Five CAPA Compliance Tips

Five CAPA Compliance Tips by Seth A. Mailhot, Special Counsel, and Emily Theriault, Associate, Sheppard Mullin Richter & Hampton LLP

Note: The views expressed in this article are those of the author and do not necessarily represent those of his/her employer, GxP Lifeline, its editor or MasterControl, Inc.

Having been intimately involved in how the U.S. Food and Drug Administration (""FDA"") inspects current Good Manufacturing Practice (""cGMP"") requirements for nearly two decades, I find myself repeating certain things to companies. Most often, the issues I repeat relate to Corrective and Preventive Action (""CAPA"") systems. CAPA systems are a focal point in FDA inspections precisely because they are the process that manufacturers follow in case something goes wrong. In the same way that a person's character may be understood by trial through adversity, quality system auditors and FDA investigators understand a company's operations through its CAPA system.

A CAPA system is not only a regulatory mandate, it is the means by which a company may improve its quality system to minimize risks and avoid problems. A properly designed CAPA system provides a process by which a company can proactively and retroactively correct problems identified through the quality system. This requires a robust dataset to detect problems, a measured approach to finding solutions, a careful implementation of those solutions, and documentation to memorialize and communicate the changes made to others.

FDA investigators focus on CAPA during inspections because it is a roadmap to identify potential and existing problems at a company. CAPA documentation provides FDA investigators, auditors, and executive management a means to review problems. Therefore, effective management of the CAPA system is critical to compliance. By following five essential steps, companies can be CAPA compliant and ensure a successful audit or inspection.

1. Implement a CAPA System and Document CAPA procedures

The first step may seem obvious, but it is essential to establish a CAPA system and document all CAPA procedures. Despite its obviousness, the failure to either have a CAPA process, or failing to document or establish CAPA procedures, is one of the most common issues noted by the FDA. The lack of a documented CAPA system was the second most common observation by FDA investigators in fiscal year 2010 (trailing first place by a single observation) and was noted in more than half of all Warning Letters citing a CAPA violation between 2008 and 2009.

The failure to have a CAPA system may result from being unaware of FDA and European Union requirements or may arise as a result of the product's questionable regulatory status, such as software or in vitro diagnostic tests.¹ Or these failures may occur in firms with a mature, robust quality system, where the firm relies on a contract manufacturer or fails to adequately integrate a newly acquired company within the firm's quality system. As a result, firms must conduct due diligence when partnering with a contract manufacturer or acquiring a new company. A lack of CAPA procedures in a potential acquisition must be identified and implementing such procedures must be a priority after the purchase is complete. Facilities should be thoroughly reviewed after integration to ensure CAPA compliance.

2. Analyze Quality Data Using Statistical Methodology to Identify Quality Problems

The second step to CAPA compliance is to use statistical methodology to analyze quality data and identify quality problems. The regulation identifies the following types of quality data that should be reviewed: process; work operations; concessions; quality audit reports; quality records; service records; complaints; and returned product.² In selecting quality data to analyze, it is critical to include data sources and elements that are both internal and external to the company. In addition, companies should be attentive to quality data on manufacturing processes and nonconformances. Both of these data sets have been noted on FDA Warning Letters.

Complaints, in particular, should be given special attention. Complaints are a direct indicator of problems with distributed product, and should be analyzed through the CAPA system as appropriate. The FDA has made clear on multiple occasions that it views complaints as a CAPA data source, and that failure to address customers' problems may result in a warning letter.

Investigators and auditors often judge a firm's quality system based on a review of its CAPA log. Therefore, it is imperative to implement and then record all changes in methods and procedures in the CAPA log. While the number of CAPAs alone may be misleading, it is important to note the key role that the CAPA log plays during an investigation. Therefore, firms should consider whether to address minor quality issues through another process or to elevate the issue to implement a CAPA process. Firms should also keep in mind that a single quality issue may spawn multiple CAPAs to facilitate implementing the necessary changes. Manufacturers should make it a priority to evaluate the number of CAPAs generated and analyze that information to determine if there is adequate quality assurance. A periodic review of the CAPA log will provide a broad view of how the system is running.

3. Investigate and Identify the Cause of Quality Problems

Manufacturers should promptly investigate the cause of quality problems. The FDA will take note if a firm has identified a problem but failed to conduct a detailed investigation to determine the root cause of the issue. Firms should conduct efficient and meaningful investigations by utilizing a systematic and orderly method. For example, firms should establish a documented investigation procedure that is implemented every time a problem arises. The investigation should be conducted by trained investigators. Firms should also employ a flexible CAPA closure target dating method that incorporates triaging based on risk. CAPAs that can be tied directly to nonconforming finished product should be given a priority.

In the beginning, the company should articulate a clear and complete statement of the problem. It is essential to identify the issue so that it may be properly addressed. The company must then invest the appropriate time and resources into conducting a thorough investigation, implementing the firm's documented investigation procedure. The investigation should be documented carefully. In addition to the investigation, the manufacturer should consider the impact of the issue on its products globally. Use of statistics and trending analysis are vital tools in determining the scope and impact of the problem. It is imperative that the company contemplates the relationship that poor practices have with nonconforming product. Ultimately, the investigation must analyze the root cause of the issue, and identify actions needed to correct and prevent the recurrence of quality problems.

Finally, companies should avoid common mistakes that result in an incomplete investigation of the problem. Companies sometimes use training as a scapegoat, or as a cure-all, and the FDA will be unsatisfied without a proper investigation to support a ""training-only"" solution. Moreover, jumping to a first or obvious cause of a problem without an actual investigation is another cause for concern. Even if a problem has what appears to be a clear cause, firms should implement investigation procedures to ensure that the actual cause (or causes) of the issue has been identified and eliminated. A failure to test assumptions may result in dire consequences, both in terms of product quality and FDA compliance with CAPA procedures.

4. Verify or Validate Corrective or Preventive Actions to Ensure the Effectiveness of Those Actions and to Ensure that the Actions Taken Do Not Result in an Adverse Impact on Finished Devices

A common mistake companies make is the failure to check effectiveness after implementing a correction or preventive action. Once an investigation is complete and the root cause has been identified, it is imperative that any corrective or preventive actions be validated following implementation to ensure the actions are effective and do not introduce new problems.

To identify and implement a plan is simply not enough; effective follow-up to ensure that the plan is addressing the problem and is not creating any new problems is indispensable. Companies should always be cognizant that fixing one problem may create another. With this in mind, any changes to the production process that fix an issue should also be viewed as a potential source of new problems. Therefore, after preventive or corrective actions have been taken, companies must ensure that not only the original problem has been solved but also that no new problems have arisen as a result of that action.

5. Implement and Record Changes in Methods and Procedures as Part of Actions Taken and Disseminate Those Records to Management and Quality Assurance Personnel

Any changes to methods and procedures must be appropriately memorialized in writing and must be reviewed by management and quality assurance personnel. The FDA highlights the importance of management review in its ""QSIT Manual"" by instructing investigators to examine the review schedule to determine if management reviews are sufficiently frequent enough to keep management ""informed of ongoing quality issues and problems."" Indeed, if management is unaware of quality issues, that is a red flag for the FDA that the firm is not reviewing quality control as frequently as it should.

Moreover, frequently conducting management reviews is not enough. Management reviews must also include a discussion of the substantive information on CAPAs to ensure that management is involved in implementing and validating corrective procedures. Effective managerial review of the CAPA process will help ensure that appropriate follow-up occurs. A best practice would be to include a managerial follow-up report on all CAPA issues that documents the investigation, actions implemented, and the validation of those actions to ensure that the problem was addressed and that no new problems arose. Active managerial involvement in the CAPA process will help promote allocation of adequate resources to address significant action and provide an incentive to follow-up on outstanding issues and close-out CAPAs in a timely manner.

By implementing a rigorous CAPA process that analyzes quality data, contains a thorough investigatory procedure, validates the effectiveness of actions taken in response to issues, and then records any changes in methods and procedures, and subsequently disseminating that information to management and personnel will help ensure CAPA compliance. Incorporating these tips are valuable to ensuring an effective quality system. This will, in turn, ensure that FDA inspections and other audits go as smoothly as possible.

Endnotes

1. In vitro diagnostic products, for instance, might be ostensibly marketed for research use only, despite being used for clinical applications. Electronic health record software may be FDA regulated if it interacts with medical devices to retrieve patient data.
2. 21 CFR 820.100(a)(1)