Computerized System Validation –
Risk Based Approach
Katalyst Healthcares & Life Sciences
1
www.KatalystHLS.com
Regulatory Imperative of Data Integrity
The extent to which all data are complete, consistent and accurate
throughout the data lifecycle.
–
The completeness, consistency, and accuracy of data.
Why do they care DI ?
For electronic records to be trustworthy and reliable, the links
between raw data, metadata, and results must not be
compromised or broken. Without data integrity, it is not possible to
regenerate a previous result reliably
Control and Validation of Computerized Systems is Central
Katalyst HealthCares & Life Sciences
www.KatalystHLS.com
Audit approach to DI on Computerized Systems
Regulatory expectations are
set by:
1. Knowledge of Regulations
2. Guidance Documents
3. Experience (483, WL)
What are the GxP What are the What Guidance
Requirements?
(P11, A11 etc.)
Experiences? is there?
Categorize regulations and Guidance into
ALCOA+ elements
Determine what Controls are necessary to
Establish / Demonstrate Data Integrity
Katalyst Healthcares & Life Sciences
3
www.KatalystHLS.com
What does the Guidance Say?
UK, US, WHO guidance is broadly equivalent, some
variations of coverage and terminology
Topic
• Definitions √ √ √
• Data Governance Strategy, Training, Whistle-Blower Policy/Practice √ √ √
• Design of Processes and Systems (locations/scribes) X √ √
• Raw Data, Meta Data, Original Records and True Copies Control √ √ √
• Control of QC Testing and Results √ X X
• Primary Records Control X √ X
• Control of Blank Forms (Paper records) √ X √
• Data Review (including Exclusion of Data and Audit Trail Review) √ √ √
• Data Retention – Archival, Backup Copies √ √ √
• Computerized System Validation and Electronic Record, Signatures √ √ √
• Audit Trail Requirements √ √ √
• Access Control √ √ √
• Data Integrity Issue Remediation Approach √ X √
Katalyst Healthcares & Life Sciences
4
www.KatalystHLS.com
Key Definitions
Term Regulatory Definitions
Data Information derived or obtained from raw data
Static Data Fixed-data document such as a paper record or an electronic image
Data with format that allows interaction between the user and the record
Dynamic Data
content
Original records and documentation, retained in the format in which they
Raw Data
were originally generated, or as a true copy
The contextual information required to understand data. It is the data that
Metadata
describe the attributes of other data, and provide context and meaning
Data as the file or format in which it was originally generated, preserving the
Original record
integrity (accuracy, completeness, content and meaning) of the record
True Copy
An exact verified copy of an original record
Data recorded by direct entry into a Computerized System either by a digital
Electronic Data
device or operator entry
Electronic Record Electronic Data that is used in lieu of paper cGxP records
A system of operator authentication, adopted or authorized by an individual,
Electronic
which is the legal equivalent of the individual’s handwritten signature for a
Signature
cGxP action or approval
Katalyst Healthcares & Life Sciences
5
www.KatalystHLS.com
FDA Warning Letters
Trends for Computerized System Warning Letters
Area 2012-2017 %
Validation 40 29
System Documentation 26 19
Data-related 21 15
Procedures 20 14
Lack of Controls 16 12
Access/Security 9 7
Incident/Change Mgmt. 3 2
Testing 2 1
Interface 1 1
Total 138 Letters 100%
Katalyst Healthcares & Life Sciences
6
www.KatalystHLS.com
30 Years of CSV Guidelines & Regulations
1980 1983 1986 1990 1995 1997 2000 2003
Time
Computer FDA FDA Japan EU Japan OECD ICH FDA FDA HIPAA
Blue SW & GMP GMP GLP GCP Part CSUCT 2003
Validation 1999/2004
Book Guide UK Ax. 11 11
Directives GLP &GCP EC PIC/S
94/95 Part FDA Guide
Pvcy 820 Device
SW Val. Part 11
2005 2006 2007 2011 2013 QMS Scope
Time GAMP 5
HIPAA Sarbanes FDA
FDA FDA OECD EU FDA Guide
Security Oxley PRO cGMP CSUCI GLP GMP Source
2005 (SOX) 9/06 5/07 Archive Annex Data &
Guide
11 RBM
Use of Computerized Systems in the R&D & Manufacture of Drug Product
Impact of - GXP Operations: GMP,GLP,GCP,ES...
Computerized - Computerized Systems Component of Operations
Systems
Katalyst Healthcares & Life Sciences
7
www.KatalystHLS.com
GAMP’s Definition of a Computerized System
Pharmacovigilance
Breadth of Applicability of computerized Systems Validation
Operating
Software procedures
and people
Hardware
(Including firmware) Equipment
Computer System (Controlled functions
(Controlling System) or processes)
Computerized System
Operating Environment
(including other networksKatalyst
or standalone
Healthcares &computerized
Life Sciences systems,
other systems, media, people, equipment and procedures) 8
www.KatalystHLS.com
CSV - What are we trying to achieve?
The testing is documented
It is tested -
rigorously
“Establishing documented evidence which provides
a high degree of assurance that a computerized
system consistently performs according to
predetermined specifications and quality attributes”
The system
is specified
The validation is maintained Testing verifies quality
throughout the system’s life cycle acceptance criteria
Fit for intended function
Katalyst Healthcares & Life Sciences
9
www.KatalystHLS.com
Design - Processes and Systems
Systems / processes should be designed to
encourage / enforce ALCOA+
•Access to clocks for recording timed events
•Accessibility of the records
Physical
•Control over blank paper templates for data recording
Arrangements •Access to sampling points (e.g. water systems)
•Access to raw data for staff performing data checking
Computerized • User Account Management
•Automated data capture
Systems •Proximity of printers to relevant activities
Controls •Metadata as part of GxP Data
Katalyst Healthcares & Life Sciences
10
www.KatalystHLS.com
CSV – Life Cycle Approach
Category 5 Custom
Increasing Configurable Increasing
complexity Category 4 Standard
rigor of
Products
validation
activity
Increasing Non-
likelihood Category 3
Configurable
Standard
of failure Product
Standard
Category 1
Infrastructure
Katalyst Healthcares & Life Sciences
11
www.KatalystHLS.com
Risk Assessment within the System Life Cycle
Katalyst Healthcares & Life Sciences
12
www.KatalystHLS.com
Validation - Scaling Rigour : Category 5
Katalyst Healthcares & Life Sciences
24
www.KatalystHLS.com
Validation - Scaling Rigour : Category 4
Katalyst Healthcares & Life Sciences
25
www.KatalystHLS.com
Validation - Scaling Rigour : Category 3
Katalyst Healthcares & Life Sciences
33
www.KatalystHLS.com
Validation - Scaling Rigour : Category 1
Katalyst Healthcares & Life Sciences
34
www.KatalystHLS.com
Validation Process Flow
Concept
Identify: Opportunities to Automate Business Process
Develop: Initial User Requirements
Identify Key Personnel
(System Owner, Process Owner, SME)
Identify Suppliers
Develop URS IRA
Supplier
Project
Assessment
System Identify Potential
Assessment Supplier
Validation
Plan
Specification Configuration and
Documents coding
Reporting &
Release Verification
Operation
Normal
Operations
Decommissioning Katalyst Healthcares & Life Sciences
Retire
ment
35
(System Retirement) www.KatalystHLS.com
Incidents
What is and what is not a Computerized System Incident
Case Study-5
Is an Incident Is Not an Incident
“I could log in yesterday, I
know my password, but I
can’t get in today” “the battery in my Service Request
mouse is dead” “printer
“I lost my laptop. It has cartridge is empty”
critical GxP data on it” Help requests are
“I don’t know which Service requests
button to press to
“Yesterday the system
do…”
would let me use that
function – today it
won’t” Access Request
“I forgot my password”
“I get a strange error
message in browser –
something about java
versions” “I have found a minor
good documentation Minor Document
“I pressed the button for practice problem to the Change
the report 3 hours ago, it system’s validation
normally takes seconds” documentation”
“Oh no! the disc
Katalyst Healthcares & Life Sciences
crashed!” 36
www.KatalystHLS.com
Change Control
What is a Change to a Computerized System?
Computerized Systems Change Electronic Data Change
•Change to CS Hardware, •Changes to the Electronic Data
software or system parameters created, held, processes and
•Changes that have potential to transmitted by a Computerized
impact (intentionally or System
unintentionally) the functionality •Electronic Data Changes have
of a Computerized System no impact on CS Functionality
Computerized Systems Changes Business Process specific SOPs
are governed by specific Change that govern the process to which
Control Procedure the electronic data pertain
Katalyst Healthcares & Life Sciences
37
www.KatalystHLS.com
Regulations requiring CSV
21 CFR Parts 210, 211 - Good Manufacturing Practices
21 CFR Part 820 - Quality Management Requirements for Medical Devices
21 CFR Parts 50, 56, 312 – Good Clinical Practices
21 CFR Part 58 – Good Laboratory Practice
21 CFR Part 11 – Electronic Record; Electronic Signature
Directive 2003/94/EC – Requirements for Good Manufacturing Practice
- Annex 11: computerized systems
Directive 2005/28/EC - Requirement for Good Clinical Practice (GCP)
Directive 2004/9/EC - Inspection and Verification of GLP
MHRA GMP Data Integrity Definitions and Guidance to Industry
PIC/S PI 011 – 3 – Good Practices for computerized Systems in
Regulated “GXP” environments
Katalyst Healthcares & Life Sciences
38
www.KatalystHLS.com
Regulatory Audits – Focus Areas
S.No Audit focus FDA MHRA WHO EDQM TGA AGES ANVISA
1. CSV √ √ √ √ √ √ √
2. CSVMP √ √ √ √ √ √ √
3. CS Inventory √ √ √ √ √ √ √
Gap Analysis &
4. Remediation- √ √ √ √ √ √ √
Legacy applications
System Landscape
5. √ √ √ X X X X
& Architecture
6. PLC Capability √ √ √ X X X X
SAP Business
7. √ √ √ √ √ √ √
Process
8. SAP Configuration X √ X X X X X
9. SAP - UAM √ √ √ √ √ √ √
10. SAP - MDM √ √ √ √ √ √ √
11. CDS √ √ √ √ √ √ √
Empower Message
12. √ X X X X X X
Center
13. CDS - UAM √ √ √ √ √ √ √
Katalyst Healthcares & Life Sciences
39
www.KatalystHLS.com
Regulatory Audits – Focus Areas
S.No Audit focus FDA MHRA WHO EDQM TGA AGES ANVISA
14. LIMS √ √ √ √ √ √ √
15. LIMS - CDS √ √ √ √ √ √ √
16. LIMS - UAM √ √ √ √ √ √ √
17. LIMS MDM √ √ √ √ √ √ √
18. QMS √ √ √ √ √ √ √
19. DMS √ √ √ √ √ √ √
20. Challenge Tests √ √ √ √ √ √ √
21. Testing Strategy √ √ √ √ √ X X
IT
22. Incident/Change √ √ √ √ √ X X
Management
23. Training √ √ √ √ √ √ √
Backup &
24. √ √ √ √ √ √ √
Restoration
25. Disaster Recovery √ √ √ √ √ √ √
Network
26. √ X X X X X X
Validation
Katalyst Healthcares & Life Sciences
40
www.KatalystHLS.com
High Level Business Process & IT Alignment
WARE HOUSE
Forecasting Procurement
Goods Receipt
and Demand MRP Run Based on MRP
Process
Management Run
Raw Material
Process Order Quality CDS SDMS
Indent to WH Production
Release Analysis /
- Planning / LES SDMS
Goods Issue to Electronic Usage
Scheduling
MFG BPR Decision
PROCESS AREA
Process Order Quality
Intermediate /
Execution Analysis / Sales Order
Finished
(Batch Processing
Goods Receipt Usage
Charging) Decision
Dispatch
Finished Process Order-
Delivery and
Product Label Usage API Execution
Billing of Sales
and QA Decision and GR
Order
Release Dispatch
Process Order-
FDF Execution
and GR
LIMS Serialization EMS
LEGEND SAP
DMS MES QMS (NOR)
Katalyst Healthcares & Life Sciences
41
www.KatalystHLS.com
Here we are….Lets Pace up
WARE HOUSE
Forecasting Procurement
and Demand MRP Run Based on MRP Goods Receipt
Management Run Process
CDS
Raw Material Quality
Process Order
Indent to WH Production Analysis /
Release
- Goods Issue Planning /
to MFG Scheduling
BPR Issuance Usage
Decision
PROCESS AREA
Process Order Intermediate / Quality
Execution Analysis / Sales Order
Finished
(Batch Processing
Goods Receipt
Charging) Usage
Decision
Finished Dispatch
Delivery and Process Order-
Product Label Usage
Billing of Sales Execution
and QA Decision
Order and GR
Release
LIMS CDS
LEGEND WMPS/SAP
BIMS Manual
Katalyst Healthcares & Life Sciences
42
www.KatalystHLS.com
Questions
s ?
i on
st
ue
Q
Contact:
Katalyst HealthCares & Life Sciences
Website: www.KatalystHLS.com
e-mail: [email protected]
Phone: 908-967-5588
Fax: 908-967-5589
Katalyst Healthcares & Life Sciences
43
www.KatalystHLS.com
