Are the UK light years ahead on data integrity?

Background 

The MHRA published their document, ‘GXP Data Integrity Guidance and Definitions’ on 09 March 2018 with the intent of providing ‘confidence in the quality and the integrity of the data generated and be able to reconstruct activities’.1 The document was followed by the development – initiated and led by the UK – of the advisory document from the OECD. Over three years later, on 20 September 2021, OECD published their advisory document no. 22 on ‘GLP Data Integrity’2. 

In the MHRA blog published on 27 September 2021, the inspectorate confirmed the OECD Advisory Document takes precedence over their document due to the UK membership of the OECD Mutual Acceptance of Data (MAD). It further states that their document was always meant to sit alongside additional regulatory guidance and that there are no plans to revise the MHRA document at this time.  

Where does that leave interested parties in the UK who are now required to comply with both? Are there major differences between the two sets of requirements, is there overlap and/or contradictions, and what additional considerations might be necessary? Does the time gap of more than three years between the documents and the UK lead on the OECD document mean that the UK is pioneering data integrity? Are we boldly going where no one has gone before? This article hopes to bring some clarity on the impact the duplication of requirements might have on existing processes and to discuss the UK’s exploration of data integrity practices. 

Differences 

The first major difference is immediately clear in the titles of both documents. While the MHRA document covers all GxP (GCP, GDP, GLP, GMP, and GPvP) disciplines, the OECD document is restricted only to GLP activities and immediately states within the first paragraph that ‘the fundamental purpose of GLP is to ensure the quality and integrity of test data related to non-clinical safety studies’.2 Since the OCED focuses on regulations regarding to GLP (for the context in use here) this is not unprecedented. Regulations on GCP, GMP, and GPvP come from other sources including ICH and the EMA, among others. Consequently, a number of terminologies that are associated with GLP activities, are used within the OECD document. They include test facility management, study director, and the definition of raw data with no reference to the source. The term source data is a GCP term defined by ICH, but it is distinguished, alongside raw data, in the MHRA paper. This is also seen with the terminologies true copy (MHRA) and verified copy (OECD), although synonymous and defined in the same context, there is a disparity in the language used between the documents. The terms listed are all well known in the realms of regulated activities, regardless of GCP, GMP, or GLP, and should not cause an experienced user any concern. 

However, go beyond the title page of each document and the similarities in the definitions throughout are glaringly obvious. Given both documents are dealing with the same regulations, this you might expect, but it is clear the drafting of the OECD document drew heavily on the MHRA’s language. The definition of risk-based approach, the definition of data integrity, and the use of the ALCOA acronym opposed to ALCOA+, among others, are all reproduced almost word for word, with just the slightest variation. Yet this is surely excellent news! With no contradiction in most pertinent terms, there can be no misunderstanding of requirements whether based in the UK or the rest of the world. 

Delve into the depths of the documents and things start to become more autonomous. The OECD document is much heavier in bulking out details of pertinent GLP requirements. The definition of data, for instance is broadly described in similar language between the two sets of requirements with a few additions in the OECD definition as ‘quantitative or qualitative facts, figures, and statistics collected for reference to analysis. These include all original records and verified copies or original records, including raw data and metadata and all subsequent transformations that are generated or recorded at the time of GLP activity, and allow the complete construction and evaluation of the GLP activity.’2 Not dissimilar to the language used in the MHRA requirements concerning GxP rather than GLP and source used in place of raw when describing data, however the OECD definition goes on to list terms not seen in the MHRA document such as record and derived data. Data structure is dealt with in the very next section (3.2) of the OECD paper, which is detailed over and above that found within the MHRA document.  

Section 4 of the OECD text is given over to the ‘Responsibilities for data, from generation to archive’,2 which lists the accountability required for each member of the study team and beyond. This gives much more obligation and definition to the individuals job titles from study personnel right through to test facility management. The MHRA paper restricts itself to talking about the role of the organisation in general and the expectation is that everyone involved in research is aware and responsible for ensuring data integrity. Given terms such as test facility management do not sit well within the worlds of GCP and GMP, it is not surprising these are not present in the MHRA requirements.  

Conversely, data lifecycle is defined in both sets of regulations using almost identical language: ‘All phases in the life of the data from generation and recording through processing (including analysis, transformation or migration), use, data retention, archival/retrieval and destruction.’1 Definitions of terms such as data approval, processing, migration, and retention are covered within the Data Lifecycle section of the OECD document but are standalone definitions in the MHRA requirements. The descriptions may have been grouped together by the OECD to show a flow through the lifecycle, but the expected lifecycle activities are set out clearly in both documents. 

 Time 

Time, and the recording of it, seems to be extremely important to the OECD and the GLP regulations. For example, an electronic signature must have a timestamp associated with it, for flat files, date, time, and the identity of the person recording the data should be recorded, date and time of verified copy generation should be retained, data and time of data migration to be defined before migration, data audit trails should be date and time stamped. Of course, the recording of time is not a new concept. The FDA CFR 21 Part 11 regulations published in 1997 refers to time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records and also in reference to electronic signature ‘the date and time when the signature was executed’3.EudraLex Volume 4 GMP Guidelines Chapter 4 (January 2011) on documentation requires the time to be recorded for packing operation within the Batch Packing record 4. While the MHRA document does not emphasise the recording of time in the way the OECD document does, there is an expectation that time is a key factor and should be recorded as is pertinent to the task at hand. Therefore facilities, regardless of the GxP in question, should assess the importance of the recording of time in all actions related to regulated activities. 

Quality 

What of quality? The MHRA paper ‘primarily addresses data integrity and not data quality since the controls required for integrity do not necessarily guarantee the quality of the data generated.’1 However, the OECD has added a definition of data quality in section 3.5. Again, since this document applies to GLP only, this seems straightforward in its thinking with ‘data quality assured by appropriate study design and accurately and scientifically address the experimental question and hypothesis being studied’2. A statement such as this will not apply to all the GxPs as covered by the MHRA document nor would a simple statement like this be able to cover all the activities under the GxP banner. Data criticality enjoys a section of its own (4) in the MHRA paper ‘considering how the data is used to influence the decisions made’1. This statement seems more pertinent to GCP activities such as safety laboratory monitoring or ECG readings and interpretation and, although criticality of data is mentioned within the OECD paper, the same emphasis is not placed on it.  

Audit Trails 

Everyone within the regulated GxP industry will know of audit trails, which have been part of everyday life for a long time. Anyone not familiar with good documentation practices must have been living in outer space. Within the MHRA paper, an audit trail is defined as providing ‘secure recording of life-cycle details such as creations, additions, deletions, or alterations of the information in a record, either paper or electronic, without obscuring or overwriting the original record.’1 However, while the definition of audit trial within the OECD document is not dissimilar, it does state that it is only true for electronic data. Since it is possible for GLP data to can be recorded manually on paper, and it is discussed within the article regarding printing of raw data sheets, one must assume that GLP facilities will continue to use good documentation practices while correcting or amending observations recorded on paper.  

Raw Data Sheets 

This brings us nicely to our final frontier, raw data sheets. Given the changing face of regulated activities for studies, it will always be necessary to produce templates or forms for data recording and collection. While both documents discuss the need to control forms such as this to allow detection of duplication and support the identification of data integrity issues, the OECD document goes further in saying the number of available copies and printouts, if available, should be controlled and reconciled. Risk assessment should be carried out to determine the level of control needed in these situations.  

The MHRA has defined ‘the risk to data is determined by the potential to be deleted, amended or excluded without authorisation and the opportunity for the detections of those actives and events.’1 For those working within a regulated industry, but outside the GLP sector in the UK, there is no impact from the additional requirements from the OECD unless your quality system is GLP e.g., for those clinical labs (human and veterinary) whose QMS is GLP. Organisations not considered to be GLP should continue to follow the principles of data integrity as set out in the MHRA document. For those GLP facilities falling under the GLPMA, there is a requirement to complete a documented review of the OECD Advisory Document and make light speed moves to comply with the changes and/or additions. Given the significant overlaps in the two documents, the UK is leading the way to the stars and beyond with data integrity.  

Tower Mains 

We hope you found this article interesting and useful. The team at Tower Mains have extensive experience in clinical trials and GLP. We can provide a wide range of QA services which are tailored to meet your specific needs. To find out more about what we can do for you, contact us at info@towermains.com. 

References

1.  1. Medicines and Healthcare Products Regulatory Agency (MHRA) ‘GXP’ Data Integrity Guidance and Definitions March 2018 Revision 1
2. OECD Series on Principles of Good Laboratory Practice and Compliance Monitoring Number 22 Advisory Document of the Working Party on Good Laboratory Practice on GLP Data Integrity 20 September 2021 
3. Code of Federal Regulations Title 21 Chapter 1 FDA Department of Health and Human Services Sub-Chapter a General Part 11 Electronic Records; Electronic Signatures March 20, 1997
4. EudraLex Volume 4 Good Manufacturing Practice Part 1 Basic Requirements for Medicinal Products Chapter 4-Documentation Jan 2011

Author: Judith O’Hagan, Senior QA Associate