How Should I Respond To This FDA Warning Letter? (And Other Compliance Questions Answered)

Success in developing a drug product, medical device, or drug substance requires navigating the tradeoffs and decisions of today's complex global regulatory realm. Some of the most common questions about compliance concern dealing with the FDA 483 list of inspection observations, warning letters, and consent decrees following FDA regulatory action. Bioprocess Online posed some important questions about warning letter responses and remediation — and other important regulatory issues — to Richard Aleman, VP of regulatory compliance at Pharmatech Associates. Aleman has an insider’s view on these issues, having spent 28 years at the FDA in both the field and headquarters organizations, specializing in biopharmaceuticals, drugs, and medical devices.

What is the best way to respond to an FDA warning letter or other regulatory action?

Richard Aleman, Pharmatech Associates: We have learned that the major mistake most companies make, especially foreign companies, is in rushing to submit a response to meet the specified time frame in the regulatory correspondence. Regardless of the regulatory agency involved, too much haste can lead to a submission that does not address the questions asked by the regulatory agency and prevents a company from moving forward to identify and establish a sustainable remediation plan.

It is important for companies to carefully read and understand what the regulatory agency is asking. This advice cannot be overstated. The initial response submitted by a company to a regulatory action is important because it sets up the trust element needed for future dealings with that regulatory authority. If the response is well thought out, thorough, and complete, the regulatory authority will view the company to be trustworthy, reliable, and competent.

Unfortunately, many companies simply want to answer the objectionable observations listed in the regulatory correspondence on face value. For any number of reasons, companies may fail to do things right the first time. When a regulatory situation arises, some companies focus on getting out of the regulatory action as quickly as possible to continue the flow of revenue. Yet, companies should be able to answer any objectionable observations from a systems point of view instead of just one compliance observation. Generally, the time frames cited in regulatory correspondence can be described as guidance and, in most cases, regulatory agencies accommodate reasonable extension of time requests. Submitting an incomplete and inadequate response ultimately will result in creating a negative impression by the regulatory agency involved, impacting a company’s financial situation, creating unnecessary expenses, potentially creating drug shortages, and prolonging the remediation process for the regulatory action in place.

What steps can be taken to remediate warning letters?

Aleman: A review of the FDA Warning Letter website over the past four years reveals a number of examples in which firms’ responses were deemed inadequate and did not fully provide information that showed that the firms’ quality systems’ data accuracy and integrity supported the safety, effectiveness, and quality of the drugs manufactured.

The problem is that many firms consistently fail to provide complete and detailed responses to objectionable observations (FDA 483) or warning letter observations. When a response fails to include an investigation of the inaccuracies in data records and reporting with a summary of all laboratories, manufacturing operations, and systems to be covered by the assessment, it will draw the attention of the specific center compliance office (Center for New Drug Evaluation and Research) involved. An incomplete response will be interpreted by the center as the firm’s lack of comprehension and understanding of what constitutes complying with CGMPs. It can signal a lack of sufficient or qualified personnel, or that there is no quality system in place, resulting in additional FDA regulatory scrutiny and actions.

In a recent remediation project, when we reviewed the client’s documentation provided to the FDA, it quickly became apparent that senior management failed to embrace its responsibility for the prior conduct at its facilities and the environment that allowed objectionable practices, including data integrity issues, to flourish undetected. Employees interviewed revealed that management on duty in the laboratory routinely instructed them to replace failing data with passing data and to repeatedly conduct retesting until passing results were obtained in order to release questionable failing batches. Interviews also revealed employees were encouraged to take shortcuts when it came to manufacturing drug products, including not completing the batch record as the manufacturing steps were completed, back-dating batch records, and signing the batch records for other employees.  We quickly detected that there was a directed, systematic practice in place to manipulate data and to release batches quicker, “make the numbers look better,” and possibly pass out-of-specification (OOS) batches. Employees involved in these activities were still employed by the firm, some in similar positions.  Although our review found no employees to have been terminated as a result of the FDA 483 findings, some had voluntarily left the company.  The FDA had mentioned the presence of these employees in correspondence between the agency and the client firm.

In this case we observed that there was a basic misconception on the part of management that product not manufactured under CGMP could be rehabilitated with additional testing, or it could be tested into compliance.  This situation is indicative of a fundamental lack of understanding regarding compliance with CGMPs. The failure of the firm to fully address and acknowledge its CGMP deficiencies to the FDA probably led to the issuance of the Warning Letter.

To remediate, management must first accept responsibility for what happened and ensure that corrective action is immediately initiated, including removing personnel found to be or suspected of tampering with data results. Management must be fully committed to quality and CGMP compliance and must take the time to understand and submit responses to FDA 483s from a systems point of view. Best results come when management can embrace the need to implement and sustain a companywide quality system.

In keeping with FDA 483 findings, management must show the FDA a complete corrective and preventive action plan. This includes a review of all work completed to date with third-party validation, and, where deemed appropriate, work previously completed should be re-done. Compliance must be companywide, strengthened and sustained by a companywide quality system at all company sites.

What about process validation compliance – what is involved for each stage? Specifically, what degree of work is required to ensure the FDA will accept the work conducted by the client’s internal quality group?

Aleman: The FDA’s Process Validation Guidance (PVG) was issued in early 2011 and has been in effect for the past six years. Yet, it is surprising how many companies are either unaware of this guidance, choose to ignore it, or simply misinterpret the guidance. The PVG identifies process validation as the process design, process qualification, and continued process verification throughout a product’s life cycle. The guidance works to establish scientific evidence that a process is capable of consistently delivering quality product determined by the collection and evaluation of data throughout the stages of a product’s life cycle, from the process design stage through commercial production. The life cycle approach to process validation means including scientifically sound design practices, qualification and evaluation of the process design, and continuous process verification. When an FDA inspection results in the issuance of a 483, List of Observations, or a Warning Letter, implement the principles of the 2011 guidance contained in the following stages:

• In Stage 1, process design, the commercial process is defined based on knowledge gained through development and scale-up activities.
• In Stage 2, process qualification, the process design is evaluated and assessed to determine if the process is capable of reproducible commercial manufacturing.
• In Stage 3, continued process verification, ongoing assurance is gained during routine production that the process remains in a state of control.

Typically, observed mistakes include a firm’s failure to understand the specific information contained in each of the three stages for process design, process qualifications, and continued process verification.

Some companies completely misinterpret the process design stage of the 2011 PVG. For example, they focus exclusively on qualification efforts without fully understanding the manufacturing process and associated variations that may not lead to adequate assurance of quality. The 2011 PVG is based on knowledge gained through development and scale-up activities, and an approach to process validation should be tailored to and based upon up front learning and knowledge about the product and process rather than simply getting to the goal of batch acceptance. 

With respect to stage 2 process qualifications, some companies continue to hold on to the perceived misconception that process validation has a three-batch acceptance requirement. Before the 2011 guidance, it was widely accepted throughout industry, implied or perhaps even stated in some FDA guidance documents, that process validation was a static three-batch demonstration requirement. Since the introduction of the 2011 guidance, the emphasis is on design, life cycle, and control of variability, thus effectively rejecting the three-batch requirement. Also, sampling methodology is a key factor in carrying out process validation insofar as it concerns monitoring and evaluating variability, especially in process qualification (Stage 2). Finally, facilities and equipment suitability is an obvious prerequisite of process qualification. 

In Stage 3, continued process verification, some companies struggle due in part to the perception that the requirement for process monitoring is a new concept. In one instance, a client failed to recognize that the 2011 guidance states that process validation is an ongoing program rather than a discrete and isolated activity, or a single event. Companies must continue to evaluate production data such as stability, process parameters, or in-process controls. In doing so, a company can determine that the process is in a state of control or determine the need for process improvements.