Common Validation Deficiencies in Regulatory Inspections

Validation is an important part of pharmaceutical manufacturing, as it confirms the processes, equipment and systems used to manufacture products are working properly. Although there are many well-established guidelines for validation, regulatory inspections of many organizations show there is still a lot of recurring validation-related issues.

There are many ways these gaps could result in observations and/or hold up approval of products, but the way to prevent these issues is to first understand the common validation deficiencies. In order to meet the expectations of regulatory agencies, pharmaceutical manufacturers must maintain validated systems in accordance with Good Manufacturing Practices (GMP) and supported by accurate documentation and risk-based approach.

Why Validation Deficiencies Occur

Validation deficiencies only occur to a limited extent due to an absence of procedures at the companies. More frequently, they are a cause of poor implementation/oversight or gaps in the company's understanding of the regulatory requirements.

Frequently validation is viewed by many, particularly those responsible for managing validation processes, as only needing to be performed on a one-time basis rather than viewed as an ongoing lifecycle process. Systems are validated when they are first set up but due to changes to systems over time these validations are no longer valid. Therefore, the validated state of systems is diminished over time.

Additional contributing factors to validation deficiencies include inadequate training, poor documentation practices and lack of coordination between people in different departments including quality assurance, engineering and production.

Incomplete or Inadequate Validation Documentation

Poor documentation is a common area of concern identified during inspections as one of the biggest deficiencies. Even if validation activities were performed correctly, incomplete or poorly maintained records will cause great concern.
The following are examples of some common documentation issues found:

• Missing Validation Protocols/Reports
• Lack of Definition for Acceptable Criteria
• Incomplete Test Results
• Missing Signatures or No Approval Signature for the Final Validation Report

Critical elements of the documentation include demonstrating successful planning, execution and review of all validation-related activities. Regulators depend on documented evidence; therefore, if any gaps in documentation exist, it can undermine credibility of the entire validation process.

Poorly Defined User Requirements

The fundamental aspect of any validation process is based on User Requirements Specification (URS). When requirements are poorly defined, vague or unknown, the entire validation process becomes weak.
Many of the issues seen at inspections are:

• Requirements that cannot be tested (are not measurable).
• Missing critical functional requirements (the things that must be operable).
• No evidence of how the requirements relate to the testing process.

It can be difficult to prove that the system meets its intended use (therefore there is no justification to buy it) if the requirements are not defined clearly. This is especially important for computerized systems that were validated under frameworks such as GAMP 5.

Inadequate Risk Assessment

Risk based is the expectation of validation practices today; but majority of companies are not doing a risk assessment or doing one very poorly. Identified issues to risk assessment include:

• Failing to identify any critical process parameters
• Failing to justify any of the low-risk classification
• No linkage to the risk assessment with the testing scope

Regulators expect a risk assessment to be used in guiding validation, as stated in ICH Q9 Quality Risk Management. If no risk assessment is completed, validation will be either insufficient or too extensive.

Deficiencies in IQ, OQ and PQ Execution

Installation Qualification (IQ), Operational Qualification (OQ) and Performance Qualification (PQ) are the key components of any validation process. Inspectors commonly find there are deficiencies in the way that these components have been completed.
Deficiencies can include:

• Not verifying all components during the IQ phase Installation Qualification
• Missing Critical Functional Tests during OQ
• PQ does not accurately represent normal operating conditions

There are also instances where testing was completed but did not sufficiently challenge the system which may lead to lack of confidence in validation results and require a revalidation.

Missing Controls for Data Integrity

Regulatory inspections have emphasized data integrity as one of their key areas of inspection. Large amounts of data are produced from validation activities; hence, weaknesses in the handling of any data can create major data integrity issues.
Some common data legacy deficiencies include:

• A complete or incomplete audit trail(s) is missing
• Data has changed without authority
• Lack of compliance with 21 C.F.R. Part 11
• An inadequate control of electronic records

Data must be able to be identified throughout its life as complete, accurate and to have been tracked. To verify this at any point or at any time, can create an entire failure of the validation activity.

Inadequate Change Control

Validation does not stop when you originally receive approval. The impact of any changes to a business process must be assessed against the existing levels of validation. Many organizations do not adequately connect change control and validation. Common areas of confusion arise from instances where the following occur:

• Changes that were made without assessing their impact
• Changes that were significant, but after which revalidation did not occur
• Changes that were made without adequate documentation reflecting the change and how it relates to the validation of the system

These problems can result in the systems being operated outside of a validated state with no justifiable reason for doing so.

Insufficient Training of Personnel

People are also a factor in the successful validation of protocols and systems. A common failure seen during inspections is a lack of sufficient training for personnel.
Some common problems include:

• Personnel do not know the validation process
• Validation tests are not performed properly
• Personnel do not fully know the documentation requirements

During an inspection, the reviewer may also review the training records of the employee(s) who perform the validation process to determine the existence of systemic organizational failure(s) within the organization.

Poor Handling of Deviations

In validation the occurrence of deviations is not unusual; however, the way that deviations are managed makes a big difference in how they are treated by the inspectors. Most of the time inspectors will examine deviations and many of those are either ignored or not adequately investigated.
Commonly found deficiencies in the management of deviations are:
A. Failure to conduct an appropriate root cause investigation
B. Inadequate implementation of corrective and preventive actions (CAPAs)
C. Closing deviations without proper justification.
In doing so, unresolved deviations may result in the entire body of evidence on which the validation study is relying to be questioned.

Lack of Periodic Review

Validation is an ongoing activity during a product's lifecycle for many companies; however, most companies do not conduct periodic reviews of their validated systems.
As a result, they will find all of the following:
1. Validation status is out of date
2. Changes to the system have not been evaluated
3. Decreased trust in the performance of the system
Periodic review of a system provides an assurance that your validated limits will continue to be met by that system's operation over time.

Weak Traceability

The lack of proper traceability matrices in your organization is a major concern. Traceability is required for demonstrating that all required efforts have been evaluated and thus met. Proper Traceability is needed to establish either the existing links between your:
1) User Requirement Specification (URS) and testing
2) Validation Coverage
3) Validation Documentation is missing or very limited because of Organizations inability to properly maintain proper methods of documenting these items are being lost.

Traceability is a critical part of validation; traceability provides direction during validation activities and will be evaluated during any agency's inspections.

How to Avoid Validation Deficiencies

Validation deficiencies can be avoided through a proactive and structured approach.
The key steps to take to prevent validation deficiencies are as follows:
1. Development of Clear and Testable User Requirements
2. Risk-based validation approach
3. Complete and Accurate Documentation
4. Linking Change Control to Validation Activities
5. Strong Data Integrity Controls
6. Regular Training of Personnel
7. Conducting Internal Audits and Periodic Reviews
Organizations that have a higher degree of focus in these areas will significantly decrease the chance of having a regulatory observation.

Role of Quality Assurance

QA is essential for preventing validation deficiencies. QA makes sure that the validation process is appropriately developed, executed and documented according to Good Manufacturing Practices.
QA performs several functions in support of its role in preventing validation deficiencies including:

• Reviewing validation reports and protocols
• Ensuring that written documentation is correct
• Ensuring that documentation of change controls and deviations is thorough
• Ensuring compliance during audits.

A significant function of QA will protect against compliance gaps.

Regulatory Expectations

Regulators require that companies remain in a validated state at all times through:

• Complete documentation of all validation processes
• A complete and systematic risk-based methodology
• Maintaining data integrity
• Continuous monitoring and evaluation of processes

If a company fails to meet their regulatory expectations, the company may receive a warning letter, an import alert or have products recalled.

Validation deficiencies represent a significant and frequently observed issue during regulatory inspections. Most of the deficiencies observed during inspections are not caused by the absence of procedures, but rather due to inadequate documented evidence, poor performance and insufficient supervision.

Pharmaceutical companies can establish a more effective validation system by identifying the common types of deficiencies and proactively resolving them.

In a highly regulated environment, maintaining a strong validation process is critical not just to meet inspection standards, but; equally important, this will help to ensure the quality of product and provide the highest level of safety for patients.

Frequently Asked Questions on Common Validation Deficiencies

Q1. What are validation deficiencies?

Answer: Validation deficiencies can be defined as failures or gaps in the validation process that were found when inspections were performed.

Q2. Why do validation deficiencies occur?

Answer: Validation deficiencies occur due to poor documentation, inadequate implementation, lack of oversight and other factors.

Q3. What is the role of URS in validation?

Answer: URS is a document that states the requirements of a system and provides the basis for validation of the system.

Q4. What is IQ, OQ, PQ?

Answer: IQ, OQ and PQ are the three stages of qualification which are to ensure a system’s installation, performance and operation respectively.

Q5. Why is data integrity important?

Answer: Data integrity is important because it provides validated data as being correct, reliable and trustworthy.

Q6. What is 21 CFR Part 11?

Answer: 21 CFR Part 11 describes and regulates the use of electronic records.

Q7. How can deficiencies be avoided?

Answer: Validation deficiencies can be prevented by following good planning practices, proper documentation processes and using a risk based approach during validation.

Q8. What happens if deficiencies are found?

Answer: If validation deficiencies are detected by an inspector it could lead to enforcement actions (i.e. fines or suspension of your ability to operate) and possible non compliance issues with regulatory bodies.

Get ready to use editable Validation Protocols in MS-Word FormatView List

Share

Tweet

Share

Pin it

Share