What Are The Records Anyway?

Tax day in the U.S. has come and gone, and lucky e-filers are already enjoying their refunds. Whether you prepare your own taxes or rely on an accountant, you know the importance of understanding which of your financial records are important and why.

The same holds true at work. In the life science industry, we use computer systems to create, modify, maintain, archive, retrieve, and transmit records. The first step on the trail to data integrity is identifying the records and the record keeping requirements.

Sometimes your auditees need help connecting what systems do to the regulatory requirements.

Where do you start?

Start With The Predicate Rule

The predicate rule is your leg to stand on when you need to help stakeholders understand record keeping requirements applied to computerized systems. (“Predicate rule” has a very FDA-centric meaning. Don’t neglect your understanding of other regional regulations.)

How do you learn the predicate rule?

1. Read the regulation. Then read it again.
2. Keep an electronic copy at your fingertips for reference.
3. Subscribe to Warning Letter updates to learn how FDA is applying the regulations to the issues they see in inspections.
4. Stay current on regulatory guidance documents. While they aren’t binding, they are a reflection on the agency’s thinking about applications of the predicate rule.

Hypothetical Examples

Let’s take a look at 2 hypothetical examples to illustrate using the predicate rule requirements to improve the effectiveness of your communications with your auditees.

Your role? Pretend you are an auditor at a pharmaceutical company.

1. Trial Master File example

A year ago, management outsourced your company’s Trial Master File (TMF) to Documents-R-Us, a cloud-based provider of electronic document management solutions to many industries, including the life sciences. For months, internal users have complained of 2 issues: 1) documents they sent to the provider for scanning and indexing into the system never show up in the system; 2) scanned documents are misfiled and difficult to find. In fact, some disgruntled users have taken to making detailed lists of what they send to the provider, or making their own copies of documents before they send the originals to the provider.

Management sends you to the provider to figure out what is going on.

When you arrive at Documents-R-Us, you find they have no SOPs, don’t know what a system development life cycle is, haven’t a clue what validation means, and have no documented requirements, specifications, testing or change control records for the eTMF system. They inform you their contract with your company makes no mention of validation. Then to top it all off, they present you with a risk analysis performed by a consultant from outside the pharmaceutical industry that concludes:

“Trial Master File documents are not clinical data. Therefore the system does not need to be validated.”

What do you do? Tabling your concerns around your company’s provider qualification and contracting processes, you concentrate on the records themselves.

Identify the records: The records include monitoring visit reports, signed Form FDA-1572s, curriculum vitae for clinical investigators, and investigator brochures.

Identify the predicate rule requirements: Predicate rules require each of these records. In addition, your company’s SOPs and clinical protocols require compliance with ICH-E6, making those requirements applicable too. ICH-E6 2.10 covers all TMF records in a general way. More specifically,

• Monitoring Visit Reports: 21 CFR Part 312.50, 312.56(a); ICH-E6 5.18.6, 8.2.19, 8.2.20, 8.3.10, 8.4.5
• Signed Form FDA-1572: 21 CFR Part 312.53(c)(1)
• Curriculum Vitae for Clinical Investigators: 21 CFR Part 312.23(a)(6), 312.53(c)(2); ICH-E6 4.1.1, 8.2.10, 8.3.5
• Investigator Brochures: 21 CFR Part 312.23(a)(5), 312.55(a); ICH-E6 5.6.2, 7, 8.2.1, 8.3.1

Next steps: You prepared well and arrive at the provider’s site with a list of documents that have been sent to them that are either missing completely from the TMF or have been misfiled. You start by educating the provider’s management team.

1. They’re right. TMF documents are not clinical trial data. Acknowledge what they got right before delivering the bad news.
2. Set the stage by helping them understand how important the records are to your company, which regulators require them, and why. (You’re taking them back to the predicate rule.)
3. Share with them the data you already have on missing and misfiled documents.
4. Remind them that your company relies on the completeness and accuracy of TMF records to support frequent regulatory inspections, and that European regulators increasingly expect to be given hands-on access to eTMF systems during their inspections.
5. Explain that the purpose of following a defined system development life cycle and validating a system is to demonstrate that the system operates accurately and reliably and consistently performs as intended.

Depending on your company’s report writing standards, you may write two findings (one for the records, citing predicate rules; the other for the lack of validation, citing Part 11). Or, like an FDA inspector, you might write one, relying exclusively on the predicate requirements.

2. Serious Adverse Event example

Your IT department has developed and deployed an interface between your outsourced EDC system and your in-house PV system: SAEDirect. SAEDirect automatically sends serious adverse event (SAE) data from the EDC system to the PV system as soon as clinical investigator site staff save the SAE form. Since deployment, monitors and auditors have noticed that some SAEs they see in the EDC system do not have corresponding safety reports in the PV system. In your next internal audit of the PV reporting process, the IT development team explains they didn’t validate SAEDirect because their management told them:

“It’s just a ‘pass-through’ system. The source data are safe in the EDC system. There’s no need to spend all those resources validating a pass-through system.”
Identify the records: The records are serious adverse events reported by clinical investigators in the conduct of a clinical trial.

Identify the predicate rule requirements: Predicate rules assign responsibilities to both clinical investigators and sponsors.

• 21 CFR Part 312.32(b) – (d), 312.64(b)
• ICH-E6 2.10, 4.11, 5.16, 5.17
• Directive 2001/20/EC Articles 16 and 17

Next steps: You meet with the IT management team and

1. Explain the 7 and 15 calendar day reporting requirements under 21 CFR Part 312. (Take them back to the predicate rule.)
2. Share the data you have on SAEs in the EDC system that never made it to the PV system or were delayed in transmission. Include statistics on missed reporting guidelines.
3. Remind them that these reporting obligations are in place to protect clinical trial subjects. The system isn’t merely a “pass through” system. It transmits data to fulfill process requirements established by the FDA.

There may be as many as three findings here: 1) late or unreported SAEs due to system failures (predicate rule); 2) failure to validate the system (Part 11 and your own SOPs); and 3) inadequate SOPs.

The moral of the story: Always start with the predicate rule. Always.

Do you have different insights on either of these hypothetical examples?  Leave a comment – start the discussion!