A Road Map To: Computer System Validation

A Road Map to COTS CSV, HPLC 1
A Road Map to
COTS
Computer System Validation
based on a HPLC, as example
Ulf Segerstéen
Pharma Quality Europe AB
Quality
SARQ, 3rd of October, 2002
PQE
Information PHARMA QUALITY EUROPE / www.pqe.it / [email protected]
Pharmaceuticals
Technology
21 CFR Part 11 effective Incipit requires ....

Validation of systems to ensure
accuracy, reliability, consistent
intended performance, and the ability to
discern invalid or altered records (§11.10(a))
…. The Bar is being raised

PART 11
COMPLIANCE
NEW
STD
COMPLIANCE
CSV
COMPLIANCE
NEW STD
CSV
COMPLIANCE
Quality
ER NEW OLD STD
ER NO ER
PQE
Pharmaceuticals
Technology
Guidance Content:
 GUIDANCE KEY ELEMENTS
System Requirements Specifications (5.1)
Documentation of Validation Activity (5.2)
Equipment Installation (5.3)
Dynamic Testing (5.4)
Static Verification Techniques (5.5)
Extent of Validation (5.6)
Independence of Review (5.7)
Change Control (5.8)
 SPECIAL CONSIDERATIONS: COTS products and Internet
Example of Guidance: Independence of Review

Computer system validation should be performed by persons other than those
GUIDANCE
CFR 21 P 11
responsible for building the system.

Two approaches to ensuring an objective review are:
(1) Engaging a third party
(2) dividing the work within an organization such that people who review the
system (or a portion of the system) are not the same people who built it.
Quality
PQE
Pharmaceuticals
Technology
COTS (Commercial Off-The Shelf) products

Commercial software used in electronic record keeping system subject to part
11 needs to be validated, just as programs written by end users need to
GUIDANCE
CFR 21 P 11
validated
(…)
We do not consider commercial marketing alone to be sufficient proof of a
program’s performance suitability
(…)
See 62 Federal Register 13430 at 1344-13445 March 20,1997
WRONG APPROACH
SYSTEM IS A COMMERCIAL IT’S OK.

PACKAGE, WIDELY USED NOT NEED TO BE VALIDATED
RIGHT APPROACH
END USER REQ SPECS
SYSTEM IS A COMMERCIAL SW STRUCTURAL INTEGRITY
PACKAGE, WIDELY USED
FUNCTIONAL SW TESTING
Quality
PQE
Pharmaceuticals
Technology
New Trend - Partnership by-Outsourcing Validation Activities

What’s in it for the Customer ?
•Staying focused on his business - be more cost-effective.
•Staying on top of the requirements - stay compliant rather than spending time solving regulatory
issues.
•Sharing the latest knowledge - don’t be active in all fields and save time for the core business.
•Being prepared for what’s to come - get resources when needed, don’t let them be an added cost to
the Products.
•Being part of the solution NOT part of the problem - give the
organization confidence to handle changes and challenges.
•Always having access to a Partner to discuss and solve issues with.
What’s in it for the Partner ?
•Client staying focused on his business makes easier for the Partner to support him.
•Client staying updated on the requirements gives the Partner flexibility to act more proactively.
•Sharing the latest knowledge makes the Client and the Partner understand each other, reducing
misunderstandings and increasing efficiency.
•Being prepared for what is to come helps the Partner to keep prices down and gives the Client more
accurate budget control.
•Being part of the solution, NOT part of the problem, helps both parties in solving and anticipating
potential problems.
Quality
PQE
Pharmaceuticals
Technology
The Lifecycle Activities for a COTS, using

a Project perspective:
SPECIFY TEST START UP
PLAN TO BE
SUPPORT
PROACTIVE CONTROL &
IMPROVE
Quality
PQE
Pharmaceuticals
Technology
The Lifecycle Activities for a COTS, cont.
SPECIFY TEST START UP
URS (PROCESS) USER GUIDE

PROCESS Q
EVALUATION SYSTEM ORG. &

FAT & SAT
DOC’s
VALIDATION PLAN VALIDATION
TEST PLAN
REPORT
MASTER INDEX DRAFT SOP’s
(MI) SOP’S (Approved)
Quality
PQE
Pharmaceuticals
Technology

User Requirement Specification based on:
• the lab Process including the HPLC-equipment, HW-
platform, SW-application, printer, expected filestorage and
user interactions.
SPECIFY • requirements for compliance to CFR 21 Part 11 (ER & ES)

and other applicable GxP regulations
• testable requirements
URS (PROCESS)
It is important that your end user requirements specifications take into
CFR 21 P 11 GUIDANCE
account
EVALUATION •predicate rules
•part 11
VALIDATION PLAN •and other needs unique to your system
that relate to ensuring
•record authenticity
MASTER INDEX •integrity
(MI) •signer non-repudiation
•and, when appropriate, confidentiality.
Quality
PQE
Pharmaceuticals
Technology
COTS
GUIDANCE End User Requirements Specifications
CFR 21 P 11
End users should document their requirements specifications relative

to part 11 requirements and other factors, as discussed above.
Pharma Industry
Define
what you User
Define
need Requirements
what Specifications
(all factors) Define
predicate
what Part
rule needs
11 Quality Assurance ______
needs System Owner _________
Quality
March, 2002
PQE
Pharmaceuticals
Technology

Evaluation based on:
SPECIFY • the CS fulfilling the Process that it is to be used within.
• Risk Assessment Index, based on complexity of the CS and on

the criticality for failure during the process.
URS (PROCESS) RISK MANAGEMENT=RISK APPROACH+RISK
ACTIVITIES
EVALUATION
• the Suppliers expected role, process and responsibilities
VALIDATION PLAN during the Project for developing + testing (FAT), installing and
testing at the customers site (SAT), supporting the CS over time
MASTER INDEX and license agreements.
(MI)
• fulfillment of compliance to CFR 21 Part 11 (ER & ES) and
other valid GxP regulations
• referenced other Pharmaceutical customers using the system.

Quality
PQE
Pharmaceuticals
Technology

Evaluation of WHAT approach to take:
GOLDEN RULE
PROCESS
CRITICALITY VALIDATION EFFORT
SHOULD BE MAXIMUN FOR
DATA
HIGH CRITICAL AND
COMPLEXITY COMPLEX SYSTEMS.
EFFORT MIGHT BE REDUCED
SYSTEM THROUGH AUDITS IN CASE
CATEGORY OF SW STANDARDS
Quality
PQE
Pharmaceuticals
Technology
Criticality Assessment
• High
Software application whose features and functions have a direct impact
on the quality, performance and efficacy of drug products
• Medium
Software used for business process analysis, information and
documentation systems that poses some business risk, or can have an
indirect impact on drug products
• Low
Packaged Software used for business purposes that poses no business
risk
Quality
PQE
Pharmaceuticals
Technology
Risk Assessment Evaluation

The Risk Assessment Index (RAI) is a rationale to evaluate the criticality and
complexity of computerized systems.
• System Complexity is higher when system:

 Performs detailed algorithm or calculations
 Interfaces with other computerized systems
 performs extensive data input checking
 processes numerous types of transactions
 requires extensive support to be maintained
 involves a large number of users
• GxP Criticality is an index of the impact of the system on pharmaceutical product or on
raw data safety and traceability
System Complexity
RAI definition
GxP Criticality (see next page)

Quality
PQE
Pharmaceuticals
Technology
Risk Assessment Evaluation

…that brings to RAI definition:
RISK ASSESSMENT INDEX
GLP/GMP Criticality Complexity RAI
Null Low/Medium/High complexity 0
Low criticality Low complexity 1
Low criticality Medium complexity 2
Low criticality High complexity 3
Medium criticality Low complexity 4
Medium criticality Medium complexity 5
Medium criticality High complexity 6
High criticality Low complexity 7
High criticality Medium complexity 8
High criticality High complexity 9
Quality
PQE
Pharmaceuticals
Technology
RAI used for evaluating HOW to perform

the Supplier Evaluation
EVALUATION
THROUGH RAI=0-2
RISKS REFERENCES
EVALUATION
THROUGH RAI=3-4
EXPERIENCES
REQUEST FOR
RAI=5-6 INFORMATION
3RD PARTY
RAI=7-8 AUDIT
SPECIFIC FIRM
RAI=9 AUDIT
COSTS
Quality
PQE
Pharmaceuticals
Technology
COTS Functional Testing of SW dependent on

Supplier Documentation available
GUIDANCE
CFR 21 P 11
When the end user cannot directly review the program source code or
development documentation more extensive functional testing might
be warranted than when such documentation is available to the user.
REDUCE
DEVELOPMENT DOCS VALIDATION
EFFORT
Quality
PQE
Pharmaceuticals
Technology

Validation Plan based on:
SPECIFY • Validation Strategy which is based on the Evaluation.
• available Validation Methods, Tools and knowledge
URS (PROCESS) • a Validation Process that are documented as a matrix of all

Validation Activities (VA), based on RAI that are expected to be
EVALUATION executed for a HPLC (COTS). Rational given for VA’s that are
not to be performed. Correspondent User roles in the Project
VALIDATION PLAN and Supplier roles to these activities in the project are used in
the same matrix.
MASTER INDEX
(MI) • statement for compliance to CFR 21 Part 11 (ER & ES)
and other valid GxP regulations
• required Supplier-, System Documentation and User

Organization and SOPs for supporting and maintaining the CS.
Quality
PQE
Pharmaceuticals
Technology
R Project Validation Maintenance

E Documentation Documentation Documentation
A • User • Validation Plan • Registration
Requirements • Validation Protocols • Support Agreements
L
and Records for HW and SW
I
• Validation Report • SOP´s
Z
E
Master Index (MI)

O
P
E
R Escrow Change
A User Control IQ Periodic
T Documentation Documents Log Review
E
Validation Backup
Quality
Documentation Log
PQE
Pharmaceuticals
Technology
SPECIFY TEST
Prerequisites to move to Test phase:

URS (PROCESS) Reviewed and Approved URS
EVALUATION Approved EVALUATION REPORT
VALIDATION PLAN Reviewed and Approved VALIDATION PLAN
MASTER INDEX Standard Index produced for all documents

(MI)
Quality
PQE
Pharmaceuticals
Technology
TESTING IS THE KEYSTONE

OF THE VALIDATION
PROCESS...
TESTING
USR
FSP SOPs
VAL Tests should include not only
VAL
CFR 21 P 11 GUIDANCE
PLAN REPORT “normal or “expected” values,
but also stress conditions.
Test conditions should extend to
•boundary values,
•unexpected data entries,
•error conditions,
•reasonable challenges,
•branches,
INDEPENDENCE FROM DEVELOPMENT •and combinations of inputs.
Quality
PQE
Pharmaceuticals
Technology
The perfect path …..

PROGRAM BUILD TESTING
This testing is performed on units of modules, SYSTEM
integrated units of code and the program as a TEST
whole.
STRUCTURAL TESTING
This testing takes into account the internal
mechanism of a system or component (white
box testing). Structural testing should show FAT/
that the software creator followed SAT
contemporary quality standards.This testing
usually includes inspections of the program
code and development documents.
FUNCTIONAL TESTING
This testing involves running the program
OQ/PQ
under known conditions with defined inputs
and documented outcome that can be
compared to pre-defined expectations (“black
Quality
box” testing)
PQE
Pharmaceuticals
Technology
Life & Test Cycle Model:

URS User Requirement Specification Performance/Process Qualification
Risk Analysis
S Functional Specification Operation Qualification

U
P
Risk Analysis
P
L
I Design Specification Installation Qualification
E
R
Quality
Source Code / Source Code Testing
PQE
Pharmaceuticals
Technology
Test Plan based on:

TEST • Validation Plan and RAI of the CS.
• FAT, which would include review of Supplier Evaluation, Test,

System & User documentation from the Supplier
PROCESS Q • SAT, which would include witness during IQ and OQ on site

together with Supplier. These tests should normally include test
FAT & SAT for compliance to CFR 21 Part 11.
TEST PLAN • PROCESS QUALIFICATION, which would include performing

the complete lab process as required by URS and User Guide,
DRAFT SOP’s should also include CS Administration tests.
• DRAFT SOPs could be in one document for this type of systems
and should be available at PQ.
Quality
PQE
Pharmaceuticals
Technology
TEST START UP
Prerequisites to move to Start Up phase:

PROCESS Q Reviewed and Approved PROCESS Q based on
DRAFT versions of the User Guide and SOP’s
FAT & SAT Approved FAT & SAT REPORT
TEST PLAN Reviewed and Approved TEST PLAN
DRAFT SOP’s Filed in the Master Index (MI)
Quality
PQE
Pharmaceuticals
Technology
The Lifecycle Activities for a COTS, END
START UP:
START UP
THROUGH CS DECISION based on:
USER GUIDE USER GUIDE approved and Users trained
SYSTEM ORG. & SYSTEM ORGANISATION trained on CS and

DOC’s System Documentation available.
VALIDATION VALIDATION REPORT, no remaining corrections,
REPORT all documents in MI approved.
SOP’S (Approved) (included in MI)
Quality
PQE
Pharmaceuticals
Technology
Example of a Validation Tool to a COTS

TOOL
REUSABLE VALIDATION TOOL
1-CS Req. & SOP
2-Validation Plan & Report
3-Test Plan & Report
4-Validation Plan & Report
APPENDIX
1-CS Req. & SOP: 2-VALIDATION P&R 2-Test Plan & Report
•URS/FS/DS and Matrix with: Ver. 1
user guide •Activities incl. CFR 21 Matrix with:
•Training Part 11-declaration •Test case
•CS Security and •Responsibility •Expected Result
•Expected Output
authorization 4-Validation Report 4-Test Plan & Report
(incl. Backup and •Reported Output Ver. 2
Contingency) •Deviations •Reported Result
•Maintenance •Summary •Deviations/Re-test
•Change Control •Approval/Rejection •Summary & Recommend.
•Periodic Review
Quality
PQE
Pharmaceuticals
Technology
Saving Effort by “Reusing” the Tool
Effort
Effort Save
Effort Save
Effort Save
Infrastructure
Quality
PQE
Pharmaceuticals
Technology
Finally:
To be in Compliance means:
Coordination (Policy & Standards)
Cooperation (sharing knowledge & support)
Capacity (make realistic Plans for big changes)
Competence (get trained to gain competence)
Consistency (use same measurements & tools)
Quality
PQE
Pharmaceuticals
Technology
We envision to conveniently engineer

innovative technology in order to
synergistically facilitate value-added
leadership skills to stay competitive in
tomorrow's world
Dilbert
Quality
PQE
Pharmaceuticals
Technology

A Road Map To: Computer System Validation

Uploaded by

Copyright:

Available Formats

A Road Map To: Computer System Validation

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

A Road Map To: Computer System Validation

Uploaded by

Copyright:

Available Formats

A Road Map to COTS CSV, HPLC 1

21 CFR Part 11 effective Incipit requires ....

…. The Bar is being raised

Example of Guidance: Independence of Review

responsible for building the system.

COTS (Commercial Off-The Shelf) products

SYSTEM IS A COMMERCIAL IT’S OK.

New Trend - Partnership by-Outsourcing Validation Activities

The Lifecycle Activities for a COTS, using

SPECIFY TEST START UP

The Lifecycle Activities for a COTS, cont.

SPECIFY TEST START UP

URS (PROCESS) USER GUIDE

EVALUATION SYSTEM ORG. &

The Lifecycle Activities for a COTS, cont.

SPECIFY • requirements for compliance to CFR 21 Part 11 (ER & ES)

End users should document their requirements specifications relative

The Lifecycle Activities for a COTS, cont.

• Risk Assessment Index, based on complexity of the CS and on

• referenced other Pharmaceutical customers using the system.

The Lifecycle Activities for a COTS, cont.

Risk Assessment Evaluation

• System Complexity is higher when system:

GxP Criticality (see next page)

Risk Assessment Evaluation

RAI used for evaluating HOW to perform

COTS Functional Testing of SW dependent on

The Lifecycle Activities for a COTS, cont.

• available Validation Methods, Tools and knowledge

URS (PROCESS) • a Validation Process that are documented as a matrix of all

• required Supplier-, System Documentation and User

R Project Validation Maintenance

Master Index (MI)

The Lifecycle Activities for a COTS, cont.

Prerequisites to move to Test phase:

EVALUATION Approved EVALUATION REPORT

VALIDATION PLAN Reviewed and Approved VALIDATION PLAN

MASTER INDEX Standard Index produced for all documents

TESTING IS THE KEYSTONE

The perfect path …..

Life & Test Cycle Model:

S Functional Specification Operation Qualification

The Lifecycle Activities for a COTS, cont.

Test Plan based on:

• FAT, which would include review of Supplier Evaluation, Test,

PROCESS Q • SAT, which would include witness during IQ and OQ on site

TEST PLAN • PROCESS QUALIFICATION, which would include performing

The Lifecycle Activities for a COTS, cont.

Prerequisites to move to Start Up phase:

TEST PLAN Reviewed and Approved TEST PLAN

DRAFT SOP’s Filed in the Master Index (MI)

The Lifecycle Activities for a COTS, END

USER GUIDE USER GUIDE approved and Users trained

SYSTEM ORG. & SYSTEM ORGANISATION trained on CS and

SOP’S (Approved) (included in MI)

Example of a Validation Tool to a COTS

Saving Effort by “Reusing” the Tool

We envision to conveniently engineer