FDA's regulation 21 CFR Part 11 on Electronic Records and Electronic Signatures provides industry with the requirements that
allow electronic records and signatures in computerized systems in place of paper records and handwritten signatures.1 Since the introduction of the final rule in 1997, however, its implementation has been relatively slow -mainly due to questions
surrounding the scope and interpretation of these regulations, the high costs anticipated by industry, and the absence of
acceptable and commercially available technical solutions.
The following case study provides an overview of the efforts by the Liquid Products Supply (LPS) site at AstraZeneca Sweden
Operations to bring its quality control (QC) laboratory into compliance with Part 11. It describes a strategy for both procedural
and technical solutions within the broader context of AstraZeneca's corporate project for Part 11 compliance.
The Corporate Level ER/ES Project AstraZeneca started its Electronic Records and Electronic Signatures (ER/ES) project immediately after the 1999 merger between
Astra and Zeneca. Obvious differences existed between the two companies' interpretation and implementation of Part 11 compliance.
Because the newly merged company had many disparate sites, remedial actions were expected to be costly.
In June 1999, the company filed a corporate ES-certification letter with FDA and simultaneously formulated its corporate project
for ER/ES. The project's main tasks were to produce a corporate-compliance framework (including the company's policy, interpretation,
guidelines, training, website, and documentation and reporting) and to establish the process for compliance throughout the
organization.
A corporate steering committee included senior management for global compliance, information systems and information technology
(IS/IT), operations and R&D. The corporate project team consisted of a smaller group of experts from compliance, regulatory
affairs, and IS/IT.
Management also assigned to each site an ER/ES ambassador - with expert knowledge of quality assurance (QA) and compliance
- who promoted the compliance project locally and reported its status to the corporate project team. A corporate project team
supervised the local projects through on-site visits and inspections. Although originally planned to last only about one year,
the corporate project was active from 2000 through 2002.
Figure 1. AstraZeneca's ER/ES Project as Applied to the LPS Site
|
A Site-Specific ER/ES Project The site-specific project at AstraZeneca Liquid Products Supply (LPS) closely followed the working model described in the
International Society for Pharmaceutical Engineering's GAMP Forum Part 11 guidance.2 A strategically selected local steering committee ensured the active involvement of the site's senior management in the project.
The steering committee for the site-specific project consisted of the head of LPS, managers for the three main production
units, the head of QA, and the IS demand manager. Regular meetings between the ER/ES ambassador and the steering committee
allowed for continuous high-level management support and handling of vital questions such as priorities and budget issues.
The major tasks for the ER/ES project at the LPS site were:
- train the staff to ensure common interpretation and practices
- bring existing systems into compliance
- establish processes to implement compliance of new systems.
At the local level, the project was divided into six different areas: the three production units, media systems (facility
and media monitoring), laboratory systems, and administrative systems. For a small organization with only a few systems, such
division may not be necessary. For large organizations like LPS (with over 2,000 employees), however, the number of systems
that can be effectively coordinated is limited (up to 30 or 40).
The ER/ES ambassador, a group of specialists for interpretation of Part 11 issues, the project leader for the whole project,
and sub-project leaders for the six areas formed a forum for coordination and common strategies.
Within each of the six project areas, the system-specific projects had a project leader, system owner (who is usually the
manager of the department or unit using the system), QA representative, and IT support.
Figure 1 shows the members of the laboratory project team, which is typical of all six area teams.
Common interpretation and quality system. In addition to management commitment, another key issue for ER/ES compliance is reaching a consensus on the interpretation
of Part 11 and updating the quality system SOPs accordingly. A corporate compliance toolkit was used, which included AstraZeneca's
international guidelines for the interpretation of 21 CFR Part 11 (written by the corporate project experts) and a corresponding
ER/ES training package.
Figure 2: Strategy to Upgrade Existing Systems
|
The corporate toolkit contributed to the assurance of common interpretation, work practices, and compliance documentation
throughout the company. It also included templates for documenting system-specific gap analyses, infrastructure gap analyses,
corrective action plans, site action plans, and close-out assessments. To include ER/ES requirements for new systems, a job
aid for user-requirements specifications was introduced, as well as reporting and follow-up templates.
Information and training. Communication was key to promoting the importance of the ongoing ER/ES project, as well as fostering a common interpretation
of the regulations. To draw attention and gain commitment to the ER/ES project within the organization, meetings with system
owners, their managers, and project leaders were held; e-mail and intranet and ER/ES websites also disseminated information.
For each significant phase of the ER/ES project (such as gap analyses, action plans, and new systems projects), the company
performed project-related training with hundreds of participants. This extensive training effort resulted in a better understanding
of the project's compliance goals throughout the organization.
To assure ongoing compliance, AstraZeneca established a job function-related training program, now part of the company's ongoing
GMP training. This modular program includes basic training for all personnel and a higher level of training for QA personnel,
project leaders, and system owners. A similar model for training is described in the Good Electronic Records Management (GERM)
Guidance for Part 11 by ISPE and the Parenteral Drug Association.3
Strategy for Compliance of Existing systems One of the key tasks of the site-specific ER/ES project was to bring existing systems into compliance. The company's strategy
for existing systems, see Figure 2, was very similar to the model described for Part 11 by the GAMP guidance.2 This strategy was followed for all project areas.
Figure 3: Map of QC Laboratory Systems for Data Handling
|
System inventory and classification. The ER/ES project group made an inventory of all equipment and systems at the site that could be affected by Part 11. The
responsible IT department managed the inventory for IT-infrastructure components. Then, systems were classified by whether
they fell under the scope of Part 11 according to the company's current corporate interpretation.
Gap analyses and corrective action plans. Gap analyses for ER/ES systems were performed according to templates similar to those given in the GAMP Part 11 Guidance.2 Corrective action plans summarized the gap analysis results for individual systems and corresponding IT infrastructure. In
some cases, this resulted in immediate action towards compliance, including both procedural and technical measures for urgent
problems or gaps.
System owners were responsible for their systems and for approving all resulting documentation. To maintain the same interpretation
throughout the organization, the ER/ES ambassador and a QA representative also approved all critical documents such as gap
analyses, corrective action plans, and exemption documents (for systems out of scope of Part 11).
