FDA’s Remote Regulatory Assessments Q&A Draft Guidance Document Explains the Regulated Industry’s New Virtual Reality
The U.S. Food and Drug Administration (FDA or Agency) recently announced the availability of a new draft guidance titled “Conducting Remote Regulatory Assessments: Questions and Answers” (RRA Draft Guidance). Remote Regulatory Assessments (RRAs) are a category of entirely remote tools that FDA used in response to the Coronavirus Disease 2019 (COVID-19) pandemic for providing continued oversight of regulated industry while mitigating the spread of COVID-19. As defined in the RRA Draft Guidance, a “RRA” is an examination of an FDA-regulated establishment and/or its records, conducted entirely remotely, to evaluate compliance with applicable FDA requirements. A RRA includes, but is not limited to, “remote interactive evaluations” and “remote record reviews.” To date, RRAs have included review of records or other information submitted upon request from FDA under sections 704(a)(4) (i.e., drug sponsors/manufacturers) and 805 (i.e., food importers subject to the Foreign Supplier Verification Program (FSVP)) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) (referred to “Mandatory RRAs” in the RRA Draft Guidance); and records assessments and/or interactive evaluations (such as remote livestreaming video of operations, teleconferences, and screen sharing) conducted pursuant to voluntary participation by industry (referred to as “Voluntary RRAs” in the RRA Draft Guidance). Based on its recent experience of using RRAs, FDA recognizes the value of RRAs and has determined that these types of assessments should continue to be used in certain scenarios for all types of FDA-regulated products.
The RRA Draft Guidance is available for public comment until September 23, 2022. In addition to our takeaways, we provide a summary of the content organized into four categories: (1) RRA fundamentals, (2) RRA expectations, (3) request for records or other information as part of RRAs, and (4) completion of an RRA.
SUMMARY
RRA Fundamentals
In the RRA Draft Guidance, FDA clarifies that RRAs are not intended to replace other means of obtaining information from establishments outside of inspections. Additionally, RRAs are not, in and of themselves, a form of inspection. According to the FDA, an RRA generally cannot meet the definition of an “inspection” because the statutory requirements specify the physical entering of an establishment to determine compliance.[1] FDA further stated that it does not intend to conduct inspections and RRAs simultaneously. The Agency may, however, use RRAs in preparation for or following an inspection.
FDA may initiate or request to conduct an RRA whenever the Agency believes that it is appropriate to help fulfill its regulatory responsibilities. This may include situations such as: (1) when FDA cannot conduct an inspection due to travel limitations; (2) preparing for an upcoming inspection; (3) investigating a consumer complaint; (4) reviewing a marketing submission; etc. Importantly, FDA specifies that it does not accept requests to perform an RRA.
RRA Expectations
Voluntary RRAs
To request a voluntary RRA, FDA will contact an establishment through the establishment’s point of contact by email or phone. The Agency requires that the establishment’s top management official at the site or their designee provide written confirmation of the establishment’s willingness to participate in the type of RRA requested. Following confirmation, FDA will work with the establishment to schedule the necessary virtual assessments.
FDA clarifies that the Agency will not take any enforcement action against an establishment for declining a voluntary RRA request. As a result of declining an RRA, however, FDA warns that it may not be able to conduct timely assessment of the establishment’s activities due to insufficient information. This may result in delays in providing an applicant with a decision regarding product approval, clearance, etc.
During a voluntary RRA, establishments can expect one or multiple of the following to occur, depending on the type of RRA requested:
- Submission of FDA-specified records, documents, and other information for review
- Virtual meetings to review the establishment’s electronic systems, operations, standard operating procedures (SOPs), etc.
- Use of livestream video and/or pre-recorded video to examine facilities, operations, data, and information
Mandatory RRAs
To initiate a mandatory RRA, FDA will provide a drug establishment with a Form FDA 4003, and a food importer with a Form FDA 482d. Such establishments are obligated to respond to these forms with the requested information. Refusal to provide the requested information in a mandatory RRA may be considered a violation of the FD&C Act and may result in appropriate action by FDA. For example, a food importer’s food shipments may be refused entry, and all products offered by that importer may be added to Import Alert 99-41.
Technological Requirements
FDA does not require that establishments participating in voluntary RRAs meet any technological requirements. However, FDA may inquire about hardware or internet connectivity to assess IT operability, security, and privacy controls to protect the confidentiality of shared data. If FDA determines that the remote interaction during the RRA does not allow for sufficient examination of the establishment (e.g., the establishment cannot support streaming video), the Agency may use different RRA tools or cancel the RRA. In this scenario, FDA will consider other necessary actions, such as an inspection.
Request for Records or Other Information as Part of RRAs
Content
Examples of records or other information that FDA may request during both voluntary and mandatory RRAs include:
- Product-specific information, including records of specific production lots or batches, test results, equipment records, periodic product reviews, etc.
- Certain summaries or lists of records
- Electronic databases (read-only) or a request that an establishment walk through information in a database
- Standard Operating Procedures and records that document control of quality systems and/or demonstrate compliance with FDA requirements
- Records or data related to the reporting or conduct of FDA-regulated research
- For FSVP importers, records related to hazard analysis, supplier verification activities, and/or corrective actions
Timeframe
FDA does not establish a standardized timeframe across all RRA types. Instead, FDA will request that records be submitted within a timeframe that is specific to the individual circumstances of the request. The circumstances that FDA will consider may include the size of the establishment and the type and complexity of the records being requested.
Format
FDA states that all requested records must be submitted to FDA in searchable PDF format. FDA will provide establishments with a secure electronic means to send requested records and information, and states that records “should” be submitted electronically. However, if the firm can establish that it is not capable of submitting documents electronically, FDA will allow for submission of paper copies, and the Agency acknowledges that if the records are subject to mandatory RRAs, they can be submitted in either electronic or physical form. FDA may request that records be submitted in English or accompanied by a verified translation.
Uses
FDA states in the draft guidance that the information and documentation gathered by the Agency during an RRA may be used for a wide array of regulatory purposes. Such purposes include, among others: supporting assessment of pending marketing submissions; determining whether an establishment is in compliance with applicable requirements; assessing the need for an inspection; supporting actions such as a regulatory meeting, warning letter, or enforcement action; and determining the priority of establishments for inspection.
Completion of an RRA
Upon completion of an RRA, FDA may have a meeting with the establishment’s management and/or present a written list of RRA observations. FDA defines “RRA observations” as conditions and/or practices observed that indicate a potential violation of FDA regulations. FDA encourages establishments to respond to RRA observations within 15 business days, during which time the Agency will not issue further action or decision. Any timely responses will be considered by FDA before such action or decision is made. This policy is consistent with FDA’s treatment of establishment responses to inspectional observations included in a 483.
Establishments that participate in an RRA should be aware that a written list of RRA observations and establishment responses may be subject to publication under a Freedom of Information Act (FOIA) request. Following a FOIA request, this information may be made publicly available with any applicable redactions.
Following completion of the RRA process, FDA will prepare a report summarizing the information reviewed, conditions found, and observations identified.
TAKEAWAYS: TRUST BUT VERIFY
From a sheer practical level, FDA’s decision to retain RRA tools adopted during a world crisis that largely prevented on-the-ground inspections is the epitome of common sense. FDA has learned that this approach not only keeps FDA and establishment personnel safe, it also saves on travel costs and lost FTE hours to travel. Firms may even find this approach much less disruptive to operations than hosting FDA personnel for a multiple day inspection. In a digital world, companies regularly retain records electronically, and so the ease with which requested documents can be transmitted electronically (assuming secure transfer to protect confidential information) cannot be disputed. While assessments of manufacturing facilities through video streaming is likely the least well developed RRA tool, advancements in this tool, even if by trial and error, should be expected over time.
So, should industry embrace this new virtual and voluntary world of compliance assessment culture. We suggest a qualified “yes.” Obviously, mandatory RRAs do not provide the regulated industry with much choice, but even voluntary RRAs have the potential to offer real benefit such as faster FDA follow up after a firm has implemented necessary post-FDA inspection corrective actions, and opportunities to avoid costly re-inspection fees. This is particularly helpful for foreign firms in locations where FDA does not have a foreign office or the necessary resources to inspect. RRAs may also offer more efficient FDA approvals, clearances, or authorizations where facility review is necessary but inspection is difficult to arrange. Further, the fact that this train has left the station must be acknowledged. Indeed, there is pending legislation that would extend the reach of mandatory RRAs; specifically, to medical device related records and bioresearch related records.
However, our qualified “yes” recognizes that being prepared to say yes to an RRA approach rather than an inspection requires considerable planning, the development of new processes, and a healthy dose of “trust but verify” thinking to assure that the firm does not unwittingly find itself disadvantaged in demonstrating compliance.
Let’s take, for example, an FDA request for electronic submission of records that the Agency would typically review on-site during an inspection. While it may be easy for FDA to issue a request records, the potential volume of the record request could be daunting for the firm. The firm should carefully review the record request and determine whether there is an opportunity to negotiate with FDA with regard to what FDA actually needs to conduct the RRA. For example, if the FDA requests “all SOPs and records generated by the establishment to document control of quality systems and/or to demonstrate compliance with the applicable FDA requirements,” the firm should seek an appropriate time frame (e.g., the last three years of records), ask FDA to further specify the record type to avoid any question (e.g., for a food facility, is FDA seeking product-specific records such as supply chain control records, validation and verification records, corrective action records?), and confirm that the records requested by FDA are of a type that FDA would be able to request under its inspectional authority (reminder: most financial, pricing, and personnel records are out of scope of FDA review).
The firm should also consider whether voluntary submission of records is an appropriate RRA for their purposes. Particularly if the record submission request is quite large, understanding which documents FDA finds of “interest” (i.e., documents that FDA may believe suggest an alleged violation) may become impossible. During an inspection, the FDA investigator may request to review a number of documents, but may only request a few documents (i.e., documents of interest that may suggest an alleged violation) to be copied. However, when documents are submitted electronically, the firm must assume that all submitted documents are of “interest.” In the alternative, the firm may suggest that, in lieu of an electronic submission of documents, a virtual meeting during which documents are reviewed online could better address both the Agency and the firm’s needs. Virtual meetings to review multiple documents with FDA may not save time for the firm, but it may help prevent the submission of large volumes of documents to the FDA without context and necessity.
THERE IS STILL TIME TO COMMENT
As noted at the outset, the RRA Draft Guidance is available for public comment until September 23, 2022. If your firm has concerns with the FDA proposal, Wiley is prepared to assist with the development of comments.
If you have any questions regarding the applicability and reach of this draft guidance to your firm, Wiley is ready to assist.
Trevor LaSalvia, a Project Assistant at Wiley Rein LLP, contributed to this alert.
[1] FDA states, however, that remote requests for Foreign Supplier Verification Program (FSVP) records, are considered a form of inspection because, by law, such records operate to evaluate a food importer’s compliance with FSVP.
