7.1 Introduction

Every organization in regulated industry must train its employees. This training is scheduled in several ways. There is a basic scheduling distinction between training that is delivered in response to a perceived deficiency in performance or qualification, and training delivered according to the calendar. Training according to deficiency in performance or qualification includes new employee orientation (NEO), training for business process redesign and standard operating procedure (SOP) revision, and most technical training. In each case, trainees lack skill, information, or motivation that can be remedied by the training intervention.

Training according to the calendar includes much of regulatory training – the periodic refresher training that is mandated in business ethics, non-harassment policies, non-discrimination policies, a number of Occupational Safety and Health Administration (OSHA) regulations,¹ and current good manufacturing practice (cGMP) regulations. As will become clear in the case of the US Food and Drug Administration (FDA) regulations, refresher training may be scheduled more frequently than on an annual basis, which is why the regulations and guidance refer to “continuing” cGMP training rather than referring to “annual cGMP refresher training.”

The decisions that are made about either kind of training are informed by an implicit or explicit business risk assessment. The level of top-down support and the scheduling of continuing cGMP training reflect a business risk assessment made by various decision makers in the organization. Moreover, decisions about the content of the training, in contrast to mandate and schedule, may also be informed by a quality risk assessment, an assessment in terms of risk to the safety, identity, strength, purity, and quality (SISPQ) of the product.²

Consider an example of business risk assessment, as it applies at the program level to continuing cGMP training. Suppose there is a deviation between the number of employees who have documented attendance at the annual cGMP refresher training session and the total number of employees who are required by procedure to attend by the end of the calendar year. In this case, the alert level is any number of employees greater than zero, excluding those on medical leave, etc. The supervisor of an employee who has failed to attend by the beginning of the December recess will be alerted by an e-mail message automatically generated by the organization’s learning management system (LMS).³

Suppose the total number of non-compliant employees is one. Will this deviation occasion a Notice of Event (NoE) investigation, and corrective action and preventive action (CAPA)? No. What about 10 employees? Probably not. What about a hundred? Perhaps. Even if it does, will the CAPA be fulfilled? There have been cases where the corrective action – simply put, getting the remaining employees trained within a month – had to be extended until the middle of February. And there was no preventive action.

Does this mean that an organization can ignore deviations in processes that have been assessed as low risk? Hardly. The business case for an organizational activity is complemented by the compliance case for that same activity. Continuing cGMP training not only periodically reminds employees of the effect of deviations, rework, etc. on the bottom line, but is a regulatory requirement as well, and reminds employees about the organization’s commitment to the regulatory requirements. This commitment carries over to all aspects of regulation.

There are several independent assessments of risk for any process or system in regulated industry, no matter how low or high the level of risk. One is the assessment made by various decision makers of the organization including employees as well as managers, another is the assessment made by regulatory investigators. Both sides are weighing the criticality and complexity of the given process in making their independent risk assessments.⁴ The decision makers in the organization must constantly be aware of this intricate interaction between their own business risk assessments and the quality risk assessments of the regulatory investigators, and factor the latter into their own calculation of risk.

The quality risk assessment tends to be reflected in the topics to be presented in continuing cGMP training. The topics reflect in part a quality risk assessment made by various decision makers in the organization, perhaps other decision makers than those making the business risk assessments. Those making the quality risk assessment will be addressing the risk to the SISPQ of the product, and how that topic can be presented as a training topic. The level of risk associated with a process or system that is subject to a given regulation is based on the criticality and complexity of that process.⁵ The risk assessment represents the level of risk as well as the acceptable melioration of that risk.

Take two possible topics for continuing cGMP training, one topic of a higher level of quality risk and another topic of a lower level of quality risk. Suppose the choice was to be made between an episode in a higher risk activity such as aseptic processing and an episode in a lower risk activity such as secondary packaging:

The International Conference on Harmonisation (ICH) expressed it well: “…the level of effort […] of the quality risk management process should be commensurate with the level of risk.”⁶ And this level of effort includes training about the topics of the quality risk management process. Both kinds of risk assessment, business and quality, must be taken into account for continuing cGMP training.

7.2 Regulations call for continuing cGMP training

FDA regulations call for continuing cGMP training. The regulations for finished pharmaceuticals are quite explicit:

Three points in this passage should be highlighted: the training shall be “conducted by qualified individuals,” shall be conducted “on a continuing basis,” and shall address “cGMP requirements applicable to them.”

Some FDA regulations tend to be more implicit. For instance, in the section “Blood and Blood Components,” it is stated that:

The European Union makes a similar point about the need for continuing training in GMPs:

Health Canada also mandates continuing cGMP training, so that “all personnel are aware of the principles of GMP that affect them, and all personnel receive initial and continuing training relevant to their job responsibilities.”⁹

A rationale for continuing cGMP training is provided in several guidances. For example, the Quality Systems Approach to Pharmaceutical cGMP Regulations indicates that “continued training is critical to ensure that the employees remain proficient in their operational functions and in their understanding of cGMP regulations.”¹⁰ Likewise, the ICH states, “Training should be regularly conducted by qualified individuals and should cover, at a minimum, the particular operations that the employee performs and GMP as it relates to the employee’s functions.”¹¹

The usefulness of continuing training has been observed outside the area of GMPs. Continuing training in good clinical practices (GCPs), for example, has been recommended for clinical trials staff, as well as for Institutional Review Board (IRB) members.¹²

Hence the FDA regulations provide a mandate for continuing cGMP training. Of course there are interpretive issues regarding these, as any, regulations. As Michael Breggar has correctly put it, “most drug regulations are subject to interpretation.”¹³ Organizations in the life sciences do not simply react to a regulation; instead there is an intricate interaction between organizational actors at all levels and the various regulations and regulatory regimes, all within a given organizational setting.¹⁴ Between an observation of a gap and an organization’s response is a complex decision process. This will occur whether the gap represents a higher level of risk, such as the level of viable particulates in a monitored area, or a lower level of risk, such as one, ten, or a hundred employees failing to attend the annual cGMP refresher training. As already noted, an observation is typically escalated, triaged, and may or may not become a record of interest in the organization’s quality management system. Whether the observation will or will not become a record of interest depends upon the risk assessment. It is that record that may or may not become the basis of an investigation and RCA. Whether the record is investigated further depends upon (possibly a further) risk assessment.

Neither employees nor the organization react to the standard, the regulation – they respond to the observed gap, in terms of risk assessments. The record of the observed gap can also become part of a set of similar records that can be tracked and trended within the quality management system. If necessary, the set itself can be investigated further. Again it is not a matter of reacting to standards, SOPs, or regulations. The organization is responding to the set of excursions, the set of gaps, as reported in the set of records. The conclusion of an investigation can be followed by the development and execution of corrective actions and preventive actions. At each decision node, the decision is based on interpretations and also on risk assessments.

The interpretive aspects and risk assessments of this investigative and remediation process may be more or less explicit in various areas of the life science industry, but the underlying need for interpretation and risk assessment remains. Moreover, since interpretive aspects and risk assessments underlie any organization’s response to compliance issues, no organization is simply reactive to regulations.

7.3 Who are the qualified individuals?

FDA regulations mandate that “Training in current good manufacturing practice shall be conducted by qualified individuals.”¹⁵ Likewise, Health Canada requires that “Training is provided by qualified personnel.”¹⁶

As Joanne Cochran and Joseph Nally point out, “Since 211.25(a) requires GMP training to be given by qualified personnel, the company should have a procedure and process for qualifying trainers.”¹⁷ Such a procedure would list the necessary steps (tasks) that, taken together, are sufficient to produce the desired outcome of the process, namely the qualified trainer.¹⁸

7.4 Applicable cGMP requirements

The FDA regulations stipulate that the training will “assure that employees remain familiar with cGMP requirements applicable to them.” What are those “applicable requirements”? Conceptualize the regulatory framework as a pyramid, with the cGMPs at the top, corporate policies making up the next tier, divisional standards as a further tier, and local SOPs as the lower tier.²⁵ Then the applicable requirements are those that filter down from the cGMPs and are refracted in the local procedures (Figure 7.1).

Topics for continuing cGMP training include not only the regulations in 21 CFR 211, as refracted to the local level, but also any “written procedures required by these regulations, as they relate to the employee’s functions.”²⁶ Those written procedures include the following see (Table 7.1).

Suggested topics for continuing cGMP training are also given in several guidances. For example, the Quality Systems Approach to Pharmaceutical cGMP Regulations indicates that “training should address the policies, processes, procedures, and written instructions related to operational activities, the product/service, the quality system, and the desired work culture (e.g., team building, communication, change, behavior).”²⁷

Likewise, Sterile Drug Products Produced by Aseptic Processing suggests that:

Also, the Guideline for Quality Assurance in Blood Establishments suggests that training topics may be derived from a review of

Another source of topics for continuing cGMP training is the set of FDA warning letters, accessible from www.fda.gov. This is an extensive compilation of GXP deviations of all sorts that can be mined for topics. There are two problems that emerge when using these resources.

First, the warning letters refer to companies other than that of the training audience, which tends to blunt the significance of non-compliance, no matter how serious. For striking examples, FDA inspected the Peanut Corporation of America (PCA) in early January 2009 and found “one environmental swab collected on 1 October 2009 from the finished product cooler floor was found positive for Salmonella. The swab location was within three feet of pallets of finished product.” Moreover:

The training audience can easily say, “Yes, these are terrible conditions, but they took place in Georgia.”

The second problem is that many times the warning letters do not provide the level of detail needed to develop compelling cGMP training. This is the case even when the warning letter is augmented by newspaper accounts. Again this tends to blunt the significance of non-compliance. It is very clear that something was seriously amiss in the PCA environmental monitoring program, but it is very hard to pin that down to make training points.

Still another source of topics is the organization’s own documentation of deviations, investigations, CAPAs, and product quality complaints, as captured in the quality management system. This documentation can be reviewed on a periodic basis, say quarterly or even monthly. The selected record can be worked up and presented in a training module. These records do not suffer from either of the shortcomings noted for the FDA warning letters. The organization’s documentation refers to the training audience’s own systems, and some members of the audience may have been involved in the observation, investigation, and remediation process. Second, the very demands for compliance and documentation in the organization’s investigation and remediation SOPs should ensure an adequate level of detail to make training points.

Take an illustrative example, one that might be a suitable topic for a quarterly cGMP training session. Recently, warehouse staff had trouble correctly filling out a particular form. Supervision caught the problem several times, while countersigning the document. Then supervision missed one, and it was recorded in the quality management system. Management was alerted, and requested an investigation of the problem – was it a matter of employee training, procedure, form design, or what?

During the investigation, training records were reviewed, and it was evident that each of the warehouse employees had been trained on the current version of the SOP by a qualified trainer. The SOP was reviewed. It looked straightforward on its face, and because it also covered two other forms for which no problems had been observed, it was given a clean bill of health. The form itself was reviewed, in terms of a checklist.³¹ (Table 7.2).

During the review of the form, it became clear that there were several serious content and formatting issues. When the form was redesigned, the warehouse staff’s trouble filling out the form ended. The problem seems to have been resolved. It is worth noting that re-training of the warehouse employees was not required, since training was not identified as the root cause of the problem, but the employees had to be trained on the rectified form.

This illustrative account could be proposed to the training council or other appropriate group and, if approved, could be worked up into a continuing cGMP training module. It would be of interest to the organization’s staff, because it refers to their warehouse, they may know the form in question, they may know some of the employees who were involved in the problem, and they will be pleased to see the satisfactory outcome of the investigation.

Perhaps the best approach to sources of topics for continuing cGMP training is a combination of local problems gleaned from records in the organization’s quality management system, with direction provided by the most serious compliance problems, as indicated by FDA warning letters³² (Table 7.3). For instance, one recurring topic from fiscal years 2005 through 2008 has been 21 CFR 211.22, “Responsibilities of Quality Control Unit.” Should the organization’s records provide any instances of such problems, the FDA warning letters might give additional weight to the training points.

A final point about applicable cGMP requirements is the relevance and effectiveness of particular cGMP training for various groups within an organization’s workforce. In Q9, Quality Risk Management, the ICH has suggested that a potential use of quality risk management principles and tools may be “to determine the appropriateness of […] ongoing training sessions based on education, experience, and working habits of staff.”³³ Trainees can be grouped according to their task assignments. For example, employees who check batch records need not be given the same continuing cGMP training module as operators, even though both groups may be governed by the same broad set of procedures. Their workplace focus is much different. Likewise, ICH recommends that the appropriateness of continuing training be determined by “a periodic assessment of previous training (e.g., its effectiveness).”³⁴

7.5 Logistics of continuing cGMP training

Having discussed the regulatory requirements for continuing cGMP training, the necessity of using qualified trainers to deliver the training, and the topics that could make up the training content, it is time to turn to the logistics of this training. The main logistical question is: How frequently should this continuing training be scheduled?

FDA regulations do not stipulate the frequency of continuing training, but recommendations are available in guidances. For example, the Current Good Manufacturing Practice for Medical Gases indicates that, “FDA recommends that cGMP training not be conducted in one massive training session. Rather, it should be presented in smaller more manageable sessions held throughout the year, or at a minimum be held once a year.”³⁵ Speaking at an FDA workshop, compliance officer Duane Sylvia suggested that, “cGMP training should be revisited at frequent intervals and needs to be conducted by qualified individuals.” He continued, “Conducting cGMP training once a year is not recommended, but instead should be presented in smaller more manageable portions, presented throughout the year with documentation of the type, time, and attendance of each session.”³⁶

Some regulated organizations have developed very elaborate schemes to schedule continuing cGMP training. One example will suffice. An organization required each employee to attend day-long refresher training at a specified location on the first Monday of the employee’s birth month. There was one makeup day a year for employees who missed their scheduled date. The training agenda was fixed for the entire year, regardless of intervening events. It incorporated OSHA, cGMP, business ethics, and other refresher training, as well as a “Meet the CEO” session. Given the packed agenda, less than an hour was devoted to cGMP topics. Birthday cake was provided to each attendee. Nonetheless, this scheme was simply a variant of the “one hour, once a year” cGMP training schedule.

Regarding industry practices, James Vesper has stated that “most companies conduct formal GMP training or reinforcement training at least annually; some do it twice a year; a few do it quarterly. “³⁷ There are business considerations as well as regulatory issues here. More generally, John McConnell has indicated “How often the training course is to be conducted depends on several factors, including:

All of these factors should be taken into account in planning for continuing cGMP training.

7.6 Conclusion

This chapter addressed continuing cGMP training in four sections. The first section reviewed the statements that FDA and other regulatory bodies have made in regulations and guidances regarding continuing cGMP training. The role that interpretation and risk assessment plays in an organization’s response to gaps (deviations) between the statements and ongoing behavior was stressed. The second section considered the “qualified individuals” that deliver this continuing training, including similarities and differences between qualification of trainers and qualification of SMEs. A formal approach to qualifying trainers such as a cGMP train-the-trainer program was compared to an experiential approach such as management’s judgment that an employee is qualified to provide training. The experiential approach is cheaper than the formal approach, but the formal approach has the merit of reducing variation in employee performance, as well as facilitating RCA in case of deviations, as the next chapter will discuss in some detail.

Also, various staffing options were examined. The third section reviewed topics that are suitable for continuing cGMP training. Sources included cGMP regulations in 21 CFR 211, written procedures required by these regulations, topics mentioned in several FDA guidances, FDA warning letters, and the organization’s own records of deviations, investigations, CAPAs, and product quality complaints. The final section addressed the logistics of such training, including the frequency with which cGMP training should be delivered, concluding that FDA recommends training more frequently than just on an annual basis.

7.8 References