FDA Warning Letter due to GMP Violations when handling OOS Results

During their visit to a US contract laboratory, FDA inspectors found basic GMP violations in the following areas:

• Handling of OOS results (21 CFR 211.192). 
• Lack of verification of test methods (21 CFR 211.165(e)) 
• Lack of integrity of electronic data (21 CFR 211.68(b))

A closer look at the described deficiencies will shed light on why they violate basic GMP rules in the laboratory and why the company's responses were deemed inadequate, which ultimately led to the sending of this Warning Letter.

Dealing with OOS Results

After an analytical test yielded OOS results, measurements were carried out with a new sample preparation. According to GMP compliant procedures, a root cause investigation should have taken place first to clarify the reason for the OOS results. When reviewing the documents, the FDA inspectors also noted that the SOP for handling OOS results did not contain any corresponding regulations and obviously gave the laboratory staff freedom to proceed with such cases, which is not compatible with the GMP rules.

The requirements for handling OOS results are described in the Guidance for Industry Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production.

The contract laboratory's response to this deficiency letter was limited to stating that the SOP had been updated accordingly. However, the FDA considered this response inadequate due to the still missing regulations on the invalidation of OOS results. In addition, no retrospective review was conducted that could have served as evidence to fully identify and investigate all OOS results.

Lack of Verification of Test Methods

The laboratory always used the same analytical method for the determination of the content of the active substance in finished products with different formulations - without providing evidence in each case that the method was also suitable for this purpose. In the same way, i.e. without proof of suitability, the same pharmacopoeial methods were also used to test for microorganisms in different products.

The FDA considered the data obtained with the test methods to be not error-free (accurate) and rated the time frame given in the response for the subsequent performance of method verification studies as inadequate.

Lack of Integrity of Electronic Data

FDA inspectors found two fundamental GMP requirements related to the handling of electronic data not met:

• Access control of electronic data 
• Audit Trail

Access to this data was not adequately protected, i.e. it was possible to delete records. Furthermore, there was no audit trail in the data processing software of HPLC and gas chromatography and thus no control over possible data manipulation.

In its feedback to the FDA, the company assured that the manufacturers of the chromatography systems had been contacted to retrofit the software accordingly. However, as no evaluation of these systems was carried out with regard to possible data deletions and potential risks for the quality of the end products, the FDA also rated this feedback as "inadequate".

Following the description of the GMP violations, the warning letter contains a short section on the FDA's view of the responsibilities of a contract laboratory. The core statement of this passage is: The FDA considers the contractor to be an extension of the client's production site. GMP deficiencies at the contractor therefore in principle pose a risk to the quality of the client's medicinal products. From this, the FDA derives the urgent obligation that the contractor informs its clients immediately and completely about problems with the analytics.