Data Literacy: The Foundation of Quality Management Maturity?

Pharmaceutical and biotechnology companies generate mountains of data that need to be interpreted into information to make decisions. Knowledge about product quality and patient safety need to be extracted from this information to ensure reliable market supply. How well these extractions are achieved and how well the resulting knowledge is used depends on the data literacy of the organization.

Introduction

The conundrum of the extraction of knowledge from information and information from data are expressed in the following quotes: 

“Where is the wisdom? Lost in the knowledge.
Where is the knowledge? Lost in the information.”

– TS Elliot

“Where is the information? Lost in the data.

Where are the data? Lost in the #@%&! Database!”

– Joe Celko

 

We are drowning in data but starving for information and knowledge. Is the pharmaceutical industry missing the link that leads us past pharmaceutical quality systems (PQS) in ICH Q10¹ and EU GMP Chapter 1² and onto the FDA’s Quality Management Maturity (QMM) program?³ QMM is an FDA initiative to enhance a PQS, based on Philip Crosby’s 1978 book Quality is Free.

 

A definition of data literacy is the ability to explore, understand, and communicate with data meaningfully.⁴

 

We would modify this definition to say the ability to explore, understand, transform, communicate and convince with data meaningfully.

 

Is your organization data literate? Ensuring data integrity (DI) and also able to extract valuable information and knowledge from the abundance of data generated by your systems?

 

Here, we explore what data literacy (DL) is and its impact on an organization’s trajectory towards ICH Q10 and QMM. We explore different organizational maturity levels and how their DL differentiates the companies who simply comply with regulations from the ones that lead the industry through technical innovation. Finally, we consider the financial benefits available in the move to QMM. 

Quo vadis pharma QMM?

Since ICH Q10's 2009 introduction of a PQS, FDA has shifted its focus to QMM.⁵ Why? Because the industry needs to move beyond simply meeting minimum Current Good Manufacturing Practice (CGMP) requirements to consistently deliver life-saving products while also achieving financial goals. Quality is an ongoing journey, not a destination, and there are three stages as shown in Figure 1:

Stage 1: Basic compliance. 21 CFR 211 or CGMP defines the minimum requirements for compliance for manufacturers.⁶ Current in CGMP allows manufacturers the flexibility to use scientifically sound and updated approaches in their design, processing methods and testing procedures.⁷ However, the CGMPs fail to mention management responsibilities for compliance. Any emphasis around DI focuses on computerized system validation (CSV) for computerized systems. There is little or no data governance. 

 

Stage 2: Pharmaceutical quality system. Implementing and maturing a PQS as described in ICH Q10,¹ and incorporating management roles and responsibilities not found in 21 CFR 211 unlike Chapter 1. Data governance and data ownership emerges with DI risk assessments, identifying and closing gaps in processes and systems utilizing two key enablers: quality risk management and knowledge management. They start to digitalize to remove paper and spreadsheets. ^8,9   

 

Stage 3: Quality management maturity. The most desirable stage, QMM integrates business and manufacturing operations with quality practices and advanced manufacturing technologies³ to minimize quality-related failures. QMM provides incentives to maintain a steady supply of crucial medications to patients, including financial, business synergy and regulatory flexibility, including reduced oversight for post-approval changes, to manufacturers who demonstrate a strong commitment to quality. ¹⁰

What sets apart organizations from each stage and how can we get to stage 3?

Data.

Specifically, how data are generated, managed, processed, delivered and understood for knowledge extraction and for decisions to be made, We make data and product. Those two. And you can’t make product without the data (M. Newton, personal communication). 

Figure 1: The journey from CGMP to QMM. Credit: Bob McDowall.

 

What exactly are we doing with the data? The answer to that mirrors the organization’s maturity level and the research backs that up. ¹¹

• CGMP: Simply meeting CGMP regulations is reactive (i.e., accept/reject).
• PQS: Risk and knowledge management outlines a data governance (DG) framework to facilitate built-in DI quality and accountability. Moving toward a proactive organization based on reliable information.
• QMM: To take PQS maturity to the next level, we have to glean the information to generate knowledge, which differentiates each organization uniquely: a QMM fingerprint.

 

It is no longer just a question of safety and efficacy, it’s a question of quality, reliable supply chains, financial incentives and leading the industry in innovation. Patients are harmed by a lack of product availability and/or quality. Perhaps this rating system could be the incentive needed to finally merge quality and business? 

Where’s data literacy? On the highway to hell.

The industry has focused intensely on DI over the past 20 years, because the regulators have, due to multiple data falsification and poor data management practices found during inspections. But have we missed the bigger picture?

Yes.

We often lack an adequate grasp of data's structure, organization and meaning, especially when business processes and data lifecycles span cultures, countries, multiple sites and departments (e.g., sampling in a warehouse or production, QC analysis and QA release). This is precisely where DL becomes crucial. It forms the foundation for process understanding, leading to effective workflows, digitalization, monitoring and review. DL connects teams across procedures, processes and tools within their business context.

DL distinguishes between data (i.e., sensor readings or analytical observations), information (i.e., results, metrics) and knowledge (i.e., historical trends, process improvements).

DL distinguishes a true subject matter expert (SME) as someone who merely memorizes SOPs from someone who intimately understands them. It's about dictating the SOP, rather than being blindly dictated by it. It means knowing when the SOP is wrong or incomplete, versus blindly following the instructions to a wrong outcome.

Minimum data requirements are that they are complete, consistent, accurate, trustworthy, and reliable throughout the data lifecycle,⁸ demand an understanding of data, its relationships, and its impact on systems, processes and people. Governance must establish measures to safeguard this data. The aim is to extract information and knowledge and deliver them to the right people, at the right time, in the right format and for the right purpose, enabling sound business decisions.

DG, DI and Data Quality (DQ) are distinct yet interrelated, as illustrated by the Lego Brick Model. ¹² No governance framework can reliably succeed for a PQS without addressing and prioritizing DL as an essential component.

Figure 2 illustrates that the building blocks of any effective PQS are data gathered in development and manufacturing. These data must be fit for purpose (DQ) and possess integrity to convey reliable information. Information collected over time, combined with accrued experience, yields knowledge about processes, products, systems and workflows.

This data, information and knowledge must be organized and controlled through a DG process to make and justify decisions. Effective DG creates a data-literate organization for business growth and sustainability. Since information and knowledge are dynamic, a foundational and relational understanding of data from every role, along with collaboration, is essential to maintain an effective PQS. Compromising any side of this triangle compromises its structure, leading to poor decisions. 

Figure 2: The data, information and knowledge triangle within a PQS. Credit: Chris Burgess.

Stage 1: Doing the wrong thing, the wrong way

Working to comply with CGMP means that there is not an overall PQS. Here, compliance is not improving.

“Despite the numerous initiatives and guidance, a review of the overall trends in FDA 483 observations and warning letters reveals that CGMP issues, particularly inadequacies that should be addressed by a complete and effective PQS, continue to be the most frequent infractions.”¹³

Some manufacturers struggle with the basics of CGMP and spend most of their time reacting to issues, asking “Why did this happen?”  

Table 1 provides an overview of operations in stage 1 companies and their level of DL.

Data literacy in stage 1 organizations is reactive and rudimentary. The focus is on data from individual batches with the goal of efficient product release (e.g., “Golden Batch”), rather than a broader, more comprehensive understanding and utilization of data across operations. Data’s value is often misunderstood; data are acquired but not properly organized, stored or trended. Data aren't consolidated into effective information from the observed events and only deal with specific incidents or issues. This shows through their regulatory inspections, product issues, recalls, reputation and/or their bottom line, as they tend to have a higher cost of “quality”. ¹⁰

Table 1: Overview of operations in stage 1 pharmaceutical companies and overall DL  assessment.

Topic	Stage 1: CGMP
Management
PQS
People	Not meeting the required combination of education, training and experience Dictated by SOPs Superficial, inadequate training
Quality	Manage batch-related quality issues Write documents for other roles, such as non-conformances for manufacturing Police other people Reactive
Process	Hybrid Siloed within each department resulting in a fragmented approach to CGMP compliance Discontinuous with multiple manual transfers ·  Poor variation control
Technology	Underutilized;  Non-networked or interfaced systems/instruments;  Neglected infrastructure and maintenance; Weak, unprotected IT/OT  Over-reliance on the vendor for qualification Systems managed individually Not readily scalable
GMP records	Heavy reliance on paper records Liberal use of spreadsheets Hybrid records Problems with synchronizing paper and electronic records
DI/DG	Focus on DI through validation No DG in place Data missing, incomplete and/or duplicated Risks not managed; gaps unknown Unhealthy data culture; No accountability defined
APR/PQR	Data collated manually, typically using spreadsheets, at the end of a review period, preventing timely insights and proactive adjustments
Supplier management	Qualification is by questionnaire, results transferred by paper report Poor quality oversight and little or no monitoring of a supplier’s electronic data
Risk management	A rudimentary paperwork activity
DL ability:	Limited

Stage 2: Doing the right thing, the wrong way

“If you’re waiting to perform an annual product review, it’s too late” (P. Baker, personal communication). Stage 2 organizations are not waiting around. They have achieved compliance without necessarily optimizing efficiency. They have acquired a high level of confidence in the integrity of both their processes and systems⁸ because they have invested time and resources to proactively “evaluate data”¹⁴ throughout the product lifecycle to get ahead of any product or process issues. They are sensitive to sources of variation in their processes and can determine causality and predict outcomes, demonstrating effective variation control where “Uncontrolled variation is the enemy of quality” (Dr. W. Edwards Deming). Variation is key in a controlled and well-understood process, ensuring product quality and patient safety.¹⁵ This is achieved using the two ICH Q10 enablers: knowledge management and risk management¹ and the operations and DL assessment are shown in Table 2.

Data literacy in stage 2 organizations signifies proficient data understanding and communication. They actively leverage data analytics within departments, demonstrating a deep and practical engagement with their data to drive inter- and intra-departmental continual improvement. Senior leadership drives risk management is a living process in these organizations and, coupled with the pertinent, reliable information collected, allows for improved, efficient decision-making.² This means risk management is not just a validation deliverable; it’s practiced by all SMEs based on their understanding of data and their experience, being identified, communicated, discussed and mitigated/accepted and monitored.

Table 2: Overview of operations in stage 2 pharmaceutical companies and overall DL assessment.

Topic	Stage 2: ICH Q10 (PQS)
Management	●     Responsibilities defined; ●     Involved in the business; ●     Participates in GEMBA walks; ●     Deviation-driven improvement ●     Active review of PQS
PQS	●     Regulatory expectation/requirement ●     Proactive
People	●     Good understanding of their role; ●     Clear and up-to-date SOPs ●     Tailored, adequate training for each role
Quality	●     Departments work in tandem with QA ●     Some repetition of problems (deviations, CAPAs, investigations, etc.) across time or departments
Process	●     Electronic; well designed; ●     Attempting to integrate ●     Manual, labor-intensive identification of variation control
Technology	●     Leveraged to improve process ●     Digitalization of some processes ●     Awareness of IT/OT security impact
GMP records	●     Moving from hybrid to electronic records and retention ●     Elimination of spreadsheets ●     Some problems with synchronization of hybrid records
DI/DG	●     DI is addressed through DG ●     Governance is in place, but there are gaps which have been assessed and prioritized and are being addressed; ●     Data owners and stewards assigned; ●     Good data culture; ●     Structured data complete, organized, with integrity
APR/PQR	●     Electronic, automated ●     Regular review periods at predetermined intervals
Supplier management	●     Strict oversight and monitoring; ●     Continuous evaluation of services, ●     Response quality, competence; ●     Personalized quality agreements
Risk management	●     Science- and risk-based approaches at each lifecycle stage
DL ability:	●     Proficient

 

Stage 3:  Doing the right thing, the right way

Building upon the understanding that stage 2 organizations achieve compliance without necessarily optimizing efficiency, the pharmaceutical industry is moving towards a future envisioned by regulators as a

"maximally efficient, agile, flexible manufacturing sector that reliably produces high-quality drug products without extensive regulatory oversight".³

For executives, the justification for investing in digitalization hinges on a clear link to positive business outcomes, fostering further support and funding. Ultimately, patients depend on the consistent availability of efficacious and safe products. Stage 3 organizations are uniquely positioned to meet these needs by successfully integrating quality with their business objectives and strategically leveraging the flexibility inherent in CGMP to adopt more efficient and advanced methodologies that maintain quality and drive business growth.

A key indicator of this evolution is the FDA's QMM program. This initiative aims to "objectively rate… pharmaceutical manufacturing sites"¹¹ to ensure a reliable drug supply. The FDA will evaluate sites based on five critical pillars (see also Figure 1), each of which requires some element of DL:

1. Management commitment to quality
2. Business continuity
3. Advanced PQS
4. Technical excellence
5. Employee engagement and empowerment
   
   

See Table 3.

Data literacy in Stage 3 is fluent with complete datasets and a widespread understanding and communication across departments, batches and products. This enhances over time and reduces knowledge loss while promoting innovation. This translates to technical solutions that are technically compliant as SMEs are regulation and guideline savvy.⁸ DL empowers employees to do a better job with less effort. Simply put, data translates into actions, not paperwork.

 

Table 3: Overview of operations in Stage 3 pharmaceutical companies and overall DL assessment.

Topic	Stage 3: QMM
Management	Engaged; working to remove roadblocks;  Facilitates employee engagement, empowerment;  Two-way trust;  Quality included in board of directors Meets Objective 4 from CPG 7346.832: Quality in Pharm Dev [14]
PQS	Predictive  Advanced continuous product quality reviews;
People	Training with demonstrable understanding and competence Empowered to identify, document, own and solve problems;  Pride in workmanship;  Proactive use of information and knowledge to improve business processes and decision-making AI/ML: Elimination of cumbersome, manual tasks to save time  Knowledgeable humans in the loop
Quality	Shared ownership of unusual problems with QA and Operations No repetition of problems (deviations, CAPAs, investigations, etc.)
Process	Process and product mastery  Analytical procedures and manufacturing processes: defined and validated design space   Concise variation control in processes and technology
Technology	Extensive digitalization of processes Driven by advanced innovation; Agile; Unified data platforms; advanced analytics
GMP records	Electronic records  Entire data lifecycle secured Elimination of spreadsheets Data analytics usage
DI/DG	DG optimized;  DI is the foundation of data analytics and decision-making; All data types (structured and unstructured) and formats integrated, organized, centralized Healthy data culture
APR/PQR	Batch to batch, proactive APR/PQR  Quick reaction to adverse trends
Supplier management	Real-time analytics permit continuous assessment of supplier quality;  Advanced auditing and monitoring to detect fraudulent or unreliable testing Collaboration to drive services and products to meet industry needs Suppliers use the manufacturer’s systems to maintain the data in-house
Risk management	Continuous and data-driven which leverages end-to-end organizational information to mitigate potential supply disruptions Quantitative and qualitative risk management aligned with organization strategy Unplanned events (e.g., CAPA, deviations) feed discovered risks into risk management processes. Risk management is linked to knowledge management
DL ability:	Fluent

Economics of quality management initiatives

The biggest roadblock to digital leadership is convincing senior management to pursue digital and cultural transformation.

 

In the recent FDA white paper titled "Quality Management Initiatives in the Pharmaceutical Industry: An Economic Perspective",¹⁶ the economics of the QMM initiative demonstrate that even suboptimal investment will generate sufficient benefits to persuade senior management to fund digital transformation. The summary is shown in Figure 3, which illustrates the relationship between investments in quality management initiatives.

 

Suboptimal funding can lead to further investment to generate business benefits and cost savings, as early wins (e.g., decreased downtime and compliance costs) create a compounding effect that builds executive buy-in for broader digital adoption. This aligns with the QMM program's goal of elevating quality beyond CGMP minimums, ultimately reducing drug shortages and enhancing pharmaceutical supply chain stability through reducing waste, preventing recalls, and enhancing your brand’s reputation.

Figure 3: Economic incentive for quality management initiative. Credit: Bob McDowall. 

Summary

We have reached the fork in the road where pharmaceutical companies can no longer operate on hope and a prayer or hide behind mediocrity. The two options are to master your products and data to lead the market OR accrue more and more regulatory scrutiny that affects your profit margins. Regulators want to see a “maximally efficient, agile, flexible manufacturing sector that reliably produces high-quality drug products without extensive regulatory oversight”[3]

 

The difference between the two options is a motivated senior leadership team and data literate staff. Do you want a barely compliant organization or an efficient one? A compliant organization is still focused on chasing DI and investigating “human error”. There is tremendous monetary and quality value in the available data and an efficient, data literate organization confidently leverages built-in DI and DQ to address bottlenecks to achieve quality maturity and serve patients and ensure a reliable supply chain.

 

Acknowledgements

We would like to thank Peter Baker, Chris Burgess and Mark Newton for their constructive review of our article.