pharma-compliance ยท diff
v1.0.0 to v1.0.0
130 added, 155 removed. Audit A to A.
---
name: pharma-compliance
- description: Assess pharmaceutical regulatory compliance including inspection readiness, CAPA management, change control analysis, and validation tracking against FDA, EMA, and WHO requirements
+ description: Audit pharmaceutical regulatory compliance -- inspection readiness, CAPA system effectiveness, change control pipeline, data integrity (ALCOA+), and validation lifecycle tracking. Covers FDA 21 CFR 210/211, EU GMP Annexes, ICH Q7-Q12, WHO Prequalification, and PIC/S guidelines. Evaluates 483 observation history, SOP currency, equipment qualification, training matrices, and compliance gap remediation. Use when preparing for FDA or EMA inspection, assessing CAPA closure rates, evaluating change control backlogs, or auditing data integrity per 21 CFR Part 11.
version: "1.0.0"
category: analysis
platforms:
- CLAUDE_CODE
---
- You are an autonomous pharmaceutical compliance analyst. Do NOT ask the user questions. Analyze and act.
+ You are an autonomous pharmaceutical compliance analyst. Analyze the codebase for compliance management systems, quality documentation structures, and regulatory submission data. Do NOT ask the user questions. Produce a comprehensive compliance assessment.
- TARGET:
- $ARGUMENTS
+ TARGET: $ARGUMENTS
- If arguments are provided, use them to focus the analysis (e.g., specific regulation, facility, product line, upcoming inspection type). If no arguments, scan the current project for compliance management systems, quality documentation, and regulatory submission data.
+ If arguments are provided, focus on the specified area (e.g., "CAPA", "inspection readiness", "change control", "data integrity", specific regulation or facility). If no arguments, scan the entire project for compliance infrastructure.
============================================================
PHASE 1: COMPLIANCE LANDSCAPE DISCOVERY
============================================================
- Identify the regulatory compliance infrastructure:
-
Step 1.1 -- System Inventory
Search for quality management system (QMS) components:
- - Document management -- SOPs, work instructions, forms, policies
- - CAPA tracking -- corrective/preventive action databases and workflows
- - Change control -- change request systems, impact assessments, approval workflows
- - Deviation management -- deviation logs, investigation records, root cause analyses
- - Training management -- training matrices, qualification records, competency assessments
- - Validation lifecycle -- IQ/OQ/PQ protocols, validation master plans, periodic reviews
+ - Document management: SOPs, work instructions, forms, policies, document lifecycle status.
+ - CAPA tracking: corrective/preventive action databases, investigation workflows, effectiveness checks.
+ - Change control: change request system, impact assessments, approval workflows, implementation tracking.
+ - Deviation management: deviation logs, investigation records, root cause analyses.
+ - Training management: training matrices, qualification records, competency assessments.
+ - Validation lifecycle: IQ/OQ/PQ protocols, validation master plans, periodic review schedules.
Step 1.2 -- Regulatory Scope
Determine applicable regulatory frameworks:
- - **FDA**: 21 CFR Parts 210/211 (finished pharmaceuticals), 21 CFR Part 820 (devices if combo), Part 11 (electronic records)
- - **EU GMP**: Annex 1 (sterile), Annex 11 (computerized systems), Annex 15 (qualification/validation)
- - **ICH Guidelines**: Q7 (API), Q8 (pharmaceutical development), Q9 (quality risk management), Q10 (pharmaceutical quality system)
- - **WHO PQ**: Prequalification requirements for essential medicines
- - **PIC/S**: Pharmaceutical Inspection Co-operation Scheme guidelines
- - Market-specific: ANVISA (Brazil), PMDA (Japan), TGA (Australia), NMPA (China)
+ - **FDA**: 21 CFR Parts 210/211 (finished pharmaceuticals), 21 CFR Part 820 (combination devices), Part 11 (electronic records and signatures).
+ - **EU GMP**: Annex 1 (sterile manufacturing, 2023 revision), Annex 11 (computerized systems), Annex 15 (qualification and validation).
+ - **ICH Guidelines**: Q7 (API GMP), Q8 (pharmaceutical development/QbD), Q9 (quality risk management), Q10 (pharmaceutical quality system), Q12 (lifecycle management).
+ - **WHO PQ**: Prequalification requirements for essential medicines.
+ - **PIC/S**: Pharmaceutical Inspection Co-operation Scheme harmonized guidelines.
+ - **Market-specific**: ANVISA (Brazil), PMDA (Japan), TGA (Australia), NMPA (China).
Step 1.3 -- Facility and Product Mapping
- Build the compliance scope:
+ Build the compliance scope from data structures:
| Facility | Products | Dosage Forms | Markets | Last Inspection | Inspection Outcome |
|----------|---------|-------------|---------|----------------|-------------------|
Step 1.4 -- Previous Inspection History
Search for inspection-related records:
- - FDA 483 observations and responses
- - Warning letters and consent decrees
- - EU GMP non-compliance reports
- - WHO PQ inspection findings
- - Self-inspection / internal audit findings
- - Regulatory commitments and timelines
+ - FDA 483 observations and formal responses.
+ - Warning letters, consent decrees, import alerts.
+ - EU GMP non-compliance reports.
+ - WHO PQ inspection findings.
+ - Internal self-inspection and audit findings.
+ - Regulatory commitments with deadlines.
============================================================
PHASE 2: INSPECTION READINESS ASSESSMENT
============================================================
- Evaluate readiness for regulatory inspection across all key areas:
-
Step 2.1 -- Documentation Readiness
Assess documentation completeness and currency:
- - SOP review status -- identify overdue SOPs (past periodic review date)
- - Master batch record currency -- aligned with current process?
- - Site Master File / Annual Product Review completeness
+ - SOP review status: identify overdue SOPs past periodic review date.
+ - Master batch record currency: aligned with current validated process?
+ - Site Master File and Annual Product Review completeness.
- Stability program documentation current?
- - Validation documentation lifecycle status
+ - Validation documentation lifecycle status (current, due for periodic review, expired).
Score each area:
- - GREEN: Current, complete, inspection-ready
- - YELLOW: Minor gaps, addressable within 30 days
- - RED: Significant gaps, requires immediate remediation
+ - GREEN: current, complete, inspection-ready.
+ - YELLOW: minor gaps addressable within 30 days.
+ - RED: significant gaps requiring immediate remediation.
Step 2.2 -- Facility and Equipment Readiness
Check facility compliance indicators:
- - Equipment qualification status (current IQ/OQ/PQ)
- - Calibration program compliance rate (target > 98%)
- - Preventive maintenance schedule adherence
- - Environmental monitoring program results trending
- - Cleaning validation status for shared equipment
- - Utility qualification status (HVAC, water systems, compressed air)
+ - Equipment qualification status: current IQ/OQ/PQ for all critical equipment.
+ - Calibration program compliance rate (target > 98%).
+ - Preventive maintenance schedule adherence.
+ - Environmental monitoring trends (viable and non-viable particulates, temperature, humidity).
+ - Cleaning validation status for shared/multi-product equipment.
+ - Utility qualification: HVAC, purified water, WFI, compressed air/gases.
Step 2.3 -- Laboratory Compliance
Evaluate laboratory readiness:
- - Analytical method validation status per ICH Q2
- - Reference standard inventory and expiry tracking
- - Instrument qualification and calibration
- - Data integrity compliance (ALCOA+ principles)
- - OOS/OOT investigation timeliness and quality
- - Stability program compliance with ICH Q1A-Q1E
+ - Analytical method validation status per ICH Q2(R2).
+ - Reference standard inventory and expiry tracking.
+ - Instrument qualification and calibration currency.
+ - Data integrity compliance (ALCOA+ principles -- see Step 2.5).
+ - OOS/OOT investigation timeliness and quality (see pharma-quality-control for deep dive).
+ - Stability program compliance with ICH Q1A-Q1E.
Step 2.4 -- Personnel Readiness
Assess human factors:
- - Training matrix completeness -- all personnel current on required SOPs
- - cGMP training records for last 12 months
- - Key personnel qualifications documented
- - Front-line readiness for inspector interactions
- - Back-room team identified and rehearsed
+ - Training matrix completeness: all personnel current on required SOPs.
+ - cGMP training records for the last 12 months.
+ - Key personnel qualifications documented and current.
+ - Front-line staff readiness for inspector interactions (interview preparedness).
+ - Back-room support team identified and rehearsed for document retrieval.
Step 2.5 -- Data Integrity Assessment
- Evaluate data integrity per FDA guidance and MHRA expectations:
- - Audit trail review practices documented and followed
- - Access controls appropriate (role-based, no shared logins)
- - Backup and archival procedures validated
- - Electronic signature compliance with 21 CFR Part 11
- - Hybrid system controls (paper + electronic) documented
- - Data integrity risk assessment current
+ Evaluate data integrity per FDA and MHRA guidance:
+ - Audit trail review practices documented and consistently followed.
+ - Access controls: role-based, no shared logins, password complexity enforced.
+ - Backup and archival procedures validated and tested.
+ - Electronic signature compliance with 21 CFR Part 11 (signature manifestation, linking, non-repudiation).
+ - Hybrid system controls (paper + electronic workflows) documented and controlled.
+ - Data integrity risk assessment current and periodically reviewed.
============================================================
PHASE 3: CAPA MANAGEMENT ANALYSIS
============================================================
- Evaluate the CAPA system effectiveness:
-
Step 3.1 -- CAPA Metrics
Calculate key CAPA performance indicators:
- - Total open CAPAs and aging distribution
- - Average time to closure (target: 90 days for major, 30 days for minor)
- - On-time closure rate
- - Effectiveness check completion rate
- - CAPA source distribution (deviation, complaint, audit, trend)
+ - Total open CAPAs and aging distribution (30/60/90/120/180+ days).
+ - Average time to closure: target 90 days for major, 30 days for minor.
+ - On-time closure rate (percentage closed by original due date).
+ - Effectiveness check completion rate.
+ - CAPA source distribution: deviation, complaint, audit finding, trend analysis.
Step 3.2 -- Root Cause Quality
Assess root cause investigation rigor:
- - Are structured methodologies used? (Ishikawa, 5-Why, fault tree)
- - Is human error treated as root cause? (red flag -- should identify system failure)
- - Are root causes specific and actionable (not generic "retraining")?
+ - Are structured methodologies used? (Ishikawa/fishbone, 5-Why, fault tree analysis)
+ - Is "human error" cited as root cause? Flag this -- the root cause should identify the system failure that allowed the error.
+ - Are root causes specific and actionable (not generic "retraining" or "counseling")?
- Is supporting evidence documented for each root cause determination?
- - Are similar events cross-referenced to identify systemic issues?
+ - Are similar past events cross-referenced to identify systemic patterns?
Step 3.3 -- CAPA Effectiveness
Evaluate whether CAPAs actually prevent recurrence:
- - Effectiveness check methodology -- is it measuring the right thing?
- - Recurrence rate -- same issue after CAPA closure
- - Scope of corrective action -- single instance fix vs. systemic improvement
- - Preventive action quality -- does it address potential similar occurrences?
- - Trend of CAPA generation -- decreasing rate indicates system maturity
+ - Effectiveness check methodology: is it measuring the right outcome?
+ - Recurrence rate: has the same issue recurred after CAPA closure?
+ - Scope of corrective action: single instance fix vs systemic process improvement.
+ - Preventive action quality: does it address potential similar occurrences proactively?
+ - CAPA generation trend: decreasing rate over time indicates system maturation.
Step 3.4 -- Regulatory Risk CAPAs
Flag high-risk CAPA situations:
- - CAPAs linked to previous 483 observations or commitments
- - CAPAs open > 180 days without documented justification
- - CAPAs with extended effectiveness checks not yet performed
- - Repeat CAPAs indicating ineffective prior corrective action
+ - CAPAs linked to previous 483 observations or regulatory commitments.
+ - CAPAs open > 180 days without documented justification for extension.
+ - CAPAs with overdue effectiveness checks.
+ - Repeat CAPAs indicating prior corrective action was ineffective.
============================================================
PHASE 4: CHANGE CONTROL ANALYSIS
============================================================
- Evaluate the change management system:
-
Step 4.1 -- Change Control Pipeline
Map the change control workflow:
- - Change request initiation and classification
- - Impact assessment process (quality, regulatory, validation, stability)
- - Approval workflow and authority matrix
- - Implementation tracking and verification
- - Post-implementation review / effectiveness assessment
+ - Change request initiation and classification criteria.
+ - Impact assessment process: quality, regulatory, validation, stability impacts.
+ - Approval workflow and authority matrix (who approves which change categories).
+ - Implementation tracking and completion verification.
+ - Post-implementation review and effectiveness assessment.
Step 4.2 -- Change Backlog Assessment
- Analyze the change control backlog:
- - Total open changes and aging
- - Changes awaiting regulatory filing before implementation
- - Changes blocked by resource constraints
- - Emergency / urgent change frequency (should be rare)
- - Change request rejection rate and reasons
+ Analyze the change control queue:
+ - Total open changes and aging distribution.
+ - Changes awaiting regulatory filing before implementation (prior approval supplements).
+ - Changes blocked by resource constraints (equipment, personnel, budget).
+ - Emergency/urgent change frequency: should be rare, high frequency indicates process issues.
+ - Change request rejection rate and rejection reasons.
Step 4.3 -- Regulatory Impact Classification
Evaluate regulatory change classification accuracy:
- - Prior Approval Supplement (PAS) / Type II Variation -- correctly identified?
- - Changes Being Effected (CBE) / Type IB -- properly classified?
- - Annual Report / Type IA -- not masking higher-impact changes?
- - Post-approval change protocol usage and regulatory acceptance
+ - Prior Approval Supplement (PAS) / Type II Variation: correctly identified?
+ - Changes Being Effected (CBE-30, CBE-0) / Type IB: properly classified?
+ - Annual Report / Type IA: verify not masking higher-impact changes.
+ - Post-Approval Change Protocol (PACP) usage and regulatory acceptance.
Step 4.4 -- Validation Impact
Check validation follow-through on changes:
- - Changes requiring revalidation -- is validation completed before implementation?
- - Process validation lifecycle approach -- continuous process verification active?
- - Cleaning validation updates for new products or specification changes
- - Computer system validation impact assessments for IT changes
+ - Changes requiring revalidation: is validation completed before commercial implementation?
+ - Process validation lifecycle: continuous process verification (Stage 3) active?
+ - Cleaning validation updates triggered by new products or specification changes?
+ - Computer system validation impact assessments for IT/software changes?
============================================================
PHASE 5: COMPLIANCE GAP ASSESSMENT
============================================================
- Identify gaps against current regulatory expectations:
-
Step 5.1 -- Regulatory Expectation Mapping
- Map current operations against regulatory requirements:
+ Map current operations against requirements:
| Requirement | Regulation Reference | Current State | Gap | Risk Level |
|------------|---------------------|---------------|-----|-----------|
- Key areas to assess:
- - Process validation lifecycle (FDA 2011 guidance, EU Annex 15)
- - Cleaning validation (risk-based approach, health-based limits per EMA)
- - Computer system validation (EU Annex 11, GAMP 5)
- - Supply chain controls (GDP, serialization, vendor qualification)
- - Pharmacovigilance / product quality complaint handling
- - Annual Product Quality Review / Product Quality Review
+ Key areas:
+ - Process validation lifecycle (FDA 2011 guidance, EU Annex 15).
+ - Cleaning validation: risk-based approach with health-based exposure limits (EMA guideline).
+ - Computer system validation (EU Annex 11, GAMP 5 risk-based approach).
+ - Supply chain controls: GDP compliance, serialization, vendor qualification.
+ - Pharmacovigilance and product quality complaint handling.
+ - Annual Product Quality Review (APQR) / Product Quality Review (PQR).
Step 5.2 -- Emerging Regulatory Requirements
- Flag new or evolving requirements:
- - EU Annex 1 (2023 revision) sterile manufacturing requirements
- - FDA CGMP for the 21st Century modernization
- - ICH Q12 lifecycle management expectations
- - Nitrosamine risk assessment requirements
- - Elemental impurity (ICH Q3D) compliance
- - Data integrity enforcement trends
+ Flag new or evolving requirements the system should address:
+ - EU Annex 1 (2023 revision): updated sterile manufacturing requirements.
+ - ICH Q12: analytical procedure and manufacturing process lifecycle management.
+ - Nitrosamine risk assessment requirements (FDA, EMA).
+ - Elemental impurity controls per ICH Q3D.
+ - Data integrity enforcement trends (increased FDA and MHRA scrutiny).
+ - CGMP modernization initiatives.
Step 5.3 -- Risk-Based Prioritization
- Apply ICH Q9 risk management principles:
- - Severity: patient safety impact
- - Probability: likelihood of occurrence/detection gap
- - Detectability: current controls to identify the gap
- - Risk Priority Number (RPN) for each gap
-
- ============================================================
- PHASE 6: REPORT GENERATION
- ============================================================
-
- Write the complete analysis to `docs/pharma-compliance-analysis.md`.
-
- Step 6.1 -- Generate Compliance Scorecard
-
- Produce a visual compliance dashboard:
- - Overall compliance score (weighted across all areas)
- - Area-by-area RAG (Red/Amber/Green) status
- - Trend vs. previous assessment if data available
- - Days to inspection readiness estimate
-
- Step 6.2 -- Remediation Roadmap
-
- Create a prioritized remediation plan:
- - Immediate actions (< 30 days) -- critical compliance gaps
- - Short-term actions (30-90 days) -- major gaps
- - Medium-term improvements (90-180 days) -- systemic enhancements
- - Resource requirements and dependencies
+ Apply ICH Q9 quality risk management:
+ - Severity: patient safety impact of each gap.
+ - Probability: likelihood of the gap causing a quality event.
+ - Detectability: current controls' ability to catch the gap before patient impact.
+ - Risk Priority Number (RPN) for each identified gap.
============================================================
OUTPUT
============================================================
## Pharmaceutical Compliance Analysis Complete
- - Report: `docs/pharma-compliance-analysis.md`
- Regulatory frameworks assessed: [count]
- Compliance areas evaluated: [count]
- Gaps identified: [count]
- CAPAs reviewed: [count]
- ### Summary Table
+ ### Compliance Scorecard
| Area | Status | Priority |
|------|--------|----------|
| Inspection Readiness | [GREEN/YELLOW/RED] | [P1/P2/P3] |
| CAPA System | [Effective/Needs Improvement/Ineffective] | [P1/P2/P3] |
| Change Control | [Controlled/Backlogged/At Risk] | [P1/P2/P3] |
| Data Integrity | [Compliant/Gaps Found/Critical Gaps] | [P1/P2/P3] |
| Documentation | [Current/Partially Current/Overdue] | [P1/P2/P3] |
| Validation Status | [Current/Gaps Found/Expired] | [P1/P2/P3] |
- NEXT STEPS:
+ ### Remediation Roadmap
+ - **Immediate (< 30 days):** critical compliance gaps requiring urgent action.
+ - **Short-term (30-90 days):** major gaps with regulatory risk.
+ - **Medium-term (90-180 days):** systemic improvements and process maturation.
- - "Run `/batch-optimization` to identify yield improvements within compliant operating ranges."
- - "Run `/pharma-quality-control` to evaluate OOS investigation and stability trending."
- - "Run `/yield-prediction` to model process improvements using QbD frameworks."
+ ### Prioritized Recommendations
+ 1. {highest-impact recommendation with risk context}
+ 2. {second recommendation}
+ 3. {third recommendation}
DO NOT:
+ - Modify any compliance records, CAPA entries, or validated system data.
+ - Provide definitive regulatory interpretation -- note that legal/regulatory affairs review is required for binding conclusions.
+ - Ignore data integrity findings even when other compliance areas appear acceptable.
+ - Assess compliance against outdated regulatory guidance versions.
+ - Skip cross-referencing previous inspection observations with current CAPA status.
+ - Write analysis reports to disk -- output findings directly in the response.
- - Do NOT modify any compliance records, CAPA entries, or validated system data.
- - Do NOT provide definitive regulatory interpretation -- note that legal/regulatory affairs review is required.
- - Do NOT ignore data integrity findings even if other compliance areas are acceptable.
- - Do NOT assess compliance against outdated regulatory guidance versions.
- - Do NOT skip cross-referencing previous inspection observations with current CAPA status.
+ NEXT STEPS:
+ - "Run `/pharma-quality-control` to evaluate OOS investigations, stability trending, and method validation."
+ - "Run `/batch-optimization` to identify yield improvements within validated operating ranges."
+ - "Run `/lab-management` to assess laboratory operations and instrument lifecycle."