-->

Sep 17, 2015

Hacking GMPs: Deliberate Attacks or Accidental Workarounds?

Can't find the right lid for the barrel?  You might find 
a different lid that almost fits and use duct tape. But if 
you do, chances are you'll be hacking your GMPs.
by Vivian Bringslimark
President & Owner
HPIS Consulting, Inc.



The subtitle tells it all.  Most employees don’t come to work with the intention to cause harm, fail or make mistakes intentionally.  Yet mistakes, errors, and failures happen.  According to Sidney Dekker, author of The Field Guide to Understanding Human Error, “mismatches between written guidance and operational practice always exist”.  I’s due to “the amount of increasingly tight constraints of procedures” (p.8).  There have been some occasions where following a procedure could have caused a deviation if it weren’t for an astute technician who questioned the “GMP” rule.   Talk about a GMP dilemma, “always follow the SOP” but don’t create a deviation either.  Alas, we have a classic example of a white hat hacker.

What is a white hack?

In the extreme case, a hack is the intent to steal from someone or do harm to something.  We immediately think of “hacking into a secure database.”  And it frightens us because a hacker exposes weaknesses and leaves us vulnerable.  The consequences of identity theft and stolen credit cards make us shiver.  So yes, “hacking” has a very negative connotation.  But can hacks be benevolent?

Bill Jensen and Josh Klein think so.  In their book, Hacking Work: Breaking Stupid Rules for Smart Results, they describe several stories of benevolent hacks at work and boldly inform us that we were born to hack.  The difference is that “the hack” does no harm.  Instead, white hat hackers are insiders who work around their own systems to improve them. Benevolent hacks “must deliver useful improvement in efficiency and effectiveness without damaging the company’s ability to reap the benefits” (p. 61).  Isn’t this what management dreams of when they ask for continuous improvement ideas?


GMP dilemmas and workarounds

But you don’t know our compliance world, you counter.   Indeed, I do.  If everything executed according to plan, there would be no need for the deviation management and CAPA quality system.  Rule benders or “positive deviants.” as Jane Bozart describes them, are “always checking the edges and see the holes rather than the net” (p.68).  Let’s be honest.  “GMP” hackers are present whether we want to accept it or not.  The change control quality system has been put in place to help manage and share their improvements systematically. 

Yet, GMP dilemmas are ever present, challenging the current process and begging for an improvement (or a benevolent hack).  A GMP dilemma occurs when a situation has presented itself to an employee that falls outside the SOP or work instruction.  In other words, how to remedy the situation cannot be found in the SOP or in the troubleshooting appendix of the manual.  The employee has to act.  What does the procedure say?  Notify your supervisor?  Some operators are reluctant to approach their supervisors for a number of reasons, one of them being is the retort – “just get it done or find a way to fix it.” This is truly a white hat hacker's dream come true!  Some will even admit that their supervisors don’t follow through with contacting maintenance or QA and the operator is on his own.  

This article is related to the Whitepaper: cGMP and ISO 13485 Integrated Quality Management System. To get the full details, please download your free copy.
So he finds a way to fix it and get it done.  I call this a “GMP Workaround.” The action(s) taken does not exactly follow the procedure or protocol.  And GMP compliance is more than likely the farthest thing on his to-do list.   For example, a stainless steel drum transporting liquid needs to be covered and sealed.  The operator knows this and looks for the lid, ring and clamp assembly.  He finds the lid and a beat up ring with missing or broken clamp.    Aha, he has encountered a GMP Dilemma.  This is not the first time it has happened, however.  In fact, he’s reported it to his supervisor multiple times.  And still the clamps are missing, the lids are out of alignment and it appears that nothing is being done about it.  Why should I worry about it, he might conclude.  But he will get in trouble if he doesn’t complete his assignment.

So, he applies a GMP Workaround.  He covers the drum and seals it with an alternate method so the liquid does not spill and nothing can get in to it.  In his mind, he’s still getting to the end goal and not losing too much productivity.  He uses duct tape and a lot of it and wheels it into the next staging area.  Does he stop and think duct tape on a product contact surface is probably NOT good GMP practice?  But wait, this situation was never discussed in GMP refreshers.   So, he’s good to go, right? 

Here’s my point.  He was presented with a GMP dilemma and attempted to mitigate the situation as best he could with what he had to work with, including previous non-responsive local supervision and workplace culture.   Sure he should have known that duct tape leaves adhesive residue for all kinds of contaminated particulates. But, when and where was he supposed to learn that? Instead, he gets written up and suspended for failure to follow procedure and violating good manufacturing principles.  


The way we deliver GMP training needs a redesign

New hires receive basic GMP training as part of orientation.  If they are new to the industry, GMPs can seem like a set of rules and do’s – don’ts for making entries in controlled documents.  Next, we introduce new hires to another concept called standard operating procedures and tell them these are how we follow the GMPs.  And then we don’t see the employees again until it’s time for the annual GMP Refresher class. We cover regulations and maybe a few specific SOPs.  But do we teach any GMP principles?  I don’t mean the regulations.  The underlying intention behind the regulation so that in the heat of a GMP Dilemma Moment, the GMPs are applied properly.  But that’s why we teach them the SOP--- so they can comply with the regulation---is what I often hear. 

SOPs are for the standard set of steps to complete routine tasks.  Employees are told they must follow procedures and for complex SOPs, are shown how to execute them.  When do we teach them how to manage deviations, anomalies, the “that’s never happened before/ glad you were in training to see it” incidents? Even with known triggers, first time non-conforming events still happen.   We are so focused on the routine, standard process do we ever teach employees how to handle a GMP dilemma other than “notify your supervisor?”   


Teaching GMP principles

Ruth Colvin Clark asserts that principles are not the same thing as procedures.   In her book, Developing Technical Training, she explains that a procedure is a series of clearly defined steps which result in achievement of a job task.  Whereas principles do not have exact steps that can be specified because the situation or context in which the task takes place can be different each time. 

We can teach “guidelines” like the 10 Commitments for GMPs and then arrange for learners to practice judgment and decision making in applying the guidelines to fit the circumstances.  The use of analogies is very effective because it relies on existing knowledge to explain the new meaning.  Incorporating sample challenge situations during training provides the “back to my job” crossover and reinforces the transfer to the workplace setting.  If we teach only step-by-step procedures like good documentation practices and the controlled document circumstances change, employees will not be prepared to relate the intention of the GMP to this new situation.  

Using a situation based approach or problem focused style for GMP Refreshers is far more challenging to deliver.  It requires participants to have more working knowledge to support the application of principles to various unpredictable situations.  Hence, we recognize this difference at the onset of employment.  That is why the first GMP training class is an orientation and is designed for new hires.   Likewise, the new hire undergoes a department orientation and on-the-job training (OJT) for complex SOPs.  Once they become proficient and qualified, we stop formal training.  This is a shame because there is where the next installment of  “non routine” or troubleshooting training needs to happen.


What’s missing: “Non-Routine Training”

Transfer of training (or learning) happens when knowledge and skill obtained are used on the job correctly, meaning as taught in training or per SOP.   This is known as Near Transfer and the goal is exact, identical behavior as trainer demonstrated.  It’s ideal for effective transfer of SOP training. Non-routine training focuses on a deeper understanding of the process and principle of the concept, in this case, both SOPs and GMP regulations.  The focus of the training is to provide opportunities for solving problems during training so when employees encounter GMP dilemmas, they are not tempted to revert to a GMP workaround.   A great next step would be to include troubleshooting in the OJT curriculum.


Accidental work-arounds or deliberate violation?

“We met with every generation currently working, in almost every industry, and found a pervasive and universal problem: the design of work isn’t meeting the needs of the people who do the work” (Jensen & Klein, p.19).   While SOPs are the standard process to follow, we encounter a host of unknown triggers that present new problems to solve almost every day.  In the attempt to solve these challenging GMP Dilemmas, informal learning is also happening incidentally, whether the operator is aware or not.  It may not be the most efficient way to learn and in some cases, not effective at all.   But these “teachable GMP moments” are lost because supervisors are not available to deliver a GMP principle message and help validate if the workaround approach is/is not compliant.   Unfortunately, GMP refreshers occur only once or twice a year, so a work-around is the next best thing in the employee troubleshooting toolbox. 


References:
Jensen, B. & Klein, J. Hacking Work: Breaking stupid rules for smart results. USA, 2010, Portfolio Penguin

Bozart, J. “Are You a Positive Deviant?”, training magazine, May/June, 2015, p. 68.
Carliner,S. “7 informal learning lessons”, training magazine, September/October, 2014, p. 30 – 33.

Clark RC. Developing technical training: a structured approach for the development of classroom and computer based instructional materials.  Phoenix: Buzzards Bay Press; p. 41, 1994.


Twenty-six years of education, life sciences industry experience and consulting engagements enable Vivian Bringslimark to provide human performance consulting services for improving people strategies.  Vivian holds a M.A. in Adult Education from Teachers College Columbia University and a M.S. in Educational Computing from IONA College.    She currently serves as Advisor to Board of Directors for the GMP Training and Education Association and will be presenting “Mirror Mirror on the Wall: Who’s GMP Refresher is Boring No More” at the 2015 GMPTEA Biennial Conference – October 25 – 29, 2015.   Visit www.gmptea.net for more conference details. 






Watch Related Videos
How MasterControl Makes Your Job Easier


Download Free Resources
White Paper: Six Ways to Optimize Your Quality Management System and Ensure FDA and ISO Compliance
Product Data Sheet: MasterControl QMS and QEM Systems for ISO Guided Companies




Related Links