Special Reports
September / October 2017

# Proof of Closure: Life Cycle of Closed Systems

David Estape, PhD
Andre L. Walker, CPIP
Stephan T. Orichowskyj, PE, CPIP
Humberto Vega, PhD
Daniel J. Pratt, PE

This article was developed by members of the ISPE Biotechnology Community of Practice. The views and opinions are those of the authors and do not necessarily reflect the official policy or position of Hargrove Life Sciences, M+W, Novartis, Sandoz, Takeda, or any of their officers.

Innovations in biopharmaceutical and sterile pharmaceutical equipment design and operation are proving their potential to reduce contamination during routine manufacturing. Based on the concept of “closed systems,” these improvements isolate the process from both the surrounding environment and operators. They also lessen the importance of facility design as a source of contamination and enable more efficient site layouts with reduced environmental control requirements.

## Production As A Continuum

Closed production can be considered a continuum of closed systems (Figure 1), each of which can be further divided into subsystems. The interfaces between systems are integral parts of the proof of closure; each one should be evaluated individually to demonstrate that it does not break the integrity of the production process. Manufacturers using closed systems must demonstrate not only that a system is ready for use, but that it will remain closed during routine production.

Separating the entire production into multiple systems reduces the complexity of this analysis. Moreover, it allows the closure strategy to be adjusted (e.g., engineering, validation) to specific characteristics of the unit operation, considering the product requirement at each production step. This article provides practical guidance on closed systems, focusing on:

• Managing process closure across unit operations; closed production as a continuum of connected closed systems
• Understanding closed systems, including characteristics, life cycle, elements, and materials
• Documenting the strategy that ensures system closure

## Understanding Closed Systems

If you ask people in the biopharmaceutical community to describe a closed system, they’ll more than likely tell you it’s a system that protects a product or process from the environment beyond the system boundaries or, more precisely, a system that does not exchange matter with its surroundings. The latter definition is analogous to the container closure concept already established for the integrity of primary packaging (e.g., vials, cartridges, ampules) of final drug product. It would be difficult, however, to apply this analogy to a bioprocess system, which always exchanges materials with the environment. Even if we were to focus only on isolating a rudimentary system from the surrounding room environment, the container closure analogy is not sustained. As an example, a closed holding tank must “breathe” air from the immediate room environment, so the system is “closed” by a sterilizing grade filter that passes mass into and out of the system in a controlled manner.

This discrepancy between the strict definition of “closed” and the practical bioengineering/regulatory understanding of the term has complicated the discussion of how to prove system closure. Because the system boundaries must exchange mass with the environment, the meaning of “closed” biopharmaceutical systems must be expanded beyond simple physical isolation from the environment.

Consequently, providing “proof of closure” requires a holistic approach that considers all the elements or properties that characterize the closed system—not simply proving that physical integrity or isolation from the environment has been achieved (Figure 2).

#### Characteristics

There are three criteria that define the readiness of a closed system: bioburden level, cleanliness level, and degree of environmental segregation or integrity. Bioburden refers to the level of viable microorganisms; cleanliness is the level of nonviable chemical or particulate residue. Controlling bioburden and cleanliness prevents contamination that could affect the process or product going through the system. The degree of environmental segregation reflects the system’s ability to maintain cleanliness and bioburden levels before and during use, and to control release of contaminants to the environment after use.

Bioburden and cleanliness levels should be defined per allowed limits for the product that will be manufactured or process that occurs in the system. For example, cell culture requires axenic conditions (containing only a single, intended organism) so bioburden control is critical. In contrast, this is not the case in early purification steps, but requirements again return to stringent levels in the final formulation tank.

Similarly, system integrity should ensure the level of environmental isolation necessary to maintain required levels of bioburden and cleanliness during the system’s life cycle. For example, although a stainless steel bioreactor should be pressure tested before each use to ensure integrity, a purification intermediate hold tank could be tested at extended intervals or after maintenance, because process requirements for axenic cell culture are more stringent than for low-bioburden purification.

Taken together, bioburden, cleanliness, and integrity define the closed status.

$$\text{System closure} = f \text{(bioburden, cleanliness, integrity)} \tag{1}$$

If for any reason it is not possible to guarantee or maintain one characteristic, then it is not possible to claim that the system is closed. A physical breach may have affected system integrity, or an addition may have introduced a contaminant. Other failures, such as ineffective transfer line steaming, may have occurred as the system was being prepared for closure. This highlights the importance of considering the entire life cycle of a closed system.

Figure 1: Closed production process as a continuum of connected closed systems

#### Life Cycle

A closed system is assembled and prepared from subassemblies, components, or materials in a manner that achieves a state of readiness (closure) prior to normal process operation. Closure is maintained during the process until material is transferred to the next unit operation. At this point the system either remains closed and stays idle, or is disassembled and no longer closed.

To confirm system closure, a variety of process parameters/conditions are used or tests are conducted over this entire life cycle, which has three phases: pre-use, in use, and post-use. Cleanliness, bioburden, and integrity must be controlled at each step. This is achieved through activities that extend beyond cleaning, sanitization, and assembly.

It may seem logical to associate achieving closure to the pre-use phase, and maintaining integrity to the in-use phase, and to see the post-use phase as somewhat irrelevant. Reality, however, is much more complex. For example, connections performed during the in-use phase will require cleaning and bioburden reduction to reestablish closure, and the integrity of a chromatography column must be maintained both during (in use) and after processing (post-use). The proposed three-phase life cycle is a good way to understand that the closed system must be created, used, and removed from use in a controlled manner, according to the guidelines below (Figure 3):

Pre-use: System is prepared to the required level of integrity, cleanliness, and bioburden. Cleaning may be performed before and/or after assembly, or completed post-use and maintained by controlled storage conditions. Sanitization or sterilization is usually the last step before use; if the system is not used immediately, the closed state must be protected. The important concept is understanding when things are clean, how the clean state is maintained, and how assembly may affect that cleaned state.

In use: The closed system is in production. This phase may also be called “closed processing,” even though in many cases mass is transferred across the system interface (e.g., through sterilizing grade filters). During connections and disconnections to expand or retract system boundaries, materials are added or removed in a safe manner to avoid contamination from the environment, operators, or materials.

Post-use: The process stream is no longer in the system. Measurements (e.g., filter-integrity tests, confirmation of noncontamination) should verify that closure was maintained during processing. The environment should be protected from residue in the equipment through careful decontamination processes or physical/temporal segregation. If the system or its components are cleaned and sanitized, storage and/or transport should protect their closure. Single-use systems or components can be discarded.

Figure 2: Closed system breakdown

### Elements

When analyzing proof of closure, it is important to consider all parts of the system that play a role in achieving and maintaining closure (acceptable bioburden, cleanliness, and integrity). One approach is to identify the closed-system boundaries and mass transfers required during operation. To facilitate this analysis, system boundaries could be further divided into equipment and connections/disconnections.

Methods must be developed to ensure equipment integrity and prevent uncontrolled material exchange with the surroundings. It is possible, for instance, to conduct a pressure hold test to ensure that there are no losses through seals and valves in a stainless steel tank.

When connecting or disconnecting systems it is necessary to prove that there is no risk of contamination. For instance, a challenge test of a single-use sterile connector can confirm that no contamination occurs in the process.

Correct material addition and removal must also be verified. Integrity testing of sterilizing grade vent filters on tanks, for example, verifies controlled addition and/or removal of air, and quality control testing ensures raw materials are fit for purpose. Following this structure allows a more systematic approach to a risk assessment for system closure.

### Materials

Materials of construction have a major influence on how closure is attained, maintained, and proven. The ISPE Biopharmaceutical Manufacturing Facilities Baseline® Guide (2nd edition) presents single-use bags as an example of a “closed system.” Multi-use stainless steel systems are defined as “functionally closed,” meaning the system is open and “rendered closed” through cleaning, sanitization, and/or sterilization processes. 1 Single-use systems are comprised of materials and components that are manufactured and assembled in a clean environment at the supplier’s facility and then gamma irradiated to reduce bioburden. Although these are very different processes, closure occurs in both cases and must be understood and controlled.

Single- and multiuse systems have distinct life cycles. In the pre-use phase, the single-use system is brought to a state of closure at the supplier’s facility. The final user is responsible for qualifying the supplier through a quality agreement and inspections. In contrast, multiuse systems are under direct control of the manufacturing site, at which closure is attained through controlled procedures.

In-use material transfers between steps require a connection that protects the process from the environment. Single-use systems can employ manual aseptic connectors or automated sterile tubing welders to achieve closure. Multi-use stainless steel systems require cleaning and bioburden reduction, which can rely on manual or fully automated procedures. Hybrid systems, in which there is an interface between a single- and multi-use system, rely on disposable valve assemblies that can be steamed at the interface between the two.

In the post-use phase, the single-use system will be discarded but the multiuse system will go through disassembly and cleaning procedures.

In all cases, regardless of the materials of construction, each system must be closed through controlled procedures and operated throughout its life cycle in a manner that fulfills the system closure characteristics required for the process. The techniques utilized to achieve, maintain, and prove closure clearly diverge due to the difference of the material properties.

• 1. International Society for Pharmaceutical Engineering. Baseline Guide, Volume 6: Biopharmaceutical Manufacturing Facilities, 2nd ed. December 2013.
Figure 3: Closed system life cycle

## Proof Of System Closure

Since system closure encompasses three attributes (cleanliness, bioburden, and integrity), proving system closure requires much more than ensuring a system has sufficient isolation from the environment. Methods for ensuring all three attributes must be in place for each stage of the system’s life cycle. A direct measure of system closure for each one is ideal—such as a filter-integrity measurement, or pressure hold test on stainless equipment. These are completed for each use of the system or continuously during use.

Indirect measures are also employed to confirm closure, especially in cases where a direct measure is not possible. Indirect measures are indicative of system closure, but do not verify it. Like direct measures, they occur before each use or continuously during use. Typical cell culture health parameters (e.g., viable cell density), for example, are indicative of correct sanitization, and a manual or automatic verification of cleaning or sanitization equipment performance (time, temperature, concentration) indicates that the cleaning and/or sanitization were likely effective.

Finally, quality system methods ensure correct system closure. These consist of validation studies and vendor quality agreements documenting that the systems and materials utilized are fit for use.

 Direct Indirect Quality System Visual inspection of system integrity Filter integrity test Pressure hold test In process bioburden sample Confirmation of noncontamination Adventitious virus testing Helium leak testing Conductivity (e.g., real-time CIP return) Verification of cleaning/sanitization cycle Cell culture health measures Positive pressure monitoring Pre-inoculation media hold verification Cleaning record review Cleaning validation Sanitization/sterilization validation Vendor quality agreements Clean hold validation Challenge testing of sterile connectors Media hold and other process simulation studies In-process hold simulation studies Leachables/extractables testing Destructive incoming testing for integrity/performance

Taken altogether, a structured and complete account of direct, indirect, Figure 3: Closed system life cycle and quality system methods should form a web of confidence and sufficient proof of closure for a given system. A partial list of typical direct, indirect, and quality system verifications is shown in Table A. A suggested format for documenting these methods, shown in Table B (PDF), contains the following elements:

1. Describe the system to be assessed. A variety of scopes are possible, ranging from a single component (e.g., sterile connector), to a complete system (e.g., bioreactor with attached feed vessels).
2. Describe each part of the system life cycle (pre-use, in use, post-use):
• Describe the sequence of operation for each phase of the system life cycle
• List the materials that must pass through the system boundary
• Define the system boundary
3. Itemize proof-of-closure activities:
• For each part of the system life cycle
• For each closure attribute (cleanliness, bioburden, integrity)
Table C: Proof of closure matrix for a Systemnutrient hold tank
System Description
System Nutrient hold tank including inlet from filter transfer skid and outlet to bioreactor
Materials Stainless steel vessel, Teflon elastomer valve closures, sterilizing grade filters (vent and liquid inlet), Viton O-rings
Cleaning methods
• Some components cleaned out of place with automated ware washer
• Automated CIP of vessel with spool pieces in place of filter housings
Bioburden reduction
• SIP of assembled vessel
Sequence of Operation
Pre-use Assemble any components cleaned out of place. Install spool pieces enabling CIP of the vent filter line and inlet transfer line. Run automated CIP process. Replace spool pieces with vent filter assemblies cleaned off-line, with tested and dried filter installed. Run automated SIP. Maintain at positive pressure during cool down with filtered compressed air and/or condensate.
In use Receive filtered nutrient from the filter transfer skid through the transfer line. Close transfer line valve after transfer. Maintain vessel at slight positive pressure. Feed the bioreactor as required through automated on/off diaphragm valve. Motive force is provided by tank positive pressure.
Post-use Isolate from the tank from the upstream and downstream systems. Vent to atmospheric. Remove filter assemblies and replace with spool pieces. Post-use CIP vessel and maintain at slight positive pressure. Integrity test filter assemblies and then clean out of place.
Mass Transfer
Pre-use
• Steam during SIP
• Clean air to maintain vessel pressure post SIP
In use
• Nutrient removal through the automated diaphragm valve
• Air (room or pressurized clean, dry, oil free) in and out of vent filter as tank level changes or to maintain desired tank pressure
Post-use
• CIP fluids and air blow down
System Boundaries
Pre-use
• Components cleaned, assembled, or sanitized out-of-place that are protected during storage and transport.
• Open ports, fittings, or transfer lines protected from the environment After SIP:
• Stainless vessel walls, inlet piping from filter skid, outlet piping to bioreactor
• Valves at sterile boundary, sterilizing grade final filter of filter skid, sterilizing grade filter on vent
In use
• Same as pre-use
• After tank filling: system contracts with closing of the inlet line isolation valve
Post-use
• Components removed from the vessel to be cleaned out of place are managed to avoid release of process soils to the facility.
• Components cleaned, assembled, or sanitized out of place are protected during storage
• Open ports, fittings, or transfer lines on the vessel must be protected from the environment
Attribute Proof Type Method Pre-Use In Use Post-use Remarks
Environmental segregation Direct Visual inspection X X
Filter integrity test X   X
Pressure hold test X
System boundary, Confirm Valve Position   X
Indirect Human factor error proofing X X
Positive sys press control Post SIP X
Quality system 2nd visual inspection X
Cleanliness Direct Visual inspection (1)   X (1) Per expired clean hold
Conductivity test     X
Indirect E/L studies (2)     (2) Leachables and extractables could be seen as an
external contaminate
Automated cleaning (1)   X (1) Per expired clean hold
Manual cleaning     (3) (3) Possible manual cleaning of spare parts
Quality system Cleaning validation (1)   X (1) Per expired clean hold
Maximum clean hold time X
Cleaning record review (1)   X (1) Per expired clean hold
Maximum soiled hold time     X
Bioburden Direct N/A
Indirect Automated sanitization/sterilization X
Cell culture health/visual inspection   X X
Process performance/parameter trending   X
Confirm noncontaminated samples     X
Quality system Sanitization/sterilization validation X
Sanitization/sterile hold studies
General   SOPs X X
Operator training X X
SOP verification X X
Table D: Proof of closure matrix for a nutrient hold single-use bag
System Description
System Single use: media/nutrient sealed sterilized (gamma-irradiated) bags
Materials Various polymers in the bag, tubing, filter, and fittings.
Cleaning methods Manufactured in environmentally controlled rooms at the supplier.
Bioburden reduction Gamma irradiation, certified sterile.
Sequence of Operation
Pre-use At the bag vendor, polymer films are fused into a multilayer sheet. The sheets are assembled into bags with tubing, filters, and fittings. The filter is integrity tested and dried before assembly.
Welding process is validated. Assembly is gamma irradiated using validated sterilization process. Bag is shipped and stored according to procedures and expiration date assigned.
In use Remove bag from shipping container and place bag in support structure. Clamp outlet tubing. Connect inlet tubing to mix vessel through peristaltic pump. Fill bag with nutrient through 0.2 μm sterilizing grade filter. Thermal seal inlet tubing near bag and remove filter. Connect liquid outlet to bioreactor through sterile connector. Install tubing in peristaltic pump. Feed bioreactor as required.
Post-use Disconnect from bioreactor. Confirm integrity of bag (e.g. no evidence of leaks or damage, proper disconnect procedure.) Remove excess material in a controlled manner. Remove filter and discard bag. Integrity test filter.
Mass Transfer
Pre-use None
In use Nutrient/media flows in through the sterilizing filter and out through the sterile connector line
Post-use Residual or used materials removed from the bag before disposal
System Boundaries
Pre-use Bag, sterilized tubing from bag to 0.2 μm liquid inlet filter, sterilized tubing from bag to liquid outlet sterile connector
In use Filling: no change from pre-use. Discharge to process: bag system boundary connected to bioreactor system boundary
Post-use Aseptic disconnect or sealing of tubing while disconnecting the bag from the bioreactor. Maintain system integrity until controlled discharge of residual material.
Attribute Proof Type Method Pre-Use In Use Post-use Remarks
Environmental segregation Direct Visual inspection X X X
Filter integrity test X   X
Indirect Human factor error proofing   X
Use of validated dis/connectors   X
Quality system Dis/connectors validation   X
Training and SOPs X X X
Handling and housekeeping procedures X X X
2nd visual inspection X X X
Vendor quality agreement X
Certificate of analysis/conformance X
Cleanliness Direct Visual inspection X
indirect E/L studies (2)     (2) Leachables and extractables could be seen as an
external contaminate
Quality system Vendor quality agreement X   X
Certificate of analysis/conformance X
Qualified environmental controls at supplier X
Training and SOPs X X X
Handling and housekeeping procedures X X X
Bioburden Direct N/A
Indirect Sanitization/sterilization by supplier X
Cell culture health/visual inspection   X X
Process performance/parameter trending   X
Confirm noncontaminated samples   X X
Quality system Sanitization/sterilization validation X
Sanitization/sterile hold studies X
Vendor quality agreement X
Certificate of analysis/conformance X
Qualified environmental controls at supplier X
Training and SOPs X X X
Handling and housekeeping procedures X X X
General   SOPs X X X
Operator training X X X

This proof of closure matrix is an invaluable tool for risk assessments, investigations, and audits. It also aligns well with the “closure analysis” described in Section 4.4.1 of the ISPE Biopharmaceutical Facilities Baseline Guide. The matrix is the natural outcome of phases 1 and 2, where the system is defined, risks identified, and control measures documented. It provides succinct guidance for the risk-rating assignment in phase 3, and data to justify the assessment of residual risk via the fault tree analysis presented in the Guide.

Once completed, the closure matrix retains a lasting utility. It provides a focal point for deviation investigations, especially those dealing with an excursion of in-process bioburden or potential cross-contamination in dual-product facilities. It facilitates hazard and operability studies and other risk assessments for both new facilities and retrofits; it lets technology-transfer teams determine if new processes are compatible with existing facilities, and helps compose procedures for new processes. At a license holder’s discretion, it could also be used to justify operations to external auditors.

In summary, to reap the benefits of closed processing systems, firms must prove that the equipment and operations in use isolate the process from the environment. The natural inclination to rely merely on measures and procedures that ensure system integrity is insufficient; the system’s life cycle and cleanliness and bioburden attributes must also be considered. A thorough assessment of a system’s closure must consider the following:

• Closure = ƒ(cleanliness, bioburden, integrity), i.e., closure is attained only when a system has acceptable levels of cleanliness, bioburden, and physical integrity.
• Closed production is performed in a sequence of closed systems.
• Closed systems have a life cycle: pre-use, in use, post-use.
• Despite being “closed,” systems must permit the addition, removal, and transfer of mass in a way that maintains system closure.
• Different processes have different closure requirements; the system should meet those requirements.
• Creating and proving closure differs by equipment type, connections to adjacent systems that must be made, and materials of construction.
• Proof of closure includes direct and indirect measures of closure, as well as quality system activities.

When this assessment has been completed for all unit operations and systems, it is possible to document a facility-wide proof of closure strategy matrix that will prove a useful reference for a variety of activities within the engineering, development, and operations functions.