The New KYSS Principle: Know Your Supplier's Supplier

This article introduces the KYSS principle to align a robust supplier management program with regulatory requirements and includes initial identification and qualification of suppliers, supplier quality agreements and both initial and ongoing supplier monitoring.

Introduction

Deaths, illnesses, injuries and many recalls have been attributed to fraudulent, counterfeit or adulterated components of finished pharmaceuticals and medical devices.¹ These tragic consequences have been attributed to a wide range of supplier poor practices, including intentional, (often economically motivated) adulteration somewhere along the supply chain. Because supply chain processes in today's industry may be convoluted and complex, it is important to know the full supply chain, which means invoking the KYSS principle—Know Your Supplier's Supplier.

Pharmaceuticals and medical device sponsoring companies, as well as application holders, have the final responsibility for product safety, efficacy and quality. This responsibility extends to the components and materials used in their production and monitored through a preventive and systemic approach to supply chain integrity, product safety and quality. Just as sponsor companies build quality into the manufacturing of their products and implement effective preventive measures at their facility, assuring the implementation of such measures at their suppliers' facilities is paramount to safety and success.

Because quality cannot be inspected or tested into materials, inspection and testing upon material receipt is simply not sufficient. Reframing the product safety perspective from focusing on the "material" to "supplier" is an important first step toward designing a robust supplier management program; one built to ensure initial suitability and managed to ensure ongoing quality.

While existing laws, regulations and guidance may vary across pharmaceutical and medical device sectors, the principles and best practices of a robust supplier management program are universal.^2-10 The "Four Foundational Pillars" upon which such a program can be built are explained below.

Foundational Pillar #1: Initial Identification and Qualification of a Supplier

Perhaps the most important and strongest of the four pillars is the initial identification and qualification of a supplier. Suppliers should be selected based on their ability to consistently produce and provide materials meeting specifications and with the desired quality attributes. Consistent with reframing the view from material to supplier, assessment of a supplier's quality system, operational infrastructure, management team and quality culture will serve as better capability indicators than reliance on initial production samples.

Supplier identification and qualification takes time and effort. Robust planning, realistic timelines and a cross-functional view are most important when selecting "the right supplier." Recognizing business needs, e.g., material costs, cannot be ignored; however, the cross-functional view will include, but should not be driven by, the purchasing/procurement group.

Not all suppliers present equal risk to product safety and quality or to business needs. As such, the level of supervision should be proportionate to the potential risk posed by the individual materials. A risk assessment process is certainly appropriate to determine the level of effort necessary to initially qualify a supplier. For suppliers of materials incorporated into the finished product or those with an impact on the safety, effectiveness or quality of the finished product, the level of effort must be high, commensurate with the risk posed. Whenever possible, supplier redundancy should be sought, as sole-source suppliers also present a high product and business risk.

It is in just such cases of high risk suppliers, the new KYSS principle should be considered. Additionally, audits at the supplier's site should include review of their supplier management program, document management system and alignment to FDA requirements to ensure adequate qualification and management of the supplier. When international suppliers are identified and qualified, additional business and quality risks are introduced. Such risks include, for example, challenges in prompt oversight, the potential impact of health authority inspections, and additional time and controls required due to the longer duration from shipment to receipt.

Foundational Pillar #2: Supplier Quality Agreement

A "quality agreement" is a comprehensive, written agreement defining and establishing the obligations and responsibilities of the quality units of each party involved in contract manufacturing of drugs subject to cGMP. In general, the quality agreement should clarify which of the cGMP activities are to be carried out by each party per the applicable regulations, and may document aspects of production, testing, control, handling, labelling, packaging and distribution, complaints recalls and rejection procedures. For high-risk suppliers, including sole suppliers, the quality agreement may include a cooperative approach to certain elements of compliance, such as process validation^11,12 whereby the owner may need to work hand-in-hand with the supplier in process validation activities.

A well-drafted quality agreement uses clear language to define key quality and regulatory roles and responsibilities, establishes communication expectations, provides key points of contact for both parties, specifies what products and/or services the contracted facility will provide to or for the owner and establishes who has final approval for various activities. The quality agreement may include specific, measurable quality requirements suppliers must meet and for which they will be evaluated and held accountable. From a cGMP perspective, the most critical elements of a quality agreement are the sections delineating the parties' respective responsibilities and the discussion of change controls. Change control is critical. The owner and contracted facility should agree upon and document in the quality agreement the types of changes for which owner review and approval must be obtained before implementation. Those changes should be implemented with notification only.

Foundational Pillar #3: Initial Monitoring of Supplier

Upon selecting a new supplier or receiving new material from an existing supplier, establishing an initial monitoring plan is essential to help affirm the supplier qualification process and to serve as a monitor of material quality. Again, the type and extent of monitoring and control to be exercised should be based on risk and the type of materials supplied (for example, active substances and excipients). The procedures established to implement an initial monitoring plan should be robust and continue as long as needed to build confidence in supply chain traceability; through the defined inspections (by the holder of the manufacturing authorization or through an entity acting upon his behalf), tests and other verification tools.  It is necessary to confirm raw materials, components and other received product conform to all approved specifications and comply with both relevant good manufacturing practice and good distribution practice requirements. Consideration to potential cross-contamination from other materials on-site should be assessed during an initial supplier audit. For critical materials, including excipients, the risks presented to the quality, safety and function of each excipient, from its source to the finished dosage form, should be evaluated as part of a risk profile. Pre-defined acceptance criteria for the initial monitoring plan should be established within the procedures.

Re-establishing the initial monitoring plan also may be appropriate after certain changes are made to material specifications, to production operations or as discussed further below as part of a dynamic supplier monitoring program.

Foundational Pillar #4: Ongoing Monitoring of Supplier

Upon successfully meeting the criteria of the initial monitoring plan, it becomes appropriate to transition to the 'ongoing monitoring plan.' A critical feature of the ongoing monitoring plan is its dynamic nature: it adjusts and evolves as additional data and information becomes available.  Sometimes, quality agreements also can be appended based on currently followed practices and any FDA requirement changes affecting the agreement.

The ongoing monitoring plan encompasses a combination of ongoing acceptance activities of received materials along with ongoing supplier assessment activities that ordinarily include periodic, on-site audits. Audits ensure maintenance of standards and continued use of an approved supply chain, review of key quality metrics, questionnaires, compliance with quality agreement provisions, responsiveness to requested corrective actions and awareness of issues associated with the supplier, including organizational, procedural or technical/process changes. Such issues may involve other materials; materials supplied to 'sister' companies, available business intelligence or health authority oversight.

The dynamic nature of the ongoing monitoring plan is influenced by its ability to detect and review these various sources of quality data and manage the reaction through the interconnectivity of quality systems. For example, if a health authority inspection at a supplier's facility results in an adverse outcome, such as a warning letter, your quality system should be poised to react. Awareness of the issue should be raised and documented through appropriate communication channels and according the requirements of the quality agreement. An initial containment action should be considered while the impact of the issue becomes fully understood. Ongoing acceptance activities (such as restoring the initial monitoring plan) should be considered for adjustment. Evidence of corrective and preventive action should be received and evaluated, perhaps supported by for-cause audits, to restore confidence and revert back to ongoing monitoring. It is essential to fully document the issues, the planned response and the outcome.

Conclusion

While 'keeping it simple' isn't always realistic in today's long, complex supply chain process, building a robust supplier management program upon these four foundational pillars supports manufacturers' responsibility, aligns with regulatory requirements and represents universal best practices.

References

1. Marucheck, A, Greis, N, Mena, C, and Cai, L. "Product Safety and Security in the Global Supply Chain: Issues, Challenges and Research Opportunities. Journal of Operations Management. 29 (2011) 707–720.
2. FDA Enforcement Reports. FDA website. http://www.fda.gov/Safety/Recalls/EnforcementReports/default.htm. Accessed 10 May 2016.
3. ICH Quality Guidelines. Pharmaceutical Quality Systems (Q10). ICH website. http://www.ich.org/products/guidelines/quality/article/quality-guidelines.html. Accessed 10 May 2016.
4. Code of Federal Regulations (CFR) Title 21 Part 211. Current Good Manufacturing Practice for Finished Pharmaceuticals http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?cfrpart=211. Accessed 10 May 2016.
5. Guidance for Industry. Contract Manufacturing Arrangements for Drugs: Quality Agreements. Draft Guidance. May 2013. FDA website.  http://www.fda.gov/downloads/drugs/guidancecomplianceregulatoryinformation/guidances/ucm353925.pdf. Accessed 10 May 2016.
6. Guidelines on the Formalized Risk Assessment for Ascertaining the Appropriate Good Manufacturing Practice for Excipients of Medicinal Products for Human Use. Official Journal of the European Union. 2015/C 95/02. 19 March 2015.
7. Eudralex Volume 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use. Part 1 Chapter 5: Production. 13 August 2014.
8. Federal Register. October 1996. Volume 61, Number 195. Medical Devices; Current Good Manufacturing Practice (CGMP) Final Rule; Quality System Regulation. FDA website. http://www.fda.gov/medicaldevices/deviceregulationandguidance/postmarketrequirements/qualitysystemsregulations/ucm230127.htm. Accessed 10 May 2016.
9. Code of Federal Regulations (CFR) Title 21 Part 820. Quality System Regulation.  http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/cfrsearch.cfm?cfrpart=820&showfr=1. Accessed 10 May 2016.
10. Global Harmonization Task Force 2008 Supplier Control Guidance. http://www.imdrf.org/docs/ghtf/final/sg4/technical-docs/ghtf-sg4-n84-2010-guidelines-for-auditing-qms-part-5-control-of-suppliers-100827.doc. Accessed 10 May 2016.
11. FDA Guidance for Industry, Process Validation General Principles and Practices, Revision 1. January 2011.
12. EMA Guideline on Process Validation for Finished Products Information and Data to be Provided in Regulatory Submissions. 27 February 2014. EMA/CHMP/CVMP/QWP/BWP/70278/2012-Rev1.

About the Authors

Anthony Newcombe, PhD, is principal consultant at PAREXEL Consulting. Newcombe has extensive knowledge and experience of the biopharmaceutical development lifecycle across a broad range of products, including monoclonal antibodies, recombinant proteins, biosimilars and vaccines. Prior to joining PAREXEL, Newcombe held senior leadership positions within industry as head of process and product validation, global industrial operations, GlaxoSmithKline Biologicals and as a member of the technical leadership team at Pfizer Biotechnology Ireland. He can be contacted at [email protected].

David Elder is vice president at PAREXEL Consulting. After a career spanning more than 23 years with the US FDA, Elder joined PAREXEL International in January 2012. He is an expert in FDA field operations, including domestic and international inspections and investigations, product recalls, enforcement actions, and imports and has a thorough and pragmatic understanding of agency law, regulations, policies and procedures. He served as a senior agency executive in the Office of Regulatory Affairs (director, Office of Regional Operations and director, Office of Enforcement) and served 15 years as an investigator, compliance officer and director of compliance at the district office level. He can be contacted at [email protected].

Cite as: Newcombe, A and Elder, D. "The New KYSS Principle: Know Your Supplier's Supplier." Regulatory Focus. June 2016. Regulatory Affairs Professionals Society.