Audit Risks and Legal Exposure Management for Small and Mid-Size Companies: What to Prioritize

Context

Effective management of audit risks and legal exposure is crucial for small and mid-size pharmaceutical and biotech companies, particularly when dealing with controlled substances. Regulatory frameworks governing controlled substances compliance, such as the Controlled Substances Act (CSA) in the US and corresponding regulations in the EU and UK, impose stringent requirements that can affect product development and market access.

This manual will provide an in-depth overview of relevant regulations, guidelines, and agency expectations regarding audit risks and legal exposure management for controlled substances compliance. It aims to equip Regulatory Affairs (RA) professionals, CMC teams, and Labelling professionals with the necessary knowledge to navigate these complexities.

Legal/Regulatory Basis

The legal foundation for controlled substances compliance lies in both national and international regulations. Key to understanding these requirements is the following:

• US Regulations: In the United States, controlled substances are regulated under the Controlled Substances Act (CSA), codified in Title 21 of the United States Code (USC). The CSA categorizes controlled substances into five schedules based on their potential for abuse and medical application.
• EU Regulations: In the European Union, the regulation of controlled substances falls under various directives and regulations, including Regulation (EC) No 111/2005 and Directive 2001/83/EC. These frameworks ensure that controlled substances are manufactured, handled, and distributed in compliance with EU standards.
• UK Regulations: Following Brexit, the UK has established its own regulatory framework for controlled substances, aligned with the Society for the Protection of Animals (SPA) and the Misuse of Drugs Act 1971. The UK government has issued specific guidance on the handling and compliance of controlled substances.

Documentation

Proper documentation is essential in managing audit risks and legal exposure related to controlled substances compliance. Key documentation types include:

• Standard Operating Procedures (SOPs): SOPs must be developed and maintained for all operations involving controlled substances. These should outline detailed processes for handling, storage, transportation, and disposal, as well as training protocols for personnel.
• Licensing and Permits: Maintaining up-to-date licensing and permits is critical. Companies must ensure that they have the necessary federal, state, and local licenses to manufacture and distribute controlled substances.
• Audit Trails: An effective auditing system should provide a clear and comprehensive audit trail, documenting every step in the lifecycle of controlled substances from procurement to patient administration.
• Training Records: All employees involved with controlled substances should undergo rigorous training, and documentation of this training must be maintained to demonstrate compliance and a culture of safety.

Review/Approval Flow

The review and approval flow for controlled substances compliance involves several critical stages:

1. Pre-Submission Preparation: Before submitting applications or variations, companies should conduct a thorough internal audit to identify potential compliance gaps and document any necessary changes. This step is crucial for minimizing issues during agency review.
2. Submission Process: When preparing submissions, consider whether a new application or a variation is warranted. Typically, a new application is required for pharmaceutical products that introduce new controlled substances, while a variation might be appropriate for changes in formulation or manufacturing processes.
3. Agency Review: Regulatory agencies, such as the FDA, EMA, and MHRA, have specific review processes for controlled substances. Key agency expectations include transparent communication, timely responses to queries, and readiness to provide supplementary information.
4. Post-Approval Monitoring: After approval, ongoing compliance monitoring is essential. This includes tracking any changes in drug schedules and ensuring continued adherence to all regulatory requirements relating to manufacturing, storage, and distribution.

Common Deficiencies

Regulatory agencies often observe common deficiencies in audit risks and legal exposure management among companies dealing with controlled substances:

• Inadequate Documentation: Failing to maintain current and accurate documentation can lead to significant compliance issues and legal exposure.
• Lack of Compliance Awareness: Personnel not adequately informed about controlled substances regulations or lacking appropriate training can jeopardize business operations.
• Poor Communication with Regulatory Authorities: Delays in communication or insufficient responses to agency inquiries can lead to approval delays and potential rejections.
• Failure to Adapt to Regulatory Changes: Regulatory frameworks are continually evolving. Companies must remain vigilant about changes and adjust their processes accordingly.

RA-Specific Decision Points

When managing controlled substances compliance, several key decision points are pivotal:

When to File as Variation vs. New Application

Determining whether to submit a variation or a new application hinges on the nature of the changes being proposed. Consider the following:

• Variation: A variation can be filed when changes are made to an already approved product, such as modifications in manufacturing site, process adjustments, or minor changes in the formulation that do not impact the substance’s schedule or mechanism of action.
• New Application: A new application is required when introducing a new controlled substance or significantly changing the drug’s formulation, manufacturing process, or indications that could affect regulatory classification.

How to Justify Bridging Data

Justifying bridging data is often necessary when new data is not available for a modified product. Companies must:

• Clearly outline any scientific rationale that supports the bridging. This could include evidence from prior studies, pharmacological data, or data from similar products.
• Provide comparative analyses to demonstrate that the new and previous formulations have similar pharmacokinetic profiles and safety profiles, thus ensuring patient safety and product efficacy.
• Engage with regulatory authorities proactively before submission to discuss data requirements and expectations to pre-emptively address potential concerns regarding bridging data.

Practical Tips for Documentation and Compliance

Effective audit risks and legal exposure management can significantly mitigate compliance issues. Here are several practical tips:

• Conduct Regular Internal Audits: Regularly assess compliance with controlled substances regulations to identify gaps and areas for improvement before external audits occur.
• Establish a Cross-Functional Compliance Team: Formation of a team that includes members from RA, Quality Assurance (QA), Clinical, and Commercial ensures a holistic view of compliance issues and effective resolution strategies.
• Utilize Digital Compliance Solutions: Adopt electronic systems for document control and compliance tracking to improve efficiency and accuracy in managing regulatory documentation.
• Engage with Regulatory Authorities Early: Establishing a proactive dialogue with regulatory agencies can provide clarity around compliance expectations and facilitate smoother approval processes.

Conclusion

Audit risks and legal exposure management for small and mid-size pharmaceutical companies dealing with controlled substances is a multifaceted challenge requiring diligence and thorough understanding of regulatory frameworks. By adhering to established legal and regulatory bases, ensuring proper documentation, and establishing a robust review and approval flow, companies can significantly reduce the risk of compliance violations and associated legal repercussions.

Effective communication with regulatory authorities and thorough preparation for audits are key components in navigating the complex landscape of controlled substances compliance. By prioritizing these areas, companies can strengthen their operational resilience and maintain adherence to critical regulatory standards.