We’ve all been following the health authority’s identified deficiencies in data governance and data integrity for the last few years, though this enforcement action has been ongoing for almost twenty years. A comprehensive GMP Intelligence program follows 483s and warning letters for information on the FDA’s focus. Particularly in this area, the best learning materials are often provided by the regulatory authorities like the FDA. The early deficiencies in this area cited disagreement between data submitted to the FDA in a regulatory filing vs the original data identified at the site. Most recently the use of ‘integration interruption’ capability of chromatography data systems has been identified as a means of data manipulation. In addition, some firms have gone to extremes in physically blocking the FDA’s access to areas which they have a right to inspect.
Here are some of the unique or egregious deficiencies or early identification of ‘new’ deficiencies in this area. For the problem areas that were identified prior to 2015 we also provide more recent ones to demonstrate, yet again, that “the more things change, the more they remain the same” (credits to Jean-Baptiste Alphonse Karr).
| YEAR | DEFICIENCY |
| Twelve years ago, an observation for failure to review audit trails for chromatography data likely served as the aha moment that this activity was necessary. Also, for those who think that the focus on sample ‘re-injections’ is new, it’s not. And both continue today. | |
| 2005 | The Quality Unit failed to: Review electronic data as part of a batch release, review computer audit trails in the Waters Empower Data Acquisition System and provide adequate training to analytical chemists. These practices led to the Quality Unit releasing batches of drug products which failed to meet in-process, finished product, and stability specifications. These practices also led to the submission of erroneous data in Annual Reports and Prior Approval Supplement # 004, for ANDA 75-838, which requested discontinuance of Blend Uniformity testing for Propoxyphene Napsylate and Acetaminophen 100mg/650 mg Tablets. The lack of Quality oversight resulted in: the ceasing of manufacturing on 5/13/05 5/19/05, the ceasing of distribution of all drug products on 5/26/05 5/13/05, the recall of all batches (3,184) of drug products and the withdrawal of at least five Abbreviated New Drug Applications… Samples of drug products were routinely resampled and re-injected or reprocessed in the [REDACTION] System during testing in the QC Laboratory when out of specification (OOS) results were obtained. There were no Laboratory Investigations into OOS results or notebook documentation available to explain the re-injection or retesting of in-process, finished product and stability samples which did not meet specifications. The OOS results were not reported and within specification results from reprocessed or re-injected samples were reported on In-Process Specification, Product Specification and Stability Study Specification Release Reports and Stability Summary Reports. Able Laboratories, Form 483, 2005 |
| 2016 | Your stand-alone computer systems lacked controls, such as routine audit trail review and full data retention, to prevent analysts from deleting data. Although you implemented a procedure to begin reviewing audit trails of your high-performance liquid chromatography (HPLC) Empower system on January 11, 2016, you had not performed any reviews prior to our inspection. Furthermore, the procedure you implemented on January 11 required (b)(4)random audit trail review (b)(4). Teva Pharmaceutical Works Pvt. Ltd., warning letter |
| 2017 | During the inspection, our investigators discovered a lack of basic laboratory controls to prevent changes to and deletions from your firm’s electronically-stored data in laboratories where you conduct CGMP activities. Specifically, audit trail functionality for some systems you used to conduct CGMP operations was enabled only the day before the inspection, and there were no quality unit procedures in place to review and evaluate the audit trail data. For example, you used standalone HPLC (2-RD HP/SM/32) to conduct analyses for Drug Master File (DMF) submissions and investigations, such as characterization of a starting material for your (b)(4) DMF. You also used uncontrolled systems to conduct out-of-specification (OOS) investigations for in-process materials used to manufacture (b)(4) API. Divi’s Laboratories Ltd (Unit III), Warning letter |
| Creativity and innovation know no bounds! | |
| 2010 | “Specifically, the practice of scraping off or erasing original data from production batch records is pervasive throughout your facility. Our investigators documented over 30 production batch records (approximately 80% of the records reviewed) that contained evidence of original data such as dates, signatures, temperatures, test results, weights, volumes, and times being removed, and new data written. This data alteration was done without an explanation of why the data was changed or the signature or initials of the person making the changes. Interviews conducted with an operator revealed that this practice is so common that the operator made a special tool to scrape off entries in production batch records so that new data or information can be recorded in its place. Additionally, you acknowledged during the inspection that the GMP Controller makes entries into the production batch records associated with the manufacturing steps. However, there is no documentation of his/her signature to acknowledge the entries recorded. The operator responsible for conducting the manufacturing step includes only his or her signature or initials to information completed by the GMP Controller. During an interview with the Quality Assurance (QA) Manager, he stated that management has been aware of the data alteration practices since September 2007.” Nanjing Pharmaceutical Factory Company, Warning Letter |
| Serious problems are noted in paper records, including those printed from electronic systems. Some have led to consent decree agreements. It’s not all about computer systems as many seem to think. | |
| 2008 | Written records of major equipment cleaning and use are inaccurate and do not provide assurance that persons double-checked the performance of equipment cleaning because there is no assurance that those persons responsible for determining that work was performed were present at the time of equipment cleaning [21 CFR 211 .182].During the inspection, our investigative team uncovered fourteen (14) instances (Observation# la, b, c, e, f, g, h, k, 1, m p, q, t, and u on the FDA 483) where cleaning records for equipment used in manufacturing operations (V-blender, (b) (4), etc.) included initials or signatures of employees who reportedly verified cleaning of equipment but were not shown as present by security log records. According to the security log used to record the entry of all personnel entering and exiting the Batamandi (Unit II) facility, the supervisors who initialed or signed the “Checked by Production Executive” or “Cleared by QA Executive” block were not present in the Batamandi facility on the days this equipment was cleaned. For example, two of these records each involved entries for five separate dates where the employee signing for verification (hereafter “Employee 1”) was not present according to the security log records (Observations #1(a) and (b)). With regard to entries made by another employee (hereafter “Employee 2”), your May 1, 2008, response states, “An investigation conducted following the issuance of the 483 revealed that the handwritten logs maintained by the security detail at the gate to the Batamandi (Unit II) facility were not intended to and cannot be assumed to provide an accurate accounting of entry in and out of the facility on any given day.” You maintain that the security log was not intended to be accurate, yet you acknowledge its accuracy in the same paragraph of the response when you state, “The security log and other records show that [Employee 2] was present at the facility on every other day on which his signature appears on batch documents.” Your response also acknowledges the accuracy of the security log when referring to entries made by Employee 1 and another employee (hereafter “Employee 3”). With regard to multiple entries made by Employee 3, your response states that this individual was not present to verify cleaning operations. With regard to numerous entries made by Employee 1, your response states:”[Employee 1] apparently was not present during the manufacturing of the exhibit batches and related equipment cleaning. [Employee 1] believed that he did not have to be physically present during an activity in order to sign off as having checked the activity on batch records. Instead, he asked [Employee 4] to bring the batch records to him at the Paonta Sahib facility so he could check and sign them. Ranbaxy, Warning Letter |
| 2009 | Your firm failed to follow its procedures for the preparation of master production and control records as required by 21 CFR § 211.186(a). Your firm’s “Batch Record Recording Procedure” states that only blue or black ink can be used to record information in the Batch Record Book. However, for at least six lots, the Master Packaging Instruction sections of the batch records contained reconciliation and disposition data written in pencil, erased, and then rewritten in ink. In addition, some data that had been rewritten in ink was different from the original data that had been written in pencil. You indicated in your response that the Quality Control Unit (QCU) member associated with this practice is no longer working for the firm; however, your proposed corrective action did not include a review of other production and control records to ensure that this practice did not occur in other instances, particularly where the QCU inspector could have advised production employees to use pencil. Your laboratory records did not include a record of all calculations performed in connection with laboratory tests as required by 21 CFR § 211.194(a) (5). For example, laboratory notebook #7, page 49, documents the assay results, but not the calculations performed in Test number DSFS D-13 and Test number TG 521 for the analysis of (b)(4), lot #HI7908. The notebook does not document reference to the spreadsheet calculation used to generate the results. In addition, the assay results generated by the spreadsheet were not verified for accuracy. Your response dated February 16, 2009, states that you have established procedures to ensure that calculations of method validation studies are recorded. The Records Management SOP, Section 5.7.4.7, states that the procedures shall define what and how data is to be recorded in respective logbooks. However, this SOP omits instructions to include in the notebook the reference to the spreadsheet calculation used to generate the results, as well as the raw data and calculations. In addition, you continued to release products based on assay results generated by the spreadsheet that has not been verified for accuracy. Hill Dermaceuticals, Warning Letter |
| 2011 | Your firm has failed to follow SOP-DLI-2550, entitled “Good Documentation Practices.” It is common practice in your firm to have another employee record the test results and/or the initials/signatures of the analyst who actually performed the testing on raw data worksheets. Your firm’s management was aware of this practice. Although your firm has revised your procedure to state that writing another analyst’s initials or signature is considered “forgery”, your response is inadequate because there is no evidence to show that the revisions will be effectively implemented. In addition, your revised procedure still allows for employees to enter data on each others’ paperwork, which is a practice that continues to undermine your data integrity and increases the possibility of errors in the laboratory record. |
| 2012 | Specifically, the inspection revealed that your firm has not established written procedures to control and account for electronically generated worksheets used by analysts to record analytical test results. Analysts in your QC laboratory print an uncontrolled number of worksheets from computers throughout the QC laboratory without supervision. |
| Appropriate computer system validation and control is necessary for enterprise software that has GMP functionality. It’s not just laboratories and manufacturing. | |
| 2009 | Failure to routinely calibrate, inspect, or check according to a written program designed to assure proper performance of automatic, mechanical, or electronic equipment, including computers, used in the manufacture, processing, packing and holding of a drug product. [21 CFR 211.68] A. The Enterprise Resource Planning System is known as the firm’s Systems Applications and Products (SAP) computer database allows rejected batches of drug product to be in Unrestricted Status (to be released for distribution). Refer to Form FDA 483, Observation #3. Please provide additional information to support that your current Enterprise Resource Planning SAP system provides limited access to only “approved QA personnel” versus warehouse or production personnel. Your December response states any correction or change in Usage Decision (UD) will require next-level QA authorization in SAP. Explain how you are able to ensure that only QA authorized personnel are changing the status of the lots in the SAP system, and how it is documented and/or tracked. In addition, your December response in Attachment #4, “Performance Qualification Report for SAP R/3 Enhancement”, shows lots that can be “Partially Approved” without selecting a Usage Decision. Provide an explanation as to what “Partially Approved” is defined as, who has the authority to make this decision, how it is documented, and why this status is “not applicable” in the Usage Decision status. Lupin Warning Letter |
| Deficiencies happen in the microbiology laboratory too. | |
| 2011 | Your firm’s laboratory records fail to include complete data derived from all tests necessary to assure compliance with established specifications and standards [21 C.F.R. § 211.194].For example,a) On December 13, 2010, the FDA investigator observed a microbiological plate that contained one (1) large colony forming unit (CFU) of mold. However, your firm’s laboratory documentation reported 0 CFU for the same microbiological plate.The inspection found that the laboratory manager had documented “NIL,” (i.e. no growth for this plate), while the same laboratory manager confirmed microbial growth in the presence of the investigators. Later during the inspection, the FDA investigator asked to see the original plate and was told that it had been destroyed. On December 21, 2010, your firm prepared a corrective and preventive action (CAPA) stating that the laboratory manager misread the plate count and that this deficiency was the result of a human error. We are concerned that your firm lacks documentation to support this conclusion and moreover, that the original plate was destroyed during the FDA inspection, as reported.Your response of January 13, 2011, raises some additional concerns as it includes a photo of the original plate that your firm stated was destroyed and the second photo of a plate that was allegedly misread. Please explain this discrepancy. We are concerned that this is a repeat violation. During the inspection of Unit VI conducted in May 2007, investigators also reported your failure to document positive results for a microbial plate that was confirmed as containing microbial growth.B) On December 17, 2010, the investigator noted that many microbial plates containing environmental monitoring and personnel samples, collected on December 12, 2010, during production, were missing from the incubator. Your response confirmed that 33 of 150 (22%) of the personnel monitoring samples were missing and that in one instance, 9 of 10 samples were missing for a single operator. Your response indicates that no missing plates were reported for the period of January 2009 through November 2010. We have determined that this conclusion is not reliable because neither reconciliation procedures nor data regarding the number of microbial plates used for environmental monitoring and microbiology laboratory samples were available at the time. Please explain how your firm determined the effectiveness of this review of 2009 and 2010 plates, without having a procedure in place for the reconciliation. Aurobindo Warning Letter |
| 016 | Our investigators observed colony counts for environmental and personnel monitoring that did not match your official records. For example, one contact plate from a Grade B area had a reported result of (b)(4) CFU, but our investigator counted (b)(4) CFUs on the plate. Five other plates had reported results of (b)(4) CFU, although our investigator counted (b)(4) CFU on each plate. Inaccurate reporting of environmental and personnel monitoring data undermines your ability to evaluate and maintain a state of control in your aseptic processing operation. Teva Pharmaceutical Works Private Limited Company, Warning Letter |
| 2016 | EM records for active air monitoring of the aseptic filling area reported samples as being collected when they were not actually collected, and some records documented purported EM results of zero colony forming units (CFU) even when the samples for which those results were reported were not actually collected. Contemporaneous video recordings that FDA reviewed during the inspection showed that such EM samples had not been collected, even though your laboratory records reported results for those samples. Our investigators observed your firm’s practice of falsifying EM results for samples that were not collected for multiple drugs, including (b)(4) injection USP lot (b)(4) and (b)(4) injection lot (b)(4). Although your laboratory records for these products and lots indicated that you collected active air samples, the video we reviewed during the inspection demonstrated that operators did not actually collect the samples. During the inspection, your microbiologist confirmed that these EM samples were never collected. Additionally, two microbiologists informed the investigator that media plates were labeled and submitted for incubation as though they had been exposed to the environment. However, these media plates were never actually exposed to the environment. Your microbiologist indicated that this practice was routine and due to “work pressure.” Because the EM results for samples were falsely reported as having been collected and/or as having produced no CFU growth, you lack assurance that the injectable drugs your firm produced in this area were sterile at the end of the aseptic filling process. Emcure Pharmaceuticals Ltd, Warning Letter |
| And, no, you cannot just take previous results from other lots and assume they apply moving forward. | |
| 2011 | For example, the inspection revealed that your QCU released API lots to the U.S. without assuring that all required tests are performed. It is a basic responsibility of your QCU to ensure that all API lots produced meet specifications for quality and purity prior to being released. Your QCU also failed to detect that your COAs stated that OVI results conformed to specifications, although the test was not performed. In addition to your failure to test (b) (4), USP, your QCU approved the release of (b) (4), USP batch # (b) (4) with no testing for OVI. This test is required under DMF (b) (4), submitted by your firm in 2005. In your response, you stated that your former Head of Quality Control thought it was sufficient to test the organic volatile impurity in three (3) (b)(4) batches and then discontinue testing of future batches. We acknowledge that your firm has begun testing for organic volatile impurities. Ningbo Smart Pharmaceutical Co. Ltd, Warning Letter |
| The need for accurate trustworthy records extends to raw materials. | |
| 2011 | For example, (b) (4) batches of (b) (4) USP were released for distribution from April 2010 through March 2011 without the adequate sampling of starting materials. It was observed within the in-house analysis records and through discussion with a firm employee that starting material (b) (4), an internal lot (b) (4) had come from an unknown supplier via a distributor without product label or manufacturer information. According to the in-house records, it was tested by GC, KF, and MP, but no raw data could be found to support the testing, nor records of instrument use logs. Additionally, there is no traceability of the finished APIs as the completed batches were not properly identified and were then comingled, allowing for commercial lots to contain an unknown blend of manufactured batches. Your response acknowledges that your facility “was not up to the mark of FDA….” and that corrective and preventative actions are needed, but are not completed at this time.Yag-Mag Labs Private Limited, Warning Letter |
| 2016 | During the inspection, our investigators spoke with an analyst who reported that “…if we find a failure, we set back the date/time setting and re-integrate to achieve passing results…” The analyst explained that deleting, overwriting, changing integration parameters, and altering PC date and time settings were done for raw materials, in-process testing, and finished API drugs. Ipca Laboratories Limited, Warning Letter |
| Yes, you do need to retain that electronic data. Servers are not expensive; purchase additional ones rather than deleting data to make room or to save money. Resolving a warning letter is far more expensive. | |
| 2012 | There is no system in place to ensure that all electronic raw data from the laboratory is backed up and/or retained. During the inspection, you informed our investigators that electronic raw data would not exist for most HPLC assays over two years old because data is not backed up and storage space is limited. Data is deleted to make space for the most recent test results. |
| 2016 | Our investigator also noted that your firm copied raw data to a CD (b)(4), and then deleted the data from the (b)(4) system to free space on the hard drive. Files copied to the CD were selected manually; the selection process was not supervised. Without audit trail capabilities or supervised file selection, there was no assurance that all raw data files were copied to the CD before they were permanently deleted from the system BBT Biotech GMBH, Warning Letter |
| You cannot delete electronic data, and definitely don’t make it a common practice. Demonstrating this process to the FDA will never have a happy ending for the company. | |
| 2013 | Your analysis of (b) (4) USP batch (b) (4) exceeded the (b) (4) residual solvent limit on February 29, 2012. Your firm did not report or investigate this OOS result and deleted the related electronic records. During our inspection, your analyst admitted that he also deleted other uninvestigated failing and/or OOS electronic data from the laboratory database in January 2013 prior to our inspection. Your QC Senior Manager also acknowledged this laboratory-wide electronic data deletion practice. During our inspection, your analysts demonstrated to our investigators that they could delete any electronic analytical data files from the laboratory computers and external backup hard drives. |
| 2016 | CGMP documentation was discarded without being assessed by your quality unit. Our investigator found torn and shredded equipment maintenance documents, raw material labels, and change control work orders in your scrap yard awaiting incineration. Your staff lacked knowledge of your corporate procedure for the destruction and incineration of documents. Wockhardt Limited, Warning Letter |
| Once again, you cannot destroy original, electronic, or paper records. GMP records in wastebaskets or in trash bins located behind buildings are, unfortunately, common on warning letters. And be aware of how the health authorities can use your own closed circuit recordings to prove bad behavior. | |
| 2013 | For example, on March 18, 2013, the FDA investigators found unofficial batch records for approximately 75 batches of injectable finished drug products torn in half in a waste area. These records contain data indicating that some batches failed to meet the in-process visual inspection specifications of not more than (b) (4) % defects, while the official batch records for these batches state that these batches had met the specifications. The uncontrolled documents indicate that up to 14% of vials had defects including, but not limited to, black particles, fibers, glass particles, sealing defects, and volume variations. According to your firm’s procedures, a defect rate higher than (b) (4) % requires initiation of an investigation; however, a senior production officer at your firm stated that no investigations are performed when this occurs. Wockhardt Limited, Warning Letter |
| 2016 | Specifically, your QA technicians and other individuals were recorded destroying and altering records pertaining to commercial batch manufacturing immediately prior to this regulatory inspection. The loss of data and documents are evidenced by the following: Through a review of your firm’s Closed Circuit TV we identified the following: (a) A document shredder was introduced into your firm’s “DOCUMENT STORAGE AREA” on December 3, 2016, approximately 4 days prior to the current US FDA inspection. (b) After the introduction of the document shredder, we observed extensive shredding of what appears to be controlled documents and extensive signing of documents by QA. These documents were of a color consistent with batch packaging records and batch manufacturing records, among other documents. Your firm failed to maintain documentation of what had been shredded… Form 483 to Hetero Labs Limited for an inspection ending Dec. 16, 2016 |
| And then there is the more obvious falsification and what appears to be a purposeful obstruction and hiding of data. | |
| 2013 | Personnel from your firm provided the FDA investigator misleading information related to the practices of “demo” and “trial” testing found during the inspection. Specifically, your employee denied several times that he had performed sample trial injections and performed injections other than those reported in the quality control release testing records. In addition, QC personnel refused to provide requested information regarding observed sample testing practices. Later your firm admitted that the injections were related to a practice of blending a non-compliant API batch with an API batch that had met the impurities specifications. The FDA was informed during the inspection that all electronic raw data files are automatically stored on a central server that is inaccessible by QC staff and that no data would be found on personal computers (PCs) associated with laboratory equipment. Later in the inspection, FDA found that raw data was being stored in several folders on PCs. Fresenius Kabi Oncology, Warning Letter |
| 2015 | During the inspection, an analyst removed a USB thumb drive from a computer controlling an HPLC. When asked to provide the drive, the analyst instead exited the room with the thumb drive. After approximately 15 minutes, management provided our investigator with what they asserted was the USB thumb drive in question. It is impossible to know whether management provided the same USB thumb drive that the analyst had removed. Zhejiang Hisun Pharmaceutical Co., Ltd., Warning Letter |
| Uncontrolled images of signatures cannot be used in lieu of certificate-based electronic signatures. | |
| 2016 | Your firm’s computer system for entering test results and storing certificates of analysis (CoA), which document whether a drug meets specifications, does not have sufficient controls to prevent unauthorized changes to a CoA after quality unit approval. During the inspection, our investigator reviewed (b)(4) CoA stored on computer #16, all of which were approved by the quality unit. A manager demonstrated for our investigator how results on an already finalized CoA could be manipulated after the formal quality unit approval. Also, the quality unit’s electronic signatures on these CoA were uncontrolled images of signatures rather than certificate-based electronic signatures. Polydrug Laboratories Pvt. Ltd., Warning Letter |
| Physically blocking FDA investigator access to areas they have authority to inspect and limiting of FDA photography will never end well. | |
| 2016 | Barring access to areas During the inspection, your firm limited the investigator’s access to the quality control laboratory. The quality control manager directed employees to stand shoulder-to-shoulder, barring our investigator from accessing portions of the laboratory and the equipment used to analyze drugs for U.S. distribution. Limiting photography During the inspection, our investigator attempted to take pictures of the (b)(4) apparatus used to manufacture drugs for U.S. distribution. Your quality assurance manager impeded the inspection by preventing our investigator from photographing this piece of equipment Nippon Fine Chemical, Warning Letter |
| The tools provided in Chromatography Data System software should be fully utilized to identify potential deviations that should be investigated and remediated. | |
| 2016 | Your quality unit failed to monitor and investigate error signals generated by the computerized systems that you use for high-performance liquid chromatography and gas chromatography. These signals indicated the loss or deletion of original CGMP analytical data. However, your quality unit did not comprehensively address the error signals or determine the scope or impact of lost or deleted data until after these problems were reviewed during our inspection. For example, our investigator reviewed audit trails from August 2016 assay testing on (b)(4) batch (b)(4) and dissolution testing for (b)(4) tablets batch (b)(4). The audit trail for these tests included the message, “deleted result set,” but neither of these two incidents was recorded in the analytical packages for these batches of drug products, nor were they reviewed or investigated by the quality unit. In addition, during the inspection, our investigator observed that your Empower 3 system audit trail displayed many instances of a “Project Integrity Failed” message, which indicates that injections were missing from the results of analytical testing. For example, in (b)(4)analysis for (b)(4) tablets batch (b)(4) conducted on June 20, 2016, no chromatogram was rendered for the initial run of testing. The data package for this testing clearly shows that the initial run is missing, but your quality unit did not investigate the incident. Mylan, Warning Letter |
| Data from PLCs should agree with paper documentation such as batch records and validation reports. | |
| 2016 | Documentation pertaining to exhibit batches submitted to the agency are incomplete and inaccurate. Data derived from your firm’s programmable logic controller (PLC) for compression machines is inconsistent with batch records and validation reports in support of applications to the Agency: …Per the PLC record, run (b)(4) was initiated 15:01:03 on 06/12/2016 a full day prior to what is indicated on the BR. Your firm failed to provide documentation explaining the (b)(4) separate runs under the same batch number. The process validation report PVR2008-01 is silent with regards to (b)(4) runs under the same batch number. Form 483 issued to Hetero Labs Limited for an inspection ending Dec 16, 2016 |
| A newer deficiency in controls over chromatography data systems. | |
| 2017 | Our investigators observed that the software you use to conduct high-performance liquid chromatography (HPLC) analyses of API for unknown impurities is configured to permit extensive use of the “inhibit integration” function without scientific justification. For example, our investigator reviewed the integration parameters you used for HPLC identification of impurities in release testing for (b)(4). These parameters demonstrated that your software was set to inhibit peak integration at four different time periods throughout the analysis. Similarly, in the impurities release testing you performed for (b)(4), your HPLC parameters were set to inhibit integration at four different time periods throughout the analysis. Inhibiting integration at various points during release testing for commercial batches is not scientifically justified. It can mask identification and quantitation of impurities in your API, which may result in releasing API that does not conform to specifications. Divi’s Laboratories Ltd. (Unit III), Warning Letter |
For more on data integrity, read this: When Will the FDA Move on from Data Integrity