1Department of Pharmaceutics and Pharmaceutical Technology, L M College of Pharmacy, Ahmedabad - 380009, Gujarat, India.
2Faculty of Pharmacy & Faculty of Science, Ganpat University, Mehsana-984012, Gujarat, India.
3Chemical Engineering Department, L D College of Engineering, Ahmedabad -380015, Gujarat, India.
Manufacturing of pharmaceutical products consists of multiple steps and the generation of several data connected to the different manufacturing processes. All the data that is generated as a result of product manufacturing should be accurate and reliable. Because it will directly relate to the quality of the pharmaceutical product. it is the basic necessity of any pharmaceutical industry to produce such a product that is reliable for its quality throughout the entire life cycle of the product. currently, There is various regulatory guidelines are available for data integrity maintenance starting from the first guideline given by USFDA in 1963. Various leading regulatory authorities like the US FDA, WHO, MHRA, EMA, and PIC/S have already given their standard for data management and data integrity. In the last few years during the inspection by regulatory bodies in different pharmaceutical industries, various breaches in data integrity due to a deficiency in good manufacturing practice (GMP) have been observed, leading to non-compliance with the guidelines set up by the regulatory body. During the regulatory inspection if this type of non-compliance is observed then it will lead to a diminishing effect on the pharmaceutical industry in way of getting a warning letter and issuance of form 483. Further, it leads to safety concerns, product withdrawal from the market, a ban on importation, business damage, and sometimes closure of the pharmaceutical firm. This review article focuses on the concept and importance of data integrity in the pharmaceutical industry, possible ways to minimize data integrity, and improvement in compliance with regulatory requirements.
Manufacturing of a pharmaceutical product consists of several manufacturing stages, equipment including laboratory instruments, and facilities. The product is manufactured with compliance to good manufacturing practices which ensure the quality, safety and efficacy of a product. The term CGMP ensures that the product manufactured meets its predefined expectation to meet product identity, strength, quality, purity, and safety for its intended use. (1). Data is a set of information generated through the manufacturing process and it gives imprint related to the quality of the product. Data can be considered the most precious asset of any company’s manufacturing process or research. during the entire life cycle of data, data should be reliable and it should be accurate. The reliability of the product depends on the quality of the data through which the product is manufactured. We can say that the quality of data is identical to the integrity of data (2).
Data integrity is an essential component of the pharmaceutical industry, as it ensures that the data generated and used in the development, manufacturing, and distribution of pharmaceutical products are reliable, accurate, and consistent. Data integrity means that the data is complete, consistent, accurate, and verifiable, from the point of data creation to the point of data destruction. It is critical for ensuring patient safety, drug efficacy, and regulatory compliance. In the pharmaceutical industry, data integrity is fundamental in every step of drug development, from research and development to clinical trials, manufacturing, and distribution. The data generated from these activities must be accurate, reliable, and free from manipulation or errors, to ensure the safety, efficacy, and quality of the drugs produced (3)
The pharmaceutical industry is highly regulated, and regulatory bodies such as the U.S. Food and Drug Administration (FDA), the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) and the European Medicines Agency (EMA) have established guidelines and standards for data integrity. These guidelines provide recommendations and requirements for pharmaceutical companies to ensure data integrity and compliance with regulations. One of the most significant challenges in ensuring data integrity in the pharma industry is preventing data manipulation or falsification. This can occur due to intentional misconduct or unintentional errors, such as transcription errors or system malfunctions. To prevent these issues, companies must implement a robust quality management system (QMS) that includes policies, procedures, and training to ensure that all employees understand the importance of data integrity and how to maintain it. Another critical aspect of data integrity is cybersecurity. The pharma industry generates and stores vast amounts of sensitive data, such as patient information, clinical trial data, and manufacturing processes. This data is vulnerable to cyber threats, such as hacking or ransomware attacks, which can compromise the integrity of the data. Companies must have effective cybersecurity measures in place to protect their data from these threats(3)(4)(5)
In the last couple of years, there is a large number of regulatory actions have been observed like import alerts and issuance of warning letters because of the violation of the current good manufacturing practices (cGMPs) (6). Due to the inappropriate practices and medicine falsification pharma industry received a warning letter and USFDA Form 483 (7). Issuance of a warning letter may further lead to penalties, fines, importation ban, reputation damage, business damages, reduction in share price, product recall, and closure of the firm(8) further it leads to a negative impression of the product and loss of trust by consumer and physician (9). These violations in GMP practices are the source behind the generation of various regulatory actions (10).
For the verification of the cGMP compliance by the pharma industry inspection by the FDA is carried out generally for different reasons like pre-approval inspection, regular inspection, post-approval, and cause audit. FDA inspection is generally carried out for the inspection of the six systems Quality system, facility and equipment system, production system, laboratory control system, material system, and labeling and packaging system (11). After the completion of the inspection by the FDA, the inspection result can be any of these three categories a)No action indicated: indicates that not at all compliance issue was found b)Voluntary action indicated: which indicates approximately regulatory violations were found but no further regulatory action require c) Official action indicated: indicate meaningful violations were observed and FDA intends to take further regulatory actions and issuance of FDA form 483 (12).
Understanding Data Integrity and Breach of Data Integrity
Data is defined as a set of information that has been translated into a form that is efficient for movement or processing. Data can be collected, measured, analyzed, and reported and further it can be visualized using images, charts, and graphs. We can further categorize data into raw data and metadata. Raw data is related to original documentation or records which is generally retained in its original format. For example, Printout generated from pH meter or balance. Metadata is related to data that generally provides context and meaning and that describes attributes of other data. Metadata generally describes data elements, structure, interrelationships, and other characteristics of data (6). Quality of data ensures that data is produced according to its predetermined expectations. Data are considered of high quality if they are fit for their intended use in various planning and operations. If any data is correct, complete, reliable, valid, consistent, and unique then the data is said to be free of defects (1).
Integrity is something we can call “Doing the right thing when no one is watching”. It is something that can be correlated with having strong moral principles, moral uprightness, and honesty. It is an individual’s personal choice to uphold moral/ethical standards (6). Data integrity plays an key role in the pharmaceutical industry for the reliability of its products. It is an principal part of the quality management system which ensures that data is the evidence for the safety of the product. Data integrity can be considered as a map of maintaining and ensuring the consistency and accuracy of data throughout its entire lifecycle. Every pharmaceutical quality system should have good data management and data storage. Expectation from any regulatory agency is that data should be true and traceable during its entire lifecycle (13).
Dr. Thomas HECKER has defined falsification of data in one of the presentations as “Any wilful manipulation, misstatement, misrepresentation, hiding, rewriting, adulteration, substituting of quality-related documents, activities or buildings, materials, to give an item the presence of GMP compliance when this is not the event, as these facts are not identified and/or known, approved/supported by management (e.g. false analytical data checked and approved)” (10).
The characteristics of data quality defined by the global regulators in the pharmaceutical industry are Attributable, Legible, Contemporaneous, Original, and Accurate—better known as “ALCOA”(FDA, 2018c; MHRA, 2018; Pharmaceutical Inspection Co-Operation Scheme [PIC/S], 2018; WHO,2016a). These guidelines represent the minimum acceptable level for data quality. ALCOA was first referenced in the FDA guidance for electronic source data in clinical investigations (FDA, 2013). Also, attributable, legible, contemporaneous, original, and accurate plus(ALCOA+), with the “+” sign in the ALCOA+ represents additional attributes for ALCOA that include the following:
ALCOA: (1) (14) (2)
A: Attributable: Data are captured in the record so that it is uniquely identified to the person generating the data. In the case of an electronic source record, the system must be compliant with 21 CFR Part 11 guidelines and maintain an “audit trail” of the data entry by registering the user, data, and time of the entry, and in some cases comments also
L: Legible: Data are readable, understandable, and permanent. The signature on the record should be identifiable.
C: Contemporaneous: Data are recorded at the time they are created or observed. It indicates the online entry of data without any backdating or predating.
O: Original: Data includes the first capture of information or source capture of data. Data should be kept in its original form. Metadata is also considered important in the record of data.
A: Accurate: Data are correct, truthful, complete, valid, and reliable. Editing of data should be avoided. Data should not contain any errors or mistakes.
ALCOA+ represents additional attributes for ALCOA that include the following:
Complete: All data generated including relevant metadata. Data is complete without any lacking,
Consistent: All data generated follow good documentation practices
Enduring: Encompasses data that lasts throughout the data lifecycle
Available: Data are available and can be accessed throughout the data life cycle
5 W’s of Data integrity: Along with the cGMP five W’s of data integrity are discussed which include as following descriptions are required
What: are Metadata, raw data, and audit trials?
Who: Who generated the data, who modified the data, and who has reviewed the audit trail report?
When: When the data are generated? Or when the changes are made to the data?
Where: where the changes are made?
Why: Why were the changes made?
Common trends in regulatory observations on data integrity breaches
Along with the growth of pharmaceutical manufacturers there is also an increase in the number of cases related to breaches in data integrity also observed. Several different types of data integrity issues are observed during regulatory inspection. These are a result of GMP violation, poor quality management, Lack of training, untrained staff, Computer systems not secure, Resource constraints, inadequate procedure related to various processes, poor document management, and equipment or electronic data not complying with 21 CFR PART11. A result of regulatory observation on data integrity breaches leads to various regulatory actions like issuance of warning letters, import alerts and seizures, product recall, and closure of the firm (13). Further most common trends in data integrity breaches can be described below in Figure .1 (2) (15)
Figure 1: Reason behind Data integrity breaches
Regulatory Aspects on Data-integrity
Various regulatory expectations are there to manage data integrity in the form of different regulatory guidelines.
Title 21 CFR is there for rules of the Food and Drug Administration by USFDA. Codification for the general and lasting rule published in the federal register by the executive sections and agencies of the federal government is USFDA 21 CFR (Code of Federal Regulation). According to the USFDA “Data integrity denotes the consistency, completeness and accuracy of data. Complete, consistent, and accurate data ought to be original or a true copy, accurate, attributable, legible and contemporaneously recorded.” (FDA,2018c.p.4) (1). USFDA has given 21 CFR Part 11 to spell out the requirement concerning the computerized system. 21 CFR requests to electronic records that are created, maintained, modified, archived, retrieved, or transmitted under any records requirements by a regulatory agency (16). FDA has clarified the role of data integrity in current good manufacturing practice (CGMP) for drugs
For the Pharmaceutical industry, MHRA has provided guidance. According to MHRA (Medicines and Healthcare Products Regulatory Agency)” Data integrity is the degree to which data are trustworthy, consistent, complete, accurate, reliable and that these data characteristics are maintained throughout the data lifecycle. The data should be gathered and maintained securely so that they are accurate. attributable, legible, contemporaneously recorded and original. ”(MHRA,2018, P.9) (1).
WHO has specified data integrity guidelines to protect patients all over the creation. Which defines international good practices for regulatory specialists and inspectors that can help to reduce misrepresentation of data. (2) The World Health Organization explains data integrity as the degree to which data are complete, trustworthy, consistent, accurate, and reliable and that these data characteristics are maintained throughout the data life cycle. It includes all obedience to scientific principles and good documentation practices(WHO,2016a,p-171) (1).
According to the Pharmaceutical Inspection Convention and Pharmaceutical Inspection Co-Operation Scheme (PICS), data integrity is the extent to which all data are complete, consistent, and accurate during the data life cycle. The data should fulfill with ALCOA+ Principles. (PIC/S,2018. P.51) (1)
Therapeutic Goods Administration (TGA), The Australian regulatory body has defined data integrity in the form of deficiency. Specifically, focus deficiency in a practice or process that has resulted in a significant risk of producing a product that is harmful to users. Further, it also focuses on data falsification, product falsification, fraud, or any misrepresentation.
For the assurance of data integrity throughout the process of testing, , packaging, manufacturing, distribution, and monitoring of medicines the European Medicines Agency has released new Good Manufacturing Practices (GMP). All the regulators trust on these data to evaluate the safety, quality, and efficacy of the medicines. (2) EUGMPs (Annex 11) in 2011 is an important example of regulatory authorities' requirements to safeguard the integrity of GxP data. (17). EU GMP Annex 11 applies to all forms of the computerized system as a part of GMP-related activities. The computerized system shall be validated and IT infrastructure shall be qualified according to the guidelines (16).
Data integrity, warning letter, and compliance
A data integrity breach is referred to as not maintaining the integrity of the data. Which indicates that the truth or reality is not reflected in the documents. Data integrity applies to each step during the drug discovery and development process. It may include various focus areas such as clinical trials, manufacturing, research and development, quality control, quality assurance, ensuring inspection, and post inspection also. During the regulatory audit, the reason behind the data integrity observation can be anything like human error, technical error, or organizational error ( related to document quality and audit management) (8) if it is focused on different warning letters issued to various Indian pharmaceutical industries the different violations in data integrity observed that includes failure to record document online, falsification of data, manipulation of data, incomplete records (BPR & BMR), backdated entry, predating entry, data overwriting, use of scratch paper, use of correction fluids and data mismatch observations (9). Some common issues observed by USFDA inspectors related to electronic data management include the firm is not having any data backup facility, electronic data are not secured, sharing of login IDs, instruments are not having audit trial reports and digital signature, the User access level is not defined (18).
Different ways to prevent Data integrity issues:
For the better growth of any pharmaceutical firm, they need to ensure that they are delivering quality products and, that their product is safe and effective. This can be ensured by the data they are representing related to specific products. The most common strategy to avoid data integrity is for the firm need to ensure that data generated throughout the manufacturing and processing stage are all original, accurate, correct, and integral.(16) The firm can develop a strong strategy to maintain data integrity and minimize the breach in it. which can be summarized below.
Company culture: The most important role in maintaining data integrity is played by the individual company’s culture. It is very important to define and apply strict ethical corporate standards for maintaining standard practices and policies of the firm. The company must develop a zero-tolerance policy for intentional fraud, careless work habits, unintentional data integrity violations and not having ethical practices to avoid unintentional data integrity breaches. a company should promote a culture in which people can openly talk about the errors that occurred while performing the task as well can talk about how to overcome them, management must appreciate the honesty and goodwill of the employee so that employee should not have any fear regarding the acknowledgement of their own mistake. All the rules and regulations related to data integrity are followed properly or not should be verified by QA oversight. It also includes regular inspection as well as surprise inspection.(14)
Self-Inspection: To achieve self-management and improvement the best way is to do a self-inspection or self-audit. Firms can have a regular self-inspection system at regular time intervals as well they can develop a self-checklist. Only having a self-inspection system is not sufficient but there should be a strict schedule for time-to-time inspection of the company. Depending on the requirement checklist can be further prepared and categorized. (6) The company should have an arrangement for regular external audits as well as internal audits so that logbooks, reviews of different documents, and attendance can be verified from time to time. Further frequency for reviewing data can be increased to find out the gap.(18)
Training: Human error is one of the major reasons behind the breach in data integrity. For the minimization of human error training to the individual can play a great role. At a specific time interval, training should be provided to technical as well as non-technical operating staff.(17) Training can be given in different languages also, specifical for the non-technical local staff it can be arranged in their local language also. Training can be given to increase the moral principle values, personal ethics, and good practices to follow as well for proving that understanding the individual role is how impactful to the medicine quality and the patient’s health.(15)
Quality culture development: The quality culture of the company plays a major role in maintaining quality as well as data integrity. Management of the company should take the initiative for the development of a quality culture. The company should arrange an awareness program such that individual can understand their role and responsibility towards the maintenance of quality. it should be that everyone willingly follows the code of ethics strictly, and everyone can share their failures or errors that might have occurred during any stage while handling the product so that further corrective and preventive action can be taken further.(15) The culture of data integrity should be followed through data integrity policy and standard operating procedures.(18) A quality-focused culture must have a healthy work environment, enable a senior person to guide employees effectively, and be able to develop people, the employee should have a feeling that their efforts are worthwhile and lead to satisfied customers.(19)
Electronic system validation & 21 CFR Part 11 compliance: An electronic system or computerized system should be validated and should comply with 21 CFR Part 11. the computerized system should be able to prevent unauthorized access or data modification as well as to record any changes or updations done with the system and who has made the changes when the change was made. All electronic data should have a proper backup. To maintain better data integrity with the electronic system it should have a biometric system. With the use of biometric signatures, it is easy to verify an individual’s identity based on physical features that are unique as well as measurable to the individual. Such as hand prints and retinal scans. With the use of modern tools such as LIMS, ELN, and LES instruments can be easily paired with the computer to achieve better workflow.(15) For the management of the industrial production process, an effective combination of information technology with proper automation can play a great role in the minimization of human error.(20) Many other technology solutions are available today for electronic data management for industry such as Warehouse Management (WHP), Content Management System (CMS), Enterprise Resource Planning (ERP), Electronic notebooks, Enterprise Content Management (ECM), and Library Information Control. tracking facility of the electronic management system is advantageous for keeping track of all sorts of documents.(21) The data that are stored electronically shall be protected by different methods such as audit trial reports shall be maintained, data should have a proper backup to another storage system or it should be protected against loss or damage. The different control as a part of the data integrity system includes validation of the computerized system, the system should able to generate audit trail reports whenever needed. Audit trial report should be computer generated, date and time-stamped, sequencing of events, and further any requirement for ensuring the change is done without obscuring previous entries to ensure the trustworthiness and reliability of the records, it should be able to record every activity that is carried out at a particular system.(16)
External consultation: One of the best practices or recommendations is to work with experts who are outside specialists. Engage subject matter Experts/third-party DI consultants.(13) Who can provide knowledge and guidance regarding the individual’s role and responsibilities towards the management of the data integrity. The external specialist can keep an eye on an individual’s role, responsibility, records, and documentation. they are ensuring that the firm has sufficient quality and super`visory personnel with the knowledge of the DI system, the firm can make DI standards clear, can provide training for maintaining the integrity standards, procedures, controls, and documentation practices that will lead to the maintenance of data integrity.(22)
Risk management: Agreeing to the Pharmaceutical Inspection Co-operation scheme the firm should have schedules for data governance that should be documented inside their Quality management system. Data integrity control should be risk-based and by utilizing the ICH Q9 direction where data integrity danger is documented and regularly supervised by senior management. By mentioning to risk management principles described in ICH Q9, it denote that “The planned user should perform a risk assessment to detect all the GMP/GDP relevant electronic data produced by the computerized systems. Once recognized, this critical data should be examined by the regulated user and verified to determine whether operations were executed correctly and whether any change(modification, deletion, or overwriting) has been made to the original data in electronic records. All changes need to be duly authorized. The review of data-related audit trails should be part of the repetitive data review within the approval process.” For the computerized system frequency, the role and responsibility of audit trial review should be based on a risk assessment according to the GMP/GDP relevant value of the data recorded.(18)
A recent warning letter citing the issue of Data Integrity
An analysis of warning letters issued by the USFDA to different pharmaceutical industries was carried out by referring USFDA website (fda.gov). Analysis was done for the period of the last six years that is from the year 2018 to 2023. further analysis was carried out to find out several warning letters that cite the word “Data integrity”. Detail analysis was carried out for data integrity-related warning letters and different information like the number of warning letters issued during each year, the number of countries that have received data integrity warning letters, the issuing authority of warning letters, the subject in which highest number of warning letter was issued was obtained.
The total number of warning letters in the last five years:
A total number of warning letters issued during the past six years that cite “Data integrity” is obtained according to the respective fiscal year. The following figure 2 represents the screening criteria for obtaining the no of the warning letter issued within the respective year. In the search option “Data Integrity” was written and a specific year was selected to obtain the total no of a warning letter that cites “Data Integrity” during that year. Figure 3 represents the number of warning letters that cite “Data integrity” issued in the respective year.
Figure 2: screening criteria for obtaining the no of the warning letter issued in the respective year that cites “Data integrity”
Figure 3: graphical representation of the number of warning letters issued in the respective year
Number of warning letters (citing Data integrity) to different countries
From the USFDA website data for each year was extracted to find out the number of warning letters issued to individual countries citing “Data Integrity”. Data is represented in below Table no:1 and Figure 4.
Table No: 1 Data integrity warning letter citing “Data integrity” issued to different countries during the past Six years.
Figure: 4 Number of warning letters citing “Data Integrity” to individual countries during the last five years.
Top 5 Issuing office:
From the USFDA website, the data was collected for the last six years and analysed to identify different issuing offices. Year year-wise Excel sheet was exported from the website with search criteria “Data Integrity”. data related to different issuing offices was separated. Amongst these, the issuing offices that have issued the highest number of warning letters citing data integrity were listed out in a sequence from the highest number of issuing letters to the lowest number. The below figure represents the top five issuing offices that have issued a maximum number of warning letters with the citation “Data integrity” during the last six years.
Figure 5: Top five issuing offices during the past six years.
Observation subject
From the obtained data analysis was carried out of each year to obtain different subjects in which the highest number of observations are obtained that are related to Pharmaceuticals. Which includes subjects like finished pharmaceuticals, adulteration, unapproved new drugs, misbranded drugs, active pharmaceutical ingredients, current good manufacturing practices, and quality system regulation. The following figure represents a graphical presntation of the last six years. All these subjects are separated by respective years and the data represent the highest number of observations issued in the year 2019 that are related to CGMP/Finished Pharmaceuticals/Adulterated/Unapproved New Drug/Misbranded subject.
Figure 4: Different subjects in which observation was issued by the FDA between fiscal year 2018 to 2023
CONCLUSION
The quality of a product represents the imprint of that pharmaceutical industry. Quality needs to be ensured while reviewing or auditing that firm. During the audit truthfulness of documents & accuracy and correctness in the process followed give a view regarding the liability of the product. Any non-compliance to GMP or manipulation of the data associated with the manufacturing process leads to a negative impression of the product as well to the individual industry. All the data associated with the development, manufacturing and distribution of products should be accurate, consistent and reliable. Every company must make sure that the regulatory requirements set forth by numerous regulatory bodies, such as the USFDA, MHRA, PICS, WHO, and EUGMPs, are met. To assure patient safety and therapeutic effectiveness, data integrity is a crucial part of the pharmaceutical industry. To assure the safety, effectiveness, and quality of the pharmaceutical product, the data resulting from various manufacturing stages must be accurate, dependable, and free from manipulation or errors. A solid quality management system can be developed by a firm to reduce the observational issues with data integrity citation. The firm can commence self-inspection, training, the development of a quality culture, consultation from an outside agency, risk management, and the validation of electronic systems by 21 CFR part 11. A company should employ and reduce any data integrity-related observations in every way possible.
CONFLICT OF INTEREST:
The authors have no conflicts of interest regarding this investigation.
REFERENCE
Mital Patel *, Praful Bharadia, Piyush Patel, Data Integrity breach: A critical challenge faced by the pharmaceutical industry throughout the regulatory audit, Int. J. of Pharm. Sci., 2024, Vol 2, Issue 7, 538-550. https://doi.org/10.5281/zenodo.12686521
10.5281/zenodo.12686521
