5 Ways to Prep for A Regulatory Audit: A Holistic Approach

As a regulatory professional, lately it has becoming glaringly apparent that the only way to be successful in a regulatory audit is to take a holistic approach to quality. Holistic can be simply defined as ‘emphasizing the importance of the whole and the interdependence of its parts’. Like holistic medicine, for a ‘healthy’ status with the regulatory agencies, a company, with all their individual components, must be firing on all cylinders in regards to compliance with the greater goal of quality. Now I fully understand this may sound like hippie nonsense, but before the incense candles, spirit crystals, and kumbaya songs come out, let me further explain this thought.


We are all hard-wired to react rather than prepare, this is basic human nature. Dealing with the uncertain is not a strong point for many people. There is a major difference between prepping for a hypothetical audit situation and having the FDA show up at your door. It takes a great deal of foresight and methodical planning (as a whole) well in advance to be ready for your next audit.

With a top-tier, systematic approach to compliance, at a certain point you are no longer defending your actions to an auditor; the actions begin to speak for themselves. You are not trying to ‘convince’ an auditor you took appropriate actions, that conclusion is drawn on their own accord. I keep a few quotes in a notebook at my desk, one of which is from the legendary football coach Chuck Knox, it reads as follows: “What you do speaks so well. There’s no need to hear what you say.”

With that said, here are a few long term efforts that speak volumes when preparing for an audit:

·         Strong management involvement. Management must have a finger on the pulse of the company to ensure the ‘little things’ don’t end up becoming ‘big things.’  Minor issues, one-offs, and ‘almost tragedies’ need to be vetted and scrutinized by management. Important note, this is not at all to be confused with being minutia focused. Simply put: beaware of the potentially overlooked.



·         Focus on ‘Big Wins.’ This may seem contrary to my last statement, but sometimes when you do the small things well, it’s easy to miss the gigantic issue staring you directly in the face. True masters of compliance understand potential regulatory shortcomings on a profound level, and use various systems, automation, and risk analyses to correct the things that really do matter. One way this is achieved by applying the ‘Pareto principle’ or ’80-20 Rule’ (80% of your benefits come from 20% of your efforts) to focus heavily on those tasks that contribute the majority of a given benefit. Of all 483’s issued, what are the twenty percent of all regulatory findings that cause eighty percent of all 483’s or vice-versa? If you follow the regulatory news to any extent you are already well aware of some of the current trends out there. Do your homework well before the exam. Know what other companies are getting cited for over, and over again. Hint: you can access 2,300+ 483’s at FDAzilla.com? 

·         Have a strong regulatory and compliance team. If there is anything a company can do to highlight their commitment to quality this is it. Managers, supervisors, floor level technicians, and lab analysts are very busy and highly overworked individuals. Having dedicated employees to write or review fully investigated deviations, generate appropriate corrective and preventative actions, assess and revise formal documents and operating procedures, perform internal audits and continuous improvement measures. Hiring talent has its price, but these tasks combined will most certainly provide the right bang for your buck to keep your company out of the regulatory news headlines.

·         Scrutinize the status quo. I harp on this a lot but it is almost never a bad idea to bring in outside consultants to review your quality systems and key processes. Continue your due diligence, this should by no means act as a crutch but merely exist as an aide to ensure your systems are working optimally.

Status Quo

Status Quo

·         Study the best. If you’re going to look at anyone in your industry, make sure it’s the best. Being the best is never an accident. Know what makes a proven winner in an audit situation. Case studies can be important tools in quality improvement.

There are a lot of bullet point posts out there that claim to provide step by step processes for guaranteed overnight results or ‘proven’ shortcuts to success. Unfortunately, there are no shortcuts to regulatory compliance in the pharmaceutical industry. If it was easy, everyone would do it. It will take you less time and less effort to do it the difficult way than it will to try the shortcuts. It takes a culture change and a great deal of preparation to instill a holistic effort to quality. Make these long term changes now and hopefully your company will reap the rewards for many years to come.

The next job emerging in Big Pharma: The Compliance Ninja

If you follow the pharma industry in the news you most certainly have noticed an increased interest  in 483’s and warning letters. They literally seem to be everywhere, almost to the point of information overload. My typical workday morning routine involves what I call “the cycle” where I briefly go through my news feed in a particular order. It usually looks something like this:  email > twitter > facebook > fierce pharma > raps RF.  I try really hard to limit this “cycle” to once in the morning and once again at 3PM but that doesn’t always happen. It is my strange, strange addiction – TLC reality show here I come! Although this may be my main sap of productivity, I figure on the bright side I am always  up to date on all the latest pharma headlines. I’ve read almost every 483 released in the past year. Every batch that gets released by the FDA, I read in a nice summary format. I know them all. My personal favorite at the moment is the Desert Rose Manufacturing Company recently getting hit with a 483 for not having enough toilet paper in their restrooms. Yes, that happened. I wasn’t kidding when I said in “8 Things I Learned From Regulatory Audits” that hosting an audit is like having guests over for dinner. If you can’t keep the bathroom clean then guests will wonder what is going on in the kitchen. Jokes aside, compliance matters, literally every detail of your operation is open to scrutiny.

It makes me wonder if the training for inspections is adequate by most companies. Should subject matter experts (SME’s) get extra training? Should there be a department full of compliance specialists?  Should we roll out a site-wide initiative? Are we doing enough? When (not if) are we going to see a 483 or warning letter? These are the questions that keep pharma company executives and VPs up at night. If you have a major stake in a pharma company, and you want to rest a like a newborn baby – it may be time to start re-thinking your compliance program and the subsequent training. This should be a huge investment and I’m not just monetarily, there needs to be a total paradigm shift that sweeps quality and compliance throughout your company. The company must bring in the right people (top tier free-agents if you will) and also develop top talent specialists from within. Like a farm team developing future major leaguers, pharma companies need to do the same with top talent. You need to have your next ace ready before your all-star needs Tommy John surgery. Did I mention I love sports analogies? Compliance needs to be where the best of the best go to shine and keep your company out of the news headlines.

If I were a director or VP of quality at a pharmaceutical company and I were creating my own compliance department full of specialists (or compliance ninjas as I would prefer to call them,  you gotta admit “Compliance Ninja” would look pretty badass on an office door) I’m gonna lay out what the core values that this position should entail.

The core values and skill set of a compliance ninja are as follows:

  • Investigator. Must have a serious nose for investigating and leading investigations (not relying on engineering or TMS). Think a mix of Sherlock Holmes and Six Sigma Specialist. After reading warning letters and 483’s issued for the past year – a major trend is not fully investigating deviations. The investigations are shallow and incomplete, settling for unknown causes when the root cause is not wrapped up for them in a bright and shiny bow. Companies are not getting the root cause – asking 3-why instead of 5-why. Also, companies are not showing how they got to the bottom of the problem, what they considered and subsequently ruled out.
  • Intestinal Fortitude. Must have the guts to ask why are we doing this? A compliance ninja absolutely cannot just go with the motion on things, they must be able to stand up for what is right. A regulatory consultant once told me that the quality department should be an extension of the FDA on-site every, single day. It is really that simple. You may not be liked but in the end patients safety is on the line. The buck needs to stop somewhere, it should probably be with you.
  • Legal Representative. I have a soft spot for old school legal television dramas. Matlock, Columbo, Perry Mason, now those guys could kill it in a courtroom. They could keep the entire room captivated – asking the right questions, presenting well prepared arguments, and defending their clients without skipping a beat or breaking a sweat. To hold up in a high stress audit room I believe some form of legal training is required. We all know the basics that come up in annual cGMP training – don’t give too little or too much information, always ask for clarification if you need it, just answer the question asked, etc. I think its time advanced techniques are used to bring employees to the next level.
  • Writer. Technical reports, deviations, and CAPAs MUST be succinct, crisp, and well tailored. I often wonder how many auditors get tired of reading pure crap as technical writing for the most part seems to be just that – garbled, jargon laced, crap. Great writers need a voice. This is accomplished by reading other great writers and writing, lots and lots of writing. Have a system, spend some time everyday reading top notch technical reports and then do your writing. Writing is one of those skills that if you don’t use it, you lose it. Even skipping a day or two you lose your edge. The most important thing is consistently showing up. Now, I admit, I may not win a Pulitzer any time soon but I’m sure as heck going to work on my craft like a writer or journalist would. Every deviation tells a story. Summarize up front. Get to the meat and potatoes of your investigation. Did you find your most probable root cause? Did you put a CAPA in place? Did you check the effectiveness of your CAPA? State these things up front and leave it up to the investigator to decide how much farther they want to dig.
  • Savy. A compliance ninja must be technical wizard. There are a ton of resources out there on the web that need to be sifted through and analyzed. Companies need to also start building software internally to sort through copious amounts of data to support their compliance programs. I can read 483 and warning letter summaries all day long but it makes a lot more sense to run those reports through advanced software to analyze for trends to stay ahead of the curve. That information needs to then go into the right hands to make proper changes. Think Moneyball for Pharma.
  • Self-Assured. The compliance ninja is not afraid to ask for help. Consultants can and should be your second set of eyes (without the politics of course). This is not always easy, unless a company is in crisis mode it is very hard for a consultant to come in and make the changes that need to be made as they are always competing with internal talent. People are used to doing things a certain way, jobs are on the line, and people get defensive. There needs to be a culture where egos get put aside and everyone takes out their yoga mats, takes a deep breath and repeats the mantra “I’m good enough, I’m smart enough, and doggone it, people like me!” Start accepting that the way you did it in the past may not have been the best practice. Accept change and move on.
  • Teacher. I’m not talking PowerPoint slides here, this is the best lecturer you had in college. You know, the teacher so passionate about the topic that you were instantly captivated. This is more than a monetary investment – its actually giving a damn about what you are teaching and convincing your peers how and why quality and compliance are completely necessary. The annual cGMP training isn’t going to cut it anymore, quality training needs to occur everyday.

With compliance, the stakes are high. The bar is constantly being raised and companies need to be on the offensive. There are more resources than ever and companies need to start trotting out compliance as a core competency.  Like Toyota with their Toyota Production System (TPS), they invented their own management philosophy and practices that set the standard for manufacturing.  Who in the pharma industry is going to set the bar for compliance? It’s time for pharma companies to invent a compliance program so bulletproof that regulatory agencies will hold them in the highest regard and perfection will be the standard.

Just think if you do it right and build the perfect compliance program, imagine all the training course certificates your company could eventually sell.

How is your company handling regulatory compliance?


What does quality mean to you?

What does quality mean to you?  This question was recently posed to me in an interview and I hastily (and probably nervously) regurgitated the words “quality is when you do the right thing when nobody is looking.”  The answer seemed to satisfy the interviewer, as there were no further questions and I received a slight head nod and moderate look of approval. I am pretty sure I heard this in my annual cGMP training and that particular phrase somehow lodged in my brain stem probably for the rest of my life.  As cliché as my answer may have sounded, I do wholeheartedly agree with those words, I just think there is something much more to quality that the pharmaceutical industry just doesn’t completely grasp yet. In hindsight, I wish I took the time to step back, relax myself and answer this question as I really feel about quality.  Although I can’t go back in time to “fix” this answer in my interview, I will try to adequately sum up my beliefs with this post.

Obviously all good companies want a clean product that works as described, this goes without saying. Everyone from the top down at a company wants the drug produced to be safe and effective; this is something I have always been highly aware of throughout my career in quality. There are GMP trainings, SOPs, quality systems, risk assessments – this is all essential to running a pharmaceutical company but I think true quality is more than just following steps on a procedure, batch record, or protocol. It’s an obsession, an obsession to be the best.

I like to bring up two examples when I talk about quality, both of which are probably far too simplistic (and ironic) to make an adequate analogy to drug manufacturing but I think the principles hold true in almost any manufacturing operation so I’m going to run with them. The first is a coffee company. Not just any coffee, Blue Bottle Coffee is a boutique coffee roaster and brewer open in a few select locations that painstakingly produces the perfect cup of coffee. They could easily produce your standard cup of Joe from a run of the mill brewing system, like that place you stop on the way to work to get your morning caffeine fix. They are far from standard. They instead make the concerted choice to produce remarkable coffee. The espresso machines are “pour over” bars imported from Japan that look like they belong in a chemistry lab and not a cafe. As described in a New York times article, “The kettles have a swan-neck that deliver a thin, precise steam of water. The wood and brass frames support a network of glass globes and adjustable nozzles that mete out liquid at 88 drops of minute.”  The owner, James Freeman goes on to explain their process in the article, “You precariously take that glass sphere, fill it with cold filtered water, then you stand on a stepstool and nervously and quickly invert it over the reservoir… Twelve hours later, the coffee is ready.”  The Blue Bottle Coffee Company stands by the owner’s firm principle to only sell the finest organic, pesticide-free, shade grown coffee less than 48 hours out of the roaster to his customers, so they may enjoy coffee at its peak of flavor. This company clearly has an obsession for every detail. They choose to do something the hard way, not just for show or to boast but because for they believe the quality is completely worth it.

My second example is from a cigar company. Yes that’s right, in a blog about pharmaceutical manufacturing, I’m talking about cigar company in third world country making a product with potential health implications. I know, I know, I get the irony; quality control should be the furthest thing that comes to mind but with this company that is hardly the case. My father-in-law enjoys a cigar now and then and subscribes to Cigar Aficionado Magazine. I like to borrow his old magazines and peruse the articles when I sit down for breakfast in the morning. One article recently caught my eye, as I started reading about Drew Estate Cigar Company. I thought their process was extremely innovative, so later that day I went on Google and dug a little bit more into the operations of this company. The first thing that stuck out to me was their training program. They typically hire younger workers, usually people very raw to the industry without preconceptions on how a cigar should be made. They spend the first 30 days solely observing – they don’t get to touch anything. After that first 30 days, the new goal is to make one cigar right, just one. Once they make one right, they then move on to two cigars, and this progress continues until they can produce 75 perfect cigars in one day. This can take around 6 to 7 months. Once they are able to produce 75 correctly in one day, they then get moved off the training program into the production side where they work up producing 375 cigars a day, this takes almost 2 years. Around the 14 month mark they reach the tipping point where the rollers are making about 225 cigars a day and the initial training investment finally pays off for the company. After years of training the workers are assessed for particular talents and leveraged for their strengths and could eventually lead to work on a high end premium hand rolled cigar like the Liga Privada series. This can be contrasted with vast other companies who immediately start their workers producing cheap lower quality products where the margin for error is very high and they can quickly make some money back on a minimal training investment.

I was equally impressed with their fermentation process (the microbiologist in me has all these population studies and R&D I would love to see done). I thought their process looked pretty innovative and I had the chance to reach out to Steve Saka, the CEO of Drew Estate Cigars on a recent Reddit AMA to ask a few questions on their process. Right off the bat, he made a point to stress their stance on quality, he quipped “you can’t make fine cuisine from marshmallows and cheese whiz.”  It starts at the beginning and no corners are cut. They use one of the hardest tobacco leaves to work with, cut at a farm in the Connecticut Valley late in the season (the ideal time to pick this particular leaf), put on temperature controlled freight and sent to Nicaragua where they are cured for 90 days and then fermented for 3 years or more at the perfect temperature. After this long, tedious process, every single leaf is felt for consistency, sorted by size, shape sometimes up to 6 or 7 times. Every part of the process is thought out, planned, and accounted for. Once again, I’m the furthest thing from a cigar expert after reading a few articles, but I can appreciate a company that puts a lot of effort into making something of high quality. I’m sure they would love to sell something that wasn’t such a hassle to make, but they do it because they want to be the best and they want to create something remarkable.

The principles of quality are always a focal point of every pharmaceutical company, blanket statements are imbedded in every mission statement and annual cGMP training classes.  Companies generally understand the importance of quality, want safe and pure products – there is no question there. My vision is to see a company take this a giant step further and obsess over complete excellence on all levels. I want to see a company that is completely transparent with every facet of the company and manufacturing process – a company that out teaches and out cares their competition. I want to see meaningful metrics kept and a true understanding of process data inside and out. When manufacturing obsesses on every detail, quality just falls into place on its own, without training campaigns and big showy hurrahs. The quality control results become better and quality assurance department runs smoother as there are fewer problems to sort through, explain, and eventually defend. This makes everything easier for a company. The answer is investing heavily in training and process improvements. I think QC results (as important as they are) can become too much of a crutch for a company. QC testing results cannot be the only source of true quality control in an organization; it comes down to excellence in all avenues of the company and its culture.

The landscape of quality is continually evolving and will continue to change in the near future as consumers become aware and expect perfection with the amount of money spent on health care. Oh yeah, the interview went well, maybe I should celebrate the new job with a cigar and a fine cup of coffee.

I would love to hear what quality means to you?


8 Things I Learned From Regulatory Audits

My very first regulatory inspection was a FDA audit in late 2007.  News spread that the inspectors were knocking at our door and I have never seen so many people trying so hard to look busy in my life (myself included). Later that afternoon and for the rest of the week my manager sent me to the temporary office trailer out behind the building to train on procedures at my desk. I was just a lowly contract technician at the time, technically not even an actual employee for the company being audited so I guess it made some sense for me to hidden away in an office during a high profile audit. Since that day very early in my career, I have been involved in numerous regulatory agency audits while working for a global pharma company. Having come such a long way, I will share a few inspection lessons I learned along the way for audit success as a laboratory analyst.

So, eight things I learned from regulatory inspections.

1. Be the guy you want to be in a bunker with.  This can be said for a lot of things not just your role within your company, i.e. your relationships with your spouse, business partner, family, friends – everyone you are close with wants to know you have their back when it matters most. The absolute last person you want find yourself alone with in your bunker is someone you don’t trust. Period. Imperfections and bad habits tend to be immensely magnified in high stress situations. You want that person who would dive on a grenade for you because you would do the same for them. Stay late to verify data, check expiration dates on every reagent, heck even check reagents for other departments. Take responsibility for mistakes and quickly correct them. Sweep the floors, even that spot behind the door you don’t want to crouch down to get. Every day try to be that person, especially during an audit.

Be this guy.

2. Be the source. Google and Yahoo are wildly successful because they do just that – provide a lot of information without asking for any credit as they give you countless pages of information. If an auditor is looking for something, i.e. a data sheet from an assay run three years ago, a random protocol written by the employee you replaced, or an Excel graph trend of every environmental isolates cultured from the plant since the beginning of time – just find it for your manager and move on. Think on your feet and anticipate where the auditor is going and future questions that could come up next.  Offer as much information to your manager or director about to head into the audit room. Make them look good, the more prepared they are the better. Do this without taking any credit for your own. Become the directory of everything related to your department. OWN the department.

3. Be fast, be accurate, and have a great review system. It is essential to have a system in place for all aspects of the audit. From runners, to review teams, inspection coordinators and those running the staging rooms. When they ask for x, y, z  be able to produce results fast and at a high quality.  Set yourself apart by producing great reports. Have a system in place ahead of time.

Review Everything

4. Networks are important. The biotech world is pretty small. If you have been in this field for any amount of time chances are you know somebody working at another company. With a strong network, you can get tipped off before they even show up at your doorstep. I’ve seen this happen before where two well known inspectors were making a visit to a company about a half-hour away and a colleague at that company politely made a call down the road to notify them that so & so were at their place and chances are they are heading your way next. Always know what is going on around you.

5. Have a profile of your inspectors.  Pet peeves tendencies, likes, dislikes, how they like their coffee or even their favorite dish. Think of it like when you are hosting guests over for dinner except your guest can shut down your operation if they don’t like the way you prepare your meatloaf. It may sound like minutiae but inspectors pick up on attention to detail. *Update* Taking this idea a step further, when the FDA shows up, you should probably have someone Google your inspector.  I would have the regulatory team go ahead and purchase all the 483’s that this inspector has issued previously. Like a football coach watching an opposing team’s game film, I would want to know my inspector’s tendencies from their past few inspections.

6. Build a rapport with the inspector. Like any good parent, teacher, or boss, an auditor has their BS radar on high alert at all times. Just like you meant to clean your room, your dog ate your homework, and you have a really bad stomach bug on the first perfect weather day of summer – auditors are trained to pick up on anything that might have the slightest hint of exaggeration or fuzzy math. Avoid mumbling, talking with your head down, and my personal favorite, the nervously shaking uncontrollably routine. Make strong eye contact and be confident in your answers. Being honest and straightforward goes a long way in this industry.

7. Prepare. You can personally prepare for regulatory audits and it probably should be a major part of career training. Like a basketball player practicing a contested 3-point buzzer-beater or a quarterback running the two minute drill, it makes a great deal of sense to practice the high stress situations before they ever happen. Two years ago I got my friends in the industry to start practice grilling each other like we are in an inspection room. I know this is completely un-sexy and a NERD alert is sounding somewhere but considering how an inspection outcome can make or break a career I see this as a little insurance to help ensure you can get things done in those high pressure moments. Make yourself really sweat and get the adrenaline flowing.

Adrenaline is flowing.

Have there been common requests in past audits? Think of your departments weak spots may be. Write them down and work to fix them. If its your job to produce a data report, practice ahead of time. Set a timer and have someone verify the accuracy of your report. Sometimes auditors from smaller countries just want to pick at the low hanging fruit and give you a real good one-over. Working in the restaurant business as a college job, I learned if you can’t keep the bathrooms clean then guests will wonder what is going on in the kitchen. Same thing with regulatory auditors, if you can’t do the small things right like logbook entries, appearance cleaning, and following basic procedures – doing exactly what you say you do, then chances are you don’t do the big things right as well, like I don’t know – producing your drug!

8. Look good. I hear a lot of griping from co-workers about having to dress business casual for an inspection. The complaint is usually something like “well shouldn’t they see us as we are dressed everyday?” The answer to this is simply no. Like the dinner guest analogy from before, you don’t want to look like a slob when your guests are coming over. Leave the sweat pants at home for a day, suck it up and throw on a dress shirt and some nice pants. Keep it simple, you don’t have to go over the top for the fictional “Regulatory Inspection Best Dressed Award.” Although, come to think of it, I would look pretty damn good testing bioburden in a tuxedo.

Overall, it is important to not forget, inspections are just part of the process and can be good for a company. Turns out the threat of extensive fines, closure, legal action, and 483’s tend to be more often than not the perfect motivation to fix anything that may be less than ideal and do things the right way. Follow these tips and hopefully you’ll be smooth sailing through your next audit.

Feel free to share some of your own tips for getting through an inspection in the comments section. I would love to hear from you.