A guide to GxP compliance

GMP, also known as cGMP (Current Good Manufacturing Practice) ensures pharmaceutical products, medical devices and other regulated items are consistently manufactured and controlled according to quality standards - thus reducing the risk of harm to consumers.

Rules and interpretations differ from country to country (and change frequently) but all GMP require that products

• are of consistently high quality;
• are appropriate for their intended use;
• meet the requirements of the marketing authorisation or clinical trial authorisation.

What’s different about life science manufacturing?

The kind of items these regulations cover are difficult to dismantle (or individually check) for quality testing purposes after they have been assembled in a production process. And their failure could represent a substantial risk to human health. Think of a strip of pills or a complex software-controlled medical device. Although batch testing is an important part of QC, GMP instead, seeks to ensure quality is ‘built into’ a product, through the effective and consistent control of the processes used to create it.

The 5ps of GMP- are the best practice areas of focus for life science manufacturers. They prioritise reducing the risk of non-conformities in end products by ensuring the consistent implementation of processes and procedures, equipment and personnel training, across the product lifecycle.

Through proper SOP documentation, implementation and record keeping GMP ensures:

• Standard operating procedures are defined and well-documented.
• Manufacturing processes are defined and controlled. Any changes to processes are evaluated and validated.
• The manufacturing process is recorded to prove that all required procedures and instructions are properly followed.
• Manufacturing occurs in a controlled environment that prevents cross-contamination.
• The causes of any quality defects are investigated and action taken to ensure that the defect does not occur again.

GMP also sets out best practice methods for manufacturers to ensure their products are packaged and labelled correctly, and that they have the ingredients and strength they claim to have.

Good Automated Manufacturing Practice (GAMP) are the guidelines for companies involved in the development and implementation of automated systems for the Pharmaceutical and Food Industries.

Increasing automation presents huge opportunities for Pharmaceutical manufacturers as they seek to produce drugs more quickly, efficiently and cost-effectively. But more automation inevitably means more complexity and an increasing risk of failure and non-conformance in end products.

For a pharma production line controlled by computer systems much of the focus on regulating quality of output shifts to the development and maintenance of the software itself.

What is Computerised System Validation?

Computerised Systems Validation (CSV) is a way of proactively guarding against the failure of such automation, and it has become a key feature of the regulatory landscape.

A CSV process establishes documentary evidence that a specific computerised system will consistently produce a product meeting its predetermined specifications and quality attributes.

This V model of software validation ensures quality is ‘built into’ your product development and management processes rather than simply ‘tested for’ and corrected retrospectively in an end Product.

The V-model provides a logical sequence that helps to organise the complex activities of defining a project scope, executing it, and qualifying it at every stage.

The V model provides an excellent basis for design control and tracking changes as a project proceeds. And the right document management system can help companies organise and generate the documentation required to execute and record this process of specification, qualification and validation - with all the relevant files indexed and stored for future auditing purposes.

But there is a logistical problem with this. This kind of validation can be a time consuming and expensive process to execute. Where end products are complex and product updates are frequent, these validation requirements can overwhelm a business resource and undermine their agility. In fact, when a company is using other manufacturers software to automate their systems, it might be impossible to achieve. That’s where the GAMP5 guidelines are intended to help.

What is GAMP5

GAMP 5 ® refers to the ISPE's best practice guidance (Version 5) which has been adopted by the industry as a framework for companies to successfully validate their computerised systems using a risk-based approach.

GAMP5 provides guidelines for required validation processes that take into account the following concepts

• A holistic understanding of product and process
• The way products can be managed and validated using a QMS
• The way lifecycle management can be levered for more scalable validation processes
• Encouraging a scientific approach to risk management that focuses on the systems that pose the most potential risk to end-users
• Levering the involvement of suppliers in the validation process to avoid duplication of effort and speed up compliance

Computerised Systems Validation is a requirement in many different parts of life science regulation including around the systems used to support GLP and GCP.

Adopting a Document Management System that functions as part of your QMS, can help a business verify and validate the operation of its required functionality while creating software systems. They can trigger validation processes to take place when new features are added, which are automatically documented as part of your change control process.

Defining and setting up these systems early on will help companies more successfully pass audits and inspections that increasingly focus on validation as a proactive measure against systems and product failure.

In the UK, the MHRA inspectorate have explained how inadequate CSV documentation frequently contributes to companies failing their audits:

Inspecting and certifying bodies around the world have echoed these issues.

Validation for electronic Quality Management Systems

It should be noted that electronic Quality Management Systems themselves are ‘computerised systems’ that require validation.

ISO 13485 Clause 4.1.6, for example states that “software applications shall be validated prior to initial use and, as appropriate, after changes to such software or its application”

A good supplier will be able to supply ‘validation packs’ to assist you in meeting these application validation requirements.

Good Clinical Practice (GCP) is a set of internationally recognised ethical and scientific quality requirements that must be followed when designing, conducting, recording and reporting on clinical trials that involve human beings.

The guidance on good clinical practice has been produced by the International Conference on Harmonisation of Technical Requirements for Registration of Pharmaceuticals for Human Use.

Here's a summary of the 13 core principles of GCP, as outlined by the ICH.

What are the 13 Principles of Good Clinical Practice (GCP)?

Those who plan and administer clinical trials must ensure:

1. Ethical Conduct: Uphold the highest ethical standards in all trials.
2. Subject Well-being: Prioritise the well-being, rights, and safety of trial subjects.
3. Risk Assessment: Assess foreseeable risks against anticipated benefits before initiation.
4. Benefit Justification: Proceed with trials only if benefits justify the risks.
5. Scientific Soundness: Ensure trials are scientifically sound with clear written protocols.
6. Protocol Approval: Obtain prior IRB/IEC approval for all trial protocols.
7. Qualified Medical Care: Assign qualified physicians or dentists for medical decisions and care.
8. Individual Qualification: Ensure all involved are qualified to perform their tasks.
9. Informed Consent: Obtain freely given informed consent from all subjects.
10. Accurate Recording: Accurately record all clinical trial information.
11. Information Handling: Handle and store trial information securely and accurately.
12. Precise Reporting: Enable precise reporting, interpretation, and verification of trial information.
13. Regulatory Compliance: Adhere to GCP and applicable regulatory requirements.

These principles of GCP form the basic framework for the safe and accountable planning, governance and administration of every part of a clinical trial. 

GPvP refers to a minimum set of standards defined by the EMA which ensures companies continue to monitor the safety of the medicines they have developed after they have been launched in the market.

What is Pharmacovigilance? (PV)

Pharmacovigilance refers to the scientific process of data collection, analysis, monitoring and prevention of any adverse effects in drugs and therapies.

It is a set of ongoing requirements intended to determine which adverse events are acceptable side effects of a drug or therapy, given their overall benefit to human health - and which are not.

The proper administration of PV within a business authorized to market and sell drugs is vital to prevent the catastrophic failures of oversight experienced in the past, where medicines such as Thalidomide continued to be licensed and sold, despite strong evidence appearing of its horrifying side effects.

What is GPvP compliance?

GPvP entails constructing and maintaining a Quality Management System capable of storing and allowing access to vast quantities of safety data, which, in turn, is used to monitor and report on the safety of all the drugs a company has authorisation to market.

The QMS describes and defines all the measures, processes and procedures necessary to ensure that suspected adverse reactions to medicinal products are collected, processed and acted upon.

There are many requirements for the effective and auditable administration of this system including:

• The appointment of a Qualified Person Responsible For Pharmacovigilance (QPPV) - an individual who is personally responsible for the safety of the human pharmaceutical products marketed by that company.
• The creation and maintenance of a Pharmacovigilance System Master File. A PSMF is a document describing the pharmacovigilance system used by the marketing authorisation holder (MAH) with respect to one or more authorized medicinal products.
• The preparation for the attention of the authorities of notification of serious adverse effects (ICSRs), periodic safety reports (PSURs) and reports on studies of post-authorisation safety (PASS);

In the UK the MHRA inspects marketing authorisation holders ( MAH ) to determine that they comply with these obligations.

Good laboratory practice (GLP) are principles which ensure the quality and integrity of non-clinical laboratory studies that support research or marketing permits for products regulated by government agencies. They are defined in FDA 21 CFR Part 58 and other regulatory codes.

GLP should govern studies around the hazards and risks to health and the environment posed by:

• Medicines
• Pesticides
• Cosmetics
• Veterinary drugs
• Food and feed additives
• Industrial chemicals

A key objective of GLP is securing data integrity through Good Documentation Practice (GDocP). GDocP ensures that regulated documentation is always accessible to those who need it - as well as data that is, Attributable, Legible, Contemporaneous, Original and Accurate (ALCOA+).

Adherence to these and other elements of GLP ensures that published data properly reflects the results obtained during those studies and can therefore be relied upon when making risk/safety assessments in development projects.

Good Distribution Practice (GDP) governs the wholesale distribution of medicinal products and is designed to ensure quality and integrity is maintained throughout the supply chain.

The World Health Organisation describes GDP as:

GDP keeps products safe and in a usable condition for their intended consumers

Distribution is important in the life science industry because of the way sensitive or fragile medical products are stored and transported can impact their APIs (Active Product Ingredients) and future intended performance.

Regulators such as the EMA and the FDA have begun to increase focus on this area, specifying the way processes and procedures should be implemented and recorded for GDP compliance. In the UK, the MHRA certifies adherence to GDP through inspection and auditing - and licenses businesses accordingly.

Anyone importing, holding, procuring, supplying or exporting medicinal products or active substances have to adhere to these guidelines - and be able to demonstrate how they comply.

Operators in this sector need to have auditable systems that specify and define the measures they take to ensure:

• Medical products are always transported and stored under the right conditions
• Contamination, theft or tampering is prevented
• Recalls and complaints can be effectively managed
• Only authorised products enter the distribution network

It should be noted that the number of critical dependencies within the supply chain means that in the EU, distributors, manufacturers and their agents are now facing ‘joint and several liability’ for quality failings in end products. Manufacturers need to be confident that their suppliers and distributors are implementing GDP in a trackable and auditable way.

Good Agricultural and Collection Practices (GACP) as defined by the WHO and others to address the specific concerns of growing, collecting and primary processing of herbs and plants that are used for medicinal purposes.

These include the QA practices, training responsibilities, and good document management practice - including the creation of Quality Management Systems to ensure repeatability and consistency in the standards of end products supplied to the market.

GACP - Documentation Requirements

• For cultivated medicinal plants it is essential to document the type, quantity and the date of harvest as well as the chemicals and other substances used during production such as fertilizers, pesticides, herbicides and growth promoters.
• All batches from each designated area should be unambiguously and unmistakably identified by batch number.
• All processes and procedures that could affect the quality of the product must be documented and used to promote best practice throughout the collection and storage of the regulated materials

In recent years with the growth of interest in medicinal cannabis and as a legalised and regulated ingredient in ‘novel foods’ - producers, distributors and manufacturers of associated products are having to rapidly respond to new regulatory requirements.

One of the most challenging areas for these evolving companies - has been the requirement to build the Quality Management Systems, with which they can document and help implement best practice in an agile and auditable way.

GDocP (Good Documentation Practices) are the standards by which data and documents should be created and maintained in the life sciences industry.

All GxP have at their heart GdocP which allows for auditable and accurate record-keeping, good governance and quality management.

For example, compliance with the Food and Drug Administration's GLP as well as GMP regulations for drugs and medical devices (21 CFR Parts 211 and 820) all speak about the observation of Good Documentation Practices.

What types of document need to be created and maintained using Good Documentation Practices?

• Batch Records
• Bills of Materials (BOMs)
• Certificate of Analyses (CoA)
• Certificate of Compliance (CoC)
• Laboratory Notebooks
• Logbooks
• Policies
• Protocols
• Quality records (including CAPAs, internal inspection reports and change control)
• Standard Operating Procedures
• Test Methods
• Training Documentation
• Validation Documents (IQs, OQs and PQs)
• Product and Sample Labels

Good documentation practice reflects the principles of ALCOA+.

ALOCA+ is an acronym that defines the fundamentals for ensuring data integrity in ‘source data’. It defines the critical elements of Good Documentation Practice:

Throughout the regulatory literature - Quality Systems are cited as the way GxPs are expected to be defined, implemented, audited and subject to a process of continuous improvement.

The definition and replication of all these GxPs across a business depends on the ability to build a robust Quality Management System that is accessible to the people who need to refer to it in their daily work. 

A good digital Quality Management System can underpin a company’s ability to control the administration and observation of GxP standards across a business.

The right digital QMS (with all its document control capabilities) gives workers the tools to create and maintain a ‘single, accessible and definitive source of truth’ when it comes to recording and implementing GxP in their working practices.

Whether you are manufacturing a drug or medical device, warehousing active ingredients (APIs) or carrying out laboratory testing, the demands of GxP compliance are fundamentally the same.

GxP compliance is about having the ability to implement (and prove you have implemented) all the controls identified as necessary for the delivery of a reliable, safe and usable end product or service.

Compliant businesses mitigate the risk of product failure (and, therefore, harm to consumers) through consistent process definition, training, procedural control and record keeping around all their working practices.

It's a proactive approach to quality and risk management through the implementation of best practice that notified bodies and regulators around the world need to inspect, audit and certify.

But while you need a QMS robust enough to protect consumers against the risk of product failure, your approach to GxP needs the flexibility to keep pace with new commercial opportunities and legislative changes.

In the end, the accessibility and agility of the digital tools you use to manage your quality management system will be pivotal to your successful and scalable compliance with the regulation.