Warning Letter: Audit trail feature disabled for HPLC systems (ucm563067)

1. Failure to prevent unauthorized access or changes to data, and failure to provide adequate controls to prevent omission of data.
Our inspection found your laboratory systems lacked controls to prevent deletion of and alterations to electronic raw data.

a. Our review of audit trail data revealed that your analysts manipulated the date/time settings on your high performance liquid chromatography (HPLC) systems. During the inspection your analysts admitted to setting the clock back and repeating analyses for undocumented reasons. Initial sample results were overwritten or deleted, and unavailable for our investigators’ review. Your firm reported only the passing results from repeat analyses. When test results are overwritten, the quality unit is presented with incomplete and inaccurate information about the quality of the drugs produced by your firm.

b. Your quality control analysts used a shared login account to access HPLC systems. This shared account allowed analysts, without traceability, to change the date/time settings of the computer, to modify file names, and to delete original HPLC data.

c. Seven out of [redacted] of your firm’s HPLC systems used for API testing had the audit trail feature disabled, although all [redacted] had audit trail functionality.

In your response, you acknowledged that you lacked effective measures to control data within your computerized systems. You committed to revising procedures for computerized systems, locking date/time settings, and enabling audit trail functions. However, you noted that you do not expect audit trail functions for all quality control instruments to be completely activated until September 30, 2017. In the interim, you committed to control measures, including updated software and logbooks.

Your response is insufficient because it did not specify who holds administrative privileges on your computers, or address the significant pattern of data manipulation (e.g., deletions, date/time alterations) we observed at your facility.

In response to this letter:
Clarify the specific user roles and detail the associated privileges for each laboratory system.
Provide an assessment of the effectiveness of your interim system controls.
Provide a commitment to conduct a similar future assessment of the effectiveness of all system controls expected to be in place by September 2017.
Explain the oversight role of the quality unit in implementing these improvements and ensuring they remain effective.

2. Failure to maintain complete data derived from all laboratory tests conducted to ensure compliance with established specifications and standards.

Our investigators found that you failed to maintain complete data for all laboratory analyses, and you relied on incomplete information to determine whether your drugs met established specifications.

a. HPLC chromatograms were deleted and not available for our investigators’ review. In your response, you acknowledged that in January 2016, “some data was deleted” while the network edition of the chromatographic operating system software was installed.

b. Our investigators found a recurring practice of re-testing samples until acceptable results were obtained. For example, our investigators found repeat HPLC testing for related substances of crude [redacted], batch [redacted]. The initial test displayed an unknown peak in the chromatogram. A different analyst retested the batch five days later: this analysis did not display the unknown peak. Only the results of the second analysis were used for batch disposition, without documented justification or investigation.

Your response is inadequate because you did not include an assessment of the deleted data. Your response also lacked commitments to investigate the unknown peak in the chromatogram for crude [redacted] batch [redacted], and to discontinue repeating tests without justification and investigation.

3. Failure of your quality unit to exercise its responsibility to ensure the API manufactured at your facility are in compliance with CGMP, and meet established specifications for quality and purity.

Our investigators found batch production records that contained blank or partially completed manufacturing data and lacked dates and signatures for verification. For example, in your [redacted] plant, our investigators found a batch record for [redacted] starting material, batch [redacted], with sticky notes from the quality assurance department directing operators to enter manufacturing data, such as missing weight and volume entries. Also, your quality unit did not approve this batch record before the material was used in further manufacturing.

All data in CGMP records must be complete and reliable so it can be evaluated by the quality unit during its batch review, as well as maintained for additional CGMP purposes.

Other documents—including cleaning records and equipment use logs—were also found to be partially completed, without dates and signatures for verification, or with pages or spaces intentionally left blank for documentation at a later time.

Your quality unit was aware of these unacceptable production department practices but did not ensure they were corrected.

View the original warning letter.