What a Health Canada inspector writes up in a QC lab

Most regulators keep their inspection playbook to themselves. Health Canada publishes a large part of it.

The guide is GUI-0023, the Risk classification guide for drug good manufacturing practices observations. Its appendix lists sample observations for each section of the regulations, sorted by how serious Health Canada considers them (GUI-0023, Appendix A). The guide says the list is not exhaustive. It is still the closest thing a lab has to the inspector’s notebook.

I have spent years in regulated LC-MS labs, in bioequivalence, CRO and natural health product QC work. When I read the quality control section of that appendix, most of it is about chromatography data. So this is a chromatographer’s reading of it, grouped by what each observation means at the bench.

How the risk levels work

Every observation gets one of three ratings (GUI-0023, section 3):

• Risk 1, critical: likely to result in a product with an immediate or latent health risk, or involving fraud, misrepresentation or falsification
• Risk 2, major: may result in a drug that does not consistently meet its marketing authorization
• Risk 3, other: a departure from GMP that is neither critical nor major

The overall inspection is then rated Compliant or Non-compliant. A non-compliant rating can lead to a re-inspection, and it can stop a new or amended establishment licence from being issued (POL-0004).

For a contract testing lab, Health Canada’s own GMP guide shows which sections apply to a tester: equipment, personnel, the quality control department and records, plus the testing sections where applicable (GUI-0001, Chart 1.0). Those are the sections below.

1. Data that never became the record

This is the largest group in the quality control section. All of these are major (Risk 2):

• the practice of performing trial sample injections
• trial blank or standard injections not governed by a written procedure
• activities not documented at the time they were performed
• electronic records not maintained as raw data where appropriate
• discrepancies between electronically saved data and printed records
• original records or raw data used to support release not retained
• modifications to raw data not documented
• activities not attributable to the person who performed them

They share one idea. The chromatography data system holds the record, and anything that happens on the instrument and does not reach that record is a problem, even if the reported result is correct.

Trial injections deserve their own explanation, so I wrote one: why “just checking the system” is a major observation.

2. Integration and reprocessing

Two observations sit directly in the data system (Risk 2):

• manual integration used without a written procedure or without appropriate review
• no written procedure describing when analytical data could be reprocessed

Neither bans manual integration or reprocessing. Both ask for a written rule and a review. That is the same position as FDA’s data integrity guidance, which expects the audit trail of an HPLC run to show the integration parameters and any reprocessing, with a justification (FDA, 2018, Q1c).

I have written about how to choose and write an integration rule for overlapping peaks. The inspector is asking whether that rule exists on paper.

3. What you saw and did not investigate

Also major (Risk 2):

• test results suggesting a negative impact on quality not adequately documented, reported or investigated
• atypical or unknown peaks in related substances, impurities or residual solvents not investigated, where required
• complete data for out-of-specification results not kept
• OOS results, deviations and borderline results not handled under a written procedure

The second one is worth reading twice. An extra peak in an impurity chromatogram is a finding, even when the reported impurities pass.

4. Methods, equipment and transfers

Major observations in the quality control and equipment sections include:

• test methods not validated or approved by quality control before use
• method transfer not performed, or inadequate
• for testing labs, in house or contract: no proper systems for qualifying, operating, calibrating and maintaining equipment, standards and solutions, or for record-keeping
• equipment for testing, including computerised systems, not qualified for its intended use
• no preventive maintenance programme for major equipment, or no maintenance records

For a contract lab, the validation point has a second side. Health Canada’s GMP guide says the contract tester is also responsible for test method validation, unless both parties sign an agreement that excludes it (GUI-0001, questions on contract activities).

5. People

In the personnel section (C.02.006), these are major for a tester:

• the person in charge of quality control does not hold a university degree in a science related to the work
• that person does not have enough practical experience
• QC responsibilities delegated to unqualified staff
• not enough personnel, increasing the risk of error
• training too weak, leading to GMP deviations

Inadequate training records and an insufficient written training programme are Risk 3. Note the jump: weak records are “other”, but weak training that produces deviations is “major”.

6. Who has the final word

The critical observations in the quality control section are short:

• no person in charge of quality control available on the Canadian premises
• the quality control department was not a distinct unit with true decision-making power
• production or management overruled quality control decisions
• samples, test results or raw data misrepresented or fabricated
• deleted or destroyed records used to support release

In a large company these are about organisation charts. In a lab of six people, where the owner may also run the instruments and talk to every client, they are about one question: can the person responsible for quality say no, and does that “no” stand?

A short self-check

If you run or manage a QC or contract testing lab, these are the questions I would ask from this list:

1. Is every injection on the instrument in the data system, and reviewed?
2. Is there a written rule for manual integration, and one for reprocessing?
3. Is every unexpected peak either explained or investigated?
4. Are the CDS and the instruments qualified, with maintenance records?
5. Does the person in charge of QC have the degree, the experience, and the authority?

Sources

• Health Canada. Risk classification guide for drug good manufacturing practices observations (GUI-0023), Appendix A, sections C.02.005, C.02.006, C.02.013–C.02.015 and C.02.020–C.02.024.
• Health Canada. Good manufacturing practices guide for drug products (GUI-0001), version 9, 2020: Chart 1.0 and the questions on contract activities.
• Health Canada. Drug GMP and establishment licensing enforcement directive (POL-0004).
• US FDA. Data integrity and compliance with drug CGMP: questions and answers, 2018.

Everything here is from Health Canada’s published guidance; it is not advice on any specific inspection. If you want a second pair of eyes on how your lab handles any of these points before an inspector does, tell me on LinkedIn which one worries you most.