Good Manufacturing Practice (GMP) and Validation White Paper

Procedure as Implemented by IDS Scheer AG A pragmatic approach

Good Manufacturing Practice (GMP) and Validation

www.ids-scheer.com

Good Manufacturing Practice (GMP) and Validation White Paper

Content
1 Good Manufacturing Practice (GMP) and Validation .....................................................................................................3 2 Harmonization..........................................................................................................................................................................4 3 Implementation........................................................................................................................................................................4 4 Difference between ISO certification and validation according to GMP....................................................................4 5 Optimum validation.................................................................................................................................................................4 6 Validation: a comparison of definitions ..............................................................................................................................5 7 Validation of SAP ERP............................................................................................................................................................5 8 Procedure implemented by IDS Scheer AG for validating SAP ERP............................................................................6 9 Maintenance of validated status/change control ............................................................................................................8 10 The release change as opportunity ..................................................................................................................................11 11 References.............................................................................................................................................................................11

Procedure as Implemented by IDS Scheer AG A pragmatic approach

1 Good Manufacturing Practice (GMP) and Validation

The use of clear, controlled and thus reproducible processes in providing the consumer with safe pharmaceutical products and medical devices and services is governed by requirements that have been stipulated in laws and regulatory frameworks for the health industry all over the world. Accordingly, for example, the WHO1 includes the task of developing, establishing and promoting international standards for food, biological and pharmaceutical and similar products among its primary mandates1, and presents its regulatory framework for GMP and validation in that context.2 The regulations that affect the USA, which generally relate to pharmaceuticals, food and cosmetics, are set forth in CFR 213, Food and Drugs, and refer to the expanded Federal Food, Drug and Cosmetic Act. 21CFR210/211 specifically describes current good manufacturing practice (cGMP4 current Good Manufacturing Practice) for medications destined for use by humans and stipulates that validation activities be declared explicitly as a means of quality assurance for automated, mechanical and electronic equipment5, for example, computer systems; these must be inspected and tested in accordance with a written program6 for assuring perfect functioning. A Good Manufacturing Practice program has also been established for medicinal products, and this is described in CFR 217. In the European Union, EU Directives 2001/83/EG8 and 91/356/EG are particularly important. The first defines a common codex for human medicaments in the EU, the second sets out in a manner binding for member states the rules of EU GMP9, which are interpreted in the EU GMP guideline10 and its annexes. The central premise of annex 1111 with regard to computer validation is that when computer-supported systems carry out activities which were originally manual in nature, neither product quality nor quality assurance must be compromised. Corresponding regulations have also been approved for medicinal products in the EU.12 The EU GMP regulations regarding pharmaceuticals are embodied in German Law in the Pharmabetriebsverordnung [rules and regulations for pharmaceutical entrepreneurs]13, which was passed under 54 of the German Law on Medicines14 to bring domestic provisions into line with the statutory requirements of the EU. The rules and regulations for pharmaceutical entrepreneurs define the regulations that cover the pharmaceutical quality of a product, and apply to the following aspects: Quality assurance system Manufacturing staff Premises Equipment Documentation Production Quality control Order production Complaints, product recall and self-inspection.

Good Manufacturing Practice (GMP) and Validation White Paper

2 Harmonization
Efforts to harmonize the GMP regulatory framework are ongoing. A number of organizations and committees15,16 are engaged in creating an internationally standardized version of the requirements, which are already very similar. In future, the scope of the quality assurance methods required by government agencies will be extended so that they may also apply to products that are considered to be related to medicines in the narrower (for example, active substances17) or the broader sense (for example, cosmetics18).

3 Implementation
Concrete implementations of these instructions that govern procedures in the development, production, quality control and marketing of medicines, for example, are proposed through economic, scientific and technological initiatives19, 20, 21, 22; thus, for example, the GAMP 4 Guide interprets the requirements for automated systems.

4 Difference between ISO certification and validation according to GMP

Unlike the regulations issued by the health authorities, the regulations based on ISO 900x define a general quality management framework. It follows that ISO 900x certification programs do not replace validation with respect to the directives and instructions cited. No additional benefits or advantages are gained in terms of quality assurance by the implementation of other standards in addition to GMP.23 In consequence, monitoring of pharmaceuticals companies in accordance with 64 of the German Law on Medicines24 falls exclusively within the purview of the responsible authority.

5 Optimum validation
In order to maximize the benefits of a validation (reproducible, safe procedures as the foundation for core business processes) while keeping costs as low as possible, solutions should be developed individually and the conditions and peculiar features of each company should be taken into account as far as possible. Thorough familiarity with the statutory requirements certainly provides sufficient leeway for a customized validation. There can be no such thing as a standard validation. The object is to use current scientific and technical means and the statutory regulations as the basis for developing and establishing models and procedures that guarantee a validated process, without incurring unnecessary expense by overfulfilling the legal requirement.

6 Validation: a comparison of definitions

The similarities between the directives will be illustrated clearly in the following example of the definitions of validation. FDA: Validation25: Establishing documented evidence which provides a high degree of assurance that a specific process will consistently produce a product meeting predetermined specifications and quality attributes. ISO-9000-2000: Validation26-Confirmation by the provision of objective evidence that the requirements for a specific use or a specific intended application have been met. EU GMP Guideline27: Validation: Establishment of evidence in accordance with the rules of Good Manufacturing Practice that procedures, processes, items of equipment, materials, operations or systems do in fact result in the intended outcomes. WHO: Validation28 is defined as the establishing of documented evidence which provides a high degree of assurance that a planned process will consistently perform according to the intended specified outcomes. GAMP Forum29 exactly the same as for FDA including reference to the FDA definition. The various definitions all state the same thing: Validation in the context of GMP is the documented evidence that a thing does what it is expected to do.

Procedure as Implemented by IDS Scheer AG A pragmatic approach

7 Validation of SAP ERP Software

At the same time, a growing number of work procedures that affect the quality of medicines are being supported by integrated enterprise software. The objective is to achieve greater efficiency and economic effectiveness through a high degree of integration and complexity. Deployed in the face of this trend are the justified demands of the authorities responsible for pharmaceuticals for comprehensible, specific, reproducible and documented, i. e. validated procedures in the production of medicines, which ultimately constitute the prerequisite for safe, effective and harmless medicines. In order to achieve this, the legislature has provided the GMP regulatory frameworks described previously (see above) as a guide for pharmaceutical manufacturers. As a result, economic efficiency and statutory conformance in the introduction and operation of integrated enterprise software are currently among the most intensely debated topics in QA and IT departments. As the integrated enterprise software of choice, in recent years SAP ERP Software has evolved from a purely commercially oriented application into a system that can also be used in support of production and sales processes or even quality control in pharmaceuticals companies. This raises the question of effective and adequate strategies for introducing SAP ERP Software from the point of view of GMP on the basis of current scientific and technological expertise.

8 Procedure implemented by IDS Scheer AG for validating SAP ERP Software

The pragmatic and practice-oriented strategy of IDS Scheer for validating SAP ERP Software is based on the GAMP procedure model and incorporates the specifications of cGMP, and as such is in compliance with the constraints of legislative bodies, science and technology: Even so, validated processes cannot be conjured up from thin air; they are only made possible by a thorough knowledge of the pertinent business processes (business process analysis) that are applied in the company as the foundation for all validation activities. The identified processes must be considered from a GMP standpoint as early as the scoping stage, when the scope of the implementation is defined, in order to establish which procedures need to be validated and which do not, so that the associated effort can be significantly reduced from the outset. Evaluation is based on a GMP criteria catalog, which provides assistance in decision making with regard to GMP categorization and was developed on the basis of the pertinent statutory requirements; Figure 1 shows one example of the GMP categorization procedure.

Figure 1: Example of GMP categorization procedure

Good Manufacturing Practice (GMP) and Validation White Paper

At the same time, a project-specific validation plan is drawn up, and this key document lists all the validation measures that have to be put in place to ensure that the functioning of SAP ERP complies with GMP. This project-specific validation plan represents the link between the companys own general validation specifications and the project-specific procedure, and defines particularly the work instructions (SOPs) that do not yet exist in the company but which are vitally important for this specific project. This ensures that these validation activities do not exist in isolation, but are integrated seamlessly in the sequence of quality assurance measures that together assure the production of safe and harmless medicines. The net result of the business process analysis and GMP categorization is a process overview, which describes the assignment of SAP transactions to the desired functionality.

Figure 2: Procedure model for SAP ERP Software validation

The procedure model shown in the following is derived from Figure 2: foundation, and as such describes all measures that must be implemented in order to guarantee that SAP ERP Software will function in compliance with all statutory and cGMP specifications. Process Models/User Requirements Specification: The progression of the overall process is described as a sequence of functionally interconnected business transactions, for example the purchasing of raw materials as a sequence consisting of purchase requisition, order, receipt of goods and quality control with release. The software of choice, ARIS Toolset, the markets leading business process management solution, is ideal for this scenario.

Procedure as Implemented by IDS Scheer AG A pragmatic approach

Figure 3: Business process management with ARIS Toolset

Business blueprints (functional specifications): Individual functions or subprocesses are listed in detail, taking into account the established external constraints. It is entirely possible for this single process to include several transactions (goods receipt postings and inventory management). System specification (in the event of expansions/modifications): Since SAP ERP Software is configurable standard software according to GAMP, expansions and modifications that cannot be made via customizing with the standard SAP functionality should be listed in a separate system specification. With standard functionality, the system specification and the user requirements specification can be combined in one document. Customizing/Programming: Both actions are documented end-to-end and with full traceability. Risk analysis: Every overall process that is categorized as GMP-relevant in the course of the process analysis undergoes technical and technological risk assessment. This risk analysis acts as a filter to distil those (partial) functionalities that require measures to minimize risk, for example, tests. This enables the qualification effort to be considerably reduced. Developer test/Code review: critical extensions and modifications undergo modular testing (Code review/Walk through, module test). Installation Qualification (IQ): Both standard (server landscape, networks, operating programs etc.) and proprietary developments and interfaces are considered in the Installation Qualification. Operational Qualification (OQ): The information flows are tested in terms of functions and transactions at the level of the individual processes. The test strategy is completed with negative tests (incorrect inputs, special cases etc.). Procedural test: An integration or procedure test, which describes the interplay between all modules and systems in the overall process, can be carried out as part of the Operational Qualification or the Performance Qualification (PQ), depending on the test environment. Project-specific validation report: The results are summarized in the validation report and evaluated with reference to the measures that must be implemented according to the validation plan. This report therefore serves as the basis for decision making regarding formal operational release.

Good Manufacturing Practice (GMP) and Validation White Paper

9 Maintenance of validated status/change control

Even as early as the introduction phase, it is essential to establish adequate procedures for change control, or the status that has been attained in the validation may be threatened or even voided. As soon as the OQ begins, each change must be documented, its effects on other functionalities and lifecycle documents that have already been released must be evaluated, and if necessary it must be tested and released formally. Admittedly, this would seem to entail a great deal of bureaucracy, but its benefit is to ensure that the systems condition is transparent, defined, auditable and documented, which is considered essential for maintaining the validated status. This means that the validated system condition must be seen as dynamic, not static, and it is therefore strongly recommended that the validated condition be tested according to a defined schedule, for example after a certain number of changes have been implemented or after a certain period of time has elapsed. This self-inspection is even prescribed by the legal authorities.30 IDS Scheer conducts these self-inspections as a separate consulting service; in so doing, its approach is guided not merely with a view to documenting formal compliance with internal and external quality standards, but also with the aim of pointing up and subsequently implementing specific instances of improvement potential. Above and beyond pure self-inspections, risk analyses of day-to-day operations have also proven their worth; in the course of these analyses each GMP-critical system component is observed in operational use in order to identify any risks that were overlooked or miscalculated during planning, and to assess their implications. Thus it is assured that for as long as it is in use SAP ERP Software will remain in the validated condition, will support the processes used in manufacturing, storage and distribution in a manner compliant with specifications and GMP, and will serve as the basis for effective and harmless medicines. This constitutes the description of the conceptual organization of an SAP ERP Software Validation, as documented in the form of plans and reports. At all events, ancillary activities, such as integrating this model into an existing or pending SOP landscape (change control, transportation, release procedures, training, documentation, internal/external audits etc.) must still be planned and considered individually. Since SAP ERP Software is a configurable standard system, the emphasis for purposes of validation is on program components that are added and adapted or expanded. Instead of conducting the requisite supplier audit for SAP itself, a supplier evaluation, for example by a validation group including several pharmaceuticals companies, may be adapted as an inexpensive alternative. The advantages of following a planned procedure may be summarized in a list of bullet items: Increased process understanding through detailed planning Systematic approach to problems Detailed documentation of internal and external expertise Reduced risk of deviations and errors Conformance with statutory regulations Reduced effort for in-process and final control

Procedure as Implemented by IDS Scheer AG A pragmatic approach

10 The release change as opportunity

If SAP ERP Software has been successfully implemented in a pharmaceuticals company but for whatever reason has never satisfied the requirements of a formal validation, a new release represents an opportunity to validate the version in current operational use and the version that will replace it at the same time. For this eventuality, IDS Scheer has developed and successfully put into practice a prospective-retrospective approach. In the retrospective part, the first step is to identify and/or establish the quality assurance context on the basis of a validation plan: This includes a GMP criteria catalog as well as the supplier audit and SOPs such as programming or customizing standards, so that the SAP ERP functionality can be evaluated in terms of pharmaceutical risk; this part is therefore quite similar to the model described above for a purely prospective SAP ERP Software Validation in the case of an introduction from new. An essential and central element of a retrospective/prospective procedure is the preparation of an experience report, in which all quality assurance measures that were performed in the past are listed and evaluated. This is ultimately the vehicle by which the reliability of the system is documented. Experience has shown that much good validation work was already being done, and therefore merited inclusion and evaluation in the experience report. User requirements may thus be generated from existing process models, user manuals or functional descriptions and used as the basis for risk analyses and the tests to be derived therefrom. These activities, which are carried out before the planned release change, then constitute the starting point for the subsequent prospective validation part.

Figure 4: Prospective-retrospective validation approach.

The advantages of the prospective-retrospective validation approach are plain. The retrospective part can be begun regardless of the release version that is currently in place, so that when the release change takes place, validation activities can be concentrated on core tasks. As a result, the danger of duplicated effort is avoided, effort and costs remain within manageable limits, and this contributes in no small part to acceptance by company management and staff.

Good Manufacturing Practice (GMP) and Validation White Paper

11 References
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 Constitution of the World Health Organization, Article 2 WHO: Quality assurance of Pharmaceuticals. A compendium of guidelines and related materials. Volume 2: CFR Title 21 Food and Drugs: Parts 1 to 1404 21CFR210/211 cGMP for Finished Pharmaceuticals 21CFR211.68 Validierung, Anmerkung des Verfassers 21CFR808; 21CFR812; 21CFR820 Medical Devices Richtlinie 2001/83/EG: zur Schaffung eines Gemeinschaftskodexes fr Humanarzneimittel Richtlinie 91/356/EG: zur Festlegung der Grundstze und Leitlinien der Guten Herstellungspraxis fr zur Anwendung beim Menschen bestimmte Arzneimittel Leitfaden fr die gute Herstellungspraxis:Humanarzneimittel und Tierarzneimittel Leitfaden fr die gute Herstellungspraxis:Humanarzneimittel und Tierarzneimittel, Annex 11: Computergesttzte Systeme Richtlinie 93/42/EWG: ber Medizinprodukte Betriebsverordnung fr pharmazeutische Unternehmer Gesetz ber den Verkehr mit Arzneimitteln (Arzneimittelgesetz) ICH: International Conference of Harmonization PIC/S: Pharmazeutical Inspection Convention/Cooperation Scheme ICH Q7A Good Manufacturing Practices for Active Pharmaceutical Ingredients; Leitfaden fr die gute Herstellungspraxis: Humanarzneimittel und Tierarzneimittel, Annex 18 25. Richtlinie 2000/11/EG zur Anpassung des Anhangs II der Richtlinie 76/768/EWG des Rates zur Angleichung der Rechtsvorschriften der Mitgliedsstaaten ber kosmetische Mittel an den technischen Fortschritt GAMP Forum: Good Automated Manufacturing Practice GMA, VDI/VDE: Society of Measurement and Automation NAMUR: Standardization Association for Measurement and Control in Process Industries APV: International Association for Pharmaceutical Technologie Pharm. Ind. 58 (2) 1996 s. o. 25 Guidelines on General Principles of Process Validation

19 20 21 22 23 24 26 27 28 29 30

ISO 9000:2000 Qualittsmanagementsysteme Grundlagen und Begriffe s. o. Guide to GMP Requirements Part 2 GAMP 4 Guide 15 PharmBetrV

10

Procedure as Implemented by IDS Scheer AG A pragmatic approach

11

Good Manufacturing Practice (GMP) and Validation White Paper

Headquarters Germany IDS Scheer AG Altenkesseler Strae 17 66115 Saarbruecken Phone: +49 (0)681-210-0 Fax: +49 (0)681-210-1000 E-mail: info@ids-scheer.com

ARIS, IDS and Y symbol are trademarks or registered trademarks of IDS Scheer AG in Germany and in many other countries worldwide. All other trademarks are the property of their respective owners. Inventory Number GMP0407-E-WP Copyright IDS Scheer AG 4.2007

www.ids-scheer.com