Continuous Compliance: Efficient Implementation of Regulatory Requirements and Industry Standards

Even testing laboratories are not exempt from strict controls and must implement appropriate quality management systems in their operations. (Source: DarkoStojanovic / pixabay.com)

Even testing laboratories are not exempt from strict controls and must implement appropriate quality management systems in their operations. (Source: mwooten / pixabay.com)

Even testing laboratories are not exempt from strict controls and must implement appropriate quality management systems in their operations. (Source: Philippdelavie / pixabay.com)

GxP guidelines and ISO standards have been accompanying companies in the healthcare and supply industry for many years. The primary goal is always the safety of patients and consumers. This requires a high standard of quality and complete traceability. Increasingly, the focus is on data integrity. Through this, companies and laboratories are obliged to establish a continuously monitored quality assurance system. Implementation is checked both internally and through inspections by recognized auditors and authorities. During this process, the need for improvements may become apparent, and the necessary measures must be implemented during ongoing operations. However, many companies postpone this step until the next inspection is announced. The consequences are well known. If critical measures are not initiated in time, this can, in the worst case, lead to the revocation of accreditation or GxP certification. A well-thought-out concept of a consistently practiced quality assurance system allows problems to be identified early and resolved, thereby saving time, costs, and stress.

Whether a company manufactures artificial heart valves (ISO 13485), produces medication (GMP), collects preclinical data (GLP), or determines laboratory values from medical or environmental tests (ISO 15189 or 17025), it is guided by legal and industrial standards. The focus is always on patient or consumer safety.

The premise sounds surprisingly simple. Companies comply with legal and industrial quality management standards, monitor and improve their processes, and demonstrate the functionality and effectiveness of their quality system during regular inspections by authorized authorities. Ultimately, a patient can trust this control system.

We could all be this patient. But we also know that every system has vulnerabilities, which can be due to cost reductions or minimalism. The establishment of control mechanisms to identify potential sources of errors is therefore a cross-cutting requirement of relevant regulations. Still, companies often hesitate to implement continuous improvement measures. The fear is that overregulation will make them unable to act. Improvement measures are often only taken when the next surveillance audit is announced. With significant resource expenditure—personnel and often financial—failures from recent times are quickly made up for. Such an approach costs money and nerves and carries risks. Unthoughtfully implemented processes are often inefficient and ineffective. As a result, acceptance of the quality management system among staff declines.

If during a surveillance inspection, due to insufficient measures, the company is found to have major or serious non-conformities with relevant guidelines and standards, this can lead to suspension or revocation of the conformity certificate or accreditation.
Nevertheless, there is a great reluctance to deal with continuous conformity systems.

Continuous conformity systems require good planning

Quality assurance is an integral part of quality management systems and thus a tool within the management system of any laboratory or company. Yet, quality assurance is often seen as a counterpoint to the production process rather than as a management tool. Some budget managers may view maintaining conformity as a stumbling block for the production process, even though internal processes have often been inefficient from the start.

How investment backlog in compliance can hinder a company is illustrated by the following example. Since 2014, the pharmaceutical IT compliance sector has evolved dynamically. This has resulted in, for example, requirements for controlling electronic data and assessing risks to data integrity. The potential consequences for patient safety can be particularly significant here. Electronic data are based on mutable and thus manipulable data sets. At the beginning of this development phase, it was still possible to argue for working with paper raw data as the primary documentation medium, despite using computer-assisted systems. This way, issues like "audit trail" could only be superficially documented. In 2018, our team was presented with this argument again during a mock audit prior to an inspection by a company. We found that for years no internal measures had been taken to maintain IT compliance, and topics like change control, CAPA (Corrective and Preventive Actions), and risk assessment had been neglected. A regulation that was meant to give companies time to integrate handling electronic raw data into their workflows was misused as a reason to halt innovation. What happened in the months leading up to the inspection can be summarized under the term "resolution of regulatory innovation backlog." The financial effort increased significantly during this period. A continuous adjustment of processes to changing regulatory requirements over the past years could have mostly been done with internal resources. Ultimately, the inspection was passed with flying colors—we hope that the operational costs of the task force actions under "lessons learned" have been documented.

Improvements and innovations always mean additional work in the short term. However, this can be integrated into ongoing workflows through targeted use of project management tools. It is important that participation in the improvement process becomes routine for every employee. This way, innovations are no longer seen as a burden but as a positive contribution to the company's future. This requires an open and uninhibited communication structure. The management and quality assurance personnel play a central role here. Employees must be actively involved in shaping the quality management system to benefit from their detailed knowledge and to ensure feasibility. This can help prevent overregulation and the associated fear of improvement processes. However, this requires a certain basic attitude from all involved. Depending on the company, a cultural change may be necessary. Without the willingness of top management to implement this, it will not work.

Regulatory oversight as part of the process

Regardless of the quality management system, consistent adherence to this approach offers the long-term possibility of keeping the effort for improvement measures manageable. Routine shortens the preparation phase for each new project. This saves time, resources, and costs. The effort to examine the system for weaknesses before regulatory inspections is reduced and can be completely eliminated in the best case. The overall monitoring process then is no longer a hurdle but just another link in the continuous conformity process.