Featured Blog

Most Sponsor GCP inspections, which result in the issuance of an FDA-483, Inspectional Observations, usually contain the citation "Failure to ensure proper monitoring of the study and ensure the study is conducted in accordance with the protocol and/or investigational plan". This umbrella FDA-483 citation is broadly designed so that it can capture a multitude of different observations but can still signal imminent regulatory action.

Given the number of published ICH and Guidance Documents, the known compliance action trends, as well as information available to sponsors at the click of a search button, why do we continue to see the same FDA-483 citations in oversight failures and data integrity? This article focuses on what, in our regulatory experience, are some notable root causes and a few recommendations for improvement.

We know that within the Bioresearch industry the typical practice is for a sponsor to assign study oversight activities to a clinical QA unit, leaving a more robust and independent quality unit to oversee GMP Phase 3 or commercial manufacturing. I'm referring strictly to the sponsor oversight activities, in this case, not monitoring responsibilities executed by a CRO. There are inherent risks in allowing this approach to go unchecked for extended periods and the results are now realized in current events and regulatory compliance actions.

The culture of clinical quality assurance (CQA) rarely includes exposure to robust QA or training activities that are more closely aligned with GMP operations, and while there is no specific requirement to do so, a lack of elevated quality functions usually results in CQA senescence, and will eventually lead to a VAI or OAI outcome.

FDA's 2018 BIMO inspection analysis metrics demonstrate that overall a lack of sponsor oversight remains the most common contributor to FDA-483 citations and warning letters. While sponsor oversight was not specifically cited in the published metrics, it is the most singular critical function of GCP and a failure to execute effective sponsor oversight and quality review functions results in inadequate monitoring of clinical sites, protocol deviations, investigator non-compliance, insufficient sponsor communication, data integrity failures, and a risk of data manipulation.

The BIMO metrics show that 26% of the 175 BIMO inspections conducted in 2018 were classified as VAI or worse. In my experience, many of those inspections classified as VAI, were probably borderline OAI, if not for promises of corrective action offered by management and/or the discretion of the FDA Investigator.

Having been on both sides of the GCP regulatory spectrum, as an FDA Investigator and as a Regulatory Consultant, I've both enforced the regulations and supported industry as they work towards compliance. There were many occasions in my FDA career where I recommended a strong VAI when an OAI may have been warranted IF I believed that the firm demonstrated significant concern and acceptance of the findings.

From my perspective and experience, the most common contributors to inadequate sponsor oversight in Sponsor-Monitor and Clinical Investigator site inspections are summarized in the following:

• Management indifference and a culture of status quo.
• No accountability of CQA operations to a compliance-oriented hierarchy.
• Lack of trained staff or insufficient exposure to elements of quality and compliance.
• Poorly executed written procedures that are not established, fully defined, complete, or followed.
• Poorly executed quality agreements that do not allow sponsors to adequately oversee CRO activities.

Let's first examine the management structure. Sponsor management that is disengaged from clinical operations will never be in a position to provide adequate oversight. Since clinical quality assurance is traditionally held to less robust quality requirements, depending on the product phase, CQA is often not accustomed to operating at a level that includes a vigorous review, nor does a culture of disengaged management see any reason to do so. This is a dysfunctional relationship where "built-in quality" is a GMP term and oversight of CQA operations is often left to self control. This status quo culture is usually demonstrated during audits and inspections and almost always results in significant regulatory findings.

I performed a follow-up audit of a sponsor in order to assess the effectiveness of promised corrective actions in response to a previously issued, and significant FDA-483, which cited failures in oversight, data integrity findings, and a failure to implement adequate computerized controls and security. During the audit, my team noted that most of the sponsor’s corrective actions were not properly designed, incomplete, ineffective, and in some cases were not even addressed. Even after the issuance of the FDA-483 a year earlier, no responsibility for the execution of promised corrective actions had been properly assigned, and management never reviewed the action plan. CQA was suffering from analysis paralysis because there was no managment or quality-unit oversight. At the conclusion of the audit one of my discussion points was the lack of quality functions within CQA management as a root cause and I referenced the ICH E6 R2 amendment as a baseline. I further explained FDA expectations for phase-appropriate quality in clinical trials. The response I received from the Director of CQA was "well, the E6 R2 Amendment is just a recommendation, not a requirement". Spoiler alert - this attitude doesn't mitigate regulatory action.

I was not surprised to hear this statement because unfortunately, this management indifference is all too common and this is a frequent response. Any former regulator will agree that this response is a primary indicator of an inattentive executive management culture, and a direct path to an OAI classification. In this example, I explained to the Director of CQA the concept of FDA enforcement discretion and cautioned him that a warning letter was likely imminent since no corrections of value had been performed since the initial inspection.

Unfortunately, the CQA personnel in the above example were not accountable to an appropriate regulatory or management unit and there was no quality or compliance review of their operations, nor had there been for many years. The organizational chart reflected a hierarchy of management oversight, but this was never implemented because the unit responsible for quality resided overseas and rarely became involved with stateside operations.

If sponsor management isn't willing to promote a culture of quality, and effective oversight, then neither can their personnel be expected to do so. Borrowing a well-known political term we will call it "trickle-down apathy". Trickle-down apathy is a virus that spreads and permeates every line in an organizational chart. Until executive management commits resources and takes actionable decisions that will establish a proactive CQA unit, future inspection results won't look any different. It cannot be understated that continued and demonstrable non-compliance is a threat to any regulatory submission and the FDA review cycle.

The FDA recognize the limitations of the legislative process and while they do not intend to regulate through guidance documents, these publications always reflect the Agency's current thinking and you can expect that FDA enforcement discretion is in play. The ICH6 R2 6(R2) Good Clinical Practice: Integrated Addendum to ICH E6(R1) document specifically recommends that sponsors implement a system to manage quality throughout all stages of the trial process. The operating level of the established system must promote effective risk-based oversight as it pertains to clinical operations. When the current regulatory climate routinely measures a high temperature of data integrity failures, it's time for sponsors to reevaluate the functionality of their clinical operation oversight.

While we can agree there is no legal requirement to establish a unit defined as "quality" for clinical operations, there is also no better way for a sponsor to establish oversight, which is a legal requirement. Non-compliance and resulting FDA regulatory actions cost more money in the long run than investing the resources necessary to create an effective clinical quality unit so that FDA has confidence in data submitted in support of a regulatory product review.

As we continue to compare CQA to the GMP counterpart, another distinguishing element of a compliant GMP quality unit is their management of a well-established training program. Typically, the training program in a GCP environment isn’t as structured and doesn’t include the same degree of quality-focused instruction. A sponsor should be as fundamentally engaged with providing CQA staff continued training as one would expect in a commercial manufacturing environment. Accordingly, why gamble on staffing CQA operations with personnel who are insufficiently trained in quality elements, when it becomes a risk to data management?

To illustrate this point, I'll provide another example. An FDA inspection was performed of a sponsor where data integrity and data management problems were cited and described by the FDA as "concerning". Fortunately for the sponsor, their training program was not fully reviewed by the FDA because the examination would have shown that none of the CQA staff was ever provided training on the elements of Data Integrity, nor did their written procedures for clinical site audits contain any provision for review of data integrity or ALCOA principles. This also transcended across their clinical site audits where the integrity of data submitted to the sponsor was never subject to a data integrity review. The staff who were assigned responsibility for management of data and clinical site compliance had no training in data integrity principles and what's more, the same staff performed both monitoring and auditing functions. How then, can the staff be expected to execute critical oversight functions? Because Management was disengaged and procedures were poorly written, CQA personnel were given responsibility for auditing their own operations, and inadequate staff training was never detected. This environment continued to operate in this manner for years. In the absence of properly trained and organized personnel, the sponsor should have considered temporary QA staffing or at least bringing in outside expertise to perform the clinical site and in-house sponsor audits.

What are the critical quality components that an effective unit must employ to ensure all other supporting regulatory expectations are met? A sponsor must establish a phase-appropriate CQA program to promote quality and compliance with regulations as they evolve through the product development cycle.

A decidedly compliant sponsor will create an effective clinical QA unit by including staff from both clinical and GMP backgrounds when possible. The breadth of this combined experience is invaluable and provides for an impressive working group. Those individuals with GMP QA experience can transition into a CQA environment and easily transform the system into a healthier unit, without duplicating the full GMP model. In my 29 years of experience, the most impressive sponsor clinical quality units that I have inspected have always leveraged GMP QA experience where it was possible to do so.

Additionally, the most effective clinical units belong to sponsors who ensure accountability by establishing active quality management oversight. A sponsor must establish a robust auditing program where audits are performed at routine intervals by personnel/auditors who are INDEPENDENT of CQA activities. Sponsor-Monitors and Auditors will not share the same responsibilities. The best model for sponsor quality will ensure that monitors never audit, and auditors never monitor. Another common mistake in sponsor oversight is to limit the time for a clinical site audit to two days. Sponsors often assign the usual timeframe for a monitoring visit to an audit, with the expectation that performing a clinical site audit would be sufficiently performed in the same amount of time. This is the incorrect approach. Adequate oversight will allow the time necessary for a sponsor to audit a clinical site based on risk, the indication, study population, number of cohorts, the rate of protocol deviations, and the number of randomized patients.

If staff resources are limited, then the best option is to engage the services of an external expert. The most effective GCP auditors will have many years of compliance expertise, and it's beneficial if they also have GMP expertise. GCP & GMP experience coupled together will ensure you're contracting with an expert who can speak both GxP languages and have a comprehensive understanding of regulations from Phase I to commercialization.

While the Industry understands that in theory, auditing and monitoring are separate functions, it’s often not demonstrated in practice or in written procedures. Where a CRO has been contracted to monitor the study, the auditing provision must be specifically defined in the quality service agreement so there is no room for misinterpretation.

Similarly, performing an audit of internal sponsor CQA activities will also be based on risk, but the number of submissions and regulatory status of clinical studies submitted for FDA review should also be a consideration. Did the product receive a fast track designation? Is the study limited to a pediatric population? A sponsor audit is primarily focused on sponsor responsibilities such as CRO oversight, monitor selection, CQA staff training, written SOPs, quality agreements, site selection and training, applicable Part 11 activities, data management, SAE/Safety reporting, and records. Regardless of the type of audit, the audit should be a comprehensive review of systems rather than using a simple checklist approach.

Proper audit planning and execution is the primary weapon against data mismanagement and non-compliance. Regulatory agencies do not accept that the transfer of responsibilities to a CRO, through a written service agreement, alleviates the expectations of sponsor accountability. Too often, lax oversight occurs because sponsors become too comfortable with CRO activities, and do not assign oversight functions to the appropriate internal team. Sponsors with good compliance history understand the need for comprehensive oversight and are more concerned with "doing it right", as opposed to doing it quickly. #auditsmatter.

In the current regulatory environment it is critical for sponsors to take a health check of their clinical operation before the FDA does. The most beneficial way to do so is to schedule an independent mock-FDA audit, to include former FDA Investigators and Product Reviewers since they are in a unique position to provide a compliance-oriented assessment with the right perspective. This team will use the same inspectional techniques so personnel will gain valuable insight and training during this process. Time for your CQA checkup.