Computer Systems & Software Validation of Computer Systems & Software – A Practical Approach Presented By Mr. Vasishtha Mehta Director Epitome Technologies Private Limited Seminar on Validation Requirements for Regulatory Compliance Indian Pharmaceutical Association Date : 8th October,2011 Venue : Sci Tech Centre, Jogeshwari (W) - Mumbai

Topics Covered Applicability of Computer System Validation GAMP Guide Lines & Good Practices Models GAMP V Model & Validation Project Practical Requirements

Applicability of Computer System Validation

Use of Automated Systems Quality Systems (Annual Product Review, Customer Complaints, Training Records, CAPA, SOP Administration, Adverse Event Reporting) Facilities & Equipment Systems Packaging & Labeling Systems Materials Systems Production Systems Laboratory Systems HVAC Autoclaves Calib & Maint WFI Inv Mgmt Dispensary Dist Systems WH Mgmt Process Inst Control Sys EBR ERP Label Gen OCR Sys Fill Check Artwork Lab Inst LIMS C of A E-Notebooks

Automating GMP Areas Personnel Qualifications (211.25) Consultants (211.34) Equipment Cleaning and Maint. (211.67) Automated Equipment (211.68)* Written Procedures (211.100) Materials Examination and Usage (211.122) Packaging and Labeling Oper. (211.130) Drug Product Inspection (211.134) Distribution Procedures (211.150) Reserve Samples (211.170) Records and Reports (211.180) Equipment Cleaning and Use (211.182) Component, Container, Closure and Labeling Records (211.184) Master Production Records (211.186) Batch Production Records (211.188) Production Record Review (211.192) Laboratory Records (211.194) Distribution Records (211.196) Complaint Files (211.198) Returned Drug Products (211.204) Drug Product Salvaging (211.208)

System Validation - Objectives Extensive Use of Software in GxP Environment calls for Automated Systems’ Validation to ensure System Functioning vis-à-vis its intended use Insurance against Data Manipulation Data Integrity on Networks System Performance in Validated State

GAMP Guidelines & Good Practices Models

Guidelines - GAMP Good Automated Manufacturing Practices (GAMP) provides the Framework for Automated System Validation Current version GAMP 5 emphasizes Risk Based Approach to Software Validation with Life Cycle Model

GAMP Categories Category Software Type CSV Criticality 1 Operating System Low 2 Firmware Removed in GAMP 5 3 Standard Software Packages Medium - High 4 Configurable Software Packages 5 Custom or Bespoke Systems High

Current Good Practices Models Process Control Systems PLC / DCS / SCADA / BMS Laboratory Computerized Systems Application Software Like HPLC /GC /FTIR etc Global Information Systems ERP Systems Like SAP / BaaN Document Management Systems

GAMP V Model & Validation Project

GAMP V Model Validation Documentation Validation Plan Go Live! User Training Corrective / Preventative Action Custom Monitoring Program System Maintenance System Usage SOP’s Go Live! Validation Documentation Validation Plan Training Records Validation Review Validation Planning Checklist Final Validation Report Risk Management Plan Supplier Audit Updated Risk Management Plan User Requirement Specification Functional Requirement Specification Design Requirement Specification Risk Management Plan Trace Matrix Installation Qualification Protocols Final Validation Report Sample Usage SOPs Validation Planning Checklist Operational Qualification Protocols Supplier Audit Performance Qualification Protocols PQ Testing Protocol Test Records Updated Risk Management Plan PQ Test Report User Requirements Specification PQ Protocols System Usage SOP’s User Acceptance Criteria Sample Usage SOP’s Functional Requirements Specification OQ Testing Protocol Test Records OQ Protocols Validation Planning Checklist Risk Management Plan Supplier Audit Trace Matrix Updated Risk Management Plan IQ / OQ Test Report Design Requirements Specification IQ Testing Protocol Test Records User Requirement Specification Functional Requirement Specification Design Requirement Specification IQ Protocols HW /SW Requirements Installation Qualification Protocols Operational Qualification Protocols Trace Matrix Off the Shelf SOFTWARE Customer Installation & Configuration Updated Risk Management Plan Configuration Drawing Performance Qualification Protocols Sample Usage SOPs Final Validation Report SysAdmin Training Training Records Configuration Homework

Practical Requirements

Process Control Systems Distributed Control Systems Programmable Logic Controllers SCADA / BMS

Process Control Systems Access Control & Password Management Program Back Up for PLC / HMI / SCADA Set Parameter Ranges To Be Restricted / Defined Alarm Management System Clock Synchronization System Design Documents V/s Configuration Check Printers & Reports Electronic Records & Signatures – Wherever Applicable Life Cycle Management

Laboratory Computerized Systems Programmable instruments Server e.g., for printing and archiving Office computer Instrument Software HPLC, GC, FTIR etc Stability Cambers, Incubators

Laboratory Computerized Systems Access Control & Password Management Adequate User Ids Data Back Up & Restore Data Security Laboratory Network & Server Qualification System Clock Synchronization Printers & Records Electronic Signatures & Records Life Cycle Management

Global Information Systems Enterprise Resource Planning Systems SAP, Other ERP Packages Document Management Systems

Global Information Systems - ERPs cGMP vs. System Configuration Interfacing of Quality Management System (BMRs) vs. ERP Records Access Control & Password Management Adequate User Ids Data Back Up & Restore Data Security Network & Server Qualification Paper Records vs. Electronic Records Electronic Signatures Life Cycle Management

Maintaining Control in Operation Maintaining Control in Operation (Post Validation) Program should ensure the following – All up-dates / new development / implementation are in line with the Change Control Procedures Risk Assessment is carried out for all up-dates / new development / implementation Validation documents (SOPs / Protocols / Specifications) are reviewed and updated periodically Audit the Validation Status of various systems Monitor the Performance of Systems Periodically

Road Map To Compliance Formulate Computer System Validation Policy – Top Line Statement Form the Core Team Formulate Validation Master Plan Define IT policies & Procedures For New Systems Follow GAMP V Model – URS to PQ For Existing Systems Take the inventory of Systems Carry Out Impact Analysis Carry Out Risk Assessment for each System Close the Gaps Update the URS and follow GAMP v Model Maintain Control in Operation

Summary Software System Validation is Critical for All Regulatory Functions including Research and Manufacturing Scope of CSV covers All Software Systems in GxP Area Prevailing GAMP Guidelines Provide Framework for Designing CSV Program GAMP Advocates Life Cycle Approach and Risk Assessment to ascertain CSV Scope Careful Planning of CSV reduces Duplicate Activities and Cost Identification of Electronic Records and Maintenance Thereof is Critical for All Software Systems Maintaining Control in Operation is Essential Post Validation

Questions & Comments

Thank You For Your Attention Sincerely Yours