Russ King, Managing Partner, MethodSense

While on a recent vendor audit of a contract research organization (CRO) we observed a situation we see over and over in this industry: Our client, the sponsor, was looking for compliance within the “spirit” of the regulations. But the CRO’s understanding of regulatory obligation was much narrower and driven by a strong emphasis on “procedures” which was principally informed by ICH E6 and their experience from relatively short one to two day audits by their clients / Sponsors: The CRO was seeking to comply with the “letter” of the regulations as they interpreted them.

And there’s the rub.

Separately, strictly following the “letter” or the “spirit” of the regulations can be problematic. Put them together in a contractual environment and the risk of conflict increases.

A company seeking to follow the letter of the regulations often approaches regulatory obligation as an externally imposed necessity. The company must somehow conform to the documentation requirements because to be cited as non compliant can harm their reputation, create greater regulatory oversight, interfere with contracts and revenue generation, or worse.

Such companies easily gravitate to a narrower interpretation of regulations with a checklist mentality of obligation and the belief that if they can address the checklist items, justify them, and conform to the checklist, then they’ll get a more cost effective path to compliance and achieve auditability. But such benefits are frequently limited because a check list mentality often means either achieving too little or too much in a compliance effort.

On the one hand, checklists can create inflexible approaches that generate costs. We’ve seen many companies using software for critical functions whose strict interpretation of 21 CFR Part 11 controls suggested a checklist of user and functional requirements that far and away exceeded their development budget. They would have achieved compliance by following the checklist, but at a cost that was unnecessary and without creating any real benefits. Once they adjusted their approach to accommodate the intent of Part 11 within the context of their current circumstances, they found a cost effective development solution that added value and achieved FDA compliance.

From another perspective, checklists can produce regulatory shortcomings that generate risk. Organizations that drive their quality culture with checklists tend to have great difficulty in extending good quality practices and oversight company-wide. We’ve seen many organizations with very superficially attractive SOPs but when their operations are examined closely the reach of those SOP’s do not extend with evidentiary assurances beyond what is normally reviewed during a superficial audit. For example, validation of software systems in support of a Sponsor’s project is often the subject of short cuts which can include missing requirements that identify the products’ intended use and informal or incomplete testing intended to replace formal validation. Such short cuts are easily hidden in thick binders of documentation where accountability for validation is difficult to establish without a trained eye. The consequence is the absence of clear accountability for data integrity and, therefore, a risk to the Sponsor’s data.

At the other end of the spectrum are companies whose quality compliance vision is driven by the spirit of the regulations. Typically we see this in Sponsors and their relationships with CROs. Sponsors believe that quality should somehow be imbued into the very fabric of an organization, a belief that can often manifest itself with a Sponsor expressing a quality vision that is made up by selecting for a particular set of tasks the most rigorous relevant regulations for guidance. For CROs, it becomes difficult to meet Sponsor expectations that leave the CRO confused or with the view that the Sponsor does not have clear expectations. As a result, the CRO too often assumes the role of defining for the Sponsor the expectations that the CRO will meet.

The root causes of the conflicts between Sponsors and CROs is primarily the lack of due diligence by the Sponsor to determine the “right fit” of the CRO and the unwillingness of the CRO to understand the expectations of the Sponsor. Sponsors should always thoroughly audit their vendors as part of their vendor selection process (not as justification for their vendor choice) and the Sponsor’s regulatory affairs / quality experts should have input on the vendor contract to ensure that their regulatory expectations are a point of contractual obligation. CROs should insist on fully vetting the Sponsor’s expectations before the engagement and be clear in advance what will be accomplished or where a compromise should be made during contract fulfillment. Failure in either regard can mean a costly change of scope down the road or unacceptable project risks.

Every life science company is different and every contractual relationship between life science companies creates opportunities for improvement. Having the right intentions does not by itself create auditable best practices. Generating auditability does not necessarily imply that a company is doing the right thing.

But the life sciences industry has a much better shot at fulfilling its public mission by integrating through cooperation both the Spirit as well as the Letter of the regulations.

Russ King is Managing Partner at MethodSense, Inc.