Background

Responding to the COVID-19 pandemic, FDA adapted its operations for field activities to provide oversight of regulated industry while mitigating the spread of COVID-19. One set of tools used for oversight of FDA-regulated products has been voluntary remote regulatory assessments (RRAs), a category that includes “remote interactive evaluations” and “remote record reviews.” During the course of the PHE, FDA published the guidance “Remote Interactive Evaluations of Drug Manufacturing and Bioresearch Monitoring Facilities During the COVID-19 Public Health Emergency,” describing remote interactive tools the agency would use during the pandemic; we summarized that temporary guidance online here. Over the past two years, FDA has conducted more than 1,470 RRAs domestically, and more than 600 for facilities outside the U.S.

As we previously discussed, based on the agency’s experience during the PHE, FDA has recognized the value of voluntary RRAs and concluded that they should be used for certain scenarios outside the current pandemic and for all types of FDA-regulated products. In a press release published alongside the new draft guidance, FDA said that as a result of RRAs, the agency has “identified unreported adverse events, gathered information to add products that appear to be violative to import alerts, evaluated the status of companies correcting issues from a previous inspection and helped the agency make regulatory decisions for product premarket submissions.” The agency concluded that “RRAs are effective in getting essential information to regulators, enabling the FDA to intervene when needed and use agency resources more efficiently to do so.”

Who may be subject to an RRA?

The draft guidance clarifies that if an RRA is voluntary (or FDA opts against exercising its mandatory RRA authority in a certain instance), FDA may request that any establishment (e.g., drug or medical device manufacturers, clinical investigators, and others) participate in a voluntary RRA. Meanwhile, mandatory RRAs may apply to establishments that engage in the manufacture, preparation, propagation, compounding, or processing of a drug, as well as importers. Additionally, Foreign Supplier Verification Program (FSVP) records under 21 CFR 1.510(b)(3) or 1.512(b)(5)(ii)(C)” or similar) are mandatory RRAs.

FDA says it will use a risk-based approach to determine whether to initiate or request an RRA, with factors considered including firm location, inspection history, complexity of product and process, and travel restrictions. The guidance notes that “RRAs are not intended to limit or replace other established means of obtaining information necessary for FDA to accomplish its public health mission outside of inspections.”

What information may FDA request as part of an RRA?

RRAs may entail, but are not limited to, any combination of the following, according to the draft guidance:

• FDA requests and reviews records, documents, and other information (such as electronic systems, and source records from non-clinical and clinical studies).

• Virtual meetings between FDA and responsible establishment personnel to review, where appropriate, the information provided, the electronic systems, the establishment’s operations, and/or the establishment’s standard operating procedures (SOPs).

• Use of livestream and/or pre-recorded video, where appropriate, to examine facilities, operations, data, and information. In the case of livestreaming, FDA notes that it may request to be present during oversight activities conducted by a party (e.g., state and foreign regulatory partners) using this tool.

To help firms prepare for an RRA, FDA set forth examples of records and other information that may be requested during a voluntary or mandatory RRA:

• Records of specific production lots or batches as well as product-specific information, such as periodic product reviews, product quality reports, equipment records, process validation records and reports, test results, product complaints or other information related to compliance with Current Good Manufacturing Practice (GMP) requirements.

• Certain summaries or lists of records, such as a summary of batches manufactured and their disposition, or a summary of discrepancies and investigations related to manufacturing and testing.

• Read-only access to electronic databases or a request that an establishment walk us through information in their database or provide data queries or summary data generated by the establishment from their databases.

• SOPs and records generated by the establishment to document control of quality systems and/or to demonstrate compliance with the applicable FDA requirements.

• Records or data related to the reporting or conduct of FDA-regulated research.

To clarify, for mandatory RRAs the draft guidance makes clear that FDA can only require activities that are within the scope of the applicable statutory/regulatory authority. However, the guidance notes that the agency may request that an establishment voluntarily participate in additional activities under a separate RRA (e.g., livestreaming).

The draft guidance enumerates how the information collected during an RRA may be used by FDA to, among other potential purposes:

• Support FDA’s assessment of pending marketing submissions, including whether to approve an application or whether to issue a response, such as a complete response letter.

• Determine whether an establishment or product is in compliance with FDA requirements.

• Facilitate assessment of the need for an inspection in follow-up to a reported concern or defect.

• Support actions such as a regulatory meeting, warning letter, import action, recall activity, or enforcement action.

• Determine the priority of establishments for inspection, particularly a surveillance inspection.

The draft guidance maintains that an RRA is not an inspection,[1]^,[2] and thus observations found during an RAA will not lead to the issuance of Form FDA 483 unless confirmed in an inspection. However, as discussed above, FDA may use the information collected during the RRA as the basis for enforcement activities as well as to support inferences that can negatively impact establishments (e.g., disapproval of a marketing application and failure to remediate observations following an inspection). Moreover, while the agency asserts that an RRA is not an inspection, the guidance instructs readers that an RRA will follow a format almost identical to an inspection:

• FDA will ordinarily prepare a report consisting of a narrative and supporting documents that communicates the summary of information reviewed, conditions and practices found, and the observations identified;

• FDA may request a meeting with the establishment;

• Establishments are encouraged to respond to any meeting or written observations within 15 business days; and

• FDA will consider any responses or corrective actions submitted within 15 business days before taking further action or making a decision.

Expectations for technology capabilities

FDA’s expectation for a firm’s technological capabilities for RRAs depends on the nature and scope of the review. For example, if an RRA allows for livestream video conferencing, firms should be prepared to provide assurance around hardware or internet connectivity, the quality of the remote connection, and security and privacy controls.

The guidance also outlines how information should be submitted in either electronic or written format, depending on the circumstances. FDA acknowledges that some establishments maintain records in paper form only (e.g., clinical investigators not using electronic case report forms or source documentation), but does not consider this an obstacle to voluntary compliance with an RRA. The agency advises that such documents should be scanned as a searchable PDF or, if scanning is not possible, mailed to FDA. This will likely leave some establishments that maintain paper records only in the undesirable position of deciding whether to bear the additional cost for transferring paper records in connection with an RRA or risking further FDA action for declining an RRA.

Consequences for declining an RRA

If an establishment declines FDA’s request to conduct a voluntary RRA, the agency advises that it may not be able to conduct timely assessment of the establishment’s activities due to insufficient information. This means, the guidance warns, that FDA may not be able to provide an applicant with a timely decision on an application or product’s approval, clearance, or authorization if it lacks information about an establishment referenced in the marketing submission. In such an event, FDA may also consider “other actions necessary to verify information submitted to FDA or obtain further information and to exercise its oversight responsibilities of that establishment,” including launching an official inspection.

If an establishment declines FDA’s request to conduct a mandatory RRA, it may be found in violation of the Federal Food, Drug, and Cosmetic Act (FDCA), and imported drugs from the establishment may be subject to refusal. Additionally, FDA may well consider it to be an inspection refusal, which could potentially lead to other regulatory consequences.

Next steps

As demonstrated by FDA’s new draft guidance, we expect the agency to continue to use its records request authority and newly piloted virtual inspection tools in addition to the agency’s traditional on-site activities to allow for more targeted on-site inspections. In addition, FDA’s focus on the pharmaceutical supply chain will likely mean enhanced scrutiny for manufacturers of critical medicines and manufacturers that are the sole source of product. This will likely mean more inspections (on-site and virtual) and more records requests for manufacturing sites critical to supply chain continuity — particularly those manufacturing sites critical to the supply chain that are located outside the U.S.

For medical device companies who are still not subject to mandatory RRAs, but can decide to participate in a voluntary RRA, companies need to consider whether there is benefit to participation and on the other hand whether declining participation may well lead to an onsite inspection. FDA’s factors for determining whether an onsite inspection is warranted are by design loose and give the agency plenty of discretion. While FDA does speak to the issuance of CFGs, companies should consider and ask whether voluntary participation in FDA’s RRA will provide sufficient data such that FDA could issue certificates of foreign governments. If participation in the voluntary RRA program could result in the issuance of CFGs, then the risk that FDA identifies compliance gaps that may well lead to an on site inspection may well be worth it.

FDA has invited comments on the draft guidance through September 23, 2022. If you wish to submit a comment, or have any questions on FDA inspectional activities generally, you may contact any of the authors of this alert or the Hogan Lovells attorney with whom you generally work.

It is also possible that in the coming weeks, a finalized FDA user fee reauthorization bill could codify into law the agency’s RRA policies. We will continue to track this legislation and keep you apprised of any changes.

Authored by Jodi K. Scott, Blake Wilson, and Lowell Zeta