Ltd. Novacyl (Thailand)

Novacyl (Thailand), Ltd.
Product: active pharmaceutical ingredients (APIs)
Date: 2/27/2015

3. Failure to prevent unauthorized access or changes to data and to provide adequate controls to prevent omission of data.

The inadequate controls over access to your data raise questions about the authenticity and reliability of your data and the quality of the APIs you produce.
Specifically,

a. Your firm did not have proper controls in place to prevent the unauthorized manipulation of your laboratory?s raw electronic data. Your HPLC computer software lacked active audit trail functions to record changes to analytical methods, including information on original methodology, the identity of the person making the change, and the date of the change. In addition, your laboratory systems did not have access controls to prevent deletion or alteration of raw data. During the inspection, your analysts demonstrated that they were given inappropriate user permissions to delete HPLC data files.

b. Moreover, the gas chromatograph (GC) computer software lacked password protection allowing uncontrolled full access to all employees.

Your response states that you commit to upgrading your HPLC systems to have audit trails and your GC system to have password protection by July 31, 2014. However, your response lacks sufficient detail of the systems and controls you will implement. Simply turning on audit trail functions is inadequate. In addition, you failed to review historical data to ensure the quality of your products distributed to the US market.

In response to this letter, provide specific details about the comprehensive controls in place to ensure the integrity of electronic raw data generated by all computerized systems during the manufacture and testing of your drugs. Your response should demonstrate an understanding of your processes and the appropriate controls needed for each stage of manufacturing and testing that generates electronic raw data. Your response should also describe the controls and procedures you will implement to retain and archive the raw data you generate.

FDA District Office: CDRH

About the author

Amy enjoys researching and writing about developments in medical technology and how that intersects with US law. She received her J.D. from the University of Florida Levin College of Law in 2020 and now works as a Regulatory Associate for SoftwareCPR®, a general-purpose regulatory consulting firm that is recognized globally for their expertise with standards and national regulations pertaining to medical device, mobile medical app, and HealthIT software.

Remote Webmeeting Assessments

SoftwareCPR can provide remote offsite assessments to support virtual offices.  Our consultants can utilize webmeeting tools to walk your teams through assessments such as:

  • 62304 compliance
  • Regulatory submission pre-review
  • Software risk analysis
  • Cybersecurity process and validation
  • Overall ISO 14971 risk management
  • Overview of software regulation with John Murray

Email office@softwarecpr.com
for more info!

Corporate Office

15148 Springview St
Tampa, FL 33624
USA
+1-781-721-2921
Partners located in the US (CA, FL, MA, MN) and Italy.