CONVERGENCE of COMPLIANCE & TECHNOLOGY

How Technology Has Changed Regulatory Compliance in the Past Decade

MATTHEW M. LOWE ABOUT THE AUTHOR

Matthew M. Lowe, executive vice president at MasterControl, is a mechanical engineer with over fifteen years of medical device experience in product development, product management, and regulatory compliance. Prior to joining MasterControl in 2006, he worked in product development and product management at Ortho Development Corp. and Bard Access Systems. He has successfully launched more than a dozen medical devices and has four patents issued. His regulatory compliance experience includes writing a 510(k) that was cleared by the FDA and managing a multisite, multiyear post- market clinical study for orthopedic devices. He received a bachelor’s degree in mechanical engineering from University of Utah and an MBA from Indiana University.

Published by MasterControl Inc., 6330 S. 3000 E., Suite 200, Salt Lake City UT 84121 DEDICATION

Copyright © 2016 by MasterControl Inc. To my wife for supporting me in my career these many years and raising our three beautiful children to be extraordinary young people in spite of the fact that All rights reserved. No part of this book may be reproduced in any I am their father. Family is everything. form or by any means without the prior written consent of the publisher, except for brief quotes in book reviews.

The content of this book is the expression of the author’s opinions and ACKNOWLEDGMENTS do not necessarily reflect the policy or position of MasterControl. I want to recognize my editor, Cindy Fazzi, without whom this work would Publisher: Curt Porritt have never come to fruition. Her vision and encouragement was instrumental Executive Editor: Jason Clegg in bringing forth what I think is a very innovative e-book format. I would also Editor: Cindy Fazzi Art Director: Mike Hansen like to thank my many colleagues, past and present, who have shared their Cover Design, Illustrations, and Layout: Deserei Koker insights and knowledge with me over the past seventeen years. Together we Video: John Johannesmeyer can continue to shape the future of how technology enables and advances regulatory compliance.

First edition: September 2016 Published in the United States of America Contents

01 VIDEO: CONVERGENCE OF COMPLIANCE AND TECHNOLOGY 02 PREFACE

CHAPTER 1: THE RECENT PAST REVISITED 04 The Old Manual Process The MRR Bottleneck Murphy’s Law Other Life Science Companies

CHAPTER 2: THE MOVEMENT TOWARD AUTOMATION 10 The Heart of 21 CFR Part 11 How Part 11 Became a Big Deal Early Days of Automation When Compliance is Adversarial

CHAPTER 3: REGULATIONS THAT HELPED SPUR TECHNOLOGY USE 14 Compliance and Technology: Important Milestones

CHAPTER 4: NO TIME LIKE THE PRESENT 19 Approval of Novel Drugs Approval of Medical Devices Greater Onus Software Industry’s Response Evolution of Quality Software Manual Process as Part of Obstacle Course

CHAPTER 5: THE FUTURE STARTS NOW 25 Prediction versus Observation Part of the Tech Movement Future Collaboration

CHAPTER 6: PREPARE TO SUCCEED 31 How Best to Prepare

CHAPTER 7: CONCLUSION 34 Positive Regulatory Relations Software Providers as Part of Collaboration Right Place, Right Time

36 REFERENCES

01 Preface In terms of pharmaceuticals, the drug called Ivacaftor (brand name: Kayledeco) is the first medicine to treat the cause—instead of symptoms—of cystic fibrosis in patients with the G551D mutation.2 Not the stuff that Hollywood films are We live in a time of rapid change and information overload. It helps to pause made of, but incredibly important for patients suffering from the potentially fatal and ponder the state of things once in a while. In the software industry, the disease. Agile principles call for regular evaluation to sustain constant development work. In the quality field, the concept of continuous improvement is embedded Breakthroughs such as these happen, thanks in large part to faster and more in the quality management system (QMS) as a never-ending cycle of changes efficient, technology-driven clinical trials, regulatory submissions, and approval based on reviews and audits. process. I feel very fortunate to be part of this movement that advances society’s ability to deliver life-changing products to market. If you work in the My background in both medical device and software technology has instilled life science industry or a regulated environment or the compliance technology in me the value of the Agile and quality approaches to contemplation. Whether sector, then you’re part of this movement. it was implementing a rework due to a nonconformance back when I was a product development engineer at a med tech firm or helping a pharmaceutical I hope this book helps increase awareness and understanding of this common company automate its quality system in my current role, the need for path we share. This is not a history book, but just the same, it’s an opportunity assessment is the same. Reflection is necessary in order to learn, adapt, and to look back at the most important developments in the recent past that have improve. shaped regulatory compliance for life science companies.

Writing this book is an opportunity for me to do exactly that—to reflect not just on the medical device sector but the life science industry in general, as well as the software development business.

If our society were a city, then writing this book is a chance for me to offer you a snapshot of the highway where life science and technology merge in order to deliver medical solutions to the rest of the world. That on-ramp where the two merge is regulatory compliance.

Without compliance, there can be no product approval, which means no matter how cutting-edge your device or how innovative your medicine, it will not reach the people who need them. In this metaphor, the individual life science companies are the different vehicles on the highway of compliance that deliver life-changing products to the global market.

This book will explore how the use of technology in the past decade or so has helped both regulated companies and regulatory agencies in easing the pains of delivering those products to patients and consumers worldwide. Regulatory milestones enforced by the FDA helped define the book’s scope.

In the past decade, we have seen numerous breakthroughs in the life science industry. For example, the BrainGate2 Neural Interface System is in the early stage of clinical trial to test the ability of paralyzed patients to control assistive devices with their thoughts.1 While telekinesis makes for great fiction, technology-driven telekinesis by implanting a sensor in the brain might just be a The cochlear implant worn by this woman alleviates certain types of reality soon. hearing loss, one of the many med device breakthroughs.

02 03 01 THE RECENT PAST REVISITED

Life science companies face enormous scientific, economic, and regulatory challenges during development of medical products. While the growth of R&D has always been intertwined with technological advances, it has not been the case for regulatory compliance.

The watershed regulation, 21 CFR Part 11, established the criteria for the use of electronic records and electronic signatures by organizations under the jurisdiction of the U.S. Food and Drug Administration (FDA). Part 11 was controversial from the start. Critics complained it was too broad and confusing. Companies said it was too costly to implement.

Part 11 went into effect in August 1997, but it took the FDA two guidances (in 2001 and 2003) to explain the regulation’s scope and application. The 2003 guidance signaled that, at last, the FDA had embraced technology for compliance purposes. It served as a catalyst for software companies to develop compliance solutions tailored to Part 11 and for the industry to automate quality processes.

It’s no coincidence that in 2004, the Pharmaceutical Research and Manufacturers of America (PhRMA) issued the SAFE (Signatures and Authentication for Everyone) digital signature standard.

“Part 11 confirmed the dire need for improvement of processes.”

Before the advent of laws regulating the life science industry, leeches* and snake oil were sold as medicine. 04 THE OLD MANUAL PROCESS Imagine standing before a long table with an array of stamps and different colors of ink pads with your piles of documents. Perhaps you would need a blue stamp for “proposed” documents, a green stamp for “approved” and black To understand how technology revolutionized the compliance process, it’s for “released.” Talk about watermarking! You would stamp each copy with the important to put this story in the right context. Let me describe what a paper- appropriate stamp. You would then attach your documents to the CO form and based process was like when I worked in the med tech industry. submit everything to doc control, cross your fingers, and hope you didn’t miss anything. In my first job in a med device firm, I was a product development engineer (PDE). The process for getting a new drawing through the system required a If doc control took issue with anything, it would involve re-printing, revisiting the lot of time and effort. Bear with me and imagine the process we endured back table for re-stamping, and re-submitting the change packet. Are you tired yet? then. Wait, we’re not yet finished.

First, you would start with an informal redline of the paper drawing among your Once the doc control team members were satisfied, they would then consult peers (e.g., other PDEs and the manager). Once done with that, you would the signature matrix and ensure the CO form had the right signatories. The list incorporate the changes and print a new copy. You would have to print an old was often bloated—by design—as there would be several individuals on the list copy and manually go through the drawing and redline it to reflect the changes included only as a safeguard in the new proposed copy. The packet would then start to go through the signatories. Typically there would Prior to all of this, you would get a change order (CO) number from the be a round of questions and/or redlines with each of the signatories, which Document Control Department, so you could include it on your new drawing. would require changes to be made, new copies to be printed, and re-routing You would then fill out the Excel spreadsheet that served as the CO form and to any signatories who signed off prior to the change. The packet might sit on print it out. Then you would take all of that to the doc control area with a copy someone’s desk for several days, if not weeks. It might mysteriously disappear of the original, the proposed redlines, and the new drawing. for several days at a time. You just never knew.

Once you were lucky enough to get everything signed off, you might then have to hold a training for impacted parties to go over the changes and have them sign off to prove that they have been trained. Heaven forbid someone were traveling or out sick because you might have had to chase that person for several more days before the drawing could be released.

When the drawing was ready for release, doc control would keep the “official” copy and would then start replacing all of the controlled copies spread throughout the plant, including the manufacturing floor, quality control, and engineering.

The Procurement Department may also have had to send out new copies to contract manufacturers and pray that the vendor would indeed receive them and would actually build the next lot of parts, and in some cases the lot currently in process, to the new spec.

We used to have great filing cabinets with very long drawers. The Engineering, Purchasing, and Manufacturing Departments each maintained its filing cabinet. For Engineering, we kept a controlled copy there with little labels (e.g., Parts x, y, z). The person who needed a document would thumb through all fifty Dr. Élie Metchnikoff, shown in his lab, embodied the challenges of the old manual process. drawings and look for the right document, if it was there at all. He won the 1908 Nobel Prize for his research in immunology.

05 06 Doc Control had a document room where the final, controlled documents MURPHY'S LAW resided. The team held the master copy and it was responsible for changing any documents that had been revised. The problem with a manual process is Murphy’s law itself—any number of things can go wrong and they will go wrong. I recall being in the midst of This meant the other departments kept “uncontrolled” copies on electronic an FDA audit. The field investigator asked for a document that could not be servers with directory structures. Uncontrolled copies did not have the found. We could find the electronic copy stored in the FileShare, but the hard necessary signatures, unlike the master copy. For example, Purchasing might copy with the wet signatures that should have been filed with doc control was send an uncontrolled copy to show a vendor, but it was strictly for review only. missing. It could have been filed improperly, lost in the process, accidentally discarded—the perils go on and on.

THE MRR BOTTLENECK As bad as that experience was, there are worse things that could happen. What if someone accidentally puts a nonconforming product on the shelf? If the If you think the abovementioned process is cumbersome, let me remind you defective item gets out in the marketplace, you could injure a patient and face a there were other hurdles along the way. Another onerous process involved the recall. material review report (MRR). It’s also known as the nonconforming material review (NCMR) process. I remember a case in my previous life, in which customer complaints on a device were not dispositioned properly and an MDR was not filed. It was The process would typically involve a material review board (MRB) meeting a common problem with a manual process. The slip-up resulted in an FDA at least once a week (scheduled) and potentially several times a week warning letter for not filing reportable events. (unscheduled). Representatives from Quality Assurance (QA) and Quality Control (QC), an R&D engineer, manufacturing engineer, and quality engineer would attend the meeting. You can just imagine the hourly cost of these weekly meetings.

If some of the parties fail to attend, you can bet that a chase would follow to get the reviewed MRRs signed by those people. What if you have MRB members who are dispersed geographically? Perish the thought! Often an MRR would result in a rework instruction, supplier deviation, change request, supplier corrective action request (SCAR), or some other activity that would also be initiated and chased on paper.

On top of this, the folks in the Materials Department would have to be notified, so they could update the enterprise resource planning (ERP) system and quarantine the product in question. The quarantine would last until the non- conforming product could be corrected for shipment to customers. When something like this happened, Procurement and Product Management would not be able to forecast the number of units the company needed to manufacture in order to keep up with the demand—and any delays in the communication or updates could result in back orders (read: lost revenue).

Now that you’ve had a glimpse of my experience enduring the manual process, how does it compare to your experience? Perhaps you and your colleagues Regulatory compliance has come a very long way from the days when heroin was sold over the counter. share a few “battlefield” stories similar to mine, or worse.

07 08 “The problem with a manual 02 process is Murphy's law....” THE MOVEMENT TOWARD AUTOMATION

OTHER LIFE SCIENCE COMPANIES Which came first, the chicken or the egg? This dilemma applies to automation and regulatory compliance. Did the FDA issue 21 CFR Part 11 to encourage technology use? Or did life science companies use technology first, which in My story is just one example confined to a med tech firm. Pharmaceutical turn prompted the FDA to develop corresponding regulations? companies, blood centers, and other regulated companies have similar experiences with paper-based processes. It’s the latter, according to an article published in ISSA Journal. “In the days of old, pharmaceutical companies would literally ship truckloads of data to the The Institute for Transfusion Medicine (ITxM) used to have a hybrid quality- FDA,” wrote Ben Rothke. “There clearly had to be a better, faster, cheaper, and management system (part paper and part electronic), which required the easier way to move data. And indeed there was—via electronic networks.” different departments to manually route their documents for review and A group of pharmaceutical companies met with the FDA in the early 1990s approval. Those documents were stored on electronic servers, printed to find out how they could submit voluminous documents electronically. This on hard copy, and compiled in more than 250 binders. Using a modified eventually led to the development of 21 CFR Part 11.7 National Committee for Clinical Laboratory Standards (NCCLS) nomenclature, documents were tracked by their number, type, and revision number.3 It’s true that regulatory requirements impose a heavy documentation burden on life science companies—a compelling reason to automate quality and Teva Pharmaceuticals, the top developer and manufacturer of generic drugs compliance processes and regulatory submissions. in the United States, used to conduct early-morning meetings affectionately dubbed by employees as “document signature parties.” At one point, the company had 3,500 SOPs under its manual process.4

SynCardia, manufacturer of the world’s first and most widely used Total Artificial Heart, had a hybrid process that generated documents in different formats and were all hand-stamped, numbered, and hand-delivered to approvers. The company’s servers stored 1,200 files at one point, but paper documents were kept in different filing cabinets. As business grew, the company’s quality system challenges also increased, culminating in an FDA audit that compelled the organization to improve its processes through automation.5

For many years, companies endured the pains of their labor-intensive processes while trying to maintain compliance and stay competitive in the global market. The situation changed for the better by the time the second Part 11 guidance was issued in 2003.

The movement toward automation of such tedious manual quality processes began in earnest at that time. Part 11 confirmed the dire need for improvement of those processes and justified corporate spending on electronic systems. It showed executives of life science and other regulated companies that investing in automation was a wise option. Indeed software companies such as MasterControl tailored their software solutions to Part 11 requirements.6

(Left) The first X-ray shows the hand—with a ring—of Wilhelm Roentgen’s wife. He accidentally discovered X-ray in 1895. (Right) Modernization as exemplified by X-rays preceded automation in medicine.

09 10 THE HEART OF 21 CFR PART 11

The FDA issued the rule to establish criteria for the use of electronic records and electronic signatures by organizations that comply with the Food, Drug, and Cosmetic Act, the Public Health Service Act, and other FDA regulations. It applies to organizations under the agency’s jurisdiction, such as pharmaceutical, medical device, biotech, blood, and biologics companies, and contract research organizations. It took effect on August 20, 1997.8

Part 11’s overall goal is to allow the use of electronic records as much as possible and at the same time ensure public safety. In complying with Part 11, it’s important to remember the essence of the regulation—FDA’s main concern is to safeguard record integrity in order to ensure product quality. The FDA cares whether all electronic records in support of regulated activities are accurate and valid.

“The FDA felt that the risks of falsification, misinterpretation, and change without leaving evidence are higher with electronic records than paper records and therefore specific controls are required,” wrote Rothke. The journal dubbed Part 11 as both a “security” and a “trust” regulation, in the sense that Part 11 builds on security toward trust. While security controls rights and access so as to maintain confidentiality and integrity, trust aims to control the basis of denial and ensure accountability of individuals responsible for certain acts within the electronic system.9

I would add that on top of those concerns, both the FDA and the industry wanted to reduce the tremendous time and effort, plus the high cost involved in regulatory submissions and compliance.

HOW PART 11 BECAME A BIG DEAL

Part 11 is voluntary in the sense that it applies to an organization only if it chooses to adopt electronic systems for compliance purposes. In the 1990s, many companies still operated with paper-based processes and sent paper submissions to the FDA, so those organizations were excluded from Part 11 requirements.

However, it became clear that the huge amounts of artifacts required to prove compliance necessitated automation and drove companies to switch to electronic systems. Many organizations combined paper and electronic processes, making hybrid systems widespread and are still so today.

Although the FDA’s Part 11 guidance clearly states that the agency’s recommendations are nonbinding, it is not a license to ignore the regulation.

Does Part 11 have any teeth? Yes, judging by the hefty fines Abbott Laboratories and Schering-Plough paid due to a host of Current Good Manufacturing Practice (CGMP) violations, including requirements related to Part 11. Over a decade ago, the two companies entered into a consent decree with the FDA, in which Abbott agreed to pay $100 million, and Schering-Plough, $500 million in fines.10 Maurice Wilkins is shown with a model of the double helix—the basis of all DNA research—which he helped develop. Similarly, Part 11 provides a foundation for the use of electronic records in life sciences.

11 talk them through it. We presented all the data they needed. They could have The FDA made its expectations of industry compliance very clear after Part made everyone’s life easier if only they told us how they needed such data to be 11 took effect. Referring to the consent decree, an FDA official told a news presented. publication, “Manufacturers who choose to wait until FDA investigators find violations rather than policing themselves will find that they have made a very I understood the need for regulation, but often felt that I jumped through a lot of poor and costly decision.”11 hoops just for the sake of jumping, not because those requirements made my product safer or better.

EARLY DAYS OF AUTOMATION Since then, the industry and regulators have matured and our understanding of Part 11 and other quality regulations has grown with experience. More and more companies have adopted technology and automated their quality processes I have to admit that back when I worked in an R&D Department of a med and quality management systems. tech company, my colleagues and I were not familiar with Part 11. The first time I heard about it, I learned we were required to validate software as part Now I look back at those days with a lot more appreciation, a feeling similar to of our testing regimen. Validation is something we dealt with all the time in graduating from college or graduate school. Once I received that hard-earned manufacturing and design, but with the introduction of Part 11, there was an diploma, all the struggles melted away. I’ve survived the hardest part, and more added requirement of software validation. importantly, I’ve learned and succeeded.

We struggled with how to deal with Part 11 and what it meant. Like most in the industry, we used the GAMP V model, which is about risk management. GAMP (Good Automated Manufacturing Process) does not prescribe a method, but it offers a pragmatic framework of good practice to ensure that your computer “FDA's main concern is to systems are compliant.12

GAMP was meant to be used along with other industry guidelines, standards, safeguard record integrity.” and best practices to determine the best approach for validation. So, to comply with Part 11, we took those principles and applied them in software validation.

WHEN COMPLIANCE IS ADVERSARIAL

Given the laborious manual process I’ve described in the previous chapter and the advent of Part 11, which we barely understood back then, it was easy to develop a negative attitude toward compliance.

I became interested in bioengineering as a grade school pupil, back when the field was in its infancy. Its novelty made it seem almost magical to a child in second grade. To think that the body could be healed through engineering and science fascinated me, and still does today.

So when I worked as a development engineer—pursuing my longtime passion for science and devices—it was disappointing to see the development process blocked with many hindrances. My relationship with regulators back then was somewhat adversarial.

My department’s internal relationships with QA and RA personnel greatly affected my views. There were times when all I could see were the obstacles to getting my products to market. We were bombarded with demands that were tedious at best and often whimsical.

It seemed as if the other departments always moved the target on my team, showing little understanding of what presented risks and what didn’t. I often The FDA protects consumers and enhances public health. These old posters fall under felt it was easier for me to just complete a regulatory task instead of trying to the same banner of safeguarding the public from contagious diseases.

12 13 Since 2000, we have benefited from a technology- driven era in regulatory compliance. Ours is a time of faster and more effective regulatory submissions and 03 adverse-event reporting. I would like to think that things will get even more efficient in the future. REGULATIONS The following laws and initiatives have helped shape THAT HELPED SPUR the rapid modernization of regulatory compliance like TECHNOLOGY USE never before. 2010 The Physician Payments Sunshine Act was 2008 passed requiring drug and medical device The FDA launched the manufacturers that Sentinel Initiative, a national 2003 participate in U.S. federal electronic system designed health care programs The FDA issued the second to track the safety of drugs, to report payments and guidance for 21 CFR Part 11, the 2007 medical devices, and items of value they give regulation on electronic records and biologics once they reach to doctors and providers. standards. Part 11 is meant to allow Congress passed the FDA the market. The project will The reporting is done the widest possible use of electronic Amendments Act expanding be implemented in stages. electronically through the technology for FDA submissions and ClinicalTrials.gov submission As of 2016, the FDA has Open Payments Program. compliance purposes. requirements. implemented a mini-Sentinel.

2000 2004 2007 2008 In the pharmaceutical industry, The National Institutes of Health's PhRMA (Pharmaceutical The FDA enforced SPL (structured the electronic common technical National Library of Medicine Research and Manufacturers of product labeling), a Health document (eCTD) became the (NLM) launched ClinicalTrials. America) issued SAFE (Signatures Level 7 international standard standard for electronic submission gov, a database that provides and Authentication for Everyone) that defines the content of drug to the FDA’s Center for Drug easy public access to information digital signature standard for the prescriptions in XML format to Evaluation and Research (CDER) about clinical trials. It’s an global pharmaceutical, biotech, make the information accessible and the Center for Biologics offshoot of a federal law that and health care industries and readable. Evaluation and Research (CBER). required a registry of clinical trials worldwide. It is intended to Drafted under the auspices of for medicines. encourage the use of digital the International Conference signatures as part of an electronic for Harmonisation (ICH), the environment within the industry. eCTD specifies how electronic submissions should be created, reviewed, and archived.

14 15 2012

Congress created a new category of “breakthrough therapy” in the FDA Safety and Innovation Act, which became law in July 2012. 2015 The breakthrough pathway is an expedited process of review and The FDA finalized its guidance 2015 approval of new drugs for life- 2014 that required most eCTD The FDA’s Adverse threatening illnesses. This pathway is submissions to be submitted Reporting System/ in addition to three other expedited The FDA required device electronically, including new MedWatch required that approval processes already in place: manufacturers and importers drug applications (NDAs), applicants electronically priority review designation (1992), to submit mandatory reports of biologic license applications submit all MDRs, MDR fast track designation (1997), and adverse events electronically (BLAs), and investigational attachments, and periodic accelerated approval (1997). (known as eMDR). new drug applications (INDs). safety reports.

2011 2013 2014 2015

The FDA introduced the The FDA released a final rule The FDA’s 510(k) eSubmissions The FDA’s Center for Devices Innovation Pathway pilot, a establishing a unique device Pilot Program offers a pathway for and Radiological Health (CDRH), priority review program for identification (UDI) system that will the construction and submission Offices of Device Evaluation pioneering medical devices. identify medical devices through of a pre-market notification (ODE) and In Vitro Diagnostics Under this program, the FDA distribution and use. A UDI is a unique application electronically without and Radiation (OIR) participated could conduct premarket reviews numeric or alphanumeric code. the requirement of a hard copy or in the International Medical within 150 days of submission, a compact disk. It’s sometimes Device Regulators Forum's about half the time of approval called “turbo 510(k)” because (IMDRF) Regulated Product for non-priority products. it’s similar to the Turbo Tax® Submission (RPS) Pilot Program. electronic process for taxpayers. The FDA’s goal is to implement a standards-based fully electronic receipt, review, dissemination, and archival environment. The RPS is meant to harmonize electronic submission methods for pharmaceutical and medical device industries.

16 17 04 NO TIME LIKE THE PRESENT

The days of manually stamping piles of documents with different colors of ink are long gone. Most life science companies have automated their QMS to some extent, though a recent report by LNS Research shows that the majority use disparate systems.

Out of more than 900 regulated manufacturers surveyed, 78 percent relied on fragmented data sources and systems that were not connected. “Today’s prevalence of disparate solutions and strategies is not providing the visibility or level of interaction across the value chain required to maintain competitiveness in the global market,” according to the report.13

Companies using connected or closed-loop electronic QMS (EQMS) performed better in terms of these key indicators: overall equipment effectiveness, on-time and complete shipments, and successful new product launches.14

From the perspective of the industry, there has been marked progress from the old manual processes, but the use of technology for quality and compliance still has a long way to go.

APPROVAL OF NOVEL DRUGS

How has technology use in submissions and compliance affected regulators? Recent reports indicate that the FDA has approved more products in less time.

While the Center for Drug Evaluation and Research (CDER) approves hundreds of new medications every year, public attention is mostly focused on novel drugs, which are few and far between. These are the truly groundbreaking medicines that advance clinical care to a new level.

On the average, CDER has approved twenty-eight novel drugs annually since 2006. The figures have improved to forty-one approvals of novel drugs in 2014 and forty-five approvals in 2015. Out of the forty-five approved in 2015, thirty- nine (87 percent) were approved during the first cycle of review—meaning the FDA didn’t request additional information, which would have delayed approval. Twenty-nine of those drugs were approved in the United States before receiving approval in another country.15

“Also noteworthy is the efficiency with which most of these drugs were reviewed and approved. CDER used a variety of expedited development and The FDA cleared more than 15,000 devices between 2011 and 2015. The compliance process regulatory tools in an effort to speed these drugs to market,” according to the makes it possible to bring technology such as MRI to the marketplace. division’s annual report, Novel Drugs Summary 2015.16

18 19 APPROVAL OF MEDICAL DEVICES The initiatives of IMDRF20, a voluntary group of regulators, to harmonize The statistics for the FDA’s approval time for medical devices were neither international regulations pertaining to medical devices point toward global impressive nor alarming. In 510(k) submissions, the FDA cleared 3,025 devices cooperation that could be aided by technology. Greater expansion of global in 2015—lower than the number of devices cleared in 2014 (3,203), and in 2013 adverse-events reporting is another area ripe for automation. As tax dollars (3,054), according to the Emergo Group, a consulting firm for the industry.17 become more and more stretched, regulatory entities will be expected to do more with less. One of the easiest ways to achieve this is through automation In 2015, 22 percent of pre-market notification applications were cleared within and technology solutions. three months of submission (compared with 21 percent in 2014); 61 percent were cleared within six months (compared with 60 percent in 2014). The consulting firm also said only 65 percent of the 510(k) submissions in 2015 SOFTWARE INDUSTRY'S RESPONSE came from American med tech firms, down from 78 percent in 2014.18 In response to an increased demand for quality and compliance software More than 15,000 medical devices were cleared by the FDA between 2011 and solutions, providers have tailored their offerings to specific requirements and 2015 through the FDA’s Pre-Market Notification Program, also known as 510(k). standards. If you can identify a standard or a regulation—from CFR rules The figure does not include medical devices subject to Pre-Market Approval enforced by the FDA to ISO standards series and various regional and state- (PMA).19 based requirements—there is likely to be a niche software solution for it.

I joined the software industry in 2006 as a product manager at MasterControl. It GREATER ONUS was among the first companies to provide Part 11 capabilities. From the second I walked in the door, change control was a hot button. Given the wider use of electronic systems in life science companies today, regulators and standards bodies increasingly expect automation—at least to The company had established itself as a leader in the document control space some degree—in a QMS. by the time I arrived, but it still had not developed a good functionality for managing change resulting from a document change. Being able to manage In some cases, like with the eMDR and eCTD, it is even mandated. So, while and bring together all of the documentation and activities for a change in one quality requirements remain the same, the onus to comply better and faster with place and selectively trigger training was a huge problem I had faced while the help of automation is much greater today. working in the med tech sector. Our customers at MasterControl faced the same problem in 2006. If your company is just getting started, now is a better time than ever to start right and automate from the get-go. It is much easier to do this than to develop Other challenging quality areas for life science companies back then were a manual process and adapt it into software later. quality event management (the term QEM was not yet invented at the time) and corrective action and preventive action (CAPA). Companies recognize that a streamlined QMS is crucial to remaining competitive in the marketplace and staying out of trouble with regulators. I was involved in a number of initiatives to advance the company’s presence in They should expect new regulations to come out with a specific technological the product lifecycle management (PLM) realm, as well as in the development interface going forward. There may not even be a paper solution from day one of solutions for management of bill of materials (BOMs), parts, suppliers, and of a new regulation. computer-aided design (CAD) files.

Increased automation also means software validation will become more Back then, life science companies found it challenging to integrate their important in terms of business risk. Understanding what your software does enterprise applications like ERP, learning management systems (LMS), and and ensuring that your system performs exactly as expected is pivotal. manufacturing execution systems (MES) with an EQMS. During this time, MasterControl developed its capability to connect those information systems I expect to see many established regulations to turn to technology to improve and synchronize data. It also developed connections with submissions efficiency at government agencies and regulating bodies. The RPS Program, publishing tools and its own capability for eMDR submissions. meant to harmonize electronic submissions, is pushing regulators toward this direction.

The Investigational Device Exemption (IDE) submission process is an area where the right electronic tools could help accelerate approval.When the “Quality is increasingly becoming FDA and institutional review board (IRB) approve an IDE for use in clinical research, the sponsor faces a new round of requirements, including collection of informed consent from patients, monitoring of the protocols, and appropriate everyone's concern.” recording and reporting throughout the study. These are activities that could be streamlined with the help of software solutions.

20 21 EVOLUTION OF QUALITY SOFTWARE From my vantage point today, I understand better the motivations of my QA Using MasterControl as a yardstick, the software industry continues to adapt. and RA colleagues. I believe that putting the right processes in place in an Software products are evolving to connect more and more business processes and automated fashion can satisfy the demands of both compliance and speed to remain current with changing regulations. market.

Today the concept of quality has become pervasive, in the sense that the burden Today it’s easier to establish a cross-functional team approach that will allow of compliance no longer rests solely on quality and regulatory personnel. Quality is you to bridge the gaps that exist among the quality, regulatory, and product increasingly becoming everyone’s concern and compliance efforts are implemented development silos. With the right software solution, departments with seemingly throughout the enterprise. As a result, software providers have also expanded their opposing interests need not be adversarial. The right tools will allow each team products to provide functionality for a broader range of users. to apply its expertise and at the same time cooperate with each other and attain common goals together. At MasterControl, we constantly strive to simplify the user experience and make it easier for our customers to roll out and validate our products as our user base expands to non-quality areas. Our goal is to permit regulated companies with software validation restrictions to adopt software like non-regulated businesses do.

We don’t want our customers sitting on a system that is three years old because they are unable to secure the resources or monies required for re-validation. Cloud software vendors release new versions of their solution multiple times a year and often do not give their clients the option to not take the new version. This means that clients must be nimble enough to accept and validate new versions of software on a near continuous basis.

Software vendors like MasterControl can greatly help in this pursuit by providing the necessary tools and documentation to make this a reality for their clients. MasterControl has been a pioneer in this regard since the introduction of its Transfer Operational Qualification package in 2006 called MasterControl Transfer OQ™. Our delivery model continues to evolve. Today our customers can have our products on their own premises, hosted in our private cloud, or delivered through one of the mainstream public cloud vendors. This array of choices didn’t exist a decade ago.

MANUAL PROCESS AS PART OF OBSTACLE COURSE

Let me circle back to what I said in the second chapter about the seemingly adversarial compliance process. During my time as a product development engineer, the development process resembled an obstacle course, which I had to undergo even if those “obstacles” (otherwise known as regulations) did not help improve my product.

In hindsight, I can attribute my resentment to the laborious manual processes I had to endure, especially those that kept the different teams at my company stuck in their little silos. Paper-based processes were a big part of the obstacle course during product development. If there had been technology that facilitated my team’s interaction with other teams and with regulators, maybe the process would have been less bumpy. Technology also greatly facilitates the re-use of information. It could have reduced the burden I faced in recreating documents in a specific format for one regulatory body versus another. CT scans are highly accurate images that help doctors make better diagnoses. Regulatory compliance is meant to ensure such complex devices are safe.

22 23 05 THE FUTURE STARTS NOW

In life sciences, time is of essence. Product development requires tremendous investment in time, money, and effort. You simply can’t afford any delays.

On the average, it takes more than a decade to develop a new medicine and get it approved at a cost of about $2.558 billion, according to the latest research from the Tufts Center for the Study of Drug Development. “When post-approval R&D costs of $312 million are included, the full, product lifecycle cost per approved drug, on average, rises to $2.870 billion,” according to the center.21

The cost of medical device development is harder to nail down. There are no research figures similar to the Tufts annual study. However, a book by Elaine Whitmore estimated that development of a medium-risk medical device that has received clearance through the Pre-Market Notification Program requires $31 million on the average, while a high-risk device subject to the Pre-Market Approval process requires about $94 million.22 In my experience, development of a new medical device takes anywhere from eighteen months for a 510(k) product to five years for a device requiring a PMA.

The entry of Google’s Verily and Apple into medical-device development is bound to disrupt the industry and increase the already intense pressure to go to market sooner. Among other things, Verily is developing smart contact lens with glucose sensor for diabetics. The lens will measure the amount of sugar in a patient’s tears. Meanwhile, Apple is exploring ways to detect a heart attack through the sound blood makes as it flows through the arteries. Amazon might jump on the bandwagon too. Its meeting with the FDA has fueled speculation about the online-retail giant’s interest in the regulated space.23

These tech giants are accustomed to very short product lifecycles and could put slower-moving incumbents under the gun to launch their products faster. What does this mean for you and everyone else in life science product development? It means every day you fall behind your product-launch schedule is another day of additional cost and unrealized market potential. It also means you are giving your competition a chance to beat you in the marketplace.

“Smart” drugs, which use nanotechnology for effective delivery and control of side effects, behoove “smarter” compliance. 25 PREDICTION VERSUS OBSERVATION

Prediction is one of the things the brain naturally does, according to Jeff Hawkins, a neuroscience buff and founder of Palm Computing, which introduced the first handheld computer. He said prediction is the primary function of the neocortex.24 Even so, I’m not inclined to make any predictions, so I will share my observations instead.

I feel very fortunate to have been a part of the life science industry and now, the software industry serving it. Based on what I have seen from both sides of the fence, I expect the following things to happen because they are, in fact, already beginning to happen:

• Regulators will introduce more and more technology-facilitated standards and regulations. • As a result, we will see greater interaction among industry, regulators, and technology vendors. • The importance placed on software quality and validation will increase as compliance becomes more dependent on these solutions. • Security concerns will continue to rise, both from a piracy and hacking perspective and intentional misrepresentation of data and/or users. • Biometrics will be used more broadly in helping secure the data and quell concerns of misrepresentation.

THE NEED FOR SMARTER COMPLIANCE

As technology grows to be more pervasive in regulatory compliance, there are bound to be missteps. Firms are likely to be saddled with some unnecessary regulations because technology makes it “easy” to comply with them, but I think these cases will be short-lived. Today’s global economy and widespread media coverage shine a light quickly on unnecessary government bureaucracy. Regulators are also more collaborative with industry, resulting in rapid feedback cycles that help adjust interactions that are not functioning or don’t make sense.

I believe that in the future, we will see compliance get “smarter” as technology takes a greater role. Given how fast things change in the industry, any discussion about the future implies you need to get a head start now.

Even with the abundance of software solutions in the market today, many life science companies still fail to realize all the benefits of technology. It’s not so much turning a blind eye to the latest technology but refusing to adopt it properly. Even when organizations automate their QMS, many of them fail to optimize their usage because of their unwillingness to put control in the hands of those who can most effect change. Deputizing colleagues outside of the quality department to create and execute compliance-related processes can accelerate The future of medical technology includes more applications of 3-D printing in the the speed with which companies are able to get their products to market and manufacture of cell and tissue products and orthopedic, dental, and other implants.

26 27 improve compliance simultaneously. Involving the people who are going to be certain devices, such as a wheelchair or a blood pressure monitor, adding a UDI working within the processes is also much more likely to improve buy-in and marking would be simple. A tag could be etched directly on the device without compliance. affecting patient safety.

Rather than take advantage of what technology has to offer, many companies What about more complex devices such as a heart pacemaker or artificial hips shackle themselves with outmoded processes in a digital world. Going back to or other implantable devices? How would a UDI marking affect their safety? the LNS Research mentioned in Chapter 4, the majority of survey participants Under an FDA draft guidance, any direct marking that would interfere with the using disparate systems used a combination of spreadsheets, email, and some safety or effectiveness of a device that has already been approved will require a form of enterprise content management system (CMS) to connect their quality new 510(k) submission.27 activities across the value chain.25 This is an example of how innovation can bring both good news and bad news When an organization first switches from paper to electronic documents, there is for the industry, but it should be seen as inherently good over the long haul. a tendency to replicate its paper-based processes instead of adopting fully the There is much at stake for the regulated companies and their technology provid- new electronic system and automating all processes and workflows. Such was ers in the ongoing movement toward innovation, which makes smarter compli- the case when ITxM first used an automated QMS in 2005. ance and stronger partnership all the more necessary.

Patrick Farley, application administrator, said, “When we first moved from paper to electronic documents, we tried to mimic exactly what we did on paper instead of allowing the system to assist in the automation process. Ten years FUTURE COLLABORATION later, we are using every tool we can to automate as much as possible.”26 Life science companies today face largely the same compliance challenges as Replicating your manual processes may bring some advantages, such as user in 2006. The big difference is the tendency for regulators to turn to an electronic acceptance because employees are familiar with the old ways, but you lose out solution rather than manual or paper processes. We saw this in the changes in on the quantum jumps in productivity that technology can afford your company the MDR regulation domestically and abroad. Today, the FDA will only accept if you look at things through new lenses. MDRs electronically. There is no longer a paper option. This is also evident, as I mentioned earlier, in the UDI regulation, whose implementation and enforcement If this sounds familiar, take a closer look at your compliance program and requires a technologically facilitated solution from the get-go. individual quality processes. Perhaps there is opportunity there to trim some of the fat from outdated processes and for you to get to the heart of what actually If life science companies have learned their lessons from Part 11 compliance, brings value. they should have a smoother experience in any new technology-enabled regulation. It is imperative, however, that regulatory bodies show willingness to The need for smarter compliance may be sooner than you think. To succeed in collaborate with technology vendors and the firms they are trying to regulate. a fiercely competitive global market, any projection for the future ought to start If implemented correctly, technology should give regulators greater insight into now. This is the best time for you to get smarter with your technology use. the businesses they are regulating and allow them to enforce regulations more efficiently with fewer personnel.

PART OF THE TECH MOVEMENT

Being part of the life science industry or the compliance technology sector means we are instruments of the technology movement, which has resulted in a dramatic transformation in health care and regulatory landscape. However, with medical advances and new applications in pharma, med tech, and biotechnology come new safety and regulatory concerns. “Being part of the life science

For example, the FDA’s release of its UDI (unique device identification) rule in 2013 was heralded as a regulatory breakthrough. The UDI system is designed to industry means we are instruments help reduce medical errors and allow the agency and the med tech industry to address adverse events faster, including more rapid corrective actions. of the technology movement....” This is, undoubtedly, an important milestone, but one that affects requirements for med tech companies, their suppliers, CROs, and technology providers. For

28 29 06 PREPARE TO SUCCEED

If success depends on preparation, then it behooves life science companies to prepare for an even more technology-driven regulatory landscape in the future.

Global health care spending is expected to increase by 4.3 percent until 2019, according to Deloitte’s 2016 Global Life Sciences Outlook. Biotech drug sales are expected to grow from $289 billion in 2014 to $445 billion in 2019, while the market share of generic drugs is likely to jump from 27 percent ($261 billion) in 2012 to 36 percent ($421 billion) in 2017. Meanwhile, medical device revenues are expected to increase from $369 billion in 2015 to $454 billion in 2019.28

In spite of this kind of growth, many life science companies are still using outdated IT infrastructure and spending significant money to fix issues because of it, according to the Deloitte report. “For example, an infrastructure designed around an impermeable core may hamper external collaboration, an important element of open innovation in R&D,” according to the document. “From a compliance perspective, outdated IT systems may stymie efforts to meet mandatory FDA GxP requirements for pharma manufacturing and product quality.”29

One of the problems is the industry’s predilection for the tried and tested at the expense of better options. “Pharma has tended to customize IT to fit its old process/organization/installed technology base; in the process, compromising benefits realization,” the report said.

HOW BEST TO PREPARE

For all of the modernization and innovation we have seen in the past decade, speeding up the delivery of medicines, med devices, and therapies from laboratories to the marketplace remains a crucial goal for the industry today. The key to improved time to market is streamlined and standardized processes, which are best achieved through automation.

Here are some recommendations for leveraging the latest technology and developing a forward-looking orientation within your organization:

#1 Develop a cross-functional approach. A silo mentality directly affects your organization’s efficiency, not to mention morale. Remember how I felt as a PDE working with QA and RA teams? In hindsight, I can attribute the adversarial undercurrents in our relations to a silo mentality. The right software solution can Collaboration through a cross-functional approach, bridging the gap among silos, and taking help you overcome silos by facilitating a cross-functional team approach. advantage of the latest technology are all necessary to speed up time to market.

30 31 Weigh the pros and cons of buying a point solution versus an enterprise To overcome the valley of death, you must focus on your core competency and platform, factoring in your specific needs and your budget for the project. If devote your energy and resources to developing and manufacturing the best you have a pressing concern (e.g., CAPA or audit) that can be separated from vaccine or heart pump or active pharmaceutical ingredient or whatever product other QMS needs, then consider using a point solution, which will address your organization is committed to delivering to patients and consumers. Don’t the problem right away at a relatively low cost. A better option is to choose an overburden your employees with routine tasks associated with a manual enterprise platform that will allow you to implement a point solution and at the system. If you have a dozen employees whose sole responsibility is to same time enable you to add solutions in the future as your needs evolve. control documents, switch to an electronic system so you can manage your documents with fewer people and redeploy the extra manpower to other areas. #2 Bridge the gap between the quality team and the rest of your organization. Your quality team exists primarily to ensure product quality If budget is a concern, you can automate your paper-based or homegrown and compliance, a daunting responsibility that the rest of the company might electronic quality system without the upfront cost of a traditional on-premise perceive as a “police” role. The ability of the team to elicit awe and anger in system. Pick a cloud or hosted service that offers access to the same equal parts stems from non-quality personnel’s FUD—fear, uncertainty, and robust, compliant, and secure EQMS without the capital expenditure and IT doubt—when faced with quality issues. Empower your quality team with the overhead. This type of service provides rapid deployment of electronic QMS right tools, namely a robust QMS that will make it easier for other departments over the Internet. It usually includes dedicated support that covers security, to cooperate and participate in compliance. maintenance, backup, and upgrades.

#3 Make your processes transparent. Transparency is not just a buzzword in politics and business. As applied to life sciences, the concept plays a key role in compliance, in the sense of creating processes that are easily assessed and audited by regulators and customers alike. It’s impossible to be transparent with a paper-based process that requires physically digging into piles of documents. An electronic system provides a single, centralized repository of all compliance- related documents, forms, and records. It means your employees and auditors will go to only one place for all compliance-related documents they need.

#4 Increase your inspection readiness. There is a lot of wisdom in the motto, “Be prepared” or “Always prepared,” which has been adopted by many groups, from the Boy Scouts to the U.S. Coast Guard. For heavily regulated companies, what could be a more relevant admonition? It is agonizing to sit with an FDA investigator or an assessor conducting an ISO certification audit when a certain document requested is incomplete, unsigned, or worse, missing. There is no better way to make preparedness a habit than through automation.

In the most practical sense, compliance boils down to passing an audit or inspection. An FDA inspection certainly prompted SynCardia’s switch from a hybrid system to a fully automated QMS. The company has said it now “moves at light speed to meet FDA requirements,” thanks to its electronic system. In addition to complying with FDA regulations, the company also complies with the European Union’s Active Implantable Devices Directive and the Canadian Medical Devices Conformity Assessment System.30

#5 Increase your competitiveness by focusing on your core competency instead of routine. Up to 90 percent of medical products being developed fail before they ever get tested on people, according to the National Institutes of Life science companies should focus on their core competency to Health. Such failure-prone development period is known as the “valley of death.” avoid the “valley of death” in product development. It stands as a wide gap between scientific discoveries and the actual translation of those discoveries into medical treatments.31

32 33 “Technology will continue to 07 play a pivotal role in the future.” CONCLUSION SOFTWARE PROVIDERS AS PART OF COLLABORATION

I would like to add that software providers are more than willing to participate Change is inevitable, so is technological advancement. As technology evolves, in the collaborative process. Indeed current developments point us in that the regulatory landscape will also change. This book’s basic premise is that direction. For example, at MasterControl, we have increased our dialogue with technology has been good for compliance and will continue to play a pivotal role customers to address their evolving regulatory needs as soon as they are able in the future. to identify those needs instead of waiting for the “effects” of those regulations, namely problems. As I alluded to earlier, we want life science companies to be The only disadvantage that could manifest along the way is the introduction of able to adopt cloud software methodologies in spite of the Part 11 validation regulations for the sake of introducing them. They may not provide value, but challenges they face. The key to this is close collaboration with and reliance on because technology facilitates their implementation, then why not? your solution providers and taking advantage of what they can provide in terms of toolsets and artifacts to ease your validation burden. The tendency to ask for needless data simply because it’s there can increase undue burden on the regulated and regulators alike. A good question to ask If your company has yet to make a switch from a legacy system to an FDA- yourself when you ask for a new piece of data or a new view of the data is: compliant automated system, now is the best time to do it. We (life science What question are you trying to answer? If you can’t formulate the question in industry, regulators, and technology providers) have arrived at a place wherein a way that makes sense and provides value, you are likely wasting your effort in our desire and commitment to improve and speed up the process of approving collecting the data. and delivering medical products are aligned.

POSITIVE REGULATORY RELATIONS RIGHT PLACE, RIGHT TIME Judging by a recent report, life science companies and regulators (the FDA in particular) maintain a positive relationship. There was a time when I entertained the idea of going to medical school. After I completed my undergraduate degree, I mentioned it to my wife. She promptly A report by PricewaterhouseCoopers’ Health Research Institute (HRI) shows that responded, “If I wanted to marry a doctor, I would have married one who was 78 percent of life science executives surveyed said their communication with the already a doctor!” My wife is an ER nurse, so we have shared our love of health FDA has improved; 76 percent said the agency provides actionable feedback; care and the life sciences throughout our careers. and 70 percent said it offers more applicable guidance, rules, and regulations. Her reaction helped me focus on mechanical engineering. As it turned out, The study is based on a 2014 survey conducted among 100 executives from the field offered the perfect combination of studying science and applying a cross-section of life science companies. The survey focused on their views technology to improve patient outcomes. When I landed a product development about the industry’s relationship with the FDA. HRI also surveyed 1,000 job at an orthopedic company shortly after graduation, it strengthened my belief consumers on their attitudes toward the industry and the FDA as part of the that I was in the right place at the right time. I could not think of a better way to study. apply my skills and promote the betterment of the human condition. The rest, as they say, is history. The report recommended enriching the ongoing dialogue. “Skilled at utilizing the latest in science and technology to develop breakthrough therapies, What I said at the beginning of this book bears repeating. Life science pharmaceutical and life science companies will need to deploy new techniques companies, regulatory bodies, and technology providers share a common path. to strengthen their relationships with the FDA and consumer. A closer, more We are instruments in producing and delivering life-changing products to the collaborative bond among all stakeholders may create a more efficient world. We are very fortunate to be part of this movement where life sciences, development and regulatory process that leads to the next generation of compliance, and technology have converged to bring positive change. As the treatments and cures,” according to the report.32 industry continues to evolve, we would do well to strengthen our collaboration.

34 35 SE TR: 3 TE: 9 EC: 1

HEAD FOV:2 5,0th 20/02:27 256x192/2 NT/VB/ED “Change is inevitable, so is technological advancement.”

P

1 2 7

EX: 3382 SE: 4 IM: 12 OSAG: L6.5 14 Supra, “Closed-Loop Quality Management and the Cost of Inaction,” GxP Lifeline blog. References 15 From CDER’s report, “Novel Drugs Summary 2015.” 16 Supra, CDER’s report, “Novel Drugs Summary 2015.”

*Photo credit for leech jar, chapter 1, page 4: “A leech jar; Essex type” by Wellcome Images, 17 “Emergo Analysis: Fewer 510(k) Submissions from U.S. Medical Device Firms in 2015,” CC BY 4.0. Slightly modified from original. from Emergo Group’s website.

1 For more information about the BrainGate2 clinical trial, visit its clinical trial website. 18 Supra, “Emergo Analysis.”

2The FDA approved Kalydeco for the treatment of CF in patients age six years and older who 19 From Emergo Group’s website, “How Long it has Historically Taken the FDA to Clear 510(k) have the specific G551D mutation in the cystic fibrosis transmembrane regulator (CFTR) Submissions.” gene. In patients with the G551D mutation, Kalydeco helps the protein made by the CFTR gene function better and, as a result, improves lung function and other aspects of CF such as 20 International Medical Device Regulators Forum (IMDRF) was launched in 2012 as the increasing weight gain. Visit the FDA website for more information. successor to the Global Harmonization Task Force, which disbanded in the same year. For more information, visit the IMDRF’s website. 3 “ITxM Marks 10-Year Milestone of MasterControl Usage,” a case study, published by MasterControl. ITxM, based in Pittsburgh, provides blood collection services and distributes 21 Tufts CSDD at Tufts University, based in Boston, Mass., provides strategic information to more than one million blood components across the country and overseas. support drug developers, policy makers, and regulators. The statistics came from a Tufts press release, March 10, 2016. 4 Teva Pharmaceuticals automated its manual process in 2001. A case study about Teva’s experience is available here. 22 Development of FDA-Regulated Medical Products: A Translational Approach (Second Edition) by Elaine Whitmore, pages 6-7, ASQ Press, Milwaukee, Wis., 2012. 5 SynCardia’s Total Artificial Heart is an implantable system designed to assume the function The book attributed the figures to this article: “FDA Impact on Medical Technology,” by J. of a failed human heart in patients suffering from advanced heart failure. Makower, A Meer, and L. Denend, www.nvca.org, 2010. A case study about SynCardia’s switch from a hybrid to a fully automated QMS is available here. 23 “5 Trends Medical Device Companies Can’t Afford to Ignore in 2016,” a white paper by Lisa Weeks, May 2016, published by MasterControl. 6 MasterControl, founded in 1993, was among the first to provide Part 11-compliant software solutions for life science companies. 24 “How Brain Science will Change Computing,” Jeff Hawkins, TED speech, February 2003. 7 “21 CFR Part 11—The Biggest Security Regulation You’ve Never Heard of” by Ben Rothke, page 16, ISSA Journal, March 2004 edition, published by the Information Systems Security 25 Closed-Loop Quality Management: Connecting the Value Chain, page 17, published by Association. LNS Research, 2014.

8 “Guidance for Industry: Part 11 Electronic Records; Signatures—Scope and Application,” 26 Supra, note 3, “ITxM Marks 10-Year Milestone of MasterControl Usage.” from FDA website. 27 Unique Device Identification: Direct Marking of Devices—Draft Guidance for Industry and 9 Supra, note 7, “21 CFR Part 11—The Biggest Security Regulation You’ve Never Food and Drug Administration Staff, June 26, 2015, from FDA’s website. Heard of.” 28 Deloitte’s 2016 Global Life Sciences Outlook, page 4. 10 “21 CFR Part 11: How and Why to Comply,” Medical Device and Diagnostic Industry, Sept. 1, 2002. 29 Supra, page 12.

11 FDA Deputy Commissioner Lester M. Crawford was quoted in an article titled, “Schering- 30 Supra, note 5, from a case study about SynCardia’s switch from a hybrid to a fully Plough Pays Fine,” by Anne Thayer, Chemical & Engineering News, May 27, 2002. automated QMS.

12 Learn more about GAMP. View this free webinar: GAMP 5 - A Risk-based Approach to 31 Supra, note 22, Development of FDA-Regulated Medical Products: A Translational Compliant GxP Computerized Systems Approach, pages 29-30.

13 “Closed-Loop Quality Management and the Cost of Inaction,” by David R. Butcher, GxP 32 The FDA and Industry: A Recipe for Collaborating in the New Health Economy, published Lifeline blog, which cited the book, Closed-Loop Quality Management: Connecting the Value by PwC Health Research Institute, January 2015. Chain, by LNS Research.

36 37 ABOUT MASTERCONTROL

MasterControl is a committed team of quality, regulatory and software experts who work to empower regulated companies to get their products to market faster. MasterControl’s enterprise quality management software solutions (EQMS) reduce overall costs, increase efficiency and accelerate compliance, creating a significant competitive advantage for customers. Drawing upon unparalleled industry experience, MasterControl offers a suite of seamlessly integrated and scalable software solutions for quality management, document control, training management, corrective and preventive actions (CAPA), supplier management, audit management, clinical management and much more. MasterControl’s complete EQMS is designed for easy implementation, validation and use, continually improving on the promise of Compliance Accelerated. For more information, or to contact MasterControl, visit www.mastercontrol.com.

38