GLP

Good Practices in the Testing Laboratory Jerry Lanese

The FDA regulation on Good Laboratory Practice deals with toxicology and preclinical studies. What most people want to know about good laboratory practice when they talk about GLP has nothing to do with the regulation 21 CFR 58, even if they don’t know that! The author clarifies the situation and proceeds to reasonable expectations for today’s laboratories.

CLARIFICATION - VENTING A FRUSTRATION As the biographical sketch will reveal, the author has spent many years in Quality Control and Quality Assurance in FDA regulated industries. These industries, as all industries, are filled with an alphabet soup of acronyms that are used as shorthand in written and oral communication to designate processes (PAT = Process Analytical Technology), documents (SOP = Standard Operating Procedures), equipment (HPLC = high performance liquid chromatograph) and regulations (GLP = 21 CFR Part 581; Good Laboratory Practice for Nonclinical Laboratory Studies). Sometimes these lead to confusion. It is the latter acronym (GLP) that should be addressed. The GLP (Good Laboratory Practices) regulation has very little to do with practices in the laboratory. It is all about the management of a preclinical study. This author is routinely asked by clients to present training on GLPs or by editors to write a paper on GLPs. When they read the scope of 21 CFR 58 they change their minds. The title of this regulation and the resulting acronym do not give a good indication of the regulation content. Although, to some, the following article falls into the category of good laboratory practices, it has nothing to do with toxicology or preclinical studies. It describes good practices for a material testing laboratory. These practices support compliance within FDA regulated industries and apply to laboratories that sup48

Journal of GXP Compliance

port both marketed product production and product development. Many of the references and examples come from the pharmaceutical industry. The primary reference is international and without a focused industry, and the practices apply to all testing laboratory operations. These practices are often referred to as Laboratory Controls. In a broad sense, Laboratory Controls may be defined as: documented practices that provide a high degree of assurance that the reported laboratory results accurately reflect the chemical, physical, or biological characteristics of the material under test.2 Maybe, to reduce the confusion, the industry should adopt a new acronym such as GLC (Good Laboratory Controls), ALC (Acceptable Laboratory Controls), or CLC (Contemporary or Current Laboratory Controls). GOOD PRACTICE IN THE LABORATORY AND THE REGULATIONS Unfortunately, there is only one section in the FDA regulations that covers good practices in material testing laboratories. Within the drug CGMP,3 one can find 21 CFR 211, Subpart I; Laboratory Controls.4 This subpart includes several paragraphs, listed in Table 1. The requirements in this subpart are based on the drug industry of 1978. If one wants to audit a laboratory's policies, procedures, and practices against this subpart, with a late 1990s interpretation, the checklists in “cGMP in the Laboratory”,5 that appeared in the predecessor to this journal more than ten years ago, is a reasonable starting point (See Journal of cGMP Compliance, July 1997, Volume 1 Number 4). Two additional, dated references that can be used as a starting point for an audit or assessment of a Quality Control Laboratory, and its Laboratory Controls, are FDA inspection guides published in the early 1990s, following the generic scandal6,7. More current expressions of the FDA interpretation of Laboratory Controls is found in two

Jerry Lanese

TABLE 1 21CFR211 Subpart I; Laboratory Controls3 21CFR211.160

General requirements

21CFR211.165

Testing and release for distribution

21CFR211.166

Stability testing

21CFR211.167

Special testing requirements

21CFR211.170

Reserve samples

21CFR211.173

Laboratory animals

Compliance Policy Manual Inspection Guidances often referred to as the Systems Inspection Program or Systems Based Inspections8,9. All of these references focus on the drug GMPs. The FDA documents focus on problem areas observed by the FDA during site inspections. Despite the passage of time, the basic concepts for good practices in the testing laboratory implied in 21CFR 211, Subpart I4 apply today. The checklists referenced above are still a good place to start in the evaluation of a laboratory in any FDA regulated industry - any industry. But times have changed and the regulations have not changed. Good practices in the laboratory have evolved and become more demanding and complex. Expectations for controls in a laboratory are defined in references or standards other than the GMPs. For a laboratory operating in an FDA regulated industry, defining current good practice cannot be limited to what is happening in laboratories regulated by the FDA. Consideration must be given to the practices in all laboratories. To be compliant with the CGMP expectations that a firm should be current, other references and standards should be considered. For a testing laboratory the most important consideration is good science. The FDA recognizes this. Repeatedly the drug GMPs10 reference “scientifically sound” procedures and sampling plans. Since the turn of the millennium, FDA representatives have been talking about the application of good science in the regulatory process.11 Pharmaceutical Quality Control Laboratories have adopted new science, tools, and techniques more rapidly than their counterparts in

production. Compendia, such as the United States Pharmacopeia12 (USP), are constantly revised to reflect the changing science and industry. The message to the industry found in: Guidance to the Industry; Quality Systems Approach to Pharmaceutical CGMP Regulations13 (hereafter referred to as the QS Guidance) is that the organization should adopt a standard and manage the compliance requirements defined in the CGMPs within that standard. This QS Guidance references ISO 9000-200514 as a possible model for the enterprise. In 1996 the FDA finalized the Quality System Regulation (QSR)15 within the framework of the version of ISO 900116 in effect at that time. The preamble to the published regulation17 clearly identifies the relationship between QSR paragraphs and ISO 9001 paragraphs. It also identifies where the QSR goes beyond ISO 9001. Another standard referenced in the QS Guidance is ISO 17025, General requirements for the competence of testing laboratories.18 This is a relatively new standard for testing laboratories. It is certainly newer than the 1978 pharmaceutical GMPs.3 ISO 17025 is a voluntary standard; there is no regulation attached to it; firms adopt it by choice; and the firm may chose to go through a formal certification process. The scope of ISO 17025 includes testing and calibration laboratories, and, as a result of activities within the automobile industry, it has been applied extensively to calibration laboratories. Physical, chemical, and biological testing laboratories fall within the scope of ISO 17025. Some FDA laboratories have chosen to be certified against ISO 17025. Although the FDA states it is going January 2008 Volume 12 Number 2

49

GLP through the process of certifying its laboratories to improve their credibility, there is a clear endorsement of voluntary standards. Many of the concepts found in ISO 17025 echo requirements in 21CFR 211 subpart I,4 or other parts of the CGMP. Others provide a current interpretation of requirements in the pharmaceutical GMP. Many of the requirements provide current interpretation to “other laboratory control mechanisms”19 alluded to in the GMPs. It is worth reviewing ISO 17025 as a current definition of Laboratory Controls. In this review the calibration service testing aspects of the standard are ignored. This review should not be considered a complete application of Laboratory Controls within ISO 17025. If a laboratory decides to use ISO 17025 as the model for its Laboratory Controls, it should critically review the standard to determine the appropriate elements of the standard for the specific laboratory environment. In the regulated environment, each element of the Laboratory Controls must be supported by written and controlled procedures and forms. One of the issues that always surfaces is what level of Laboratory Controls should be implemented in the development laboratory. ISO 17025 standard is a general standard for all testing laboratories and supports good science, which should be a primary concern of any laboratory. Clearly, laboratories that support drug product development are subject to the drug CGMP regulations in effect today. ICH Q1020 strongly suggests that the Pharmaceutical Quality System should be implemented throughout the product lifecycle, which includes product development. The QS Guidance also references the lifecycle. Laboratory controls are a reasonable expectation of all testing laboratories involved in any phase of the product lifecycle. If a laboratory is interested in good science, it should never ask the question, “How GMP should we be?” ISO 17025 is divided into two parts: Management Requirements and Technical Requirements. MANAGEMENT REQUIREMENTS Items discussed under Management Requirements include the organizational infrastructure that must be in place for the laboratory to exist, as well as the Quality System components that are generally managed for the whole site by a unit other than the laboratories. 50

Journal of GXP Compliance

Organization The laboratory should carry out its responsibilities while meeting the requirements of appropriate standards, clients or customers, and regulating authorities. Most laboratories in the regulated environment are captive units within a larger entity. Requirements are defined in internal corporate or site policies and procedures. If the firm has the type of Quality System required in the QSR15 or proposed in the QS Guidance, responsibilities are defined in the Quality Manual. The laboratory must not be subject to external conflicting influence in the interpretation of data, reporting of results, or compliance with standards. An obvious, and possibly superficial, way of demonstrating this independence is to show the laboratory as an independent unit, reporting to the highest level on the organization chart and without any attachments to units that might want to influence its integrity, such as production, marketing, and finance. The real test is whether business or the pressures of any of the impacted units over rides good science in the operation of the laboratory or information released by the laboratory. The organization of the laboratory should be defined in the site Quality System, Quality Manual, and Laboratory Controls and provide for: • Authority and resources to perform the expected tasks and take appropriate action when the unexpected happens. • Freedom from internal and external influences. • Policies and procedures that protect the confidentially of the information. This applies most to the contract laboratory, but should be a consideration for the internal laboratory. • A clear organizational and management structure. • Defined responsibilities, authorities, and internal relationships for all staff. • Adequate supervision by individuals with appropriate qualifications. • A senior manager who is responsible for ensuring that all elements of the internal Quality System are implemented and followed and has access to management at the highest level where decisions are made impacting laboratory policy and resources. Customers for the captive laboratory are internal to the organization, and few. Customer requirements are

Jerry Lanese

communicated through internal procedures and forms. For the contract laboratory, the definition of customer requirements is more complex and often complicated by marketing efforts. In both environments, it is appropriate to have procedures in place that define a process for the determination of customer requirements. This is addressed further, below. ISO 17025 considers laboratory management responsible for work contracted out. For the captive laboratory, the decision to contract work may be made at a higher level. When results generated by a contract laboratory are ultimately reported to the customer by a second laboratory, the reporting laboratory is responsible for the assurance of the quality of the data. This requires processes such as vendor certification, vendor audit, skip lot testing. Quality System

Quality System is the new buzz word in FDA regulated industries. In reality it is the reincarnation of a concept that has been around for some time. Every organization should have a Quality System. Usually the organization's quality system is modeled after the quality standard it chooses, or is imposed on it in the form of a regulation. Every organization should be evaluated against quality standards. Ideally, that evaluation should begin with a critical internal evaluation. For decades the FDA has been evaluating firms against regulations, which are a type of quality system. Unfortunately, the old regulations21 focused on the production and quality control aspects of the business and the industries placed the responsibility for implementation on the quality unit. Contemporary standards recognize the importance of management support and involvement in the effective implementation of any Quality System. Details of the evolution of FDA from the enforcement of the old regulations to the Quality System concept is not appropriate for this discussion. From the implementation of the QSR15 it was apparent that every organization under the FDA umbrella should embrace the Quality System concept and therefore, every laboratory should be operating within a Quality System. FDA made this very apparent for the pharmaceutical industry when it issued the systems-based inspection compliance guides8,9 and the QS Guidance in which the Laboratory Control System is positioned under the umbrella of the Quality System. Laboratory Controls

include subsystems provided by the enterprise Quality System. Many of these are discussed within the following management requirements. Document System

Compliance to any standard requires a system of controlled documents. For the laboratory, documents include policies, procedures, test methods, sampling plans, and specifications. All of these are controlled within the document system. Throughout this discussion of Laboratory Controls it is stated that there should be a system, process, or procedure for elements of the Laboratory Controls. These are detailed in controlled documents. Where the laboratory is part of a large organization, the document system is a site function, generally managed by Quality Assurance. Although a system of controlled documents is one of the foundations of Laboratory Controls, it is taken for granted in this discussion. It includes the structure and procedures for the wide range of documents that define Laboratory Controls. Once implemented the procedures must be followed by all. Review of requests and contracts Although the ISO 17025 requirement for contract review22 is aimed at the contract laboratory, the concepts apply to all laboratories. This section requires policy and procedures that allow the laboratory to review any proposed work to determine whether the methods are adequately defined, the laboratory has the ability and resources to perform the testing, and the tests meet the requirements of the client. For the contract laboratory, this avoids commitments by marketing that cannot be met by the laboratory. For the captive laboratory, it is appropriate that there be a process for laboratory review of projects that require non-routine testing or samples, such as validation projects, before the laboratory is committed and the project is initiated. Subcontracting of tests

In many cases, the laboratory does not have the ability to perform all of the testing requested of it and it becomes necessary to rely on the expertise or capacity of a contract laboratory. When reported to the client, the reporting laboratory is responsible for the data. Laboratory Controls should include processes that proJanuary 2008 Volume 12 Number 2

51

GLP vide this assurance. Often the audit and certification processes are the responsibility of other units, such as Quality Assurance, but the laboratory must be involved and assure appropriate controls that provide assurance of the quality of the data are in place and all aspects of the defined processes are current. Purchasing services and supplies

ISO 17025 states: “The laboratory shall have a policy or procedure(s) for the selection and purchasing of services and supplies it uses that affect the quality of the tests”.23 In most cases the responsibility for purchasing lies with the purchasing unit and one of the responsibilities of that unit is to obtain the best price for the company. The best price for an item is often in conflict with the required performance characteristics. Every laboratory can relate examples of the purchasing department's having found a cheaper supplier of a reagent that appeared to have the same specifications as a reagent in use, and ordered that reagent. When received and introduced to testing, the test methods did not work. Another area of concern is contracting for services, such as facility or equipment maintenance, calibration, qualification, or validation. The laboratory should be involved in purchase or contracting of any services that have laboratory-specific requirements and cannot be effectively evaluated on the basis of a list of specifications or marketing claims found in a catalog. Laboratory Controls include a system that allows the purchasing unit and the laboratory to work together as a team to provide supplies and services that meet laboratory requirements and minimize the potential risks associated with dealing with suppliers. Often these are Purchasing Department procedures. If the Purchasing Department is not covered by controlled documents, the laboratory should have its own controlled procedure that defines the laboratory purchasing process. “Procedures shall exist for the purchase, reception and storage of reagents and laboratory consumable materials”23 and there should be processes to “ensure that purchased supplies and reagents and consumable materials that affect the quality of tests … are not used until they have been inspected or otherwise verified as complying with standard specifications or requirements …”.24 These ISO 17025 requirements are ex52

Journal of GXP Compliance

amples of how the new standard provides detail to the GMP requirement for “other laboratory control mechanisms”. Procedures for storage and handling of some laboratory chemicals and reagents cannot be limited to the requirements found in ISO 17025 or the GMPs. Laboratory Controls include policies and procedures that support a range of national and local environmental standards and OSHA regulations. Among these are procedures that require the use of safety glasses and other protective equipment, use of special, emergency breathing apparatus, and storage of acids, bases, and volatile solvents. Once the purchased materials enter the laboratory environment, the handling of these materials is a laboratory responsibility and there should be laboratory procedures in place consistent with current practice. It is very common for a laboratory to have a procedure that defines receipt of chemicals and reagents. It may identify the label form; it must identify the content of the label that should include: date received, expiration date, and identification of the individual preparing the label. Most laboratories identify two expiration dates based on date of receipt and date of opening. The requirement for these dates implies that there is a process in place for establishing scientifically sound, and supportable expiration dates for the range of chemicals and reagents found in the laboratory. Reference standards, standard solutions, and chromatographic columns are just a few of the special items that are routinely ordered and received by the laboratory. Laboratory Controls include special processes for purchase, receipt and control of these items that assure the integrity or the material. Reference standards are discussed further under Technical Requirements. Control of nonconforming testing

When the laboratory identifies a non-conforming material, the initial concern is how the laboratory handles the result that is not within specifications or is unexpected. The pharmaceutical industry and the FDA spent a decade beginning about 1993 wrestling with this issue. It is fair to say that, by today's standards, most laboratories did not do a good job with out-of specification observations prior to the generic scandal. Investigations and conclusions were (and possibly are still) often biased by pressures from outside the labo-

Jerry Lanese

ratory. Judge Wolin provided a legal interpretation as to whether investigations of out-of-specification observations are appropriate and what should be included in an investigation.25 Guidance26 has expanded the scope of the expectations to include unexpected results. Two conclusions can be derived from the expanded scope. First, Laboratory Controls should include trending of data and a mechanism for identifying test results that are out of trend. Second, laboratories in a development environment may claim that they are not testing against specifications, but they generally have some expectation of the outcome. Laboratory Controls in the development environment should include a process for investigating unexpected observations consistent with current industry practice and FDA expectations.26 The laboratory procedure for handling out-of-specification or unexpected observations starts with logging the observation. This is followed by a laboratory investigation with the purpose of identifying the assignable cause. If an assignable cause cannot be identified, the organization must either accept the original observation and report it or extend the investigation using an approved protocol for retesting. There is still debate as to whether retesting is appropriate. The organization will have to decide what approach it will take and, if it decides to use retest as part of laboratory investigations, the laboratory should have a policy that supports the decision and a procedure that defines the process for retest. Retest procedures are complex and scrutinized closely for good science and compliance to the procedure. Corrective Action, Preventive Action (CAPA)

CAPA is an important part of Laboratory Controls. In most organizations CAPA is an element of the enterprise or site Quality System and managed by Quality Assurance. It is important that the laboratory integrate its investigations and recommendations into the CAPA program and use it as a tool for continuous improvement of laboratory operations. Records

Records are a very important requirement of any Quality System. Almost every procedure in the Quality System requires that some record be generated, analyzed, reacted to, and stored. The record system goes well

beyond the laboratories and is often implemented, managed, and monitored by a unit outside the laboratory. Record systems are very complex today because of the implementation of computerized systems that create, collect, and store data and records. They are often integrated with paper records. The laboratory has been a significant force in driving the transition to computerized record systems. High Performance Liquid Chromatography, a significant tool in most laboratories and the instrument of choice for greater than 80% of the sample load in the many pharmaceutical Quality Control Laboratories, is very data intensive. Chromatographic data systems are often the first computerized system introduced in the operations part of a business. Laboratory Controls include the processes for those enterprise or site record systems that apply to laboratory operations. There must also be procedures in place that discuss records and record keeping practices unique to the laboratory. These include: • The handling of notebooks: assignment of individual notebooks, indexing and maintenance of notebooks, page formatting, close-out of the notebooks, and archival processes • The many aspects of good record keeping practices: neatness, corrections, significant figure practices, rounding, handling of instrument generated printouts • LIMS and chromatography data system usage that goes beyond the enterprise network procedures, such as: system-specific log-in and log-off, data or information entry, file naming practices, handling of the raw data, reporting of computer generated results TECHNICAL REQUIREMENTS Within the ISO 17025 framework, technical requirements cover those operations and concepts that impact the hands-on part of the laboratory operation. Personnel In the laboratory, more than in any other unit in the organization, the skills and practices of the staff are important to the success of the operation. A detailed discussion of a training program can be found in the article: “Training and the Laboratory”27 (This article appears later in this section for your convenience.). January 2008 Volume 12 Number 2

53

GLP The Drug GMPs use the terms education, training, and experience. ISO 1702528 states “the laboratory shall maintain current job descriptions”. Although one might interpret a requirement for job descriptions from the various FDA regulations, the ISO 17025 statement is clear. As a requirement of the Quality System, job descriptions are under the controlled document umbrella, requiring appropriate review, approval, and change control. Since Job Descriptions are the responsibility of Human Resources in most companies, the requirement positions some of the activities of that organization within the Quality System. Not only should the documents (the job descriptions) be controlled, the processes supporting them should be controlled. Job descriptions should be thorough and, in addition to required education and expected experience, they should define responsibilities including tasks such as: planning laboratory operations, performing tests, interpretations, reporting opinions and results, and management duties. They should define required expertise or experience, as well as qualification and training. In the System Inspection Programs8,9, the inspectors are directed to review the training and qualification of laboratory personnel. ISO 17025 states that “…management shall ensure the competence of all who operate specific equipment, perform tests, evaluate results, and sign test reports …”.29 These statements demonstrate the evolving expectation that training programs go beyond reading procedures, stand-up lectures, or one-on-one mentoring to documented challenges of the competency of the individual to perform the assigned tasks. Conceptual training should include challenges (usually tests) of comprehension. Task related training should include challenges of proficiency. Proficiency testing may be easier in the laboratory than in most areas in the organization. Analysts are required to test “unknown” samples at the end of training on a specific method to demonstrate proficiency, and periodically through their tenure in the laboratory to maintain qualification. With competency testing, the “true” value of the sample must be known and appropriate, and challenging criteria should be defined for the acceptance of an analyst's result as a demonstration of proficiency. Results that do not meet these acceptance criteria should be procedurally exempted from the Out-of-Specification procedure and a special procedure for handling them included in the Training Pro54

Journal of GXP Compliance

gram. Competence in the assigned tasks is an expectation at all levels of the laboratory operation, from dishwasher to management. Training records, as any record, must be maintained and available. In most laboratories individual training plans are varied and training records are complex. The responsibility for maintenance of records varies from laboratory to laboratory and must be defined in an appropriate procedure. Whatever the system, the analysts and supervisors must understand their accountabilities within the local program and constantly monitor training and training records to ensure that each analyst has documented qualifications for present and anticipated tasks. Facilities

Laboratories are often put in some remote corner of the building or site because they work with smelly materials and often the smell gets into the clothes or lab coats of the analysts and gets carried into the cafeteria. Or, they are isolated because the analysts work with microscopic bugs, molecules or tissue with funny, frightening names. The basic regulatory expectation is that all facilities, but, specific to this discussion, laboratory facilities, should be appropriate for the intended use. It is a responsibility of laboratory management to make sure that the facilities keep up with the increased sophistication of laboratory operations. Evolving laboratory operations bring special facilities' requirements, such as special grades of water, or gases, required for instruments or tests. Dirty, cluttered laboratories indicate a lack of control. The first impression of the inspector or auditor is the order of the laboratory. Adequate laboratory facilities and effective facilities maintenance practices are required to sustain a neat, orderly laboratory environment. Laboratory upkeep may embrace both the facilities unit and the laboratory. Some of the very basic Laboratory Control procedures establish the responsibilities and ground rules for keeping the laboratory neat and orderly. Although it may be acceptable, current industry practice to isolate the laboratory, it is also minimum current industry practice to provide the laboratory with an environment that has a reasonable level of air conditioning and particulate control. The basic laboratory should have appropriate hoods to isolate the toxic or

Jerry Lanese

noxious materials from the analysts. Biological and microbiological samples and testing require very special facilities that range from laminar flow hoods to isolators and class 10n clean rooms. Over time the expectations for appropriate environmental and particulate controls in sampling areas have become more demanding. These are focused prevention of cross contamination between samples and cross contamination of the sampled material onto the sampler and into the surrounding environment. Biotechnology brings additional new demands for environmental controls. Because many laboratory related facilities are special and specific to the laboratory, once installed, they may become the responsibility of the laboratory. The one exception to this generality is the HVAC system that typically remains the responsibility of the facilities organization. Responsibilities should be clearly defined in the pertinent Quality System. When the responsibilities for these special facilities lies with the laboratory, Laboratory Controls include an extensive library of procedures devoted to the operation, maintenance, and calibration of each of the units. Test Methods

Test methods are the life blood of the testing laboratory. They are a significant element of Laboratory Controls and a Laboratory Control Mechanism specifically referenced in 21CFR 211, Subpart I10. Test methods are often found in a special section of the document system. Most of the other Laboratory Controls exist to support test methods and provide assurance that the tests will be performed properly and yield accurate results. One can not mention test methods without consideration of method validation. Reference to method validation is found in the drug GMP in the paragraph on testing and release for distribution.30 In the 1978 mindset, the laboratory only had to validate release test methods. Current practice is to validate at least all critical test methods and the FDA tried to clarify its expectations when it included in the proposed amendments the deletion of the reference to method validation in the paragraph on release for distribution30 and the addition of a paragraph titled Methods Validation.31 The implication is that all test methods must be validated. A more practical approach is for the Laboratory Controls to include a procedure that defines the process

by which all test methods are subjected to a risk analysis to determine whether a method must be validated, and the level of validation. The pharmaceutical industry has been the leader in test method validation. The USP includes chapters providing guidance on validation of chemical methods32 and the validation of microbiological methods.33 The International Conference on Harmonization prepared a Guidance34 on the topic. Although most of the literature is directed to validation of chemical testing methods in the pharmaceutical industry, the concepts can be applied to the validation of any test method: chemical, biological and microbiological, and physical, for any application. Method validation is based on the evaluation or demonstration of seven characteristics: specificity, accuracy, precision, range, linearity, quantitation limit, and detection limit. Guidances also reference an eighth characteristic, robustness. The laboratory must determine which of these characteristics are challenged and the acceptance criteria that must be met based on a comprehensive understanding of the intended use of the test method. The intended use is particular to the material tested and the laboratory conducting the test. Laboratory Controls include procedures that identify responsibilities for validation and how method validation will be accomplished in the specific laboratory environment. Since the practice and terminology35 associated method validation varies between companies, the laboratory control procedures should define practice and terminology for the specific laboratory environment. A variation of method validation is method verification. Method verification will definitely be a topic for discussion if the laboratory uses compendia methods. Verification can be defined as: documented evidence that a previously validated test method performs as intended in a new environment. What constitutes adequate and appropriate method verification is still a topic of debate. The GMPs and the USP are generous in stating that if a laboratory uses a compendia method without modification, is may assume that the method is validated. But, the laboratory must verify the performance of the method.36 Often, laboratory management is unwilling to consider the good science that should be included in verification. To help the laboratory understand the process, the USP recently added a new paragraph on method verification.37 The January 2008 Volume 12 Number 2

55

GLP laboratory must demonstrate the method performs as intended under actual conditions of use. The new environment includes material, facility, instrument, and analyst. Since all of the method characteristics are dependent upon the material, analyst, or instrument, it is appropriate that method verification include an experimental challenge of the pertinent characteristics in the new environment. The laboratory should have in place a procedure that establishes a policy supporting the laboratory's interpretation of method verification. Risk analysis should be used in establishing the procedure and a risk-based approach should be included in the procedure for determining the extent of data required for each method verification project. ISO 17025 requires: “Testing laboratories shall have and shall apply procedures for estimating uncertainty of measurement”.38 The concept that a laboratory should have a good understanding of test method uncertainty might be implied by the 1978 statement, “Laboratory controls should include the establishment of scientifically sound and appropriate … test procedures”.39 However, the ISO statement clearly established the expectation for a quantitative assessment of uncertainty. Knowledge of measurement uncertainty is an important factor in establishing that a method is suitable for its intended use. Laboratory policy and method validation procedures should require an evaluation method uncertainty through the test lifecycle. This is consistent with the drive by FDA that firms design quality in products and processes (expressed in the QS Guidance and many FDA podium statements), the ICH Q8 expectation for quality by design,40 and the ICH Q10 expectation that the organization develop a system to manage information through the product lifecycle.41 The evaluation of method uncertainty should be included in the Method Development Report and/or Method Validation Report for each method. These should be readily available in any laboratory using the methods. Method uncertainty should be a part of the method specific training so that each analyst understands the uncertainty of test procedures that he or she performs. This information sharing can only happen if there is effective communication between the laboratories supporting development and operations. Often the unit that develops test methods is in a different division within the corporate organization from the ultimate method user. An effective organization will en56

Journal of GXP Compliance

able a Quality System that encourages communication between units with diverse priorities; provides a knowledge management system that allows the easy flow of information demonstrating a method is appropriate for intended use; and facilitates a thorough understanding of the test methods by the users. Equipment

It is necessary for the laboratory to have the appropriate equipment to support sampling and testing prescribed in sampling procedures and test methods. There is a cyclic relationship between laboratory equipment and test methods. The definition of the intended use of a test method may include equipment restrictions. If the development laboratory is assigned to develop a method for the assay of a certain active that will be transferred to a laboratory having only an isocratic HPLC system, the functional requirements would include the assay of that active using isocratic HPLC. If, during the method development, it becomes apparent that the required separation cannot be carried out using isocratic conditions, it would be necessary to upgrade the HPLC system in the receiving laboratory. The functional requirements could then be modified to state that the method will be used to assay for the active using gradient or isocratic HPLC. New equipment brought into the laboratory must be qualified. One of the issues continuously debated is how extensively the laboratory must qualify an item of laboratory equipment. Laboratories were qualifying hotplates with the same intensity as liquid chromatographs. As the result of an initiative by the American Association of Pharmaceutical Scientists, the USP will include a chapter on instrument qualification in the near future. This chapter will provide guidance for the classification of instruments as an aid in defining the level of qualification that should be considered when the laboratory writes its procedure describing equipment qualification. One of the first decisions is who will perform the qualification: contractor, internal group responsible for qualifications, or laboratory personnel. Responsibilities are based on the site organization defined in the Quality Manual or Quality System and supported by laboratory procedures describing the laboratory's role and process. If qualification is performed by a contract service, the site procedures covering review and approval of protocols and

Jerry Lanese

reports by site Quality Assurance apply. Also, once they become an official protocol of the laboratory as well as appropriate Quality System procedures covering deviation investigations and change control apply. Measurement traceability

In order for a measurement to be credible, an observer or reviewer must be able to trace it back to recognized or reliable standards. Traceability of the facility, equipment, and instrumental control parameters and instrument output is assured through calibration. Laboratory instrument calibration can be managed as a part of a site program. A typical arrangement exists when the laboratory has a calibration procedure which functions under the umbrella of the site calibration procedure. If the laboratory does not have a site program to work with, or within, it must establish the laboratory instrument calibration program on its own. No matter how the program is structured within the organization, it must include the same basic elements. Although ISO 17025 is a standard for calibration laboratories, it is lacking in a concise description of what should be in a compliant laboratory calibration program. Paragraph, 160(b)(4), in the 1978 Drug GMPs42 provides an excellent summary. The program must be defined (in a procedure) and it should include: • Specific calibration procedures for instrument types, or, at the extreme, individual instruments. These procedures address the elements listed below considering the intended use of the instrument. • Appropriate, data-based intervals. These are the basis for • A schedule for the calibrations • Appropriate limits of accuracy (calibration tolerance) across the range of use • Appropriate limits of precision • Defined actions in the event an as-found calibration result exceeds the limits for accuracy or precision. These remedial actions should evaluate the impact of the out-of-tolerance finding on instrument and product. Beyond these general requirements for a compliant laboratory calibration procedure derived from the drug regulation, ISO 1702543 is a good source for detail within the program. Another factor in the traceability of test results is reference standards or reference materials. Calibration

standards are a key part of the calibration program and the control of calibration standards should be defined within the calibration procedure. Reference standards are required by most test methods. Most test methods use a comparison of the instrumental response of the sample to the response of the standard. Good science requires that the comparison standard be the best available and that it be traceable. Reference standards are usually obtained from recognized, credible organizations, such as the United States Pharmacopeia. Laboratory Controls include procedures for ordering, receiving, dispensing, and use of reference standards. Secondary standards are a category of standards in the spotlight of the FDA. All of the FDA guidances for inspection of laboratories referenced above identify secondary standards as an area of concern. Often, because of cost, a laboratory chooses to use secondary standards. Laboratory Controls must include a process for the thorough comparison and certification of internal secondary standards against recognized reference standards, providing appropriate traceability. CONCLUSION Laboratory Controls, or Good Practices in the Testing Laboratory are not limited to the FDA regulated industries. The concepts apply to all testing laboratories. Every laboratory should adopt a standard that it believes incorporates controls appropriate for its operation. The most referenced FDA regulation covering laboratories is old and limited because of its focus on the pharmaceutical industry. It is appropriate for a laboratory in the regulated industry to look beyond the industry specific regulations and structure its Laboratory Control using a contemporary, laboratory-focused Quality System. ISO 17025 is referenced in this discussion as a model. There are other laboratory-focused Quality Systems. Most of the requirements imposed by an FDA regulation will be covered in the general standard. Where a specific regulatory requirement is not covered, the model standard can be augmented. Standards, such as ISO 17025 were established as a standard for voluntary certification by a recognized body. It is not necessary to go through the certification process, and the FDA has not given any indication that certification of the laboratory will be required. A firm can easily use the standard as the framework for its Laboratory Control System and for critical self-assessJanuary 2008 Volume 12 Number 2

57

GLP ment. The message from the FDA that firms should be integrating their compliance efforts with a Quality System is very clear. This is especially true for testing laboratories because most of the industry-specific regulations do not include laboratory operations. REFERENCES 1. 21 CFR 58; Good Laboratory Practice for Nonclinical Laboratory Studies., published in 42 FR 60013, Dec 22, 1978 2. Author's definition 3. 21 CFR 211; Current Good Manufacturing Practices for Finished Pharmaceuticals, published in 43 FR 45077, September 29, 1978. 4. 21 CCFR 211 Subpart I - Laboratory Controls 5. cGMP in the Laboratory, Lanese, J.G.; Journal of cGMP Compliance; Vol.1, No 4, July 1997, p 14-24 6. Guide to the Inspections of Pharmaceutical Quality Control Laboratories; FDA; Office of Regulatory Affairs 7. Guide to the Inspections of Microbiological Pharmaceutical Quality Control Laboratories; FDA; Office of Regulatory Affairs 8. Compliance Program Guidance Manual Program 7356.002; Drug Manufacturing Inspections; FDA CDER, Feb. 2, 2002 9. Compliance program Guidance Manual,, 7345.848; Inspection of Biological Products, FDA CBER, December 2004 10. 21 CFR 211.160(a) 11. There are many references to the FDA emphasis on science. One is a speech, Pharmaceutical GMPs in the 21st Century: FDA's New Initiative on Drug Quality, presented by Janet Woodcock, March 3, 2003. 12. United States Pharmacopeia-National Formulary; published by the United States Pharmacopeial Convention 13. Guidance for Industry; Quality Systems Approach to Pharmaceutical CGMP Regulations, FDA, September, 2006 14. ISO 9001 2005; Quality Management Systems - Requirements; International Organization for Standardization 15. Quality System Regulation (QSR); 21 CDE 820; Medical Devices; Current Good Manufacturing Practice 16. This was ISO 9001 that was issued in 1987. The standard was revised in 2001 and again in 2005 17. Preamble to Quality System Regulation; Federal Register; October, 7, 1996 18. ISO 17025; General; requirements for the competence of testing laboratories; International Organization for Standardization, 1999

58

Journal of GXP Compliance

19. 21CFR211.160(a) 20. ICH Q10; Pharmaceutical Quality System; International Conference on Harmonization, Draft Consensus Guideline; May 2007 21. For this discussion, an old regulation is defined as one that was implemented or had the most had revision prior to 1995. 22. ISO17025 4.4 23. ISO 17025 4.6.1 24. ISO 17025, 4.6.2 25. United States District Court for the District of New Jersey; United States of America, Plaintiff, v. Barr laboratories, Inc., et al., Defendants: Opinion 26. Guidance for Industry Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production, FDA, Oct., 2006 27. Training and the Laboratory; J of GXP Compliance, Oct., 2004, Vol. 9, No. 1, pp 6-23 28. ISO 17025 5.2.4 29. ISO 17025 5.2.1 30. 21 CFR 211.165(e) 31. Proposed 21 CFR 211.222, Test Methods, 61 FR 20103, May 3, 1996 32. Validation of Compendial Procedures; United States Pharmacopeia 33. Validation of Alternative Microbiological Methods; United States Pharmacopeia 34. ICH Q2(R1); Validation of Analytical Procedures: Text and Methodology; International Conference on Harmonization; 2005 35. A simple example of differences of terminology is whether the organization evaluates limit of detection or detection limit. One example of practice is how the organization establishes the detection limit. 36. 21 CFR 211.194(a)(2) 37. Verification of Compendial Procedures; United States Pharmacopeia 38. ISO 17025; 5.4.6.2 39. 21 CFR 211.160(b) 40. ICH Q8; Pharmaceutical Development; International Conference on Harmonization; 2006 41. ICH Q10, Pharmaceutical Quality System; 1.6 42. 21 CFR 211.160(b)(4) 43. ISO 17025 5.6.2.1 GXP

Jerry Lanese

ARTICLE ACRONYM LIST ALC

Acceptable Laboratory Controls

CAPA

Corrective and Preventive Action

CFR

Code of Federal Regulations

CGMP

Current Good Manufacturing Practice

CLC

Current Laboratory Controls

FDA

Food and Drug Administration

GLC

Good Laboratory Controls

GLP

Good Laboratory Practice

HPLC

High Performance Liquid Chromatography

ICH

International Conference on Harmonization

ISO

International Organization for Standardization

PAT

Process Analytical Technology

QS

Quality System

QSR

Quality System Regulation

SOP

Standard Operating Procedure

USP

United States Pharmacopeia

ABOUT THE AUTHOR John (Jerry) Lanese, Ph.D., is the President of The Lanese Group, Inc., an independent consulting firm, and a member of the Editorial Advisory Board of the Journal of GXP Compliance. Dr. Lanese has more than 35 years of experience in teaching and pharmaceutical quality function management. In recent years, he has conducted assessments of a number of pharmaceutical laboratory operations, individually and with teams, and has presented seminars on process validation, test method validation, computer system validation, and cGMP in the Laboratory. Jerry was named the Best Seminar Presenter for the year 2001 by the Institute of Validation Technology. In 2005, his article “Training and the Laboratories” was selected as best article of year for the Journal of GXP Compliance. Recently, in 2007, Jerry received the Kenneth G Chapman Industry Recognition Award for his contributions to the Pharmaceutical Industry. Jerry can be reached by phone at 913-491-9234 or on the web at www.lanesegroup.com.

January 2008 Volume 12 Number 2

59