Regulations & EHS&S

The data Integrity conundrum between pharma and excipients

By Brian Carlin, DFE Pharma; Dale Carter, Evonik; Irwin Silverstein, IBS Consulting in Quality; Ann Gulau, Dow Chemical Company; Brittney Wells, Lonza; and Katherine Ulman, KLU Consulting - 23rd September 2019

Data integrity 2019-05.jpg
Data integrity is key to demonstrating compliance with Pharmaceutical GxPs, such as manufacturing, documentation and laboratory practices.

Failure to ensure data integrity is a breach of cGMP. In 2016, 80% of FDA Drug Product and API warning letters included a reference to the lack of data integrity, mainly due to incomplete data. Several regulatory agencies have issued data integrity guidance documents in recent years, all of which follow the definition embodied by the 1990s FDA acronym “ALCOA”:
  • Attributable: Data must be attributable to the person generating the data. Who performed an action and when? This can be recorded by initialing and dating a paper record, or by audit trail in electronic records.
  • Legible: All data recorded must be legible and permanent, even if corrected or updated
  • Contemporaneous: Recorded at the time of task or measurement. Date and time stamps should match order of execution and data should never be back dated.
  • Original: Original data, recorded for the first time in database, approved form, or a dedicated notebook. Recording results on paper for transcription later can introduce errors. If hand written data or thermal printouts need to be stored electronically, verified “true copies” may be needed.
  • Accurate: Free from errors, reliable, truthful and reflective of the observation. No editing without documentation/annotation of amendments.
Implicit in these requirements for ALCOA are that records should be complete, consistent, enduring and available.
Excipients vs API and Drug Product
Excipients are much more diverse than APIs. They have compositional and molecular weight polydispersity, and excipients are often extracted rather than synthesized, from operations such as harvesting and mining. They are typically manufactured by continuous processes, and in much greater volumes than would be encountered in the pharmaceutical industry. Generally, most excipients were not designed for pharmaceutical use, although many of them have long histories of patient safety via various routes of drug administration or from legacy applications as food additives.
The various data integrity guidance documents differ slightly in approach and specific details, but are intimately bound to the wider regulatory framework of GMP and good documentation practices, which are based on APIs and drug products. Pharmaceutical usage may only be a small part of a specific excipient market, so most excipients are not manufactured under API or drug product cGMPs. Some suppliers may sell to the pharmaceutical market and leave it to the users to establish pharmacopoeial compliance, which means limited compliance with GMP. The further one gets from pharmaceutical cGMP, the less likely it is that detailed data integrity expectations will be met. ALCOA principles are good business practice in any commercial sector, but judgement will be required in the application of specific Pharma data integrity requirements to excipients.
With excipient GMP on a sliding scale, users should anticipate varying degrees of applicability of specific Pharma data integrity requirements. Therefore, users need to define which specific data integrity requirements are expected from their excipient manufacturers.
Based on the known marketed applications of their materials, excipient manufacturers should define which records are necessary to support their GMPs and the measures taken to ensure data integrity. Excipient manufacturers lack adequate control of the integrity of their data when they do not literally follow the regulatory guidelines.  A common expectation is for manufacturers to provide validation reports for their excipients, analogous to those generated by Pharmaceutical companies during API and Drug Product development. FDA requirements are very specific in this respect.
Big Data in QbD
Traditionally, pharmaceutical companies performed full compliance testing on each received batch of excipient which meant that less emphasis was placed on supplier Certificate of Analysis (CoA) data integrity. Where users rely on data from qualified suppliers without confirmatory testing (21 CFR 211.84), supplier CoA data integrity is critical. Pharmaceutically aligned suppliers utilize controlled platforms such as LIMS and SAP like those used in the Pharmaceutical industry.
From a Quality by Design (QbD) perspective, reliance on purchased CoAs fails the ALCOA criterion of completeness. The number of batches purchased may not be sufficient to statistically represent supplier performance. Access to all CoA data over a period of time gives a more representative picture of supplier process variability for that timeframe. In turn, the CoA data is only complete if there are no out-of-specification (OOS) excipient batches. Full batch data including OOS is necessary for assessment of supplier process capability. It should be noted that for some excipients produced to serve multiple industries there may be “second quality” markets for material outside the Pharma specification. Recycling of material would also need to be taken into account in determining process capability.
Many excipients are produced by high-volume continuous production. Of necessity, CoA values will be either average or composite results. QbD drives utilization of more data from excipient manufacturers by pharmaceutical companies, beyond the traditional CoA. It is unlikely that pre-existing systems dating back years, if not decades, were designed with the data integrity requirements of the end-pharmaceutical user in mind. If the data is used for information only and does not control finished product safety or quality data integrity is less of an issue. At the other extreme, real time release (RTR) of continuously produced pharmaceuticals utilizing supplier data would require maximum data integrity.
A second driver to greater utilization of supplier data is the need to demonstrate user oversight of supplier quality. Users are strictly liable for the quality and GMP of their suppliers, including data integrity.
Sharing of data by excipient manufacturer with users may require confidentiality agreements to maintain the manufacturers’ proprietary know-how. There may also be restrictions on use of the data in patent applications and regulatory submissions.
Why is data integrity different for excipients?
Industrial control systems are often more focused on safety. Changes to address Pharma requirements may have unintended consequences. It is not easy to harden/improve compliance without revalidating safety critical systems. Excipient manufacturers typically use networked control systems to afford remote monitoring and control, in contrast to the small-scale batch operations, typical of Pharma.
Many legacy control systems used by excipient manufacturers make data attribution difficult because their control systems are open. If a specific operator is not identified for every action it may be possible to ameliorate by shift rosters, physical access security, training, or a control/data entry log. The degree of GMP at various stages of production may influence the extent of data integrity.
Many industries, including those manufacturing excipients, use redundancy, with multiple sensors and in process tests to reduce dependence on a single data stream. In contrast, pharmaceutical operations are often dependent on a single sensor, which places more emphasis on validation and calibration. Multiple sensors allow voting and reduce dependence on calibration. Data integrity is at a system level higher than that of the individual sensor.
High frequency testing, using “quick and dirty” (nonspecific) methods or sensors, outweighs a limited number of test results from more precise but onerous methods. A better population estimate is obtained, and sampling error is reduced by higher frequency testing, which compensates for lower data integrity at the level of individual measurement. High frequency automated data capture reduces potential for operator error in sampling or testing. The consistency of surrogate signals can be used for online monitoring with more specific methods to investigate changes.
Increasing utilization by users of supplier data may also pose data retention challenges for the supplier. What data should be retained, for how long, and should it include metadata to enable interrogation of dynamic records? Audit trails and security access controls would be needed for such data. The data retention period could be linked to retention samples, but the excipient manufacturer needs to define this.
User considerations for reliance on third party data sets.
If data integrity is uncertain (paper or electronic) the questions to assess the risk are:
  • Will patients/consumers be injured?
  • Will product quality be jeopardized?
  • Will compliance with any cGXP be uncertain?
  • Will there be increased risk of product liability?
  • Will there be costs of the poor data quality?
  • Where on the continuum (information-only to control signal) will the data be employed? This analysis will allow development by the user of a prioritized data integrity plan.
Data integrity must be balanced against utility when using a variety of large externally sourced datasets for novel analyses. It is difficult to retrospectively implement controls for validating the data at point of creation or capture, and correcting errors may cause inconsistencies. Rather than trying to control the data creation to preempt errors, the focus changes to identifying inconsistencies and standardizing the data.
The user may not be able to impose specific data integrity requirements on the maker. If pharmaceutical consumption is minor and the requirements too onerous, without commensurate return on investment, there is a risk of the maker withdrawing from the Pharma market if no longer economically viable to serve. In the large plants producing excipients there is a bias towards simplification and commodity volumes versus complexity and specials. Pharmaceutical requirements that can be met with incremental investment, and which does not increase operating costs to serve majority markets, are more likely to be accepted.
Quality culture is perhaps more important than integrity of specific data. Pharmaceutically aligned excipient manufacturers should have the personnel, expertise, training and a culture for employees to raise issues and follow good data governance. It will then be much easier to deal with any mismatch in data integrity expectations between user and maker.
Ahead of this year’s CPhI Worldwide, we are summarizing the findings of a previously unpublished in-depth piece from last year’s CPhI Annual Report. The full findings in this year’s Annual Report will be released at CPhI Worldwide in November (5-7) and all previous annual reports are available online at
Brian Carlin, Director QbD/Regulatory DFE Pharma
Dale Carter, Head of Quality Silica Americas Evonik
Irwin Silverstein, President, IBS Consulting in Quality LLC
Ann Gulau, Quality Assurance, Dow Chemical Company
Brittney Wells, Regulatory Lead, CQA, CQE, PCQI, Lonza
Katherine Ulman, Primary at KLU Consulting