You asked, we answered - Another validation webinar Q&A

In this blog, we present questions we didn't have time to answer during our "Ask Me Anything on Validation" webinar. If you haven't yet watched the webinar, you can view the recording.  We also collected all the questions into a single document available upon request. 

Question: Related to temperature mapping GMP warehouses and storage rooms I have two questions:

• Is there a regulatory requirement that specifically states that you must perform routine temperature mapping of GMP warehouse areas and storage rooms?
• Other than the literature that exists related to validation in general such as FDA Guidance on Validation, etc., are there any other regulatory documents that mandate such activity?

Paul Daniel: A short answer your question: there is (almost) no regulatory requirement that states that you have to map at all.  However, this answer is unfulfilling and only creates more questions.

So, here is the long answer:  

We need to start with 21 CFR Part 211, Subpart H – Holding and Distribution (211.142(b). 

“Written procedures describing the warehousing of drug products shall be established and followed. They shall include: …Storage of drug products under appropriate conditions of temperature, humidity, and light so that the identity, strength, quality, and purity of the drug products are not affected.”

Yes, I know this says warehousing, but it is under the subpart of “holding” and the FDA has said elsewhere that holding is anything that is not distribution. This means all of manufacturing is included.  No matter what you are processing, at some point the material is held.

The clear mandate here is that we have to store drugs (and any GxP products, raw materials, and intermediates) in conditions that do not negatively affect quality.  This is echoed in the regulations of every nation and organization that publishes guidance (ISPE, WHO, ICH, etc.).

Temperature mapping was not mentioned in any regulations before 2011 (except certain USP chapters, while enforceable by the FDA, are better thought of as guidance rather than regulations).  And even when regulations started mentioned mapping (for instance GUI-069 from Health Canada in 2011) it is only in the context of Good Distribution Practices.

But mapping was going on well before 2011.  I did my first temperature mapping of a freezer in the spring of 1997 and it was already an established practice at that time.  

Temperature mapping is a method that GxP industry came up with to comply with the regulatory requirements (protect drugs from temperatures that will affect quality).  Temperature mapping was conveniently placed within the context of validation and qualification, because mapping is more or less an Operational Qualification of a temperature control system.

Mapping is an effective way to verify that storage and holding environments are capable of ensuring drugs are maintained in correct conditions.

To answer your second question: Why does it have to be routine?  

The simple answer is that we repeat mapping because things change in the environment and equipment wears out. Systems that depend on electricity, moving parts, refrigeration liquids, and insulation degrade in performance over time. In my experience, the same refrigerator with the same set-point will map differently three years later.  Once we witness this, we see why we must map periodically.  We add the element of change control, where when a system is knowingly changed, which necessitates re-validation.  Re-validation may not be regulated, but that doesn't mean it's not expected. It is written into guidance and a part of common practice as much as the initial temperature mapping.

The latest guidance on the topic is in the recently released (December 2021) 2nd revision (I was an editor) of the ISPE’s Good Practice Guide to Controlled Temperature Chambers. 

Traditionally, the expectation was that temperature-controlled areas would be mapped on an average three-year cycle, with warehouses mapped in both summer and winter.  Intervals between mapping studies was based on risk assessment, with high-risk environments (i.e. stability chambers) being mapped more often, and low-risk environments (i.e. laboratory reagent refrigerators) mapped less often.  The new expectation is that a risk assessment is documented to determine if re-mapping is required, based on past performance and continuous monitoring data.

Someday there may be a better method to prove that an environment is capable of storing sensitive products in correct conditions.  But currently, re-mapping at intervals is part of current good manufacturing practice (cGMP).

 Question: Did the COVID-19 pandemic force you to make clear change(s) in your validation process? Or did it cause the use of alternative tools for validation?

Paul Daniel: This is one of the most interesting questions of the webinar. The short answer for me is no. A core part of the validation process is observing the behavior or output of the system being tested. This means observing the results of your test scripts to ensure that you met your acceptance criteria. If you aren’t present to observe the results, you can’t verify that the test was successful.

However, because viewLinc is a browser-based monitoring system, Vaisala service technicians can execute a portion of the software IQOQ remotely. During the pandemic, remote validation was offered more often. However, Vaisala had been offering remote validation prior to the pandemic. 

But during the COVID-19 pandemic, Vaisala technicians continued traveling to install viewLinc systems and execute IQOQ’s. For many customers, validation and qualification are important enough to have technicians on-site. We found that customers created a safe working space for our technicians by limiting the number of employees and other safety protocols. I spoke with several colleagues who work in validation as consultants. They report that visits to clients’ sites continued with the customers supplying workplace safety controls, rather than experiencing a shift to alternative tools.

Question: What is the difference between PV (Process Validation) & PQ (Performance Qualification)?

Josh Keenan: Several companies will claim that there is a large difference between PQ and PV. In my experience, companies differentiate between the two this way:

Performance Qualification entails running three lots of product through your sub-process or equipment and then verifying the outcome. For example, imagine a tablet press that you want to qualify. First comes IQ and OQ. For the PQ you would run three lots of granulation through the equipment to verify the outcome of the tablet press, testing for rejects, friability, compression, etc.

On the other hand, a lot of companies will then say you need to run a PV which is an all-encompassing validation. In the scenario of tableting, the validation starts with the granulations, moves to tableting, includes the coating, printing, and possibly the packaging, and then assesses the overall lot clearance and performance with all aspects of that process being considered as one large unit operation. In my experience, PQs are limited to single pieces of equipment, or small systems, whereas the PV will encompass your entire process, and hence the use of the term “Process validation” instead of “Performance Qualification.”

Question: What is the requirement to validate network infrastructure? How does one go about doing this (confirmation of data integrity both in motion and at rest, security, etc.)?

Paul Daniel: I don’t think you can really validate network infrastructure. I prefer the term qualification when dealing with equipment. But even then, I think a truly qualified network may not be a possibility. There are just too many pieces of widely scattered equipment operating in dynamic ways to imagine that we could lock it down and call it qualified. I use the term “network qualification” to refer to a general level of control.

Achieving a general level of control of a network can involve:

• Documenting the equipment used
• Documenting connections and configuration
• Verifying that the equipment (physical and virtual) meets certain standards before deployment on a network
• Ensuring administrators are properly trained
• Ensuring access control - only those who need to use the system can access it
• Operating under a change management or change control policy
• Following ITIL best practices

The key is to decide the level of control that is necessary and appropriate for your network based on the types of information it contains. Once this basic level of network control is in place, then I would look at the data integrity and security concerns system by system, applying additional controls where they are justified by a risk-analysis.

Question: Can continuous monitoring replace temperature mapping requirements or is temperature mapping always a prerequisite to continuous monitoring (For example, you temperature map so that you know where to install loggers for continuous monitoring)? 

Paul Daniel: First, let's clarify the difference between mapping and monitoring. Mapping uses a high density of sensors, over a short period, with the purpose of proving that all the storage space in a piece of equipment or area can meet the required temperature specifications. Monitoring, on the other hand, uses a few sensors (often just one in a chamber) to prove that the area has not become compromised in its ability to maintain temperature specifications. This could be a power failure, or a door left open, or a set-point being changed.

The only time monitoring can replace mapping is when there are enough monitoring sensors deployed to provide the same amount of data provided by mapping. No one would do this for a refrigerator, because monitoring a refrigerator with nine sensors is unreasonable. But in a warehouse, it could be done. (And has been by some Vaisala customers.) I call “Continuous Mapping”. Here you use more sensors than normal monitoring, but to save on the labor of deploying and collecting mapping loggers every 18 months.

We have a webinar on the topic: Continuous mapping: better data, better compliance

Warehouse mapping is typically performed every three years, once in the summer and once in the winter, although many do yearly mappings. It is an extremely labor-intensive process, so it can make good financial sense to monitor your warehouse with a mapping-level density of sensors and use those sensors to perform your remapping as needed.

Question: What is the difference between verification, validation, calibration?

Paul Daniel:  Validation provides objective, documented evidence that a process produces results that meet predetermined acceptance criteria.

Qualification focuses on equipment and software. It ensures that systems produce results that meet predetermined acceptance criteria, usually proving they have been installed correctly and are operating as expected.

Verification is testing or spot-checking, often performed during qualification or validation, between mappings and calibration intervals. An example would be to verify that an SOP exists and has been approved. Another example of verification would be to check that a device had been calibrated during a qualification of a system involving sensors. 

Calibration is a separate process from validation and qualification. Calibration is a documented and controlled comparison between a measurement device and a reference standard, to determine the accuracy of the measurement device.