Article | June 6, 2014

A Comparison Of Process Validation Standards

Effective Retail Ready Packaging

By Jeff Boatman, senior subject matter expert, medical devices and quality systems, QPharma Inc.

This article was originally published in Pharmaceutical Engineering magazine and is being reprinted with permission from ISPE.

U.S. life science firms are currently subject to two different process validation standards: the Global Harmonization Task Force’s Process Validation Guidance and FDA’s Process Validation: General Principles and Practices. These standards have considerable overlap, both officially and practically, across the drug and medical device industries. Previously, all FDA divisions followed a single guidance document, but that document has long since been superseded by new regulations and advances in validation science. This article examines the differences and similarities between the two guidance documents and concludes that any firm manufacturing product whose predicate regulations require process validation (drugs, devices, Active Pharmaceutical Ingredients, biologics, or human-based tissues) should incorporate the philosophies and directives of both to meet Agency expectations and to assure the highest quality of their products.

This article does not examine requirements of the national compendia (e.g. the United States Pharmacopeia), whose validation requirements are much less prescriptive that FDA guidance documents; and did not include standards from industry groups such as ASTM. Note that while this article is specific to the regulatory requirements of the U.S. Food and Drug Administration, the GHTF standard examined applies to Europe as well, and the new FDA guidance discussed in this article is under consideration by the European Medicines Agency as the possible basis for an E.U. equivalent1, currently in committee draft2.

Introduction
Process Validation: General Principles and Practices was finalized by the U.S. Food and Drug Administration’s centers for Drug Evaluation and Research (CDER), Biologics Evaluation and Research (CBER), and Veterinary Medicine (CVM) in January 2011, nearly two years later than originally predicted by its authors.

Notably missing from the new guidance’s authorship list is the Center for Devices and Radiological Health (CDRH), one of the main contributors to Guideline on General Principles of Process Validation, the 1987 document which was obsoleted by the 2011 guidance.  At first glance, this seems an odd omission, as CDRH was an approver of the 1987 standard and has been instrumental in establishing the state of the art in Life Science validation practices in the years since.

Background
21 CFR 820.75 states where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance.  This “fully verified” criterion is highly subjective on the part of an inspector; while some firms argue that because they 100% inspect product they therefore fully verify the output of their manufacturing process, an FDA inspector need not actually agree with that assertion.  Although inspections and tests may be mitigations used to reduce the overall amount of formal validation required, CDRH generally demands validation of the overall manufacturing process. A review of the 1996 Preamble to the Quality System Regulation offers some insight:

One of the principles on which the quality systems [sic] regulation is based is that all processes require some degree of qualification, verification, or validation, and manufacturers should not rely solely on inspection and testing to ensure processes are adequate for their intended uses.

Since that time, the medical device industry has been subject to stringent, science- and statistics-based validation expectations.  For example, the concept of ongoing process validation—i.e., that Performance Qualification (PQ) is not the end of validation but merely the event that marks the start of commercial production—is a new concept in the 2011 guidance, but a longstanding expectation of medical device firms under the process trending requirements of 21 CFR 820.70 and 820.100.  The new FDA document also relies heavily upon statistical analysis, control, and prediction, while statistical expectations are already built into the Quality System Regulation; and Statistical Process Control (SPC) and process capability tracking and trending (Cp/CpK) are the norm at medical device manufacturers.

It might therefore seem mysterious that CDRH would not be a signatory to this seminal validation guidance.  Prior to the finalization of the new guidance, the author discussed this with contacts within both CDRH and the Center for Drug Evaluation and Research (CDER), who confirmed that by mutual agreement, CDRH would instead utilize the Global Harmonization Task Force (GHTF) process validation standard, SG3/N99-10:2004, Quality Management Systems – Process Validation Guidance.3  A clue to this internal discussion was present in the footnotes of FDA’s Inspection of Medical Device Firms, which cited SG3/N99-10, and the January 2011 process validation guidance made it official by explicitly stating that device firms were to follow SG3/N99-10. That standard was updated in 2004 to reflect the new validation requirements of ISO13485:2003, Medical devices – Quality management systems, which was itself updated to harmonize with the more general ISO9001:2000 standard.  FDA provided input into the 2003 ISO 13485 standard, so it is fitting that CDRH utilizes SG3/N99-10.

This article will examine the SG3/N99-10:2004 standard to evaluate how it compares to U.S. medical device regulatory requirements, current best practices, and especially the new Process Validation: General Principles and Practices. This latter exercise may be of particular interest to Combination Product manufacturers and firms that produce or market both drugs and devices, and therefore may be subject to both CDRH and CDER and need to comply with the GHTF standard as well as the 2011 FDA guidance.

This analysis is not intended to be a tutorial on process validation, or to analyze any validation document in detail.  Except to highlight other FDA rules that further explain a requirement, comments are limited to only those instances where the GHTF validation standard appears to conflict with or provides different expectations than FDA’s process validation guidance and current industry best practices.

Operational Qualification (OQ)
A longstanding definition of OQ is “documented verification that all aspects of…equipment that can affect product quality operate as intended throughout all anticipated ranges.”4 Although OQ is not referenced by name in FDA’s process validation guidance, the new guidance incorporates that meaning, along with a somewhat controversial requirement that such verifications run at operating ranges for as long as would be necessary during routine production.5

By comparison, the GHTF standard defines OQ as “establishing by objective evidence process control limits and action levels which result in product that meets all predetermined requirements”6 [emphasis added].  This appears to contradict other validation documents; typically, challenge of the overall process to ensure it consistently produces acceptable product is conducted only after qualifications have demonstrated that individual pieces of equipment operate properly throughout their specified ranges7. Indeed, equating validation to the successful manufacture of product meeting its specifications is a throwback to the original definition of validation in the 1978 drug GMPs8; that philosophy was abandoned when FDA published the 1987 process validation guidance. This apparent contradiction suddenly makes sense if one equates “product” to “the output of the process.”

21 CFR 820.3(r) defines product as “components, manufacturing materials, in-process devices, finished devices, and returned devices”; clearly these are the outputs of a rigorously defined process.  The FDA guidance similarly defines product as “…human and animal drug and biological products, including active pharmaceutical ingredients….”9 SG3/N99-10 does not define the term.  Even if we use the conventional dictionary meaning (i.e., product = the result of a process, but not necessarily the final product) this is hard to reconcile with “establishing action limits.”  The GHTF document therefore appears to use the term “OQ” differently, and in different sequence, than common U.S. validation industry usage; but as this paper will explain, this really is not an issue.

FDA process validation guidances, both old and new, expect engineering studies to be performed to determine the critical processing parameters and their operational ranges that produce acceptable final product.  Indeed, the 2011 guidance devotes an entire section to this practice and has specific expectations regarding its documentation.

The GHTF document also describes these activities, but assigns them to the OQ phase instead of an earlier, pre-validation phase10. The GHTF “OQ” is therefore more of an exploratory experiment than a rigorously defined protocol.

Reducing this to the absurd, a Combination Product manufacturer might have to perform process capability studies, execute an Installation Qualification, and then repeat the process capability study again as part of an OQ in order to satisfy all the relevant validation standards.  The author concludes that there is no reason for a firm to change its current practice to match the GHTF standard, provided that operating and alert parameters are in fact being determined and documented, and equipment is being qualified as capable of meeting its process specifications at those limits.  Whichever documentation approach a firm takes, they can be confident that they are following an FDA-endorsed best practice.

Note that the 2011 FDA guidance includes an expectation that such process development activities will be properly documented11, and medical device firms may consider that expectation the next time they are gearing up a production line.  Although that guidance is not signed by CDRH, we will demonstrate later in this article why conformance may still be essential in order for a device manufacturer to meet CDRH and GHTF requirements.

Risk Management
Whether a firm produces drugs or devices, and whether performed during Operational Qualification or as part of pre-validation engineering studies, risk management and statistical tools are now mandatory.  For medical devices, this has been a de facto requirement since CDRH formally adopted ISO 14971, Application of risk management to medical devices. The GHTF standard describes the use of Fault Tree Analysis (FTA) and process Failure Mode Effects Analysis (pFMEA) to determine which aspects of the process pose the greatest risk to product quality12; the new FDA guidance describes Design of Experiment (DoE) studies to identify relationships between control and component inputs and process output characteristics.13  FDA recommends a statistician or person trained in statistical process control develop the methods used in evaluating ongoing production trends14; GHTF recommends the use of sound statistics throughout the validation process15, For medical devices, both of these tie into the general regulatory requirement to maintain procedures for identifying statistical techniques16.

Experienced validation professionals have seen firsthand how all of these tools are essential for an efficient validation.  Without DoE and pFMEA to flag the parameters most critical to product quality and identify those issues most likely to affect the process, validation coverage would have to be exhaustive.  The use of “product tree” risk assessments to cross-check similar processes and materials can reduce the number of finished products whose processes must be validated from hundreds to a handful.  And without proper and documented statistical strategies, confidence in results cannot be assured to a predetermined degree, violating the predicate “high degree of assurance” requirement in 820.75 and inviting an inspector to declare the entire validation effort null and void.

Therefore, the risk assessment and statistical requirements from both documents should be employed, not only to ensure compliance, but because in the long run these practices produce better products, reduce complaints—and inevitably save time and money.

Validation Of Overall Process
As mentioned in the introduction to this article, the idea that an entire manufacturing process can avoid validation because the final finished device is 100% inspected is patently false.  Confusingly, the flowchart included in the GHTF document for determining whether validation is required for a given process leans strongly towards product verification17 (“Is Process Output Verifiable?” > “Is Verification Sufficient?”).

Since SG3/N99-10 has been adopted by CDRH, one might conclude that CDRH is therefore backing away from its longstanding “fully verified” stance.  However, this flowchart must be read in light of the validation examples that follow it18.  Processes listed that may be subject to verification in lieu of validation include manual cutting operations; testing for color; visual inspection of circuit boards; and manufacturing of wiring harnesses.  These are not comprehensive manufacturing processes, but are individual steps or sub-processes within the overall product manufacturing sequence; while verification may suffice for these individual steps, this in no way exempts the overall manufacturing process from validation.  The GHTF document merely reinforces existing requirements in 820.75 and the QSR Preamble: while individual production steps may be exempted from validation based on risk (including the mitigation of verification), the overall manufacturing process must still be validated.

This is fully compatible with ISPE methodologies, in which system boundaries are defined; and within those boundaries, process components that have direct impact on product are subjected to risk assessment and validated on a sub-process level as appropriate19. The 2011 guidance does not explicitly address qualifications at the process-component level, except when the mitigation involves the use of Process Analytical Technology20; but many device firms have adopted a “PQ/PPQ” strategy of performing PQ on individual processes and then an overall “PPQ” to make actual finished product. This strategy, originally suggested by the now-obsolete 1987 guidance, is certainly compliant; but is required by neither FDA nor GHTF and may well be a waste of time and effort under current rules.

Software Implications
Both the GHTF standard and the 2011 FDA process validation guidance document explicitly exempt software validation from its scope, but do mention that software may be an integral part of a manufacturing process21.  In many cases, software that operates a manufacturing line is a standalone process deserving its own requirements, specifications, and validation, and the reader should refer to FDA’s General Principles of Software Validation.

For instance, Building Management Systems, and off-the-shelf programs that store labeling artwork and print and reconcile labels, have internal software processes that function independently of the equipment being monitored and operated; as such, they may warrant their own validation activity.  At the opposite extreme, a simple Programmable Logic Controller (PLC) that was coded specifically to operate a heat sealer is arguably an integral part of that equipment.  The exclusion of software validation from SG3/N99-10 does not itself prevent simple control software from being validated as part of an equipment OQ—but the code should be specified [21 CFR 820.70(g)] and, if not contained in read-only firmware, maintained under change control [21 CFR 820.70(b),(i)].  Note that challenges of ladder logic as part of equipment qualifications, combined with code documentation and change control, also meet CDER requirements for such systems at drug firms22.

Determinations that software is, or is not, integral to equipment design should be described in validation plans or risk assessment documents, and should include or reference the software’s 21 CFR 11 (electronic records) impact as well23.  While no specific regulation requires separate validation efforts as a result of electronic record implications, many companies have a corporate policy regarding Part 11 (and, for firms also operating under ISO13485 or the European Medicines Agency, E.U. Annex 11) and tie their validations of systems that process electronic records or electronic signatures back to that policy based on a separate computer system audit.  Including a system’s electronic records impact as part of an equipment assessment can assist in demonstrating compliance with the company’s policy and highlight systems requiring special attention.

Number Of Runs
The “classic” required number of production runs to support a Performance Qualification is three batches or lots.  For example, the QSR preamble states

While FDA believes that three production runs during process validation (process validation may be initiated before or during design transfer) is the accepted standard, FDA recognizes that all processes may not be defined in terms of lots or batches. The number three is, however, currently considered to be the acceptable standard.

Three is the smallest possible number of runs that can identify a “trend,” but there is scant scientific basis for arbitrarily picking three successful runs as a validation effort’s acceptance criterion.  On this issue, CDRH and CDER are now in complete agreement: the GHTF document states “challenges should be repeated enough times to assure that the results are meaningful and consistent,”24 while the FDA guidance states “the number of samples should be adequate to provide sufficient statistical confidence of quality within a batch and between batches.”25 When questioned during an ISPE teleconference, the CDER representative stated that the number of runs had to be “enough to demonstrate consistency, but at least three.”26

The author has confirmed with FDA27 certain special instances where a PQ could be performed with as little as a single confirming run; but these opportunities are most likely to appear at contract manufacturers whose “new” products are simply variants of products and processes for which extensive production and validation history already exist. The reader should further bear in mind that a “lot” is often defined by the firm in terms of financial impact or practicality, which may bear little relationship to validation.  For example, declaring a “lot” to consist of 30 units because there are 30 rows to record serial numbers on a Device History Record or because the electronic batch record has a limit of 1,000 bottles of drug may result in tidy paperwork, but is a poor predictor of likely process variability.  Validation plans and protocols should avoid dogmatic definitions of “batch,” “lot,” and “run” and rely instead upon risk assessments and, where appropriate, Analyses of Variance.

Historical Data
Basing validation and production sampling on historical parametric data is more efficient than reliance on attribute generalizations. Savvy manufacturing engineers know that by maintaining good records during process design activities, data from those studies can be analyzed to provide very efficient sampling plans and realistic acceptance criteria.  For example, tight historical standard deviations encountered during process capability trials might statistically justify taking only ten samples per run during PQ, while simply relying on a generic sampling plan such as Acceptance Quality Limits (AQL)28 might require fifty samples.  Likewise, establishing an acceptance criterion of “95% confidence that no more than 1 out of 1,000 units produced is defective” is far more meaningful than “inspect 50, pass on one defect, fail on two defects”—but the critical tail calculations required to make such an assertion demand reliable and representative historical parametric data.

Unfortunately, it is common industry practice to use generic AQL tables (or worse, unfounded guesses) as an acceptable, if inefficient, guideline.  While AQL and similar sampling plans will continue for the purpose for which they were originally designed (i.e. sampling of product to test for go/no-go acceptance attributes), the era of using AQLs as a surrogate for sound statistical analyses may be coming to an end. As expressed in both the FDA guidance and the GHTF document, there is a growing expectation at regulatory authorities that manufacturers demonstrate that they have a clear and in-depth understanding of their processes.  One controversial provision of the FDA guidance is a recommendation of “…continued monitoring and/or sampling at the level established during the process qualification stage until sufficient data is available to generate significant variability estimates.”29 The Parenteral Drug Association protested that this is an unwarranted expectation, stating in part “…a limited number of developmental batches would not be sufficient to develop a statistically sound rationale for commercial product distribution.”30 While CDRH has a longstanding expectation for firms to show thorough understanding and control over their processes31, their sibling Center, under such industry pressure, may ultimately relax some of these requirements. Even so, expect to see pharmaceutical firms coming under increased CDER and District Office scrutiny of their statistical controls, with SPC, CpK, and Analyses of Variance among the likely candidates.  The contra-wise argument is that it is acceptable for drug manufacturers to meet a lower validation standard than medical device firms, and with the 2011 guidance, CDER has made it clear that they strenuously disagree.

The above items make sound statistics during process capability, Design of Experiment studies, and good documentation of their results critically important.  GHTF says “validation of a process can be partially based on accumulated historical manufacturing, testing, control, and other data related to a product or process... historical data is not feasible if all the appropriate data was not collected, or appropriate data was not collected in a manner which allows adequate analysis.”32 This means that for any data to be used in a validation exercise, it has to be properly recorded and stored in accordance with documented quality record procedures per 21 CFR 820.180.  This mirrors CDRH constraints on the use of “retrospective” validation data, which in essence preclude the use of such data if not properly recorded or if the data and the system itself have not been maintained under rigorous change control33. As a practical matter, relying solely upon historical data to retrospectively “validate” a process is no longer permitted by either FDA division.

Ongoing Validation
As previously mentioned, ongoing monitoring of process variability and trending is a long-standing CDRH expectation.  Any ‘Six-Sigma Green Belt’ knows that a low CpK means excessive waste, and CDRH inspectors are known to specifically check for CpKs metrics trending below 1.3.  The GHTF document makes it explicit: “trends in the process should be monitored to ensure the process remains within the established parameters. When monitoring data on quality characteristics demonstrates a negative trend, the cause should be investigated, corrective action may be taken and revalidation considered.”34

What is really new is CDER’s application of this strategy to drug firms as well: “…data collected should include relevant process trends…information collected should verify that the critical quality attributes are being controlled throughout the process.”35 While CDRH authority is explicit in 21 CFR 820.70 and 820.75, CDER argues that it has implied authority under the Annual Product Review clause of 21 CFR 211.180(e)36. If that viewpoint ultimately prevails, it will no longer be acceptable for a firm to have one level of production surveillance for medical devices and another, lesser state of control for drugs.  The author has seen device companies tell Agency inspectors that validating a given process to a high degree of confidence is impractical or impossible, only to be informed that their competitor is already doing it.  Forewarned is forearmed: the QSR Preamble states “during inspections, FDA will assess whether a manufacturer has established procedures and followed requirements that are appropriate to a given device under the current state-of-the-art manufacturing for that specific device.”

Finally, some pharmaceutical companies may attempt to revive a decades-old argument that manufacturing inefficiencies, such as scrapping batches or culling out product that fails to meet specifications, is a financial business risk that FDA has no authority over, and therefore they do not need to validate and/or monitor their processes.  Such firms are advised to read another new FDA guidance explaining CDER’s expectations of a drug manufacturer’s quality systems, which concludes that quality must be built into product and processes through Quality by Design, and not established through subsequent inspection and test37. While guidance documents technically “do not establish legally enforceable responsibilities,”38 this represents CDER’s current thinking, and a drug firm will be hard-pressed to explain why their validations and ongoing monitoring should not meet the state of the art already employed by their sister device companies. Quality by Design, the concept that one must establish the expectations for a process in advance and then objectively prove that resulting products and processes meets those requirements (and not simply test product until it passes) is not merely an FDA philosophical expectation; it is United States federal case law39.

Conclusion
The good news is that a firm using risk assessment tools to perform and document process development; validating processes based on risk and sound statistical principles; and performing ongoing process monitoring using tools such as SPC swimlane charts, CpK tracking, and determination of Root and especially Special Cause of variation, is already meeting both the GHTF and FDA documents.

If your firm is not already doing this, GHTF SG3/N99-10 has an extensive appendix with an excellent explanation of these tools and their application. In particular, a company that produces Combination Products or both drugs and devices—especially within the same facility—should consider incorporating aspects of both SG3/N99-10 and Process Validation: General Principles and Practices as described in this article.

About The Author
Jeff Boatman is the senior subject matter expert for medical devices and quality systems at QPharma. A Certified Quality Auditor (CQA) and highly experienced regulatory expert and trainer, Jeff has served with the company for more than 10 years. His previous positions included the role of R&D engineer at Boston Scientific.

Jeff's many organizational affiliations include the position of Senior Member, American Society for Quality Biomedical Division. In 2010, he was named one of PharmaVoice’s "Most Inspiring People."  Formerly enlisted in the U.S. Air Force, Jeff studied nuclear physics at The Air University.

References

  1. http://www.gmp-compliance.org/elements/ProcessValidation_SurveyResults.pdf
  2. http://www.ema.europa.eu/docs/en_GB/document_library/Scientific_guideline/2012/04/WC500125399.pdf
  3. GHTF documents do not currently appear in the CDRH Consensus Standards list, but SG3/N99-10 is already referenced in CDRH inspectional procedures such as FDA Compliance Program 7382.845.
  4. Baseline® Pharmaceutical Engineering Guide, Volume 5, “Commissioning and Qualification,” § 2.4.4: International Society of Pharmaceutical Engineers, March 2001
  5. Process Validation: General Principles and Practices, § IV.C.1: Food and Drug Administration, January 2011
  6. SG3/N99-10:2004 Quality Management Systems – Process Validation Guidance, § 2.2: Global Harmonization Task Force, January 2004
  7. Guideline on General Principles of Process Validation, § VIII.1.b: Food and Drug Administration, 1987
  8. Title 21 CFR, § 211.110(a)
  9. Process Validation: General Principles and Practices, § I
  10. SG3/N99-10:2004, § 5.4
  11. Process Validation: General Principles and Practices, § IV.B.1
  12. SG3/N99-10:2004, Annex A
  13. Process Validation: General Principles and Practices, § IV.B.1
  14. Process Validation: General Principles and Practices, § IV.D
  15. SG3/N99-10:2004, § 5.2
  16. Title 21 CFR, § 820.250
  17. SG3/N99-10:2004, § 3.1
  18. SG3/N99-10:2004, § 3.2
  19. Baseline® Pharmaceutical Engineering Guide, § 3.3
  20. Process Validation: General Principles and Practices, § IV.B.2
  21. Process Validation: General Principles and Practices, § I; SG3/N99-10:2004, § 0
  22. Title 21 CFR, § 211.68
  23. Part 11, Electronic Records; Electronic Signatures – Scope and Application, § C.1: Food and Drug Administration, August 2003
  24. SG3/N99-10:2004, § 5.5
  25. Process Validation: General Principles and Practices, § IV.C.3
  26. Response given by Grace McNally of CDER, co-author of the then-draft Process Validation: General Principles and Practices, while addressing the ISPE/FDA teleconference of January 13, 2009
  27. Co-presentation between Jeff Boatman and David Doleski, Acting Director, Division of Good Manufacturing Practice Assessment, FDA/CDER Office of Compliance; Regulatory Affairs Professionals Society Midwest Conference, Indianapolis, IN, October 26, 2011
  28. ANSI/ASQ Z1.4-2008, Sampling Procedures and Tables for Inspections by Attribute: American Society for Quality Control, 2008
  29. Process Validation: General Principles and Practices, § IV.D
  30. Federal Dockets Management System Docket FDA-2008-D-0559: Parenteral Drug Association, March 2009
  31. Title 21 CFR, §§ 820.70(a) and (a)(2)
  32. SG3/N99-10:2004, § 7
  33. Medical Device Quality Systems Manual, § 4: Food and Drug Administration, January 1997
  34. SG3/N99-10:2004, § 6.1
  35. Process Validation: General Principles and Practices, § IV.D
  36. Process Validation: General Principles and Practices, § IV.D
  37. Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations, §§ B and C.3: Food and Drug Administration, September 2006
  38. Process Validation: General Principles and Practices, § I
  39. United States v. Barr Labs Inc, 812 F., Supp 458

Copyright © 2013, 2014 QPharma Inc., Jeff Boatman, and the International Society of Pharmaceutical Engineers — may not be reprinted or copied without permission.