DEVIATION INVESTIGATIONS A Proper Objective Perspective

1. DEVIATION INVESTIGATIONS A Proper Objective Perspective FDA USP Conference Irvine, CA December 5, 2008

2. Investigations Deviations (All departments) Out-of-Specification (QC Lab) Out-of-Trend (QC Lab) Raw Materials Components Containers/Closures API Finished Drug Product Deviation investigations are critical to GMP compliance. No department is immune to deviations (departures from cGMPs) � this includes QA and QC. Often, it�s interesting to note that there are no deviations in the quality system for QA and QC. Whenever there is an invalid OOS or �laboratory error�, why are these errors or mistakes not covered through a deviation investigation? Deviations are akin to looking into a mirror and seeing your reflection. The reflection we see for our industry is �compliance�. Deviations should never be viewed as a �demerit� or �negative� but rather viewed as a means to demonstrating cGMP compliance and ultimately continuous improvement! Here are various types of investigations required by pharmaceutical and biotech companies as required or when warranted by cGMPs.Deviation investigations are critical to GMP compliance. No department is immune to deviations (departures from cGMPs) � this includes QA and QC. Often, it�s interesting to note that there are no deviations in the quality system for QA and QC. Whenever there is an invalid OOS or �laboratory error�, why are these errors or mistakes not covered through a deviation investigation? Deviations are akin to looking into a mirror and seeing your reflection. The reflection we see for our industry is �compliance�. Deviations should never be viewed as a �demerit� or �negative� but rather viewed as a means to demonstrating cGMP compliance and ultimately continuous improvement! Here are various types of investigations required by pharmaceutical and biotech companies as required or when warranted by cGMPs.

3. Deviations Associated with limits vs. specifications GMP mistakes or errors Reprocessing or Rework Unapproved changes Performing an activity without proper training Outside of operating parameters or in-process control limits Failure to follow written SOPs or approved batch record instructions So, let�s start by defining what a �deviation� is �. Without knowing what a deviation is can often be the primary problem that leads to non-compliance and fundamentally if left uncorrected for long periods of time can lead to FDA regulatory actions such as a Warning Letter or even a Consent Decree. Warning Letters are official letters to the President of the company clearly stating FDA�s belief that the company is operating in a state of non-compliance with respect to cGMPs. In other words, operating with too many �deviations� reported and investigated inadequately OR not even reported and thus not investigated to determine root cause and affect appropriate and timely corrective actions. In simple terms, deviations are GMP mistakes or errors. In is especially important to distinguish between limits vs. specifications. Specifications are subject to OOS investigations. Outside of limit or established in process control ranges are subject to deviation investigations. In even a more reduced manner, deviations can be explained as �anything that is ATYPICAL, UNUSUAL, or ABNORMAL� within a GMP production, testing, or storage (holding or warehouse) environment. This naturally assumes that a company is well versed in knowing what is normal and what is not normal or knowing what is typical vs. atypical or knowing what is usual vs. unusual. Therefore it is critical that companies continue to mandate cGMP training and a culture of continuous learning throughout all levels of the organization.So, let�s start by defining what a �deviation� is �. Without knowing what a deviation is can often be the primary problem that leads to non-compliance and fundamentally if left uncorrected for long periods of time can lead to FDA regulatory actions such as a Warning Letter or even a Consent Decree. Warning Letters are official letters to the President of the company clearly stating FDA�s belief that the company is operating in a state of non-compliance with respect to cGMPs. In other words, operating with too many �deviations� reported and investigated inadequately OR not even reported and thus not investigated to determine root cause and affect appropriate and timely corrective actions. In simple terms, deviations are GMP mistakes or errors. In is especially important to distinguish between limits vs. specifications. Specifications are subject to OOS investigations. Outside of limit or established in process control ranges are subject to deviation investigations. In even a more reduced manner, deviations can be explained as �anything that is ATYPICAL, UNUSUAL, or ABNORMAL� within a GMP production, testing, or storage (holding or warehouse) environment. This naturally assumes that a company is well versed in knowing what is normal and what is not normal or knowing what is typical vs. atypical or knowing what is usual vs. unusual. Therefore it is critical that companies continue to mandate cGMP training and a culture of continuous learning throughout all levels of the organization.

4. Deviations GMP mistakes or errors Good documentation errors � missing entries, unexplained entries, improper corrections or edits to official records Environmental Monitoring over alert or action limit excursions Out of calibration Unplanned preventive maintenance or repairs to �qualified� equipment or systems Other deviations: If a batch record or logbook requires documentation and an operator fails to do so, then this is clearly a deviation or departure from procedures. If the error is captured by the affected department during review and properly explained, then this would not necessarily be a deviation unless (of course) product impact could have been potentially affected. These types of documentation errors where product impact could be potentially affected would certainly require a deviation investigation. For example, failing to properly document cleaning between product changeover can not be caught by a supervisor during review and not reported as a devation.Other deviations: If a batch record or logbook requires documentation and an operator fails to do so, then this is clearly a deviation or departure from procedures. If the error is captured by the affected department during review and properly explained, then this would not necessarily be a deviation unless (of course) product impact could have been potentially affected. These types of documentation errors where product impact could be potentially affected would certainly require a deviation investigation. For example, failing to properly document cleaning between product changeover can not be caught by a supervisor during review and not reported as a devation.

5. Deviation Investigations Root Cause(s) � Thorough Investigations What vs. Why or How The 20 : 80 (what : why/how) Rule Corrective Actions Batch release dependent Preventive Actions Batch release independent ROOT CAUSE: Jeff Yuen tells a story in training courses all over the world about how he asks his sons to �pull weeds� from the garden. His father did it to him and now as is appropriate he does this to his sons. He makes them work in the garden. Well, after asking several times, the boys finally drop their Xbox controllers and run out to the garden. In five minutes, they�re back in the house playing computer games. Jeff checks the garden and pretty good � all weeds are not in sight � they�re all gone! Well, Jeff leaves on a business trip and comes home a week later. Lo and behold, there are twice the number of weeds and he could swear some of the same �weeds� are back with a vengeance (twice as tall)! What�s the morale to the story? The boys didn�t pull the �weeds� out by the roots. They just broke off the tops and buried them. Isn�t this true of what we face everyday in plant or factory. People are not committed to getting to the �root� cause of a deviation. Is operator error really the �root cause�? Why or how was it possible that the operator made the mistake? We don�t even ask � and FDA sees this in our investigations. Why do we have to wait for the FDA investigator to ask us these questions during an inspection? We need to be asking these questions in real time. So, it is critical that you spend 20% of your time documenting �what happened� and spend figuratively 80% of your time investigating �root cause�. Unfortunately, what do we get �. Sarcastically, we get �TWO WORDS� � OPERATOR ERROR. That�s all? We�re going to get cited for inadequate deviation root cause investigations for sure. Our attention to details during root cause investigations will be reflection of our commitment to cGMPs. Corrective actions (good ones) are DEPENDENT on appropriate root cause investigations. Preventive actions based on a history or pattern of recurring deviations is the basis for establishing and demonstrating a willingness to invest in �SYSTEMS� level continuous improvements.ROOT CAUSE: Jeff Yuen tells a story in training courses all over the world about how he asks his sons to �pull weeds� from the garden. His father did it to him and now as is appropriate he does this to his sons. He makes them work in the garden. Well, after asking several times, the boys finally drop their Xbox controllers and run out to the garden. In five minutes, they�re back in the house playing computer games. Jeff checks the garden and pretty good � all weeds are not in sight � they�re all gone! Well, Jeff leaves on a business trip and comes home a week later. Lo and behold, there are twice the number of weeds and he could swear some of the same �weeds� are back with a vengeance (twice as tall)!

6. Deviation Investigations Deviation investigations must not be biased from the start From an FDA or cGMP perspective, the purpose of conducting a deviation investigation is not to �release the batch.� The true purpose of a deviation investigation is to determine the root cause for the �deviation�\ implement appropriate and meaningful corrective actions, and evaluate the implicated system (e.g., the training program) once a pattern of repeating deviations is noted. Many deviation investigations even start out this way: �The purpose of this deviation investigation is to release the affected batches �.� We all know how this deviation investigation is going to end even before the FDA investigator gets to the conclusion section. The company had determined that there was no �product impact� from the start � with this in mind how can FDA feel comfortable that truly �objective and thorough (as required by GMPs)� deviation investigation be conducted!Many deviation investigations even start out this way: �The purpose of this deviation investigation is to release the affected batches �.� We all know how this deviation investigation is going to end even before the FDA investigator gets to the conclusion section. The company had determined that there was no �product impact� from the start � with this in mind how can FDA feel comfortable that truly �objective and thorough (as required by GMPs)� deviation investigation be conducted!

7. Deviations Investigations vs. Batch Release (Product Impact Assessments) Batch release should be considered a separate and distinct QA function and activity! Product Impact Assessments should be done �collectively� (summation of all deviations) after an appropriate deviation investigation has been completed. All deviations must then be collectively evaluated at the time of final batch release. This is not to confuse everyone by saying that batch release and product impact are NOT IMPORTANT. Product impact is ultimately the most important consideration when performing batch release. However, there are too many times when I�ve been in meetings where the poor operator is sitting in a conference room waiting for the �question� like why or how was it possible (during a deviation investigation) AND the question never comes up because there is a heated debate over PRODUCT IMPACT. We see a fundamental need to make sure that a proper deviation investigation process allows for determining �definitive� or �potential� root causes rather than �fast forwarding� to product impact. How can product impact be properly assessed without properly or fully �understanding� the root cause? This is not to confuse everyone by saying that batch release and product impact are NOT IMPORTANT. Product impact is ultimately the most important consideration when performing batch release. However, there are too many times when I�ve been in meetings where the poor operator is sitting in a conference room waiting for the �question� like why or how was it possible (during a deviation investigation) AND the question never comes up because there is a heated debate over PRODUCT IMPACT. We see a fundamental need to make sure that a proper deviation investigation process allows for determining �definitive� or �potential� root causes rather than �fast forwarding� to product impact. How can product impact be properly assessed without properly or fully �understanding� the root cause?

8. DeviationsRoot Cause(s) Documenting all attempts to identify, determine, confirm, or rule out potential root cause(s) Why and how did it occur Detailed descriptions (what, where, when, and who) of the deviation vs. root cause investigation or assessments Definitive or Potential Root Cause(s) Again, operator error or machine failure are not root causes. They are really �root cause� categories that are better suited for tracking and trending of deviations but not really for describing in detail the �real root causes� (definitive or potential). As with pulling weeds, sometimes to get to the real root cause(s) we have to get our hands in the �dirt� and not be afraid to get down to the �roots� of an issue. If we don�t pull up the weed by the root, the deviation will come back or never go away! How many of us struggle with operator errors, operator errors, operator errors (persistent operator errors).Again, operator error or machine failure are not root causes. They are really �root cause� categories that are better suited for tracking and trending of deviations but not really for describing in detail the �real root causes� (definitive or potential). As with pulling weeds, sometimes to get to the real root cause(s) we have to get our hands in the �dirt� and not be afraid to get down to the �roots� of an issue. If we don�t pull up the weed by the root, the deviation will come back or never go away! How many of us struggle with operator errors, operator errors, operator errors (persistent operator errors).

9. Root Causes Definitive vs. Potential Root Causes THERE IS A BIG DIFFERENCE BETWEEN WHAT HAPPENED VS. WHY OR HOW SOMETHING HAPPENED!

10. Corrective Actions Short term, immediate actions taken to �correct� or address the potential root cause(s) for each reported deviation Actions designed to eliminate or minimize the potential for recurrence of the deviation Must be initiated (accountability in a formal quality system) or completed prior to closing out of the investigation Corrective actions should be tracked and trended in a quality system The next big piece to improving compliance is understanding the difference between corrective actions vs. preventive actions! Correcting a problem is much different than preventing a problem! For example, for those of you that live in OC know � correcting a fire is much different than preventing that fire from occurring in the first place! Homeowners who lost their homes certainly understand this subtle yet major difference! But, many times we go into companies and the �definitions� for corrective actions and preventive actions even look word for word the same with the �term� correct replaced with �prevent� in the definitions referenced in SOPs. This can be extremely confusing to personnel and we see this when we see �retrain� cited for corrective actions in some deviations and then �retrain� cited for preventive actions in other deviations. Corrective actions are those immediate actions that must address the �root causes� identified in the deviation investigation (potential or definitive). They must match! Often deviation investigation corrective actions don�t even match the referenced root causes! We cite operator error and then state that the SOP must be revised. This doesn�t make logical sense. The next big piece to improving compliance is understanding the difference between corrective actions vs. preventive actions! Correcting a problem is much different than preventing a problem! For example, for those of you that live in OC know � correcting a fire is much different than preventing that fire from occurring in the first place! Homeowners who lost their homes certainly understand this subtle yet major difference! But, many times we go into companies and the �definitions� for corrective actions and preventive actions even look word for word the same with the �term� correct replaced with �prevent� in the definitions referenced in SOPs. This can be extremely confusing to personnel and we see this when we see �retrain� cited for corrective actions in some deviations and then �retrain� cited for preventive actions in other deviations. Corrective actions are those immediate actions that must address the �root causes� identified in the deviation investigation (potential or definitive). They must match! Often deviation investigation corrective actions don�t even match the referenced root causes! We cite operator error and then state that the SOP must be revised. This doesn�t make logical sense.

11. Corrective Actions General FDA 483 Observation Corrective actions do not �match� or support definitive or potential root causes.

12. DeviationsPreventive Actions Longer term actions designed to determine the effectiveness of corrective actions Actions designed to ensure the �prevention� or recurrence of deviations Preventive actions do not have to be initiated or completed prior to closing the investigation Preventive actions should be tracked, monitored for completion, and trended in a quality system Preventive actions are �system level� improvements. Retraining an operator does not improve the system. Changing or modifying the training program or addressing the �trainers� improves the training program from a quality systems perspective! Since preventive actions are essentially continuous improvement initiatives, they don�t have to be completed or initiated prior to closure of the deviation but they do have to have a prescribed timeframe and milestones defined. Senior management must have visibility to continuous improvements initiatives or projects AND senior management must demonstrate their support (resources and fiscal or budgetary support).Preventive actions are �system level� improvements. Retraining an operator does not improve the system. Changing or modifying the training program or addressing the �trainers� improves the training program from a quality systems perspective! Since preventive actions are essentially continuous improvement initiatives, they don�t have to be completed or initiated prior to closure of the deviation but they do have to have a prescribed timeframe and milestones defined. Senior management must have visibility to continuous improvements initiatives or projects AND senior management must demonstrate their support (resources and fiscal or budgetary support).

13. Preventive Actions Preventive actions must focus on �system� evaluations and �system� level continuous improvement. Quality system improvement is more important to FDA than corrective actions (band-aid fixes necessary to just release a batch).

14. DeviationsFDA�s Chronologic Expectations Deviation reported in real time Timely notification of QA (within 24 hours) Thorough root cause investigation Timely investigation (within 30 days) Corrective actions proposed and initiated or completed Investigation closed Implicated batch(es) released or rejected Preventive actions initiated and closed

15. Planned Deviations Planned deviations should be handled through the QA approved change control procedures. All changes should be evaluated for product impact, significance The need for requalification or revalidation Changes ultimately approved or rejected by QA. QA should insist that planned deviations not be used; all deviations should be unintentional, unplanned, or unexpected. Shutdown or validation protocols can also be used in lieu of planned deviations. If we know that deviations are �GMP mistakes� or a failure to follow an SOP, why would we �plan� to do so in advance. Planned deviations is an oxymoron (a contradiction in terms). With appropriate reason AND data to support the planned deviation, the planned deviation should be considered a �change� and approved in advance by QA (ironically as planned deviations are approved by QA now). If there is no data to support the planned deviation (or change), then the planned deviation should be simply reduced to a �deviation� that requires investigation to determine why the procedure or batch record could not be followed in this particular instance. Planned deviations are typically never investigated! If the reason for the planned deviation is temporary and needed to collect or generate data that would be used to support a formal change at a later date, then a study protocol should be used to supercede established procedures but in this way the reasons and rationale and study design (DOE) can be formally pre-established and documented prior to the start of the planned deviation. Bottom Line: There are better ways to handle planned deviations using mainstream change control or study protocols (cross-referenced to a deviation or set up using sound scientific rationale � i.e., from process development).If we know that deviations are �GMP mistakes� or a failure to follow an SOP, why would we �plan� to do so in advance. Planned deviations is an oxymoron (a contradiction in terms). With appropriate reason AND data to support the planned deviation, the planned deviation should be considered a �change� and approved in advance by QA (ironically as planned deviations are approved by QA now). If there is no data to support the planned deviation (or change), then the planned deviation should be simply reduced to a �deviation� that requires investigation to determine why the procedure or batch record could not be followed in this particular instance. Planned deviations are typically never investigated! If the reason for the planned deviation is temporary and needed to collect or generate data that would be used to support a formal change at a later date, then a study protocol should be used to supercede established procedures but in this way the reasons and rationale and study design (DOE) can be formally pre-established and documented prior to the start of the planned deviation. Bottom Line: There are better ways to handle planned deviations using mainstream change control or study protocols (cross-referenced to a deviation or set up using sound scientific rationale � i.e., from process development).

16. Deviation vs. Out of Specification Preliminary investigation Purpose: Investigate to determine if the initial OOS test result is valid or invalid based on a review of the bench; do not discard sample preparation, pipettes, etc. Analyst error Sample preparation error Instrument error Reference standard Calculation error Failure to follow test method

17. Deviation vs. Out of Specification Once confirmed, invalid OOS test results should be converted to deviation investigations Confirmed valid OOS test results should be investigated through the OOS procedure Link to the failure investigation procedure for rejected materials, API, and/or finished product

18. Deviation ManagementBusiness Perspective Measures of efficiency and productivity Qualified suppliers Higher yields Process Optimization Routine global senior management visibility Competitive business strategic plans QA quality systems evaluation Regulatory insurance policy (CGMPs) Mission or Vision Statements �Do it right the first time� �Quality First�

19. Final Thoughts Deviation investigations are not an unusual or foreign concept to industry or in our normal outside of work life Workers compensation or injury at work Consider steps taken with respect to EHS (safety or injury related) investigations, corrective action, and preventive action program. Corrective actions are designed to target root cause(s). Preventive actions are designed to ensure corrective actions are effective in avoiding work related injuries through appropriate �system� level improvements.

20. Contact Information

21. Reproduction or Copies Further reproduction, copies, or use of this presentation without explicit permission from Jeff Yuen and Associates is strictly prohibited. November 13, 2003