The Use of Scientific Data to Assess and Control Risks Associated with Sterilizing Filtration

In recent years, a desire to minimize the risks associated with sterilizing filtration has prompted much discussion on the need for preuse/post-sterilization integrity testing (PUPSIT) to detect nonintegral filters before they are used if there is any risk of not detecting them after the filtration process. The purpose of this article is to present guidance to industry (sterile drug manufacturers, filter suppliers, and regulators) on how to develop and evaluate scientific data to prevent undetected non-integral sterilizing filters. Potential shortcomings of some previous discussions and publications on this topic are:

• Lack of published scientific data and evidence presenting relative risks and controls, thus leading to subjective evaluation of risk based on anecdotal information.
• Emphasis on detection of failures rather than prevention of failures.
• Use of biased risk assessments with predetermined outcomes.
• Efforts to eliminate all filter failure risk, ignoring additional risks posed by the addition of new control measures.
• Recommendation of a single means to control filter integrity risks for all products and conditions, without regard to process-specific differences in risk.

The underlying principle of the work described in this article is the use of objective scientific data to address these shortcomings, characterize risk, prevent sterile filter failure, and ensure product sterility and patient safety.

This article draws conclusions from the scientific studies, workstreams, and publications delivered by the Sterile Filtration Quality Risk Management (SFQRM) consortium formed between BioPhorum and PDA. It uses those conclusions to provide guidance to industry (sterile drug manufacturers, filter suppliers, and regulators) on the use of quality risk management principles and scientific data to prevent undetected non-integral sterilizing filters.

PUPSIT was identified as a key topic in the mission statement of the SFQRM consortium: to explore the risk of product contamination as a result of sterile filtration failures, to identify the actions needed to prevent such failures (including the possible need to perform PUPSIT), to determine under what conditions it may be appropriate to deploy PUPSIT, and (in those cases) how to best perform PUPSIT.

It is generally recognized that post-use filter integrity testing is sufficient to detect filter failure and ensure patient safety unless there is a possibility that a filter passing the post-use test could have allowed bacterial penetration during filtration. This possibility is the phenomenon referred to as filter “flaw masking”, hypothesized to occur when, for example, a filter is damaged during sterilization such that it allows bacterial penetration, but that the damage becomes plugged during the filtration process to such an extent that it allows the filter to exhibit a passing post-use integrity test result.

For this masking phenomenon to occur, two conditions must exist: First, there must be a flaw in the filter that is large enough to allow bacterial penetration during use, yet small enough to be plugged during the filtration process. Second, the product being filtered must be capable of blocking that flaw to the extent that it will pass a post-use integrity test.

Two workstreams within the SFQRM consortium were designed specifically to evaluate the risk of this filter flaw masking and to understand in what conditions it might occur: Masking Studies, and Bacterial Challenge Test (BCT) Data Mining.

Masking Studies

The objective of the Masking Studies workstream was to determine if the hypothesized masking phenomena can occur, and if so, under what conditions. The benefit of this information would be to provide industry with criteria for predicting and preventing flaw masking.

To directly evaluate the possibility of filter flaw masking, this workstream executed tests where worst-case, marginally flawed filters were challenged with a proteinaceous solution to plug the defects and create a passing post-use integrity test.

The following sets of flawed filters were used for the tests:

1. Cartridge filters rejected from filter manufacturing lines due to marginally out-of-specification integrity test results. Every sterilizing grade filter is integrity tested within the supplier’s manufacturing process as a release criterion. Over the course of time, rejected filters were collected for the masking trials. It should be noted that marginally out of specification filters are rare, most rejects are catastrophic failures (large defects that make the filters unable to be integrity tested); therefore, it took multiple months to obtain the quantity used in these tests. Additionally, not all filters that fail the in-process integrity test will necessarily allow bacterial passage—in particular, marginal failures have a possibility of still being completely retentive.
2. Disc filters with intentionally created defects generated by laser-drilling 10 µm holes in 47mm flat disc membranes. This set was included because of the difficulty in obtaining marginally failed cartridge filters described above.

The results of these studies were shared in the masking studies article, “Test Process and Results of Potential Masking of Sterilizing Grade Filters” (1).

Of the 24 cartridge filters tested with 24g/L foulant concentration and 90%+ flow decay (Set 1), only two demonstrated apparent “flaw masking” with a pre-use integrity test failure followed by a post-use integrity pass. Interestingly, despite the high foulant concentration and flow decay, the majority of filters (19) experienced a reduction in bubble point after exposure to the foulant, while only five experienced a bubble point inflation (of which only two started out failing and ended passing).

As for the intentionally damaged, laser-drilled filter discs (Set 2), an automated integrity tester was able to detect the damaged filters in all of the test conditions whether challenged with 0.8 g/L or 24 g/L foulant solutions at any blockage level up to 75% (i.e. flow decay such that the final flow rate is one quarter or less of the initial flow rate). No flaw masking could be identified when automated integrity testers were used, as all integrity tests failed the post-use test as well as the pre-use test.

At blockage levels above 75%, manual bubble point tests were performed and only two of the 27 test conditions demonstrated passing post-use integrity test results. The two filters which passed the post-use test had high filter blockage levels of 81% and 97%, flow decay which is not typically experienced nor desired in commercial terminal sterilizing grade filtration applications where the filters are appropriately sized.

The results of the Masking Studies show that while masking can be made to occur, it is not likely to occur under typical drug manufacturing conditions. These studies also demonstrate some criteria for evaluating the risk of masking: If companies manufacture products with unusually high foulant concentrations and use filters to levels that approach blockage conditions, then the risk of masking may be relevant. However, if filtration processes use systems that are appropriately sized, experience minimal flow decay and filter blockage, then the risk would be low and much less significant.

Bacterial Challenge Test (BCT) Data Mining

The consortium identified an additional way to evaluate the risk of flaw masking which didn’t require finding (or creating) defective filters. Any fluid with a clogging/flaw-plugging mechanism (that would cause a flawed filter to appear integral in the post-use test) should also cause an increase in the bubble point value of an integral filters due to excessive pore plugging. In other words, the relative movement of a bubble point value between a pre-use test and a post-use test can indicate whether a flaw-masking fluid is present, even without the need of a flawed filter (Figure 1). The same concept applies for other integrity test methods correlated to bacterial retention such as diffusive flow (i.e. flaw masking with diffusion tests appears as a post-use diffusion rate lower than the pre-use diffusion rate). For the sake of simplicity, and because bubble point rather than diffusive flow data was available for most BCTs, bubble point will be used as the representative test in this discussion.

This led to the formation of the BCT Data Mining team whose objective was to indirectly evaluate the risk of filter flaw masking. This would allow the industry to better predict masking and implement controls to prevent it.

The BCT Data Mining team evaluated historical integrity test results from over 2,000 filters used in bacterial challenge tests (the bacterial retention validation performed on sterilizing filters according to PDA Technical Report No. 26: (Revised 2008) Sterilizing Filtration of Liquids. These historical tests provide two opportunities to evaluate whether a bubble point inflation mechanism (and thus a risk for flaw masking) exists for any given fluid and filter combination:

1. The tests start with an initial confirmation of filter integrity (preuse). Then the filters are exposed to the product, plus a high concentration of bacterial challenge organism (at least 107 CFU / sq.cm filtration area). This exposure is usually worst-case compared to the process being validated: longer filtration times, volumes, and flow rates (thus representing a worst-case opportunity for filter fouling). The presence of the challenge organism further improves the data set: the cells and any cellular debris contribute an additional burden to the filter which could theoretically plug flaws or pores. After the completion of the test, the filtrate is evaluated for sterility, and the integrity of the filter is also checked (post-use). The SFQRM consortium recognized that historical test reports could be data-mined, comparing post-challenge integrity test results to pre-challenge integrity test results to determine whether a bubble point inflation mechanism exists for a particular filter/fluid combination.
2. In parallel with the bacterial challenge test of the sterilizing grade filters, a filter with larger pore size (usually 0.45 µm rated) is challenged as an experimental control to confirm sufficiently small, viable, and mono-dispersed bacterial cells are used and penetrate such filter. This filter is also integrity tested before and after challenge and will typically have a bubble point result well below that of a sterilizing grade (0.2 µm) filter due to the more open pore structure. This 0.45 µm filter can be considered a model of a flawed sterilizing grade filter. Only if the 0.45 µm filter becomes so fouled that its post-use integrity test result exceeds the minimum passing result for a sterilizing grade, 0.2 µm rated, filter would flaw masking be a risk for this model of a defective sterilizing filter.

The BCT Data Mining Team calculated a bubble point ratio by dividing the post-use integrity test result by the preuse integrity test result and performed statistical evaluation of the results (post-use test results using a different wetting fluid from the preuse integrity test were corrected through the use of conversion factors determined experimentally). A ratio above 1.0 represents bubble point inflation, and a ratio below 1.0 represents bubble point depression.

When the data were evaluated in aggregate, the mean ratio of the post-test BP to the pretest BP was exactly 1.00 (to 2 decimal places) for all test filters and 0.99 for all control filters (0.45 µm rated filters) with narrow distributions around these means. This indicates that there is no wholesale trend of bubble point inflation in the industry, and the same was true when separately evaluating each filter membrane material, and each type of fluid (drug product, buffer, biologic, etc.)

When looking at individual fluid/filter combinations, The BCT Data Mining workstream determined that only a small fraction (less than 1.5%) of the filter test conditions demonstrated ratios above three standard deviations from the mean. These few outliers represent fluid/filter combinations with a theoretical possibility of a flaw masking mechanism, at least when performed under the worst-case processing conditions and with the addition of the challenge organism. The trend identified by the Masking Studies team was confirmed here: flaw masking or significant bubble point inflation is rare, and the few fluids with ratios notably above 1.0 tended to be those for which significant fouling (flow decay) was observed. The results of these studies were shared in the BCT article “Datamining To Determine The Influence Of Fluid Properties On The Integrity Test Values” (2).

Evaluating the Risk of Flaw Masking

It should be noted that the occasional possibility for bubble point inflation identified by the two workstreams above does not represent a risk to product safety by itself. A bubble point inflation mechanism must be combined with the use of a flawed filter in the first place to create a risk of microbial contamination of the filtrate, followed by the theoretical flaw masking. Not only must the filter be flawed, but it must be marginally flawed in such a way that a bubble point could still be obtained and inflated (atypical for the most common filter failure modes: catastrophic failures for which a bubble point is not obtainable due to membrane or capsule damage during shipping, handling, or sterilization), yet sufficiently flawed to permit microbial passage. Typical use and sterilization of these filters are validated by the supplier and/or end user to remain integral under the routine processing and sterilization conditions. It is important to note that, in order to maintain correlation of the integrity test with microbial retention for production samples tested in the course of routine filter manufacture, the filter manufacturer must eliminate all failure modes that are not detectable by a routine integrity test.

From the data presented above, it becomes clear that the majority of filter fluid combinations present negligible risk of bubble point inflation, and thus negligible risk of filter flaw masking. Moreover, a review of terminal sterilizing grade filtration applications and their lack of excessive flow decay further minimize masking risks. If the sterility risk of flaw masking were very remote, but there are no offsetting risks encountered by implementing and executing PUPSIT, then PUPSIT might be recommended in all cases. As was shown by two additional workstreams and consortium papers described below, however, performing PUPSIT is not free from sterility risk itself. Instead, we find a trade-off of risks.

The difference between the two scenarios shown in Figure 2 demonstrates why it is so critical for end-users to perform a robust evaluation of the risk of flaw-masking for their particular fluid and filter combination. The large majority of the processes where flaw-masking can be shown to not occur are represented by the scenario on the left, while processes with a significant risk of flaw masking are represented on the right and may warrant implementation of PUPSIT or a more detailed evaluation of the relative risks.

Minimizing the Risks of Performing PUPSIT

Another workstream within the SFQRM Consortium consisted of a team that executed detailed risk assessments of the entire sterilizing filter life cycle as described in Points to Consider for Risks associated with Sterilizing Grade Filters and Sterilizing Filtration (currently in-press). Although these were only examples designed to be used as templates for end-users’ process-specific assessments, they identified potential faults/ failure modes that could compromise the integrity of a filter or otherwise add risk to the sterile product manufacturing process. Many of these potential failure modes occur during the execution of PUPSIT itself, which was confirmed by the results of a BioPhorum survey performed in summer 2019 by 21 drug manufacturing sites, representing 17 BioPhorum member companies.

The survey responses demonstrated that incorporating PUPSIT into a filtration process increases the complexity of the process, and with increased complexity there are increased risks such as:

• Requiring the system to maintain much higher pressures, often exceeding 60psi, increasing the risk of sterile boundary leaks especially when using single-use equipment. Deviations and leaks were reported in classified areas due to burst tubing junctions in such cases.
• Much longer process times associated with filter wetting, blow-downs, and need to adapt to non-standard situations (such as re-wetting the filter, re-orienting the filter to effectively remove air, etc.).
• System manipulations on the sterile side of the filter.
• Exponential increase in the complexity when using a redundant filtration design, if both filters need to be tested.

A similar survey performed in 2017 identified one drug product manufacturer that actually reported a process simulation (media fill) failure that was traced to a root-cause associated with performing PUPSIT.

The message taken by SFQRM consortium from the survey was that with careful process design and development, filter users can mitigate (yet not completely eliminate) the increased complexity, product discard, and turnover time associated with PUPSIT. It was with this in mind that the final deliverable of the SFQRM workstream was developed: Points to Consider for Implementation of Pre-use Post-Sterilization Testing (PUPSIT) (in-press).

This paper was designed to share PUPSIT best practices identified over the years by filtration subject matter experts at filter supplier firms and end-users, so that when PUPSIT is performed it is performed in such a way that it reduces the risk as much as possible (Figure 3). This also ensures that risk assessments are not biased: When comparing sterility risks of not performing PUPSIT with those encountered when performing PUPSIT, the PUPSIT case will be presented fairly, with as many best practices incorporated as possible to minimize the risks.

A reader of this comprehensive document will become intimately aware of the challenges of implementing PUPSIT such as:

• Filter reorientation
• Sterile blow down after integrity test
• Performing PUPSIT on filters inside an isolator
• PUPSIT with redundant filters
• The further addition of new sterilizing gas and liquid filters required to maintain the sterile boundary and allow PUPSIT (which must also be integrity tested and represent additional possible failure points)
• Manipulations of the sterile side of the filter

Recommendation

Through the work of this team, the previously hypothetical flaw-masking phenomenon was shown to be at least theoretically possible through observation of masking on marginally failed filters and bubble point inflation, but only under extreme process conditions.

The data from the BCT Data Mining Team and the Masking Studies team demonstrate that for most of the fluid and filter combinations under normal processing conditions, there is no flaw masking or bubble point inflation mechanism to pose a risk of a “false pass” post-use integrity test. This is especially true when considering the need of a sterilizing grade filter to be properly sized to filter the entire fluid batch at hand. This means such filters are typically over-sized and have enough capacity not to foul to a degree as experienced in the trial work. SFQRM team members, as experts in critical sterilizing filtration, shared the typical fouling levels encountered at terminal filters in their firms and reported that flow decays typically stay well below 40%. Based on this data, and the strong case for added process risk accompanying the performance of PUPSIT, we recommend that end-users should take a risk-based approach to the implementation of PUPSIT in filtration processes.

Because the need for PUPSIT depends so strongly on the potential for flaw masking, we recommend that any sterile product manufacturer considering a process without PUPSIT should perform a process-specific evaluation of the risk their fluid / filter combination has for flaw masking. This may be as simple as a confirmation that the fluid components have no theoretical potential for flaw masking (e.g. for final sterilizing filtration of WFI or some buffers), but a detailed evaluation may also include additional data such as:

• The level of flow decay (fouling percentage) encountered during the process
• Directly assessing their specific products’ possibility to inflate the bubble point, either through BCT studies as shown in the BCT Data Mining paper, or through supplemental studies specifically designed to evaluate bubble point inflation
• The presence of pre-filtration or redundant filtration, which can remove flaw-masking components from the fluid stream before it encounters the final sterilizing filter (there is a strong rationale for never requiring PUPSIT for the downstream filter of a redundant pair).
• Use of laser drilled flawed filter discs for the evaluation of filter flaw masking

If there is a reasonable risk of flaw masking that cannot be adequately reduced using process controls, the default position should be to perform PUPSIT. Any relative risk evaluation of “PUPSIT” and “No PUPSIT” process designs must ensure that the best possible PUPSIT scenario is compared to the No PUPSIT scenario, incorporating as many of the Best Practices identified in “Points to Consider for Implementation of Pre-Use Post-Sterilization Integrity Testing (PUPSIT),”  (or practices providing equivalent reduction in risk) as possible.

This discussion focuses on the patient safety risk of releasing a non-sterile product. The observation herein is that for the majority of cases, filter flaw masking is not a concern, and thus post-use filter integrity testing is adequate. None of this discussion precludes a filter user from performing PUPSIT for other reasons, such as the business risk of processing with a non-integral filter that would not otherwise be detected until the batch is already filtered.

Conclusion

Because product and processes may be unique, it is difficult to determine a single control measure that satisfies all situations. This paper and the referenced SFQRM consortium efforts are designed to provide the reader with guidance for the type of information to be considered to make an informed decision for their respective product and process.

The Masking Studies can be used as a guide for the determination of likelihood that a given product may be prone to clogging a flawed filter. The BCT Data Mining assessment of bubble point inflation provides further evidence that likelihood is low. Both stand as examples of tests that can be performed by a parenteral drug manufacturer to evaluate the risk of flaw masking in their process, and both can be used to provide guidance for precautions and controls that can be implemented to reduce or eliminate the likelihood of masking. Additional controls may include adding prefilters to reduce clogging materials, changing formulation parameters or conditions, or the use of a properly designed PUPSIT procedure.

The example fault-tree analysis and risk assessments can provide guidance for the likelihood of a filter becoming flawed during its manufacture, handling, transport, and sterilization, as well as being a source of effective control measures. Assessments such as these can be used to identify any weakness in the process and help determine precautions and controls to reduce the likelihood of filter flaws and failures, as well as the adverse effect of these failures. Such precautions may include performing pre-sterilization integrity tests, adding prefilters to reduce clogging materials, changes in filter handling procedures or packaging to reduce risk of filter flaws, changing sterilization process parameters or conditions, and/or the use of a properly designed PUPSIT procedure.

The surveys, FMEA risk assessment, and Best Practice Points to Consider provide insight into the complexity of properly designing and safely performing the PUPSIT procedure. It is essential that the reader understand the complexity of PUPSIT procedures. Any procedure performed during an aseptic process and on the downstream side of a sterilized system can be inherently risky and must be properly controlled. Once compromised, the chance of detecting a breach in a sterile pathway or aseptic process would be low, and the result potentially catastrophic.

The question is not whether PUPSIT can uncover a pre-use, post sterilization filter integrity failure, nor whether there is a theoretical possibility of a flawed filter passing an end of use integrity test, nor the impact of such an occurrence. The question is whether (and when) PUPSIT is the best choice to prevent such an occurrence from affecting product sterility. Once a company determines the combined risk of a filter becoming damaged and then having that damage masked, they can identify the steps that can be taken to reduce that risk and balance the residual risk to the risks of possible control measures.

References

1. Ferrante, S., et al. “Test Process and Results of Potential Masking of Sterilizing Grade Filters.” PDA Journal of Pharmaceutical Science and Technology Accepted Article (Published online May 28, 2020)
2. Thome, B., et al. “Datamining To Determine The Influence Of Fluid Properties On The Integrity Test Values.” PDA Journal of Pharmaceutical Science and Technology Accepted Article (Published online May 28, 2020).