Computer System Validation 11/18/2018 Computer System Validation     Introduction, Requirements and Tools for Implementation Audio Seminar September 14, 2006 For any question before, during or after the seminar, send an e-mail to huber@labcompliance.com Re: Audio156

Today’s Agenda Q&A's Q&A's FDA and international requirements 11/18/2018 Today’s Agenda FDA and international requirements Terminology, master&project planning, Specifications (DQ) Vendor Assessment IQ/OQ/PQ Change control, requalification Validation report and other documentation 10 worst mistakes Part 1 Q&A's Part 2 Q&A's

Reference material Master plan/Project Plan 11/18/2018 Reference material Master plan/Project Plan SOPS - Validation of COTS systems - Risk based validation - Validation of spreadsheet applications - Testing - Validation of electronic document management systems Example: Identification of computer systems Examples for Warning letters FDA and other guidance documents This material and more is available for download on the seminar website. The link is included in the order confirmation. For ordering go to: www.lacompliance.com/seminars/audio156

Regulations and Quality Standards 11/18/2018 Regulations and Quality Standards Good Laboratory Practices GMP Manufacturing Practices Good Clinical Practices FDA’s 21 CFR Part 11 (Electronic records and signatures) EU and FDA Japan (Automated) Equipment should be suitable for it’s intended use Equipment should be routinely checked

Calibration, inspection, routine checks 11/18/2018 FDA GMP (211.68) (a) Automatic, mechanical, or electronic equipment or other types of equipment, including computers, or related systems that will perform a function satisfactorily, may be used in the manufacture, processing, packing, and holding of a drug product. If such equipment is so used, it shall be routinely calibrated, inspected, or checked according to a written program designed to assure proper performance. Written records of those calibration checks and inspections shall be maintained Calibration, inspection, routine checks Calibration records Written program

US FDA 21 CFR Part 11 - Electronic Records, Electronic Signatures - 11/18/2018 US FDA 21 CFR Part 11 - Electronic Records, Electronic Signatures - US FDA 11.10 (a): Computer systems should be validated to ensure accuracy, reliability and consistent intended performance Part 11 Guidance Scope and Applications, C1. We recommend that you base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity.

FDA Warning Letters Calibration, checking Requirements 11/18/2018 FDA Warning Letters Your firm failed to establish and maintain procedures to ensure that equipment is routinely calibrated, inspected, checked, and maintained (160) Inspection and Testing of Manufacturing Equipment, xxx do not fully describe the requirements for equipment qualification, including environmental conditions for equipment operation. (164) Calibration, checking Requirements Ref: www.fdawarningletter.com

FDA Warning Letters IQ IQ/OQ OQ PQ 11/18/2018 FDA Warning Letters IQ Manufacturing equipment used in the production are not labeled or identified in the batch record (112) Lacks documentation of installation and operation qualification of equipment (160) The Validation Master Plan does not contain an operational qualification for xxx (164) There is no requirement for a Performance Qualification protocol (164) IQ/OQ OQ PQ Ref: www.fdawarningletter.com

FDA Warning Letters Data transfer Security 11/18/2018 FDA Warning Letters Data transfer of a (chromatographic) client server system not validated (W-029) The functional, operational and security features of the data acquisition and storage … software have not been challenged or validated for accuracy or for reliability (W-029). Data transfer Security Ref: www.fdawarningletter.com

Configuration Testing 11/18/2018 FDA Warning Letters The network ... module design limitations, which can only support up to four chromatographic acquisition systems, had up to five chromatographic systems connected. There was no validation showing this configuration to be acceptable (W-067). Validation of the system did not include critical system tests such as volume, stress, performance, boundary, and compatibility (W-067) Configuration Testing Stress testing Ref: www.fdawarningletter.com

FDA Warning Letters Risk analysis Impact analysis 11/18/2018 FDA Warning Letters For example, a formal risk analysis of the original system design and software changes to correct software bugs that caused incorrect functionality or performance problems, and to enhance the product, has not been documented. (W-146) Although your software release notes briefly describe the nature of unresolved software bugs in a particular software version, they do not explain the impact of these software bugs on user needs and intended uses. (W-146) Risk analysis Impact analysis Ref: www.fdawarningletter.com

Validate Spreadsheets 11/18/2018 FDA Warning Letters Failure to use fully validated computer spreadsheets to calculate analytical results for in-process and finished product testing [21 CFR 211.165(e)]. For example, the computer spreadsheets used to calculate analytical results for... have not been validated. (063) QA/QC Spreadsheet Validation, is deficient in that only a small range of values are being used to challenge computerized spreadsheet mathematical calculations. (063) Validate Spreadsheets over wide range Ref: www.fdawarningletter.com

EU GMP Directive - Annex 11 11/18/2018 EU GMP Directive - Annex 11 Annex 11 to EU GMP Directive Validation should be considered as part of the complete life cycle of a computer system. This cycle includes the stages of planning, specification, programming, testing, commissioning, documentation, operation, monitoring and modifying. PIC/S Guide for Inspectors - Good Computer Practices A lack of evidence for the quality assurance of the software development process, coupled with a lack of adequate validation evidence may very well be either a critical or a major deficiency. PIC/S: Pharmaceutical Inspection Convention Scheme

Industry Recommendations 11/18/2018 Industry Recommendations GAMP Guide for Validation of Automated Systems Reference document for computer system validation Referenced in FDA and PIC/S Guides Uses V-lifecycle model, risk based approaches Defines five software categories Supplemented by Good Practices Guides for specific applications (lab systems, testing) GAMP: Good Automated Manufacturing Practice Order from www.ispe.org

CSV Lifecycle Models Validation/is not a one time event 11/18/2018 CSV Lifecycle Models Validation/is not a one time event Validation starts when you plan for and design a product (hardware, software) or a method. Validation is finished when the product is retired and all data are successfully moved to a new system Validation follows one of the lifecycle models DQ URS PQ IQ FS OQ OQ DS IQ PQ Build/Code 4Q Model V-Model

Qualification/Validation Phases 4Q Model 11/18/2018 Qualification/Validation Phases 4Q Model User requirement specifications Functional specifications Vendor qualification Design Qualification Installation Qualification Operational Qualification Performance Qualification Check arrival as purchased Check proper installation of hardware and software Validation Report Validation Plan Test of functional specifications Test of security functions Test for user requirement specifications Preventive maintenance + Change Control

Validation Master Plan - Purpose 11/18/2018 Validation Master Plan - Purpose The key elements of a validation program should be clearly defined and documented in a validation master plan (EU GMP Annex 15) Increases significantly efficiency and consistency of individual validation projects Answers the inspector’s question: “What is your company’s approach towards validation?” For: corporate site department specific systems Framework for individual validation projects

Validation Master Plan - Contents 11/18/2018 Validation Master Plan - Contents Scope, e.g., for all GxP regulated environments Glossary, e.g., validation, qualification Responsibilities Steps/approaches for validation and testing, e.g., DQ, IQ, OQ, PQ Criteria and examples for risk assessment Release procedure, e.g., who has to approve Discontinuance Contents of validation report and other documents Consistency Efficiency For audits

Validation Project Plan 11/18/2018 Validation Project Plan Specifies strategy, approach, responsibilities, activities and deliverables of validation efforts Includes - Scope, System description - Validation strategies - Responsibilities and team membership - Activities and deliverables - Supplier assessment - Risk assessment - Testing strategies, protocols, test procedures, acceptance criteria - DQ/IQ/OQ/PQ - Traceability matrix - Validation reporting - Record management

Design Qualification - Definition/Purpose 11/18/2018 Design Qualification - Definition/Purpose Definition Design qualification (DQ) defines the functional and operational specifications of the instrument and details the conscious decisions in the selection of the supplier (EU Annex 15). Purpose Helps in all later phases, e.g., OQ and PQ testing Answers the question: “What is the system doing and what are the system requirements and specifications?” Ensures that the equipment was developed and manufactured in a quality environment?”

Design Qualification - Contents 11/18/2018 Design Qualification - Contents Description of the application and intended use of the equipment Description of the intended environment User requirement specifications Functional and performance specifications Qualification of the vendor Use vendor specifications for help

Leverage supplier tests 11/18/2018 Supplier Assessment Purpose: determine the adequacy of the suppliers quality system Types of assessment - Preliminary assessment (questionnaire, postal audit) - Detailed on-site audit (quality system, process, product) Extent of the assessment depends on - criticality of the system, complexity - risk to data integrity associated with use of the system - ability to verify system functionality in the lab Can reduce in-house testing through tests done by the supplier Leverage supplier tests

Documenting Vendor Assessment 11/18/2018 Documenting Vendor Assessment # Audit Item 3 2 1 N/A Company profile Organization Software development ////more//// 1 = Excellent (above average) 2 = Adequate (average) 3 = Poor (below average) 0 = Unsatisfactory N/A = Not applicable

Installation Qualification - Definition - Purpose 11/18/2018 Installation Qualification - Definition - Purpose Definition Installation qualification establishes that the instrument is received as designed and specified, that it is properly installed in the selected environment, and that this environment is suitable for the operation and use of the instrument Purpose Make sure everything arrived as purchased Make sure hardware and software is ‘properly’ installed and systems are properly configured Make sure, components and systems are well documented

Installation Qualification - Steps 11/18/2018 Installation Qualification - Steps Collect supplier’s environmental conditions, operating and working instructions and maintenance requirements Compare systems, as received, with purchase order Install of systems according to vendor specifications and engineering drawings Verify proper software installation Check documentation for accuracy and completeness Document all components with asset and serial numbers Assistance from Vendor

Operational Qualification - Definition - Purpose 11/18/2018 Operational Qualification - Definition - Purpose Definition Operational qualification (OQ) is the process of demonstrating that an instrument will function according to its operational specification in the selected environment Purpose Ensure that the equipment functions and performs as specified by the user across all operating conditions in the user’s environment

Operational Qualification - Steps 11/18/2018 Operational Qualification - Steps Identify critical functions for the computer systems as defined in functional and user requirement specifications Develop test cases for the functions and define acceptance criteria Perform the tests Evaluate results and compare with acceptance criteria Document results Assistance from Vendor for OQ services Hardware and software

11/18/2018 Key Points for OQ Tests Tests should be linked to user requirement and functional specifications (test traceability matrix) Test cases should include normal and stress conditions Tests should be quantifiable Test cases should be designed for reuse Extent of testing should be based on system complexity, impact on product quality and risk assessment URS FS Test

Traceability Matrix (here requirement specification vs. Test ID) 11/18/2018 Traceability Matrix (here requirement specification vs. Test ID) Requirement Number Requirement Test ID 1.1 Example 1 4.1, 4.3 1.2 Example 2 1.3 Example 3 3.1 1.4 Example 4 3.3, 4.1 Please note: one requirement may need two tests, and one test ID may serve more than one requirements

Performance Qualification - Definition - Purpose 11/18/2018 Performance Qualification - Definition - Purpose Definition Performance Qualification (PQ) is the process of demonstrating that a computer system consistently performs according to a specification appropriate for its routine use Purpose Verify that the system and applications work as intended (before and during routine use) Answers the question: “How can you be sure that the application works as intended day-by-day?”

Performance Qualification - Steps 11/18/2018 Performance Qualification - Steps Regular disk maintenance Regular virus checks Regular system performance tests Monitoring network traffic Environmental monitoring Change control procedures

11/18/2018 Change Control Main reasons for changes: hardware maintenance and repair and software upgrades Changes must follow a documented change procedure Procedure should require risk analysis and evaluation if the change may affect the computerized system's validation status Document changes; what, why, who, how tested?

Example: Change Request and Control Form 11/18/2018 Example: Change Request and Control Form Form ID Date Location System ID Description of change Include reason for change Impact of change Evaluate impact on validation Authorization to change Name Signature Date Approved by Completed by Implemented Date of implementation Comments E.g., document observations, testing

Validation plan and validation report are most important 11/18/2018 Validation Report Response to validation plan validation approach Describes application, use and environment of system Summarizes test plan/acceptance criteria/results Deviations from the plans Authorizes use of system Validation plan and validation report are most important

Qualification protocols, Vendor assessment Supporting material (plots) 11/18/2018 Documentation Framework (corporate, site, department) Master Plan Project Plan SOPs For individual projects or processes Written procedures For individual products Test procedures Qualification protocols, Vendor assessment Supporting material (plots) Test Records

10 Worst Mistakes for Computer Validation 11/18/2018 10 Worst Mistakes for Computer Validation Not understanding the business, the application and principles of computer validation No validation policies and procedures No or insufficient specifications Not leveraging validation efforts and support from vendor No or insufficient documentation of installed software and systems No or Insufficient Testing and Documentation Too much testing No or Inadequate change control procedures Spreadsheet applications not validated Validation and testing not based on risk

Thank You I would like to thank All attendees for your attention 11/18/2018 Thank You I would like to thank All attendees for your attention Dan Janal for moderating the session Give feedback and choose any two from over 150 documents (value: $138) for free: SOPS and/or Validation examples. GOTO: www.labcompliance.com/misc/conferences/feedback.aspx Check topics and details of 100+ audio/video seminars Audio: www.labcompliance.com/seminars/audio Video: www.labcompliance.com/seminars/video Slide 37

Laboratory Compliance Package 11/18/2018 Laboratory Compliance Package With 30 SOPs and Laboratory Master Plan Primer and Interactive audio seminar on laboratory compliance: requirements and strategies for implementation 30 SOPs for fast implementation Multiple forms, templates and examples for consistent and effective implementation Three gap analyses and master plan 10+ reference papers FDA presentations Analysts, IT and QA learn all about requirements and strategies And get SOPs and examples for easy implementation. More info: www.labcompliance.com/books/lab-compliance Slide 38