Procter & Gamble Risk-Assessment Program Emphasizes Part 11 Requirements

While known more for its consumer products in other markets, Procter & Gamble (P&G) has some 3,600 employees in its pharmaceutical unit and the company recognizes that smart, proactive risk assessment makes sense on both a regulatory and an operational level, a P&G manager said.

In addition to several marketing offices and many pharmaceutical representatives in the field, P&G has three research and development (R&D) facilities in the U.S. and another in England. It also has manufacturing plants in Germany, Puerto Rico and France.

Understanding, assessing and addressing risk with computerized systems is critically important for a company with more than 100,000 employees worldwide, said corporate records manager Jane Connerton last month at the Drug Information Association conference in Philadelphia.

To tackle the issue, P&G uses a Risk Assessment and Management Process (RAMP) with Part 11 requirements as one of its foundations. RAMP provides P&G with a mechanism to help the company determine if a computerized system must be validated to meet:

Governmental regulations or business critical objectives; Compliance with Part 11; and Applicable alternate media guidelines.

P&G also uses RAMP to apply a validation standard that calls for documented evidence to provide a "high degree of assurance" that a specific process will consistently produce a result that meets a product's predetermined specifications and quality characteristics.

Leveraging RAMP, P&G employs checklists for each computerized system that ask which regulations, directives or guidelines apply to the given system. RAMP then asks for an assessment for each "Yes" answer. The checklists cover:

Good manufacturing practice rules, including distribution or practitioner samples. For example, does the computerized system fall under Part 203 (prescription drug marketing), Part 210 and 211 (current good manufacturing practices for finished pharmaceuticals), Part 600, 601 or 610 (biologics), or Part 820 (quality system regulation); Good laboratory practice (GLP), specifically Part 58 (GLP for nonclinical laboratory studies); Good clinical practice (GCP) submissions. Specifically, does the computerized system apply to Part 50 (protection of human subjects), Part 54 (financial disclosure by clinical investigators), Part 312 (investigational new drug application), Part 812 (investigational device exemptions), or Part 314 (new drug applications); and Part 11: For example, it notes that if a system submits erecords to the FDA that are not specifically identified in agency regulations, Part 11 still applies.

When assessing risk relative to Part 11, P&G uses a high-medium-low rating system:

High: Critical regulatory records. Predicate rule records from nonclinical and clinical studies, regulatory submissions, drug product manufacturing and release, drug distribution, or standard operating procedures (SOPs); Medium: Critical records that have less of an impact on patient health, product safety and quality, or the outcome of clinical or nonclinical research; and Low: Supportive records such as financial disclosure statements, investigators' curricula vitae and facilities records.

If a record doesn't have to be validated or is not covered by Part 11, P&G uses its RAMP's e-guidelines. Those cover:

Retention time requirements: Does the system have the ability to apply retention times listed in the records retention schedule?

Preservation and migration requirements: Has a preservation plan been developed to ensure that the erecords metadata, content, context and structure are maintained throughout the system's required retention time?

Erecord disposal: Has a process been developed or a tool selected to dispose of erecords in a way that they cannot be reconstructed? Esignatures: Does the process of creating an esignature ensure the authenticity of the signer and the integrity of the signature?

Verification, validation and change control: Does the audit trail at a minimum capture the date, time and person; and the action taken?

P&G also has a firm handle on alternate media, including paper records, Connerton said. All are tracked in a single system. This ensures that erecords on tape, CD, floppy disk and other formats are retrievable and readable. She advised checking erecord readability every three years. -- Michael Causey