Good manufacturing practices guide for natural health products (GUI-0158): Risk classification, CAPA process
On this page
Risk classification of NHP GMP observations
During a NHP site licence assessment or a site inspection, a Health Canada officer or inspector notes deviations from Part 3 (GMP) of the regulations as explained in this guide. These deviations appear as risk-rated GMP observations in Health Canada documents, such as information request notices and inspection exit notices, provided to regulated parties.
Purpose
Health Canada wants to ensure consistency by our:
- assessment officers during NHP site licence assessment
- new application, amendment or renewal
- inspectors during NHP site inspections
This consistency applies to:
- classifying GMP observations according to risk
- assigning an overall compliance rating to the paper review of GMP evidence or to an inspection
We also want industry to be aware of the situations we consider unacceptable and that may result in a non-compliant rating or compliance and enforcement actions or both.
This tool can also be used by your company when conducting a GMP self-inspection to proactively identify issues.
Background and scope
As part of the continuous improvement of the NHP program, we updated our risk classification tool to:
- ensure a transparent and consistent approach to evaluate GMP compliance
- align with the rest of this guide
GMP deviations can result in an NHP that is harmful to the patient, consumer or other end user. Therefore, our evaluation of a company's overall compliance with GMP considers the nature and extent of the deviations.
As the list of GMP observations in this guide is not exhaustive, additional observations may be added where appropriate.
Risk classification guide
You must follow the GMP outlined in this guide. For any observations that are noted, your QA personnel must document and take appropriate CAPA to eliminate the cause and prevent future non-compliance.
In addition to following the risk classification categories and giving examples of observations for the GMP requirements, we may use other relevant documents and information when:
- reviewing a company's compliance history
- determining risk classification and compliance and enforcement measures
Not all of the observations listed in this section of the guide may apply to all types of activities.
Risk categories
GMP observations are classified into 1 of 3 risk categories. They are based on the nature of the deviation from GMP and extent of occurrences.
Risk 1: Critical observation
- A GMP deviation that results in or is likely to result in a non-compliant product or an immediate or latent health risk
This includes an observation of:
- fraud
- product adulteration
- misrepresentation or falsification of data
- widespread cross-contamination, infestation or unsanitary conditions
Risk 2: Major observation
- A GMP deviation that may result in an observation of:
- a product that does not consistently meet its marketing authorization
- a failure to follow procedures to approve batches of products prior to sale
- a failure of the QAP to fulfil their responsibilities
Certain Risk 2 observations may be upgraded to a Risk 1 and are identified with an arrow (↑). This indicates that the site does not control its processes and operations effectively.
Risk 3: Other observations
- A GMP deviation that does not meet Risk 1 or Risk 2 criteria but is a departure from the GMP
Certain Risk 3 observations may be upgraded to a Risk 2 and are identified with an arrow (↑).
A repeated Risk 2 or Risk 3 deviation or unresolved deviations from a previous site licensing assessment or inspection may result in a higher classification.
Assigning the overall GMP compliance rating
As part of an NHP GMP assessment and inspection, we will assign:
- GMP observations a corresponding risk category
- an overall GMP compliance rating (compliant or non-compliant)
This rating is a determining factor in our site licensing decision or inspection outcome.
The risks we identify will be used to evaluate the effectiveness of your company's QA team or department in terms of their knowledge, training and ability to function independently.
Regardless of the compliance rating assigned, the company should make every effort to resolve any noted deviations in a timely manner.
Non-compliant rating
In general, a Risk 1 observation will result in a non-compliant (NC) rating. As a result, we may suspend, cancel or refuse to issue, amend or renew a site licence.
When the products present a significant health hazard, we may take appropriate enforcement action, such as requesting a recall or detaining or seizing the products.
We may also assign an NC rating in other situations, including:
- when numerous Risk 2 observations are identified indicating that the site does not control its processes and operations effectively
- when repeated Risk 2 observations are not adequately resolved
- indicates the required corrective actions following the previous assessment or inspection were not implemented
Compliant rating
We may assign a compliant (C) rating in different situations, including where we have made:
- no observations
- only a few Risk 2 observations focused on isolated issues
- only Risk 3 observations
Risk classification of GMP observations
The following lists the observations for each section of Part 3 of the regulations.
Take note:
- Text in parentheses is additional optional information that we may include in the risk observation at our discretion.
- The use of the word ‘or' indicates that the statements are related, so we may select either or both statements.
Specifications (section 44)
Risk 1 (critical) observations:
- addition of adulterants (for example, ingredients listed in the Prescription Drug List, narcotic substances or any ingredients not listed in the Natural Health Products Ingredients Database) or fraudulent replacement or mixing of medicinal or non-medicinal ingredients
- misrepresentation or falsification of testing records
Risk 2 (major) observations:
- products not assessed or tested according to their approved finished product specifications (including test methods and acceptance criteria) (↑)
- inadequate finished product specifications available for products (↑)
- finished products that do not comply with their specifications are distributed or released for sale (↑)
- modifications to testing records not documented
- inadequate scientific rationale for using quantification by input (↑)
- no review of batch records for imported products using quantification by input
- inadequate rationale or process for using reduced or rotational testing program
- inadequate testing parameters (for example, test methods, target quantities, upper and lower acceptance criteria)
- reduced testing program applied by importer without a certificate of analysis for each lot received
- reduced testing, rotational testing or quantification by input not supported by adequate documentation
- failure to ensure third-party laboratory is acceptable for intended use
- finished product specifications and any changes made to specifications are not approved and documented by the QAP
- inadequate written procedures (SOPs) related to finished product testing or specifications (↑)
Risk 3 (other) observations:
- failure to maintain a copy of the certificate of compliance when using batch certificates for imported products (↑)
Premises (section 45)
Risk 1 (critical) observations:
- inadequate segregation of raw material dispensing, manufacturing, storage or testing areas to prevent cross-contamination, with evidence of cross-contamination
- inadequate building maintenance, resulting in premises in poor condition (for example, major structural defects or damages such as holes, cracks or peeling paint) with evidence of product contamination
- inadequate pest management, resulting in premises with evidence of contaminated product, extraneous pest matter or visible signs of infestations
Risk 2 (major) observations:
- inadequate segregation of raw material dispensing, manufacturing, storage or testing areas to prevent cross-contamination (↑)
- malfunctioning of the ventilation or filtration system resulting in possible localized or occasional cross-contamination
- outlets for liquids and gases or accessory supplies (for example, steam, air, nitrogen, dust collection) not properly installed or identified
- maintenance (such as air filter replacement), periodic verification and monitoring of pressure differentials not performed, when applicable
- temperature or humidity not controlled or monitored where or when necessary (for example, conditions not monitored daily) (↑)
- light not controlled where or when necessary (for example, storage not in accordance with label requirements of the product)
- inadequate precautions to prevent temperature, humidity or light level excursions of raw, in-process or finished products
- inadequate building maintenance, resulting in premises in poor condition (for example, major structural defects or damages such as holes, cracks or peeling paint) with direct exposure to contaminant
- damage (for example, holes, cracks or peeling paint) to walls, ceilings and floors immediately adjacent to or above manufacturing areas or equipment where the product is exposed (↑)
- accumulation of dust, powder or other contaminants on hard-to-clean pipes, fixtures or ducts directly above products or manufacturing equipment
- surface finishes (floors, walls and ceilings) do not permit effective cleaning
- unsealed porous finishes (for example, on floors, walls and ceiling) in manufacturing areas that may lead to contamination (such as mildew, mould, powder from previous productions) (↑)
- insufficient manufacturing, packaging, labelling and storage space that could lead to mix-ups
- quarantine area accessible to unauthorized personnel or quarantine area not clearly marked
- insufficient precautions to prevent contamination or cross-contamination of the materials and product
- grounds around manufacturing buildings not suitably maintained
- inadequate refuse receptacles or improper waste disposal practices that may lead to contamination of the product or harbourage of pests (↑)
- doors giving direct access to exterior from manufacturing and packaging areas used by personnel during production
- inadequate measures to prevent pests from entering the premises and contaminating products
- inadequate pest control record
- inadequate written procedures (SOPs) related to the maintenance of the premises (↑)
Risk 3 (other) observations:
- unscreened and untrapped floor drains
- damage to surfaces not directly adjacent or above exposed products
- non-production activities performed in production areas
- inadequate rest or break, change, wash-up or toilet facilities
- insufficient lighting in production or inspection areas
- untidy conditions that do not permit effective cleaning
Equipment (section 46)
Risk 1 (critical) observations:
- evidence of a malfunction that could affect the quality or safety of the product
Risk 2 (major) observations:
- contamination or potential for contamination of a product by foreign materials (for example, grease, oil, rust, leaking gaskets, particles) from the equipment or utensil due to inadequate equipment or utensil maintenance, installation or use (↑)
- equipment not suitable or operating within its specifications (↑)
- inadequate provisions in place for storing or protecting clean equipment to avoid contamination (↑)
- production equipment or utensils made of porous, reactive or toxic materials, or not designed to withstand repeated cleaning, are in direct contact with materials (raw, in-process or finished product)
- inadequate covers for tanks, hoppers, or similar manufacturing equipment
- equipment location or identification may lead to cross-contamination or possible mix-ups (for operations performed in a common area)
- water system not maintained or operated to provide water of acceptable quality (↑)
- inadequate calibration program or records not maintained for automatic, mechanical, electronic or measuring equipment (↑)
- inadequate equipment preventive maintenance program or equipment is not maintained properly (for example, according to its maintenance schedule)
- inadequate equipment calibration, maintenance, usage or cleaning logs
- temperature-, humidity- or light-sensitive compartments are not controlled or inadequate records maintained, where appropriate (↑)
- inadequate written procedures (SOPs) related to the functioning, maintenance or calibration of equipment (↑)
Risk 3 (other) observations:
- insufficient distance between equipment and walls to permit proper cleaning (↑)
- base of immovable equipment not adequately sealed at points of contact
- temporary means for repairs (for example, with tape, cardboard) in use
- defective or unused equipment not removed or appropriately labelled
Personnel (section 47)
Risk 1 (critical) observations:
- individual or team responsible for the supervision of manufacturing, packaging, labelling, storing or importing (with storage or transportation) does not demonstrate adequate education, GMP knowledge or training, or does not have practical experience in their area of responsibilities
Risk 2 (major) observations
- individual or team responsible for manufacturing, packaging, labelling, storing or importing not qualified by education, training or experience to perform their respective tasks
- insufficient training (initial or ongoing) for personnel responsible for QA and manufacturing, packaging, labelling or storage operations resulting in related GMP deviations
- insufficient personnel with the necessary qualifications for QA and manufacturing, packaging, labelling or storage operations with evidence of error (↑)
- personnel using unapproved written procedures (SOPs)
- inadequate written procedures (SOPs) related to the appropriate training, education and work experience of personnel (↑)
Risk 3 (other) observations:
- inadequate training records or training is not reflective of the personnel's responsibilities (↑)
- inadequate written training program (↑)
- personnel using outdated written procedures (SOPs)
- inadequate job descriptions that outline the role and responsibilities of each position
Sanitation program (section 48)
Risk 1 (critical) observations:
- widespread accumulation of residues and extraneous matter or gross infestation, indicating inadequate cleaning
- inadequate written sanitation program in place for premises or equipment resulting in premises in an unacceptable state of cleanliness (unclean or unsanitary manufacturing, packaging, labelling or storage areas)
Risk 2 (major) observations:
- personnel with illnesses that could affect the safety or quality of a product are permitted to work around or near production materials or products (↑)
- inadequate written sanitation program (↑)
- inadequate written health and hygiene procedures
- personnel having direct contact with materials or using processing equipment and not following appropriate hygienic practices to protect products against contamination (↑)
- inadequate equipment cleaning
- inadequate written procedures (SOPs) for cleaning (including cleaning frequencies) of production or storage areas (↑)
- for shared equipment, no cleaning is performed between production runs of different products (↑)
Risk 3 (other) observations:
- inadequate equipment or facility cleaning records (↑)
- cleaning not completed as scheduled
- inadequate identification of cleaning compounds or sanitizing agents (↑)
- personnel responsible for cleaning not identified
- sporadic dust, powder or residue observed in some manufacturing areas or on equipment (↑)
- inadequate procedures for the destruction and disposal of waste materials and debris (↑)
Operations (section 49)
Risk 1 (critical) observations:
- contracting out manufacturing, packaging, labelling or storage services from a site that does not comply with the applicable GMP or does not hold a site licence
- no written procedures (SOPs) in place for the critical activities conducted at the site
- material (raw, in-process, bulk or finished) adulteration or contamination
- unsuitable treatment of raw agricultural materials that contain soil or other contaminants
- materials (raw, packaging, in-process or finished) stored under inappropriate conditions with evidence of quality deterioration or cross-contamination
- raw materials improperly identified or labelled (for example, failure to include appropriate name, description, lot number, expiry date, quality status and potency, as required) which has led to mix-ups
- presence of material not authorized for use in NHPs (for example, prescription drug, controlled drug), unless permitted under a separate licence
- use of raw materials that are beyond their shelf life without approval from the QAP or added without testing or scientific rationale
- no written master formula or master production document
- master formula or manufacturing order showing gross deviations or significant calculation errors
- inappropriate control of labels with evidence of mix-ups
Risk 2 (major) observations:
- evidence that approved procedures are not followed by personnel (↑)
- upon receipt, raw, bulk, in-process or packaging materials not held in quarantine until released by the QAP
- inadequate or inaccurate labelling of raw, bulk, in-process, or packaging materials or finished products
- no retest period or expiry date established for raw materials
- production personnel do not respect the quarantine status of raw or packaging materials
- inadequate written procedures (SOPs) for conditions of storage (including transportation) (↑)
- inadequate written procedure (SOP) for material or product receiving or sampling
- water used in manufacturing or processing not of acceptable quality (↑)
- successive attenuations completed in area other than laminar airflow workstation (applicable to homeopathic medicines)
- failure to destroy outdated or obsolete printed packaging materials and record the disposal
- certificate of analysis shows incomplete testing results (↑)
- inadequate or incomplete raw material or primary packaging specifications available for products (↑)
- each batch of raw material was not evaluated against specifications
- inadequate written master formula or master production document (↑)
- inadequate batch record, certificate of manufacture or batch certificate (↑)
- production processes not controlled
- inadequate investigations and corrective action plans pertaining to deviations, OOS testing results or complaints
- deviations or CC processes not documented or not approved by the QAP
- lack of proper identification of in-process materials resulting in a high probability of mix-ups
- inaccurate or incomplete information in manufacturing, packaging or labelling orders or procedures
- significant or unusual discrepancies observed during reconciliation of bulk product or printed packaging materials not investigated by qualified personnel prior to release
- failure to record duration (of mixing, maceration or percolation, for example) and other significant manufacturing steps as specified in the procedure, when applicable
- activities performed were not attributable to the person who performed them
- no quality agreement(s) (written agreements) with contractors
- insufficient controls in place to ensure that records cannot be deleted (↑)
- insufficient controls in place to ensure that changes made to data are tracked and justified (↑)
- activities were not documented at the time they were performed
Risk 3 (other) observations:
- inadequate written procedures (SOPs) for handling materials (↑)
- failure to establish complete and comprehensive written procedures (SOPs) (↑)
- written procedures (SOPs) not systematically reviewed on a periodic basis, do not reflect current practices or do not contain instructions or directions that are applicable to NHPs
- access to production areas not restricted to authorized personnel
- inadequate or unsigned quality agreement(s) (written agreements) with contractors
- no inspection or audit program for contractors (↑)
Operations (section 50)
Risk 2 (major) observations:
- inadequate distribution records for products (↑)
- recalled products are not identified appropriately and placed in quarantine until disposition is determined
- inadequate written procedures (SOPs) related to product recall (↑)
Risk 3 (other) observations:
- incomplete recall procedure
- incomplete list of all previous recalls
- inadequate process for recalled product reconciliation or effectiveness checks
- mock recall not performed (when applicable)
- quality agreement (written agreement) does not outline recall responsibilities
Quality assurance (section 51)
Risk 1 (critical) observations:
- no QAP who is responsible for assuring the quality of the product before it is released (made available) for sale
- individual or team responsible for QA not qualified by training, experience and technical knowledge relating to the activities conducted and GMP
- QA is not a distinct and independent function or unit, with evidence that QA decisions are overruled by other departments or management
- no testing of finished products before they are released for sale
- test results that indicate a negative impact on product quality were not documented, reported or investigated by the QAP
- misrepresented or falsified analytical samples, tests results or raw data
- information, test results or raw data used to support release were not available, deleted or destroyed
Risk 2 (major) observations:
- inadequate testing of finished product (not according to finished product specifications) (↑)
- use of materials in manufacturing, packaging, labelling or storage without prior assessment and approval by the QAP (↑)
- products made available for sale or resale without assessment and approval by the QAP (↑)
- batch or lot records, raw material test results and product label not reviewed as part of the determination to reject or approve product for distribution or sale (↑)
- product released for sale that does not comply with its product licence (↑)
- inadequate system for complaint handling or returned goods (↑)
- inadequate written procedures (SOPs) available for sampling, inspecting, testing of materials (raw, packaging, in-process or finished product) or product release, where applicable (↑)
- inadequate investigation or documentation of OOS test results, OOT test results, deviations or borderline conformance
- rework done without prior approval of the QAP
- decisions made by the QAP are not documented (includes signature or date)
- returned products unsuitable for resale are not identified, segregated or destroyed
- inadequate records maintained for returned, reprocessed, reworked or redistributed products (↑)
- inadequate written procedures (SOPs) for investigating and documenting OOS test results, OOT test results, deviations or borderline conformance (↑)
- inadequate written procedures (SOPs) for handling product complaints (↑)
- no process in place to identify and prevent the importation of product from sites not included on the site licence, with evidence of importation from these sites (↑)
Risk 3 (other) observations:
- written procedures (SOPs) for manufacturing, packaging, labelling, importing or storing products are not approved by the QAP
- incomplete or missing documentation for a written complaint
- failure to provide a written job description of the QAP
Stability period (section 52)
Risk 1 (critical) observations:
- stability data collected does not support the product shelf life
Risk 2 (major) observations:
- inadequate data (for example, real time or accelerated, number of lots) or scientific rationale or program available to establish or confirm shelf life (↑)
- stability data or records not reviewed and approved
- no action taken when data shows that product does not meet its specifications prior to the expiry date (↑)
- inadequate stability program (↑)
- no stability studies pertaining to changes in manufacturing and packaging materials, if applicable
- samples retained for stability studies are not stored under recommended storage conditions
- inadequate testing parameters (for example, test methods or specifications, upper and lower acceptance criteria) (↑)
- inadequate written procedures (SOPs) related to stability data or testing or the determination of expiry date (↑)
Risk 3 (other) observations:
- insufficient quantities retained for complete testing
- failure to follow stability procedure or protocol
Records (sections 53 to 58)
Risk 1 (critical) observations:
- evidence of falsification or misrepresentation of records (for example, release and stability testing results, manufacturing documents, sales documents)
Risk 2 (major) observations:
- documentation not readily available from site licence holder (for example, unable to access records from products that are manufactured, packaged and or labelled outside of Canada in a timely manner)
- failure to maintain master production documents at the manufacturing or importing site
- failure to maintain a listing of all ingredients contained in each lot or batch of the NHP
- failure to maintain testing records in respect of a lot or batch of raw or packaging material used in the manufacturing or packaging of the NHP
- failure to maintain testing records in respect of a lot or batch of the NHP by the manufacturer or importer
- failure to maintain a copy of the specifications for each NHP that is being manufactured or imported at the site
- failure to maintain general records demonstrating that each lot or batch of the NHP was manufactured in accordance with GMP
- failure to maintain stability data to establish or confirm the expiry date of each NHP
- failure to maintain records containing sufficient information to enable the recall of every lot or batch of the NHP that has been made available for sale (manufacturing, testing and distribution records)
- failure to maintain a list of all the NHPs that are being manufactured, packaged, labelled, imported or stored at the site
- failure to maintain a copy of the sanitation program that is in use at the site
- records not signed or dated
- incomplete records
- failure to maintain records for 1 year following the expiry date of the NHP
- records required to be maintained were not retained in a readable and readily accessible format for their required period
- records were not named and organized in a manner that allowed for adequate traceability
- inadequate written procedures (SOPs) related to the maintenance of records (↑)
Risk 3 (other) observations:
- good documentation practices not followed (↑)
- lack of version control of written procedures (SOPs) or forms
- illegible records
- inadequate electronic documentation or electronic signature system in place
Sterile NHPs (section 59) and ophthalmic use (section 60)
Note that risk classifications for sterile NHPs are based on those outlined in Risk classification guide for drug GMP observations (GUI-0023).
Risk 1 (critical) observations:
- inadequate validation of critical sterilization cycles
- water systems not validated
- evidence of water system problems such as microbial or endotoxin counts not within specifications
- no media fills performed to demonstrate the validity of aseptic filling operations
- no environmental controls or monitoring for viable microorganisms during filling for aseptically filled products
- aseptic filling operations continued following unacceptable media fill results obtained
- batches failing initial sterility test released for sale based on a second test without proper investigation
- inadequate environmental conditions for aseptic operations
- absence of leak test for ampules
Risk 2 (major) observations:
- aqueous-based products not subject to terminal steam sterilization without proper justification
- inadequate room classification for processing or filling operations (↑)
- aseptic manufacturing suites were under negative pressure compared to clean areas (C-D) (↑)
- clean areas (C-D) were under negative pressure compared to unclassified areas (↑)
- insufficient number of samples taken for environmental monitoring or inadequate sampling methods (↑)
- insufficient environmental controls or insufficient monitoring for viable microorganisms during filling for aseptically filled products (↑)
- premises and equipment not designed or maintained to minimize contamination or generation of particles (↑)
- inadequate maintenance of water systems
- inadequate re-validation of water systems after maintenance, upgrading, OOS trends
- inadequate training of personnel (↑)
- personnel involved in aseptic filling prior to completing successful media fill
- inadequate gowning practices for clean and aseptic areas
- access to sterile production areas not restricted to authorized personnel
- inadequate sanitation or disinfection program (↑)
- inadequate practices or precautions to minimize contamination or prevent mix-ups
- non-validated time lapse between cleaning, sterilization and use of components, containers and equipment
- no consideration given to bioburden prior to sterilization
- non-validated time lapse between start of manufacturing and sterilization or filtration
- inadequate program for media fill
- capability of media to grow a wide spectrum of microorganisms not demonstrated
- misinterpretation of results for media fills
- samples for sterility testing insufficient in number or not representative of the entire production run
- each sterilizer load not considered as a separate lot for sterility testing
- purified water is not used as the feed water the clean steam generator
- inadequate testing program for water system (↑)
- the water system used for the final rinsing of containers and components used for NHPs is not tested for endotoxins
- inappropriate environment or controls for crimping following aseptic filling
- inadequate inspection for particles and defects (↑)
- gases used to purge solutions or blanket products not passed through a sterilizing filter (↑)
- inadequate integrity testing of sterilizing or vent filters (↑)
- inadequate written procedures (SOPs) related to sterility (↑)
Risk 3 (other) observations:
- steam used for sterilization not monitored to assure suitable quality
- inadequate control on the maximum number of personnel present in clean and aseptic areas
Lot or batch samples (section 61)
Risk 2 (major) observations:
- failure to retain and store samples of each lot of product in its original container or in containers of the same material and construction for a period of 1 year past the expiry date of the NHP, as part of an established sample retention program
- failure to provide retained samples of finished products
- retained sample not stored under appropriate environmental conditions (as listed on the product label)
- inadequate written procedures (SOPs) related to sampling (↑)
Risk 3 (other) observations:
- insufficient quantity of samples retained for finished product testing
- quality agreement (written agreement) does not outline sample storage responsibilities
Recall reporting (section 62)
Risk 1 (critical) observations:
- misrepresented or falsified recall record(s) provided to Health Canada
Risk 2 (major) observations:
- failure to notify Health Canada within 3 days of commencing the recall and provide the information as outlined in section 62 of the regulations
Risk 3 (other) observations:
- incomplete recall information provided to Health Canada
- inadequate product reconciliation records
Compliance and enforcement
Compliance and enforcement measures by the Regulatory Operations and Enforcement Branch are based on the:
- nature of the deviations from GMP
- risks to health and safety that these deviations represent
Enforcement activities may include:
- asking for recall of NHPs
- issuing public advisories
- asking for voluntary detention, export or voluntary disposal of NHPs
- seizing NHPs
- cancelling, refusing or suspending a product licence (by the Natural and Non-prescription Health Products Directorate)
- cancelling, refusing or suspending a site licence
- issuing a stop sale request
- issuing an injunction preventing firms from selling NHPs
- prosecuting people
- having the Canada Border Services Agency refuse entry of NHPs into Canada
For more information on compliance and enforcement activities, consult:
Corrective and preventive action process
Purpose
This section will help you develop a strong CAPA process so you may be able to efficiently correct issues and ensure they will not reoccur.
It will also help you develop a comprehensive CAPA plan. A CAPA plan is used to respond to issues, deficiencies and non-compliances that could be identified by:
- personnel
- the QAP
- Health Canada
- consumers
- other sources (such as an audit)
There are also events that may trigger the need to initiate a CAPA plan:
- deviations (a written procedure is not followed)
- OOS test results
- internal findings (such as findings from a self-inspection)
This section describes:
- some of the information expected to be included in a CAPA plan
- best practices and suggestions to create a well-prepared CAPA plan
- expectations on the implementation of a CAPA plan
- the approach used by Health Canada to evaluate a CAPA plan
An issue is identified
Your QAP should have already developed and implemented a suitable CAPA process to follow. It will ensure the correct people are alerted if an issue is identified and that the steps that will need to be taken to address it are clear. This process must be part of your QA system.
Document and record
The whole CAPA process should be well documented and include a tracking system for events, to help you efficiently document and keep track of the ongoing issues.
The purpose of the CAPA process is to:
- collect information
- analyze the information
- identify and investigate product and quality problems
- take appropriate correction measures (to contain the situation immediately), corrective actions (to control a current event), and preventive actions (to prevent a problem from occurring again)
Thus, if you do not record and document every step of the process, the CAPA plan may fail at:
- dealing effectively with product and quality problems
- preventing issue reoccurrence
- preventing or minimizing GMP failures
- demonstrating due diligence was performed
Assemble a team of subject matter experts
Your CAPA process may require that you assemble a multidisciplinary team of appropriate subject matter experts (such as QA, QC, manufacturing). Such a team will be able to approach the problem from multiple angles to:
- implement immediate corrections
- investigate and conduct a root cause analysis
- evaluate the impact of the issue
- plan corrective actions and preventive actions (CAPA plan)
- put the CAPA plan into action and monitor its effectiveness
Make immediate corrections
When you identify an issue, it's important to immediately correct or contain it. A correction may involve repairing, modifying or adjusting a machine. Containment may involve putting a product lot or a machine in quarantine until you can gather more information.
Contain the issue until an investigation to identify the root causes can be conducted and corrective actions can be taken. High-risk issues require immediate correction measures to mitigate risks. You may need to use a series of short-term risk mitigation measures while long-term measures are being implemented.
Implementing a correction by itself without a broader set of corrective actions and preventive actions may not address the underlying problem. Immediate corrections will not prevent similar issues from happening again, but finding the root cause will.
Note: It's not acceptable to continue to operate under conditions that may adversely impact the quality of NHPs or the safety of consumers.
Identify the root causes
Containment and immediate corrections are usually not enough to fully address an issue. You must identify the underlying causes of GMP deficiencies to:
- determine which actions are necessary to eliminate the root cause
- prevent the issue from happening again
Identify what caused the issue. Simply concluding that the problem was caused by human error or inadequate training can lead to ineffective CAPA.
Conduct the analysis using an appropriate investigation methodology or a combination of methods. Some methods that may be used to investigate root causes are described in Table 3.
| Method | Considerations |
|---|---|
| 5 whys | Identifies root cause quickly but may not identify all root causes, especially if the issue is complex or high risk. Asking why the deficiency occurred and drilling down by asking 4 (or more) questions beginning with a “why” will help to provide insights into the root causes. |
| Fishbone diagram | Uses a fishbone diagram to identify many possible causes for an issue. This structured approach helps to sort ideas into categories such as specifications, premises, equipment, personnel, sanitation, QA, stability and records. Doing so helps to identify relationships between different causes to fully address observations (immediate corrections, corrective actions, preventive actions). |
| Pareto analysis | Used to analyze and rank identified causes to determine which cause should be addressed first. Also known as the 80-20 rule. It will help you to prioritize actions. |
Evaluate the impact
An impact evaluation will:
- ensure you have critically analyzed the breadth of the issue
- help you understand what went or may go wrong, the likelihood of occurrence and the severity of the consequences
Categories used to describe the level of impact (such as critical, major or minor, or high, medium or low) should be included in the CAPA plan. The categories should be defined in as much detail as possible.
During the impact evaluation, it's important to also consider if:
- similar issues could happen
- there might be an impact on the quality of marketed NHP lots or other products
- if yes, you should investigate the previous lots of products that could be affected and look at related trends
- the data and information used to make previous decisions is reliable
- the level of control (such as over other products, internal processes, systems or suppliers) is adequate
- other actions are required to mitigate or eliminate the identified risks and gaps
The level of action taken to address observations should be proportionate to the risk and complexity of the GMP deficiencies.
Follow a written procedure (SOP) when determining the impact of the issue and its underlying causes. The quality of the analysis depends upon the robustness of the data used to assess the impact.
This data is often subject to information gaps or unexpected variables in processing. Revisiting the impact analysis when additional information becomes available is an important aspect of sustaining quality and compliance. This can be done even after you have completed the CAPA plan.
Implement corrective and preventive actions
Corrective actions are reactive. They are taken to control an existing issue. Preventive actions are proactive. They are taken to prevent the issue or similar problems from happening in the future.
Identifying the actions as corrective or preventive makes it easier to demonstrate that the CAPA plan fully addresses the issue and any possible underlying GMP deficiencies. This is why root cause investigations and impact analyses are essential when preparing a comprehensive CAPA plan.
As an example, if there is a product impact, part of your CAPA plan may include taking the following actions:
- adapting the manufacturing process, such as:
- modification to equipment
- new cleaning process for equipment
- a recall for batches or lots already distributed in Canada or abroad, as required
Determine and record the timeline to correct issues and implement the CAPA plan. Your plan should consider the resources (time, personnel, materials) needed for effective implementation.
It is important to set reasonable implementation timelines and monitor them. If extra time is needed to implement something, a justification should be documented.
Monitor effectiveness of action plan
Once you have implemented the CAPA, you need to revisit the issue. Answer these questions:
- Have the immediate corrections, corrective actions and preventive actions worked in addressing the issues and their root causes?
- Have employees completed training relevant to the immediate corrections, corrective actions and preventive actions?
- Have the immediate corrections, corrective actions and preventive actions resulted in any negative consequences? How may these be addressed?
Investing time and effort to prepare and implement a CAPA plan may also result in operational improvements.
Closure
Before the QAP approves and closes the CAPA plan, it's important to consolidate the related records and documents from each step of the process and their outcomes. In addition to helping prepare the CAPA plan itself, this information can be used to create or modify written procedures (SOPs).
Consolidating all records and analyzing the information generated will help you meet and maintain the regulatory requirements of the regulations.
Once the records are consolidated, you should confirm that the records include:
- a description of the immediate corrections or containment steps taken
- the results of your root cause and impact analyses
- the date that the CAPA were implemented
- the effectiveness of the actions taken
CAPA plans requested by Health Canada
We may inspect sites conducting licensable activities to assess their compliance. Inspectors issue an inspection exit notice after an inspection. This notice:
- gives an inspection rating of compliant or non-compliant
- describes any GMP deficiencies and non-compliances (observations) identified during the inspection
- provides an opportunity to prepare a CAPA plan in response
- indicates the date that a written response must be provided
During the site licensing process, we may issue an information request notice. This notice:
- describes any GMP deficiencies and non-compliances (observations) identified during the assessment
- provides an opportunity to prepare a CAPA plan in response
- indicates the date that a written response must be provided
The CAPA plan is mandatory, as it's an important part of the inspection or licensing process. CAPA plans provided by the deadline are reviewed and the information in these documents are taken into consideration. Responses received after the deadline are not reviewed.
During inspections or site licensing, only a sample of the NHP products processed by your company are looked at. Therefore, the observations describe a specific situation seen or identified. It is critical that your CAPA plan address the underlying GMP deficiencies tied to the observation made and is not limited to the specific product or process identified in the notice. As an example, if an inspector identifies a product lot with an issue, you must consider the impact of the observation on all the other lots and other products that could be affected by the issue.
A CAPA plan may be under way but not fully completed at the time the written response must be provided. Nevertheless, you must provide your ongoing CAPA plan to us by the due date.
Include in the CAPA plan:
- a clear summary of the steps completed
- immediate corrections and dates these actions were taken
- a description of preliminary or completed root cause investigations and impact analysis conclusions
- plans for ongoing investigations, impact analysis and target dates
- a description of implemented corrective actions and preventive actions, including dates completed for each observation
- a description of planned corrective actions and preventive actions and target completion dates for each observation
Health Canada may ask you to demonstrate and support your actions taken with documented evidence (for example, photographs, repair bills, updated SOPs).
If the target completion date extends over a long period of time, always include a justification. It's important not to commit to target dates that are overly optimistic or do not consider the actual time needed to complete the required work. CAPA must be implemented and evaluated as soon as possible.
Some CAPA may take a long time to implement (such as building renovations). For these, you must include the short-term actions taken to mitigate risks while the long-term actions are being implemented.
We expect you to address all observations and correct and prevent any underlying GMP deficiencies. When the observations are risk-rated, the CAPA plan that you submit must include the actions taken or planned to address:
- all critical (Risk 1) and major (Risk 2) observations
- any underlying GMP deficiencies
Complete all the actions and future commitments identified in the CAPA plan, including their dates of implementation. Failure to complete actions and meet commitments, including their target dates, can lead to compliance and enforcement actions.
Target completion dates that must be extended due to unforeseen consequences should be managed through quality management processes. You should:
- have a rationale as to why you cannot meet commitments or target dates
- have an updated action plan to address the issues, including revised target dates
- put in place interim control measures to mitigate risk (with date of implementation)
You should avoid vague responses. We require enough information to understand what your plans are and the reasons for those plans. Also, we consider timelines such as “from now on”, “in the future” or “to be determined” to be too vague.