[Stability Testing related News – vol.51]

◆  Cloud Computing: Regulations for the Return Transmission of Data in the Event of Business Discontinuation (16-Dec-20 ECA)

The trend towards cloud computing means that a large amount of data is stored by cloud providers. Now, how do you get your complete data if the cloud service provider goes out of business or gets insolvent?

What do Regulations demand and how can they be implemented?

Both the German AMWHV and the EU GMP guidelines consider the responsibility to lie with the RU (Regulated User). The AMWHV focuses on the retension of documentation, i.e. the availability of GxP-critical data. According to § 20 AMWHV, the pharmaceutical manufacturer must take precautions to ensure that the documentation is kept available for the entire storage period in the event of closure of the manufacturing or testing site where the documentation is stored in accordance with sentence 1.

The EU GMP guidelines focus on the business process and thus on the GxP-critical application and data. According to Annex 11 of the EU GMP Guideline, Chapter 16 – “Continuity of business operations” – precautions should be taken to ensure the continuous support of these processes in the event of a system failure (e.g. by a manual or alternative system), if computerised systems support critical processes. The time required to put these alternative processes into operation should be determined on a risk-based assessment for a particular system and the processes supported. These procedures should be adequately documented and tested.

This task/obligation could be included in the service contract with the CSP (Cloud Service Provider) by obliging the CSP to ensure the availability of data and, if necessary, application via an additional subcontractor. However, the RU should evaluate within the scope of a risk assessment whether it would not be reasonable to keep a backup site on premise.

◆  ICH Q9 Risk Management to be Revised (13-Jan-21 ECA)

Since 2005, the ICH Q9 guideline has been state-of-the-art when it comes to quality risk management (QRM) in the GMP environment. Now, it is to be revised. What is planned?It is planned to develop specific, officially accessible, training material beyond the “briefing pack” which is already available. Developing this training material is mentioned as the main objective of the revision.

• High degree of subjectivity in risk considerations and in QRM results: although complete exclusion of subjectivity is not possible, well-known strategies (such as on bias and behavioural patterns) could contribute to control. This applies to Chapters 1 and 4.1 and the development of specific training materials for such strategies and tools.
• Product availability: the ICH Q9 guideline is not a supply chain guideline, but the (non-)availability of medicinal products on the market can represent a risk for patients. In future, this topic should be given more attention in Chapters 6 and 7, as well as in Annex II with the addition of a new section (II.9). Furthermore, training materials should also be developed on this subject.
• The lack of understanding of the formalities within the framework of the QRM: There are uncertainties in this regard both in the industry and among the regulatory authorities, as the concept paper points out. As part of the revision, Chapters 1 or 5 should therefore be adapted with regard to Annex I. The aim is to describe a more effective application of QRM principles and a better execution of QRM activities. Training material should also be developed.
• The lack of clarity on risk-based decisions: according to the concept paper, there is a lack of clarity on what is meant by good risk-based decisions, how QRM can improve decision-making or how to achieve risk-based decisions. Among other things, the expected benefits of investing in risk-based decision-making should be specified. Chapter 1 is to be amended for this purpose and a new section II.10 in Annex II as well as a new reference in Chapter 6 are to be added. As with the other three areas, training material is to be developed.

The concept paper also proposes more clarification on the maintenance of risk assessments and the implementation of the risk review. The risk review should also be linked more with continuous improvement, as mentioned in ICH Q10, and life cycle management from ICH Q12/14.

The finalised revision should be available by July 2022. A detailed timetable can be found in the Business Plan​. You can find the concept paper on the EMA website.

◆  Survey Results on “Remote Audits” of Notified Bodies (26-Jan-21 ECA)

Within the framework of a survey via the EU Commission, Notified Bodies in the medical devices sector were asked about their experiences with “remote audits”. The results are now available.

37 Notified Bodies participated in the survey, which was closed at the end of October 2020. 12,860 audit days were carried out as remote audits under consideration of the Medical Devices Directives. In addition, 389 days were carried out with regard to the regulations for products required by Covid-19 or partial audits.

Fortunately, 75% of the audits were rated as successful or very successful. Only one Notified Body gave a negative assessment. This Notified Body, however, had completed less than 20 audit days. Auditors have made the experience that, depending on the number of audits, their learning process with regard to preparation and implementation has also increased significantly. Interestingly, the number of audit findings is roughly comparable to that of on-site audits.

The greatest advantage identified was the considerably reduced travel time. This led to more efficiency. Yet what were the greatest shortcomings? By far, the item “poor internet connection” tops the list.

You can find the results in a position paper of the Team Notified Body Commitee.