Novacyl (Thailand), Ltd.
Product: active pharmaceutical ingredients (APIs)
Date: 2/27/2015
3. Failure to prevent unauthorized access or changes to data and to provide adequate controls to prevent omission of data.
The inadequate controls over access to your data raise questions about the authenticity and reliability of your data and the quality of the APIs you produce.
Specifically,
a. Your firm did not have proper controls in place to prevent the unauthorized manipulation of your laboratory?s raw electronic data. Your HPLC computer software lacked active audit trail functions to record changes to analytical methods, including information on original methodology, the identity of the person making the change, and the date of the change. In addition, your laboratory systems did not have access controls to prevent deletion or alteration of raw data. During the inspection, your analysts demonstrated that they were given inappropriate user permissions to delete HPLC data files.
b. Moreover, the gas chromatograph (GC) computer software lacked password protection allowing uncontrolled full access to all employees.
Your response states that you commit to upgrading your HPLC systems to have audit trails and your GC system to have password protection by July 31, 2014. However, your response lacks sufficient detail of the systems and controls you will implement. Simply turning on audit trail functions is inadequate. In addition, you failed to review historical data to ensure the quality of your products distributed to the US market.
In response to this letter, provide specific details about the comprehensive controls in place to ensure the integrity of electronic raw data generated by all computerized systems during the manufacture and testing of your drugs. Your response should demonstrate an understanding of your processes and the appropriate controls needed for each stage of manufacturing and testing that generates electronic raw data. Your response should also describe the controls and procedures you will implement to retain and archive the raw data you generate.
FDA District Office: CDRH
