Pharmaceutical Facility, Utility, Equipment, Qualification and Validation

1. 21st Century Regulatory Step by
Step Compliance
Part-2
Facility, Utility, Equipment,
Qualification
Presented By:
Md. Saddam Nawaz

2. Evolution of Commissioning and Qualification

3. Genesis of Verification - Industry
2001 – ISPE Baseline Guide 5 establishes impact assessment
model
2004 – FDA approaches ISPE with concerns on current
practices
 BG5 Impact Assessment model not delivering expected
efficiencies
 Significant failures and rework during and post qualification
 Excessive paperwork to show compliance
2004 – ISPE Qualification Task Team develops white paper on
risk based qualification
 Approved by ISPE International Leadership Forum (ILF)
 Team included J&J, Pfizer, Astra Zeneca, Eli Lilly, Genentech,
Merck &Co. NNE Pharma Plan, Commissioning Agents, Inc.

4. Genesis of Verification - Industry
FDA and ISPE ILF agree to support an ASTM International “Standard
Guide” as an industry consensus standard under E55 Committee
(Pharmaceutical Manufacturing & Quality)
 Developed by industry and regulators vs. FDA developed guide
2005 - ASTM International E55 writing team launched
 Lead by Pfizer (Sabra Seyer) and J&J (Dave Petko)
 Industry participation: GSK, Sandoz, Wyeth, Siemens, Novo Nordisk, Astra-
Zeneca, Thermofischer, Amgen
 A&E participation: NNE Pharmaplan, Foster-Wheeler, Commissioning Agents
 BOH participation: FDA (Donald Marlowe, Ali Afnan, Chris Watts ), Swedish MPA
(Christina Gaffner)
 Development input received: MHRA (Gerald Hadden, Paul Harvey)
ASTM E2500 published July 2007

5. • ASTM E2474-06 Standard Practice for Pharmaceutical Process Design Utilizing
Process Analytical Technology.
• ASTM E2476-09 Standard Guide for Risk Assessment and Risk Control as it
Impacts the Design, Development, and Operation of PAT Processes for
Pharmaceutical Manufacture.
• ASTM E2281-03 Standard Practice for Process and Measurement Capability
Indices.
• ASTM E2500-07 Standard Guide for Specification, Design, and
Verification of Pharmaceutical and Biopharmaceutical
Manufacturing Systems and Equipment.
• ASTM E2709-10 Standard Practice for Demonstrating Capability to Comply
with a Lot Acceptance Procedure.
ASTM Standards in FDA PV
Guidance

6. ASTM E 2500 - 07, What is it?
“A risk-based and science-based approach to the specification,
design, and verification of manufacturing systems and equipment that
have the potential to affect product quality and patient safety.”
“The overall objective is to provide manufacturing capability to support
defined and controlled processes that can consistently produce
product meeting defined quality requirements.”
 A voluntary consensus standard
 It has legal relevance
Stresses expert analysis of critical element that affect product quality
 “quality”, (not Quality Assurance or Quality Unit) appears 44 times
 “expert” appears 21 times
 “critical” appears 20 times

7. What ASTM E 2500 Applies To
Pharmaceutical and biopharmaceutical manufacturing
Systems:
Facility equipment
Process equipment
Supporting utilities
Process monitoring systems
Process control systems
Automation
Systems that have the potential to affect
Product Quality
Patient Safety

8. ASTM E 2500-07 Highlights
The ASTM standard focuses on
 Specification
 Design
 Verification
 Lifecycle
Alternative to ISPE Baseline Guide Vol 5 Commissioning &
Qualification
 complexity, cost, time
Replaces Design Qualification with a Design Review by Subject Matter
Experts
Risk Assessments by Subject Matter Experts (SMEs)
 Eliminate Impact Assessment
Use of umbrella term “Verification”
 “Fit for intended use” - Not bound by the formal, commissioning, IQ, OQ PQ
phases, validation or other
Lifecycle Change
 Continuous process improvements and real-time monitoring (PAT)

9. Why is it needed now?
“It is estimated that validation can add up to 25%
of the total installation cost for new facilities.”
E 2500 – puts focus on Critical areas that affect
Product Quality
Patient Safety

10. The Pfizer case
Pfizer is the largest pharmaceutical company in the world They
had implemented a risk based verification system globally in the
company according to the new ASTM E2500 standard. (Before
Pfizer had a traditional C&Q approach according to ISPE C&Q
guide Vol 5 similar to NN)
•By adapting the new risk based approach…Pfizer expect to:
• save 40% of all expenses to Commissioning and Qualification
• Eliminate between 2 and 6 month of project execution time.
• Get improved quality level

11. Implementing ASTM E 2500
To implement the concepts of E 2500
Approach has to change
Expertise (of the people involved) has to
change
Tools have to change
Otherwise there will be no real change

12. Traditional Terminology

13. Traditional Terminology

14. Traditional Terminology

15. Traditional Terminology

16. New Terminology (RBA)

17. Qualification -“Traditional” vs. RBA
Traditional Approach
(Product) User Requirements not
Formally Documented
Protocols Developed from “Templates”
IQ/OQ Protocols “Preapproved”
Commissioning not Leveraged
Engineering and “Validation”
Personnel Often Distinct
Emphasis on Documents – Not System
Performance
Risk-Based Approach
Process Requirements Documented,
Approved
Risk Assessments Determine Critical
Aspects of Design
Engineering Testing
(“Commissioning”) Verification
All Documents with Technical Merit
Used as Evidence of Fitness for Use
Emphasis on Meeting Process
Requirements

18. ISPE Guides Transformation to align with
ASTM 2500

19. ASTM E 2500 Is:
A standard approach for validating equipment,
facilities, processes
Streamlined process
Risk based – reduce costs
QbD – develop then employ best practices
More consistent qualification
Supports current regulatory guidance (FDA, ICH)
Knowledge (expert) based
Risk based

20. ASTM E2500-07 Lifecycle Phases

21. ASTM E2500 Key Concepts
Risk-based approach
Risk management should underpin the specification, design, and
verification process
Science-based approach
Product and process information should be used as the basis for
making science- and risk-based decisions that ensure that the
manufacturing systems are designed and verified to be fit for their
intended use
Critical Aspects of Manufacturing Systems
Critical aspects of manufacturing systems should be identified and
documented based on scientific product and process understanding
Quality by Design (QbD)
Quality by design concepts should be applied to ensure that critical
aspects are designed into systems during the specification and
design stage.

22. ASTM E2500 Key Concepts
Good Engineering Practice (GEP)
GEP should underpin and support the specification, design, and
verification activities.
Subject Matter Expert (SME)
SME’s should take the lead role in the verification of manufacturing
systems…within their area of expertise and responsibility.
Use of Vendor Documentation
Vendor documentation may be used as part of the verification
documentation, providing the regulated company has assessed the
vendor.
Continuous Improvement
Change management should provide a dependable mechanism for
prompt implementation of … improvements following the approach to
specification, design and verification.

23. Critical Aspects of Manufacturing
Critical Aspects :
Critical Aspects are defined as functions, features,
abilities, and performance or characteristics
necessary for the manufacturing process and
systems to ensure consistent product quality and
patient
Critical Aspects must be identified during the risk Management process.
Critical Aspects are derived directly from CQA and the general GMP
compliance issues.
Critical Aspects are subject to risk assessment and risk mitigation; if
possible and Verification testing.

24. Relation Of CQA, CPP, and Critical Aspects

25. What is GEP?

26. Subject Matter Experts (SME)
 SME is defined by ASTM as:
Individuals with specific expertise and responsibility in a
particular area or field (for example, quality unit, engineering,
automation, development, operations, and so forth).
• Subject matter experts should take the lead role in the
verification of manufacturing systems as appropriate within
their area of expertise and responsibility.
• Subject matter expert responsibilities include planning and
defining verification strategies, defining acceptance criteria,
selection of appropriate test methods, execution of verification
tests, and reviewing results.

27. Risk Based Approach
• Definition of CQA, CPP & Critical aspects
• Risk ranking
• Risk mitigation:
• Design solutions
• Control strategy
• Design Review
• SME allocation
• Suppliers selection
• Test
• Documentation etc

28. Quality Risk Management Identifying
Potential Risk
Well
known
vendor
Simple
Equipment
Customized
Well known
technology
New
Vendor
Bad
Vendor
Exact
Copy
Equipment
Customized
New
technology
Critical Process
Parameter
Unstable
process
Manual
Equipment
Customized
Complex
process
and
many
interfaces
Off the
shelf
Equipment

29. Risk Assessments
Risk assessment is an attempt to answer the following questions:
–What can go wrong?
Risk
–How bad are the consequences?
Severity
–How often does/will it happen?
Probability of Occurrence
–If it happened, how would we know?
Likelihood of Detection
–Is the risk acceptable?
Risk Evaluation, Mitigation

30. Organizational Structure of QRM

31. Risk Mitigation – Safe design solutions
& Control strategy
PAT
Monitoring
Equipment
Monitoring
HVAC
Monitoring
Sanitary
Issue
Calibration
Process
Monitoring

32. Risk Mitigation - Vendor Assessment
The most important questions are:
• Does the vendor have a documented and certified quality system
(e.g., ISO 9001)?
• Is equipment hardware developed and manufactured according to a
documented procedure?
• Are tests documented and traceable to design and requirement
specifications?
• Does the vendor provide assistance in design qualification,
equipment installation, qualification, maintenance, and timely repair
through qualified people?
• Is there a customer feedback and response system in case the user
reports a problem or enhancement request?
• Is there a change control system with appropriate notification of
users subsequent to changes?
• Will the vendor allow an audit if such a need comes up?

33. Quality Risk Management
Use of Vendors test results etc
Vendors test documentation may be used as part of the verification
documentation, if the vendor is assessed, and there is evidence of:
 An acceptable vendor quality system,
 Vendor technical capability
 Vendor application of GEP such that information obtained from the
vendor will be accurate and suitable to meet the purpose of
verification.
If inadequacies are found then we have to mitigate potential risks
by applying specific, targeted, additional verification checks or
other controls rather than repeating vendor activities and
replicating vendor documentation.

34. Risk Mitigation -Design Review (DR)
• The DR is an important part of the risk
management process, and DR must be focused
on the risk aspects:
– Design meets the mitigated unacceptable risk derived
from the risk assessment process.
– Planned Verification testing and acceptance criteria are
sufficient and commensurate to level of quality risk.
– Design Meets relevant Critical aspects and ensure that
Critical Process Parameters can be controlled to the
desired level
– The Critical Quality Attributes (CQA) can be ensured
by the proposed design

35. Key Ideas of ASTM E2500
Methodologies
1. Requirements
2. Specification &
Design
3. Verification
Toolbox
1. Design Review
2. Subject Matter
Experts
3. Risk Management
Process
4. Change Management
Plan

36. ASTM VERIFICATION FLOW

37. Benefits of Implementing E 2500
• LEAN manufacturing systems
– Remove waste
• Elevate our industry to more knowledge, better
understanding of our manufacturing systems
– Data, PAT, Design Space
• Focus on what’s important (Critical)
– More is not better
• Better technical understanding (Subject Matter
Experts)
• Less waste & repetition
– Use vendor doc’s

38. ASTM E2500 Case Study: Phizer
Transitioning from Traditional
Qualification to
Verification

39. Comparison of C&Q vs. Verification Approaches

40. Comparison of C&Q vs. Verification Approaches

41. Verification Model
Overview
(Phizer)

42. Verification Quality Strategy And Risk Management
Q8 Science Q9 Risk

43. Status of Phizer Verification Program

44. ASTM E2500 Case Study:
Amgen Relational Model
for Qualification

45. Change from Impact categorization
to “Levels” – Mindset Change
Level 1- Equipment assets within a system where
operation or maintenance activities can affect the
critical quality attributes, the critical aspects, or the
critical process parameters of the product the system
delivers.
Level 2 - Equipment assets within a system where
operation or maintenance activities can have an adverse
business impact.
Level 3 - Equipment assets not included in the definitions
of level 1 or 2.

46. Amgen interpretation and application
of:
ASTM-2500
ICH Q9
EU Vol. 4 Annex 15
FDA Process Validation
ISPE FSE Guide

47. Using the Document Hierarchy
12/5/2016 Md. Saddam Nawaz 47

48. GEP Framework – 5 SOPs
Design Review
Engineering Change Management
Engineering Quality Systems
Automation Project Delivery
Commissioning Planning and Execution

49. Amgen Relational Model
for Qualification
12/5/2016 Md. Saddam Nawaz 49

50. EU GMP Guide-Annex 15
Qualification & Validation draft released

51. EU GMP Guide Annex
15 Qualification &
Validation draft
released in 2014

52. Step 1: Develop Supporting Processes
• SME Qualifications: SMEs are identified for
specific systems, and their qualifications
documented. Criteria for SME qualifications
establish minimum standards for education,
level of experience, systems expertise, formal
training, and certifications. Manufacturing or
process science experts typically define user
requirements, whereas systems engineering
experts focus on design and verification.

53. Step 1: Develop Supporting Processes
(Cont’d)
• Risk-Assessment Tool: This tool focuses SME
decision-making and documents the rationale
explaining why some testing is unnecessary and
why some requires added scrutiny. Many risk
analyses can be conducted by just two or three
SMEs who have system-specific engineering and
facilities expertise. Such experts perform risk
analyses by considering risks to products,
patients, systems, and safety. Their risk-analysis
reports identify critical aspects and rank risks as
negligible, tolerable, undesirable, or intolerable.

54. Tool is likely a suitable fit under this consideration and is designed or capable to perform this way.
X Tool may have less (or no) capability to deliver under this consideration or may be either overly complicated or too simplistic for
the task.
! Tool may be suitable, however effectiveness may be limited due to challenges in rating some probabilities of occurrence. It may be
challenging to rate risk probabilities if there is limited means to detect those risks in the first place.
1 Brainstorming capability of this tool may be particularly beneficial for this type of assessment.
2 Capabilities of this tool can be scaled back to accommodate qualitative or more simple assessments.

55. Step 1: Develop Supporting Processes
(Cont’d)
• Engineering Change Notification: A simple
process documents and approves the inevitable
modifications that occur during system design,
start-up, and verification. This streamlined
process describes and authorizes updates to
system specifications, design, and testing and
ensures that they are approved by both SME
and the “system owner.”

56. Step 2: Project Planning
VMP
Verification Team and Responsibilities
Document Matrix (planning, design &
verification)
Eligible vendor documentation
According to E2500 sections 6.8.1 and 6.8.3,
vendor qualification is approved by a
system’s SME and a company’s quality
assurance department.

57. VMP
1.5 The VMP should be a summary document which is brief,
concise, clear and contain data on at least the following:
a) Validation policy.
b) The organizational structure for validation activities.
c) Summary of the facilities, systems, equipment, processes on site and
the current validation status.
d) Template formats to be used for protocols and reports.
e) Planning and scheduling.
f) Change control and deviation management for validation.
g) Handling of acceptance criteria
h) References to existing documents.
i) An assessment of the resources required.
j) The ongoing validation strategy, including revalidation and /
requalification, where applicable.
k) Confirmation that the materials used for validation are of the
required quality and suppliers are qualified to the appropriate level.

58. Step 3: Requirements Definition
• User requirements specifications (URSs)
define needs that will provide the “basis for
further specification, design, and verification
of the manufacturing system,” says E2500
section 7.2. SMEs typically develop and
approve these requirements based on a
company’s needs for capacity, output, process
controls, and cleaning/sterilization as well as
the operating environment.

59. URS of Pure Steam Generator

60. 12/5/2016 Md. Saddam Nawaz 63

61. Step 4: Specification and Design
• SMEs translate URSs into a system description
and functional specifications (FS), which
provide the basis for a system’s detailed
design. System vendors are often best
equipped to develop those specifications. A
vendor also can be leveraged to provide both
hardware and software design specifications
(HDSs and SDSs) as needed.

62. Step 5: Risk Assessment
• At this point, SMEs conduct an FMEA (or
other tool) as a design review to identify
critical aspects that affect their systems’
installation, operation, and performance.
Resultant URS and FS revisions are
documented with an engineering change notice
(ECN) approved by each system’s SME (if
required). Recommended verification testing is
carried forward for critical aspects to the
verification plan

63. Step 6: Verification Plan
• A verification plan provides a systematic
approach to verify that manufacturing systems
“have been properly installed,” “are operating
correctly,” and are “fit for intended use,” as
described in E2500 sections 5.1 and 7.4.
• A verification plan consists of two documents:
an inventory verification list (IVL) and a
verification test matrix (VTM).

64. 12/5/2016 Md. Saddam Nawaz 67
An IVL contains a list of relevant documentation: URS, FS, HDSs, SDSs, piping and
instrumentation diagrams (P&IDs), electrical and mechanical drawings, manuals,
utility predecessor matrices, a risk-analysis report, a verification testing matrix, and
the verification protocol and report.
VTM identifies critical testing on the basis of risk levels identified in a risk assessment
report, design documentation, and SME input. This document also identifies the
chronological point in a system’s life cycle (e.g., factory, installation, start-up, or
qualification) when testing will be performed and documentation acquired (E2500
section 7.4.2.1).
Critical aspects require added SME scrutiny and are documented or tested in a
verification test protocol (VTP). Acceptance criteria for a VTP are derived from
performance and functional requirements detailed in system design documents (e.g.,
URS and FS). VTPs list tests to mitigate high-risk aspects as well as tests deemed
necessary by SMEs to demonstrate system functionality, features, capacity, and output
quality. Such critical tests are generally executed only once, either during factory
testing. As described in section 7.4, a VTP contains only the critical testing necessary to
verify that a system is properly installed, that it operates correctly, and that it is fit for
its intended use (E 2500 §7.4). A VTP organizes this testing as it pertains to
installation/utility verification, start-up/operation verification, and
functional/performance verification. According to E2500 section 7.4.2.3, a VTP
ensures that this critical testing is reviewed by both an SME and QA personnel.
Noncritical aspects are documented using the IVL checklist and typically do not
require the resources or oversight of an SME or QA personnel.

66. 12/5/2016 Md. Saddam Nawaz 69

67. Step 7: Verification Plan Execution
• Because a VTP covers only critical testing, it is executed or
overseen by a system SME (E2500 section 7.4.3.1). Critical
tests assess system performance and functionality and
include more complex testing, such as performance curves
and system response attributes.
• Documentation and test results from the FAT and SAT —
including eligible vendor test documentation (section
7.4.3.2) — may be referenced to satisfy test requirements
within a VTP. In that case, prior test results would be
reviewed and documented by the SME during VTP
execution. A key element of such an approach is that testing
is not repeated unless results are likely to be affected by
transportation or installation.

68. Step 8: System Verification Report
• This report specifically reviews and summarizes all testing for critical
aspects as identified in a VTP. Ideally, the report is written by an
independent SME, which further mitigates risk by providing an independent
review of protocol exceptions, deviations, and punch-list items.
• It also summarizes actual system performance data (e.g., capacity and
outputs) to compare with user requirements and specifications. That
provides added value as a document to reference in defining actual system
capabilities.
• Based on that review, a system verification report concludes with a
statement that indicates whether a system is or is not fit for its intended use
(E2500 section 7.5.3). Section 7.5.4 says that this report should be approved
by the SME as well as by QA: the SME reviewing technical elements
whereas QA provides risk-mitigating oversight to ensure that the design-
qualification process was followed and complies with current regulations.

69. Step 9: GMP Release
• Final system release for GMP use is performed
by QA personnel. QA verifies that a system
has been documented as fit for its intended use
and that it complies with other GMP systems
with respect to personnel training, calibration,
maintenance, operating procedures, and
change management. Once those elements are
verified, QA can issue authorization to release
the system for GMP operational use (E2500
section 7.5.5).

70. Step 10: GMP Operation and Change
Management
• After release for GMP use, according to section 8.4.3,
modifications are controlled through change management
with a focus on critical aspects and system performance.
Changes to noncritical aspects are authorized by the SME
using an ECN form, which streamlines the process for
repairs and parts replacement. Changes to critical aspects
are allowed providing that criteria identified in the relevant
VTP are satisfied.
• To mitigate risk with additional oversight, changes that
affect system requirements relative to product quality and
patient safety are additionally approved by QA (E2500
sections 8.4.2 and 8.4.3).

71. Validation Cycle
12/5/2016 Md. Saddam Nawaz 74

72. Conclusion
Along with differences outlined above, there are many similarities
between the ISPE and the ASTM approaches to Qualification and
Validation.
In the ASTM norm, all verification approaches are documented to
provide a level of detail proportionate to the identified risks to
products and patients rather than systems and components as
detailed in the ISPE Guide. This is the key major difference between
the ISPE Baseline Guide traditional approach to Qualification and
the ASTM norm.
In addition, the ASTM norm pays a heavy emphasis on the
involvement of Subject Matter Experts and their development and
approval of all design and verification documentation. In addition,
this Verification process outlined in the ASTM norm re-places the
ISPE Qualification process.

73. FINAL
THOUGHT

74. THANK YOU