Background

FDA acknowledged in the press release announcing the draft guidance that disruptions in the U.S. drug supply continue to occur due to drug quality problems, vulnerabilities in the global supply chain, unanticipated increases in demand, market withdrawals of drugs, and natural disasters. In 2019, in an effort to address the national drug shortage, the federal Drug Shortages Task Force released a report that called for the adoption of risk management plans to proactively assess risk and to predict and prevent supply disruptions that could potentially lead to a drug shortage. Then in 2020, Congress passed the CARES Act to require certain manufacturers to develop, maintain, and implement, as appropriate, a “redundancy risk management plan” that identify and evaluate risks to a drug’s supply. The draft guidance drops the word “redundancy” from the required risk management plan, and acknowledges that redundancy (e.g., more than one supplier) is an example of a risk control strategy but is not the only possible way to control supply risks.

The statutory requirement for each manufacturer of a covered drug, to develop, maintain and implement a supply risk management plan for such covered drugs (including APIs) went into effect in September of 2020. In addition, the statute expressly grants FDA the authority to inspect, copy, or request such risk management plans either during an inspection or as part of an information request in lieu of, or in support of, an inspection. However, Congress failed to grant FDA any mechanisms to enforce the new requirements for supply risk management plans. The failure to develop, maintain or implement such a risk management plan is not linked to any Prohibited Act under 21 USC 331 or otherwise connected to any consequence, penalty, or other enforcement provision. In contrast, Congress created a noncompliance letter mechanism for failure to submit required information regarding the discontinuance or interruption in the production of lifesaving drugs. See 21 USC 356c(f). Nevertheless, drug manufacturers should not be surprised if FDA starts requesting supply risk management plans during on-site inspections and through information requests. It is also possible that, in the future, Congress will further expand FDA’s enforcement authority with regard to this requirement.

The draft guidance also expansively interprets the statutory requirement for supply risk management plans by interpreting the term “manufacturer” to extend to an application-holder, as a “primary stakeholder,” even if the application holder relies on contract manufactures for the actual manufacturing. Although this interpretation goes beyond a literal interpretation of the statute, it is aligned with FDA’s 2015 implementing regulations for 21 USC 356c, which apply to application holders “the responsibility for reporting to FDA a permanent discontinuance or an interruption in manufacturing, whether the product is manufactured by the applicant itself or for the applicant under contract with one or more different entities.” 80 FR 38915, 38917 (Jul. 8, 2015).

Who should implement a risk management plan?

The draft guidance defines stakeholders in the manufacturing supply chain for drugs and describes the products for which RMPs would be required. FDA points out that these stakeholders include both primary stakeholders, which are entities that determine which materials and services are necessary to produce a drug product; and secondary stakeholders, who have more detailed insight into specific segments of the supply chain for a drug product but may not have an understanding of its entirety. These stakeholders include NDA/BLA/ANDA holders, both finished product and API manufacturers, and other parties as well, such as inactive ingredient manufacturers, packagers, and distributors. According to the Agency, these primary and secondary stakeholders are among those that are subject to the risk management plan requirements. However, FDA recommends that all stakeholders consider developing, maintaining and implementing risk management plans, even for products for which such RMPs are not required by statute.

The types of drugs for which RMPs are required by statute include:

• Life-sustaining and life-supporting drugs, including APIs

• Drugs, including APIs, to prevent or treat a debilitating disease or condition, including for emergency medical care or surgery or is critical to the public health during a public health emergency

• Any associated medical device used for the preparation or administration of these drugs

The draft guidance also spotlights seven other types of other drugs for which RMPs are recommended:

• Drugs to treat rare diseases

• Drugs that lack appropriate alternatives

• Medical countermeasures used in the event of a potential public health emergency stemming from a terrorist attack

• Sole source drugs

• Drugs with only one API manufacturer in the product’s supply chain that has been appropriately qualified by the quality unit of the finished dosage form (FDF) establishment

• Drugs with only one FDF manufacturer in the product’s supply chain

• Drugs manufactured in a facility with an inspection in the last 5 years that was classified as official action indicated (OAI)

What should a risk management plan include?

FDA recommends using the quality risk management process and principles described in ICH Q9 as the framework to develop an effective RMP. The RMP should consist of three elements: a risk assessment, risk control and risk review. The draft guidance adds to the elements of that framework, describes considerations for stakeholder oversight for RMPs, and aims to assist with the interpretation of the quality risk management process within the context of developing RMPs.

The draft guidance states that RMPs should result in understanding the risk of supply disruptions that may lead to shortages across the supply chain, integrates redundancy into the supply chain, improves the forecasting of demand changes at all stages of production, maintains sustainable compliance, improves overall incentives between purchasers and manufacturers, and fosters collaboration with regulators. In addition, FDA recommends that the primary stakeholder RMPs should also include plans to repair the supply chain after a disruption.

FDA also recommends that the primary stakeholder share as much of its RMP as possible with secondary and other stakeholders of the drug product to enable secondary and other stakeholders to incorporate the broad strategies of the primary stakeholder’s RMP into their own plans and contextualize the risks identified in the primary stakeholder’s RMP, specifically for the manufacturing facility.

An appendix to the draft guidance provides helpful risk factors that should be considered when developing specific RMPs to mitigate the potential for drug shortages. A few notable risk factors, applicable to different stakeholders, include:

• weaknesses in the manufacturing process specific to individual drugs or in inventory management at the manufacturing facility

• whether the drug manufacturing relies on incapable or unreliable equipment

• whether any of the suppliers of drug product container-closure systems or device constituent parts

• geographic risk factors, including potential for natural disasters, political instability and regulatory uncertainty

• manufacturing vulnerabilities, including lack of manufacturing capacity to meet an unexpected surge in demand, inadequate backup manufacturing capability, lack of availability of contract manufacturers or other alternate sources, lack of availability of laboratory services to support manufacturing, and inadequacy of management oversight

• potential vulnerability to cyber threats

• capability and historical record of the facilities in the supply chain, including whether there is a history of sustained current good manufacturing practice (CGMP) compliance, including the presence or recurrence of quality issues, CGMP violations, potential for major defects and recalls, inspectional findings at the facilities in the supply chain, and adequacy of quality management oversight, that might affect the availability of the drug

• weaknesses in the infrastructure and utilities; water systems; heating, ventilation, air conditioning, and environmental control; and the proximity of support services such as laboratory testing

Comments on the draft guidance are due July 19, 2022. If you may wish to submit a comment, or have any questions about risk management plans, please contact any of the authors of this alert or the Hogan Lovells attorney with whom you regularly work.

Authored by David Horowitz and Lowell Zeta