An update on inspections by governments and health authorities of contract/clinical research providers (CROs) and other service vendors to the pharmaceutical industry.
United States
Inspections of CROs and other providers have been going on for many years by FDA and now, by other health agencies, in greater numbers. In 2011, FDA updated its Compliance Program Guidance Manual, CP 7348.810, Sponsors, Contract Research Organizations, and Monitors. This document describes the procedures for FDA inspectors who do inspections of sponsors and CROs. They define CROs as: “Such entities consist of those organizations or corporations that have entered into a contractual agreement with a sponsor to perform one or more of the obligations of a sponsor (e.g., design of protocol, selection of investigators and study monitors, evaluation of reports, and preparation of materials to be submitted to FDA). In accord with 21 CFR 312.52 and 511.1(f), responsibility as well as authority may be transferred and thus the CRO becomes a regulated entity.” This makes it crystal clear that CROs are on the radar screen.
This document covers all the areas of clinical research including drug safety and pharmacovigilance. Although not expressly stated in this document, similar requirements are in place for CROs and other vendors handling post-marketing drug safety and PV. The inspectors are instructed to:
- Determine who is responsible for final evaluations and decisions in the review of adverse events and safety information.
- If a CRO is contracted to perform an obligation of the sponsor for managing adverse event/safety information (e.g., including activities such as collecting, evaluating, or reporting such information), obtain information that identifies the responsibilities of each party.
- Determine if safety information/unanticipated adverse device effects were reported to FDA as required by regulations.
- Determine if safety information/unanticipated adverse device effects were reported to participating investigators (and to reviewing IRBs for device studies) as required by the regulations.
- Review the procedures (e.g., frequency, scope) the sponsor/CRO uses for the receipt, evaluation, and monitoring of safety information/unanticipated adverse device effects, as well as the process for updating the investigator brochure. If applicable, review the composition and function of the safety team/committee (for drugs and biologics).
- Determine who is responsible for final evaluations and decisions in the review of adverse events and safety information.
This is not news and such inspections of CROs and other organizations have been ongoing for many years:
From the FDA’s Office of Scientific Investigations’ Metrics (2015)
And focusing on CROs (the sections in blue) in the next graph:
Thus we see a drop from 25 in 2009 to four in 2014. Presumably there are several reasons for this: the “message has gotten through”, there has been consolidation of CROs, higher priorities perceived by FDA etc. There is no reason to think CRO inspections will stay low, particularly as the pharma companies outsource more and more.
This entire metrics document is worth reviewing if you deal with audits and inspections. In addition, a presentation made by FDA in 2013/14 covering an earlier version of these metrics as well as FDA’s philosophy and actions in audits should be reviewed.
So this we know and have known for many years.
Europe
What is new is the EU (and especially UK) focus on CRO inspections and PV inspections in particular. This was highlighted on the UK’s MHRA’s website earlier this year.
In this posting, the MHRA reviews the current situation and then explains what it is doing to increase their inspections of service providers. Inspections were authorized by law beginning in 2003 and expanded several times over the years. Currently, the MHRA notes, there are many ways of doing clinical research and handling PV. Some or all of the drug safety/PV functions are now outsourced to CROs.
The MHRA notes that when they inspect MAHs they also inspect the activities of the CRO(s) servicing the MAH. Unlike the US, where FDA inspections are “free”— that is the US government does not charge the inspected company for the inspection — this activity in the UK and in most of Europe is fee-based. The MAH is charged a substantial fee for the inspection. The daily GCP, GMP and PV inspection fee is about $4000 per working day, which is 7 hours. So a four day inspection will cost well over $16,000. The cost of inspecting a CRO is sometimes covered by the fee paid by the MAH.
The MHRA and other agencies in the EU currently do GCP inspections of service providers, including those in the US, but these do not seem to be PV-focused and often PV is covered only superficially.
The MHRA is now contemplating a fee-based inspection of the CROs. They justify this by saying that this may:
- Reduce the number of inspections of service providers
- If a “stand-alone” inspection of a CRO is done, this may reduce the frequency of inspections of the MAH.
- The inspection of the CRO may cover the services the CRO provides to multiple MAHs which may shorten the inspection time at each MAH using the CRO. The MHRA notes, though, that they will still need to evaluate the “interfaces and oversight” of the CRO by the MAH.
Not sure I agree with these points, particularly that the number of inspections will drop. But we shall see.
To prepare for CRO inspections, in 2014, the MHRA did a survey of 22 CROs asking for volunteers to participate in a pilot phase of inspections. Ten responded and seven agreed to participate. Two will be inspected by the Good PV Practice Inspectorate in 2015/2016.
It is worth looking at the MHRA website on Good PV Practice and the guidance on how to respond to inspection findings.
Bottom Line
FDA, MHRA and other agencies have been doing PV inspections directly or indirectly of CROs for well over a decade in the post-marketing area and, in a somewhat less focused manner, in clinical trials. The clinical trial inspections were more GCP oriented with PV looked at during the inspection. Directed PV inspections were unusual unless a for-cause reason was noted.
This is changing. PV inspections during clinical trials and post-marketing are now becoming routine. As the business model for pharma companies (NDA holders, MAHs) changes with much more out-sourcing, the health agencies are following suit and are working out mechanisms to inspect the out-source service providers.
Outside the US, the fee-based concept of inspections adds a “money-making” dimension to the discussion. Since many agencies “balance their books” by fees, allowing them to receive less direct funding from parliaments or the central government, there may be an incentive from the financial side also to expand inspections. In any case, there clearly is a worldwide tendency to increase governmental oversight of pharmaceuticals, their development, use and adverse events. Most people would agree this is laudable though the actual extent of oversight and control is always up for debate.
From these actions, several lessons can be learned and several actions should be put into practice by MAHs/NDA holders and service providers/CROs. None of these should be surprising:
- Be sure your PV system is in place with solid SOPs, trained personnel, Quality Management Systems, excellent documentation, a solid, validated safety database, internal oversight and auditing
- Tracking of the rules, regulations and best practices (that is, government expectations which are not written down as formal regulations) are known and implemented where appropriate.
- Attention to the “interface” between the service provider and MAH/NDA holder. That is, a clear set of documents (contract, master service agreement, study management plan, SOPs, data transfer, safety database(s) etc.) must be in place and functioning well.
- Ensure that this covers not just post-marketing situations but also clinical trials.
- If multiple service providers are used, each must be tracked and the relationship in control. I have seen companies using six or eight CROs on multiple continents in clinical trials with multiple databases and no clear oversight or control. This does not work well in practice, particularly as the time of NDA/MA submission approaches when disparate data must be combined from many sources.
- Be ready for an inspection and, if from the EU, budget for it.
- There is more and more transparency, particularly with social media in play. Be ready for the “dirty linen” to be washed in public.
- PV is now a multi-discipline activity involving not just collection of SAEs and AEs but also involves personnel from other disciplines including risk analysis and mitigation, regulatory, legal, quality, marketing, social media, etc.
- Most pharma companies and some CROs are pretty well attuned to this. The CROs now must come up to speed if they have not done so already.
- There may be some pushback if the costs of the CRO inspections are placed solely on the MAHs/NDA holders. However, the CROs, if charged, will surely figure some way to pass this cost on to their clients.
As usual, life is becoming global, more complex and very interesting!
