United States: FDA Issues Draft Guidance Addressing Remote Regulatory Assessments

In March 2020, in response to the COVID-19 pandemic and associated health risks and travel restrictions, the Food and Drug Administration (FDA or the Agency) adjusted its field operations, suspending most of its inspection program in the United States and abroad. To continue to provide oversight during the pandemic, FDA introduced alternatives to in-person inspections, known as remote regulatory assessments (RRAs). RRAs are remotely-conducted examinations of regulated establishments to evaluate compliance with FDA requirements where traditional inspections are deemed impracticable. Based on FDA's experience with RRAs during the pandemic, the Agency has concluded that RRAs should continue to be used after the pandemic, as a supplement to FDA's inspection program.

In July 2022, FDA released a draft guidance document, Conducting Remote Regulatory Assessments - Questions and Answers: Guidance for Industry ("Draft Guidance"), to provide answers to frequently asked questions related to RRAs, including how they are conducted and how the Agency will use them. It is important that entities regulated by FDA understand this guidance, as the Agency has made clear that RRAs will be a permanent oversight tool for the Agency.

What Are RRAs?

FDA uses the term "RRA" to describe a category of activities, including remote reviews of records submitted upon request from FDA under sections 704(a)(4) and 805 of the Federal Food Drug and Cosmetics Act (FD&C Act), or "mandatory RRAs," and remote records assessments and interactive evaluations conducted pursuant to voluntary participation by industry, or "voluntary RRAs."¹ Mandatory and voluntary RRAs differ in that denials or delays of mandatory RRAs may lead directly to enforcement action.² However, while the latter category of RRAs are technically voluntary, a refusal to honor a request for records, remote interactive valuation, or other form of RRA would likely lead to a mandatory in-person inspection, increased FDA scrutiny, or delays in the approval of medical products.³ Mandatory RRAs are limited to requests for records regarding pharmaceuticals and regarding compliance with the Foreign Supplier Verification Program (FSVP) for food imports.

RRAs are not intended to replace inspections or other established means of obtaining information from industry, but may precede, prompt, or serve as a follow-up to an inspection.⁴ RRAs preceding an inspection may provide information eventually combined with observations from an inspection, but FDA will confirm any observations from the RRA during the inspection prior to including them on an FDA Form 483. RRAs following an inspection may be used to conduct follow-up activities with the establishment or to verify corrective actions.⁵

How FDA Conducts RRAs

FDA will use a risk-based approach to determine whether an RRA is appropriate to help fulfill the agency's regulatory responsibilities and protect human and animal health.⁶ The Agency will consider factors including, but not limited to, firm location, inspection history, complexity of product and process, and travel restrictions. Different programs and Centers within FDA may assess risk differently based on the product. At this time, the Agency does not accept requests to perform an RRA.⁷

After determining an RRA is appropriate, FDA will request either a voluntary or mandatory RRA. For a voluntary RRA, FDA will contact the establishment through its point of contact by email or phone, request that the establishment's top management official provide written confirmation of the establishment's willingness and ability to participate in the RRA, and work with the establishment to schedule virtual interviews, confirm technological capabilities, and request information for review as appropriate.⁸ For a mandatory RRA, FDA will use either FDA Form 4003 to request information from drug establishments under § 704(a)(4) or FDA Form 482d to request FSVP records under § 805.⁹

During an RRA, FDA may request and review records and other information; conduct virtual meetings with responsible establishment personnel to review the information, electronic systems, the establishment's operations, or the establishment's standard operating procedures (SOPs); or examine facilities, operations, data, and/or information via livestream and/or pre-recorded video.¹⁰

The technological capabilities an establishment will be expected to meet will vary depending on the type of RRA and its scope. At a minimum, establishments should have a remote connection adequate for FDA to review requested records and other information. For RRAs requiring additional technological capabilities, such as live streaming video, FDA may inquire about the establishment's capabilities prior to conducting the RRA. If an establishment is unable to support streaming video or other live virtual interactions, or if such interactions do not permit a sufficient examination of the establishment, FDA may use other tools or terminate the RRA and consider other oversight actions, such as an inspection. FDA recommends that, to the extent practicable, establishments employ technology allowing access for remotely viewing and evaluating operations at the establishment.¹¹

For mandatory RRAs, FDA will request records be submitted within a specified timeframe that provides the establishment reasonable time to respond, and for voluntary RRAs, FDA may suggest timeframes to ensure the RRA is completed in a reasonable amount of time. FDA's expectations for reasonable request timeframes may include the size, resources, and capabilities of the establishment;, the type, complexity, and volume of records being requested;, the reason for the request;, and the need for translation of any requested documents.¹²

Records or other information FDA may request during an RRA can include:

• Records of specific production lots or batches as well as product-specific information, such as periodic product review, product quality reports, equipment records, process validation records and reports, test results, product complaints, or other information related to compliance with Current Good Manufacturing Practice requirements,.
• Certain summaries or lists of records (e.g., a summary of batches manufactured, a summary of discrepancies, and investigations related to manufacturing and testing),
• Read-only access to electronic databases or a request that an establishment walk the Agency through information in a database or provide data from the establishment's databases,
• SOPs and records generated by the establishment to document control of quality systems and/or to demonstrate compliance with applicable FDA requirements,
• Records or data related to the reporting or conduct of FDA-regulated research, and
• For FSVP importers, records related to hazard analysis, the importer's determination of appropriate supplier verification activities, performance of supplier verification activities, and/or corrective actions.¹³

Following an RRA, FDA may meet with an establishment's management and/or present a written list of RRA observations, defined as "conditions and/or practices observed ... that indicate a potential violation of the laws enforced by FDA." FDA will not issue an FDA Form 483 for an RRA. Any written list of observations may be subject to a request under the Freedom of Information Act after its initial disclosure to the establishment and may thereby be made publicly available (with redactions of information otherwise exempt from public disclosure). As with Form 483 observations, FDA encourages establishments to provide any responses to RRA observations within 15 U.S. business days to ensure the response is considered before any further Agency action. Following the RRA, FDA may conduct an inspection or take other appropriate actions, such as an enforcement action, if significant issues are discovered.¹⁴

Consequences of RRAs

FDA may use the records and other information gathered during an RRA to: support FDA's assessments of pending marketing submissions (e.g., whether to approve an application or whether to issue a response, such as a complete response letter); determine whether an establishment or product is in compliance with FD&C Act, Public Health Service Act, or other FDA requirements; facilitate assessment of the need for an inspection in follow-up to a reported concern or defect;, support actions such as a regulatory meeting, warning letter, import action, recall, or enforcement action; and to determine the priority of establishments for inspection.¹⁵

FDA has identified "significant benefits in using RRAs."¹⁶ RRAs have been used to verify corrective actions taken in response to inspections, provide FDA information to help the Agency use its inspectional resources more efficiently and effectively, and provide information about deficient practices that led FDA to take further regulatory action.¹⁷ RRAs can provide benefits for industry as well: remote evaluations may identify issues and allow establishments to take corrective actions, enhancing their preparedness for future inspections, and an RRA preceding an inspection can reduce resource expenditure by reducing the time FDA is present at the establishment and optimizing FDA's time on-site by reducing the extent of records review required to occur on-site. Perhaps most significantly, FDA can make regulatory decisions, including the approval or authorization of FDA-regulated products, without an inspection if it can verify the information in the marketing submission. RRAs can therefore help support and reduce delays of approvals and authorizations of FDA-regulated products.¹⁸

Conclusion

While RRAs may seem less formal or burdensome than an inspection, FDA-regulated entities should avoid treating RRAs as any less important; the result of an RRA can result in a complete response letter, increased scrutiny, and possibly compliance action. To avoid damaging consequences, and potentially obtain valuable benefits, companies should recognize that RRAs will require similar levels of preparation and care as would an in-person inspection.

Just as companies generally establish SOPs for FDA inspections, they should have similar policies in place for RRAs. Such policies should clarify issues such as who in the company participates in an RRA, how to ensure accurate and complete responses to FDA's requests, how to take notes and log what happens during the RRA, and how to follow up if FDA issues a list of RRA observations. Companies should also have processes in place to consult company or outside counsel when an RRA touches on issues that carry particular significant legal or regulatory risk, such as evidence of significant product quality, sterility, or data integrity issues. RRAs will likely play an important and permanent role in FDA's inspection and oversight program, and companies likely to be assessed must prepare accordingly.

*Sam Williams contributed to this Advisory. Mr. Williams is a graduate of University of Michigan Law School and is employed at Arnold & Porter's Washington, DC office. He is not admitted to the practice of law.

Footnotes

1 Draft Guidance at 3-4.

2 See FDA Safety and Innovation Act (FDASIA), Pub. L. 112-144 § 707 (deeming adulterated any drug that "has been manufactured, processed, packed, or held in any ... establishment and the owner ... of such ... establishment delays, denies, or limits an inspection, or refuses to permit entry or inspection"); cf. FDA, Circumstances that Constitute Delaying, Denying, Limiting, or Refusing a Drug Inspection: Guidance for Industry (Oct. 2014).

3 See Draft Guidance at 12.

4 Id. at 7.

5 Id. at 8.

6 Id.

7 Id.

8 Draft Guidance at 9-10.

9 Id. at 10.

10 Id.

11 Id. at 11-12.

12 Id. at 14.

13 Id. at 12-13.

14 Id. at 15-16.

15 Id. at 13-14.

16 Id. at 5.

17 Id. at 8-9.

18 Id.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.