As regulatory agencies like the FDA (America), PMDA (Japan), EMA (Europe), ANVISA (Brazil), and CFDA (China) continue to increase the amount of regulation for the Life Sciences industry, companies must place an increased importance on lean internal audit protocols as well as on respond mechanisms. This can become exceedingly complex as companies expand commercial markets and need to comply with additional market regulators. Companies who manufacture products, such as drugs for human consumption, are heavily scrutinized by regulators; the slightest mishap can incur serious penalties.
There are currently a few major market offerings that companies consider to improve their lean internal auditing processes:
With the speed that information is able to spread in the age of global connectivity, individuals and organizations are held under the microscope by the general public. This is particularly true when regulators announce that a Life Sciences company has been issued a warning letter. Besides negative public perception as a result of a failed inspection, there may also be fines, recalls, or even site shut downs if there are persistent issues that are not resolved.
Life Science companies leverage lean internal audits to make sure their sites are in compliance in each and every way possible. Just to clarify, the term lean audit does not mean any corners are being cut in conducting the audit; it simply means that the quickest, most efficient and effective processes are being used in conducting the audit. The process should be as similar as possible to a regulatory inspection, to ensure that each area is examined with a fine microscope less a company risk falling out of compliance. For those companies who are active in multiple markets, there is the additional onus of needing to do audits for each series of regulations where compliance is required.
Most companies have one concern with their internal auditing process – is it effective at identifying concerns? However, when one looks at FDA inspections in aggregate for Life Sciences (see fig. 1), the FDA finds only 60-65% of inspections (annually) perfectly in compliance or have No Action Indicated (NOI) in the findings from the inspection. Approximately 30-35% of inspections annually result in a Voluntary Action Indicated (VAI) which is raised when there are areas found to be out of compliance, but it does not meet the regulatory threshold for significance. In these cases, it is more of an identification that something should be done, but the company is not found to formally be out of compliance. Finally, 4% of inspections result in an Official Action Indicated (OAI), meaning that the company was found to be significantly out of compliance and action must be taken to resolve it. 1 2
Following the results of an inspection or a lean internal audit, it is up to the company to then take action to resolve issues using the Corrective Action and Preventive Action (CAPA) methodology. The company must analyze the issue to determine a root cause and implement both a correcting mechanism for that occurrence and a preventative mechanism, so that the issue will not occur in the future. Internal audits and regulatory inspections are not the only causes of CAPAs – any investigation of an issue on site or in the supply chain will require the company to create a CAPA in order to ensure quality of their product. It is very important that CAPAs are well documented and follow through 100%, because regulators will review CAPAs when they come for inspections.
The top concern in this Audit to CAPA process for most companies is effectiveness, which per the results of the FDA’s inspections statistics, is questionable. However, what many companies are not considering is if there is a way to not only be effective, but also be efficient. The FDA itself asked this question of their own inspection processes and “to enable the Agency to more effectively allocate its limited regulatory resources, the FDA is implementing a risk-based approach to regulating pharmaceutical manufacturing.”3 Life Science companies need to use the same approach to help focus their efforts where their risk is the greatest. This is not to say that low risk sites and products do not need comprehensive internal audits, quite the contrary: in order to balance effectiveness and efficiency companies must use risk identification and quantification to direct them where they need to do additional audits, and improve their response mechanisms.
For Life Science companies, internal audits and CAPAs are significant drivers of the cost of good quality. The cost of good quality (see figure 2) is defined as appraisal (lean internal audit) and prevention (CAPA) costs. Life Science companies have a great deal of costs associated with quality, but these are two areas that are not typically investigated when a company is looking to go lean. This is likely due to the related costs of poor quality, specifically the costs associated with failing regulatory inspection. By not focusing specifically on how to make the internal auditing and CAPA process efficient, it actually ends up reducing the effectiveness of the programs because like the FDA, resources are not infinite.4 While companies typically will spend what it takes to maintain their compliance, some still will fail inspections. Focusing on efficiency can allow a company to ensure a higher inspection pass rate while dedicating less resources to their internal audit and CAPA processes.
In the Life Sciences market there are typically two approaches to improving lean internal audit and resulting CAPA process, external consultants and information systems:
Outsourcing – This can be a good option for a company when they have had very recent struggles with the effectiveness of their own internal audit processes. This will allow the company to quickly identify compliance gaps by having a regulator quality inspection without the penalties a regulator can hand out. The longer term agreements are a little less appealing because they can be quite expensive and they force the company to rely on an outsider rather than building up internal capabilities. This is a problem because if the outsourcing company has turnover and does not keep up their quality, it will be difficult to identify the problem proactively and instead appear when the regulatory inspection fails. Additionally, there can be a conflict of interest in allowing the outsourcing company to help define audit frequency and strategy, or the Life Sciences Company must define their own frequency and strategy without being involved in the auditing themselves.
External consultants – These resources are typically very successful at ensuring internal audits are effective at maintaining compliance. The approach is very much to maintain compliance regardless of costs. What they typically lack are process optimizations that allow internal auditors to do more with less, and a technological solution that can further enhance the effectiveness of the team, reporting quality, and real-time identification of risks.
Information systems – In the modern era there are many different software based solutions which track and trend information and allow real-time reporting of metrics. Not all of them are fully integrated to have each quality; ERM, financial, and compliance systems communicate to produce high impact – simple reports for management’s evaluation. But there are some options which can do this. The main concern with implementation of information systems is typically the perception it comes only at a very high cost and the fear that the provider has not fully evaluated and optimized processes around the system. An information system will be an underutilized tool with a very limited ROI, unless processes around it are enhanced, user roles and responsibilities are defined, and response mechanisms are put in place.
To deploy the most effective lean internal auditing program that will prevent regulators from finding OAIs and VAIs is not necessarily costly. In fact, the most effective program is efficient and therefore able to pay special attention to high-risk areas while giving management the confidence that compliance will be assured through identification of all potential concerns. To ensure compliance it is critical not just to identify concerns, but to correct and prevent them quickly and comprehensively and enhance the response mechanisms process. To ensure this, the ideal solution involves four key phases:
Diagnosing the problem – the purpose of this phase is to understand the current state. How is the company doing with compliance? How efficient are their internal audit and subsequent response programs? Typical activates include:
Designing the solution – during this phase the future state is defined in specific detail, and a plan is developed to take a company from their current state to their ideal state. Typical activities include:
Implementing and embedding – During this phase the plan designed in the previous phase is put into place. Key considerations during this phase are:
Sustaining & improving – The final step is an ongoing effort that begins with a scheduled reevaluation of the current state, typically 1 year after implementation begins. It includes utilizing the reporting mechanism and defined metrics to measure success and identify troubled areas. The critical element of this phase is to make sure that the initiative not only sticks, but is regularly evaluated for further improvement. As regulations periodically change, it is important to make sure the program keeps pace with any changes.
An immense amount of pressure is put on Life Science companies not only to maintain compliance with one or more regulators, but also to compete in a global environment. In order to manage this, companies need to deploy lean audit teams which identify all possible concerns, and must also have lean response mechanisms which allow comprehensive follow through in a swift and efficient manner. Consider this methodology and the significant advantage it will bring to facilities during increasingly competitive times.
By Tom Ambrogio and Adit Babureddy, consultants
Monopoly Building, Operational Excellence, Change Management & Supply Chain Expert