Complying With Batch Release: Auditing Electronic Batch Records

To ensure that quality is maintained throughout the pharmaceutical or healthcare organization, frequent audits, both internal and external, are required to assess the quality and effectiveness of the processes, systems, and personnel employed by the company. Audits are an important part of quality assurance and the quality management system. This concept needs to apply to computerized systems as much as physical operations. Within pharmaceuticals, perhaps the most important computerized system is the electronic batch record.

This article presents some advice for auditing electronic batch records to assess their current good manufacturing practice (cGMP) status. This is useful in the qualification stage and essential once the electronic record system is in operation. It is only through conducting rigorous audits that the pharmaceutical organization can stay ahead of the regulatory expectations.

Electronic Batch Records And The Audit Process

As computerized systems, electronic batch records should be subject to audit to verify that systems and applications are appropriate, efficient, and adequately controlled to ensure valid, reliable, timely, and secure input, processing, and output at all levels of a system's activity. There are different approaches that can be taken to such audits and different types of internal audits, including the following:

• Verification audit
• Annual audit
• For cause audit (such as arising from quality management system reviews, CAPAs, change control, data migration)
• In response to regulatory trends
• Following the acquisition of a new computerized system.

In addition, the organization will often opt to audit a vendor, especially when purchasing a new computerized system.¹ Such an audit may also arise if issues develop with a given system.  There will also be audits of the organization by a standards body or regulatory agency.

Audits often begin by reviewing the system inventory. This can include:

• Identification of the system and versions
• Purpose of the system
• Validation status
• Physical or storage (drive and files path) location of the computerized system and related documentation
• The name of the responsible or contact person.

Validation will include an assessment of areas like structural integrity, operational reliability, and ongoing support for the software and hardware products used in the electronic batch records system.

Areas to focus on include:²

• How the computerized system fits with the quality management system
• Whether the computerized system has been subject to quality risk management
• Whether a supplier/system vendor audit has been conducted
• The design specification for the computerized system
• The user requirement specification for the computerized system
• The validation procedure for implementing the computerized system. This will include the approach taken, the validation master plan, and the verification method. The validation plan describes all activities, such as review of the user requirement specification, review of the development plan (design), test strategy, verification of the data migration (if applicable), review of the validation documents, and the acceptance testing of the whole system.
• The change control for the computerized system. All new systems should go through change control, and change control should be used appropriately for existing systems. In the event of changes in the computerized system, including version updates, these should be done first in a test environment, after which the validation status needs to be re-established. If a revalidation is needed, it should be conducted not just for validation of the individual change but also to determine the extent and impact of that change on the entire computerized system.
• Configuration management of the computerized system
• Training to use the computerized system

Fundamental to the audit process is the accumulation of evidence. During an audit, the auditor will be seeking to establish that the process under review is as it is expected to be and for this, they will require audit evidence. For this to happen, the auditor will be assessing what they are told, hear, and see to determine if it complies with the audit criteria.

The most significant issues that an auditor could find are:³

• The lack of a written detailed description of each system.
• System log not kept up to date with controls over changes.
• Weak security in place.
• No audit trails in place or audit trails not active.
• Lack of evidence for the quality assurance of the software development process.
• Inadequate validation of the computerized system.
• Improper data manipulation.
• Adjustment of time clocks.
• Backdating of information.
• Creating records after the fact or without actually executing the procedure.
• Excluding adverse information.
• Sharing of passwords.
• Discarding or destroying original records.

Data Integrity

The above list feeds into the area of data integrity. Preventing data integrity breaches can be addressed with three primary elements: personnel and training, good system validation, and the maintenance of security.

Data integrity can be subdivided into two distinct areas:⁴

• Physical integrity, which is concerned with the challenges associated with correctly storing and fetching the data itself.
• Logical integrity, which focuses upon the correctness or rationality of a piece of data, given a particular context.

Beneath this there are various subtypes, such as referential integrity, which refers to the database rule that a primary key cannot be duplicated in a table. This also ensures that if the primary key in one table is changed, then the foreign keys in the other tables are also updated.

For computerized systems, good data integrity practices need to be considered in the design, implementation, and use of any system that stores, processes, or retrieves data. With databases, for example, data retention is an important aspect of data integrity, such as specifying the length of time data can be retained in a particular database.

In pharmaceuticals and healthcare, data integrity is fundamental to a pharmaceutical quality system that ensures that medicines are of the required quality.⁵ Inadequate data integrity systems could open an organization to risks of recalls and defective product, potentially resulting in:

• Patient death, chronic illness, or disability.
• Regulatory statements of non-compliance.
• Importation ban(s).
• Loss of consumer and regulator trust/confidence, which is exceedingly difficult to recover.
• Product application reviews suspended.
• Market and share price reduction.

Each of the above indicates that data integrity is a particularly important issue that organizations need to be aware of, risk assess, and have measures in place to meet regulatory expectations.

Following the audit process, each organization should undertake a risk review and take action accordingly, beginning with those items identified as being of the greatest risk.

Summary

Computerized systems, including electronic batch records, matter greatly for the modern healthcare or pharmaceutical facility, and more manufacturing processes and data collection operations are being automated. While many software designers are employing good development and documentation practices, followed by robust validation and verification activities before releasing their products, this cannot be assumed. This necessitates the need to audit the design process and to undertake robust computerized system validation. In addition, the day-to-day practices of operating electronic batch records also needs to be periodically audited as part of the quality system to ensure that the required controls are in place and that important control features (such as passwords) and verification steps (such as assessing audit trails) are in place. The essential elements of a compliant electronic batch record system can perhaps be summed up as:

• Ensure that only validated and secure computerized systems are used.
• Ensure access by authorized personnel only.
• Require the use of passwords and access controls to ensure that people have access only to functionality that is appropriate for their job role and that actions are attributable to a specific individual. 
• Create backup copies and check the integrity and accuracy of backup data and the ability to restore the data during validation, and monitor this periodically.
• Ensure independent checking of critical data.
• Have procedures in place for the safe storage of data for the required time. The routine backing up of data should involve the placing of the data into a safe storage location, adequately separated from the primary storage location. This could be storage media held in a fireproof safe or onto a second server.
• Incorporate procedures for the systematic use of an accurate and secure audit trail. The items included in the audit trail should be those of relevance to permit reconstruction of the process or activity.

The above list forms part of data integrity expectations, where data must be attributable, legible (permanent), contemporaneous, original, and accurate. These concerns need to be considered across the product life cycle, as captured by the electronic batch record. The data life cycle considers all phases in the life of the data, from initial generation and recording through processing, use, archiving, retrieval, and (where appropriate) destruction. Failure to address just one element of the data life cycle will weaken the effectiveness of the measures implemented elsewhere in the system. This is why auditing electronic batch records is a compliance necessity.

Tim Sandle’s new book, Digital Transformation and Regulatory Considerations for Biopharmaceutical and Healthcare Manufacturers, Volume 1: Digital Technologies for Automation and Process Improvement, has been published by DHI and is available via the PDA Bookstore: https://www.pda.org/bookstore/product-detail/5897-digital-transformation-volume-1.

References

1. Stembridge, K. and Adkins, M. (2018) Making the Move to Electronic Batch Records, Pharmaceutical Technology, 42 (4): 52-55
2. PDA (1999) Validation and Qualification of Computerized Laboratory Data Acquisition Systems, Parenteral Drug Association, Technical Report #18, Bethesda, MD, USA
3. Sandle, T. and Sandle, J. (2019) Audit and Control for Healthcare Manufacturers: A Systems-Based Approach, PDA / DHI Books, River Grove, IL, USA
4. Sandle, T. (2016) Risk Assessment and Management for Healthcare Manufacturing: Practical Tips and Case Studies, PDA / DHI, Bethesda, MD, USA.
5. FDA (2018) Data Integrity and Compliance With Drug CGMP Questions and Answers Guidance for Industry, December 2018, U.S. Department of Health and Human Services, Food and Drug Administration, Washington

About The Author:

Tim Sandle, Ph.D., is a pharmaceutical professional with wide experience in microbiology and quality assurance. He is the author of more than 30 books relating to pharmaceuticals, healthcare, and life sciences, as well as over 170 peer-reviewed papers and some 500 technical articles. Sandle has presented at over 200 events and he currently works at Bio Products Laboratory Ltd. (BPL), and he is a visiting professor at the University of Manchester and University College London, as well as a consultant to the pharmaceutical industry. Visit his microbiology website at https://www.pharmamicroresources.com/.