2. Geoffrey Levitt Chief Counsel, Regulatory and Research Building a Culture of Compliance and Risk Management August 26, 2005

3. 2

4. 3 Compliance Compliance With What? Law and regulation Good manufacturing practices Agency expectations Internal rules How Is Compliance Achieved? Setting expectations Measuring attainment Enforcing compliance

5. 4 Compliance: Ultimate Goals Patient Health Quality Product Adequate Supply Regulatory Compliance Pass inspections Stay out of trouble Business Success Sell product Make money

6. 5 Risk Management What Risks Are We Managing? How do we assess risks? How do we compare risks? How do those assessments and comparisons guide our behavior? What Does Risk Management Have To Do With Compliance?

7. 6 Basic Rules: FDA GMP Requirements Food, Drug, and Cosmetic Act: 1938: Safety Factory Inspections Legal Authority for GMP Requirements: 1962 Major GMP Regulations: 1978 Major Court Test: 1993 Risk-Based Quality Initiative: 2002 Tension: Compliance vs. Flexibility

8. 7 Principles Purpose: Assure that all members of the drug industry are made aware of the level of performance expected of them to be in compliance with the act. Goals: General enough to be suitable for essentially all drugs; Flexible enough to allow sound judgment and innovation; Explicit enough to provide clear understanding of the rules Approach: Describe what needs to be done, provide latitude as to how.

9. 8 FDA Enforcement: Modern Era Sea change: regulators (pre-1990) to enforcers NAFs and Reg Letters replaced by the Warning Letter (1991) Explicit notice of violation and threat of regulatory action without further notice Barr Case (March 1993) Aggressive FDA vs. combative company Negotiations break down; Barr pre-empts FDA strikes back; PI to shut Barr down Surprise: FDA Wins! GMPs are what FDA says they are Courts will enforce Lesson: Dont Take FDA On Over GMPs

10. 9 Consent Decrees: Features Responsible Individuals Named Additional Inspection Authority Enhanced Powers: Recall, Shutdown Outside Auditor - Reports and Certification Timelines With Financial Penalties Contempt Penalties Disgorgement (Optional) A Private Regulatory Micro-Regime for Company

11. 10 Beyond The Enforcement Model: A Risk- Based Approach Concerns About The Enforcement Model: Stifling innovation Misallocating FDA and industry resources Solution: Calibrate Compliance Intensity Based On Risk Factors Complexity of product/process Lack of defined process variables Potential impact of an error on product quality Public health impact Manufacturers compliance status

12. 11 Beyond The Enforcement Model: A Risk- Based Approach Focus On The Patient View quality elements from perspective of ultimate goal: ensure safe, effective, pure product for the patient Guides how expectations are set (regulations and requirements) and how compliance is checked (audits and inspections) Significance of process issues is measured against health impact, medical need, and product availability Sets a framework that encourages technological advances FDA inspections are targeted and focused based on inherent risk of product and process steps as well as compliance status

13. 12 Culture of Compliance What Does It Mean In A Risk-Based Environment? Good information Balanced communication Effective analysis: root cause of problems Risk assessment Corrective action Evaluation

14. 13 Managing A Compliance Culture Demonstrated Senior Management Commitment Establish explicit plans, goals, objectives Put resources into quality and compliance Align metrics with quality and compliance Participate actively in designing and overseeing quality and compliance Create an appropriate management structure with clear lines of responsibility Actively seek out and act upon quality/compliance information

15. 14 Policies and Plans Robust Structure of Written Policies, Standards, SOPs Built on explicit quality objectives Align Quality Objectives With Business And Manufacturing Priorities Reduce complexity Decrease variability Be Specific Design processes to ensure real-time release of quality product Use electronic batch records Reduce number of SOPs

16. 15 Training Systematic And Structured Needs assessment Training curricula Testing and certification Documented Comprehensive Policies and procedures Regulatory requirements Job functions Work culture

17. 16 Audits How Often and How Deep? Complexity of the process Complexity of the product Compliance status and history Experience Major product/facility changes For Regulators As Well As Regulated

18. 17 Corrective Action Adequate Information Periodic reports Manufacturing/lab investigations Customer complaints Internal audits Agency inspections Effective Follow-up Investigate Correct Evaluate effectiveness

19. 18 Safety Valves Robust Investigative Capability Adequately resourced Plugged in to management Compliance Hot Line Publicized Anonymous No retaliation Vigorous follow-up

20. 19 What About Risk Management? System for assessing vulnerabilities: chances of a problem X severity of consequences Health Compliance Supply Business System Effectiveness Right resources Right questions Right information

21. 20 Risk-Based Compliance: Outcomes Better, more informed risk decisions Better relationship with regulators Put compliance resources where most needed