One group programme, many site cultures: why speaking up decides data integrity

The go-live pack was the same everywhere. One group SOP for recording and correcting GMP data, one configuration of the electronic logbook, one training deck translated into four languages. The programme team went from plant to plant with the same slides and the same readiness checklist, and every site signed the same form.

A few months later the group quality dashboard showed something nobody had planned for. One plant was logging dozens of small data errors a month: a lot number mistyped and corrected, a weighing booked against the wrong step, a printout that did not match the screen. Another plant, same system, similar products, was logging almost nothing. At the next steering committee the quiet plant was held up as the example.

It took an audit trail review, done for an unrelated reason, to change that reading. The quiet plant was not making fewer mistakes. It was correcting them differently: at the end of the shift, by the shift leader, under his own account, with the same short reason every time. Nobody was committing fraud. People were doing what they had always done when something went wrong: tell the person in charge and let him sort it out without fuss.

That scene is a composite of several multi-country rollouts, but anyone who has carried a group programme into plants with different histories will recognise it. The system was identical. The people around it were not.

A quiet site is not a clean site

A data integrity programme works on what people make visible. Audit trails, deviation records, corrections with a reason: each depends, at some point, on a person deciding to say ‘this is wrong’ instead of quietly fixing it or living with it. When that decision is easy, errors surface, get counted and get fixed at their cause. When it is hard, the same errors still happen. They simply stop showing up where the group looks for them.

The reporting rate of a site therefore measures two things at once: how often things go wrong, and how safe people feel saying so. Headquarters usually reads only the first. The site with the most reported errors gets the visit and the action plan, and the site that reports nothing gets the praise. Sometimes that is right. Often it rewards precisely the behaviour a data integrity programme exists to remove.

Writing in ISA’s InTech magazine (May/June 2020), Victor Venâncio argued that a digital transformation rests on three pillars, technology, processes and culture, and that culture, organisational and national, is the one companies most often neglect. His examples came from oil and gas, where a headquarters programme copied unchanged into a subsidiary with a different culture can stall. The argument carries over to a pharmaceutical group, with one addition he had no reason to make. On a GMP site, culture decides more than how fast a programme is adopted. It decides whether the record can be trusted.

What the guidance already says

Regulators do not leave this to HR. The PIC/S guidance on data management and integrity, PI 041-1 of 1 July 2021, gives culture a whole section, in unusually direct language. Depending on culture, it says, an organisation’s control measures may be ‘open’, ‘where hierarchy can be challenged by subordinates, and full reporting of a systemic or individual failure is a business expectation’, or ‘closed’, ‘where reporting failure or challenging a hierarchy is culturally more difficult’.

The next sentence is the one a group programme should be built around. In closed cultures, ‘a greater emphasis on oversight and secondary review may be required to achieve an equivalent level of control’. The guidance also accepts that an effective quality culture and data governance ‘may be different in its implementation from one location to another’. Put simply, the level of control is fixed and the means of reaching it are not. Read that way, a single rollout plan that treats every plant the same will under-control some of them.

Two details in that table matter more than they appear to. The MHRA puts ‘the behaviour driven by performance indicators’ next to culture and senior management behaviour, a polite way of saying that a bonus on right-first-time can buy silence. And EU GMP Chapter 1 asks for a justified human-error conclusion. That matters, because ‘operator error, retrained’ is the fastest way to teach a whole shift that reporting a mistake ends with your name in a deviation.

Where a site’s culture comes from

When people talk about culture in a multinational group they usually mean national culture, and it is real. Geert Hofstede’s dimensions are the most quoted frame. Power distance, in his definition, is ‘the extent to which the less powerful members of organizations and institutions (like the family) accept and expect that power is distributed unequally’. Uncertainty avoidance concerns a society’s tolerance for uncertainty and ambiguity. Both shape how an operator reacts when a senior colleague makes an entry that looks wrong, or when a procedure does not cover what is happening on the line.

Two cautions, though. Country scores describe averages across populations, not the person standing at the granulator, and Hofstede’s own material warns that the numbers are a convenience and the pattern is what counts. A rollout team that briefs itself with a country chart and then treats every operator as a stereotype has learnt the wrong lesson.

The second caution: on a plant, national culture is rarely the strongest layer. Two others usually weigh more.

• The site’s own history. A plant bought from another group keeps its old habits for years. A site that went through a hard inspection, or a manager who once made an example of someone, carries that memory long after the people involved have gone.
• What managers do on a Tuesday afternoon. The values poster matters less than the reaction. The first time an operator reports her own mistake on the new system, the whole shift watches what happens to her, and that single response teaches more than the training deck.

Research backs up what the shop floor already knows. Amy Edmondson’s 1999 study of 51 work teams in a manufacturing company introduced ‘team psychological safety’, a shared belief that the team is safe for interpersonal risk taking, and found it associated with learning behaviour. Team leader coaching was one of the things that shaped it. Two lines on the same site, under two different supervisors, can sit at opposite ends of PIC/S’s open-to-closed scale.

What it looks like in the plant

On the floor, a closed culture rarely announces itself. It shows in small things that a programme team, in for a week with an interpreter, will miss unless it looks for them.

Corrections cluster at shift handover, made by the same few people. The ‘reason for change’ field always holds the same phrase. Deviations are closed with operator error and retraining, and the retraining is the same read-and-sign. The SOP was translated, but its examples still describe another plant’s equipment, so people follow the local practice and sign the group document. PIC/S even anticipates the language problem in a footnote on scribes, where it advises ‘bilingual or controlled translations of documents into local languages and dialect’.

From the automation side, the clearest signs are in the configuration. A shared ‘supervisor’ login on the HMI that the whole shift knows. Administrator rights handed to a shift leader ‘because he is trusted’. An audit trail switched on and never reviewed. Alarms acknowledged by whoever happens to be nearest. None of these is a cultural fact on its own, but together they show where a hierarchy has been allowed to settle problems out of sight. PIC/S has a sentence for this as well: where possible, management should implement systems with controls that, by default, uphold the intent of company policies. In a closed culture, individual accounts and a mandatory reason for every change do more than tidy up the configuration. They provide the secondary review the culture will not do by itself.

Adapting the rollout without weakening the requirement

Once the difference between sites is visible, the temptation is to soften the standard for the difficult ones. That gets it backwards. The requirement stays. What changes is how much of it rests on people volunteering information, and how much on review and system design.

In practice that comes down to a few deliberate choices. Local champions are picked for credibility on the floor rather than rank: an experienced operator people already go to for help, alongside the automation engineer who knows the system. Training uses the site’s own equipment and its own near misses, told in the local language by someone the shift recognises. The confidential route PIC/S asks for goes outside the line and works in the language people actually speak. And the first errors reported after go-live are handled visibly well, because that is the moment the shift decides whether the new system is a tool or a trap.

The last step of that path is the one most often skipped. Telling the person who reported an error what came of it (the label changed, the screen redesigned, the step added to the SOP) takes ten minutes. It is also the strongest argument for the next report.

Where to start

1. Read the reporting rate as two numbers. For each site, put error and correction counts next to an audit trail sample. A low rate with corrections concentrated in a few accounts is a finding, not a success.
2. Walk the floor before writing the rollout plan. Spend shifts on the line with someone who speaks the language, and ask operators how a mistake is handled today. Their answer is your baseline.
3. Review site KPIs and incentives. Any target that pays for fewer deviations or a higher right-first-time rate should be read against PIC/S §6.5 before go-live.
4. Configure for the culture you find. Individual accounts, a reason for every change, audit trail review built into batch review: where open reporting is weak, the system carries more of the control.
5. Set up an escalation route that works locally: confidential, outside the reporting line, in the local language, and tested. If nobody has ever used it, find out why.
6. Brief the managers first. Before the operators are trained, every supervisor should know how to respond to the first reported mistake, and why ‘operator error’ needs a justification.

Five common mistakes

• Praising the quiet site. Few reported errors may mean a good process or a closed culture, and the audit trail tells you which.
• Translating the words but not the examples. A procedure that describes another plant’s equipment is followed in spirit and signed in full.
• Treating culture as a country score. National averages say nothing about the supervisor on nights; site history and management behaviour usually weigh more.
• Closing deviations on operator error. EU GMP Chapter 1 asks for system causes to be ruled out first, and every unjustified ‘human error’ makes the next report less likely.
• Discipline that silences the room. PIC/S warns that severe retribution may stop others from disclosing what an investigation needs. Deliberate falsification has to be dealt with; an honest mistake reported promptly should never cost more than one kept hidden.

A requirement that does not travel alone

A group can ship the same system, the same SOP and the same training to every plant. It cannot ship the conversation that happens on a night shift when someone spots a wrong entry. That conversation is shaped by the country, by the site’s history and, above all, by how the people in charge reacted last time. The texts are clear that it is the outcome, not the method, that has to be equal everywhere.

The most reliable site in a group is the one where people would tell you about their errors, whatever the dashboard says about how many it reports.

References

• PIC/S, PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, 1 July 2021, section 6 (§6.1–6.3, §6.5).
• MHRA, ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018, §3.3 and §6.5.
• World Health Organization, Guideline on data integrity, TRS No. 1033, Annex 4, 2021, §4.5, §4.8, §4.9.
• European Commission, EudraLex Volume 4, EU GMP Chapter 1: Pharmaceutical Quality System, in operation since 31 January 2013, §1.4(xiv), §1.5.
• G. Hofstede, Dimensionalizing Cultures: The Hofstede Model in Context, Online Readings in Psychology and Culture, 2(1), 2011.
• A. Edmondson, Psychological Safety and Learning Behavior in Work Teams, Administrative Science Quarterly, vol. 44, 1999.
• V. Venâncio, ‘A digital journey to business transformation for oil and gas’, ISA InTech, May/June 2020, pp. 38–43.