1. Session 6: Data Integrity and Inspection of e-Clinical Computerized Systems May 15, 2011 | Beijing, China Kim Nitahara Principal Consultant and CEO META Solutions, Inc. (USA)

2. To understand data integrity and its relation to computerized systems used in clinical trials To review key issues related to the inspection of e-clinical computerized systems 2www.diahome.orgDrug Information Association Purpose of this session:

3. Data Integrity Regulatory Requirements for e-Clinical Computerized Systems Inspection of e-Clinical Computerized Systems –Expectations –Results 3www.diahome.orgDrug Information Association Topics to be discussed:

4. What is Data Integrity? How is Data Integrity Lost? How Do We Ensure Data Integrity? Why is Data Integrity Important? 4www.diahome.orgDrug Information Association Data Integrity Topics:

5. Data Integrity is the “validity” of the data for its intended purpose and use –Accurate –Complete –Reliable –Accessible –Enduring 5www.diahome.orgDrug Information Association What is data integrity?

6. Human Errors and Tampering Storage and Transfer Errors Software Errors Software Viruses Hardware Malfunction Disasters 6www.diahome.orgDrug Information Association How is data integrity lost? Loss of Data Control Loss of Data Integri ty

7. Personnel Training Procedural Controls –SOPs –Quality Assurance and Management Computerized Systems Controls –Error Detection and Correction –System Validation Information Technology (IT) Controls –Backup and Disaster Recovery Plans –Network Security 7www.diahome.orgDrug Information Association How do we ensure data integrity?

8. Clinical Trials Data May be Used to Make Important Decisions –Industry –Regulatory Agencies –Public Data May be Re-Used in the Future –Repeated Analysis –New Purposes 8www.diahome.orgDrug Information Association Why is data integrity important? Data Integrity is a Regulatory Requirement

9. How Do Agencies Ensure Data Integrity? What is Expected During Inspections? What Are the Requirements? 9www.diahome.orgDrug Information Association Regulatory requirements topics:

10. Regulations and Guidance Review of Submitted Data Independent Analysis of Data On-Site Inspections 1) They Provide Requirements 2) They Confirm Adherence 10www.diahome.orgDrug Information Association How do agencies ensure data integrity?

11. Effective controls for trustworthy data Accurate and complete records Reliable systems and processes Secure data, systems and facilities Qualified and trained personnel Requirements to Ensure Data Integrity 11www.diahome.orgDrug Information Association What is expected during inspections?

12. Provided in: Regulations Guidelines and Guidance for Industry Compliance Policy Guides; Program Manuals; Advisory Documents Published Presentations 12www.diahome.orgDrug Information Association What are the requirements?

13. “An investigator is required to prepare and maintain adequate and accurate case histories… and other data…” 13www.diahome.orgDrug Information Association Example of US FDA Regulation (FDA 21 CFR 312.62 Investigator Recordkeeping and Record Retention)

14. “Systems with procedures that assure the quality of every aspect of the trial should be implemented.” 14www.diahome.orgDrug Information Association Example of ICH Guidance (ICH E6 Good Clinical Practice; Consolidated Guidance)

15. (FDA/ICH) E6 “Good Clinical Practice: Consolidated Guidance” (April 1996) (FDA) “Computer Systems Used in Clinical Investigations” (May 2007) (FDA) “Part 11, Electronic Records; Electronic Signatures – Scope and Application” (August 2003) These Are Not Regulations 15www.diahome.orgDrug Information Association Examples of FDA and ICH Guidance

16. –“Clinical Investigators” (CP 7348.811) –“Sponsors, CROs and Monitors” (CP 7348.810) These are used by FDA personnel (and are useful to you!) 16www.diahome.orgDrug Information Association Examples of US FDA Compliance Program Manuals

17. What does FDA ask during inspections? What records are inspected? What has FDA observed? What is FDA’s response to deficiencies? 17www.diahome.orgDrug Information Association Computerized System Inspection Topics:

18. Were there any problems experienced during the course of the study? What is the source of data entered into the computer? Direct (no paper)? Case report form? Office record? Other? (CP 7348.811 Clinical Investigators) 18www.diahome.orgDrug Information Association What does FDA ask during inspections?

19. What is the source of the hardware and software? Who enters data? When? How are data changed? By whom? Is an audit trail produced? (CP 7348.811 Clinical Investigators) 19www.diahome.orgDrug Information Association What does FDA ask during inspections?

20. “If a firm is keeping eRecords or using eSignatures determine if they are in compliance with 21 CFR 11.” “At a minimum, ensure that:” –Corrective Action Plan is in Progress –Accurate/Complete Copies Available –Employees Are Held Accountable and Responsible (CP 7348.810 Sponsors, Monitors and CROs) 20www.diahome.orgDrug Information Association What does FDA Ask during inspections?

21. Software Development Documentation Validation Plans and Documentation System Description/Configuration Diagram System Operations Records Configuration and Change Control Records 21www.diahome.orgDrug Information Association What records are inspected?

22. Personnel Training Procedures and Records Data Collection and Transmission Controls IT Security Procedures and Records Emergency and Back-up Procedures and Records 22www.diahome.orgDrug Information Association What records are inspected?

23. Lack of programming standards and conventions No documents describing the intended function(s), operation and performance of software Failure to test software at its operational limits Incomplete test documentation 23www.diahome.orgDrug Information Association What has FDA observed?

24. The firm did not monitor and keep track of changes to hardware, application or operating system software. There was no validation data to show that the system gave accurate and reliable results There was no written validation plan reviewed or approved by management 24www.diahome.orgDrug Information Association What has FDA observed?

25. No documentation of training of persons engaged in writing, validating or supporting computer programs No written SOPs for user operations, security guidelines, software revision control, virus detection, disaster recovery, and database backup and audit trail archival. 25www.diahome.orgDrug Information Association What has FDA observed?

26. The audit trail switch was intentionally disabled and prevented the recording of data that was modified or edited There is no written procedure to describe the process that is used to assign, maintain passwords and access levels to the system There were no restrictions on who could create, rename, or delete data. 26www.diahome.orgDrug Information Association What has FDA observed?

27. Lack of validation Validation protocols for upgraded software do not contain diagrams or lists of hardware configurations and peripheral devices within the system. The validation team and individual responsibilities are not specified 27www.diahome.orgDrug Information Association What has FDA observed?

28. Form FDA 483 Inspectional Observations (“483”) Establishment Inspection Report (EIR) Notification to assigning Center Regulatory sanctions for violations 28www.diahome.orgDrug Information Association What is FDA’s response to deficiencies?

29. “If initial findings indicate the firm’s electronic records and/or …signatures may not be trustworthy and reliable, or when …systems inhibit meaningful FDA inspection, a more detailed evaluation may be warranted.” (CP 7348.810 Sponsors, CROs and Monitors) FDA may perform another inspection 29www.diahome.orgDrug Information Association What is FDA’s response to deficiencies?

30. “In addition to a response to the deficiencies noted earlier in this letter, please outline your firm's global corrective action plan, including timeframes for correction, to address this Part 11 issue…” FDA Warning Letter 30www.diahome.orgDrug Information Association What is FDA’s response to deficiencies?

31. “When substantial and significant part 11 deviations exist, FDA will not accept use of electronic records and …signatures to meet the requirements of the applicable predicate rule.” (CP 7348.810 Sponsors, CROs and Monitors) FDA may not accept the clinical trials data 31www.diahome.orgDrug Information Association What is FDA’s response to deficiencies?

32. Data Integrity Regulatory Requirements for e-Clinical Computerized Systems Inspection of e-Clinical Computerized Systems –Expectations –Results 32www.diahome.orgDrug Information Association Summary of discussed topics:

33. Regulatory agencies establish regulations and guidance to ensure clinical trials data quality and integrity Regulatory agencies confirm compliance with regulations to ensure that clinical trials data and reports are accurate and reliable for their purposes 33www.diahome.orgDrug Information Association Conclusions:

34. Regulatory agencies generally follow their standard procedures when they conduct their inspections of e-clinical systems If deficiencies are found during inspections, regulatory agencies have the authority to take actions, including rejection of clinical trials data. 34www.diahome.orgDrug Information Association Conclusions (continued):

35. Questions and discussion kim.nitahara@metasol.com Drug Information Associationwww.diahome.org35