Pharma-IT: Virtualization and Validation

By John Avellanet Managing Director Cerulean Associates LLC A collision between technology and regulation is fast approaching. As pharmaceutical companies and their suppliers look for ways to cut costs, technology is leaping to the forefront. Leading the pack is the idea of outsourcing data centers to vendors using computer virtualization. Stumbling along in the opposite direction is last century's 21 CFR Part 11 and all of its costly misinterpretations. Computer Virtualization Computer virtualization has many different meanings. At its narrowest sense, one physical computer runs different operations under different software systems (such as your production line monitoring software, your email software, your word processing software, and so on all on the same computer). Each piece of software thinks it has the computer to itself. Virtualization can also be much broader, spreading your software over many different computers connected across different regions and time zones all around the world. From a cost savings perspective, virtualization is loved by chief financial officers as it reduces costs by 30% under its narrowest use and up to much more dramatic cost reductions near 80% if you rely upon the broader sense of virtualization. Today, only 15-20% of companies embrace virtualization. Technology analysts expect data center virtualization to be adopted by more than 60% of companies world-wide within the next two years, driven in large part by economic pressure. While virtualization may save money for pharmaceutical companies, especially those outsourcing their computer departments, the business risks from a compliance standpoint are very real. Virtualization is complex. Because so much can be spread in little bits and pieces across so many computers and networks (or all combined onto one computer), any single tiny, little change may have significant, unanticipated downstream impact. One of the closest analogies may be the way the internet works – and can break down. Think about the way you access the internet today. When you start up your internet browser and go to a website like Google or Pharmaceutical Processing, the pathway taken by your computer to show you that site goes through your company's network or, when you are home, through your telephone or cable company's network. If the wrong tiny, little switch is turned off somewhere the vast telephone or cable network, you won't be able to access the internet or maybe just half of the websites based on the East Coast of the US. Google and the millions of internet websites are still there, you just cannot get to them. The same vulnerability holds true when you virtualize your data center. Your company's software, its production data, and so on is all still there – spread across a vast number of computers and networks (or all crammed onto one) – but any little glitch may cut off your access to it or, in the worst case, destroy some of that information. Information loss may be a minor irritant when trading emails with your friends, but the FDA does not smile kindly on companies that cannot produce production data. Just as you manage your risk of accessing the internet at home by signing a contract with the professionals (e.g., your telephone or cable company) to handle the hook-ups, access rights and connection availability, so you should let those technology vendors that specialize in virtualization deal with all the network infrastructure and computer systems involved. You then focus on managing the risk of non-compliance with regulations. And therein lies the catch. Virtualization is an advanced technology use that needs advanced regulatory interpretations. The slow pace of legislative and regulatory change provides a significant mismatch between the complexities of the fast-growing virtualization trend and the costly "validate everything" of 1997's Part 11. Part 11 Revised In talking with officials at the FDA in preparation for my seminar last year on revisions to Part 11 and the EU's Annex 11, it became clear that the work of the FDA Part 11 revision group is complete. As I mentioned to seminar attendees, and in my May SmarterCompliance newsletter, the FDA's 21 CFR Part 11 has been revised and is only awaiting final center approval before it can be published. Given the recent agency leadership change, I anticipate the revised Part 11 to be released to be sometime later this year. For pharmaceutical companies looking at virtualization, the revised Part 11 will be just the change needed to avoid a headlong collision of technology and regulation. Details of the revised Part 11 and how to prepare your company are beyond the scope of this column; you can get the information, strategies and reference materials from the recorded version of my seminar, Understanding and Implementing the Revised FDA Part 11 and EU Annex 11, on my website (http://www.ceruleanllc.com/seminars). Given the revised Part 11, its intent and its new focus, how then to tackle the compliance challenges inherent in virtualization and still save all that money? Tackling Virtualization and Validation As members of my SmarterCompliance™ Toolkit program recognize, the solution lies in moving away from a spotlight on the computer toward a focus on controlling outputs. Technology – whether a computer or a virtualized data center – is just a tool, a means to an end. That end is an electronic record that is "attributable, legible, contemporaneous, original, and accurate" (Dr. Stephen Wilson, Deputy Director, CDER, FDA, FDA Regulatory Perspective: Data Integrity, May 2006). This is the pathway to adopting good technology and good compliance. To achieve success with virtualization and compliance, there are four key steps to take: 1. Homework. Do your homework on the type of technology outsourced provider you want. I've written a very popular article based on my own experiences years ago as a biotech and device executive trying to find good consultants and outsource providers. You can read the article in its entirety at this link: http://www.ceruleanllc.com/Resources/Choose_a_Consultant_Get_Results.htm. Follow the steps in that article (or in some of the others I've written that touch upon similar themes, "Cost-Effective IT Outsourcing" or "SMB Validation: Four Ways to do More for Less") to pick the right vendor for your company. 2. Quality/Technical Agreement. Craft a quality or technical agreement with the virtualization vendor that identifies your minimum expectations in terms of monitoring, reporting, security, uptime (i.e., availability) and backups. To identify realistic expectations, have your computer department research out typical levels for each of those categories (for instance, average uptime expectation email service might be 98.4%). Then, conduct a risk analysis, assessing the risk to the product, the patient and your compliance for that level of service. Be prepared to pay more if you want rates of service higher than typical. 3. Independent Controls. Include in your agreement the ability to conduct independent verifications – either yourself or by hiring an independent auditor – of the vendor's controls around the virtualized data center, the security of your information and access to your stored or archived data. Electronic data is most vulnerable sitting in storage – whether on a computer disk or backed up onto tape. Work with an independent consultant who has experience in both Part 11 and records management to craft a set of control points and check-ins to conduct during the course of your contract with the virtualization vendor. 4. Polices and SOPs. You need to complete your management of the risks of virtualization with a strong policy and procedural framework. Here too you may find it advantageous to work with someone with both an IT and records management background – particularly if that individual has had to deal with records and litigation; few things will give you a better sense of what to reasonably expect when it comes to controlling electronic information and data integrity than an experience or two justifying to a skeptical lawyer why some records were kept and some were destroyed. Practical policies and standard operating procedures need to be written, trained and enforced. The independent auditor you use to help you monitor or conduct due diligence on your virtualization vendor should make sure to incorporate of a review of the vendor's records control policies and procedures as well. With these four tactics, virtualization compliant with the revised Part 11 can cut costs and lower risk. This, in turn, can help you speed drugs to market and pass some of the cost savings onto consumers, creating a "win-win-win" for everyone from shareholders and investors, to the regulators and the public. Final Thoughts Finally, having tackled compliance by shifting from physical computer and software validation to a risk-based validation of the overall virtualization environment and its outputs (e.g., the integrity of your electronic records), you will face an interesting question: Since that approach works for the complex virtualized data center, why are we still taking the costly 1997 "validate everything" strategy with the rest of our 21st century technology? Are you ready? About the Author John Avellanet is the founder of the regulatory intelligence and lean compliance program for executives and business owners, the SmarterCompliance™ Toolkit. He is the author of more than 30 articles on lean compliance and quality systems (including cost-effective tactics for Part 11), a co-author of a recent book on biotech business development, and a frequent speaker with FDA officials. He can be directly reached through his independent advisory firm, Cerulean Associates LLC, on the web at http://www.ceruleanllc.com

Talkback! Pharmaceutical Processing is pleased to provide you an opportunity to share your opinions on any of the news stories or articles on our site. We reserve the right to edit/remove comments

http://www.pharmpro.com/ShowPR~PUBCODE~021~ACCT~0000100~ISSUE~0902~RELTYPE~ATO~PRODCODE~9139~PRODLETT~FP.html

Validating Process Validation

By Agnes Shanley,

PharmaManufacturing.com

FDA’s new draft guidance gets to the essence of what process validation is, and isn’t. Have you read it yet?

Safe pharmaceutical manufacturing, as we know it today, could not exist without process validation. Introduced in the 1970s, when FDA was still known as the Bureau of Drugs, the concept was originally designed to protect the public against the impacts of variability in sterility assurance, but was extended broadly to drugs and devices.

It aimed to ensure that any process would do what its developers intended it to, and make products of reproducible quality. The concept worked.

It also became a monster. Over time, misunderstandings about validation promoted a rigid, bureaucratic approach to manufacturing. Concerns have led some companies to lock in inefficiencies, generate reams of defensive documentation, and reject new technologies or approaches, even if they would improve both process and product.

In addition to being far more engineering-focused and much more clearly written than the previous guidance, the new document stands out from the prior guidance in that it:

• outlines, clearly, a life-cycle approach to process validation
• presents the essence of what Quality by Design is, without going into the terminology
• emphasizes the importance of process control, calling out the importance of both QA professional and the line operator in providing feedback and
  continued process verification.
• specifically mentions process stability and process capability
• mentions the potential role of simulation
• touches on the importance of continuous operator training
• highlights the need for a crossfunctional approach, even specifying the different disciplines that should, ideally, be involved.
• discusses the need for data analysis, within and between product batches, mentioning the most relevant places to find this information:
• discusses how PAT and real-time data access would change the approach to Performance Qualification

So what was so wrong with the prior guidance? I decided to check the wording of the 1987 document more carefully. It made me wonder about a few things….for one thing, where on earth did the magic number three (for the infamous “three validation batches”) come up? It wasn’t in that document.

The earlier document had already paved the way for QbD by highlighting the importance of drug development, yet it seemed to focus more on data collection than interpretation. It was also somewhat diffuse, taking many paragraphs to discuss control limits, and including lengthy asides on process examples that sounded like religious commentary on sacred scripts.

Some companies are already taking a very modern approach to process validation, and developing techniques that would allow processes to be adjusted on the fly. Last month, a meeting of the American Institute for Chemical Engineers (AIChE) in Philadelphia offered a number of practical examples showing how these concepts are being applied.

One expert from a U.K. company showed how multivariate models can be used to adjust automatically for differences in raw material sourced from different suppliers so that the resulting product’s quality is always consistent.

That is the future, but for many operations today it might as well be science fiction.
Recent informal surveys in our magazine have found that pharmaceutical development and manufacturing are still using mainly univariate rather than multivariate data, and that many companies aren’t even performing process capability analysis. The sigma level of drug manufacturing, experts say, remains around 3. At the same time, some FDA reviewers and inspectors may not be in synch with the new guidance. Audience members at one AIChE session asked why some FDA reviewers appear less interested in hearing about their carefully developed “design spaces” than in specific process values.

Even if there’s more work to be done, documents like this draft guidance provide clarity and a basis for open discussion and benchmarking. FDA is accepting comments on the document until January 19, via http://www.regulations.gov). I urge you to write with any constructive criticism. In the meantime, write us and let us know what you think.

FDA publishes guidance on process validation

The US Food and Drug Administration (FDA) has issued draft guidance on process validation, updating its 1987 document to incorporate advances in manufacturing technology and thinking.

Modern risk management and quality system tools and concepts form part of the FDA’s new thinking, which is in keeping with its initiative entitled “Pharmaceutical CGMPs for the 21st Century – A Risk-Based Approach”.

Biological products, including active pharmaceutical ingredients (APIs), are the focus of the document, which by implementing manufacturers should align their process validation activities with the product lifecycle concept and existing FDA guidance.

The document defines process validation: “as the collection and evaluation of data, from the process design stage throughout production, which establishes scientific evidence that a process is capable of consistently delivering quality products.”

Covered under the guidance are some general considerations for process validation, such as having an integrated team that has members with a variety of specialisations, and more specific recommendations.

These recommendations span the three stages covered by process validation, namely process design, process qualification and continued process verification.

The three stages cover the adoption of process validation from development and scale-up through to commercial manufacture and beyond to provide ongoing assurance.

Included in the document are sections covering capturing process knowledge and understanding and facility design and equipment selection.

Documentation and analytical methodology are also covered in the guidance, which can be found here .

Asahi Kasei gains TechniKrom’s bioprocess business

Japanese chemicals firm Asahi Kasei has ramped up its bioprocessing operations with the acquisition of US industrial processing specialist TechniKrom’s biopharmaceuticals business.

The integrated offering, which will operate as a wholly-owned Asahi subsidiary, will combine TechniKrom’s portfolio of processing equipment and validation services with Asahi’s hollow-fibre and membrane adsorption technologies.

The deal, financial terms of which have not been released, builds on the firms’ collaboration centred on Asahi’s range of industrial Planova virus removal filters and, according to the Japanese company, will help drugmakers lower production cost and improve product quality.

Yasuyuki Yoshida, president of Asahi Kasei Medical, said the deal seems like a perfect fit in terms of the firm’s global expansion plan. He explained that the integration provides “a base for the development, production, and sale of equipment and systems in the US.”

While the US market for biologics and biotherapies has grown continually since it first emerged as a going concern 25 years ago, the development of follow-on biologics as patent expiry looms looks set to shift the expansion into a higher gear.

In recent months for example, several US majors like Pfizer and Merck & Co have expressed an interest in growing their generic biologics portfolio in preference to investing in the development of non-biologic drugs.

While such big pharma interest would have proved a barrier to entry for smaller firm’s wishing to claim a share of the traditional drug market, the greater technical difficulties associated with manufacture of biologics may mean there is more scope for technically proficient biotechnology companies to prosper alongside the industrial giants.

In addition, the Food and Drug Administration’s (FDA) recent approval of the first drug to be derived from transgenic-animals; GTC Biotherapeutics’ anti-clotting therapy Atryn, suggests that US demand for effective bioprocessing solutions will continue growing. All of which looks good for Asahi Kasei TechniKrom in terms of developing its business in the US.

TechniKrom President Lou Bellafiore was also pleased about the new relationship. He said that: “In addition to our existing products and services that we will continue to offer, we are extremely excited about the line-up of novel bioprocess separations products that Asahi Kasei TechniKrom will introduce."

HVAC Excellence Test Validation Procedures

HVAC Excellence Test Validation Procedures

By John Hohman

Developing the content

Test content is developed through the input of technical experts. Traditionally called

“focus groups”, these groups have transitioned into groups now called “Subject Matter

Experts” or SME’s. To develop any national test, a minimum of five and a maximum of

nine technical experts from three states are essential. Ideally, the more participation from

more states is desired and sought.

A work session for the SME’s at the developmental stage generally consists of a “job and

task” analysis of the work done within the field of occupation that the SME’s represent.

A job and task analysis attempts to identify elements of the occupation that can be

identified as individual jobs. It continues to identify tasks that need to be completed

within each job element. There may be many jobs within an occupation and subsequently

many tasks that need to be done before a job can be completed. This is the first step in

developing “Content Validity.”

Depending on the scope of development, SME’s may be involved in identifying other

elements of the occupations, such as: tools, equipment, work environment, conditions of

work that relate to ADA (America requirements, etc. Sometimes this information is

already sufficiently documented and doesn’t require additional study.

Developing the structure

After the job and task analysis has been completed, the same or another group of SME’s

is retained to develop the structure of the test. The structure of a test is sometimes

referred to as the “table of test specifications” and is used to determine the content and

emphasis of the test. This is the part of the test building process that establishes

“Construct Validity.”

It is generally understood that a group of questions (items) may constitute a test of

knowledge in a given field of occupation. Developing the table of test specification

maintains a degree of control on the content of the test. This process also satisfies the

condition of “Semantic Validity” whereby the labels relate to the occupation being

evaluated. This control of content helps to insure that one aspect of validity is maintained,

the second step for “Content Validity.”

The structure or table of test specification identifies the number of questions/items to be

applied to a given section/category of the test. Doing so maintains the content

relationship of the test while individual questions, relating to the section/category, may be

changed or randomly selected from a test item bank.

Developing the items

Questions on a test are typically referred to as “test items.” Each item takes the form of a

multiple-choice question. The item is made up of three parts: 1) the question, called the

“stem”, a single correct answer, and a set of plausible, possible answers called

“distracters.” The number of distracters sometimes helps to elevate the difficulty or level

HVAC Excellence Test Validation Procedures

By John Hohman

of the test. Typically there are four choices, one correct and three plausible distracters.

There can be up to seven choices for a given item.

The same or a similar occupational group of SME’s are involved with the development of

test items. Items are generated in many different ways, and they are guided by the “table

of test specifications.” More items are generated than the test requires. Often, items are

abandoned for many reasons and additional items are required to maintain the size or

length of a test.

Items are reviewed for “Bias” toward protected groups by persons other than the SME’s.

The test developer selects individuals that have a high degree of sensitivity to bias

language to review the developed test items in an attempt to eliminate all or most

language that may offend or bias an item for a protected group of people.

Pilot Testing

Pilot testing is an important step in the development of a test. Pilot testing consists of

identifying individuals within an occupation that are at approximately the target level of

the test. For example, a technician level test may require selecting individuals who have

some level of experience within the occupation to pilot the test.

Pilot participants are selected by knowledgeable people within the occupation. They are

asked to select participants who they feel are at the specific level the test is designed.

Through this selection process come aspect of “Criterion Related Validity” is generated.

Typically, selected participants have already been evaluated to some degree by the person

who selects them. Therefore, some degree of relationship exists between the level of the

participant and the level of the test. Other criterion related tests results might be used to

validate this process for a pilot group.

The size of the pilot test group will be selected to generate sufficient data. Depending on

the number of people within the occupation, the number within a location, or the number

of individuals that can be found to volunteer, will determine the pilot test group.

“Face Validity” is generated at this point in the test development process. Face Validity

refers to the recognition of the test title, test categories, and test items as being part of the

field of occupation. Individuals who pilot test are asked to respond or comment on each

of these parts of the test.

The pilot test also asks participants to mark items, words or phrases that might have an

impact on protected groups in a second attempt to eliminate bias.

Item Analysis

Item analysis is the process of technically reviewing the structure, response, and fit of a

given item and the relationship of that item to the rest of the test. Through item analysis

HVAC Excellence Test Validation Procedures

By John Hohman

some levels of “Reliability” validation can be obtained. Item analysis can use any or all

of the following statistical analysis:

Kuder Richardson Formula - KR 20 & KR 21

Cronbach Coefficient Alpha

Spilt-half Reliability Coefficient

Level of Difficulty

Easiness Scale

Coefficient of equivalence

Spearman-Brown

Standard error of measurement

Final Formatting

The item analysis will reveal items that are not working as expected. Those items will

either be eliminated or the deficiency repaired. The test will be formatted to the correct

number of total questions and each section/category is reviewed for the correct number of

questions according to the table of test specifications. All other spelling and formatting

difficulties are eliminated.

Test Delivery

Delivery of the test follows prescripts required for all national tests and requires a level of

security. The delivery process consists of identifying individuals to proctor the test who

have a high degree of personal conviction and agree to the requirements of handling and

proctoring a national test.

Continuing Analysis

Test results are continually monitored on a periodic basis. As score anomalies occur,

whole tests or individual items are scrutinized for problems. When a test shows a

significant level of problems it is slated for review ahead of its scheduled review period.

All tests are reviewed on a three year basis.