Changing Supplier Controls Requirements

Companies that choose to produce medical products come under the regulatory laws of the countries in which they market their products.   For the U.S., this falls under the purview of the U.S. FDA, with its CGMPs, “Current [best practices] Good Manufacturing Practices”, as codified in 21 CFR 4, Combination Products, 21 CFR 111, Dietary Supplements, 21 CFR 211, Pharmaceuticals, and 21 CFR 820, Medical Devices, and others.

For much of the rest of the world, the European Union provides a major model, with its directives, emerging CGMPs,  and the ISO quality standards -- ISO 9001 for the majority of quality management systems, and ISO 13485 for medical device QMS.

All these regulatory requirements mandate that a company establish a ‘total quality system,’ from customer requirements through development, procurement (supplier control), production, to customer use and feedback.  

Supplier controls are involved in all the above and are designed to require that vendor-supplied products and/or services:

• Also ultimately meet the applicable CGMPs
• Are also subject to true failure investigations / root cause analysis
• Perform meaningful verification / validation, including support for COAs / COCs
• Document valid product development, improvement, change control
• Subject all CGMP activities to science-based decision-making

U.S. FDA’s world view

FDA’s Commissioner Margaret Hamburg stated, in the U.S. FDA’s new “Global Engagement” Report, dated April 2012:

“As our world transforms and becomes increasingly globalized, we must come together in new, unprecedented, even unexpected, ways to build a public health safety net for consumers around the world.”

FDA Commissioner Margaret A. Hamburg, MD, as also quoted 

in an April 23, 2012, FDA press release.

This in not just a U.S. issue but is a major concern for regulatory agencies worldwide.

In 2011 as one of the steps to meet this globalization challenge, the U.S. FDA opened the following operating resident posts in major areas of off-shore manufacturing for U.S. companies:

• China (Beijing, Shanghai, and Guangzhou)
• India (New Delhi and Mumbai)
• Latin America (San Jose, Costa Rica; Santiago, Chile; and Mexico City, Mexico)
• Europe (Brussels, London, and Parma, Italy)
• South Africa (Pretoria)
• Middle East and North Africa (Amman, Jordan)

As a result, the FDA is 1) training their equivalents in those areas to current regulatory requirements / best practices, and are 2) auditing key offshore suppliers of major components supplied to U.S. manufacturers. 

The FDA’s increased emphasis on supplier qualification

Know the source

It is incumbent upon manufacturers to know their suppliers throughout the supply chain, preferably direct to the manufacturer supplier, but, as is more likely, through intermediaries such as distributors: 

• If direct from manufacturer, then assess the manufacturer
• If purchased from a distributor
  • Must know manufacturer and site
  • Must know role of distributor
  • Warehousing
  • Packaging
  • Repackager (if applicable)

Assess distributor and manufacturer/repackager

• Ideal :  Regulated   medical manufacturers audit all critical products / excipient suppliers
• Impact : Each audit cycle
• Challenges:   Manufacturers have hundreds to thousands of sites that should be audited globally.   Vendors in turn have hundreds of client audits to host.   Vendors increasingly will be expected to audit their suppliers, and on down the   chain
• Not currently happening to any substantial degree.

Supply chain integrity – current key areas of FDA emphasis

The FDA expects that the end manufacturer ensure supply chain integrity and fight counterfeiting using existing systems such as the following:

• Verified Paper Trail:
  • Already in use e.g., all U.S. states require a d rug pedigree for shipments of drugs into their state
  • All movements require paperwork
• Site audit
• Verify distribution
  • Shipping papers back to original manufacturer
  • Periodically confirm

UDI / GUDID:  The FDA’s new device labeling requirement (UDI) with its global database (GUDID)   [for more information go to the fda.gov website].

Further specifics

Some additional techniques / systems include:

Distributors:

• Good Distribution Practices
  • Unopened Package
• Plus Good Manufacturing Practices where:
  • Packaged from bulk
  • Repackaged

Tamper-evident Seals:

• Boxes
  • Embossed Tape
• Drums
  • Embossed Tape
  • Imprinted Dust Caps
• Bulk
  • Numbered Seals

Identification of the manufacturer and site:

• Paperwork (Bill of Lading) traced to Manufacturer

This should also involve the certification of all distributors.  All subject to the periodic confirmation of current information and changes.

Shipment receipt documentation verification

In-house receipt and approval

• Evaluation of Packaging
• Label matches reference label
• Tamper-evident seal matches reference seal
• Packaging components match reference components
• In addition to proof of meeting specification and inspection / approval of components

Predicting vulnerability

The FDA both recognizes 1) the quality and safety advantages of documented CGMP / QMS systems versus 2) the economic advantage to those manufacturers who choose to “unlevel the playing field” by not playing by the rules with “adulterated product” in areas such as:

• Cheaper, poorly documented vs. cGMP, ISO 9001 / 13485- certified, compliant
• U.S. FDA   registered establishment (subject to periodic FDA cGMP-compliance audits)
• Improved test methods
• Specific vs. non-specific
• Employ consensus / recognized standards vs. “home-brewed”
• Purchase direct from manufacturer vs. through long supply chain

Note:  FDA’s definition of “Adulterated Product” includes not just unapproved changes to a product but the non-adherence to cGMPs / specifications / SOPs, et al, in their manufacture.

Meeting the challenges

• Develop Product Risk Management Files / Reports
  • ISO 14971 – Medical Devices (can use as a “model” for non-device products)
  • ICH Q9 – Pharmaceuticals (and dietary supplements)
  • Combination products go with dominant component
• Establish   “critical suppliers” based primarily on product use[r] risk;   factor in risk to company for delivery problems, financial, other issues
• Inspect and audit to supplier “criticality”

Critical suppliers must be selected / qualified / retained ultimately by means of the

Non-critical suppliers may be selected / qualified / retained by means of:

• Audit questionnaires / desk audits;
• Phone audits, subsequently documented to a script;
• Third-party audits.

Validity of the alternative / “desk” audit supported over time by:

• CAPA trending
• Receiving QC trend data
• WIP / NCMR / OOS trend data
• FG QC trend data

Alternatives to the onsite audit, e.g., the questionnaire / paper audit, are less acceptable to regulatory agencies and are unsuitable for critical RM / components and APIs (active pharmaceutical  ingredients) / excipients.

Summary

As shown above, the FDA recognizes that it is playing “catch up” to an existing global supply network with complex products, systems, and an outdated reliance on an “honor system” for imports that is not working.  What it is doing is no different from what other industries have already implemented to protect themselves from dangerous counterfeit products and “knock-offs” and level the playing field.  While specifics may change, the basic principles of supplier controls as outlined above will not be going away.