Guidance 040 – Periodic Review of Processes and Systems

1. Scope of the PR

Periodic Review (PR) applies to validated processes and systems.

Examples of the terminology used for critical systems include Direct Impact or critical. Periodic Review of the systems will apply according to the qualification approach used as indicated in Appendix1.

For systems, Appendix 1 provides guidance on the steps to be followed based on the approach used, how the risk assessment of systems is used, where it is documented, how the frequency of the PR is established and when the PR cycle starts.

2. Routine Process Revalidation/Requalification

Routine revalidation is only required for high risk processes (e.g. sterile/aseptic). The types of processes that are typically involved in routine revalidation include sterilization and aseptic processing (e.g. autoclaves, de-pyrogenation tunnels, steam-in-place systems, aseptic filling lines).

If Routine revalidation is required, it is typically conducted using a concurrent validation approach. The testing is executed on a preset frequency against a standardized pre-approved protocol or SOP.

If the time for routine revalidation is utilized to make changes to a process or the validated system supporting a process (e.g. change a loading pattern in an autoclave), then the revalidation should proceed in two steps. In this case, the previously validated parameters should be requalified to demonstrate the process has remained in a state of control since the previous re-qualification. Then the changes are made and the process is validated prospectively. The routine revalidation process should be based on conducting at least one validation run. The details of the tests required (for example: load configuration, container size) should be defined in the routine revalidation procedure.

3. Risk Assessment Approach

The risk assessment should include, as a minimum, an evaluation of the process/system criticality (risk to product quality and/or patient safety). In addition, evaluation of the probability of an adverse event and detectability can be used to further assess the level of quality risk associated with a process.

The risk assessment should be conducted jointly by representatives of the Quality Team and the Process Owner and other potential Subject Matter Experts(e.g., Validation/Technical Services).

4. Risk based PR for Processes

Where no significant changes have been made to the process, a PR (with evidence that the process is consistently producing product meeting its specifications) fulfills the need for revalidation.

Below are considerations for some specific types of processes:

• Sterile and sterilization processes:

For sterile and sterilization processes that are subject, due to their criticality, to routine re-qualification, periodic review is not required as the evaluation of deviations, changes and process trends are covered by the Annual Product

• Manufacturing processes:

An Annual Product Record Review is to be performed for all critical production stages or steps associated in a GMP site for API and marketed drug product. Depending on regulatory requirements in the intended drug product market, the Annual Product Record Review may include a Validation Summary. This meets the need for Periodic Review of the process.

Where there is no regulatory requirement to include validation in the Annual Product Record Review, it remains good practice to combine the Periodic Review of the manufacturing process with the Annual Product Record Review, as this already includes a review of the changes and deviations associated with the process.

• Test methods:

Test methods typically have built in controls such as system suitability tests or trending of assay standards that provide a high level of confidence in the ongoing validity of the method. In addition, a review of laboratory data and laboratory investigations / deviations and associated corrective actions is required in the Annual Product Records Review. This meets the need for periodic review.

6. Periodic Review Process

Once the processes and systems for which PR is required have been defined, the PR Process consists of documenting and reviewing information related to the given process or system It involves the internal process of collecting and evaluating information to determine if the current process or system remains in a validated/ qualified state, and is being operated in accordance with applicable cGMP regulations, site policies and procedures. The typical content that may be included in the PR is included in Appendix 1.

Where the review considers records from existing quality systems, the purpose of the review is only to verify that the quality system has been followed and, for changes, evaluate the cumulative impact.

7. PR Frequency and Scheduling

It is recommended that the frequency of PR for systems and processes be determined using a risk based approach, where there is no defined frequency for periodic review, and the periodic review is not conducted in conjunction with another review exercise (such as Annual Product Record Review). The process for determining the frequency and scheduling of PR should be defined and documented. The assignment of frequencies based on risk should be documented and approved by the site Quality Team. The risk assessment and definition of when periodic review must be initiated must be approved by the Quality Team.

For Systems:

The determination of PR frequency and scheduling should be based on the system requirements documentation and any system (e.g. System level impact Assessment,) or component level impact assessments, or Quality Risk Assessment that have been previously completed.

This determination should be conducted jointly by representatives of the site Quality Team and the System Owner and other potential Experts (e.g., Engineering/Maintenance).

As a minimum this determination assessment should include an evaluation of the system criticality.

In addition, evaluation of the probability of an adverse event and detectability can be used to provide further justification of the level of quality risk associated with a system.

Refer to Appendix 2 (I) for systems risk assessment(RA) examples to determine PR frequency.

For Processes:

The initiation of a periodic review should be clearly defined for each process, and should be based on a risk assessment. There are many considerations that need to be included, some of which are listed below:

• Criticality of the process and associated product(s) – e.g. final product, intermediate, bulk, route of administration.
• Critical quality attributes of the product that are controlled and/or monitored by the system or process without downstream verification.
• Probability of a critical parameter deviation being detected before it could reasonably affect product quality attributes.
• Use of data from the system to demonstrate compliance with a registered process, including batch record, lot release or other GMP records.
• Ability of trending system(s) being used to detect drift that may impact validation status of process
• Frequency of trend data recording and review