The methods used in most microbiological test laboratories originated in the laboratories of Koch, Lister, and Pasteur. As such, they are very old, typically over a hundred years. While numerous changes have occurred in the chemistry laboratory, there have been limited improvements in methods used for microbiological testing. In the past decade, the focus of many researchers has been the study and implementation of improved methods for the isolation, early detection, characterization, and enumeration of microorganisms and their products. In common language, this translates to better methods, automated methods, miniaturized methods, and methods that require less time or expense.  

All of these methods are collectively grouped into the category of rapid microbiological methods (RMM). In some compendia, these are also called alternative microbiological methods. The methods range from simple dip-stick-type tests to very complex automated systems that perform a variety of tests using a variety of techniques. The prices for these methods vary greatly, from a few dollars to hundreds of thousands of dollars. Although these methods are called rapid microbiological methods, many have their roots in other sciences, e.g., chemistry, molecular biology, biochemistry, immunology, immunochemistry, molecular electronics, and computer-aided imaging. 

Rapid microbiological methods provide significant opportunities for pharmaceutical companies to obtain data that may be significantly better than that obtained via traditional methods, may be more cost effective, may provide marketing advantages, and may allow for coordinated process analytical technologies to be fully integrated within a facility.  

While science moved forward in developing new microbiological methods, industry was slow to accept and implement these methods. One of the greatest concerns was that regulators would not recognize these methods as superior to traditional ones. Another concern was that companies would not be allowed to change test limits based upon the test method — i.e., they would use a superior method that was likely to detect more organisms, and they would not be allowed to adjust limits to accommodate the sensitivity of the new method. A further concern was that the first company to submit a new technology for regulatory approval would have a much more difficult time obtaining approval than companies that submitted later.  

In recent years, a variety of documents has been issued or drafted to help the microbiologist select, purchase, implement, and regulate the submission of rapid microbiological methods.  We discuss six. 

Parenteral Drug Association Technical Report Number 33

The Parenteral Drug Association (PDA) was one of the first organizations to develop guidance for evaluating, implementing, and validating rapid microbiological methods. Guidance information was published as Technical Report 33 (PDA TR No 33).

  This document was developed by a committee of individuals from industry, regulatory agencies, compendial groups, and instrument vendors. This guidance provided definitions, in microbiological terms, for validation criteria similar to the information in 

 Proposed Chapter <1223> on Alternative Microbiological Methods Validation

The USP proposed a draft monograph <1223>, Validation of Alternative Microbiological Methods, which defines various validation criteria that may be used for rapid microbiological methods and defines these criteria in terms of microbiology. Additionally, the proposal identifies how to determine which criteria apply to different technologies, based on the type of testing being performed.

FDA has initiated a program to modernize requirements for pharmaceutical manufacturing and quality. This modernization includes several objectives: encouraging early adoption of new technologies; facilitating industry application of modern quality-management technologies;  encouraging implementation of risk-based approaches in critical areas; ensuring that policies for review of a submission, compliance, and facilities inspection are based on state-of-the-art technologies; and enhancing the consistency and coordination of FDA regulatory programs. This program resulted in the 2004 initiative, 

Pharmaceutical cGMPs [current Good Manufacturing Practices] for the 21st Century — A Risk-Based Approach

FDA's 2004 Guidance on Aseptic Processing

In 2004, the FDA published a guidance document on aseptic processing of pharmaceutical products. This document includes the following provision for the use of alternative microbiological test methods:  

"Other suitable microbiological test methods (e.g., rapid test methods) can be considered for environmental monitoring, in-process control testing, and finished product release testing after it is demonstrated that the methods are equivalent or better than traditional methods (e.g., USP)."

 This was one of the first regulatory documents that specifically recognized the potential use of alternative rapid microbiological methods.

The concept of process analytical technologies (PAT) is described in the FDA's 

Guidance for Industry: PAT — A Framework for Innovative Pharmaceutical Development, Manufacture, and Quality Assurance

. PAT is defined in this document as:  "Systems for analysis and control of manufacturing processes based on timely measurements, during processing, of critical quality parameters and performance attributes of raw and in-process materials and processes to assure acceptable end product quality at the completion of the processes."

  Rather than relying on finished-product testing, PAT allows manufacturers to use faster, more accurate test methods capable of producing real-time or near-real-time data for process control. Traditional microbiological test methods usually cannot deliver real-time or near-real-time results, making them unsuitable for PAT applications. Nonetheless, RMMs were included as PAT applications by the FDA PAT subcommittee in October 2002, following representation from industry practitioners. 

 Table 1.  Applications of Rapid Microbiological Methods			

PHARMEUROPA, the official forum for communicating general policies of the European Pharmacopoeia, published a draft chapter 5.1.6. "Alternative Methods for Control of Microbiological Quality" in 2004. This chapter provides an overview of some of the RMMs available and potentially applicable to pharmaceutical processes, and describes how they may be used for microbiological control of products and processes. This chapter also provides guidance regarding how to choose an appropriate methodology and how to validate the method.

In most cases, the definition of PAT includes collecting real-time data, typically in-line, to make decisions about product quality early in the production process. Although there have been great advances in RMMs in the past few years, most methods developed to date are still conducted on the laboratory bench, off-line, i.e., samples are collected and taken to a laboratory for testing. While this may not be as advantageous as many of the chemistry applications developed, it is a significant improvement over traditional microbiological methods, because results may now be available in hours to a few days — instead of days or weeks. As a result, implementing these methods makes it possible to achieve many of the savings available from other systems. 

Classical microbiological test methods frequently are divided into three general categories, based on the test function performed. These categories are: presence or absence of microorganisms (e.g., pathogen detection, absence of objectionable organisms, sterility testing), enumeration of microorganisms (e.g., bioburden testing); and identification of microorganisms. This classification answers three specific questions:  "Is something there?" (presence or absence); "How much is there?" (enumeration); and "What is there?" (identification). 

Table 1. (continued) Applications of Rapid Microbiological Methods 			

Classification systems for rapid methods are based on how the technology works: methods that measure the growth of microorganisms; methods that determine the viability of microorganisms; methods that detect the presence or absence of cellular components or artifacts; nucleic acid methods; traditional methods combined with computer-aided imaging; and combination methods. 

These methods are based on the measurement of biochemical or physiological parameters that reflect the growth of the microorganisms. Examples of these types of methods include:  adenosine triphosphate (ATP) bioluminescence, colorimetric detection of carbon dioxide production, measurement of change in head space pressure, impedance, and biochemical assays.  

These types of technologies do not require microorganism growth for detection. Varying methods are used to determine if the cell is viable, and if viable cells are detected, they can be enumerated. Examples of this type of technology include solid-phase and flow fluorescence cytometry. 

Cellular-component or Artifact-based Technologies.

 These technologies look for a specific cellular component or artifact within the cell for detection or identification. Examples of these systems include: fatty acid profiles, mass spectrometry (i.e., Matrix Assisted Desorption Ionized-Time of Flight, MALDI-TOF), enzyme linked immunosorbent assay (ELISA), fluorescent probe detection, and bacterial endotoxin-limulus amebocyte lysate testing (LAL). 

These technologies use nucleic acid methods as the basis for operation. Examples of this type of technology include:  deoxyribonucleic acid (DNA) probes, ribotyping/molecular typing, and polymerase chain reaction (PCR). 

Traditional Methods with Computer-aided Imaging.

 This approach involves using a classical method for most of the processing of a sample, and then using imaging software to detect the growth earlier than methods requiring visual growth detection. In most cases, detection of growth using human vision typically requires growth of 10

  cells. Computer-aided imaging can detect much lower levels of cellular growth, e.g., less than 100 cells. 

 This term is used to describe those systems that involve more than one methodology or test to achieve a final result, e.g., a system that tells whether an organism is present and is also capable of identifying the microorganism. 

Adenosine Tri-Phosphate (ATP) Bioluminescence

 ATP is present in all living cells. In the presence of the substrate D-luciferin, oxygen, and magnesium ions, the enzyme luciferase will use the energy from ATP to oxidize D-luciferin and produce light. The amount of light or bioluminescence produced can be measured by sensitive luminometers, and is proportional to the amount of ATP in the sample. The emitted light is usually expressed as relative light units (RLU) rather than as direct estimates of microbial numbers. Vendors of these technologies have conducted studies to show the correlation between RLU readings and approximate number of organisms. These standard curves are used to translate the raw RLU data to more meaningful organism-quantification data. ATP bioluminescence reduces the test time required in the traditional method by approximately one-third. ATP bioluminescence can be used to screen both filterable and non-filterable samples.  

PallCheck (Pall Life Sciences), Milliflex (Millipore Corporation), Rapiscreen (Celsis), and novaLUM (Charm). Hygiena also has a small hand-held luminometer. 

The majority of ATP-based systems are quantitative. The capability of these instruments can be enhanced by using the microbiology application of most probable number techniques.  

: Adenylate kinase is a cellular component that allows for microbial detection. The adenylate kinase released from cells reacts with ADP to form ATP. The ATP is detected using an ATP bioluminescence method. Using these technologies significantly lowers the level of detection for the system. The assay has a detection level of about 34 cells. The detection level can be further reduced (to about four cells) by extending the incubation for ATP generation time.

Articles

Peer-Reviewed Research

PAT can be defined as a collection of real-time data in-line to make decisions about product quality early in the production process.

Rapid Microbiological Methods and the PAT Initiative

The use of disposable cell culture systems for the manufacturing of biological products in mammalian cells is advantageous because it facilitates minimization of necessary validation efforts, as well as circumvention of up-front sterilization and subsequent cleaning steps.  For research-scale applications, culture systems typically used are tissue culture flasks, roller bottles, or spinner bottles, and 1 to 50 mg of proteins in total volumes up to 2 L are produced (Table 1). In biopharmaceutical development or for manufacturing of antibody-based diagnostics, a scale-up of production to reach protein yields of 50 to 1,000 mg is often necessary. To meet these increased protein yields, two alternative routes might be considered. Either increase the culture volume, or switch to a technology that yields product in a more concentrated form. 

For volume scale-up, increasing the number of cell-culture disposables is cumbersome because handling-time and space requirements increase accordingly, inevitably resulting in higher manufacturing costs. A more economic solution is provided by bag-based disposable systems,  available in working volumes of up to 500 L, providing an alternative to stainless steel bioreactors. However, working with bag-based bioreactors requires capital investment in specific equipment and trained personnel. 

Another possibility is to use disposable two-compartment bioreactors that allow production of recombinant proteins in a highly concentrated form. The two-compartment technology has been widely adopted in recent years as it does not require any additional investment in specific equipment and can be easily handled by staff experienced with standard cell-culture systems.  

The first part of this article describes two-compartment cell cultivation, for readers unfamiliar with it. Part two presents a cost analysis for production of monoclonal antibodies (MAbs) using two-compartment technology that many laboratories have successfully employed for production of MAbs in the milligram-to-gram range. The production costs associated with the most widely used two-compartment system are compared to the costs of conventional production with roller bottles or with a stirred bioreactor. The data presented are based on results obtained from in-house experiments at INTEGRA Biosciences AG, from customer surveys, and supported by figures from published literature. 

In its simplest form, two-compartment cultivation occurs when cells grow inside dialysis tubing placed in a culture bottle filled with medium. Because of the semi-permeable properties of the tubing, small nutrient molecules such as glucose or glutamine can freely diffuse to the cells, while toxic catabolites are continuously removed from the cells by diffusion in the opposite direction. Trapped inside the tubing, the cells are optimally supported and can grow to high densities. 

The first commercially available two-compartment systems were hollow fiber bioreactors (HFBs), based on a bundle of hollow fibers embedded in a disposable plastic cartridge. The culture medium is continuously perfused through the hollow fibers while the cells reside in the space surrounding the fibers. The walls of the hollow fibers are semi-permeable like a dialysis membrane so nutrients and metabolic waste products can freely diffuse to and from the cells. HFBs require specific equipment, consisting of a pump to maintain medium flow and provide gas exchange. An overview of HFBs was given by Jackson, Trudel, and Lipman in 1999, but several  systems they described have disappeared from the market as they proved too expensive and too cumbersome to use.

  This was especially true for a production scale smaller than one gram, whereas HFBs are still used for a higher scale (Table 1). 

Small-scale HFBs have been displaced by membrane-based two-compartment systems, which have proven to be more cost effective and simpler to use. Currently, two systems are available: the two-compartment roller bottle miniPERM (designed by the German-based In Vitro Systems & Services GmbH) and the static flask CELLine (INTEGRA Biosciences AG, Switzerland).

  As shown in Figure 1, the core element of the CELLine system is the cell compartment, which is formed by two different membranes incorporated into the bottom of the cell-culture flask. The upper membrane separates the cell compartment from the medium compartment and is made of a semi-permeable cellulose acetate sheet for exchange of metabolites between the two compartments. The lower membrane is made of gas-permeable silicone and guarantees efficient oxygen and CO

 transfer between the cell compartment and the incubator. Because the cell compartment is only 2 to 3 mm thick, efficient oxygenation is achieved by simple diffusion, hence avoiding the need for agitation and the resulting detrimental shear stress. 

Table 1.  Comparison of Different Disposable Cell Culture Systems for MAb Production (Modified after McArdle4)			

As illustrated in Figure 1, cells and the secreted expressed proteins accumulate in the cell compartment,  located at the bottom of the flask,  separated from the medium compartment by a dialysis membrane, indicated by a line of dashes (---) in the diagram. Nutrients smaller than 10 kDa freely diffuse through this dialysis membrane, thereby sustaining cell growth. Similarly, but in the opposite direction, toxic catabolites cross the dialysis membrane and are removed from the cells' surroundings. Efficient gas exchange takes place through the gas-permeable silicone bottom of the cell compartment membrane, indicated by a line of dots (Â·Â·Â·) in the diagram. 

Due to the high reaction specificity of MAbs, the production scale necessary for research and development applications, for 

 diagnostics, or for quality control purposes does usually not exceed 1,000 mg. In the comparative analysis presented here and summarized in Table 2, we consider the costs arising during production of 200 mg MAbs using either a CELLine 1000 or conventional non-compartmentalized systems (roller bottles and a stirred bioreactor). Different production parameters need to be defined according to the required yield and to the culture system used (listed in the upper section of Table 2). The production process depends on productivity of the  hybridoma clone used, i.e., on the amount of MAb produced per mL culture supernatant. In conventional cultivation systems, the maximal hybridoma density achieved is approximately 10

  cells/mL, and typical productivity values found in the literature  are 0.01 to 0.05 mg/mL.

  It must be noted that productivity can be considerably inferior when using a "low secretor" clone, as is often the case when productivity is not considered during clone selection. The other parameter influencing the production process is the volume of produced supernatant. Concerning the roller bottle and the stirred bioreactor, a supernatant volume of 300 mL and 5,000 mL per culture vessel has been defined, respectively. When assuming a productivity of 0.04 mg/mL and a batch culture protocol (i.e., one harvest per cultivation vessel), the volume of supernatant required to yield 200 mg MAb amounts to 5 L, which requires the use of 17 roller bottles or one bioreactor run. 

Figure 1.  Schematic Representation of the Two-Compartment Set-up in a CELLine 1000 Bioreactor 			

The cell density achieved in a CELLine bioreactor is typically 1 to 2 orders of magnitude higher than in a conventional culture vessel, due to the optimized culture conditions described earlier. Consequently the product concentration also increases by a factor in the range of 10 to 100. In the case of hybridomas, densities of 10

  cells/mL and MAb concentrations between 1 and 2 mg/mL are achieved.

  The volume of supernatant produced with CELLine corresponds to the cell compartment volume (20 mL) where the secreted MAb remains trapped.  

Another important parameter to consider is the duration of cultivation determining the number of times supernatant can be harvested. Cells are cultivated for an extended time period in CELLine (10 weeks or  more), and the supernatant is harvested weekly. When a productivity of 1.5 mg/mL is assumed and 20 mL of supernatant are harvested weekly from the cell compartment of one CELLine, seven harvests are necessary to produce 200 mg of MAb. Because 1.0 L of medium is exchanged weekly in its compartment, the total medium consumption is 7.0 L for this compartment, plus 140 mL for the cell compartment. 

Production costs listed in the second section of Table 2 were calculated according to these parameters and are subdivided into expenses for disposables, equipment amortization, medium, serum, and labor. With regards to disposable costs, a bioreactor is relatively expensive. However, similarly high are the expenses estimated for the purchase of 17 roller bottles. Concerning equipment costs, standard cell culture laboratory equipment (such as incubator and microscope) has not been considered because this equipment is required regardless which culture system used. When using CELLine, no additional equipment is needed, whereas amortization costs accrue for the roller apparatus and the stirred bioreactor. To calculate  costs, a depreciation period of five years and an average number of 30 production runs per year have been assumed, so with an initial investment of €3,000  (approximately $3,700) for the roller apparatus and €20,000  (approximately $24,668) for the stirred bioreactor, amortization costs per run are €20 and €133.3 (approximately $25 and $164), respectively. 

Regarding medium costs, the use of CELLine involves consumption and consequently costs that are approximately 40 percent higher than conventional systems. Significantly less serum is necessary because most growth-stimulating components in serum are too large to diffuse through the semi-permeable membrane and it is common practice to supplement only the cell compartment with serum and to reduce or completely omit serum supplementation of the medium compartment.

  A one percent serum supplementation of the medium in the medium compartment (70 mL serum) has been assumed, because this is often done to reduce osmotic pressure generated by unequal supplementation of the two compartments. Assuming a 10 percent serum supplementation of the medium in the cell compartment, an additional 14 mL of serum is necessary for CELLine, resulting in a total consumption of 84 mL serum. This represents a six-fold reduction of serum consumption (and costs) when compared to the 500 mL serum needed for non-compartmentalized systems. 

Table 2.  Cost Analysis in Euros for Production of 200 mg of MAb Using CELLine or Conventional One-Compartment Systems			

To calculate labor costs, a wage of €40/hr (approximately $49.33/hr) has been assumed, and the handling time for inoculation and supernatant harvesting has been estimated based on the feedback of different users. The time necessary for handling CELLine amounts to 20 min per bioreactor and harvest, the handling of one roller bottle requires 15 min, and the use of the stirred bioreactor, including cleaning and sterilization, is estimated to require a total of eight hr. Despite the fact that the handling time for one roller bottle is 25 percent lower than for one CELLine, the larger number of bottles requires a total handling time of 265 min, or nearly twice as much as  for seven CELLine harvests (140 min). 

Further cost savings are possible during downstream processing of the product. Owing to the high concentration of the produced MAb, concentrating it prior to purification is not necessary. Depending on the application of the MAb, purification might be omitted as well, because the MAb purity, i.e., the ratio of MAb to contaminants, is much higher than the purity of MAbs produced with conventional systems. 

According to the analysis presented here, total production costs are lowest when CELLine is used (€1.5/mg MAb, or approximately $1.85/mg MAb), and they increase by 60 percent when using roller bottles (€2.4/mg MAb, or approximately $2.96/mg MAb), primarily resulting from higher expenses for serum and labor. The production with a stirred bioreactor further augments the costs, due to additional labor and to equipment amortization. It should be noted, however, that costs depend on the amount of MAb produced: for small amounts (less than 50 mg) the difference between roller bottles and CELLine is small and economic considerations are less relevant. For larger amounts (greater than 1 g), the use of a stirred bioreactor becomes competitive and represents an alternative to CELLine. 

The CELLine bioreactor combines the advantages of high cell densities achieved in two-compartment systems with the ease of use typical of a standard tissue culture flask, resulting in economically efficient biomanufacturing on a small to medium scale. The presented benefits of MAb production with CELLine also apply to the manufacturing of other biological products such as recombinant proteins and viral vectors, so that any laboratory with basic cell culture expertise can produce highly concentrated, high-quality proteins for research or diagnostic purposes in a cost-efficient way.

  is product manager for cell cultivation at 

, Schonbühlstr.  8, CH - 7000 Chur, Switzerland,  phone:  +41 (0)81.286.95.30, Fax: +41(0)81.286.95.33, 		

1. Jackson LR, Trudel LJ, Lipman NS. Small scale monoclonal antibody production in vitro: methods and resources. 

2. Trebak M, Chong JM, Herlyn D, Speicher DW. Efficient laboratory-scale production of monoclonal antibodies using membrane-based high-density cell culture technology. 

3. Bruce MP, Boyd V, Duch C, White JR. Dialysis-based bioreactor systems for the production of monoclonal antibodies — alternatives to ascites production in mice. 

4. McArdle J. Report of the workshop on monoclonal antibodies). ATLA. 2004; 32 (suppl 1):119-122. 

5. Mittermaier J, Zang-Gandor MO. Long-term high level protein expression in adherent, protein-free growing BHK cells using INTEGRA CELLine adhere 1000 bio-reactor flasks. 

6. Docagne F, Colloc'h N, Bougueret V, et al. A soluble transforming growth factor-beta (TGF-beta) type I receptor mimics TGF-beta responses. 

7. Matsumoto I, Studer A. Continuous recombinant protein production in baculovirus infected SF9 cells using CELLine classic 1000 two-compartment bioreactors. 2004. Available at: 

www.integra-biosciences.com/celline_7_e.html

Featured Article

The cell density achieved in a CELLine bioreactor is typically 1 to 2 orders of magnitude higher than in a conventional culture vessel

Small-scale Biomanufacturing Benefits from Disposable Bioreactors

The adoption of open networks in manufacturing environments, and the expanding connectivity and decentralization of computer systems and databases, are making the need to secure a company's automation and production systems more important than ever. The direct linking of manufacturing systems to information systems through the presence of Ethernet on the factory-floor creates an environment where traditional information technology (IT) and manufacturing worlds collide. This trend increases the vulnerability of these systems to the same security threats facing today's IT environments. Attacks — whether direct or indirect — from hackers, worms, viruses, and employees can affect the safety and security of people, products, processes, and productivity.  

With increasing pressure from consumers and government bodies to ensure product authenticity and safety, life sciences companies need to consider security solutions that help them maintain regulatory requirements and also protect their manufacturing processes. One way companies can ensure their operations and systems are completely secure, is by staying educated and up-to-date on existing and emerging security threats to their facilities and developing a detailed and comprehensive plan of action similar to the one described in this article.  

Though most manufacturers acknowledge that threats exist, it is difficult for them to determine just how vulnerable their systems are and what measures can improve factory floor security. An ARC Advisory Group report states that 92 percent of manufacturers claim plant security is of the utmost importance.

  However, only 3.6 percent state that their facility is "completely secure," meaning they are satisfied with precautions taken to protect assets from internal and external threats. 

While the need to improve the security of manufacturing control systems is an important issue across all industries, it is especially critical for the life sciences industry. With  millions of dollars invested in the research and development of a single product, one incident of counterfeiting or product tampering can have a significant impact on a company's bottom line.

  According to the International AntiCounterfeiting Coalition, counterfeiting pharmaceutical products has become a $350 billion per year problem.

  Criminal investigations of counterfeit drugs by the FDA has more than doubled in the last two years.

Concerns typically faced by IT managers — viruses, Trojan horses and phishing — combined with the threat of espionage keep plant-floor security managers awake at night. Viruses and Trojan horses can wreak havoc on computer systems and render them inoperable. Phishing relies on fake credibility to lure victims into revealing proprietary information based on the tendency to trust the security of a brand name. Personalized e-mails linked to legitimate-looking web sites inform recipients that their password or other vital information has been compromised, and urges them to click on the web link to update their profiles. The link takes the victims to a fake web site where any corporate or financial data entered are routed directly to the phisher. 

Figure 1. Defense Measures For Security and Data Protection			

Computer security practitioners define a specific threat facing every company as social engineering. It is the practice of obtaining confidential information by manipulation of legitimate users. Parties interested in stealing a company's proprietary information contact unsuspecting employees via telephone or the Internet to request specific information. These scammers are looking to find anyone who might divulge  information about a product or production process. If combined with other bits of information gathered from other unsuspecting employees, this detail can provide them with valuable information about a drug's recipe or manufacturing process.  

Internal security breaches caused by employees may be more frightening than external threats. A cyber crime study by the Federal Bureau of Investigation and the Computer Security Institute released in 2000 found that 71 percent of security breaches were caused by individuals who worked within the organization.

  It was also discovered that the majority of internal disruptions are accidental and could easily have been prevented with better plant security policies in place. Whether it is an accident caused by an untrained employee programming a controller, or a disgruntled worker tampering with a maintenance system, current IT technologies designed to prevent outside attacks offer little protection.  

Life sciences companies focus on validating their systems to ensure  adherence to regulatory requirements. If manufacturing data are lost or don't meet validation requirements, The Food and Drug Administration (FDA) will shut down production, causing significant revenue loss. Validation is costly and time-consuming. As a result, many companies are reluctant to update technology or alter processes for security purposes. This reduces plant-floor security to less of a priority than validation. Compounding the problem is the faulty assumption by many that if a process is validated, it is also secure.  

A basic approach to developing a security program involves assessment, design, implementation, and maintenance. Common sense tells us that an effective security program requires knowing what to protect and how to protect it. Generally you only need to protect things that add value to your business and should only apply protection in proportion to the value of the item.  

Assemble a security team combining the IT and manufacturing departments and others who have a vested interest such as the chief information officer, chief security officer, and chief financial officer. Designate a security risk manager who will assume ownership and responsibility for implementing all four parts of the program.  

 At the outset, it is essential to understand the assets and vulnerabilities of a facility. Simply applying security technologies without understanding the risks provides little protection from internal or external threats. Identify valuable assets and examine possible weaknesses to help managers responsible for security understand what needs protection and where to focus security efforts. Security risk managers can then develop a clear plan to secure the facility after assessing the probability of a given threat, and determine the level of toleration for the identified risk.   

 Once the assessment is complete and assets and vulnerabilities are identified, managers can develop ways to reduce security risks to acceptable levels. This may involve a variety of risk mitigation technologies and processes, including limiting physical access to automation systems, assigning user names and passwords to all personnel, and tightening control of computers and software used on the automation network.  

 Managers can deploy risk reduction countermeasures for improved security after designing a risk mitigation strategy. This includes technology like firewalls, intrusion detection systems,  software for user authentication and authorization, and defined policies and procedures for plant personnel. Protect crucial systems with multiple defensive layers to guard against all identified threats. Once in place, validate the system and test it for known security vulnerabilities.  

 Ongoing maintenance is essential to a sound security strategy. This includes auditing, monitoring, and reevaluating the system on an ongoing basis to search for new, unidentified vulnerabilities. A key component of maintaining the security solution is implementing a business continuity and recovery program to respond to severe business interruptions. It is also critical to enforce all security policies and procedures involving management and plant floor personnel. An effective security program is only as strong as its weakest link. 

As plant-floor systems become increasingly interconnected to the rest of the enterprise, opportunities for external and internal security breaches increase. The outer layer of a company, normally protected by the IT domain, is essentially the outer fortress wall of the plant floor. This wall employs technologies such as firewalls and encryption to protect systems and data from unauthorized users (hackers and phishers).  

Within the fortress, companies also need to be concerned with intentional security attacks and accidental breaches from employees and partners. While IT protects a company's assets from external threats, control systems, user authentication, and role-based authorization help protect production assets and intellectual property from internal security breaches.  

Companies can protect information inside the perimeter by implementing role, location, and process-based authentication between inner and outer areas. Plant-floor technologies with built-in authentication make application of security much easier. Set up the enforcement along the lines of 

 — Would you want your human resource manager modifying a controller program or forcing an output? Depending on the roles established on the plant floor, engineers and technicians are probably the only employees who should have access to plant floor equipment, and they can be identified by name. We refer to this as role-based security

 — Would you want engineers forcing an output on a critical process from their office? More than likely, you want them close to the process, forced to go to the PC or panel attached locally so they could quickly ascertain whether they've done the right thing. We refer to this as location-based security.

 — If a technician were trained only on how to start up Production Line One, you wouldn't want him changing a program on Line Two. Although the line may be within sight, she does not have any responsibility or training on Line Two. Accidents caused by these types of oversights are commonplace on the plant floor. Isolating to this level is called process-based security 

Develop policies and procedures that will educate employees and define processes to further support your security program and offer the best return on investment. An addendum would be to enact appropriate policies and procedures with any third-party contract organizations. Make sure these organizations guarantee protection of your data and intellectual property as if they were their own. It is a good idea to seek the advice of security providers that have consultants available who can help customers plan and build effective strategies using security technologies and best practices available. 

Currently, no specific mandates for process control security measures in the life sciences industry exist. The closest thing to a mandate is FDA's 21 CFR Part 11 requirement, which defines parameters by which pharmaceutical companies can author, approve, store, and distribute electronic records.

It is recommended that security-risk managers and chief information officers in the life sciences industry get involved in organizations' standards committees, such as the Instrumentation, Systems and Automation Society to influence the direction for potential future government regulations.

				  Technical committees, such as the SP-99 (manufacturing and control systems security), are already paving the way for security standards.  

, 2100 Riverchase Center, Suite 210, Birmingham, AL 35244, 205.605.0125; fax 205.985.7233 		

1. Moore W, Slansky R, Hill R. The new world of manufacturing security. ARC Strategies 2003 August. 

2. Internally generated statistic at Rockwell Automation 2004. 

3. Toran MW. Industry risk report: The life sciences; industry consolidation, a challenging global economy, increasing federal regulations and fear of terrorism are creating new exposures for the pharmaceutical industry. How they address these exposures will have a significant impact on their bottom line. Risk and Insurance 2003 December. 

4. Vaczek D. FDA Praises advances on counterfeiting. Pharmaceutical & Medical Packaging News 2005 July:18. 

5. Stephanou T. Assessing and exploring the internal security of an organization. SANS Institute 2001 March. 

6. Code of Federal Regulations. Electronic Records; Electronic Signatures. 21 CFR Part 11. 2002. 

A 2000 cyber crime study revealed that 71 percent of security breaches were caused by people who worked within the company.

Securing Your Company's Manufacturing Data

The implementation of good quality electronic systems is challenging. In most organizations, business processes are entrenched, personnel are overworked, and financial resources are limited. Sometimes these organizations do not understand that aspects of their electronic environment are out of compliance or even worse, may even not realize the need for compliance.  

Today's networked, and web-enabled, biopharmaceutical environments demand data of the highest quality. Do not regard Good Laboratory Practice (GLP), Good Clinical Practice (GCP), and Good Manufacturing Practice (GMP), collectively known as GxP-related computer systems, as a collection of discrete technologies  solely supported by individual validation packages and a few SOPs. A company must think of its entire virtual, GxP-related environment as a process stream. This environment must have an entire quality system built around it to be able to meet the intricacies of the law and to be able to produce, manipulate, analyze, transfer, and store high-integrity data. 

This article is aimed at individuals working in GxP functional areas, like laboratories, clinical trials, clinical and commercial manufacturing, quality, supply chain, and the information technology (IT) organizations. An approach to utilize such thinking for  building compliance and quality into the readers' organizations will be outlined. This article will not define how to develop a 21 CFR Part 11 risk document; rather it will examine the context of Part 11 as an attribute of a larger, frequently over-looked, and extrinsic, quality system.

  We introduce a methodology to outline, assess, and document this virtual process stream and make recommendations on how to close compliance and quality gaps. 

The ubiquity of desktop computers with easy-to-use spreadsheets and databases, web-enabled technology, and high-speed networks has allowed many people to rely on these tools for their daily work. This evolution of technology in today's society has been a panacea, but has also made it easy for those working in regulated industries to implement computers into their work practices without forethought of the consequences. As a result, workers in FDA-regulated organizations have to keep up with technology changes while still ensuring that the safety, identity, strength, purity, and quality of the product, and ultimately consumer safety, are not detrimentally affected. These challenges apply equally to all individuals working in GxP functional business areas, not just  IT specialists. 

Many IT departments do not fully understand the requirements of the law, nor do they understand the impact that their work practices and decisions have upon the larger enterprise.  Business people are not likely to be aware of how their day-to-day practices impact the virtual environment and the data being produced. Both sides may be fooled into thinking that because they have implemented a validated computer system that they are in compliance with the law. This thinking is erroneous, because the days of stand-alone or isolated computer systems dedicated to one function are gone.  

The Food and Drug Administration (FDA) has written rules and statements in attempts to guide industry on the use of computer technology. There is confusion in industry concerning Part 11 rules for electronic records and electronic signatures. We believe that this confusion stems from a reading by many that   FDA's position on Part 11 of a "narrow interpretation" means that FDA has in fact 'backed-off' or relaxed its stance. This understanding is incorrect and untrue, as evidenced by FDA's own statements that the intent of Part 11 still exists, but the number and types of systems falling under Part 11 are not abundant.

  We contend that this "narrow interpretation" of Part 11 has lulled many into believing that when Part 11 is applicable, it should only apply to discrete systems. Discrete is not meant to solely describe a stand-alone PC. Networked systems within the confines of the organization are also considered discrete in the context of this article. 

Table 2.  Compliance Attributes of a High-Level System			

Part 11, although well meaning, has placed a burden on industry that has caused many organizations to lose sight of basic quality. With the advent of a risk-based approach to Part 11, many appear to have taken the position that all computer quality is risk-based.  This is not true. The intent of the regulations has always been to require a demonstration of repeatability of functions, and a demonstration of control and understanding of the systems at any point in time (historical or current). Demonstration of repeatability is determined by the degree of validation, revealed through risk analysis. Demonstration of control and understanding of the virtual stream should always be present despite the regulation. 

There has been too great a focus on understanding what Part 11 is and how to apply it. This anxiety has caused many to forget or even fail to realize that there are basic quality practices that must be in place despite Part 11. These quality  control practices should be centered on the attributes listed in Table 1.

  Principally, auditable documentation must exist to show compliance with the requirements of the law. Table 2 outlines compliance attributes of a high-level computer system that act as a benchmark for demonstrating good faith. 

With the increased demand for organizations to share information externally as well as internally, it is imperative that quality  supports the entire environment. Such an environment frequently exists across all supporting business functions and regulatory practices (i.e., GLP, GCP, GMP). We have found that common quality assurance practices focus on discrete systems of the organization without taking into account the end uses of the information, or how it will flow to and across those discrete systems. An organization's entire environment, consisting of technology, supporting business practices, and documentation that impacts the quality of its data must be considered.  

Table 3.  Example of an Assessment Questionnaire			

Over the past several years more attention has been devoted to validating network equipment, like routers. However, information is still frequently shared within and between organizations using non-validated media (e.g., disks, CDs, email files) that exist outside of the validated (or validateable) domain. It is common for such information to be used for important decision-making, investigations, and submissions without regards to possible adverse consequences.   

Examine all potential uses and supporting endeavors of the data and then define them as a virtual process stream. This stream should consist of technology and business practices across GxP areas for production, manipulation, analysis, transfer, and storage of data. 

This effort will produce a thorough, documented understanding of the entire stream and will identify gaps in existing understanding of the environment. This work will ensure that legal requirements are met and a strong quality system is in place to support a virtual environment of technology, documentation, and supporting business practices producing GxP-related information. 

We have encountered a few organizations that did not consider the virtual process stream in their daily practices. It might be helpful to talk about a few cases.  Many biotechnology and pharmaceutical firms have implemented Enterprise Resource Planning (ERP) systems across their local area networks (LANs) and wide area networks (WANs) that may fully meet the expectations of a high-quality electronic system. However, the generated data may then be shared with an external partner organization. The technology (i.e., ETL tool, XML, disk) and business practices used to transfer that information, and the use of the information within the partner organization have not been fully taken into account by the originating organization. Frequently, we have found that once the information leaves the originator's environment, the originator seems to believe that their responsibility for the data has been nullified. 

Table 4.  Electronic Quality Systems Guidance Document			

Another example focuses on the collection and use of data from clinical trials.

  For example, data are collected at multiple sites and sent to the analyzing or end-use organization. We have witnessed on many occasions these data being transcribed (by hand or fax) into electronic format from paper forms, saved to file, and physically or electronically mailed out to a receiving organization. The data may undergo several more conversions (paper to electronic, electronic to paper, or electronic to electronic) and cuts for the statistical analysis before being sent to the primary end-user. Data are then prepared for use in important decision-making or a submission.   

Although the analysis plan was generated, it is common for the plan to not specify the handling of data in its entirety, or to specify incorrect or poor-quality procedures to handle the data outside of the statistical processing. The sponsoring agency may not have any idea of the actual detailed handling (storage and conversion) and transmissions that occur to support the generation of the final report. Many organizations feel that the storage of the paper case report forms relieves them from concerns about the quality attributes of the downstream electronic, or physical plus electronic, processes exercised. 

As our last example, we have observed that a client assumes all processing occurs on an individual server that may be validated, but some sort of handling occurs that moves the data off the server to another non-validated location. Also, no procedures may exist to support functions that are occurring to the data that is now stored at this other location. As a result, a "new" copy of the dataset is created and that may end up being used in a study or a filing without thought to its origination. An inspector could immediately call the integrity of a decision, submission, or investigation into question. 

Companies need to implement a good quality electronic system around their virtual GxP-related process stream. Here is a succinct and well-organized approach for assessing current status and providing recommendations for closing quality and compliance gaps.   

During the first phase, organize the environment into logical processes. This can be done in many ways to suit the organization. Usually the processes would be organized according to a functional area, for example, supply chain distribution. If the firm has multiple product pipelines with different technologies and business practices, both internally and at differing partner sites, the process flows can be differentiated as Product X and Product Y.   

Thinking of the electronic environment as a stream of logical processes is instrumental to building and maintaining a good and cost-effective quality system. Delineation of boundaries around individual computer systems is ineffective and often leads to an organization losing sight of its larger-picture environment, which usually consists of inter-dispersed business practices (i.e., handling) that may not be fully realized.   

Develop flowcharts to document and view the logical processes. Multiple charts for the same process flow should interconnect. Such flow charts should contain references to supporting documents, such as SOPs and validation packages. We recommend that the generated flowcharts be approved and managed in a document control program. Microsoft Visio has been found to serve as a good tool.  

During this first phase, draw up and fill out an assessment questionnaire to identify quality and compliance gaps in each of the logical processes. Design the questionnaire around each listed attribute. Questions posed should include the existence and suitability of procedures, policies, business practices, and technology, directly or indirectly supporting the electronic process stream. A brief example is Table 3. 

For phase two, once the assessment has been completed and rated, develop an electronic quality systems guidance document. This document is a design tool, built from the flow charts and results of the assessment questionnaire. It provides a summary outline for the organization's environment and makes recommendations for closing any quality and compliance gaps that may exist. The documents are considered living documents, and should be revisited on a periodic basis, preferably yearly. The document should contain the sections listed in Table 4. 

Now you are ready to confidently face an audit. The virtual process stream is understood and under control. Your guidance document clearly outlines all of the technology, business practices, and documentation employed that supports the virtual process stream. As a result, the quality of the virtual stream, used to support GxP areas, will be beneficial to consumers of your products as well as your own corporate harmony.  Inspectors will appreciate visual flowcharts linked to organized documents that encompass complex technical environments. The methodology outlined should tell any inspector that your organization is making every effort to demonstrate control and understanding of the environment supporting the GxP data, and that nothing is being hidden in its complexity. 

  is an independent consultant, 48 Harvard Lane, Bedford, NH 03110, 617.899.6410, fax 866.511.8961, 

1. FDA. Guidance for Industry, Part 11, Electronic Records; Electronic Signatures - Scope and Application. US Department of Health and Human Services. Bethesda MD 2003 August. 

2. FDA. Quality System Regulation. 21 CFR Part 820. US Department of Health and Human Services. Bethesda MD revised 2001 April.  

3. Peltier TR. Information Security Risk Analysis. Information Technology — Code of Practice for Information Security Management. ISO/IEC 17799:2000. CRC Press. Boca Raton FL 2001 September. 

4. FDA. Guidance for Industry, Computerized Systems Used in Clinical Trials; Draft Guidance; Revision 1. US Department of Health and Human Services. Bethesda MD 2004 September. 

5. Chamberlain R. Computer Systems Validation For The Pharmaceutical And Medical Device Industries. Alaren Press. Libertyville IL 1994. 

6. Russell D and Gangemi GT Sr. Computer Security Basics. O'Reilly & Associates. Sebastopol CA 1991.  

7. Wingate G (ed). Computer Systems Validation – Quality Assurance, Risk Management, And Regulatory Compliance For Pharmaceutical And Healthcare Companies. CRC Press. Boca Raton FL 2004. 

All potential uses and supporting endeavors of the data must be examined and then defined as a virtual process stream.

Closing Gaps in Quality Control of Electronic Data

As 2005 draws to a close with the various biotechnology and pharma stock indexes inching upward (the Morgan Stanley Biotech Index was up 3.44% in October), the prospects for a brighter and more profitable 2006 seem fairly positive. If 2004 was any indicator when the Biotech Index climbed 12% in November and December after moderate growth in October, then Christmas could come early for bioscience investors. 

In the January issue, I'll write more about what to expect in 2006, and what lessons the life sciences industry can learn from the events of 2005. 

This month, though, a scandal is brewing in biopharm circles that could blow the top off the industry and make it much more difficult for doctors and biopharm research companies to share critical research information — and possibly put some physicians behind bars who try to put a price tag on the sensitive research information they hear about from biopharm industry companies. 

According to a thunderbolt special series from 

, prosecutors are preparing charges against medical researchers who allegedly sell confidential information from prescription drug studies and release that information to Wall Street analysts. 

It's a growing market, if not a pretty one. Big-time investors often pay up to $1 million for such information. Doctors can charge up to $500 per hour to discuss the pros and cons of clinical drug trials. One firm, Gerson Lehrman Group (

), even acts as a matchmaker, lining up analysts to talk to any one of  60,000 doctors ensconced in the firm's database. In 2002, that number was 30,000. 

Let's visit planet Earth for a moment. I spent five years as a bond trader in New York and one fact of life I learned was that when an analyst got a hot tip, it was only a matter of seconds for that tip to be passed along to favored clients. 

And that practice is illegal. You can't take insider information relating to any company's financial prospects and pass it along to investors. Such actions create an uneven playing field and reduce investor confidence in the integrity of the financial markets. 

Worse still, the doctors involved in the alleged gambit charged analysts hundreds of dollars per conversation — beer money on Wall Street — for access to potentially hugely profitable information they had in hand. 

 expose, researched and written by reporters Luke Timmerman and David Heath, found at least 26 cases of insider trading related to drug research between doctors and stock analysts. The doctors involved weren't pikers either. Blue-chip research universities such as UCLA and The University of Pennsylvania (full disclosure: I taught, and was compensated for, a writing class at Penn earlier this autumn) were involved, as were old, established financial firms like Citigroup and Wachovia Securities. 

In most instances, doctors allegedly involved in the insider trading scam delivered proprietary information about confidential studies they were working on to Wall Street analysts. 

 alleges that  the analysts subsequently passed the information along to clients. 

 states that "until now, the selling of drug secrets has been hidden from securities regulators and the public, but biotech and Wall Street insiders say the practice is widespread." The practice is being driven by hedge funds — largely unregulated investment pools that cater to the super rich — and is facilitated by firms like Gerson Lehrman. Matchmakers pay the scientists $300 to $500 per hour to speak with the investors. According to legal experts interviewed by the newspaper, "trading stock based on secret information bought from medical researchers is illegal." A 1983 US Supreme Court decision found that analysts are free to gather information about companies and pass it on to their clients, but added that analysts are forbidden to persuade someone to divulge company secrets, claiming that practice is "misappropriating" nonpublic information. 

also reports that doctors involved in the case were annoyed that investigators would find anything inappropriate about their passing along proprietary information to Wall Street analysts. Some physicians quoted in the series claim the information they discussed with analysts was already in the public domain and that it wasn't very useful. One doctor cited in the piece, Corey Langer from the Philadelphia-based Fox Chase Cancer Center, told  reporters that he was only giving out personal opinions on ongoing studies and research, and what he said was clearly within the limits of the SEC's (Securities and Exchange Commission's strict rules on confidentiality. 

We'll let the SEC and congressional investigators sort this mess out, but the burgeoning trend of doctors being paid money by Wall Street investment firms is deeply disturbing and ought to be abolished. According to the 

Journal of the American Medical Association 

MA), the number of doctors who accept money from Wall Street firms has risen from fewer than 1,000 in 1995 to roughly 75,000 today. 

What's the big deal? Besides the obvious conflict of interest in a private investment firm "buying" time and information from doctors and researchers deeply involved in sensitive drug research, there's a big ripple effect in how such fee arrangements negatively impact clinical trials. As 

 series attests, a "worst case" scenario might involve a physician inflating up clinical data to ensure that the analyst was getting his or her money's worth for the fat fees paid out to researchers. Conversely, a doctor who hears from an analyst that results from a given drug trial would help the drug company's stock may tend to select healthier study participants to "push" the drug toward better study results — then cash in on the stock frenzy that usually follows. As Drummond Rennie, deputy editor at JAMA told 

, "When the data leaks out, it wrecks the trial." 

With so much at stake, it's no surprise that Congress is itching to get involved. Senator Charles Grassley from Iowa is making the most noise, urging both the SEC and the department of Justice to conduct investigations into a potentially block-buster-sized drug trial payola scandal. Said Grassley in a letter to the House of Representatives, "We need a complete and thorough review of these findings and allegations. Selling drug secrets violates a trust that is fundamental to the integrity of both scientific research and our financial markets."  

What are the chances of some doctors doing a perp walk on CNN? (Led away in handcuffs on TV.) I'd say 50-50. As a separate article in 

 points out, federal investigators have their work cut out for them. The SEC would be the primary investigators and they have jailed a few over the years on insider trading charges (including a handful in the biosciences sector). You may recall former executive Eric Tsao of biotechnology company Med-Immune Inc., who was sentenced to 15 months in prison for insider trading and perjury, as reported by the Department of Justice a few years ago. There have been others. But those were clear-cut cases of biotech executives leaking company financial information directly to Wall Street types.  

The doctor-analyst tango is more nuanced and tougher to prove. As 

 reports, SEC investigators must "weed through a number of complex issues determining whether securities laws have been breached," and their job will be "challenging." The key for regulators is to prove that the information changing hands is valuable enough to convince a trader to buy or sell the company-in-question's stock. Says 

, regulators must also demonstrate that the information in question was "non-public" and that medical researchers did, in fact, breach their confidentiality agreements (agreements often can vary in scope and discipline). 

What concerns me is the casual indifference on the part of doctors whose judgment patients must come to trust. It's a credibility and trust issue and doctors must always pass those types of tests. But what do we get? Quotes like the one Ben McGraw, an ex-Wall Street analyst at the California-based biotech firm Valentis, told 

"Everybody does this.... It's now common practice." 

Okay, so the practice of doctors talking to analysts is more pervasive these days. But that doesn't make it right. Any time money changes hands between doctors and slick Wall Street market mavens, any investor's antennae ought to go up (not to mention the patients who may one day use the drug in question). 

Now it's time for this practice to fail its clinical trial.

Celebrity author and business/finance commentator for CNN and Fox News, 

,79 Radcliffe Drive,Doylestown,PA  18901,267.880.3144, fax 267.880.1939, 

Columns and Departments

Doctors can charge up to $500 per hour to discuss the pros and cons of clinical drug trials.

Psst! Hey Doc...Got a Hot Stock Tip?

After three years of talking about modernizing how industry develops and produces new pharmaceuticals, Food and Drug Administration (FDA) officials are taking action to encourage the implementation of new quality-based manufacturing approaches. Last year's flu vaccine shortage, recent product recalls, and supply problems that overwhelm makers of pandemic treatments highlight the importance of replacing costly and wasteful production systems with innovative quality-by-design (QbD) approaches that regulators can evaluate more efficiently. 

This quality approach to biotech manufacturing may also establish a pathway for approving generic versions of biotech therapies.

BioPharm International-12-01-2005

Rapid Microbiological Methods and the PAT Initiative

Small-scale Biomanufacturing Benefits from Disposable Bioreactors

Securing Your Company's Manufacturing Data

Closing Gaps in Quality Control of Electronic Data

Psst! Hey Doc...Got a Hot Stock Tip?

Regulatory Beat: FDA Seeks to Ensure Product Quality and Streamline Regulation

From the Editor in Chief: Price and Prejudice