Welcome to our E-Seminar:
Risk-based Approach to Part 11 and
GxP Compliance
Chairperson: John Vis
In
tro
Common Discussion
Q: Do I really need to do this?
Possible Answers
A: Of course! (QA)
B: Who cares, I have work to do! (Engineering)
C: No way! (IT)
D: It depends! (FDA)
Source:Neil McClenney, SEC Associates, Inc., Presentation at IVT Philadelphia Conference, October 2003
Chairperson: John Vis
eg
ul
at
io
ns
R
Pharmaceutical cGMPs for the
21st Century
Announced August 21, 2002
Two year program
Merges science-based risk management with an
integrated quality system approach
Will not interfere with current enforcement
Will be implemented in multiple steps
Changes to part 11 were pre-announced in late
2002
Chairperson: John Vis
eg
ul
at
io
ns
R
Part 11 is NOT Going Away!!
Risk-based compliance approach FDA will scrutinize
areas with high impact on product quality according to
existing GxP
FDA will continue enforcing predicate rules (GxP)
Validation, change control and training are required for
GxP-relevant systems
Access security, device checks, operational checks for
trustworthy and reliable records are still mandatory
technical controls
Audit trail, copies of electronic records, record retention,
legacy systems are not a key focus area for FDA
enforcement
Electronic signature requirements are unchanged
Chairperson: John Vis
eg
ul
at
io
ns
R
Predicate Rule Requirements
Description
Production, control, laboratory records to assure that drug products
adhere to established specifications. Records for components, drug
product containers, labeling etc.
Equipment cleaning and use log
Master production and control records
Batch production and control records
Production record review
Laboratory records
Protocol for a non-clinical laboratory study
Reporting of non-clinical laboratory results
Raw data, documentation, protocols, final reports, QA inspection
records and samples, job descriptions, training records, instrument
maintenance, calibration and inspection records
Supporting records for INDA and records described by ICH GCP
Guidelines
Ensure that the systems are designed to permit data changes in such a
way that the data changes are documented and that there is no
deletion of entered data
List of individuals authorized to make data changes
Chairperson: John Vis
Category Predicate Rule
Reference
GMP
21 CFR 211.180
GMP
GMP
GMP
GMP
GMP
GLP
GLP
GLP
21 CFR 211.182
21 CFR 211.186
21 CFR 211.188
21 CFR 211.192
21 CFR 211.194
21 CFR 58.120
21 CFR 58.185
21 CFR 58.195
GCP
21 CFR 312.57
21 CFR 312.62
ICH GCP 5.5.3 c)
European GMP
Guide Annex 11 10
ICH GCP 5.5.3 e)
GCP
GMP
GCP
eg
ul
at
io
ns
R
Part 11 Requirements
Section
Requirement
Responsibility*
11.10a
Systems must be validated
Proc.
11.10b
Accurate and complete copies
Tech.
11.10c
Protection of records
Proc., Tech.
11.10d
Proc., Tech.
11.50
Access limited to authorized
individuals
Secure, computer-generated,
time-stamped audit trail
Checks (device, authority,
system checks)
Signature Manifestations
11.70
Signature/Record Linking
Tech.
11.100
Uniqueness of e-sig to the
individual
E-Sig Components and Controls
Proc., Tech.
Controls for identification codes
and passwords
Proc., Tech.
11.10e
11.10f/g/h
11.200
11.300
Tech.
Tech.
Tech.
Proc., Tech.
* Proc. = Pharmaceutical company is usually responsible to develop procedural controls
Tech. = Supplier is usually responsible to implement technical controls
= Enforcement Discretion (August 2003 Guidance)
Chairperson: John Vis
eg
ul
at
io
ns
R
New Part 11 Guidance Summary
New guidance is most relevant for low
risk systems (e.g word processor typewriter excuse)
Minor changes for high risk systems,
e.g. Chromatography Data Systems
Requirement for long term reprocessing
(>5 years) may go away
Users are required to perform risk
assessments for just about everything
Chairperson: John Vis
eg
ul
at
io
ns
R
When Part 11 Applies
GxP
Requirement?
???
no
???
Out of
scope
yes
Used for regulated
activity?
no
Out of
scope
yes
Maintain
e-records
for business?
no
Out of
scope
yes
PART 11
Chairperson: John Vis
The Regulators Product
Centric View
Drug Product Quality
The regulatory concern is product
quality and safety
Data and Records
The regulations specify the data and
records required to assure product quality
Instruments and
Systems
The validation and qualification of
systems assures data and record quality
Systems Infrastructure
The validation and qualification of
infrastructure assures system reliability
Chairperson: John Vis
FD
Validation
We recommend that you base your
approach on a justified and documented
risk assessment and a determination of
the potential of the system to affect
product quality and safety and record
integrity
For instance, a word processor used
only to generate SOPs would most likely
not need to be validated.
Validate all automated computer systems that
affect GxP type records (old and new systems).
Chairperson: John Vis
10
FD
Audit Trail
Audit trail is required by some predicate
rules.
We recommend that your decision on whether to apply audit
trails, or other appropriate measures, be based on the
need to comply with predicate rule requirements, a
justified and documented risk assessment, and a
determination of the potential impact on product quality
and safety and record integrity.
Audit trails are particularly important where the users are
expected to create, modify, or delete regulated records
during normal operation.
Chairperson: John Vis
11
A
FD
Inspectional Observation
The program runs across a LAN The firm presented a
diagram in support in support o the validation status for
this LAN. The diagram provides graphical representation
of the current I/O wiring (node lists) for each of the various
devices of this LAN. Regarding this diagram
The diagram lacks review by the quality unit
The diagram has not been maintained following
established document control procedures
The diagram has been produced using I/O data
contained within the non-validated excel node list
database, which is not a controlled record
Ref: O.Lopez, Philadelphia 2002
Chairperson: John Vis
12
A
FD
FDA Warning Letters
The firm utilizes a Wide Area Network (WAN) to connect
all Local Area Networks (LAN's). The WAN is not
validated as described below.
The Quality unit has failed to ensure that procedures are in
place, which define all system definition documentation, which
must be maintained for the WAN.
The Quality unit has failed to ensure that complete WAN
system definition documentation is included in WAN
documentation. For example, the Quality unit has failed to
ensure that the WAN validation documentation includes WAN
site diagrams.
When requested, the firm could produce no approved WAN site
diagrams. The Quality unit has failed to put in place
procedures, which define that WAN site diagrams are
maintained.
Chairperson: John Vis
13
FD
Warning Letters/
Networked System -
(Networked) system testing was not conducted
to ensure that each system as configured could
handle high sample rates.
Validation of the (networked) system did not
include critical system tests such as volume,
stress, performance, boundary, and compatibility
Ref: www.fdawarningletter.com
Chairperson: John Vis
14
A
FD
Examples From Network
Related 483 Observations
Wide Area Network diagrams (WAN) with appropriate
definition documentation identifying corporate sites on the
network that use XXX have not been included in any XXX
validation documents
Validation of the system did not include critical system
tests such as volume, stress, performance, boundary, and
compatibility
Validation documentation failed to include complete and
updated design documentation, and complete
wiring/network diagrams to identify all computers and
devices connected to the ... system
Chairperson: John Vis
15
is
k
Key Focus Areas for FDA
Enforcement
Before August 2003
Part 11 applies to all
systems that manage erecords in a regulated firm
High Priority
High
risk
Medium
risk
After August 2003
Predicate rule
requirements, documented
risk assessment and
business use determine
whether part 11 applies
Low risk systems may fall
out of scope for part 11
Low
risk
No
risk
Low priority
Chairperson: John Vis
16
Break Number 1
Chairperson: John Vis
17
is
k
R
Risk The Magic Word
A risk is a potential problem,
but a problem is a risk that
really happened.
Chairperson: John Vis
18
is
k
Risk Management
O
Risk Evaluation
Identify the system
Identify hazards and
possible harms
Estimate, justify and
document risk level
(probability/severity)
Risk Mitigation/Control
O
On-going Evaluation
O
O
O
Risk assessment
Risk Analysis
Estimate costs of
mitigation
vs. non-mitigation
Define and take actions for
mitigation
Monitor for new harms
Monitor risk levels
Update plan and take
actions
Key criteria: product quality (public health), business continuity
www.labcompliance.com/books/risk
Chairperson: John Vis
19
is
k
Documenting Risk
Assessment
Use tables with description of risks, severity,probability
and the rationale behind
Calculate overall risk factor (severity, probability)
Classify factors in high, medium and low
Risk
description
Severity
Justification Probability
Chairperson: John Vis
Justification Risk factor
20
is
k
R
Risk Prioritization Example:
QC Lab Data System
Production control
Records????
Sample receipt
and log in
Release
Packaging
Labeling
Sample
analysis
Review and
approval
Impact on product quality: DIRECT
Regulated activity based on: E-Records
Chairperson: John Vis
21
is
k
Infrastructure Risks and
Mitigation
Data Loss
(network failure)
Data Corruption
(operational errors,
transmission errors due to outof-spec components)
Data Insecurity
(inadequate controls)
Redundant setup
Continuous health monitoring
Compliance with technical
standards
Physical and logical
segregation of subnets
Security procedures (security
policies, password policies)
Technical security (firewalls,
virus protection, access control
lists)
Chairperson: John Vis
22
is
k
Example: GAMP Risk Level
Categories
Probability of
Detection
WAN
GAMP Risk Level
Severity
Likelihood
WAN
High Vulnerability Systems
Medium Vulnerability Systems
Low Vulnerability Systems
GAMP Risk Level 1 System
GAMP Risk Level 2 System
GAMP Risk Level 3 System
Source: ISPE GAMP Forum
Chairperson: John Vis
23
is
k
Validation Rigor Increases
with Vulnerability
Class of System
Custom Software
Application
COTS Application
Infrastructure
Vulnerability/Val
idation Rigor
Plan/Report
High
Design Phases
Qualification Phases
-URS (business and regulatory
needs)
-FS (Full functionality of the
system)
-Validation Plan and Report
-Detailed Risk Assessment
-Design down to module
Development
aginst operational aspects
-SOPs Supplier Audit -Project specifications
-Comprehensive positive
-Design Review Process -Audits
functional testing
Source Code Reviews
-Periodic Review
-risk-focused negative
-Change Control
Traceability Matrix
functional testing
-URS (business and regulatory
needs)
-FS (Full functionality of the
system)
-High level Risk Assessment
-Design documents
aginst operational aspects of
(application configuration
processes
aspects only)
-Positive functional testing
-Design Review Process --risk-focused negative
Traceability Matrix
functional testing
Medium
-Validation Plan and Report Development SOPs
-Supplier Audit
-Periodic Review
-Change Control
Low
-High level Risk Assessment
aginst operational aspects of
processes
-SLA
-Network topology diagram
-risk-focused functional
-Quality and Compliance Plan -Network definition (list of
-Work SOPs
supported applications,
testing (e.g. Security
-Periodic Review
network performance, security controls, data integrity,
backup and recovery)
-Change Control
requirements)
Source: ISPE GAMP Forum (Pharmaceutical Engineering, May/June 2003, Volume 23 (3), page 24
Chairperson: John Vis
24
is
k
R
Example: Networks as System
Components
Network Communication is Integral to Modern Systems
Design
Network Performance Directly Affects Application
Performance
Point Errors Can Affect Your Ability to Complete Critical
Tasks
If Critical Tasks Slowed There is a Business Cost
Regulators View Data at Risk as Product Quality at Risk
Business Impact can be High
Chairperson: John Vis
25
is
k
R
Specifying a Networked
System
To be answered by the anticipated users
Operating environment
Security requirements (physical and logical
controls, authentication, encryption, biometrics?)
Capacity (sites, users, volumes)
Performance (response times, latency)
Reliability (risks, up-time, redundancy, data
integrity)
Standards to be used: Protocols, cabling, design
considerations, operating procedures)
Chairperson: John Vis
26
n
Q
ua
lif
ic
at
io
Qualification Phases
O
Design Qualification
O
O
Installation Qualification
Operational
Qualification
Performance
Qualification
O
O
O
O
O
O
O
User requirement specifications
Functional specifications
Vendor qualification
Check arrival as purchased
Check installation of hardware and
software
Test of key functions
Requalification
Test for specified application
Preventive maintenance
On-going performance tests
Reference: L.Huber,
Validation of Computerized Analytical and Networked Systems, 2002, Interpharm Press
Detailed content and ordering: www.labcompliance.com/books/validation3
Chairperson: John Vis
27
n
Q
ua
lif
ic
at
io
DQ
Example: Qualification Phases
for Networks
The network is suitable for the applications
The design matches the intended use
IQ
Verifying and documenting static network
topology
The implementation matches the design
OQ
Dynamic topology verification and capacity
testing
The implementation operates properly
PQ
Measuring the network in use
Determining that the risk of failure in use is low
Chairperson: John Vis
28
n
Q
ua
lif
ic
at
io
Documentation
The Four Cs of a Quality
Network
Connection
Each device can connect as the application requires
Communication
The devices can communicate through the connection
Capacity
The network has sufficient capacity for quality
communication
Control
The network will continue to enable quality
communication
Chairperson: John Vis
29
n
Q
ua
lif
ic
at
io
Measurement Based Network
Qualification
Direct Measurement Reduces Risk Faster than
Documentation Alone
Direct Measurement Verifies the Actual Network
Quality
End to End Communication Quality is the Key Metric
Look Inside Your Network!
Chairperson: John Vis
30
on
cl
us
io
n
C
Flashback
Q: Do I really need to do this?
Possible Answers
A: Of course! (QA)
B: Who cares, I have work to do! (Engineering)
C: No way! (IT)
D: It depends! (FDA)
Source:Neil McClenney, SEC Associates, Inc., Presentation at IVT Philadelphia Conference, October 2003
Chairperson: John Vis
31
on
cl
us
io
n
C
Conclusion
Part 11 is not going away
You need to understand the regulatory requirements that affect
your work-area
You need to develop a gap and risk analysis
Which Trouble Areas are the Greatest Risks
What Remediation is Required
The results affect your overall validation plan
Validate applications, qualify infrastructure
Ask your suppliers for help if you lack resources or expertise
Chairperson: John Vis
32
ra
pU
p
W
References and
Recommended Reading
www.ispe.org and www.pda.org: Good Practice
and Compliance for Electronic Records and
Signatures:
Part 1: Good Electronic Records Management
(GERM),July 2002
Part 2: Complying with 21 CFR Part 11, Electronic
Records and Signatures September 2001.
GAMP 4 Guide for Validation of Automated
Systems, December 2001 www.ispe.org
Chairperson: John Vis
33
ra
pU
p
W
References and
Recommended Reading (2)
W. Winter, L. Huber: Instrument Control in Pharmaceutical
Laboratories Compliance with 21 CFR Part 11 and the New
Draft Guidance [submitted to Pharmaceutical Technology
Europe, Special Issue 21 CFR PART 11: COMPLIANCE AND
BEYOND MARCH 2003]
Wolfgang Winter, Electronic records are here to stay, Biopharm
Europe, Special Issue September 2002, 29-31
L. Huber, Implementing 21CFR Part 11 - Electronic Signatures
and Records in Analytical Laboratories Part 1, - Overview and
Requirements, Biopharm 12 (11), 28-34, 1999
W. Winter, L. Huber, Implementing 21CFR Part 11 - Electronic
Signatures and Records in Analytical Laboratories, Part 2
Security Aspects for Systems and Applications, BioPharm 13
(1), 44-50, 2000; reprinted in Pharmaceutical Technology 24 (6),
74-87, June 2000
Chairperson: John Vis
34
ra
pU
p
W
References and
Recommended Reading (3)
W. Winter and L Huber: Implementing 21CFR Part 11 Electronic Signatures and Records in Analytical
Laboratories, Part 3 Data Security and Data Integrity
BioPharm 13 (3), 2000, pages 45-49
L. Huber and W. Winter: Implementing 21CFR Part 11 Electronic Signatures and Records in Analytical
Laboratories, Part 5 The Importance of Instrument Control
and Data Acquisition BioPharm 13 (9), 2000, Agilent
publication number 5988-0946EN
W. Winter and L. Huber: Implementing 21CFR Part 11 Electronic Signatures and Records in Analytical
Laboratories, Part 6, Biopharm and LCGC North America
November 2000 Supplement
Chairperson: John Vis
35
