By Martin Lush, global VP, NSF Pharma Biotech and Medical Devices
It’s Friday, it’s late, and you are just leaving for the weekend. The inspection you hosted two weeks ago remains a painful memory. The exit meeting didn’t go well — five major observations, all relating to your quality system. When your boss enters your office, you know it’s not to wish you a good weekend. She looks stressed, anxious, and keen to off-load a big problem …
“We’ve received the regulator’s audit report. We now have one critical and seven majors, and we have 15 days to respond in writing. Our license to operate is at risk. Cancel your weekend. I need the draft response by Tuesday.”
Acknowledge receipt of the report immediately. Be respectful and polite, never defensive. Keep this immediate communication short and to the point. Commit to providing a comprehensive response within the expected time frame. Emphasize your total commitment to fixing the underlying causes and to addressing any immediate risks … and then leave for the weekend! This is not a frivolous point. So many responses are written by people who are tired, stressed, and just not thinking straight. Take time to think before putting pen to paper.
Get Back To Basics — Your Primary Objective
In writing the audit report, the regulator is (subconsciously) expressing one or two emotions: fear over patient safety and/or lack of trust and confidence in your company. Your primary objective is to remove both.
Fear: The auditor’s primary objective is to safeguard public health. A damaging audit report means they have concerns about your company’s ability to manufacture products that are safe, efficacious, and of the right quality. This may be due to specific observations or just a feeling that systems, procedures, or practices are not in a state of control.
Lack of trust and confidence: Poor inspections quickly erode trust and confidence between the regulator and your company. The relationship between company and agency has been badly damaged. Remember, auditors are human! Although good auditors base conclusions on facts, emotions will play an important role in how they perceive your company, your leadership, and your quality culture. This is not a precise process, and cultural differences can often sabotage good intent. These cultural differences can easily lead to miscommunication and misunderstanding that then create the feeling of distrust. If you did any of the following during an inspection, you have eroded the most crucial element of any successful inspection, trust:
So, when responding to regulatory criticism, remember:
Before writing to the regulators, remember the essentials:
Drafting Your Response: Down To The Specifics
Now that we have covered the foundations of a good written response, here is a simple step-by-step guide to walk you through the process.
Step 1: Have the right mind-set.
Mind-set dictates not just our thoughts, but also our actions. So:
Step 2: Ask yourself, “Is the observation factually correct?”
Or has there been some misunderstanding or miscommunication between you and the regulator? View this from the auditor’s perspective, not yours. Acknowledge any potential misunderstanding by providing facts and data. Accept responsibility for not conveying these clearly during the inspection. Remember, the effectiveness of communication is measured by the response you get. If there has been any misunderstanding, it’s your fault, not the inspector’s.
Step 3: Acknowledge each observation.
Accept the validity of all observations you feel are justified. However, if you don’t agree with the observation or criticism, say so. Defend your position based on good science, good regulatory practice, and common sense. For example, one of our clients was cited for “insufficient detail” in an SOP covering gowning procedures. The auditor felt the three-page SOP with eight photos and very few words was not detailed enough to ensure consistency of practice. The company rejected the validity of the observation by providing:
Step 4: Complete a far-reaching risk assessment.
This must address:
The scope of the risk assessment is vital. When did this issue first occur? How many batches are involved? Remember, these deficiencies probably extend to other plants in your network. Do not limit your risk assessment and CAPA (corrective action preventive action) plan to the plant in question or just to the specific observation in question.
Step 5: Perform immediate risk mitigation (correction).
What steps will you take immediately to mitigate risk? Who will do what, and by when? What are your milestones and measures?
How will short-term corrective actions be monitored and measured for effectiveness? What resources will be dedicated to successful implementation?
Step 6: Identify the error chain: What caused this to happen? Why didn’t you pick up on this and fix it?
A detailed review of all of the contributing factors (error chain) that led to the deficiency is essential. Take, for example, failure to set the correct specification for environmental monitoring. The questions the regulatory agency want answered include: