For Life Science Companies
The purpose of document control systems is to ensure that manufacturers build products that are safe and reliable. ISO and FDA Current Good Manufacturing Practices (CGMPs) presume that both the process and documentation that directs company processes follows pre-approved methods and that any change to these methods is restricted to authorized personnel and tracked for future review. All FDA-regulated and ISO-certified companies are mandated to have a document change control system.
Inefficient document control systems cost FDA-regulated manufacturers millions of dollars. This significant loss in revenue can primarily be attributed to the inefficiencies that occur when using a paper/hybrid-electronic system (wherein document change control is managed in a manual fashion or using a combination of both paper and electronic files.) Manual systems are error-prone, delay a product's time to market, and introduce product quality problems that can result in stringent regulatory penalties. In fact, the FDA cites inadequate change management as a major cause for "Form 483" observations. Examples of common shortcomings include documents with missing dates or missing numbering schemes, uncontrolled copies and document changes without approvals or explanations. To eliminate these inadequacies, regulated companies are turning to electronic-based quality management systems.
Today's quality management systems provide integrated solutions to handle everything from corrective /preventive actions (CAPA) through change control and training.
Today's quality management systems provide integrated solutions to handle everything from corrective /preventive actions (CAPA) through change control and training. This article will focus on document control processes within the quality system lifecycle and provide insight into the capabilities needed to automate change control processes that will increase efficiency, ensure compliance with FDA requirements and improve overall profitability.
To eliminate the problems FDA-regulated companies are being cited for during inspections and audits, a change management /change control software solution must incorporate the following capabilities:
- Compliance Management
- Document Management
- Revision Control
- Complete Implementation and Validation Tools
In order to move from a manual, paper-based system to an electronic, automated system, manufacturers must follow the guidelines outlined in regulation 21 CFR Part 11 for using electronic records and signatures. These guidelines include the following:
- Multi-password access and signature...forced expiration - The FDA requires two distinct identification components for document compliant change control: one for login and one for document approval. Options should be available for configuring the length of the password and alphanumeric combinations to maintain the highest level of security for the system. Password expiration, encryption and certification are also necessary.
- Account and intruder lockout - An account should be automatically locked for both login and approval anytime a password or login is compromised. If any unauthorized attempt is made during either login or approval, the intruder lockout feature is activated (after the number of unauthorized login attempts or approval attempts has been reached). The system administrator should be able to customize the number of password attempts.
Figure 1 — Change control as part of the quality management lifecycle
- Signature manifestation on the document - Signature manifestations are required for FDA regulated companies to meet Part 11 requirements and should be automatically appended to each document. Manifestations should include first name, last name, date, time and meaning of the electronic signature. Manifestations should also appear on all human-readable forms that are either viewed electronically or printed on paper.
- Change control rationale - Changes made to document metadata should be tracked. (The Metadata contains document attributes like title, author, etc.) Each time a change is made to any metadata, a user must enter a reason for the change. The system must track each of these changes and make them available for review.
Document management capabilities boost efficiency and ensure compliance by eliminating labor-intensive tasks like physicallyrouting documents for approval, storage and distribution.
- Format agnostic - The system must be able to control any document regardless of the application used to create(e.g, Word processing, spreadsheets, CAD, video, audio...)
- Document lifecycle management - Documents must be managed through their lifecycle statuses of Draft, Released and Archived. (See Figure 2) Lifecycles can be based on document type and need to automatically adjust document security based on lifecycle status.
- Audit trail history / record archiving - A secure, time-stamped audit trail of all changes made to any record should be maintained and accessible to the appropriate users and departments. All of this information needs to be automatically captured and secured. Reporting functionality would track past versions, metadata and approval history of the record, from the time it was created until the present.
- Centralized, Secure Repository - Documents should be securely stored to ensure only authorized access, while making it easy to protect against disaster.
- Document cross-linking - In manufacturing environments, documents complement one another. For example, a form may be associated to a standard operating procedure (SOP), or an equipment manual associated with a maintenance drawing, etc. A document control system should allow document linking to provide users the relevant information needed to do their job.
Document revision control represents one of the most time-consuming tasks and one of the tasks that is ripe for automation. When automating document control processes, users will find that with the right solution they can accomplish the following:
- Ensure control of all document versions/revisions - Be able to present the currently released document, while simultaneously managing collaborative changes that will result in a new revision.
- Control rogue documents - A system should alleviate the consequences of uncontrolled electronic documents by enabling copies to "Self Destruct" after the "configurable" time allotted to the document expires. For example, a document that is saved outside the system and e-mailed to another person would be impossible to open 48-hours after it is copied from the system. Similarly, a system should offer capabilities to manage printed documents. Anytime a document is printed from the system, expiration dates and times should be automatically watermarked prominently on the document.
- Automate document routing, approval and escalations - Document routing and approvals should be automatedto notify all approvers or collaborators in the authorization chain. Configurable, time-based escalation featurescan expedite approval and collaboration cycles in case users are too slow to act or are unavailable. Upon approval, old versions would automatically revision while users affected by the change are assigned a task be trained or re- trained. (Training is addressed in a supplementary white paper available from MasterControl)
- Automatic document replacement (draft to release to archive) - As documents are approved old versions should automatically move to an archive vault and be replaced by the newest version. This eliminates any possibility of employees using the incorrect version. (See Figure 2)
- Unlimited pre-determined and ad-hoc routing steps - Routes for document collaboration or approval should be pre-configurable for use at anytime or added on the fly. Each step in a route can have one or many approvers assigned to it to allow for the creation of a combination of serial and parallel routing.
- Real-time, repeatable e-mail notification - Customizable e-mail notification should be provided to alert users in a route to take action of their specific tasks. Managers would be notified when tasks are completed to proactively monitor collaboration, change management, approval and training cycles.
- Electronic signature/approval history tracking - Managers should be able to view electronic signature details, approval history and cycle statuses as needed during the change management process.
- Automatic distribution upon approval - After the completion of approval cycles, documents should be automatically distributed to users affected by the change and old versions are archived.
FDA-regulated companies looking for document control, change management or change control systems should search out applications that have complete services for implementation and validation.
- Training for IT managers, system administrators and general users - A variety of training should be available for system administrators, advanced users (PowerUsers) and general users (Viewers) that are mindful of the product, the industry, and the customer's unique practices. Such training should be available at the vendor's facility, at the customer site, live over the Web, and/or pre-recorded.
- Validation tools and services - Organizations should ensure that the solution provider has been audited by similar companies within their own industry and that they have a good user-base of references. Organizations should also ensure thatvendors provide all the necessary validation tools and services for buyers to perform their own validation or elicit complete services from the vendor. The vendor's validation tools and services should follow Good Automated Manufacturing Practice (GAMP) guidelines for computer systems validation. A good rule of thumb is thatvendors that offer their own validation tools and services are generally more familiar with the system and can usually accelerate validation.
FDA-regulated companies would agree that moving from a manual, paper environment to an electronic system for document control and change management is challenging. It is an endeavor that includes costs for upgrading IT infrastructures(if necessary), the training of users and the validation of the system. However, most, if not all of the companies that have made the transition can prove that the benefits of automation include a faster return on investment (ROI). More importantly, the automation of these change control tasks eliminate common errors that are cited in FDA 483 Observations yielded by companies using manual, paper-based/hybrid-electronic systems.
Jason Clegg is Marketing Director at MasterControl Inc. MasterControl produces software solutions that enable regulated companies to get their products to market faster, while reducing overall costs and increasing internal efficiency. MasterControl securely manages a company's critical information throughout the entire product lifecycle. Our software is known for being easy to implement, easy to validate and easy to use. MasterControl solutions include quality management, document management, product lifecycle management, audit management, training management, document control, bill of materials, supplier management, submissions management, and more. Supported by a comprehensive array of services based on industry best practices, MasterControl provides our customers with a complete information management solution across the entire enterprise.
Is it a Correction, a Corrective Action, or a Preventative Action?Read each CAPA scenario carefully. Decide whether the scenario is a Correction (C), Corrective Action (CA) or a Preventive Action (PA). Select one answer only! If the answer you selected is correct you will continue to the next scenario. If it is not correct you can try again!