Siegfried Schmitt, PhD, is principal consultant withÂ PAREXEL, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q: In light of the COVID-19 pandemic, many of our planned on-site audits can no longer be performed for the foreseeable future, and there is a need to replace these by remote (desktop) audits. Under what circumstances can such remote audits be considered equivalent to on-site audits?

	A: Regulatory agencies around the world are facing the same challenge of deciding when inspections can be performed remotely and when they must be performed in person. Each respective agency has its own guidelines, but across the board, they all rely on the fundamental principle of a risk-based approach to compliance.

	In April 2020, the European Medicines Agency (EMA) updated its guidelines to allow for quality personnel to conduct remote audits when on-site audits are not possible, noting that, “… on-site audits as well as remote audits can be considered, after agreement with the investigator and if the audits are assessed as essential, e.g., triggered audits with the purpose of investigating serious deviations from the trial protocol or from the applicable legislation” (1).

	Similarly, FDA announced postponement of both foreign and domestic inspections, except those deemed mission critical, and the agency is now relying on off-site monitoring and the commitment of companies to quality in the absence of in-person regulatory oversight. For medical devices, FDA has published a “Remote Auditing Pilot Program” document outlining a voluntary pilot program for remote auditing of processes, the Medical Device Single Audit Program (MDSAP) as part of the audit of a medical device organization (2). An important aspect of this pilot is the use of technology that facilitates remote audits, including:

		Web-based meeting systems with screen sharing capability

		Teleconferencing in conjunction with e-mail

		Smart glasses or optical mounted head displays

		Remote ‘read only’ access to automated systems, such as electronic quality management systems (e.g., to view standard operating procedures [SOPs], deviations, electronic batch records, video recordings from the operational area, etc.).

As part of the audit preparation, it is important to ensure that all involved parties have suitable and compatible technological means in place, as tools and technology vary considerably across organizations. It is recommended to prepare a checklist with minimum requirements, such as Internet upload and download speeds, for each technology, and to share this checklist in advance with the sites to be audited.

	It is also important to consider in advance not only the feasibility of each type of audit, but its respective benefits and limitations. 

provides an example for such a comparison. Whichever audit model is selected, it should be based on a documented risk assessment, and standard audit procedures should be developed in advance of the audit.

	1. EMA, “Update to Guidance on Regulatory Expectations in the Context of COVID-19 Pandemic,” Press Release, April 20, 2020.
	2. FDA, Medical Device Single Audit Program (MDSAP), 


	Vol. 33, No. 7
	July 2020
	Pages: 50, 49

	When referring to this article, please cite it as S. Schmitt, “Performing Remote Audits During the Pandemic,” 

Articles

It is important to consider the feasibility, benefits, and limitations of each type of audit in advance.

Performing Remote Audits During the Pandemic

Q. While working on a variety of projects in three different continents, I had the opportunity to meet and work with young, enthusiastic newcomers to the industry. They were from a variety of different professional backgrounds, including pharmacists, engineers, and chemists. During our conversations, most of them asked the following types of questions:

The college or university I graduated from did not provide courses on compliance or industrial operations-how can I fill this gap?

Though I applied for many positions, I have been unable to find a permanent position yet-how can I improve my chances?

On the Internet, I found several courses on good manufacturing practices (GMPs), for compliance experts, or similar. These are relatively expensive. Are they worth investing for someone like me (a beginner)?

Should I work my way up within a particular department or would it be better if I gain experience in different departments?

	A. The following are not exhaustive or the only answers to these questions, but they will give some insight.

	It is true that few graduates have seen industrial operations by the time they graduate, but that doesn’t mean that they don’t come equipped with many of the basic skills needed in the industry, such as team working, presentation skills, analytical thinking, and the ability to self-study. Companies will provide training, as a minimum on the applicable and relevant internal processes and procedures, which will cover both the operations and the compliance side of the business. A lot will be learning on the job, from peers and often also from mentors.

	Finding your first permanent job can be a frustrating experience, but persistence usually pays off. Gaining experience through temporary voluntary engagements, placements, or positions is what helps improve the chances for long-term or permanent employment. And don’t forget to network through portals such as LinkedIn, Bing, or similar sites that have a good reputation with industry and job agencies. Also, it’s important to write a succinct and well-thought-out curriculum vitae, and there is a lot of great advice available for free online on how to do this. The Internet is the place to research jobs, but often also for potential employers to find the right candidate.

	Having a better understanding about compliance will surely be of benefit, whether looking for a job or for furthering one’s career prospects. Whether you are lucky enough to have your employer pay for external courses, be subsidized (e.g., by a state job center), or have to pay yourself, in all cases you should scrutinize the courses offered:

		How relevant are they to your current or prospective work?

		Do they provide references? Is there feedback available?

		Are the certificates merely proof of attendance or are they widely recognized by the industry?

		Is it just classroom learning or is there also a practical element?

		Do they provide comprehensive documentation?

	The answers to these questions will help you determine if the course is right for you. For example, if you want to become a certified auditor (be it for GMP or ISO 9001), you will have to pay for a course with an approved training company. If however, you want to get a basic understanding of the freeze-drying process, you will easily find free tutorials online. Should you need hands-on experience, then training courses offered by universities or industry associations with in-house training centers will be the right choice.

	What if you have been in the industry for a while, but would like to change positions and/or area of expertise? Very often this is less of a question of opportunity, but more of a question of an individual’s preferences. There are equally excellent subject matter experts who never strayed from their vocation (say regulatory affairs, quality control, or manufacturing) and who are perfectly happy in their jobs, and there are those who worked in different departments to become more universal experts. Pharmaceutical companies probably look more for experts in a particular subject, whereas service providers, such as consultancies or contract research organizations, may have a need for experts with more varied backgrounds.

	We may not always find the job we want, but we can always learn from what we do, and it will always be a beneficial personal and job experience.

	When referring to this article, please cite it as S. Schmitt, "Starting a Career in the Bio/Pharmaceutical Industry," 

Having a better understanding about compliance will be of benefit when looking for a job or for furthering one’s career, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.


Starting a Career in the Bio/Pharmaceutical Industry

Q. I work in my company’s quality department. What are some best practices for handling process or product changes?

	A. In December 2019, the Pharmaceutical Inspection Co-operation Scheme (PIC/S) published a recommendation, ‘How to Evaluate/Demonstrate the Effectiveness of a Pharmaceutical Quality System in relation to Risk-based Change Management’ (1) and a Concept Note on this Recommendation document (2). This action highlights two critical aspects, namely the importance of change management within the realm of quality and the necessity to apply a risk-based approach.

	Nothing stands still; therefore, change is inevitable. Though the PIC/S document covers all relevant steps in the change management process-from change proposal, change assessment, change planning and implementation, through to change review and effectiveness checks-it does not detail categories of change. It merely states, ‘Change categorizations are appropriate and based on the level of risk’ (1).

	In practice, the following are three typical categories of change:

		Planned changes: Someone wishes to make a change for whatever reason and applies to make this change. This change, if approved, will be implemented, its effectiveness verified, and it becomes permanent.

		Temporary changes: Sometimes, someone wishes to make changes for a defined period of time followed by a return to the previous state. This could be because there is the need for some building work, or because of staff shortages, or other reasons.  Again, it is known that someone wants to make this change. If approved, it will be implemented for the desired period and then all goes back to as it was before. Some companies use the term ‘planned deviations,’ which is synonymous with ‘temporary changes.’

		Emergency changes: Rarely, an organization may have to implement emergency changes. Here, nobody knew that this change would be required, so there is no planning. Perhaps there is not even time for approval before the change is being implemented. Almost always, this type of change is triggered by an event that endangers environment, health, or safety. In short, an emergency change is triggered by a deviation. Perhaps a gas pipe develops a leak; the line must be immediately shut down and work perhaps continues with gas cylinders. As soon as possible, the change needs to be properly assessed and a decision must be made; this will either become a temporary change or a permanent change. To emphasise, the only difference here is that you cannot plan for it.

	Looking at these scenarios, one finds that the starting point can differ (either a change request or a deviation). The end point may also differ; one may end up in a new state (permanent change) or back where it all started from (temporary change). The pathways for these change categories are shown in the flow chart (

). This flow chart needs to be amended as necessary, to reflect the specific processes and procedures within each company. Just make sure, you comply with all the relevant requirements in the regulations, as summarized in the PIC/S document.

	1. PIC/S, “Recommendation, How to Evaluate/Demonstrate the Effectiveness of a Pharmaceutical Quality System in relation to Risk-based Change Management,” Nov. 28, 2019.
	2. PIC/S, “Concept Note on a Document prepared by the PIC/S QRM Expert Circle on ‘How to Evaluate/Demonstrate the Effectiveness of a Pharmaceutical Quality System in relation to Risk-based Change Management’,” Oct. 7, 2019.

	When referring to this article, please cite it as S. Schmitt, "Embracing Change Management," 

No matter why change may be needed, it is important to comply with all the relevant regulatory requirements, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.

Embracing Change Management

Q. In a recent audit, we were asked about the meaning of the signatures on our controlled documents. Our reply was that it clearly states that the signatories are either authors, reviewers, or approvers. The auditor considered our response insufficient, pointing out that we often have up to 10 reviewers. Though the names and titles of these are given, their review responsibilities are not defined or described. We are unclear how to make the meaning of the signatures more precise.

	A. The regulations do not provide much detail with regards to your question. For example, the European Union guidelines (1) require, “Documents containing instructions should be approved, signed, and dated by appropriate and authorised persons.” The US regulations are a little bit more specific in 21 

) Part 11 (2) regarding the signing of electronic records and state, “This information must include the printed name of the signer, the date and time when the signature was executed, 

 [emphasis added] (such as review, approval, responsibility, and authorship) associated with the signature.”

	The question is whether the meaning of the signatures in your documents is clear enough and unambiguous. Let us look at an example, such as a cleaning standard operating procedure (SOP) for manufacturing equipment. An author, most likely a member of the operations team, prepares the document. There will be several reviewers, possibly including manufacturing, engineering, validation, quality unit, regulatory affairs, and health and safety. These reviewers will each have a different perspective from which they perform their review.

	One could argue that the role and the associated job description define sufficiently what a reviewer has to do. In theory, yes; but in practice this is often not the case. Therefore, companies typically apply one of two approaches: either define the controlled documents review and approval responsibilities in a document (e.g., the SOP for SOPs) or add the meaning to each signature in the signature list.

 is an example of such a review responsibilities matrix.

	If we apply this to the cleaning SOP example, we would expect:

		The operators to check if the instructions can actually be performed (technical feasibility)

		Managers in manufacturing to check the functional correctness of the cleaning procedures (e.g., cross-reference cleaning validation reports) and to verify that the instructions are clear and logical

		The validation team to verify that the cleaning procedures are in concurrence with previously executed cleaning validations

		The quality unit to ensure that the document uses the correct template and format, that the procedure meets regulatory requirements, and that any related change controls or audit/inspection commitments have been met

		The regulatory affairs department to confirm that the procedure is in concurrence with the manufacturing licenses

		The health and safety executive to check that all required safety precautions are applied, for example, where flammable or corrosive solvents are used.

	In summary, it is good industry practice to clarify the precise remit for each of the reviewers of a controlled document, rather than just apply the general term of ‘reviewer.’ This does not have to be as difficult as the example herein.

	And finally: are you still sure you need up to 10 reviewers?

EudraLex Vol. 4 Part I Chapter 4 Documentation

.
	2. Electronic Records; Electronic Signatures, 


	Vol. 32, No. 11
	November 2019
	Page: 54-53

	When referring to this article, please cite it as S. Schmitt, "Signatures–What’s in a Name?," 

It is good industry practice to clarify the precise remit for each of the reviewers of a 
controlled document, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.


Author | Siegfried Schmitt

Articles

Performing Remote Audits During the Pandemic

Starting a Career in the Bio/Pharmaceutical Industry

Embracing Change Management

Signatures–What’s in a Name?