Contamination Control Strategy under Annex 1: what paragraphs 2.3 to 2.6 require of the CCS

The abbreviation CCS appears around fifty times in the text of the revised EU GMP Annex 1, and in six of those places the wording is "justified in the CCS". So the Annex does more than require that a Contamination Control Strategy exists. At named points it requires the strategy to justify decisions.

The revised Annex 1 (C(2022) 5938 final) has applied since August 25, 2023, with only paragraph 8.123 on lyophilizers applying since August 25, 2024. The framework and our services are described on the Annex 1 (Sterile Manufacturing) page; this article is about what the text requires of the CCS.

What paragraph 2.3 requires

A CCS "should be implemented across the facility", that is, throughout the whole site, in order to define all critical control points and to assess the effectiveness of all controls: the design, procedural, technical and organizational ones as well as the monitoring measures. Its effectiveness should form part of the periodic management review.

The last sentence of the paragraph matters most in practice. Existing control systems that are appropriately managed "may not require replacement", but they should be referenced in the CCS, "and the associated interactions between systems should be understood". The Annex does not call for a new world of documents. It calls for the interplay of the existing systems to be understood. A CCS that links SOPs meets the first part. In our reading, it meets the second part only once every control states which risk it addresses and how its effectiveness is measured.

The Glossary defines the CCS as "a planned set of controls for microorganisms, endotoxin/pyrogen and particles, derived from current product and process understanding". Derived from product and process understanding: that derivation is what separates a collection from a strategy.

The order of priority the Annex sets

Paragraph 2.2 ranks the priorities of quality risk management: first the design of facility, equipment and processes, then well-designed procedures, and finally monitoring systems "as the element that demonstrates that the design and procedures have been correctly implemented". The next sentence reads: "Monitoring or testing alone does not give assurance of sterility." Paragraph 9.1 expressly places the site's monitoring program within the CCS: each element on its own is of limited reliability and is no indicator of asepsis; only together do the results help confirm the reliability of design, validation and operation.

For the CCS this means that a "Monitoring" chapter with a sampling plan and limits is the third step. Design and procedures have to come before it and explain why the monitoring is laid out this way and not otherwise.

Sixteen elements and how they interact

Paragraph 2.5 lists what a CCS should consider at a minimum, expressly "but are not limited to": design of plant and processes including the associated documentation, premises and equipment, personnel, utilities, raw material and in-process controls, containers and closures, vendor approval and outsourced activities, process risk management, process and sterilization validation, preventive maintenance, cleaning and disinfection, monitoring systems including an assessment of whether alternative detection methods can be introduced, prevention mechanisms from trend analysis to CAPA, and continuous improvement based on all of the above.

The list is a usable outline, but on its own it does not make a strategy. Paragraph 2.4 says why: the measures against contamination form "a series of interrelated events and measures" that are typically assessed individually, "but their collective effectiveness should be considered together". Paragraph 2.6 requires changes to the systems in place to be assessed "for any impact on the CCS before and after implementation". A change control that updates the CCS only after implementation covers half of that.

Where the rationale comes from

Paragraph 3.1 item iv anchors the derivation in the pharmaceutical quality system: risk management is applied in the development and maintenance of the CCS, and it "should be documented and should include the rationale for decisions taken in relation to risk reduction and acceptance of residual risk". Item v places oversight of the state of control with senior management; the outcome of risk management should be reviewed regularly, during change, in the event of a significant emerging problem and during the periodic product quality review.

The scope of the Annex says two things about this. First, QRM applies to the document in its entirety and is not normally referred to again in individual paragraphs. Second, the limits, frequencies and ranges it specifies should be considered a minimum requirement; they are stated due to "historical regulatory experience of issues". Anyone who adopts a frequency from the Annex has demonstrated the minimum, but not yet its suitability for their own plant. The reasons for the revision name as their basis the tools "as described in the ICH Q9 and Q10 guidelines". The current version is ICH Q9(R1), and its section 5.1 states that formality in quality risk management is not a binary concept but a continuum, whose degree depends on the uncertainty, importance and complexity of the decision.

From this follows the test question for every measure in the CCS: why exactly this frequency, this limit, this airlock? The answer "it is in the SOP" points to a document that owes the same answer. The answer paragraph 3.1 requires is a documented risk assessment with the rationale for why the remaining risk is accepted.

Where the Annex expressly expects the justification in the CCS

At several points the text names the CCS as the place where a decision should be justified or defined. A selection:

• Barrier systems (paragraph 4.3): RABS or isolators are beneficial in minimizing microbial contamination associated with direct human interventions in the critical zone. Their use "should be considered in the CCS", and any alternative approach to the use of RABS or isolators should be justified. The text expresses no preference for either technology; paragraph 4.18 calls them "different technologies".
• Background environment (paragraph 4.20): open isolators generally a minimum of grade C, closed isolators a minimum of grade D, and "the decision on the background classification should be based on risk assessment and justified in the CCS". RABS used for aseptic processing a minimum of grade B.
• Glove replacement (paragraph 4.21): the frequency "should be defined within the CCS".
• Sterilization validation (paragraph 8.39): load patterns other than the worst case are validated "at a frequency justified in the CCS".
• Size of the aseptic process simulation (paragraph 9.40): the justification for the number of units to be filled "should be clearly captured in the CCS".

Anyone who looks for these points in their own CCS and finds a justification for each has passed a first check; the Annex names the CCS as the place for a justification or a defined setting at further points as well.

Intervention list, aseptic process simulation and monitoring belong together

Paragraph 8.16 requires an authorized list of allowed and qualified interventions, both inherent and corrective. The procedures for them "should be first evaluated via risk management and APS and be kept up to date". Paragraph 9.34 closes the loop from the other side: the aseptic process simulation (APS) should include the interventions of the routine process in a similar manner and frequency, "based on assessed risks posed to product sterility".

Under paragraph 9.32, the APS should not be considered the primary means to validate the aseptic process; the effectiveness of the aseptic process should be determined through process design, adherence to the quality system, process controls, training and the evaluation of monitoring data. Under paragraph 9.38, the APS is normally repeated twice a year for each aseptic process, each filling line and each shift. Paragraph 9.46 sets the target at zero growth: any contaminated unit means a failed APS, followed by a root cause investigation, normally a minimum of three successful consecutive repeat simulations and a review of all records relating to aseptic production since the last successful APS.

In our reading, this produces a requirement for the CCS that the text does not state in a single sentence: the intervention list, the APS design and the monitoring program must trace back to the same risk assessment. Otherwise, when a unit turns out contaminated, the investigation under paragraph 9.46 faces routine data for which nobody has defined in advance what they will be used for.

Three questions for the next review

Three points can be checked on your own CCS without great effort; the selection is ours:

• Can any given measure be traced backwards, from the measure to the risk, from the risk to the documented assessment with the rationale for the accepted residual risk (paragraph 3.1 item iv)?
• Is there a justification in the CCS for each of the points named above, from the background classification to the number of APS units?
• When was the CCS last changed, and what triggered it? Paragraph 2.6 requires the assessment before and after a change. If the last trigger was an audit and not a change to the plant, the product or the data, the CCS is following instead of steering.

We support the development and revision of a CCS under Annex 1 (Sterile Manufacturing). The classification and monitoring concept for the rooms sits in Cleanroom Qualification, the preparation for the inspection in Inspection Readiness.