cGMP Violations: Beware Complacency

Sept. 17, 2007
Are companies adequately following cGMPs? This article examines some recent FDA 483s and Warning Letters and provides a compliance level index.

On June 12, 1992, the United States filed action against Barr Laboratories, alleging that the company had violated sections 331(a) and 351(a) (2) (B) of the Food, Drug, and Cosmetic Act (FDCA). Specifically, the company was accused of violating Current Good Manufacturing Practice (cGMP) regulations, including 21 CFR Part 210, cGMP in Manufacturing, Processing, Packing, or Holding of Drugs; General and 21 CFR Part 211, cGMP for Finished Pharmaceuticals. Barr Laboratories failed to validate equipment-cleaning processes and conduct failure investigations, and staff released several batches using selective data.

More than 15 years later, those same cGMP violations still occur in the drug industry. In fact, several drug companies have been cited with FDA 483s and Warning Letters. Whereas 483s document violations to FDA’s Code of Federal Regulations, Warning Letters reiterate those violations and serve as a legal threat to an organization. The following is an overview of cGMP violation trends in the industry:

  • Insufficient standard operating procedures (SOPs) and documentation. Companies often lack SOPs and associated forms for internal processes. FDA requires manufacturers to have documented procedures for their processes, expecting that they will exercise control over their respective business processes. However, in recent cases some SOPs were found lacking, or employees failed to follow them, resulting in process inconsistency.
  • Underqualified personnel (particularly software vendors) performing sensitive functions. Too often, software developers are charged with writing the validation deliverables of a drug-related software application. In many cases, the documents that result fail to ensure that a software application has been tested for its intended use. FDA requires a system to be tested against predetermined specifications, and if unqualified personnel are authoring umbrella-type validation documents, the specifications may be incorrect.
  • Insufficient external training for employees. Many companies are focusing on in-house training and don’t send employees to outside training conferences. Although internal training is essential, external conferences provide an industry perspective on select topics and can be used to further document an employee’s qualifications.

Here are some specific cGMP violations documented in the last 18 months. What follows are highlights of violations as well as the “Gregor Index” (see below).

21 CFR Part 211.100 [B]

Written Procedures; Deviations

Violations of this rule involve drug firms’ failure to document deviations, implement a standard operating procedure (SOP) governing deviations, document within a deviation SOP the criteria that must be met for a deviation, and obtain Quality Assurance (QA) approval. These cGMP violations are common, as projects often move faster than compliance. In some cases, management will endorse “planned deviations” in order to accommodate a project timeline. Planned deviations undercut project quality and can lead to adulterated product if a firm is not careful about how it uses them. Unplanned deviations pose risks to a project and/or product and must be carefully documented, reviewed, and approved by all relevant parties, including an independent QA unit.

SEC.211.25 [A]
Personnel Qualifications

Violations of this statute include failure of drug firms to: document training of personnel and consultants; train personnel and consultants on current SOPs before they are required to perform tasks governed by those SOPs; and train their employees in cGMPs.

Conducting and documenting training is essential for drug makers, but most fail to document their training appropriately. Sometimes training is conducted, but the integrity of the training records is poor. It is important for drug firms to identify and document what training is required for employee’s job function, then to conduct that training and document it.

The Gregor Index tracks the compliance level of an FDA-regulated industry, as it pertains to the three main areas of compliance, Good Manufacturing Practices (GMP), Good Laboratory Practices (GLP) and Good Clinical Practices (GCP). The points scale is based on a proprietary calculation that considers 483s and 483s that led to Warning Letters.

For the many companies that use an electronic application to deliver training and store training records, it is vital to validate that application. This is important to data integrity, as it ensures that the intended functionality and security are in place. Lastly, manufacturers must validate against the applicable part of 21 CFR Part 11 if they are using the application to conduct the training or store its output.

Production Record Review

Under this regulation, one drug firm was cited for: “Failure to thoroughly review any unexplained discrepancy and the failure of a batch or any of its components to meet any of its specifications, whether or not the batch has been already distributed. The investigation of a complaint submitted by a customer on 8/11/06 regarding a possible reaction of two dogs to Pyrantel Pamoate Suspension Canine-2X (4.54 mg / mL), Lot [redacted], was not thoroughly and/or completely documented. The assay of the product returned by the customer found 142.7% of label claim.

The letter to the customer says the higher assay value indicates that the bottle was not shaken well. However, there is no documentation of the receipt and examination of the returned sample. In addition, the report of the investigation of the complaint does not indicate that the batch record, process validation data or stability information was reviewed as part of the investigation.”

Drug makers continue to struggle with assessing unexplained discrepancies or failures of a batch or its components. The previously mentioned company did not produce any documentation of the receipt and examination of the returned sample, nor did it document the review of the batch record, process validation data or stability information. It is imperative for any drug manufacturer not only to document the SOP that governs investigation reviews, but also to document the investigations per established procedures.

Responsibilities of QC Unit

In violation of this statute, a drug firm failed to “establish and follow written responsibilities and procedures applicable to the quality control (QC) unit [21 CFR 211.22(d)].” When drug manufacturers fail to follow their own SOPs, they also neglect to document that failure. This spells disaster, as it communicates to outside parties – such as FDA investigators – that a company does not have control over its own processes and procedures. Lack of process control typically leads to adulterated product.

If those sorts of regulatory repercussions don’t sufficiently motivate manufacturers to attack and eliminate these problems, consider the fact that failure to establish, follow and document SOPs can easily result in adulterated product going out the door – into the hands of physicians and consumers. The consequences of that could include product recalls, patient injury or death, litigation, lost sales and lasting damage to a company’s reputation.

All drug manufacturers should perform an annual review of their SOPs to ensure that they are being followed and that there are documented procedures for each process. I suggest that companies prioritize their procedures and review of high-risk procedures first, then work their way down to less critical procedures.


It is important to remember that there can be a significant impact on patient safety if SOPs are not established and followed. After all, isn’t ensuring patient safety the foundation of our business?

About the Author

Michael Gregor is president of Compliance Gurus, West Newbury, Mass. Readers may call him at 1-800-381-6859 or e-mail him at mgregor@

About the Author

Michael Gregor | Compliance Gurus