Computer System Validation in

GMP Area

• Ebo Widarisman
• Presented on QA/QC Managers Group Workshop
• Sept 2019
Global Inspection Trends Chronology

1980’s – Basic GMPS’s

1990’s – Part 11 Computer Control

2000s – Quality System/OOS/CAPA/Trending

2010s – DATA INTEGRITY

Introduction
• What is computerized system?

• What is then Computerized Systems Validation?

• Why Computerized Systems Validation?

 What is a Computerized System?

• Not only Hard Ware and Soft Wares, but also Users, Administrators,
business processes, SOPs, ........
 What is Computerized Systems Validation

• It is ongoing process
• Establishing documented evidence
• To provide a high degree of assurance
• That a computerized system and its components
• Will consistently perform to predetermined specification
 Why is Computerized Systems Validation

• The purpose of validation is to confirm that the computerized system

specifications conform to the user’s needs and intended use by
examination and provision of documented and objective evidence
that the particular requirements can be consistently fulfilled.
• Establish confidence in the accuracy, reliability and consistency in the
performance of the system
• Compliance with regulations and assure “inspection readiness”
• Maximize business benefits to be derived from IT Systems
 Regulations & Guidelines
Regulations
• Eudralex www.ema.europa.eu
• MHRA www.mhra.gov.uk
• ICH www.ich.org
• FDA , US Code of Regulations, Title 21: Food and Drugs
• BPOM, Peraturan BPOM No. 34 Tahun 2018 Tentang
Pedoman CPOB – Aneks 7 Sistem Komputerisasi
Guidelines
• PIC/S www.picscheme.org
• GAMP Richtlinien www.ispe.org
 Responsibilities and SOPs
• Each corporate/business unit is responsible for establishing a
policy on CSV requirements
• Site or departments are responsible for:
• CSV SOPs
• System Inventory and assessment
• System Specific Validation protocol
• System specific validation documentation
• SOPs must:
• Comply with the CSV Policy and any regulations that apply
• Be approved by the appropriate management for the site or
department
 How Do I comply?

Quality System Assurance

Analytical Control
Validation & Calibration
Equipment Control
Process Control
Material Control
Supplier management
 System & Inventory Assessment
• Site or departments are responsible for compiling and
maintaining details about their computer systems
• This information includes identifying the systems that are being
used and for what purpose those systems are being used
• The system inventory and assessment information is used
to determine which systems need to be validated
 System & Inventory Assessment
ID/Asset Description Location Application GxP Risk Contact Time Frame
Number C,M,m for Validation

Note: C = Critical, M= Major, m= minor

 System Specific Validation Protocols

• Validation protocols are documents associated with each of

system identified as requiring validation
• The protocol describes the scope, procedure to be followed,
responsibilities and acceptance criteria for the validation
• Validation protocols should comply with the SOPs
 Validation Documentation

• Document that verifies each validation

activity must be generated and stored with
the validation protocol in the appropriate
archive
• Validation Document includes:
• Test Data
• Summary Reports
• Procedures
• Certification forms produced during the
validation process
 Assessment Validation
• Before you can validate a system, you need to identify the systems
that require validation.
• Determining if a system requires validation involves analysis of the
following areas:
• 21 CFR Part 11 –electronic records and signatures;
• Manufacturing processes;
• Product release or stability information;
• Regulatory information;
• Support GxP activities
• All users must be trained on current SOPs related to computer
system development and validation.
 Validation Master Plan

• The validation of all computer systems will be documented

in a Validation Master Plan (VMP)
• The Validation Master Plan will include:
• Identifying components requiring validation
• Prioritizing and justifying the validations to be performed
• All activities and assigned responsibilities
• Establishing site specific procedures to support validation
 CSV Methodology
What is GAMP 5?
• Good Automated Manufacturing Practice, Founded in 1991. International Society
for Pharmaceutical Engineering (ISPE) sets the guidelines for manufacturers and
the current Version is GAMP 5.
• GAMP describes a set of principles and procedures that help ensure that
pharmaceutical Software have required quality.
• Computer system validation (CSV) following GAMP guidelines require users and
suppliers to work together so that responsibilities regarding the validation process
are understood.
• For users: GAMP provides a documented assurance that a system is appropriate
for the intended use before it goes “live.”
• Suppliers can use GAMP to test for avoidable defects in the supplied system to
ensure quality products are produced.
 CSV Methodology
Why GAMP 5?
• Facilitates the interpretation of regulatory requirements.
• Establishes a common language and terminology.
• Promotes a system life cycle approach based on good
practice.
• Clarifies roles and responsibilities.
• Focus attention on those computerised systems with most
impact on patient safety, product quality, and data integrity
• Avoid duplication of activities
 CSV Methodology
GAMP 5 Categories
 CSV Methodology
CSV Model
verifies
Planning Reporting

User verifies Performance

Requirements
Specification Qualification Tests (PQ)

Functional
verifies Operational
Qualification Tests
Specifications
(OQ)
Validation Plan
Installation
• Scope Design verifies Qualification Tests
• Approach Specifications
(IQ)
• Roles & Responsibilities
• Acceptance Criteria
System Build
 CSV Methodology
CSV Model
verifies
Planning Reporting

User Requirements verifies Performance Qualification

Specification Tests (PQ)

Functional verifies Operational

Specifications Qualification Tests (OQ)
User Requirements
•User Needs for the
software
Design verifies Installation
Specifications Qualification Tests (IQ)
•Intended Use of the
Software
System Build
• Critical Constraints
 CSV Methodology
CSV Model
verifies
Planning Reporting

User Requirements verifies Performance

Specification Qualification Tests (PQ)

Functional
verifies Operational
Specifications Qualification Tests (OQ)

Functional Specification Design verifies Installation

• How the software should look Specifications Qualification Tests (IQ)
• What data the software should
capture
• Logic, calculations
System Build
 CSV Methodology
CSV Model
verifies
Planning Reporting

User Requirements verifies Performance Qualification

Specification Tests (PQ)

Functional verifies Operational

Specifications Qualification Tests (OQ)
Design Specification
• Database design
• Process design Design verifies Installation
• Security design Specifications Qualification Tests (IQ)
• Interface design
• Architecture design System Build
• Network requirements
 CSV Methodology
CSV Model
verifies
Planning Reporting

User Requirements verifies Performance

Specification Qualification Tests (PQ)

Functional verifies Operational Qualification

Specifications Tests (OQ)

Design verifies Installation

Specifications Qualification Tests (IQ)

Develop Software /or/ Purchase and Configure System Build

 CSV Methodology
CSV Model
verifies
Planning Reporting

User Requirements verifies Performance Qualification

Specification Tests (PQ)

Functional verifies Operational Qualification

Specifications Tests (OQ)

Installation Qualification
Design Installation • Installation and Set Up
verifies Qualification instructions
Specifications Tests (IQ) • Confirmation that installed
and set up according to
System Build Design
 CSV Methodology
CSV Model
verifies
Planning Reporting

User verifies Performance

Requirements
Qualification Tests (PQ)
Specification

Functional verifies Operational

Specifications Qualification Tests (OQ)

Installation Operational Qualification

Design verifies • Confirmation that all
Qualification
Specifications functionality is present
Tests (IQ)
• Confirmation that all
System Build feature are working as
specified
 CSV Methodology
CSV Model
verifies
Planning Reporting

User verifies Performance

Requirements Qualification
Specification Tests (PQ)

verifies Operational
Functional
Qualification
Specifications
Tests (OQ)

verifies Installation Performance

Design Qualification
Qualification
Specifications • Confirmation that
Tests (IQ) software meets the
users’ needs and is
System Build suitable for their use
 CSV Methodology
CSV Model
verifies
Planning Reporting

verifies
User Requirements Performance
Specification Qualification Tests (PQ)

verifies
Functional Operational
Specifications Qualification Tests (OQ)

Validation Report
verifies Installation • Confirmation of Validation Plan
Design
Qualification • Testing Summary
Specifications
Tests (IQ) • Confirmation that Acceptance
Criteria Met
System Build • Authorize Deployment
 CSV Scope
What Software Requires Validation?

Manufacturing Software
What Types of • Software used in the Production,
Computer Engineering & Supply Chain
Systems and
Software Require
Validation?
Quality Management Software
• Software used to implement the
quality management system
 CSV Scope
Manufacturing Software
• Software used in the Production, Engineering & Supply Chain

Manufacturing Production Inventory

Bill of Material Control
Automation Monitoring
Software Software
Software Software
(e.g., ERPs)

Programmable
Building Preventive
Logic Yield
Management Maintenance
Controllers Calculations
Systems Management
(PLCs)
 CSV Scope
Quality Management Software
• Software used to implement the quality management
system
Change Laboratory Non-Conformance
Control Calibration
Management Tracking
Software Software Software
Software

Deviation / Internal Training Laboratory

Complaint Audit/CAPA Management Calculations (e.g.,
Software Software Software spreadsheets)
 CSV Program Implementation
Procedure Examples
• How to validate
• How to perform risk
assessment
• How to audit vendors
CAPA (if out of compliance)
Validation Master Plan
• Policies, Procedures
• Inventory
• Validation Timeline

Inventory Assess &

Define Develop Train Systems Prioritize Document
SOPs and Validate
Policies Templates Personnel and Systems & Plan
Software Software

Policy Examples Example

• Which systems and software require • Which systems and software
validation? require validation?
• When does validation occur? • What is the risk level of each?
• When do vendors need to be • What is the priority for
qualified? Audited? validating each system?
 PERIODIC EVALUATION AND REVIEW OF
COMPUTER SYSTEMS
• Purpose
• Remain computer system in a validated state
• Regulatory Requirements (EU GMP Annex 11)
• Computerized systems should be periodically evaluated to
confirm that they remain in a valid state and are compliant with
GMP. Such evaluations should include, where appropriate: the
current range of functionality, deviation, records, incidents,
problems, upgrade history, performance, reliability, security and
validation status reports.
35
 REASONS FOR REVALIDATION
Time based (*)
• Periodic revalidation
Event based
• Planned changes
• Unplanned changes
• Inspectional/Audit observations
• Out-of-specification results
• Customer complaints
(*) Automated equipment shall be routinely calibrated, inspected,
or checked according to a written program (FDA 21 CFR Part 211)
36
 RETIREMENT
Reasons for Retirement
• Aging of software and hardware
• High maintenance cost
• Missing functionality
• FDA regulations
• business requirements
• Obsolescence
• No longer supported by the supplier (hardware, software)
• New IT strategy or system platform
37
 RETIREMENT STEPS
• Remove software
• Destroy hard-disk if it contains critical data
• Terminate existing admin support
• Terminate maintenance and service contracts
• Take system out of service
• Identify SOPs and other documents to be obsoleted
• Draft system summary retirement report
• Get retirement report approved
• Communicate successful system retirement
38