Failure to ensure data integrity is a breach of cGMP. In 2016, 80% of FDA Drug Product and API warning letters included a reference to the lack of data integrity, mainly due to incomplete data. Several regulatory agencies have issued data integrity guidance documents in recent years, all of which follow the definition embodied by the 1990s FDA acronym “ALCOA”:

Implicit in these requirements for ALCOA are that records should be complete, consistent, enduring and available.

 

Excipients are much more diverse than APIs. They have compositional and molecular weight polydispersity, and excipients are often extracted rather than synthesized, from operations such as harvesting and mining. They are typically manufactured by continuous processes, and in much greater volumes than would be encountered in the pharmaceutical industry. Generally, most excipients were not designed for pharmaceutical use, although many of them have long histories of patient safety via various routes of drug administration or from legacy applications as food additives.

 

The various data integrity guidance documents differ slightly in approach and specific details, but are intimately bound to the wider regulatory framework of GMP and good documentation practices, which are based on APIs and drug products. Pharmaceutical usage may only be a small part of a specific excipient market, so most excipients are not manufactured under API or drug product cGMPs. Some suppliers may sell to the pharmaceutical market and leave it to the users to establish pharmacopoeial compliance, which means limited compliance with GMP. The further one gets from pharmaceutical cGMP, the less likely it is that detailed data integrity expectations will be met. ALCOA principles are good business practice in any commercial sector, but judgement will be required in the application of specific Pharma data integrity requirements to excipients.

 

With excipient GMP on a sliding scale, users should anticipate varying degrees of applicability of specific Pharma data integrity requirements. Therefore, users need to define which specific data integrity requirements are expected from their excipient manufacturers.

 

Based on the known marketed applications of their materials, excipient manufacturers should define which records are necessary to support their GMPs and the measures taken to ensure data integrity. Excipient manufacturers lack adequate control of the integrity of their data when they do not literally follow the regulatory guidelines.  A common expectation is for manufacturers to provide validation reports for their excipients, analogous to those generated by Pharmaceutical companies during API and Drug Product development. FDA requirements are very specific in this respect.

 

Traditionally, pharmaceutical companies performed full compliance testing on each received batch of excipient which meant that less emphasis was placed on supplier Certificate of Analysis (CoA) data integrity. Where users rely on data from qualified suppliers without confirmatory testing (21 CFR 211.84), supplier CoA data integrity is critical. Pharmaceutically aligned suppliers utilize controlled platforms such as LIMS and SAP like those used in the Pharmaceutical industry.

 

From a Quality by Design (QbD) perspective, reliance on purchased CoAs fails the ALCOA criterion of completeness. The number of batches purchased may not be sufficient to statistically represent supplier performance. Access to all CoA data over a period of time gives a more representative picture of supplier process variability for that timeframe. In turn, the CoA data is only complete if there are no out-of-specification (OOS) excipient batches. Full batch data including OOS is necessary for assessment of supplier process capability. It should be noted that for some excipients produced to serve multiple industries there may be “second quality” markets for material outside the Pharma specification. Recycling of material would also need to be taken into account in determining process capability.

 

Many excipients are produced by high-volume continuous production. Of necessity, CoA values will be either average or composite results. QbD drives utilization of more data from excipient manufacturers by pharmaceutical companies, beyond the traditional CoA. It is unlikely that pre-existing systems dating back years, if not decades, were designed with the data integrity requirements of the end-pharmaceutical user in mind. If the data is used for information only and does not control finished product safety or quality data integrity is less of an issue. At the other extreme, real time release (RTR) of continuously produced pharmaceuticals utilizing supplier data would require maximum data integrity.

 

A second driver to greater utilization of supplier data is the need to demonstrate user oversight of supplier quality. Users are strictly liable for the quality and GMP of their suppliers, including data integrity.

 

Sharing of data by excipient manufacturer with users may require confidentiality agreements to maintain the manufacturers’ proprietary know-how. There may also be restrictions on use of the data in patent applications and regulatory submissions.

 

Industrial control systems are often more focused on safety. Changes to address Pharma requirements may have unintended consequences. It is not easy to harden/improve compliance without revalidating safety critical systems. Excipient manufacturers typically use networked control systems to afford remote monitoring and control, in contrast to the small-scale batch operations, typical of Pharma.

 

Many legacy control systems used by excipient manufacturers make data attribution difficult because their control systems are open. If a specific operator is not identified for every action it may be possible to ameliorate by shift rosters, physical access security, training, or a control/data entry log. The degree of GMP at various stages of production may influence the extent of data integrity.

 

Many industries, including those manufacturing excipients, use redundancy, with multiple sensors and in process tests to reduce dependence on a single data stream. In contrast, pharmaceutical operations are often dependent on a single sensor, which places more emphasis on validation and calibration. Multiple sensors allow voting and reduce dependence on calibration. Data integrity is at a system level higher than that of the individual sensor.

 

High frequency testing, using “quick and dirty” (nonspecific) methods or sensors, outweighs a limited number of test results from more precise but onerous methods. A better population estimate is obtained, and sampling error is reduced by higher frequency testing, which compensates for lower data integrity at the level of individual measurement. High frequency automated data capture reduces potential for operator error in sampling or testing. The consistency of surrogate signals can be used for online monitoring with more specific methods to investigate changes.

 

Increasing utilization by users of supplier data may also pose data retention challenges for the supplier. What data should be retained, for how long, and should it include metadata to enable interrogation of dynamic records? Audit trails and security access controls would be needed for such data. The data retention period could be linked to retention samples, but the excipient manufacturer needs to define this.

 

If data integrity is uncertain (paper or electronic) the questions to assess the risk are:

Data integrity must be balanced against utility when using a variety of large externally sourced datasets for novel analyses. It is difficult to retrospectively implement controls for validating the data at point of creation or capture, and correcting errors may cause inconsistencies. Rather than trying to control the data creation to preempt errors, the focus changes to identifying inconsistencies and standardizing the data.

 

The user may not be able to impose specific data integrity requirements on the maker. If pharmaceutical consumption is minor and the requirements too onerous, without commensurate return on investment, there is a risk of the maker withdrawing from the Pharma market if no longer economically viable to serve. In the large plants producing excipients there is a bias towards simplification and commodity volumes versus complexity and specials. Pharmaceutical requirements that can be met with incremental investment, and which does not increase operating costs to serve majority markets, are more likely to be accepted.

 

Quality culture is perhaps more important than integrity of specific data. Pharmaceutically aligned excipient manufacturers should have the personnel, expertise, training and a culture for employees to raise issues and follow good data governance. It will then be much easier to deal with any mismatch in data integrity expectations between user and maker.