Automating quality assurance in pharmaceutical, biotechnology, and medical devices

Pursuing the benefits of automation

Many life sciences companies are behind the maturity curve in the adoption of robotics and cognitive automation (R&CA). No wonder, since US Food and Drug Administration (FDA) regulation 21 CFR Part 11 requirements have created uncertainty over how to proceed with R&CA and potential impacts to human safety has slowed progress across the industry. Despite the lag, use of automation is gradually spreading across pharmaceutical, medical device, and biotechnology companies, from clinical trials to regulatory compliance to the back office.

As with any information technology (IT) initiative impacting product quality, patient safety, or data integrity, R&CA rollouts require validation to ensure systems are fit for their intended use. However, R&CA validation can be a conflicting challenge. For example, how can autonomous solutions be validated for a defined use when, by their nature, they can change in functionality based on available data?

This challenge is compounded by the availability of new, commercially available automation tools. In the past, R&CA solutions required the writing of code, typically relegated to a small group of computer scientists. Now, these easy-to-access automation tools can be deployed with greater speed by less-technical people. This creates a risk of rogue deployments undertaken by business users either oblivious to or dismissive of IT control and validation requirements. Such outside-the-lines actions could lead to regulatory sanctions, fines, or even a production shutdown.

Life sciences companies are under pressure to pursue the benefits of automation or risk falling behind competitors. At the same time, such initiatives can increase a company’s exposure to operational lapses, FDA findings, cyber threats, and other risks. Development of a flexible, mature validation strategy can help companies implement controls that support regulatory compliance, product safety, and industry competitiveness as they use automation to pursue efficiency, cost-savings, and innovation opportunities.

Back to top

Introducing process automation tools

R&CA comprises two related technologies: robotic process automation (RPA) and robotic cognitive automation (RCA).

RPA tools are rules-based systems that mimic human behavior to automate parts of repeatable processes. Once written and tested, RPA algorithms operate in a predictable manner and don’t change. Repetitive, high-volume processes with defined steps and systems are typically good candidates for RPA.

RCA adds cognitive capabilities to RPA through the introduction of machine learning tools. RCA tools can process and interpret unstructured data, make judgments, and engage in predictive reasoning. Their behavior can also change over time, based on the data and methods used to train them. With proper quality deployment, RCA solutions can be trained to perform many of the same duties as humans.

Back to top

Using the bots

Life sciences companies can explore many different applications for robotic process automation and robotic cognitive automation, and associated validation, across the Good Manufacturing Practices, Good Clinical Practices, and Good Laboratory Practices (GxP) landscape, including:

• Streamlining the tedious product labeling process in manufacturing
• Supporting advancements in pharmacovigilance by providing the tools and capacity to process volumes of data on product quality and distribution
• Maintaining official records required by predicate rules, subject to inspection under FDA requirements, such as study protocols for new drug applications
• Enhancing training and learning management systems (LMS) effectiveness by automating training assignments, identifying gaps, and communicating with personnel affected
• Identifying high-risk abnormalities in images through large-scale interpretation and processing of clinical trials data, such as radiology reports

Regulators are also signaling a greater interest in how R&CA is deployed in validation processes. While encouraging companies to innovate, authorities expect them to address risks associated with new technologies.

Back to top

Mitigating risks

While the stakes for implementing R&CA solutions for pharmaceutical, biotechnology, and medical device quality assurance are high due to the impact on patient safety, other industries have overcome similar challenges.

For example, the autopilot feature on virtually every modern airplane is an autonomous rules-based (RPA) program. Its use is restricted to lower risk activities and turned off during higher risk maneuvers such as take-off and landing. Additionally, if certain unexpected anomalies occur, such as unintended turbulence, the autopilot can signal for pilot intervention. Although this functionality was developed in the 1920s, its deployment for commercial use has similar parallels and consequences in life sciences: malfunction or unintended action could result in a serious human health catastrophe.

In a more modern setting, self-driving cars operate in a similar environment due to their potential impacts on human safety. Such cars operate with RCA technology, learning from experiences both positive and negative. Companies employing this technology aim to show regulators and society that self-driving cars using RCA technology are safe, but in the early stages they do so with the premise that a driver must be present behind the wheel just in case.

Both examples offer object lessons for the life sciences industry as companies adopt RPA and RCA solutions:

1. Other industries have overcome technology risks that have direct implications for human safety by deploying high-quality solutions.
2. Automation can be implemented, but human intervention should be built into the process for high-risk activities.

Back to top

Developing a validation strategy

Development of a validation strategy is a vital first step in R&CA deployment, whether an organization is focused on RPA or venturing into more complex uses of RCA. Following are considerations for each type of strategy:

RPA strategy considerations
RPA implementation conforms to the tried-and-true computer systems validation methodology: identify system boundaries and functionality, create controls around them, validate that controls work as intended, and then release them for use.

RPA deployment may cross multiple systems, which can compound change control requirements. Even using established methodologies and strategies, it is important to understand the broader context in which RPA technologies are being built and integrated into current systems.

Once the bots are developed and implemented using standard operating procedures, the organization must commit to a maintenance plan, whether it be in-house or includes vendors.

Other RPA deployment considerations include:

1. Early adoption of a controls framework that will guide actions throughout the RPA life cycle to set the quality standard for deployment throughout the organization
2. Inclusion of RPA implemented in the organization’s overall change management strategy to ensure that changes don’t have unintended impacts
3. A controls framework that focuses on checks and balances between high-risk automated processes and human intervention
4. Greater emphasis on testing and validation to verify they can execute processes within boundary conditions—and provide alerts if not—due to higher processing speed
5. Security-based controls to ensure that only authorized people—and authorized bots—can gain access to certain parts of the system
6. Periodic maintenance validation, executed at a higher frequency during early-stage development, to verify that changes to upstream systems haven’t affected bot functionality

As with other IT deployments, it is important to evaluate and prioritize the risks associated with RPA to help determine how much testing will be required. Also, a process change can require refinements to a bot. Questions to consider include what amount of process change would require a bot to be revalidated and do the revision fit into existing change management processes or does a different change management process need to be developed?

RPA strategy considerations
RCA requires additional controls beyond those governing RPA. While RPA functionality is static, RCA is dynamic and constantly gaining “experience” as it learns from new data. Organizations need the ability to constantly validate RCA systems at a frequency of risk, as well as to monitor how tools are evolving. Controls need to be in place to check cognitive systems when they go beyond established boundaries if allowed.

Two actions can help organizations build on the tenets of RPA deployment to enhance the quality and effectiveness of RCA deployment:

1. Establish adequate controls around the training data sent into the system to detect any outliers
2. Perform stress tests on training data to establish controls that support intended outcomes

Back to top

The bottom line

Implementations across an array of industries demonstrate that companies can mitigate the risks and capture the value of R&CA. Life sciences can follow suit with validation that adheres to traditional computerized systems validation methodologies while demonstrating that automation solutions can be as reliable as humans.

Validation of data is critical to a well-built automation model. Automation will still require human intervention at key failure points, and changes in controls will be necessary if models are changed to produce new outcomes. By understanding these parameters, life sciences companies can pursue R&CA opportunities more confidently and potentially overcome the risks of falling behind competitors in technology adoption.

Back to top

Contact us

Back to top