Skip to main content

Welcome to the Parexel Resource Center

Find the latest resources on regulatory, clinical development, biotech, and more. Browse our content below.

Between Scylla and Charybdis – FDA Revised Draft Guidance on CGMP Compliance for 503(B) Outsourcing Facilities

In January 2020 the Food and Drug Administration (FDA or “agency”) published the revised draft guidance Current Good Manufacturing Practice – Guidance for Human Drug Compounding Outsourcing Facilities Under Section 503B of the FD&C Act.

The FDA published the revised draft guidance based on feedback from stakeholders and comments received on the first draft guidance to reflect further consideration of how CGMP requirements should be applied to outsourcing facilities considering the size and scope of their operations.  You can find a copy of the revised draft guidance here.

The revised draft guidance presents several issues that are likely to draw scrutiny and raise more questions by the firms who are operating 503(B) outsourcing facilities. I’ll discuss five of these potential issues in this blog: (1) publishing this type of guidance in the current administration’s regulatory culture; (2) imposing new regulatory burdens; (3) blurring the distinction between outsourcing facilities and commercial manufacturers; (4) regulatory enforcement discretion; and (5) some ideas on steps industry can take.

Tension with recent executive branch policy and directives

In January 2018 the Department of Justice published a memo (commonly known as the “Brand Memo”) reaffirming a policy that the government does not regulate by guidance.  The memo prohibited the use of guidance documents, or noncompliance with guidance documents, to establish violations of law in civil enforcement actions. A copy of the press release and the “Brand Memo” can be found here.

Not content to stop with the “Brand Memo” to advance its regulatory enforcement policies, in October 2019 the administration published Executive Order 13892 Promoting the Rule of Law Through Transparency and Fairness in Civil Administrative Enforcement and Adjudication in the Federal Register.  A copy of the executive order can be found here.

The order provides that agencies are not permitted to use guidance documents to impose standards or legal consequences on parties.  The order also requires agencies to adhere to known principles of due process in administrative enforcement actions.  You can read more about the order and its potential effects on the FDA in my blog post Further Limits on The Use of Guidance for Enforcement – How Will FDA React? published previously and which you can find here.

In the revised draft guidance, FDA states that until final CGMP regulations are issued for outsourcing facilities, those facilities are subject to the CGMP regulations in 21 C.F.R. §§ 210 & 211 (see lines 23-28).  If FDA intends to use this guidance document to determine whether or not enforcement action(s) will be taken in the interim period before the CGMP regulations for outsourcing facilities are published, it is hard to reconcile that approach with the policy announced in the “Brand Memo” and the directives in the Executive Order.

New and expanding regulatory burdens

In Section I of the notice published in the Federal Register, the FDA states that the revised draft guidance includes significant revisions to address comments on the potential use of a DMF for contract laboratory testing arrangements and testing of component quality before use in compounding.  The notice can be found here.

The agency recognizes four (4) different types of Drug Master Files (DMF):

  1. Type II are used for drug substance, drug substance intermediate, and materials used in their preparation, or drug product;
  2. Type III are used for packaging materials;
  3. Type IV are used for excipients, colorants, flavors, essences, or material used in their preparation; and
  4. Type V are used for FDA-accepted reference information such as sterile process validation information or non-clinical studies for the safety evaluation of excipients.  Type I DMF, which were used for manufacturing facilities information, were discontinued in 2000.

By all appearances, the revised draft guidance does not discuss the use of a DMF and there are no further comments or discussion of the agency’s rationale in the notice. 

Had the revised draft guidance included any discussion of using a DMF in these circumstances, it would have likely triggered confusion about what type of DMF could be legitimately used since the Type I DMF has been discontinued for nearly two decades.  Even if a Type V DMF could arguably be used, creating a fit-for-purpose DMF, sending it to FDA and executing the contractual arrangements between all parties involved can be complex, time-consuming and onerous when that information could just as readily be kept on file at the outsourcing facility and available for inspection.

On page 17 of the revised draft guidance (lines 636-640), the agency states that it does not intend to take regulatory action against an outsourcing facility regarding additional testing to confirm the a supplier’s Certificate of Analysis (COA) under § 211.84(d)(2) if the outsourcing facility enters into a quality agreement with each supplier.

There are no explicit requirements in the CGMP regulations at 21 C.F.R. §§ 210 & 211 for quality agreements. 

There are alternatives available to regulated parties that enable all parties to coordinate compliance with the regulations, or a firm can choose to use a quality agreement presuming it is severable from a Master Services Agreement (MSA) that could contain confidential business information that falls outside agency inspection jurisdiction.  In this case, not only is the agency predicating enforcement decisions on the use of very highly prescriptive elements for an instrument that is outside the scope of the regulations, the agency is also arguably regulating enforcement by guidance which runs afoul of the first point discussed above.

On page 25 (line 991) of the revised draft guidance, FDA recommends that contract facilities performing testing of a drug be ISO 17025 accredited.

Adoption of voluntary public consensus standards for drug manufacturers does not waive or act as a substitute for the CGMP inspection scheme used by the agency.  Furthermore, it is unknown whether not the ISO 17025 standard would be recognized by the Center for Drug Evaluation and Research (CDER).

It is very plausible that a contract facility could meet the ISO 17025 standard and still receive an adverse FDA inspection classification (“official action indicated” or “OAI”).  The result here is that the collateral regulatory burden for contract facilities – not only the outsourcing facilities themselves – increases significantly.  These contract facilities would bear the added burden of gaining ISO 17025 certification in addition to FDA inspection readiness without any added assurance that the ISO certification would be recognized by the agency or mitigate adverse regulatory consequences.

Minimizing the distinction between outsourcing facilities and commercial manufacturers

The International Conference on Harmonization of Technical Requirements for:

  • Registration of Pharmaceuticals for Human Use (ICH) guidance Q6A Specifications: Test Procedures and Acceptance Criteria for New Drug Substances and New Drug Products: Chemical Substances was published by FDA in December 2000.  Section 1.3 of the guidance states that the guidance addresses only the marketing approval of new drug products (including combination products) and, where applicable, new drug substances… (emphasis added).  A copy of the guidance can be found here.
  • The ICH guidance M7(R1) Assessment and Control of DNA Reactive (Mutagenic) Impurities in Pharmaceuticals to Limit Potential Carcinogenic Risk was published by FDA in March 2018.  The scope of the guidance discussed in Section II is limited to providing guidance for new drug substances and new drug products during their clinical development and subsequent applications for marketing.  It also applies to post-approval submissions of marketed products, and to new marketing applications for products with a drug substance that is present in a previously approved product (emphasis added).  A copy of the guidance can be found here.
  • The ICH guidance Q1A(R2) Stability Testing of New Drug Substances and Products was published by FDA in November 2003. Section 1.2 of the guidance states that its scope only addresses the information to be submitted in registration applications for new molecular entities and associated drug products (emphasis added). A copy of the guidance can be found here.

In the Federal Register notice announcing the availability of the revised draft guidance, FDA states that the document reflects the agency’s intent to recognize the difference between outsourcing facilities and conventional drug manufacturers and to tailor CGMP requirements to the nature of the specific compounding operations conducted by outsourcing facilities.  See Section I of the notice. Likewise, the revised draft guidance states that it reflects FDA’s intent to recognize the differences between outsourcing facilities and conventional drug manufacturers (see lines 33-34).

Yet the guidance document does just the opposite by making prodigious use of citations to various ICH guidance documents that are only applicable to commercial manufacturers who are submitting marketing applications to health authorities.  These various guidance documents are also not intended to provide information on CGMP compliance issues for commercial manufacturing activities.

As a result, FDA has blurred the line – either by design or unwittingly - between outsourcing facilities and commercial manufacturers.  The result is regulatory creep for outsourcing facilities that is inconsistent with the clear intent of guidance recommendations for commercial product development and application review purposes.

The myriad cross-references to ICH guidance documents indicates that FDA is essentially treating outsourcing facilities as not significantly different than commercial manufacturers and is attempting to implement standards more similar to large-scale drug development than formulating a drug product that is tailored to the individual needs of a consumer. This defeats the purpose of “tailoring” CGMP “requirements” in a guidance document.

Enforcement discretion has limits

The Supreme Court has recognized on several occasions over many years that an agency’s decision not to prosecute or enforce, whether through civil or criminal process, is a decision generally committed to an agency’s absolute discretion. Heckler v. Chaney, 470 U.S. 821 (1985).

But in a case heard in 2019, a federal court ruled that the FDA could not delay or relax enforcement requirements mandated by the law (in this case the Tobacco Control Act.  Mem. Op., Am. Acad. of Pediatrics v. FDA, No. PWG-18-883 (D. Md. May 15, 2019).  The court noted that the Chaney case does not permit FDA to unreasonably delay for years the enforcement requirements of a statute that Congress has indicated is crucial to ensuring public health.  The court also remarked that the FDA guidance document involved in the case which described various enforcement priorities had implemented changes to the statutory process and those had legal consequences.

Here, the FDA has clearly communicated that until CGMP regulations are published for outsourcing facilities the standard required by the statute is the set of regulations found in 21 C.F.R. §§ 210 & 211.  If it takes years to create and publish those regulations to ensure that compounded drugs meet acceptable quality criteria for compliance with the Food, Drug and Cosmetic Act (FDCA) and the agency is using a series of draft guidance to implement enforcement priorities, then there could be limits to how far the enforcement discretion policy can apply.

Actions regulated industry can take

Don’t rely on enforcement discretion. Although there could be some limitations placed on FDA enforcement discretion depending on how FDA is choosing to implement a statutory program, the reality is that the FDA is given a wide berth by courts in decisions about how it uses enforcement discretion.

Add that element to the potentially risky scheme of regulating compliance enforcement by guidance and there are bound to be problems down the road.  Since the agency has been clear that until CGMP regulations are published and implemented for outsourcing facilities it will apply the commercial CGMP regulations in 21 C.F.R. §§ 210 & 211, outsourcing facilities are advised to design quality systems that will meet these standards.

Although this is a conservative position and would require more resources to design and implement, it will also provide outsourcing facilities with a greater degree of assurance that they will more likely than not avoid adverse inspection results, the subsequent enforcement and regulatory actions that can drag on for years (just have a look at the litany of woes on the FDA website for pharmacy compounding enforcement here) and build greater confidence in more robust continuity of operations and market supply without regulatory interruption.

Consider using a site master file to build the compliance framework that meets commercial CGMP regulations and prepare for inspections.  Take a page from the CGMP rules from the European union (EU) and set up a site master file.  It is a useful approach to organizing compliance information, finding gaps in quality systems and preparing for inspections, and FDA personnel may have examined these in the past during inspections of facilities that operate in the EU or domestic US facilities that need to be compliant with EU requirements.

Since the scope of compounding operations is typically expected to be less than large-scale commercial manufacturing (despite the FDA narrowing the gap between them in the revised draft guidance), the site master file should be less extensive to compile but still effective in demonstrating to the agency that the outsourcing facility has mastery in implementing CGMP controls for its products and processes. Guidance from the European Commission on site master files can be found here.

Blunt the effect of FDA referencing various ICH guidance documents by creating product quality dossiers for each compounded product that are similar in scope to the E.U. Qualified Person (QP) specification files but less extensive that Type II DMF or marketing applications.  The European Commission (E.C) defines a specification file as a reference file containing, or referring to files containing, all the information necessary to draft the detailed written instructions on processing, packaging, quality control testing, batch release and shipping of an investigational medicinal product (see the rules here).

An easy and readily recognizable way to organize this information is to adopt the structure of the Quality Overall Summary (QOS) used as part of the Common Technical Document, identifying which subject headings don’t apply and which ones need to be discussed.  The level of detail in these sections is much less extensive than in full quality section of a marketing application or Type II DMF and can be modified as necessary for a variety of products (see pp. 7-11 of this guidance document).

Similar to the site master files, these product dossiers can assist in finding gaps in knowledge or information, preparing for inspections and demonstrating to the FDA that the outsourcing facility understands the quality of its products and the control of the compounding operations that are being used to formulate and package the product.

Using a set of well-written documents to demonstrate to FDA that an outsourcing facility has an understanding of its products, their manufacturing processes and rigorous CGMP control suitable for commercial products to ensure reliable quality along with a cautious approach to the vagaries of FDA enforcement discretion should put outsourcing facilities on a sound footing to avoid protracted compliance disputes with the FDA even as CGMP compliance policy evolves.