Surviving a regulatory audit

Swapna Narayanan

Indian pharmaceutical industry is going through a rough patch today, predominantly, in the regulatory compliance domain. One of the common failures cited by the regulatory authorities in their warning letters is lack of adequate documentation. They basically repeat the message that pharma manufacturers have failed to create and maintain written procedures for:

• Production specifications
• Quality control operations
• Master manufacturing records
• Returned goods and equipment etc.

This has resulted in:

• Financial risk such as huge penalties
• Legal risk such as criminal proceedings against members of top management
• Reputation risk such as public-relations disasters, and
• Risk of business disruptions including closures, loss of productivity, and/or loss of contracts and clients.

Why is it happening?

There are very many reasons for this. Some of the key issues related to ineffective documentation are listed on (Table 1).

Table 1: reasons for ineffective documentation
Ineffective documentation	Although most companies blame employees when errors are made repeatedly, the root cause is usually inadequate quality policies and procedures that are poorly written, hard to find, incorrect, or out-of-date.
Interpretation issues	Because of inconsistencies in quality policies and procedures, there are confusing business communications that fail to convey important messages or bury key points. They also lead to mistakes made because employees misunderstood the documentation.
Lack of easy access	Most of the times employees find it easier to pick up the phone and ask for help than to search through existing documentation to find the information on their own. Though there are lots of documentation available, but is not getting used primarily because of lack of easy access to written documentation and support information.
No time to search for information	Whenever employees are reviewing, updating, or documenting compliance information they fail to find an accessible, reliable source of information that tells them: what they need to do, how they need to do it, and when the work needs to be completed
Lack of clarity on the process	There are scenarios where a simple process gets slowed down and takes weeks to complete. Invariably because: an employee does not know how to fill out a form, where to submit it, and when to expect a response a manager is not aware of how the approval process works or where they fit in the chain of command for authorisation, or an assistant is not sure how to enter information into a database and generate and route necessary reports.
Not addressing the diverse needs of the users	When it comes to information – one size does not fit all. Employees need different information based on their roles – the information needed by security personnel, the executive management, or an audit team is not the same. When information for different audiences is placed into a single document without considering their needs or how the information will be used – it creates confusion, inefficiencies, frustration, and, usually, mistakes.

What are the regulatory agencies looking for?

The regulatory authorities have clearly defined GMP guidelines that the manufacturer must adhere to while developing their products. Basically they want to see clear written documentation with respect to:

• Quality management – control, assurance etc.
• Personnel management
• Production facilities and equipment
• Documentation and records
• Production and in-process controls
• Packaging and identification labelling
• Storage and distribution
• Laboratory controls and validation
• Complaints and recalls etc.

What do the regulatory agencies see today?

Common refrain heard from a regulatory agency is – ‘All organisations promise to provide written procedures and then fail to produce them.’ This is what leads to warning letters and eventually to seizures and injunctions.

How do we cross the divide?

The pharma industry faces the task of meeting all regulatory compliance requirements and compliance standards. Given the fact that ensuring quality assurance is an intensive exercise – from discovery to clinical trials to patient delivery of safe and effective products, one must stay on top of the regulatory requirements.

To do so, companies must develop a comprehensive Compliance Management System that is agile and adaptable – considering the ever changing regulatory environments. Developing and maintaining documents is a key component of this system. The system must encompass clear documentation across the core aspects of quality by design, quality product development, quality risk assessment and management, audits and approvals and structured root cause analysis, corrective/preventive action etc.

What does a regulatory agency expect in a Compliance Management System (CMS)?

All regulatory agencies specify that pharma manufacturer must maintain good documentation and records as per the GMP guideline. For them–if it is not written, it did not happen. They expect documents that are:

• Developed, prepared, reviewed accurately
• Approved, signed, and dated by authorised stakeholders
• Unambiguous in nature – with clear title, purpose etc.
• Distributed efficiently
• Stored in an easy to retrieve manner
• Regularly reviewed and kept up-to-date
• Effectively version controlled with a clear traceability etc.

How do we set up an effective CMS?

Companies that want to reduce corporate exposure and improve employee productivity need to ensure that their documents are clear, accurate, and accessible. The list below describes seven requirements for effective documents that meet the needs of a compliance initiative:

• Accurate – Content needs to be verifiably correct and match up with how employees actually perform their work.
• Accessible – Users and auditors- need to be able to access the document they need quickly and then easily locate the information they need.
• Comprehensive – Documents must include the required content at the right level of detail for the employees who rely on it, and satisfy the regulators who examine it.
• Clear and user-focused – Employees must understand what they need to do without having to ask supervisors, call for help, or take their best guess on proceeding. And regulators need to clearly understand how document content matches up with what employees actually do.
• Agile and adaptable – If it’s not easy to revise and update in response to changing regulations or changing practices, documentation will quickly become obsolete– in other words, useless and non-compliant.
• Technology-compatible – Increasingly, users access their documentation online. Knowledge management systems offer the promise of centralised control, as well as quick and easy re-purposing of content. This means that companies need to organise and structure content in ways that are compatible with how knowledge management systems work.
• Standardised and scalable – In some organisations, there are still teams of technical writers who create documentation, but there is a clear trend towards giving responsibility for authoring to employees who are not professional technical communicators. Even when there’s a writing team, their content is likely to come to them from engineers, research professionals or other subject matter experts whose expertise doesn’t include writing.

How can information mapping help?

Information mapping is a method that has become the standard for creating policies, procedures and documentation that help companies across all industries achieve and maintain compliance. Its principles provide writers with a common set of guidelines for breaking information into manageable chunks, organising those chunks into topics, and using labels to make information accessible and usable. This standard approach to maintain documents in a compliance management system lends consistency to company documents and meets the requirements for effective documentation, accessibility, ease of use and modular design.

What should companies do?

Companies should adopt a three pronged approach to address the issue of ineffective documentation.

1. Audit current processes: As a first step, companies must take stock of the situation. They must do a comprehensive audit of their existing quality policies and procedure documents. The audit parameters should be from the perspective of users:

For employees:

• Are my documents educating my employees – both in the overall processes as well as in the specific procedures that tell them how to do their jobs?
• Is the documentation capturing the cumulative learning of the workforce and spreading it across all workers?
• Is it ensuring consistency in activities and contributing towards a quality end-product?
• Are they able to find, understand, and execute evolving policies and procedures so the company is not put at risk?

For auditors

• Is the documentation recording the company’s activities accurately?
• Is it providing an audit trail not only for staff and customers, but also for auditors?
• Is it reliable with clear and concise evidence that the company is operating in compliance with their requirements?

2. Compare against a global standard: Information mapping is a global content standard. Our research and implementations across various companies has found that information is easiest to find and understand when it is categorised into types and separated based on the purpose for the information for the reader.

We use six distinct information types that account for as much as 90 per cent of the content in most business documentation. They are:

• Procedure – how to do something
• Process – how something works or what happens
• Principle – policies, guidelines, rules
• Fact – specifications, data
• Concept – ideas, or terms that need to be defined
• Structure – a physical representation of parts, boundaries, relationships

3. Transform your content: Once identified, adopt the following approach and transform your content as per the information mapping standard:

• Identify the targeted audiences; create documentation at the ‘right’ level detail for each audience.
• Ensure information is categorised by type and purpose.
• Break information into manageable units/topics and label each unit/topic.
• Check for consistency.
• Determine if information is accessible.
• Identify reusable information modules.

In a nut shell –

For compliance strategies to be effective, employees and auditors must be able to effectively use your documentation. Documentation is an essential part of meeting expectations of regulatory agencies. If companies stringently adhere to the basic premise of quality – “Document what you do. Do what you have documented”, and supplement it with an effective documentation standard – they can regain their credibility with the regulatory agencies as well as the marketplace – both Indian and global.