기준서에는 넣었습니다.
현장에서 보여 줄 수 있습니까?

It is in your SOPs. Can you show it on the floor?

Korea's Ministry of Food and Drug Safety (MFDS) issued its Data Integrity Assessment Guideline for Drug Manufacturers in October 2020 (guideline dated 29 October 2020). An official letter of 23 March 2022 extended it to all drugs, including active pharmaceutical ingredients, from 2023, and set deadlines of 30 June and 31 December 2022 for reflecting the assessment criteria in each company's four GMP standard documents (letter, item 2). The deadlines have passed. In i&CP's view, the question now is not whether the text is in your documents, but whether your records show that you work the way the documents say.

Statements marked "guideline" summarize the MFDS guideline of 29 October 2020, with page numbers as printed. "Letter" means the MFDS administrative order letter of 23 March 2022, and "Attachment 1" its first attachment. Interpretation and the "On the floor" items are i&CP's view, not the position of MFDS. English document names and terms are i&CP's translation.

Signal 1 · An administrative order, not a recommendation

The guideline states an administrative order: reflect the assessment criteria in the four standard documents and operate accordingly (guideline 4, p.5). Where data manipulation is found or the criteria are not implemented, it states administrative penalties under a zero-tolerance principle, with a criminal complaint where necessary. If manipulation is confirmed in a pre-approval GMP assessment, the application is returned (guideline 4, p.3). The first scope was new drugs filed on or after 1 January 2021, with a pilot from October 2020 to October 2021 (guideline 4, p.5). The 2022 letter extended it to finished products (new drugs, sterile products, products requiring equivalence) from 1 July 2022 and to all drugs from 2023. It said inspections from July 2022 would check first whether the criteria are reflected in the documents, and that non-compliance would lead to administrative action (letter, items 2 to 5). The guideline's table of administrative dispositions lists failure to follow an MFDS order and failure to follow one's own written standards as separate violations (guideline II, p.36). That table is the one printed in the 2020 guideline; check current law for later changes.

Signal 2 · What changed, in seven rows

One table sets the previous practice beside the new one in seven rows (guideline 4, p.4). Detailed criteria replace principles. A result is accepted only when all supporting data from the whole test process, such as metadata and audit trails, are kept. Responsibility extends from the quality unit to management. An error record that a reviewer and an approver have reviewed and signed is not accepted on later explanation. A legacy system is accepted when it is operated under controls based on risk assessment. Test items vulnerable in data integrity call for risk assessment and safeguards. Systems are expected to set access rights and assure reliable time records, such as time stamps, in line with ALCOA+. The scope of data management is extended to all data generated throughout testing (guideline 4, p.3). As a plain-language aid, i&CP restates ALCOA+ (PIC/S PI 041-1 #7.4, p.15) as nine everyday questions, from "Is the person's name on it?" to "Can you retrieve it when asked?".

Signal 3 · Each item asks twice

The assessment items follow the structure of the GMP rule: nine groups and 46 numbered items for finished products (guideline I-1, pp.6–20), eight groups and 46 items for active pharmaceutical ingredients (guideline I-2, pp.21–35). Under the 46 finished-product items, i&CP counts 109 sub-items. In most items, the first sub-item asks whether a control is written into the standard documents, and the following ones mainly ask whether it is actually done and recorded. Examples are audit trail review (2.2 item 9, p.9), backup (2.2 item 5, p.8), access rights (2.2 item 12, p.10) and self-inspection (13 item 1, p.19). Attachment 1 of the 2022 letter lists 45 sub-items to be reflected in the documents. In i&CP's view, the other 64 can only be answered on the floor.

Signal 4 · Six things to show on the floor

Examples from the finished-product items: (1) periodic audit trail review, performed by a department not related to the work (2.2 item 9, p.9); (2) records of creating, changing and deleting access rights, with system administrator rights held by someone with no direct interest in the quality data (2.2 item 12, p.10); (3) system clocks synchronized with a standard clock, and a record of any time adjustment (2.2 item 13, p.10); (4) scheduled backups and verified recovery (2.2 items 5, 6 and 17, pp.8–11); (5) approved true copies for non-permanent originals such as thermal paper, and metadata kept with scanned copies (2.2 item 4, p.8; 5.2 item 2, p.15); (6) for legacy systems that generate no audit trail, an alternative way of tracing and a report verifying that it is equivalent (2.2 item 8, p.9). Inspection covers records created after the date the guideline applies to each product (guideline 4, p.5). In i&CP's view, all six ask not whether a procedure exists but whether there is a record that it was followed, and closing the gap needs management to receive regular reports and assign people and time.

Overall message

The guideline dates from 2020 and the document deadlines from 2022. From the start it asked two things: is it in your documents, and do you work that way. In i&CP's view, what to prepare now is not a new document but the records showing you have worked as written. If the records are not there, start keeping them today.

Standard documents are a promise. Records are the evidence.