GMP stands for good manufacturing practices. GAMP is good automated manufacturing practices. All manufacturing endeavors benefit from attention to quality, but this is especially important when the product is pharmaceutical. As a literal matter of life and death, following GMP for pharmaceutical manufacturing is not just good sense, but also the law.
However, it's not always obvious where to start. Here are seven things you should know about GMP.
1. The FDA Sets the Rules
That's the federal Food and Drug Administration, which is a government agency funded by taxpayers, and charged with protecting and promoting public health. The FDA publicly publishes official guidance, and these guidelines have the force of law. Violating FDA guidelines bear criminal consequences.
2. ISPE is the Go-To for Guidelines
The International Society of Pharmaceutical Engineers is the foremost authority on how to achieve FDA regulations. One does not have to follow ISPE recommendations to achieve good manufacturing practices, but one of the most straightforward ways to guarantee FDA compliance is to follow ISPE recommendations. ISPE publishes these guidelines in print and on the web for a thorough variety of applications. Time saved vs. time spent developing and refining an original solution easily covers the cost of these publications.
3. There is No "Best" Practice
There is no "best" because every application is different. Federal guidelines are open-ended and emphasize responsibility, ownership, and traceability. The guidelines aren't step-by-step, but the approach that a company develops to meet them should be.
4. GAMP = User Accounts & Audit Trail
There are no specific programming practices required by the FDA. General, good practice is recommended -- like separation of concerns, using comments to explain the "why" of the code, using appropriate architectures like state machines, etc.
The only specific requirements relate to Electronic Records -- e.g., recipe databases or process data archives. The FDA guidance document CFR Part 11 describes electronic records requirements.
The key to compliance is: limit access, track all changes, and attribute all changes to certain users.
To accomplish this, the general approach is to limit all edit-access to only users with accounts. Accounts must be associated with a user's full name, and users must not share accounts. All changes are timestamped and bear the identity of the person who made the change; that's their "e-signature". The original record is always saved somewhere, and never destroyed -- that's the "audit trail" part.
Siemens, Rockwell, and other PLC/HMI providers have whole suites of built-in features for CFR Part 11 compliance.
5. The C Stands for Current
cGMP stands for current good manufacturing practices. "Current" is important, because the cutting-edge way to do something 5 years ago may now be obsolete. It's important to keep evaluating your process to make sure it meets current good practice.
6. You Don't Have to Reinvent the Wheel
Implementing GMP can be quite the undertaking, so there's lots of room for agencies and companies to provide a value add. When considering a solution, it's good to know that you can buy:
- Consulting services - Some companies will provide both expertise and labor to get your manufacturing process up, running, and compliant
- Requirements tracking - Some of these are explicitly for GMP, others are more generic, but these softwares take a lot of the headache out of managing requirements and traceability for large projects (more on that below)
- Audit trail & e-signature software - When it comes to automation and digital data storage, the key to compliance is a data audit trail with an electronic signature, as mentioned in item 4 above. Turning on audit trail with a checkbox or two is a significant value add over building the functionality in-house.
7. Documentation is Key
Documentation helps to unite an effort across stakeholders and across time.
When there are multiple stakeholders, the documentation serves as a central reference for what was required, and how it was accomplished. These teams may be in different parts of the world, but by writing down and confirming all assumptions and requirements, everyone can be on the same page (pun intended).
It takes months to implement a process that may run for years, so a more robust record is required than memory. Documentation takes effort, but it decreases future uncertainty. When an auditor asks how something is done, one can confidently say, "Here's the written procedure. It was completed on this date by this person."
Documentation is such a crucial part of the process that it received its own blog post, here!
Ultimately, the purpose of good manufacturing practices -- and good anything practices (aka GxP) -- is to promote safety and health through attention to quality.
Do you still have burning questions about GMP? Looking for an integration or software partner who's keen on quality? Let us know in the comments, or contact us!