The road to free validation

At first glance, the title of this article may bring a wry smile to the face of many an astute practitioner, but I can provide 'documentary evidence' that free validation is not a just a play on words, but a financial reality.

Flawed philosophies

As a seasoned lecturer in validation and compliance, I welcome novel ways of explaining what validation and, more generally, compliance are; how they affect a company; and how best to implement them. Fundamentally, as a pharmaceutical facility embarks on a validation initiative, or rather the overall pursuit of regulatory compliance, projects can easily become lost in the detail and, consequently, lose sight of their true objectives. All too often, personnel put their energies into 'doing things right' and, while this may seem commendable, on closer inspection it can be found wanting. I have found this embraced in companies as part of policy, but these flawed philosophies can manifest as problems almost anywhere in the business. Unless the company has the evidence to back up such claims, regulators will know exactly what to challenge and where to expose these shortcomings.

Doing things right is also often extolled as the rhetoric in training sessions and project meetings without consideration of the huge costs and burden of both the validation effort and the remedial tasks in the infrastructure required to support them. Often we find investment in both is disproportionate to any returns, making it no small wonder that validation is still regarded by many with great suspicion. Practitioners have also opined at conferences that it adds no tangible value to their business, but why is this misconception still prevalent? Why are there still so many misunderstandings surrounding validation and what constitutes full compliance with, for example, FDA and the Code of Federal Regulations (CFR)? One answer is that we should all ponder less about 'doing things right' and think more objectively about 'doing the right things', otherwise we may find that we have elevated the entire operating parameters of the business to a level it cannot afford, is ill equipped to develop and incapable of sustaining.

Conditions

There are conditions to achieve 'free validation'. First, financing a major validation project requires substantial capital outlay and is a daunting task for all concerned. When validation is placed alongside the daily running of the business, cultural resistance is inevitable and someone will invariably ask: "Why do we have to do this?" The point they should be making is that it is not part of their job description, contract of employment or day-to-day duties; in fact ,the extra work is more often a substantial departure from the daily continuity that keeps the business going.

As the intensity of a project builds, so too does the pressure on those in key positions, which contorts the point of compliance from one of substantive inconvenience to a general feeling of upheaval. Add to this the barbed comments between colleagues during monthly project budget reviews, where disparities between project outlay (finance) and progress become all too apparent, and validation becomes even more controversial. Management has every right to feel prickly as the costs and business risks are enormous — get it wrong and you compromise product quality, patients' health and the company.¹

As the funding dries up, corners are cut, strategies are reinterpreted, assumptions are made and the whole experience of striving for regulatory compliance begins to fall apart, if not overtly, covertly in private memos and closed door tête-à-têtes. In the end, the red ink is slashed all over what is left of the budgets, but what has really happened is that the business risk has risen and placed the company at the mercy of the thoroughness of regulatory bodies. But maybe the business will get lucky? Maybe they will not notice that policies and key procedures are not followed and that things have not always been documented. If there is a version of Russian roulette in the pharmaceutical business, this is it. Symptomatic of a business tumbling toward critical and major observations, the condition is known as 'quasi-validation.'²

Keeping it simple is key, but this is easier said than done. Keeping the costs of validation and compliance to a minimum would keep many happy as it would lessen the work load across the entire organization, freeing us to do what we do best — make the finest medicines and devices in the world.

But how does one go about 'doing the right things,' bringing down costs and providing validation for free? There are ways and means via a collection of informed perceptions on well-worn industry maxims, such as, there is little difference between 'process development' (PD) and 'process validation' (PV).³

With the right investment in PD, specifically the optimization of manufacture using a 'corrected business framework (CBF),' validation is achieved in unison and paid for out of the profits from increased yield and heightened efficiencies in manufacture and the infrastructure that supports it. Such a strategy places validation in a whole new light and makes pursuing it good business sense, but only when it is done well and fully integrated.

The epithets used earlier in the context of this article, such as 'remedial actions' and 'CBF', are the terms I prefer when citing the problems inherent within a company. 'Remedial actions' pertains to company infrastructure, namely the short-comings in engineering, maintenance, calibration, analytical methods, utilities, manufacturing, personnel, training, the quality management system, IT and batch records. If there are problems in any of these business units (departments), they will manifest as failings within validation; not failings of validation, per se, but failings of infrastructure — shortcomings that support the undisputed truth that you cannot validate bad practice.

Conversely, a 'CBF' is one that has commercial terms and conditions, and regulatory compliance at its core. Therefore, there must be a clear distinction and balance between business risk (loosing money) and regulatory risk (compliance). For example, within any validation project, only systems, equipment components and instrumentation that have a direct impact on product quality should have a place in the validation scope. Anything deemed to be business risk should be placed among regulatory risk as a function of informed judgments, never out of ignorance.

It is time to abandon the ill-conceived quasi approaches to validation and compliance, not least because the subjects have moved on and become more complex and expensive, but with the advent of electronic records and signatures, the demand for full process and product characterizations, and the growing use of statistics to demonstrate compliance, validation concepts continue to challenge the best of the best. However, the fundamentals of the subject are as true today as they were when Theodore E. Byers introduced PV to the pharmaceutical industry on 11 October 1974.⁴ As validation continues to mature, it also seems to have acquired a quantum state whereby the more we look the more we see. With this comes a heightened awareness of companies' imperfections, shortcomings that make everybody nervous as there is always someone responsible.

The mechanics of validation are very simple. Validation is the pursuit of exactitudes (yes/no, pass/fail, critical/noncritical, compliant/noncompliant). Unfortunately, these are then applied to inexact sciences meaning that a greater degree of realism and rationalization is no longer an option, but a serious business need, especially when one considers that business and compliance risk equate to degrees of business exposure that increase exponentially within the project. This is amplified when a company forms the aforementioned quasi approaches to validation and compliance from a platform of false economies.

How to achieve free validation

So, what are the means by which free validation can be achieved? The following ten categories, in no particular order, show the way and outline a more enlightened and lean approach to validation and compliance. These savings will, collectively, offset the capital outlay, if not immediately then in a realistic pay-back period.

Planning. It's all in the planning as they say. Plan the work and work the plan — validation and the uniform state of compliance are no exceptions to this rule. Reduce the project to the basics and marry these to the existing business model. While it may seem like trying to get a square peg in a round hole at times, there is sound reasoning behind the need to straddle such obstacles. There is no sense in trying to change too much too soon as continuity is key. Maintain all the basic tenants of quality assurance (QA) and quality control (QC) at all times and ensure that the business units are configured collectively, aligned with regulators' GMP requirements. Also remember that regulators have little interest in business efficiency; they are only concerned with whether you have control over both the good and bad elements of manufacture and the facility that supports it.

Gap analysis. Perform a gap analysis against each business unit to determine in real time how healthy the infrastructure is in relation to compliance with regulations and use the findings (the gaps) as the outline scope of a remedial plan. Apply to this process a proceduralized approach to impact assessment, such as methods penned by ISPE, to rationalize and differentiate between business and regulatory risks (modular differentiation).

The process will, effectively, reduce the validation scope. A simple method of achieving this is to obtain the asset registers for all systems, equipment, components and instrumentation and then analyse them in a committee type forum to designate their GMP impact (direct, indirect and no impact). For computer systems, we follow the risk-based approach. Remember, only those with direct impact should figure in the validation plan, but you should log all rationales and the reasons for their respective designations as these will later help explaining any distinction given. They also provide an important source of reference material that supports change control and batch record.⁵ Simply put, check you have all the pieces in each department and ensure that they are compliant with each respective part of the regulation.

Remedial plan. A remedial plan is a recent, but essential, concept. If a company does not address the compliance gap across departments then problems will later manifest in validation, along with all the problems evoked by having to open countless numbers of change controls and deviations. As suggested earlier, the infrastructure is the backbone of the organization, and must be sufficiently robust to support validation and compliance, otherwise there is no business.

In reality, the remedial plan is a collection of smaller plans that outline the patches and fixes required in each business unit. The plan will include a list of deliverables, such as those found in the matrix of a validation master plan (VMP), but in a remedial plan they are deliverables required to correct the infrastructure, and the necessary upgrades to plant and equipment. Once the business unit has been corrected and configured within itself, work can begin to configure it to each of the other departments, providing a robust and compliant infrastructure (modular integration).

Documentation. Simplify the validation suite of documents with lean approaches that rationalize procedures, guidelines and templates. Use these as the basis to form validation plans. The production of these is simplified further still by the prior development of a validation policy and strategy document. While this is not a mandatory document, it is one that includes the statements and details of the strategies pertaining to all aspects of validation and compliance, including cleaning and analytical methods; test methods validation; computer systems; utilities; equipment; and process facilities. By these means, VMPs can be written succinctly and concisely, rendering it much easier to understand and implement the 'policy and strategy' document. This then leads into any programming Gantt charts that are required. Some of the more tried and trusted methods of streamlining validation include:

• Family protocols — master protocols used to validate generic groupings of equipment.
• Integrate Factory Acceptance Test (FAT)/Site Acceptance Test and commissioning with validation as far as possible, placing more emphasis on QC in the engineering sequence.
• Design engineering with validation as part of the design criteria.
• Macro-driven validation templates (these also support QA/Part 11).
• Training — plan the work and work the plan!⁶

Resources. Commit resource and funding to optimize manufacture. As stated earlier, there is little difference between PD and PV. The commitment to PD calls in to play the very mechanics found in PV, resulting in greater efficiency, visibility and control in manufacture, leading to less scrap, more yield and increased profit margins. Essentially, a full commitment to PD should provide PV for free.³

One of the primary functions in PD is 'process characterization' of the process steps: the system of documenting the capabilities of process steps all the way to the edge of failure to establish the 'worse case scenario'. This provides a fuller understanding of the process and a juncture to document process capability. It also doubles as operational qualification and provides some of the obligatory documentary evidence. A secondary function of characterization for validation and compliance is in the use of statistics and statistical sampling. There has always been sampling, but the concept of statistical sampling is relatively new in validation and is now attracting greater interest in other areas within regulatory bodies. Statistics and statistical solutions (sampling plans) are the portal between PD and PV (Figure 1). By examining the process through statistics, using statistical analysis tools and programmes (e.g., Six Sigma and Minitab software), and using information garnered from process/product characterization and making adjustments to process equipment, instruments and components, and so forth, the process performance can be optimized. This will also provide the savings needed to soften the initial capital investment required to support both validation and compliance (Figure 1).

Reviews and approvals. Simplifying the review and approvals process may not, initially, take long to develop. The real-time constraints are often found in the facilitation of the document through the review and approvals process, and this problem is exacerbated where electronic approval is used. Reluctance to let go of the 'hard copy' means that old and new ways of document approvals live alongside each other. The difficulties are complicated by the routing of documents for 'unofficial' preapproval to smooth their eventual passage through the electronic system. This route seems to have invited far more reviewers and approvers than is required to achieve compliance. All the above lengthen the time it takes to complete the cycle from blank paper to approved document.

Rationalization of procedures and the document system. Each business unit will have a plethora of dedicated standard operating procedures that have evolved with little or no regard to how they are best configured to the business sector they are designed to service, and with no regard to how they link (directly and indirectly) with procedures in other departments/sectors. Ostensibly, the coverage of procedures carry overlaps, conflicts, misalignments, gaps and a degree of duplicated effort. The number of procedures should be reduced through rationalization, retirement, amalgamation and redesignation. However, there should never be a procedure when a guideline, work instruction or routine will suffice.

'Active' current good manufacturing practice (AcGMP). GMPs are required by law where cGMPs are the current interpretations of these laws and AcGMPs are the 'active' real-time interpretations of GMPs. cGMPs are penned by peer-review groups, such as the Pharmaceutical Inspection Convention, ICH and the Parental Drug Association, but these take time to filter through industry as they require drafts consultations, seminars, papers and, ultimately, publication. Therefore, GMPs and cGMPs are, by nature, retrospective when used by industry. Real-time interpretation of AcGMP is derived from a company's study of regulatory trends, citations and warning letters. These observations eventually find their way into the peer-review route and, ultimately, into amendments and additions to guidelines, before much later finding their way into actual GMP. But these current interpretations find their way into a company through policy, procedures and training.

There is also the pressure brought to bare on regulators by peer-review groups over elements of legislation, such as 21CFR Part 11 compliance, where industry was not convinced or prepared to foot the bill that, in the case of Part 11, was once estimated to be in excess of US$100 billion (€64.4 billion) globally. Remembering too that this is all about interpretation, the GMPs are written ambiguously so that this interpretation resides with the manufacturer, seemingly leaving no avenue for litigation with the regulators. Additionally, there is no chance of litigation regarding cGMPs published by the peer-review groups as they are only guidelines. There is no escaping that culpability resides fairly and squarely on the shoulders of the manufacturer. Therefore, to service a validation project well, a company must remain vigilant, and nurture a real-time awareness of industry and regulatory trends. Essentially, this creates a ratcheting effect spawned in regulatory audits, whereby companies A, B and C are inspected and have all found similar approaches to solving complex compliance issues. The regulators embrace these solutions and use them in later inspections within companies that have failed to conform to such field standards. Thus, a real-time interpretation is essential; one that is serviced through events, such as the trend in warning letters, to gauge the mindset of the regulators in 'real time' and in an 'active sense'.

Training, culture and management. Excellent procedures, slick strategies and the best will in the world are ineffective without lots of training, cultural buy-in and strong management.

Akin to the property maxim "location, location, location", the pharmaceutical industry's is "training, training, training", which must ensure that everyone sees the same big picture and understands the proscriptive elements of procedures in the same way. Having it written down does not guarantee it will be understood and followed in the same way by all, so unless one is prepared to train, test the training and monitor the outcome of the training thereafter, there is a risk that we are creating more trouble than we are trying to solve.

Cultural resistance is one of the biggest obstacles in the run-up to an inspection. In engineering, for example, validation is not part of the culture engineers have grown up with. On many occasions I have been asked by engineers: "Why try and fix something that is not broken?" It's a valid question. The answer I give is this: engineering has evolved primarily to satisfy commercial terms and conditions, but there are certain elements of engineering by way of their regulatory significance, distinction and application (discussed earlier as impact assessment) that single them out as part of a validation scope, not to satisfy commercial terms and conditions, but the regulatory exactitudes they are measured for success against. This includes testing, traceability (audit trails) and other documentary evidence.

Figure 2

Management is another area of great concern as many managers frequently lack the skill, experience or aptitude to do what is required. Usually, managers are the victim of the Peter principle:⁷ promoting someone to their level of incompetence. A good knowledge of validation, with a wide skill set, is essential for a validation and compliance manager if the job is to be managed on time, in budget and fit for purpose. There is no room for compromise either regarding this latter point as 'quality is King!' However, even those in validation frequently do not understand the big picture, and those outside do not understand any of the correlations, causations and commonality that validation engenders. All too often a project is doomed, and what is at fault? If one spent time conducting a simple trend analysis of warning letters, it would be seen that most problems emanate from management, procedures, training or a combination of all three. Ultimately though, the project is won and lost in the planning and the general assumption that the process already has capability, accuracy, precision and full characterization.

Figure 3

To keep the management of a validation and compliance project simple, it must be planned in four distinct phases:

• Phase A is where project status is established, gaps identified, plans formed and project tools (including training) generated and communicated to all concerned.
• Phase B takes the corrected modules and, first, configures them by department before linking each department to every other in a way that supports project objectives and compliance with the CFRs.
• Phase C validates the various processes, systems and practices against the CFRs.
• Phase D includes departmental auditing and project audits; FDA training for inspection; a dummy audit by an external company (to mimic an FDA audit) and, finally, FDA's proper inspection (Figures 2 and 3).

Commissioning material. A refined approach in the use of commissioning material in validation. The following statements should be considered when regarding both subject matters in one context:

• Commissioning is incomplete until validation has been successfully completed.
• The criteria for commissioning and validation are different. The former satisfies commercial arrangements, the latter regulatory compliance.
• The acceptance criteria for commissioning is often different to that for validation, and vice versa.
• The type and methodology used to document both events (commissioning and validation) can differ considerably or, occasionally, be the same.
• Test scripts for both events are usually a mixture of generic tests — those exclusively for validation and those exclusively for commissioning.
• The parameters set against the acceptance criteria for test results can differ greatly for both disciplines.
• Commissioning and validation can, theoretically, happen in any sequence. Moreover, the tests can seem the same, but success in validating pivots on subtle yet fundamental differences, such as those discussed earlier. While the two events have distinctly different agendas, they complement each other, as the above bullets emphasize.

Commissioning is undoubtedly a great precursor for validation. An inspection of the equipment is a necessary part of commissioning work as it exposes defects that are not detected at FAT or manifested through transit. Both will be corrected at the commissioning stage to prove conformity with the specification and conclude contractual arrangements. Ordinarily, this would be sufficient if it were not for subsequent validation. Even when commissioning is successful (modular differentiation), it does not guarantee that any associated qualifications will turn out likewise. The conclusion of a validation study (the configured performance of the equipment) may expose previously hidden flaws in:

• The design.
• Its application(s).
• Inadequacies inherent within commissioning.

One of the most important criteria is management. It is essential that the whole experience of commissioning, validation and overall compliance is managed properly, and by someone with all the requisite experience in all the disciplines mentioned. Without this, the programme will wander, costs will rise and confidence, as well as expectation, will rapidly fall away.

The right things

Call for papers

With the costs and complexity of validation and compliance rising, it is high time to focus on 'doing the right things'. With the right investment, savings can be achieved that offset the capital cost of a compliance and validation project, and provide significant savings within the revenue budget thereafter.

Validation is not there to police or find fault with the business, rather, it is a great business tool that provides both compliance and the assembly of a robust diagnostic tool. Good validation practice should save a lot of money, not cost a lot of money. Moreover, it should diminish regulatory risk. Done well, validation safeguards the company.

Keith Powell-Evans is Compliance and Validation Consultant at Altran (France) and Founder member of the Institute of Validation.

References

1. K. Powell-Evans, Pharm. Technol. Eur., 10(1) (1998).

2. K. Powell-Evans, Pharm. Technol. Eur., 14(9), 60–65 (2002).

3. GHTF (Global Harmonization Task Force) SG3/N99610:2004.

4. W. Gibson and K. Powell-Evans, Validation Fundamentals (Interpharm, Illinois, USA, 1998).

5. ISPE Commissioning and Qualification Baseline Guide (2000). http://www.ispe.org/

6. K. Powell-Evans, Pharm. Technol. Eur., 10(12), 48–52 (1998).

7. P.M. Senge, The Fifth Discipline, (Currency/Doubleday, New York, New York, USA, 1990).