Pharmaceuticals, Biotechnology, Food & Beverage, Cosmetics are considered as highly regulated industries.
The pharmaceutical, biotechnology, food & beverage, and cosmetics industries are strictly regulated globally to ensure health, product safety and quality. The life cycle of the products is monitored by the corresponding authorities:
- United States: Pharmaceuticals & Biotechnology are monitored by the U.S. Food and Drug Administration (FDA). Food & Beverage: Food safety and labeling are overseen by the FDA and USDA. In the USA, the FDA regulates the sector under the Modernization of Cosmetics Regulation Act (MoCRA).
- Europe: The European Medicines Agency (EMA) coordinates scientific evaluations, while national agencies enforce compliance. In the EU, compliance is mandated by the EU Cosmetics Regulation (EC 1223/2009).
- Globally: Pharmaceuticals & Biotechnology standards are aligned by the International Council for Harmonisation (ICH). Global food standards are guided by the Codex Alimentarius (FAO/WHO). Manufacturing quality in the cosmetic industry is globally standardized via ISO 22716 (Cosmetics GMP).
Across all four sectors, strict quality guidelines must be met and data integrity frameworks is legally required to assure quality standards and requirements are met.
Data Integrity must be given throughout the process of testing, producing, packaging, distribution and monitoring of medicines.
But why is this so important?
Because the medicines (of course food and cosmetics as well) have direct impact on our health – here I must add that drugs for animals are also produced in regulated environment, thus same quality standards are mandatory. On average, it takes 10 to 15 years for a new medicine to travel from initial discovery to the commercial market. During the production high standards for purity and quality are implemented. Every single manufacturer must keep complete record of his production cycle – no matter if on paper or over an Electronic Batch Record (EBR) – thus he can verify that all quality standards were met during the production. If inspection at his production site is done, the manufacturer must verify that all steps during the production were complete correctly – this can be verified based on his production record – on paper or digital. This production records must not have gaps – the data must be complete -> Data Integrity.
Another Example: Let us imagine that somebody discovers that particular medicine is corrupted and it does not meet the required standards (this medicine was already approved for the market) – an immediate highly coordinated, legally mandated emergency response designed to protect public health is triggered.
If a batch is corrupted, manufacturers must rely on the Electronic Batch Record (EBR) or paper logs. If the data has absolute integrity, the company can look at the logs and say: “The temperature spike happened exactly at 2:14 PM on Tuesday during Batch X.” This allows them to recall only Batch X instead of pulling millions of safe drugs off the market, avoiding massive drug shortages.
Here I must note that this is a very simple example – usually deviation during the production (like out-of-range temperature) must be detected and recorder during the production (Batch Record) and inspected by the quality team.
Data integrity refers to the overall accuracy, completeness, and reliability of data. It ensures that data remains unaltered, uncorrupted, and trustworthy from the moment it is generated, through its storage and processing, until its eventual archived or deleted (usually data must be stored for period between 15 and 20 years).
In highly regulated industries (like pharmaceuticals, biotech, food, and cosmetics), data integrity is not just a best practice – it is a strict legal requirement. If data loses its integrity, the safety and quality of the product is no longer given.
What I know about the Data Integrity (in digital environment) is that it can be described by three main fundamental components:
- Physical Integrity: Protecting the physical data against disasters, power outages, or hardware failures. This involves secure servers, robust backups, redundant systems, and durable storage media.
- System Integrity: Protecting data from human error, unauthorized access, or software bugs. This is achieved through user access controls, validation checks, automatic system logging, audit trails, protocolling.
- Regulatory Integrity (ALCOA+): Making sure the data tells the absolute truth about a process. This means knowing who entered the data, when they did it, and ensuring that no data was deleted, hidden, or backdated, that it is readable, understandable and error free.
Which components should be included in an automated control system in order to assure Data Integrity?
Audit Trail
“Audit trails are particularly important where the user is permitted to create, modify, or delete regulated records during normal operation.”
(Guidance for Industry Part 11 – Scope and Application, FDA, 2003)
- All changes and entries of relevant data made by the operator during ongoing operation are logged in an audit trail.
- The required events and information (old value, new value, user ID, date and time stamp, and justification if necessary) are recorded in the archive.
- It must be possible to print the audit trail.
Data Archiving
- Continuous Archiving
- Messages, alarms, measured values, etc., are continuously stored in system-native archives – locally.
- These locally archived data can be automatically transferred to a long-term archive.
- Process data (essentially process values, alarms, and messages) are stored without the operator having the ability to make changes.
- The system protects the data against manipulation.
- The archive data can be retrieved throughout the entire retention period.
- Batch-Oriented Archiving
- Messages, alarms, measured values, etc., are archived on a batch-oriented basis.
- These locally archived data can be automatically transferred to a long-term archive.
- Process data (essentially process values, alarms, and messages) are stored without the operator having the ability to make changes.
- The system protects the data against manipulation.
- The archive data can be retrieved throughout the entire retention period.
Electronic Signature
- Usually used in connection with the batch management system
- What needs to be signed (e.g., batch release)
- Persons / groups required to sign
- Sequence of signatures, if required
Logging / Reporting
- For a required proof of quality, it is defined which production data are relevant for output in a report. A report can contain messages and alarms, recipe data, as well as process values in tabular or trend curve form.
- All batch-relevant records are documented in a batch report, including operator interventions and electronic signatures.
- The batch reports can be saved, for example, in PDF file format.
- The batch applications offer no operator options to modify these data.
- The batch reports can be archived and printed as many times as required.
Configuration Control / Configuration Management
- Changes in the batch system
- Versioning of recipes, formulas, etc.
- It is documented with a time/date stamp who edited the recipe and who approved it.
- Changes in the engineering system
- Changes in the automation system
- Changes to the installed system software
- Project archiving
User Management, System Access
- Users must strictly be granted only the required access rights.
- Centralized user management (creation, deactivation, blocking, unlocking, assignment to user groups) by the administrator.
- Use of a unique user identification (User ID) in combination with a password.
- Definition of access permissions for user groups.
- Access and authorization level depending on the specific plant/system area.
Backup, Restore, Disaster Recovery
- The ability to backup, restore, and archive data on any computer platform is essential to preserve the integrity of the information contained within these systems in the event of system failures.
- The loss of critical parts of the IT infrastructure and business applications can have a significant impact on the business of a regulated company.
- With correct/appropriate engineering and configuration of an automation system, an uptime of nearly 100% can be achieved.
Cyber Security
- The increasing interconnection of production and office networks in the course of IT-OT integration and the use of the Internet of Things offer industrial companies many advantages, but this also increases the risk of cyber threats.
- Cybercriminals operate highly professionally and regularly record successes by exploiting vulnerabilities.
- Data can be deleted, manipulated, or stolen.
- Cyber security measures in modern automation systems ensure that data, know-how, and plants are protected at all times.
Sources:
Guidance on good manufacturing practice and good distribution practice: Questions and answers
