www.istockphoto.com

The biopharmaceutical industry uses living biological systems as a platform for manufacturing of protein-based drugs, vaccines, and other therapies derived from or consisting of different cell types. On one hand, living systems are inherently susceptible to viral infection and may harbor endogenous viruses, so the potential for such contamination cannot be eliminated. On the other hand, the industry has an excellent patient-safety record.

Viral safety is achieved through three fundamental measures: prevention (e.g., by selection), removal (by clearance and/or reduction), and detection (by testing). First, multiple preventive measures are used, including control and viral testing of raw materials (including media) ideally certified to be free of animal-derived components and use of unidirectional closed processes. Second, virus inactivation and removal steps are incorporated, and their effectiveness is confirmed through validation studies. For example, results must demonstrate the capability of process steps to inactivate or remove model viruses to an acceptable safety margin based on meeting _log10 reduction targets. Third, companies perform extensive viral testing of samples taken throughout a bioprocess stream: cell bank through drug substance and drug product manufacturing. Taking these measures is assured through compliance with current regulatory expectations in line with national and international regulations and guidelines (such as those listed in the “Relevant Guidelines” box at the bottom of this article).

The need for a viral contamination response plan can be justified through a risk-assessment approach (Figure 1). Rare instances of contamination by adventitious agents have occurred at biomanufacturing facilities over the past few decades. Whereas no patient reportedly has been infected, viral-contamination events in some cases have led to significant drug shortages, and the affected companies have sustained significant negative repercussions after incurring a viral-contamination event (1). Although early and reliable detection is desirable for preventing the unnecessary consequences of a false positive (e.g., product shortage and financial impact) or the potential danger of a false negative, such technology remains a challenge (2). Severity would be the highest if affected product were released to and used by patients, which stresses the criticality of fast detection.

The risk of viral contamination in the bioprocess industry thus is characterized by a very low likelihood of occurrence, which may be reduced further depending on effectiveness of reliable and early detection. Yet this risk is also characterized by the very high — potentially catastrophic — severity of consequences to products, companies, and/or patients if contamination events occur. Even if it were contained successfully at an early stage (e.g., in upstream production), a viral-contamination event could cost a company dearly through loss of production time and expensive activities (detailed herein) that would be necessary to enable resumption of production. Moreover, the resulting damage to its brand name can expose a company to a loss of market share, marginalization, and even takeover by competitors.

Yes, contamination events have been rare. Because of the high severity and the challenge of detection, however, it is prudent for biopharmaceutical companies to invest beyond preventive and other measures that have become standard practice in compliance with current good manufacturing practice (CGMP) and other current regulatory guidelines. Such investment should include establishing a robust response program to be implemented in case a viral contamination event does occur. Having such an “emergency-preparedness plan” in place would reduce potential risk to patients and limit financial damage to a company and its branding. But having a plan is not enough; practicing it regularly (e.g., performing “drills” as described below) helps ensure that all people involved would perform their respective response activities as expected according to plan and that the plan is kept up-to-date and subject to continuous improvement.

Figure 1: Usually stated in terms of a risk priority number (RPN), the risk of a viral infection can be determined by conducting a risk assessment.

The Response Plan
The response plan recommended herein is a three-phase process (Figure 2). Depending on an individual company’s strategy, internal resources, and capabilities, in a contamination event it is likely to need support from external parties. Specifically, third-party confirmation and identification of the contaminating virus(es) (phase 1) and decontamination of all potentially affected areas (phase 2) will help a company resume normal operations quickly and safely (phase 3). Therefore, as part of preparations, it is important to select appropriate service providers and establish contracts with them. A virus-contamination response program should include details about how and when those external services are to be leveraged in the three phases following a potential viral-contamination observation.

Biopharmaceutical companies differ in their internal practices and requirements for vendor selection — e.g., legal aspects and documents, scope-of-work (SoW) descriptions, master service agreements (MSAs), and confidential disclosure agreements (CDAs) — so those aspects are not discussed herein. Maintaining such agreements and keeping them up to date must be emphasized, however. For example, updates may be necessary because of technical changes when test methods improve and advance, as guidelines evolve, and in response to changes in the landscape of potentially high-risk viruses. (Consider the 2019‑nCoV Betacoronavirus outbreak for one example.) Once these contracts and service agreements have been established, maintaining them is similar to renewing an insurance policy: It does not serve to prevent a disaster from occurring, but it could reduce its impact significantly if one does occur. Because selected vendors must be capable of providing expected results both reliably and in due time (note that being reasonably priced is merely a bonus), those capabilities need to be verified, as described below.

Vendor/Technology Selection: Surveying currently available vendors and assessing the technologies they use would help ensure that the requirements best suited to a biomanufacturer’s specific needs and expectations can be met. This should be done both when establishing a program and periodically thereafter. Examples of considerations specific to biopharmaceutical companies include the drug product(s) manufactured in a given facility; its location, utilities, and equipment; and the internal capabilities of its quality control (QC) laboratory and other groups.

The available range of testing technologies includes established cell- and plate-based adventitious viral agents (AVA) and polymerase chain reaction (PCR)–based techniques and more recently introduced next-generation sequencing (NGS) and microarray methodologies (3) that should be evaluated and factored into the choice of testing service providers. These virus identification/detection technologies differ in many important aspects: e.g., robustness, accuracy, and speed (3), which all should be considered.

Likewise, decontamination methods and chemicals (e.g., as listed in Figure 2) differ in aspects such as effectiveness, safety, and potential damage to exposed equipment (4). Chemical concentrations that could degrade equipment and/or facilities — or introduce/increase particulates (e.g., through corrosion) — should not be used.

Assessment of these options should include consideration of those aspects as well as the balance between the advantages and disadvantages of each technology and the service-providers using it. Benchmarking of the industry landscape and regulatory trends will help a company determine its comfort with and acceptance of newer technologies.

Figure 2: The three main phases of a viral-contamination response plan

Verification of Service-Provider Capabilities: Another important detail to establish in service agreements is response and turnaround time (TAT). Once services providers are selected and agreements/contracts are in place, provider performance should be verified in terms of TAT and virus-identification/area-decontamination successes (Figure 2). Ideally, a mock exercise would be performed to confirm not only the agreed-upon response and TAT, but also that the entire cycle operates as expected. For a virus-testing laboratory, that cycle would be from sample shipment to return of test-result reports, including correct virus identification (verified through shipment of blinded samples).

Likewise, confirmation of a virus decontamination service provider should include a mock exercise at the client’s production site, with strategically placed biological indicators to verify a successful decontamination. Performing such an exercise also would ensure logistical success, including appropriate placement of signage, adequate employee preparedness and compliance, and so on. In both cases (confirmation testing and decontamination), verification should be guided by execution of a protocol that includes meeting defined acceptance criteria.

Program Maintenance: A response program should be maintained continuously within a biopharmaceutical company by a core virus-risk mitigation (VRM) team. Membership of this team would expand in the case of an actual incident and response initiation. During routine operations, a core VRM team’s maintenance responsibilities would include

• assuring timely renewals of contracts with services providers
• keeping an up-to-date list of critical contacts (with their contact information), including key stakeholders and experts within the organization as well as required external parties
• coordinating regular training activities related to the response standard operating procedure (SOP) and associated documentation
• performing routine simulation exercises similar to drills with participation of all involved parties — with the important inclusion of floor operators, whose input is invaluable to ensuring an optimal response in a time of need.

Training and Practice: Some facilities have dedicated training laboratories that include key unit operations (e.g., for staging and media preparation, bioreactors, purification skids, QC testing, and gowning areas). Leveraging such training options facilitates simulation activities, discussions, and presentation of potential cases. Seeing representative equipment helps in visualization of response activities that would take place in a facility and in discussing specific potential viral-contamination scenarios in the relaxed, non-GMP environment of a class-like setting.

Response Activities: Key elements and the general structure of a robust viral-contamination response program should be outlined in SOP format. A program’s scope should include guidance on the following activities:

• initially confirming a potential viral-contamination observation
• taking steps to ensure containment of the viral contamination
• assessing potential risk to people who might have been exposed
• initiating an investigation of possible source(s) of the contamination
• identifying the virus(es) involved
• determining the extent of contamination
• reestablishing containment as information is gathered
• making plans for decontamination commensurate with the extent of contamination
• performing corrective actions
• returning the facility to service.

Teams responsible for each of those activities should be defined and kept up to date along with timelines and plans for communication among internal stakeholders and external parties over the duration of the an emergency response is needed. The SOP also could include attachments such as checklists for access restriction, materials segregation, and confirmation-testing status.

Figure 3: Example response flow diagram (swim-lane diagram) showing process phases in the response to a potential viral contamination and stakeholders’ involvement at each phase; QC = quality control; API = active pharmaceutical ingredient; QA = quality assurance; CAPA = corrective and preventive action; DR = deviation report; OoS = out of specification (results)

Example Flow of Activities
Potential scenarios are too numerous and case-specific for all possibilities to be considered here. Figure 3 provides an example process-flow diagram consisting of lanes showing the phases of the investigation process (top, x-axis) with the stakeholders involved at each phase (left, y-axis). The process most likely would be initiated (top left) as a result of an out-of-specification (OoS) observation such as a positive result from one of the routine virus tests performed by the QC laboratory. The observing party (QC virology testing) immediately notifies the VRM owner, and the core team would expand immediately to form a virus-contamination response team (VCRT).

Instant notifications also are sent to the active pharmaceutical ingredient (API) manufacturing and manufacturing-support departments as well as to the head of the supply center. The VCRT leader is likely to be a quality or technical subject-matter expert (SME) who is responsible for assembling quickly a VCRT typically consisting of representatives from the following departments: manufacturing/API; QC and quality assurance (QA); regulatory affairs (RA); plant engineering; pathogen safety; and health, environment, safety, and security (HESS).

Abnormal bioreactor performance is not necessarily an indicator of viral infection. Such performance abnormalities (e.g., shifts in pH, dissolved oxygen, and so on) can occur for many reasons unrelated to infection, making them potentially false positives. Likewise, not every viral infection would announce itself through abnormal bioreactor performance, leaving the potential for false negatives.

It is important that an appropriate manufacturing/process owner takes precautionary containment actions promptly in the suspected area(s). Doing so should include restricting access for personnel working in the affected areas until virus contamination has been removed. Administrative and badge-access tools can be used to restrict potentially affected personnel from entering nonaffected areas for a reasonably minimum time to allow for showering and changing. All potentially affected materials (including in-process intermediates such as bioreactor harvest) should be identified, segregated, and quarantined leveraging relevant internal procedures to prevent their use and further possible propagation of the contamination.

Because virus testing is performed/overseen by QC, that group would initiate an OoS and deviation report (DR) in response to a positive virus-test result. QC also would oversee confirmation testing, including shipments to contract labs. Confirmation testing and virus identification are important as well as urgent activities. The specific assay technology used for confirmation testing depends on what methods are used in house at a given company and on the virus test(s) that initially yielded the positive result. Parallel confirmation testing by QC virology and by a (preestablished, as discussed above) contract test laboratory would facilitate investigations and pending decisions (diamond shapes in Figure 3). At this point (left-side diamond), virus contamination may or may not be confirmed.

During the entire response process, the VCRT is expected to meet daily to direct, coordinate, and communicate internally the status and progress of the investigation and response, including reporting to site and/or corporate management. The team would collaborate on a virus-contamination investigation by leveraging appropriate personnel (e.g., from the deviation management group) and existing internal investigation procedures and tools. Coordinated activities include containment actions, confirmatory virus-testing, identification and infectivity determination, and decontamination. Assessments of risks to personnel, environment, the facility, the process, and in-process product batches would be conducted by appropriate internal committees and experts.

Positive Test Results: Confirmation (and ideally, identification) of a viral contamination (left diamond, “Yes” in red, Figure 3), would trigger multiple external and internal communications and actions. The VCRT would coordinate many lines of communication, including those to pertinent safety and product quality committees that would need to determine whether any released products (or supplies) were compromised. RA would orchestrate a communication plan with the relevant health authorities. Concomitantly, other external communications — e.g., between HESS and the local city and/or region — are performed as required, as are internal communications and regular updates at the production site (e.g., regarding risk to people and the environment). A risk assessment should be performed to determine the relevance of the incident to patients, and HESS should determine risks for employees, the facility, and the environment together with appropriate SMEs (e.g., pathogen safety and engineering groups).

Likewise, confirmation of a virus contamination would trigger activities by the API manufacturing group, including immediate termination of all potentially affected bioreactors (those that share common space, utilities, media, and so on) followed by decontamination. All implicated raw materials and process intermediates are to be discarded, and a product hold is put into place.

The next decision point (right-side diamond, Figure 3) concerns the extent of a contamination and whether it is a recurring incident. The type and extent of decontamination activities should be commensurate with the extent of contamination. For example, one that is limited in extent (e.g., in the number and/or location of bioreactors) might require only surface cleaning agents with multiple repeats of normal facility cleaning procedures; a contamination that is widespread (e.g., one that has entered interstitial spaces in the facility) could warrant facility shut-down and use of penetrating cleaning agents (fumigation).

A limited-extent/first-occurrence incident (right diamond, “Yes” in black, Figure 3) calls for standard or normal cleaning according to existing SOPs, followed by investigation activities. Ideally, a root cause is determined, followed by implementation of appropriate corrective and preventive actions (CAPAs) and DR closure. Return-to-service (right side of Figure 3, framed in green) is the desired goal, and the faster it is achieved, the fewer and less severe the overall consequences of the incident will be to patients and/or the business.

If raw materials are suspected as a source of contamination (5), then alternative approved vendors should be used until suspected vendors are cleared for manufacturing use. Investigation activities should ensue according to the company’s deviation management and conformance systems, and interim deviation reports might be issued depending on the investigation complexity and time requirements.

Investigators will look into what exactly was observed, what type(s) of sample(s) tested positive (e.g., cell bank, cell expansion, production bioreactor, and so on), and where the incident occurred (e.g., which building or suite). If the event occurs in a multiproduct production facility, the investigation also would evaluate potentially affected products and shared equipment — noting by whom and how the observation was made, including details on what test method(s) showed positive results.

Unusual observations should be considered to help assign cause or assist in the investigation, including notes on abnormal bioreactor performance or out-of-range parameters that cannot be explained by deviations such as an in-process control malfunction or material-specification failure. Depending on the investigation outcome, manufacturing and/or QC groups should implement CAPAs. Using appropriate quality risk management (QRM) tools such as risk-based impact assessment (RBIA), the VCRT and/or qualified department or personnel should assess risks to the facility as well as to product and to employees. In addition, requirements should be defined — e.g., for the number of successful test cell-culture runs depending on the specific case and based on the risk assessment’s outcome — and criteria should be met before the VCRT can recommend return to service (or not). QA would review and confirm that criteria were met before approving the final disposition of the facility and its return to commercial activity.

A more extensive contamination case (right diamond, “No” in red, Figure 3) could entail leveraging a service provider that has been contracted in advance for this purpose, as discussed above. Note that the type of fumigation agent is likely to be predetermined based on the contract service provider chosen. Broad decontamination/fumigation of a facility and its utilities will be orchestrated by the engineering department. Other considerations include

• whether the identified virus is a pathogen that could be dangerous to humans
• how complex decontamination activities will be — which can be indicated by a failure of earlier cleaning attempts (the virus was not eliminated)
• what business/safety risks are deemed unacceptable.

The exact extent and type of decontamination response will be determined by the VCRT in consultation with site general and quality management as well as stakeholder department heads. Regardless of the extent of contamination, API manufacturing should discard all possibly affected raw materials safely and compliantly, including in-process materials, treated and decontaminated waste, and wash fluids and disposables. Decontamination of affected facilities and/or utilities should be confirmed and approved by HESS along with their safety (for personnel to return to and access decontaminated areas). Completion of investigation activities and risk assessments would be conducted as described above to enable removal of product hold and resumption of commercial operations.

Negative Test Results: If no virus contamination is confirmed (“No” in black, left diamond, Figure 3), then an investigation for a potential false positive is triggered. This shifts the investigation activities to the QC laboratory — which might focus on samples and/or reagents handling, for example. Depending on the outcome of such an investigation, implementation of CAPAs would follow as well as decontamination of QC laboratories and discarding of materials and reagents as needed. Precautionary containment actions would discontinue, and the facility would return to routine commercial manufacturing.

After return-to-service is achieved, additional requirements and activities would result from a virus-contamination incident. Risk management and monitoring/control plans should be created based on recommendations from the VCRT, which in turn would consider the virus identification, outcome of the investigation, and extent of overall impact. To help prevent contamination reoccurrence, those plans could include new and/or revised procedures, such as for sourcing raw materials and for sample testing. Both during and after a virus-contamination event, product-release decisions would await regulatory assessment by appropriate health authorities or other relevant agencies. Additional external communications would be determined as appropriate — e.g., press releases and letters to patients, physicians, and advocacy groups. Internal communications should be provided continuously by the VCRT at the production site and across the organization’s line functions, depending on the company.

Caveats: Note that this response plan is general and that case-specific details such as company and facility location, specific products and manufacturing processes, and so on can entail changing the presented flow of activities. I offer no timeline details for the pathway from virus detection and confirmation to return-to-service because they can vary greatly (by months and even years) from case to case. Being prepared with a detailed response plan in place, however, can reduce significantly the time it takes to recover from viral-contamination events. Being continually ready with a plan and SOP as discussed herein, routinely qualifying emergency-service providers (both virus testing laboratories and fumigation services), renewing and updating their contracts, establishing a VCRT and performing simulation activities (drills) with stakeholders at all levels — all taken together should minimize potential consequences and therefore would be essential for the benefit of patients and companies alike.

Simulation Activities: Practice drills facilitated by SMEs and/or professional trainers — with the participation of representative personnel from all involved departments — are critical to ensuring optimal performance when an emergency does occur. In such simulations, participants are presented with different scenarios as case studies.

Because it is impossible to come up with all possible scenarios, companies should take a prioritization approach (e.g., considering reported cases in the industry to emphasize scenarios of higher likelihood and/or impact). If a training laboratory is available, it can provide an ideal setting to perform these drills. It could contain nonoperational but representative unit operations and processing areas — e.g., media preparation, scale-up, isolation and purification, gowning, QC sampling, and testing areas.

In such a setting and including representatives from all areas, (especially operators), staff members could visualize simulated activities to guide their discussion and help identify opportunities for improvement. Such simulation activities should be performed routinely. They can help companies identify concerns ranging from communications to concrete actions on the manufacturing floor, thereby facilitating continuous improvement of the response process and making adjustments that might be called for (e.g., because of process or test-method changes). Among the scenarios to consider during a simulation are review of potential results obtained by external testing laboratories and decontamination processes. Because it might not be feasible to simulate activities performed by external parties, it is important to confirm their capabilities independently, as described above. The confirmation testing and decontamination assistance of service providers are integral to an emergency response.

Lessons Learned in Practice
Upon establishing a viral-contamination response plan, an organization might discover that some activities do not match initial expectations. Establishing and renewing contracts with service providers can be time consuming. Few such companies are one-stop shops that can offer virus coverage, availability of desired technologies, documentation, and good laboratory practices (GLPs) all in one. Verification of external service providers’ capabilities, availability, and TAT thus forms an integral part of assuring preparedness. This calls for shipping samples for testing and performing on-site decontamination exercises as well as report generation — all of which adds complexity to the process.

Performing routine simulations is a great way to confirm internally that a response plan meets expectations and remains up to date with all changes that arise (from personnel roles to facility, equipment, and platforms). Simulations are also a great initiator of feedback that can result in improvements to the SOP based on participants’ experiences and expertise. Finally, simulation exercises should facilitate orderly, targeted, and faster response activities with a robust plan in place, ultimately confirming the effectiveness of the response plan.

Acknowledgments
I am grateful to the following Bayer colleagues for their input: Edward Cheng, Venkatesh Srinivasan, Robert To, Fugin Qin, Shawn Liu, Wensheng Wang, Bob Kozak, and Michael Gravink. I am most grateful to QA colleagues Tara Stonebarger, Lisette Gilchrist, Munira Jamil, and Tina Self for their support.

References
1 Editorial: A United Front. Nature 472, April 2011: 389–390; doi:10.1038/472389b.

2 Hendricks LC, et al. Apparent Virus Contamination in Biopharmaceutical Product at Centocor. PDA J. Pharm. Sci. Technol. 64(5) 2010: 471–480.

3 Khan AS, et al. Technical Report No. 71: Emerging Methods for Virus Detection. Parenteral Drug Association, Inc.: Bethesda, MD, 2015.

4 Dehghani H, et al. Technical Report No. 83: Virus Contamination in Biomanufacturing — Risk Mitigation, Preparedness, and Response. Parenteral Drug Association, Inc.: Bethesda, MD, 2019.

5 Shimoni Y, et al. Viral Risk Evaluation of Raw Materials Used in Biopharmaceutical Production. BioProcess Int. 14(9) 2016: 22–31.

Yuval Shimoni is a principal specialist in quality assurance at Bayer HealthCare LLC, 800 Dwight Way, Berkeley, CA; 1-510-705-5775; yuval.shimoni@bayer.com. Shimoni first presented this work at the Fourth Annual Virus Safety and Viral Clearance Summit (San Francisco, CA) in October 2019. The views and opinions expressed in this article are those of the author and do not necessarily reflect the official policy or position of his employer.