Ensuring Regulatory Compliance: The Role of Validation in Pharmaceutical and Biotech Industries

In the pharmaceutical and biotechnology sector, validation is a mandated practice integral to the entire drug development process, particularly in the context of computerized systems and manufacturing testing methodologies. The necessity for validation arises from the regulatory requirements defined by the US Food and Drug Administration (FDA) governing pharmaceutical manufacturing processes under Title 21, Chapter 1, Subchapters C, F and H.

While Title 21 references validation in different parts, the focus of validation in this article will be on the scope of its application in a cultural mindset of Good Manufacturing Practice (GMP). These are some of the regulations for direct manufacturers of pharmaceutical products, thus defined as “manufacturer” in these regulations. These manufacturers (pharmaceutical or biotechnology organizations) have Quality departments that oversee the implementation of the validation standards and processes as part of their regulated business processes.

Validation in quality management systems

Title 21 of the Code of Federal Regulations (CFR) are the regulations for Food and Drugs. Chapter 1 of Title 21 contains 1,299 separate Parts enforced by the FDA, Department of Health and Human Services.

Categorized in Subchapter H for Medical Devices is 21 CFR 820 [Quality System Regulation], which governs the design, manufacture, labeling, storage and servicing of finished devices intended for human use.

In this Part and paragraphs, the following are defined as follows:

§ 820.3 (z) “Validation means confirmation by examination and provision of objective evidence that the particular requirements for a specific intended use can be consistently fulfilled.”

§ 820.3 (aa) “Verification means confirmation by examination and provision of objective evidence that specified requirements have been fulfilled.”

In this example, a software developer builds a user authentication interface (a user log-in/password dialog). In practical terms, a verification activity would entail a simple test case with screenshot evidence that the dialog window was built according to a defined user requirement or functional specification. A validation activity would entail a formal test case of its functionality and usability, which indicates whether a user can or cannot successfully log in with their credentials (with pass/fail criteria) per the definition in § 820.3 (z)(2)

“Design validation means establishing by objective evidence that device specifications conform with user needs and intended use(s).”

In § 820.3 (z)(1), Process validation means establishing by objective evidence that a process consistently produces a result or product meeting its predetermined specifications.

In quality control (QC) laboratories, the intended use for lab instruments is for data acquisition, and software for data analysis are qualified together as a single entity. The digital transformation of raw data into analyzed reportable results is considered an automated process that requires validation per § 820.70 (i)

“When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.”

Test methods and procedures from Development groups being introduced into the regulated space require validation before they can be used to assess and release products are regulated per § 820.75(a)

“Where the results of a process cannot be fully verified by subsequent inspection and test, the process shall be validated with a high degree of assurance and approved according to established procedures. The validation activities and results, including the date and signature of the individual(s) approving the validation and where appropriate the major equipment validated, shall be documented.”

Validated test methods and procedures that are used in QC must be maintained and monitored per § 820.75(b)

“Each manufacturer shall establish and maintain procedures for monitoring and control of process parameters for validated processes to ensure that the specified requirements continue to be met.

(1) Each manufacturer shall ensure that validated processes are performed by qualified individual(s).

(2) For validated processes, the monitoring and control methods and data, the date performed, and, where appropriate, the individual(s) performing the process or the major equipment used shall be documented.”

In the course of routine manufacturing, GMP requires proper documentation of deviations per § 820.75(c)

“When changes or process deviations occur, the manufacturer shall review and evaluate the process and perform revalidation where appropriate. These activities shall be documented.”

Validation as good manufacturing practice

Categorized in Subchapter C for Drugs: General is 21 CFR 211 [Good Manufacturing Practice for Finished Pharmaceuticals], which are the current good manufacturing practice (cGMP) regulations for the preparation of drug products for human consumption.

In regulatory audits, some common citations are found in the category of Automatic, Mechanical, and Electronic Equipment in § 211.68 (b)

“Appropriate controls shall be exercised over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel. Input to and output from the computer or related system of formulas or other records or data shall be checked for accuracy. The degree and frequency of input/output verification shall be based on the complexity and reliability of the computer or related system. A backup file of data entered into the computer or related system shall be maintained except where certain data, such as calculations performed in connection with laboratory analysis, are eliminated by computerization or other automated processes. In such instances a written record of the program shall be maintained along with appropriate validation data.”

These citations include:

•  The company did not implement effective computer system controls to ensure authorized access to the systems.

•  Access was inconsistent with appropriate roles and responsibilities. (e.g., laboratory analysts could delete or modify data, change configuration settings (e.g., disable audit trails), could adjust date and time stamps for electronic data to falsify the date/time when data was initially acquired.)

•  Data was not backed up appropriately to allow data reconstruction activities in future.

•  Audit trail data did not match.

Product samples shall be tested and examined per § 211.84 (d)(2)

“Each component shall be tested for conformity with all appropriate written specifications for purity, strength, and quality. In lieu of such testing by the manufacturer, a report of analysis may be accepted from the supplier of a component, provided that at least one specific identity test is conducted on such component by the manufacturer, and provided that the manufacturer establishes the reliability of the supplier's analyses through appropriate validation of the supplier's test results at appropriate intervals.” 

How product samples from a manufactured batch shall be tested and examined are listed in the regulations per § 211.110 (a) 

“To assure batch uniformity and integrity of drug products, written procedures shall be established and followed that describe the in-process controls, and tests, or examinations to be conducted on appropriate samples of in-process materials of each batch. Such control procedures shall be established to monitor the output and to validate the performance of those manufacturing processes that may be responsible for causing variability in the characteristics of in-process material and the drug product.”

In summary, validation is mentioned in different Parts of Title 21.  GMP is a cultural mindset that emphasizes governance and regulated practices to ensure that product(s) and data are not adulterated and can be made commercially available or consumed by humans during clinical trials. The impetus to demonstrate regulatory compliance to ensure their products are safe for human consumption is an imperative for pharmaceutical and biotechnology organizations.  

About the author

Timothy Bolus, MPM, MBA, is the senior compliance product/program manager at Molecular Devices. Over the past 28 years, Tim has developed his expertise working in diagnostic labs, manufacturing, clinical development and in the GxP space bringing the customer perspective to the new compliance portfolio marketing team. He works closely with sales and marketing teams with strategies to promote GxP products and services, and works with software engineering teams as the product manager to develop innovative software solutions, enhancements and features. He obtained his dual Masters in Business Administration and Project Management from DeVry University in San Francisco (California) and his BS in Biology from Angeles University Foundation in the Philippines.