INTRODUCTION

Who will come to inspect? Young companies know that it is unlikely that the FDA or another regulator will come to inspect. Established companies know that they will, typically every two years or before a new product approval. But inspections are not always by regulators. Companies doing contractual research or manufacturing can be certain that inspections are forthcoming. And companies under consideration for purchase or partnering can expect to see inspectors at the door. During any inspection, for whatever purpose, quality plays a key role, and this means that documentation systems will be subject to scrutiny. This chapter addresses how companies can maintain inspection readiness, and it answers the following questions.

1. What is the difference between and inspection, audit, and evaluation?
2. If we pride ourselves on being compliant, do we need to prepare for an inspection?
3. What should companies do to remain inspection ready?
4. What does “due diligence” mean?
5. How can we best prepare for an inspection?
6. We maintain inspection readiness by conducting regular self-audits, but should we keep the audit reports?
7. If we do retain our audit reports, do we have to make them available to inspectors?
8. What's the difference between corrective action and preventive action, and what records do we need to keep?
9. How does a company know when it is going to be inspected?
10. Who will inspect?
11. Can we refuse to permit an inspection?
12. Should we cancel an inspection if key personnel are not available?
13. What triggers an FDA inspection related to 21 CFR Part 11?
14. If the FDA requests documents in advance of an inspection visit, should we provide copies?
15. What's the advantage of letting an inspecting group see documents in advance?
16. When undergoing any inspection (regulator/due diligence/client), what should be the protocol?
17. Who needs to participate in an actual inspection?
18. What roles should employees play during an inspection?
19. What should a person do if they don't know the answer to an inspector's question?
20. What should a person do when asked a question about something they personally did not do or observe?
21. What should people do if they know the answer to a question but that information is not desirable to be disclosed?
22. Is there any way to know what inspectors will look for during an inspection?
23. Do all inspectors look for the same things?
24. Do inspectors always look at document systems?
25. How closely will inspectors look at our document system?
26. When a company undergoes an inspection, what specific role does document management play?
27. Our company has controlled documents in multiple systems so which will inspectors look at?
28. What is considered a “high-risk system”?
29. How much evidence of validation is necessary to satisfy inspectors?
30. How should we make documents available to inspectors on site?
31. Must a company provide the FDA with electronic copies of electronic records?
32. Why, during a recent inspection, when we printed an electronic file from our hybrid document management system, did the inspector insist that we produce the original document?
33. Can a company give an inspector a password to a document system to log on and see how the system works?
34. Can inspectors request to see work instructions?
35. How can we track the documents the inspectors want to see?
36. Do inspectors ever look at training records?
37. Do you have to let inspectors take photographs?
38. Can an inspector ask us to sign an affidavit?
39. If a company complies with the text of the regulation, is it sufficient to avoid citation?
40. What are the most common citations for document systems?
41. Our processes are working well for us; but if an inspection finds something, can we just say we'll fix it?
42. What is a 483 and how does a company get one?
43. What's the difference between a warning letter and a 483?
44. Who knows who gets a 483 and a warning letter?
45. How does the FDA know to keep confidential information out of warning letters?
46. What happens if a company fails to address citations?
47. If we get a 483, does it automatically mean we'll get a warning letter?
48. If you get an observation during an inspection, what should you do?
49. How can we avoid a lot of corrective actions after the inspection?
50. Who can best respond in writing to any observations from an inspection?
51. How can we make sure that our inspection responses are sound?
52. Can we disagree with an observation?
53. Should we keep our inspection reports?

1. What Is the Difference Between and Inspection, Audit, and Evaluation?

These terms are often used interchangeably. Companies may define the subtle differences internally. Some companies define inspections to be from an external source, while audits are from an internal source. Usually an evaluation follows the same concepts as an audit without involving regulatory authority. For example, a potential software vendor is evaluated before a purchasing decision.

2. If We Pride Ourselves on Being Compliant, Do We Need to Prepare for an Inspection?

What the FDA and other organizations conducting compliance inspections want to see is that the company systematically takes inventory of its strengths and weaknesses, that it weighs what's there against the regulations in place, and that it is perpetually in a state of forward motion to stay compliant and in control. When an inspection team arrives onsite, they will respond only to what they see or don't see. And their assessment will be generated from their own expectations of what they expect to be in place. Inspectors are not privy to the culture of the company and its way of doing business. So no matter how pristine an operation is, it's the impression it makes that drives the results of an inspection. Astute companies take every safeguard to maintain and project control. And that is why your company should prepare for all inspections. Preparation involves communication and review of the plan for dealing with unforeseen issues that may arise.

3. What Should Companies Do to Remain Inspection Ready?

The most important aspect of compliance is in following your own SOPs, keeping them current, and continually training staff as change occurs. Compliance is something that occurs gradually and continually. Trying to become compliant immediately before an inspection usually doesn't yield good results.

4. What Does “Due Diligence” Mean?

Due diligence is a catchall term that means paying attention and doing your homework. So a company may undergo due diligence when a potential partner looks at it, or a company may say they do due diligence when they hire a consultant or contractor.

5. How Can We Best Prepare for an Inspection?

Companies can put a preparatory team in place. Such a team has a leader who is knowledgeable in compliance, quality assurance, and regulatory affairs. This person, however, should not be expected to provide answers to every question, but should assume the role of chief spokesman during the preparation process. Team members typically come from areas that the actual inspection will focus on. These people must be able to function with a unified front, and they must be able to address issues that may be problematic and solve them.

6. We Maintain Inspection Readiness by Conducting Regular Self-Audits, But Should We Keep the Audit Reports?

The regulations do not require that you keep the actual reports, but require that you have a record of your auditing activities. Many companies retain the last audit report until they affirm that corrective action has taken place; so at any given time, they have only one current audit report of a given area. Of course any corrective action that you undertake as a result of your audits requires documentation (1).

7. If We Do Retain Our Audit Reports, Do We Have to Make Them Available to Inspectors?

No. The company should have a procedure in place that delineates its position on audit reports. Most companies have a policy that restricts viewing of internal audit reports to select management staff. Many companies do not retain their actual internal audit reports, but keep a record of audit activities. Other companies retain the last audit report, which they then destroy upon a new audit.

8. What's the Difference Between Corrective Action and Preventive Action, and What Records Do We Need to Keep?

CAPA discussions in the United States seem to focus more on the CA than on the PA because the CA tells how companies address their problems. Notified Bodies, who issue ISO 13485 certification, focus more on the PA component and may call for a preventive action program. In the United States, quality activities are often preventive in nature, and stem from a quality system mindset, so you can say that a preventive action program is one where staff anticipate problems and fix them before an incident occurs.

9. How Does a Company Know When It Is Going to Be Inspected?

Companies do not always know when they are going to be inspected. When an inspection is part of planned regulatory interaction, inspections are usually scheduled. Most inspections of foreign establishments are scheduled as well.

10. Who Will Inspect?

With regard to the FDA, only their inspectors may perform inspections. Any number of regulatory bodies can visit a facility to inspect. Organizations that issue certifications, such as ISO, do so regularly. Depending on the product, Drug Enforcement Agency (DEA), Environmental Protection Agency (EPA), and Occupational Safety and Health Administration (OSHA) are but some of the regulatory bodies that may inspect. Others may be regulatory bodies from countries where a company's products will be manufactured or distributed. Potential partners or clients seeking to affirm that a company's systems are worth their investment may also inspect.

11. Can We Refuse to Permit an Inspection?

Sometimes a company will choose to refuse an inspection; but if it does, the reason for doing so should be valid. For instance, if a company has recently completed the construction of a new facility, but is not yet actively using it, it may indicate that an inspection would be more efficacious at a later date. Refusing an inspection is always noted, however, and if it happens frequently, it can be a red flag for the inspecting body.

12. Should We Cancel an Inspection If Key Personnel Are Not Available?

When an inspection is initially scheduled, you should avoid times when key personnel are unavailable. Within a short time after scheduling an inspection, you may want to reschedule if key personnel are to be unavailable. However, you should not cancel or attempt to reschedule an inspection within a couple of weeks of the target date or after inspectors have made travel arrangements. Your quality system must be such that you can manage an inspection at any time. Key personnel must have backup personnel that can perform duties in their place. Remember, too, that many inspections take place with no advanced notification at all.

13. What Triggers an FDA Inspection Related to 21 CFR Part 11?

During the course of FDA audits, inspectors review both paper and electronic records. The use of electronic records, and especially electronic signatures, can result in the inspection delving into documentation related to 21 CFR Part 11. Specifically, inspectors are interested in computer system validation, risk mitigations that depend on software controls, and software functionality related to industry standards.

14. If the FDA Requests Documents in Advance of an Inspection Visit, Should We Provide Copies?

If your company has an SOP that states that copies are not to be removed from the premises, then inspectors will usually abide by that requirement. But most companies will send a limited set of documents to the FDA in advance. A standard is to print “controlled copy” on each document, maintain a list of documents to be issued, send by return receipt mail with the signature of recipient, and account for each document as it is returned. Companies should not send electronic copies of documents to the FDA. Original documents should never leave the site.

15. What's the Advantage of Letting an Inspecting Group See Documents in Advance?

A preview of documents can facilitate the inspection. If a company does make them available, it may request a signed receipt for them. This practice shows control, not only of original documents, but of all copies too. Document copies are usually returned at the time of the inspection.

16. When Undergoing Any Inspection (Regulator/Due Diligence/Client), What Should Be the Protocol?

Every company should have an SOP that explains how to conduct an inspection. The idea is to limit the inspectors' access to the facilities and documentation, answer only questions asked, avoid volunteering information, be respectful and courteous, and assist in making the inspection as short as possible. Such an SOP should address preparation before the inspection, how to verify credentials of inspectors, how to notify all staff of the inspection, how to keep track of documentation given to the inspectors, how to respond to 483, how a summary of the events is issued to management, and how follow-up actions are to be determined.

17. Who Needs to Participate in an Actual Inspection?

It's important for companies to have a host or host group ready to receive inspectors and stay with them throughout the process or be available as necessary. Companies typically assign an official host, a person who knows the company's systems and procedures as well as the binding regulations. This is the person who greets inspectors at the door and acts as the official spokesperson for the company through the inspection. Other key participants include a scribe—a person who documents all discussions, questions, and answers. The scribe should keep of log of documents provided in the sequence in which they are made available to which inspector. The scribe needs to be able to write succinctly, quickly, and accurately. The scribe's role is to record, but not interpret. It's also smart to assign a person to be the data facilitator. This person doesn't need to be visible to the inspection team, but assumes the duty of making requested documents available during the inspection.

18. What Roles Should Employees Play During an Inspection?

Staff should be available to answer questions from inspectors, demonstrate processes, and provide supporting documentation (2).

19. What Should a Person Do If They Don't Know the Answer to an Inspector's Question?

Any time you don't know the answer to a question, simply state that you don't know the answer. Do not try to explain why you don't know. Immediately inform the inspection team of this incident so they can prepare an answer if the question is raised again.

20. What Should a Person Do When Asked a Question About Something They Personally Did Not Do or Observe?

Answer any question asked of you about what you did or observed truthfully and succinctly. Do not volunteer information and elaborate about the event. If you did not participate in the events related to the question, simply state that you did not participate and request that the question be directed to the inspection team so an appropriate person can be sought.

21. What Should People Do If They know the Answer to a Question But that Information Is Not Desirable to be Disclosed?

Whenever you are asked a question that discloses information that is undesirable, it is best to tell the inspector that you need a few minutes to research the answer. Leave the room and notify the inspection team of the issue. Together you will present supporting documentation and truthfully disclose the answer. Remember that presentation counts, so be sure to present the facts in a way that minimizes the undesirable disclosure of information.

22. Is There Any Way to Know What Inspectors Will Look For During an Inspection?

Inspections always address quality systems, known failures, and issues from previous inspections. Other than that, it is difficult to know which areas will be inspected. This is intentional so that companies will be diligent in their compliance in all areas.

23. Do All Inspectors Look For the Same Things?

Inspectors in general consider all the processes in place at your facility and examine those that are of interest to them. This means that the individual inspector makes a big difference in the focus of an inspection. Inspectors don't have time to look at everything, so they pick what is important to them at the time. They almost always will look at your quality awareness. They always address observations from previous inspections. Sometimes they select a system or process that has not be inspected before. Often they pick systems for which they have considerable knowledge.

24. Do Inspectors Always Look at Document Systems?

Document systems are usually included in every inspection. Because the document system is the repository for the processes and provides the controls for their maintenance, it is the foundation for all other systems. If a company has been previously inspected and there were no observations related to the document system, an inspector may choose to focus elsewhere, but surely it will be a focus of a subsequent inspection.

25. How Closely Will Inspectors Look At Our Document System?

Document systems are part of a company's quality system, and as such they will almost certainly receive focus during an inspection. The “proof” of compliant operations resides in the documentation a company keeps, and companies are required to produce it. Inspections usually include review of document approval, version control, and observation of document distribution.

26. When a Company Undergoes an Inspection, What Specific Role Does Document Management Play?

The document management role must ensure that documents are known, controlled, and retrievable and provide requested documents to inspectors. The assumption is that companies will have document controls in place. Failure to produce documents in a “timely manner” during an inspection signals that the company does not have good controls in place. Failure to produce documents during an inspection is a frequent 483 citation.

27. Our Company Has Controlled Documents in Multiple Systems, So Which Ones Will Inspectors Look at?

Let's say that your company has three laboratory information management systems (LIMS) plus an electronic document management system where you keep SOPs, methods, work instructions, protocols, and reports. Typically, inspectors will first look at the document management systems to ensure that a foundation is present for other systems. Often the inspector will select one of the LIMS systems to focus on next. Due to time constraints, the remaining LIMS systems will most likely be addressed in subsequent inspections. Since you don't know which LIMS will be inspected, all must be in a constant state of control.

28. What Is Considered a “High-Risk System”?

How systems are determined to be high risk has not been clearly defined by the FDA, and the regulations require companies to make this determination for themselves. The FDA uses the company's determination and their experience to focus on high-risk systems, which are systems that in comparison to other systems have a greater impact on the safety and efficacy of products or services. Companies perform a risk assessment by inventorying systems, assessing the criticality of the data the systems handle, performing gap analysis to identify deficiencies from industry standards, and assigning relative risk levels. Risk is based on the outcome of a failure on product and patient safety as well as accuracy of electronic data.

29. How Much Evidence of Validation is Necessary to Satisfy Inspectors?

Software systems require validation, so be prepared to produce your validation records that show that your system is suitable for its intended performance. Validation must address all the functions of the system that are use and configuration selected. Validation documents must include requirements, installation, specification, risk assessment, testing, SOPs, training, and formal system release.

30. How Should We Make Documents Available to Inspectors on Site?

A company should designate a specific area for the inspectors to review documents such as a conference room. Inspectors should not be left unaccompanied. And all documents issued to inspectors should be logged.

31. Must a Company Provide the FDA with Electronic Copies of Electronic Records?

The company must provide electronic copies of electronic records if the FDA demands them. However, if access to electronic records requires training, it may be too cumbersome for the company and the inspector to go through the training process, so controlled, printed copies may suffice, provided that they are printed from the electronic records on demand, and not previously printed.

32. Why, During a Recent Inspection, When We Printed an Electronic File from Our Hybrid Document Management System, Did the Inspector Insist that We Produce the Original Document?

The FDA is clear that it accepts electronic copies in place of paper, provided that your document system is compliant with Part 11. It may be that the inspector was gauging how long it would take you to retrieve an original document and whether it was in a “timely manner,” which industry has interpreted to mean within 24 hours.

33. Can a Company Give an Inspector a Password to a Document System to Log On and See How the System Works?

Absolutely not. If an inspector says “I know how to use your system,” this doesn't mean that he or she can have access. A secure system requires passwords known only to the user to log on, and the inspector can't possibly have one for your system. Furthermore, any system, whether fully electronic or hybrid, requires training, and the inspector has not been trained in your system.

34. Can Inspectors Request to See Work Instructions?

Yes. Work instructions function like SOPs and must have the same controls. It doesn't matter what you call your procedural documents; they are all binding. Work instructions, workstation instructions, guidelines, procedures, and training documents are examples of documents that must be controlled as SOPs are controlled. The most common difference is the number and level of approvals required.

35. How Can We Track the Documents the Inspectors Want to See?

It's good practice to compile an inspection book to contain the batch records, procedures, and other documents that the investigators have requested or are mostly likely going to request. If the firm has made copies of documents available to the inspection team prior to the actual event, it should log that data in the inspection book as well. Having documents ready shortens the time necessary to produce the copies during the inspection, and it also shortens the time the inspectors are in the facility. The key is to log all documents issued and returned from an inspector.

36. Do Inspectors Ever Look at Training Records?

Yes. Training records are often a focus during inspections and have a high rate of noncompliance. It is one thing to have controlled processes and documents; but if you fail to train the people that implement those processes, you don't have a quality system. Training records must address training of all SOPs, work instructions, and other process documents. Often companies do not maintain a system for ensuring that each person is trained on all the documents that apply to their work. Also, many companies fail to retrain people when new versions of controlled documents are reissued.

37. Do You Have to Let Inspectors Take Photographs?

If your company has an SOP that states that photographs are not to be taken, then inspectors will usually abide by that requirement. However, the FDA has almost unlimited rights to search and record information if they suspect illegal activity. The FDA frequently employs the Department of Justice and Federal Bureau of Investigation to assist in cases where criminal activity is suspected.

38. Can an Inspector Ask Us to Sign an Affidavit?

Yes, they can ask, but under no circumstances should a host sign an affidavit that compromises the company's position. Every company should have an SOP that explains how to conduct an inspection. When subject to such a request, the host should politely refer to the company's policy on signing affidavits.

39. If a Company Complies with the Text of the Regulation, Is It Sufficient to Avoid Citation?

No. The FDA issues the regulation, but it takes time for industry to respond and establish standards for compliance. These standards evolve from discussions between companies and the agency. The FDA can therefore cite a company for failure to comply with industry standards. Note that the FDA regulations are so high level that they encompass virtually every industry standard that can arise.

40. What Are the Most Common Citations for Document Systems?

The most common citations for document systems include lack of computer system validation by representatives of the users of the system, lack of training records, noncompliance with SOPs for document controls and approvals, and inadequate security related to 21 CFR Part 11 industry standards. Since many document systems use a hybrid approach where documents are retained electronically and are also printed and approved with a handwritten signature, there are many failures related to keeping both copies of the document in synchronization.

41. Our Processes Are Working Well for Us; But If an Inspection Finds Something, Can We Just Say We'll Fix It?

Such a position shows a willingness to comply with what the inspection team wants to see, but it's not the wisest course of action. To wait for an assessment by a regulatory group or proposed partner or customer can be costly. It is a reactive approach, and it can force excessive man-hour expenditure, and possibly even production downtime if the company has to aggressively respond to inspection observations. It's much better to assess internal systems and processes before an outside body has the chance to do so. A proactive company anticipates what a compliance inspection may entail and pinpoints any potential observations and addresses them before inspectors come on site.

42. What Is a 483 and How Does a Company Get One?

FDA form 483 is a document that an inspector fills out to make an observation. The FDA issues 483s at the end of an inspection.

43. What's the Difference Between a Warning Letter and a 483?

While a 483 records an observation and does not require a corrective action, a warning letter is a formal notice that the company must make a corrective action. Most companies make corrective actions in response to 483s to avoid escalating the issue to a warning letter.

44. Who Knows Who Gets a 483 and a Warning Letter?

Both 483s and warning letters are public information and can be obtained by anyone through the Freedom of Information Act.

45. How Does the FDA Know to Keep Confidential Information Out of Warning Letters?

The FDA attempts to redact personal information, trade secrets, and other types of confidential information from documents made public. Often a thick black pen is used to cross out text in a document. There is no assurance that everything you consider important will be redacted. It is in your best interest to limit disclosure of confidential information and immediately verify any information made publicly available so that you can request additional redaction if necessary.

46. What Happens If a Company Fails to Address Citations?

If a company fails to respond to a warning letter or does not make required corrective actions, the FDA may take many courses of actions including product recalls, loss of right to market products, fines, and product seizure. Failure to address 483 observations from a previous inspection may result in addition 483 observations and warning letters in subsequent inspections.

47. If We Get a 483, Does It Automatically Mean We'll Get a Warning Letter?

No. Most 483s are observations that are not systemic. Companies should try to make corrections actions for the issue noted and make procedural changes to avoid the issue from recurring. Often corrective actions can be made during the course of the inspection; but care should be taken to not act too quickly, thereby making the issue bigger.

48. If You Get an Observation During an Inspection, What Should You Do?

All observations, 483s and others, should be recorded and reviewed with management. A plan for making corrective actions should be written and approved in advance of making the corrective actions. Communication and correspondence with the FDA should be managed by a single channel, most often with the Regulatory Affairs department.

49. How Can We Avoid a Lot of Corrective Actions After the Inspection?

It's always a good idea to look at the company's past interaction with an inspection team to highlight what the company needs to do to prepare itself. What was the outcome, and why? What were the expectations, and how did the company fail to meet them? Since the inspectors are sure to focus on past issues, it is best to be proactive in those areas.

50. Who Can Best Respond in Writing to Any Observations from an Inspection?

This task usually falls to the official host or a member of the host group. Sometimes preparation of the response becomes a team effort, particularly if the inspection has been lengthy and the findings many. Writing a response to observations is never easy, because so much hangs on the result. The primary writer has the task of promising action on behalf of the company, and doing it in such a way that the proposed activities are clearly defined. But the good news is this: This type of writing is “just the facts.” Regulatory Affairs and senior management should approve all correspondence.

51. How Can We Make Sure that Our Inspection Responses Are Sound?

There are several pitfalls in this type of writing:

52. Can We Disagree with an Observation?

You may disagree with an inspection finding and politely try to explain why the observation is not correct. However, it is not in your best interest to be argumentative or defensive. It is best to formulate a written response, collect supporting documents, have it approved by management, and send it through the proper communication channel.

53. Should We Keep Our Inspection Reports?

Every company should have an SOP that explains how to conduct an inspection. This SOP should require all inspections to be recorded in a log. It should be part of the company's policy to retain each inspection report, whether it has multiple observations or none, because each report is part of the history of the company. In addition, the company needs to retain copies of inspection responses and other official correspondence.

REFERENCES

1. Title 21 CRF Part s211.180 and 211.188, www.fda.gov, accessed April 9, 2009.

2. Gough, Janet. Hosting a Compliance Inspection, 2001. Bethesda, MD: Parenteral Drug Association and Godalming, Surrey, UK: Davis Horwood International.