Quality Management Systems: FDA & EMA Requirements

One of the areas that is relatively new to drug safety and pharmacovigilance (PV) involves the emphasis now being placed on “quality”.  It is no longer enough to do a good job and know you’re doing a good job, but now this must be documented and reviewed by overseers to ensure you really are doing a good job!  I suppose one might say that, after x years of doing drug safety, “I know how to do this!”  But if one thinks about it, it is always worthwhile having another set of eyes look at someone’s work to be sure no issues or errors have slipped in.  We certainly want someone to double check airplanes and the pilot before take-off or the functioning of nuclear reactors.  So now we have it in drug safety.

 FDA

Both FDA and EMA (and other agencies) have made it clear that they expect quality to be built into drug safety (and all pharmaceutical systems).  FDA has issued several documents on quality though they are not as specific as EMA’s quality documents on PV.  Much of ICH and FDA’s quality publications relate to manufacturing but the expectation is that this will also be applied to PV.  FDA’s Office of Regulatory Operations has issued a Quality Manual ((https://www.fda.gov/AboutFDA/CentersOffices/OfficeofGlobalRegulatoryOperationsandPolicy/ORA/ucm135836.htm). FDA’s quality requirements have been built up over the years based on FDA’s 1999 publication on Quality by Design as well as ICH Quality documents.

The contents can be summarized as follows (with my interpretations for drug safety):

QMS: Each company should have a quality management system (QMS) which includes a mission statement of the goals and scope of the program as well as defining applicable laws, regulations and, importantly, best practices (procedures where the law is unclear or silent).  In addition there should be written, versioned procedural documents (SOPs, Manuals, Work Instructions etc.).  It is a good idea to create a corporate “Quality Manual” summarizing, at a high level, the company’s intent to maintain top quality.

Management Responsibility: There must be a commitment by management for quality and they should lead by example.  They should communicate this policy, receive and respond to feedback and maintain a customer focus noting that the concept of  “customer” is broadly defined to include not just patients and health care providers but many others such as health authorities, and internal company clients.  Management should ensure that planning and the quality system are put in place.

Resource Management: There must be adequate resources to get the job done and prevent backlogs.  This includes the usual things such as personnel, computers, work facilities, money/budgets etc.  There must be adequate training and the company must ensure that confidentiality and data privacy are fully maintained.

Planning, Processes, Controls and Execution: This broad area basically requires that the company be prepared and anticipate issues and problems.  This may be hard in PV where spontaneous reports determine one’s workload (and fate).  But broadly speaking this means:

• Anticipate where possible (don’t schedule vacations for the PV staff at the time of the launch of a new drug),
• Be prepared for the unanticipated such as unexpected severe toxicity, tampering, counterfeiting etc.  See the book The Black Swan: The Impact of the Highly Improbable by Nassim Nicholas Taleb – not about drug safety but about highly unlikely but catastrophic events.
• Stay up to date on new regulations, technology, processes
• Have valid, traceable processes with audit trails
• Have the right technology (e.g. drug safety software)

Measurement Planning & Implementation:  “If you can measure it, you can fix it” is a well-known phrase in engineering and is applicable here.  The company must monitor and track “key performance indicators” (KPIs) to be sure that the processes are working.  The results should be made known to the appropriate stakeholders.  If problems are found, a root cause analysis should be done and corrective actions and preventive action plans (CAPAs) put in place.  Periodic audits should be done and “continual improvement” should be in place.  Some KPIs that PV should track include (my opinion, not from FDA’s document):

• Late & on time ICSRs, e.g., 7-, 15-day reports, EU submissions)
• Late reports into Drug Safety, e.g., from study monitors
• Late workflow steps within DS, e.g., triage within 24 hours, case closure by day 7, coding, medical review, due diligence requests
• Late reports to HAs, business partners etc.
• E2B reporting failures

• Late & on time aggregate reports (e.g. PADERs, PSURs, DSURs)
• Late & on time Medical Monitor trip reports
• CAPA commitments done on time, done but late, not done
• SOPs updated on time & training done as required.

There should be consequences for both success and failure.  Results should be compiled by employee, department, team etc. (as appropriate) but care should be taken to avoid public embarrassment and shaming (“Praise publicly, reproach privately”).  Success should be rewarded; failure and poor performance penalized.

Audits: It is expected that all functions of PV (home office, subsidiaries, vendors, partners, etc.) should be audited periodically.  FDA does not specify the frequency but many companies do audits of major operations yearly and smaller or less critical PV units or functions every 2-4 years.  FDA and EMA maintain a 2-4 year inspection  cycle of companies unless for cause when inspections are more frequent.  There should be an internal company compliance function or group to handle this.  They should not be part of PV or drug safety.

EMA

Unlike the FDA, the EMA has put forth a very clear and explicit document covering quality systems in drug safety & PV.  See their recent Good PV Guidelines Module 1 (https://www.ema.europa.eu/docs/en_GB/document_library/Scientific_guideline/2012/06/WC500129132.pdf).

Many of the points are very similar or identical to FDA’s.  I will highlight the differences and note specific points that EMA makes.  The document is worth reading by anyone who does drug safety.

The EMA notes that a QMS must contain: organisational structure, responsibilities, procedures, processes, resources of and resource management, compliance management and record management.  The goals are compliance with the law, prevention of harm, promotion of safe drug use and patient/public health protection.

Responsibility and resource management are similar to FDA’s requirements.  There is some stress on the identification and investigation of non-adherence to requirements.  Upper management’s roles are the same as FDA notes.

Training is stressed for all personnel involved in PV activities.  Training records and plans must be kept and there should be a process to check that the training results in understanding and correct conduct of PV activities.  Interestingly, EMA notes that adequate training should also be considered even for staff members with no specific PV tasks and responsibilities but whose activities may have an impact on PV.  This includes personnel in clinical trials, technical product complaints, medical information, terminologies, sales and marketing, regulatory affairs, legal affairs and audits.

EMA is more specific than FDA in noting that the MAH (sponsor) must have:

• Continuous monitoring of PV data, risk minimisation.
• Scientific evaluation of all information on risks particularly regarding ARs from off-label or occupational exposure
• Examination & submission of non-serious ARs
• Integrity, quality & completeness of data
• Processes to avoid duplicate submissions.
• Effective communication with public, HCPs & CAs on all safety matters
• Updated product labeling as new information becomes known
• Written SOPs & procedural documents
• Good PV record management & data security/privacy
• Organization charts, HR management within PV, job descriptions

As with FDA there should be continuous monitoring of safety data for timeliness, quality and completeness.  EMA stresses that the PV function must be independent – that is, all decisions must be taken in the sole interest of patients & public health.  There must be business continuity plans to allow continued function in emergencies, computer crashes etc.

The module addresses some very specific EU requirements such as the responsibilities of the Qualified Person for PV (QPPV) and the new Pharmacovigilance System Master File.  See the document and other modules (as well as other Bart’s Corner postings on this) for further information.

Interestingly, the EMA defines some “critical PV processes”.  The implication of this is that they must be in place and will be inspected when the company gets a “visit “from a health agency:

• Continuous safety profile & benefit-risk evaluations
• Establishing, assessing and implementing risk management systems and evaluating the effectiveness of risk minimisation
• Collection, processing, management, QC, follow-up for missing information, coding, classification, duplicate detection, evaluation and timely electronic transmission of individual case safety reports (ICSRs) from any source
• Signal management
• PSURs
• Meeting commitments and responding to requests from CAs;
• Interaction between the PV and product quality defect (i.e. manufacturing) systems
• Communication of PV concerns between MAHs & CAs especially regarding changes to the risk-benefit balance of products
• Communicating information to patients and HCPs about changes to the risk-benefit balance
• Keeping product information up-to-date
• Implementation of variations (i.e. changes) to MAs for safety reasons according to the urgency required
• Submissions to EudraVigilance

The PV system must be continuously monitored with audits, KPIs and other procedures.

Subcontracting and out-sourcing are permitted with written, up to date contracts in place.  The MAH though is reminded that the ultimate responsibility for fulfilling the legal requirements and responsibilities for PV always remains with the MAH.

Bottom Line: Every company has to have a quality system in place.  The health agencies will inspect and punish those who don’t.  At the very least, the QMS should cover the critical processes noted above in the EMA section.  The consequences of failure to this are severe and the health agencies are getting tougher and tougher on this (as they should).