Ensuring Supplier Quality
For drug companies, it needs to be about more than materials
By Les Schnoll
I've worked in the medical device and pharmaceutical/biotechnology industries, and I've concluded that when it comes to quality, the medical device world is at least 20 years ahead of its drug-world cousin.
The Food and Drug Administration's quality system regulation (21 CFR 820) for medical devices, which many people ridiculed at its inception, has since shown that a comprehensive quality management system (QMS) is far superior to a regulation that focuses primarily on manufacturing. But those of us who saw the light more than a decade ago already knew that.
A number of best practices that result in the superiority of a QMS—requirements for corrective and preventive action, risk management and supplier quality management—are commonplace in the medical device world but are either nonexistent or given only cursory mention in the current good manufacturing practice (cGMP) for finished pharmaceuticals (21 CFR 211). For purposes of this discussion, let's focus on supplier quality management.
If you were to search for the word "supplier" in 21 CFR 211, only a few instances of the word are found—primarily in section 211.84 (testing and approval or rejection of components, drug product containers and closures). The only other section of the regulation that contains "supplier" is section 211.184, which deals with component, container closure and labeling records.
The drug cGMPs contain absolutely no requirements for critical activities associated with a robust supplier quality management program, including supplier selection and approval; supplier evaluation and performance monitoring; supplier approval status; supplier change control; supplier-related corrective and preventive actions, continuous improvement and development; supplier contract and agreement administration; and supplier risk management.
What about services?
In most cases, suppliers are considered to be only those organizations that provide materials and components. Unfortunately, the suppliers that have the greatest impact and that are typically the least managed are those that provide services, including contract manufacturing and contract research organizations. Without a strong supplier quality management program in place, those subcontractors can cause long-term harm to a manufacturer—harm from which it can be extremely difficult to recover.
Let's take the example of a critical portion of the drug development process: clinical trials. The purpose of a clinical trial is to obtain objective data that prove the safety and efficacy of the drug product. This is an intensive, protracted phase of the drug development process, encompassing hundreds or thousands of patients, several years of time and millions of dollars.
To a large extent, the approval of a drug is largely dependent on the results of those clinical trials. Yet all too many drug companies entrust this critical process to a third party that might never have been evaluated by the manufacturer.
Let’s look at a hypothetical scenario, one in which the lack of a supplier QMS coupled with ineptitude results in a Murphy's Law case study. Everything that could possibly go wrong actually goes wrong.
This company, claiming basic compliance to the regulatory requirements contained in 21 CFR 211, decided to manage its first clinical study. Having no past experience in the management of clinical trials, the company decided to use a contract research organization (CRO) to manage the trial for them.
The company selected a CRO based on name recognition and the recommendation of a colleague. The two organizations met, discussed the study and agreed on financial terms. The CRO was selected and given free rein to select the clinical study sites and investigators, ensure the clinical trial was performed according to the study protocol and ensure corrective actions were taken if issues were identified. In essence, the CRO represented the sponsor of the study—the manufacturer. What could go wrong in this scenario?
Plenty, as all too many companies have found. Let's break it down into the elements that have been identified as important to a supplier quality management program.
Supplier selection and approval
The selection and approval of the CRO should have been based on objective criteria—something more than a recommendation and good price. In this case, use of tools, such as a request for quotation, supplier survey and quality system assessment, should have been used to establish the CRO's qualifications.
Final selection of the CRO should have been based on the review of its abilities to meet business requirements for quality, cost and delivery. Competitive comparisons of financial, business and quality attributes might be considered where applicable.
The selected CRO should be qualified and approved only when the following elements are in place: a signed confidentiality/nondisclosure agreement (if not included in the contract/purchase order), a statement of work for business arrangements and a supplier quality agreement.
The CRO should be added to the company's list of approved suppliers when its quality and business systems are accepted as meeting requirements. In our hypothetical scenario, the CRO and the individuals responsible for providing the contracted service (the clinical research associates) both should have been assessed. The CRO, as an organization, might be qualified and have the necessary experience, but the individual personnel assigned to the clinical study also must be part of the assessment.
In the case of the CRO, the manufacturer's clinical affairs function (with support from the quality organization) should be responsible for periodic reviews and reports of supplier performance, as defined in the group's documented procedures.
Performance measurement should be based on quality system assessments, quality performance, cost, delivery, service and other commercial considerations. Outcomes and decisions should be documented.
If the CRO's performance is not meeting expectations, it should be managed to correct performance and might result in the approved CRO's status changing to conditional or its removal from the approved supplier list.
In this scenario, the manufacturer truly delegated management of the clinical study to the CRO and did not bother to evaluate the CRO (and its personnel assigned to the project) or monitor its ongoing performance.
A key responsibility of the management of a clinical trial is the monitoring of each study site, an activity similar to a quality control function. If this activity is not performed properly, the study itself could be in jeopardy. Having unqualified or unmotivated monitors as the sole interfaces between the study site and the drug manufacturer could be disastrous.
Supplier approval status
The drug company should define the various ways the CRO can be approved. This might include an on-site assessment—typical for selecting a CRO—or other methods (for example, registration to an international quality system standard).
Once approved, the CRO can be used. Since Murphy and his law are alive and well, however, there might be instances in which the CRO can no longer be considered to be approved. The CRO might be disapproved if it fails to maintain acceptable levels of quality, service or delivery, or can no longer be approved as a result of current evaluations—in this scenario, the identification of unacceptable study monitors.
While supplier change control would be most applicable to the purchase of materials and components, it should also be considered for CROs. For example, if clinical research associates are changed or if templates used for study records are modified, the CRO should be required to notify the manufacturer in advance and obtain its approval before the change is made.
In our scenario, high turnover of study monitors resulted in missed visits, incorrect assumptions and lack of consistency in assessing the clinical study sites. Changes in case report forms and other documentation resulted in wasted time and effort spent reviewing data, explaining undocumented changes and locating misfiled records.
Corrective, preventive actions
The drug manufacturer's quality organization should be responsible for managing CRO-related corrective and preventive action. An approved CRO should be required to have a documented procedure that specifies its process for handling corrective and preventive actions.
The quality organization should verify that the status of corrective and preventive action is reported to the manufacturer within agreed-on timelines and that the action taken is communicated within the manufacturing organization to ensure action taken is effective and does not adversely affect the product.
Performance on corrective and preventive action should be included in the overall rating and performance monitoring of the CRO.
The CRO should be developed using a continuous improvement program. Development plans should be generated jointly by the manufacturer and the CRO using a variety of tools and techniques, such as process mapping, data collection, Pareto analysis, and failure and root cause analysis.
Generally speaking, the manufacturer's procurement function should administer contracts with the CRO. These agreements should be updated periodically to ensure that the needs of both the manufacturer and the CRO continue to be addressed.
The initial signed contract in this scenario did not include a quality agreement or any other terms that protected the manufacturer. It was not reviewed again, even though the clinical trial ran for three years and multiple issues with the CRO were identified.
Supplier risk management
In this hypothetical example, had the company implemented any type of supplier quality management program, the outcome would have been different. Even if the CRO had been selected and approved, an adequate monitoring program would have identified many of the issues early, and corrective actions could have been taken. Unfortunately, our theoretical organization did not have a clue and paid the price for its naivety.
A robust risk management process could have prevented the damage. A simple tool—a failure mode effects analysis—would have identified the probability, severity and detectability of potential issues, and allowed for proactive actions to mitigate their occurrence and impact.
The pharmaceutical industry should learn from its medical device compatriots and look beyond containers, closures and components for supplier-related impacts on the quality of its products and the viability of its business.
Using a CRO is a standard practice in the pharmaceutical industry; ensuring the CRO is qualified and effectively monitored is not.
Les Schnoll has 30 years of experience in industries regulated by the Food and Drug Administration and is currently vice president of quality and regulatory affairs for ThermoGenensis Corp., Rancho Cordoba, CA. He is a senior member of ASQ and an ASQ certified quality engineer, auditor and manager. A member of the U.S. technical advisory group to ISO technical committee 176, Schnoll wrote The Regulatory Compliance Almanac (AACC Press, 2001).