine, 3. Blister Machine. Q:Will these machines at any stage create electronic Record that we must preserve under FDA regulations? E.g., Recipes/ configurations, Visual Inspection (Quality Related) pictures of Labels, Alarms

ANS:  The CGMPs for devices, 21 CFR 820 require a DMR or recipe for how the device is built (BOM template, references to applicable assembly and test SOPs, drawings, required labeling, traveler template, etc.). The DHR or lot record provides proof that the DMR was followed for that lot, e.g., the BOM is filled out with lot numbers and quantities of each part used, the traveler documents line clearances, machine settings, QC test results, etc.. These records may be kept manually / paper, or electronically. If kept electronically, or if E-SOPs, etc., are used, then 21 CFR 11 becomes operable, and any computer systems used to generate, use, save, change those e-records / e-signatures must be validated, to include Part 11 issues, e.g., audit trails, date / time stamping, et al. That would include the three pieces of equipment you mention; if they generate an e-record to be used in proving CGMP compliance (to 820) to be retained in the DHR, etc., then they have to include Part 11 issues as part of the required validation. Since all equipment must be validated, and all software / firmware must be validated. If the equipment uses software to run, but not to generate records (i.e., you record the information to set or run the equipment and capture any data manually (e.g., manually write info on the traveler), then the equipment and its software would be validated as normally (e.g., IQ, OQ, PQs), but Part 11 elements would not be part of the validation. Part 11 only becomes a requirement if you are using e-records and/or e-signatures in lieu of paper records and/or manual signatures, to prove or satisfy a CGMP requirement / provide a CGMP record.

QUES:  Thanks a lot John for the Answer 🙂 To give you a clearer picture, We have SAP which creates the batch number, expiry date, units to be produced etc and sends to SCADA. Machines receive this information from SCADA. So there is no communication from Machine Control system to SAP. What else SCADA communicates to Machines & vice versa? Recipe Name, good/bad items produced, Machine states(Running/stopped/aborted, etc.) but no Alarms are communicated. Also, there is a significant amount of Machine Parameters configurations (also a part of Machine recipe) needed to produce the Items, remain in machine. It's not recorded anywhere else, only in machine. But machines don't have Electronic signature at any stage. SCADA also maintains the EBR. Like line clearance, goods received etc Electronic signature is maintained in SCADA to validate the changes. We also have Electronic Document Management System where we have DMR, DHF. Change control is maintained in this EDMS.  

ANS:  Basically what you described fits what I sent you previously.  Not only does the computer systems need to be validated per 21 CFR 820, but those computer / electronic systems involved in facilitating and/or  documenting CGMP actions (if any) also need to be validated to 21 CFR 11 on top of the general CGMP validation (I usually add Pt 11 test cases to the OQ).

-- Jel@jelincoln.com

Also, where validated machines generate data that needs to be retained in the GMP record, instead of the normal data integrity requirement of two signature, one entry, one verification, only one signature is required, one verification. -- JEL 09/19/2023