How To Validate Computerized Systems

How to Validate Computerized
Systems
An example from practice for the
pharmaceutical ERP system
Scarabaeus+
at Lindopharm GmbH
(Hilden - Germany)
© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

Industrial Automation Partners BV - GTI GmbH Germany
What is Validation?
• A definition:
– Validation is the documented evidence, in
accordance with the GMP-requirements,
that all used methods, processes,
equipment, materials, workflows and
systems lead to the specified results and to
the specified characteristics of a product.
» Interpretation of the EU-GMP-Guide by the
German Inspector K.-H. Menges, Darmstadt «

Qualification vs. Validation
– Qualification by definition of the EU-GMP-
Guide is...
...the documented evidence that all used equipment
works correctly within its specification and leads
to the specified results.
– Since computerized Systems are more than
just Equipment (they contain Hardware,
Software, Processes and Personnel),
Qualification is a Part of the CS-Validation.
– Rule: Only qualified Computer-Systems can
be validated.
A Computerized System
More than just Hardware and Software !
• Software • Hardware/Equipment
– Standard Packages – Computers and Network
– Individual Solutions – Devices
– Interfaces/Add-Ons – Machines
– Software- – Hardware-
Documentation Documentation
• Processes/Documents • Personnel
– SOPs – Employees
– Validation – Specialists
– Logbooks – Consultants
– Change-Control – All must be trained!

Rules and Standards to Follow
• For the European Union
– EU GMP Guideline 91/356 and 91/412 (Article 9)
– EU GMP Guide
• particularly Annex 11 „Computerized Systems“
• For the U.S.
– FDA 21 CFR Part 211
• particularly Subpart D „Equipment“
– FDA 21 CFR Part 11
• „Electronic Records/Electronic Signatures“
• Worldwide recognized Interpretations and Guidances
– GAMP 4 (Good Automated Manufacturing Practice)
– PIC/S Draft-Guidance „Computerized Systems“
– New FDA Draft-Guidance „Part 11,...-Scope and Application“
– ISPE White Paper „Risk-Based
Approach to 21 CFR Part 11“
Who is Lindopharm
 Founded in 1947
 120 employees
 12 in field service
 Turnover 2002: 15 Mio €
 3700 m² pharmaceutical
production and service
 Distribution to Wholesalers
 Full-Service
 Development
 Laboratory
 Contract Manufacturing

Lindopharm Products
Capsules
Sprays
Liquids
and Drageés
Sachets

The use of Scarabaeus+
Dedicated pharmaceutical processes
• Recipes and detailed • Computer Controlled
Manufacturing Weighing and Step-By-
Instructions Step Instructions
• Production Planning • Covering every stage of
• Optimized Purchase production
• Batch oriented Material • Testing and Release of
Management Semi-Finals and Finals
• Warehouse and Stock • Sales and Order
Management management
• Automatic Status • Picking, Shipping,
Checking Invoicing
• Integrated Quality
Control Module
Assessing the GMP-Impact
GMP Risk in %
Purchase
50%
Finance/MIS Warehouse/ Stock
10% 90%
Marketing/ Sales Production

20% 100%
50%
Shipping/ Logistics QC/ Lab
100%

Phases of the Validation Cycle
• Phase 0: Planning and Definition
• Phase 1: Specification
• Phase 2: Implementation and Test
• Phase 3: Installation
• Phase 4: Qualification Testing
• Phase 5: Going Productive
• Phase 6: Keep it Validated

Phase 0: Planning and Definition
Activity / Document Responsibility
• SOP System for CS Validation System Owner
• CS Validation Master Plan System Owner
• User Requirement Spec. (URS) System Owner
• Vendor Auditing / Vendor Selection System Owner
• Functional Specification (FS) Vendor

Setting up the Framework:
SOP-System for Computer Validation
• SOP 1: Validation of Computerized • SOP 10: Error Handling and
Systems in GMP-Environment Escalation Strategy
• SOP 2: Risk Assessment for • SOP 11: Change Control for
Computerized Systems Computerized Systems
• SOP 3: Requirements for the User
Requirement Specification • SOP 12: Revalidation of
Computerized Systems
• SOP 4: Requirements for the
Functional Specification • SOP 13: Requirements for the
• SOP 5: Training for Computerized Validation Plan
Systems • SOP 14: Requirements for the
• SOP 6: Data Backup and Recovery Validation Report
• SOP 7: Security, Protection and • SOP 15: Vendor Auditing for
Access Rights Computerized Systems
• SOP 8: Breakdown of Computerized • SOP 16: FDA 21 CFR Part 11
Systems Compliance Strategy
• SOP 9: Recovery of Computerized
Systems after Breakdown

Validation Master Plan for
Computerized Systems
• General Commitment of the
Management
• Organisation and Responsibility
• Validation Policy
• Categories of Computerized Systems
• Classification of Components
• Validation Phases and Activities
• Problem Management and Error
Escalation
• Configuration and Version
Management
• Change Control Policy
• Living List of GMP-relevant
Computerized Systems in the Appendix

The V-Model
Finish
Risk Assessment
User Requirement Performance
Specification Qualification (PQ)
Funtional Operational
Specification Qualification (OQ)
Design Specification Installation

Design Qualification (DQ) Qualification (IQ)
System Module
Implementation Testing

Do Ask Questions First,
Shoot Later...
• User Requirement Specification (URS)
– Definition of the User‘s Needs
– Definition of the Environment, Standards, Rules and Legal Requirements
– Provide Demand Numbers for Crossreference Matrix
• Vendor Auditing / Vendor Selection
– Assessment of Vendor‘s Organisation and Product Portfolio
– Assessment of Vendor‘s QM-System
– Use Checklist (i.e. from GAMP 4 Appendix M2)
– Reduce Time and Effort by Joint Audits
– Put Your Decision in a written Document!!!
• Functional Specification (FS)
– Given by the selected Vendor
– Definition, how Vendor plans to fulfill the Demands
– Demand Numbers should be used
for Crossreference to URS

Phase 1: Specification
• Project Validation Plan (PVP) System Owner
• Project Quality Plan (PQP)
• Hardware Design Specification Vendor /
System Owner
• Software Design Specification Vendor
• Software Module Specification Vendor
• Design Qualification (DQ) System Owner

Project Validation Plan (PVP)
Project Quality Plan (PQP)
• Defines the Validation Strategy for the specific Computerized System

• Exact Planning for the Validation of the specific Computerized System
• Contains an continously updated Task- and Time-Schedule
• PVP and PQP are very often maintained
together in one Document

Design Specification and
Design Qualification (DQ)
• Hardware Design Specification
– Fixed Environment given by System Owner
• Facilities, Installation, Building, Rooms, Cabling, Power etc.
– Required Environment given by Vendor
• Minimum and Recommended Hardware, Devices, Workstations, Servers, Network,
Interfaces to Side-Systems
• Software Design Specification
– Drill-Down of FS into Software Functionalities
– Should refer to Demand Numbers from URS for Crossreference
– Given by Vendor
• Software Module Specification
– Very Detailed Specification of Module Design and Data Structures
– Given by Vendor and used by Vendor‘s Developers to implement the
Software according to the Requirements
• Design Qualification (DQ)
– Optional formal Act of checking
Design Documents for Completeness
Phase 2: Implementation and Test
• Risk Assessment / Risk Analysis System Owner/
• Testplans for FAT, SAT, IQ, OQ, PQ Vendor
• Software Development Vendor
• Module Testing (100% !) Vendor
• Optional Factory Acceptance Test System Owner/

(FAT) Vendor

Risk Assessment / Risk Analysis
• A permanent Meassure to assess GMP-Risks in all Phases
• Most important to determine the Depth and the Effort of the different Test
Phases (Module Testing, IQ, OQ, PQ)
• Should be carried out by using standard Risk Assessment Methods (i.e. FMEA)
• Should be supported by a Risk Assessment Tool
• FMEA (Failure Mode and Effect Analysis) Adaptation for CS-Validation:
Preparation: Define a Risk Assessment Team for the CS
Step 1: Identify all Functionalities of the CS (use URS, FS and DS for Reference)
Step 2: Assess the GMP-Relevance of every Functionality
Step 3: Identify possible Malfunctions by reversing the Effect of every intended
Funtionality
Step 4: Assess the Probability of Appearance (low = 1, medium = 2, high = 3),
the Importance (low = 1, medium = 2, high = 3, extreme = 4) and the
Probability of Detection (high = 1, medium = 2, low = 3) of the Fault
Step 5: Calculate Risk Priority Value (A x I x D)
Step 6: For RP-Values of 7 or higher define protective Meassures (Module
Testing, IQ Tests, OQ Tests, PQ Test, Maintenance)
Step 7: Re-assess Risk, taking successful protective Meassures into account.
This time, the RP-Values should be below 7

Risk Assessment Tool

Test Planning
• Module Testing
– Carried out by Vendor
– Should be 100% of all Functionalities (GMP- and Non-GMP-
Relevant Functions)
– Normally also required by QA-System of a GMP-compliant Vendor
(i.e. complete Test Documentation available for Scarabaeus+)
– Can be referenced as Part of the Validation (no Need to repeat all
Tests!)
– Should be supported by a Test Specification Tool to ease Test
Planning for all Test Phases
• Factory Acceptance Test (FAT)
– Optional Test against the Functional Specification in Vendor‘s
Environment
– Required by GAMP4; can be omitted, if Vendor or CS is Standard or
has reliable References
– If successful, CS is released for Delivery and Installation

Test Specification/Protocol Tool

Phase 3: Installation

• Delivery and Configuration Vendor
• Optional Site Acceptance Test (SAT) System Owner
• Training Plan and User Training System Owner/

Vendor

Bringing the System On Stage
• Delivery and Configuration of the CS at the Target Location
• Vendor should have SOP for the Process of Delivery and Installation
• Vendor provides Installation Plan and writes down an Installation
Protocol and a Configuration Protocol
• Neccessary Modifications during Installation MUST be tracked according
to Change Control Procedures
• Site Acceptance Test (SAT)
– Optional Test for correct Installation in System Owner‘s Environment
– Very often covered by IQ to reduce Costs and Effort
• Training Phase
– System Owner (and Vendor) create(s) Training Plan
– Separated Training System should be made available (i.e. parallel
Installation of an identical second Instance of the CS)
– Users are training according to Training Plan
– Trainings have to be documented!

Phase 4: Qualification Testing

• Installation Qualification (IQ) System Owner
• Operational Qualification (OQ) System Owner
• Performance Qualification (PQ) System Owner
• FDA 21 CFR Part 11 Compliance System Owner/

Paper (if required) Vendor

Testing for Qualification
• Tests during Installation Qualification (IQ)
– Should ensure correct Installation of the CS
– Checked against general System Design Specification
– Focussed on Hardware, Network, Equipment and Interfaces
– Testplan can be derived from Risk Assessment and reduced to GMP-relevant
Risks
• Tests during Operational Qualification (OQ)
– Should ensure correct Implementation of the required Functionalities
– Checked against Functional Specification
Risks
• Tests during Performance Qualification (PQ)
– Should ensure correct System Operation under real productive Conditions
– Should consider Stress Tests and intentional System Failures
– Checked against User Requirement Specification
Risks

Phase 5: Going Productive

• Maintenance Plan System Owner /
• Maintenance and Service Contract Vendor
• Validation Report System Owner
• Release of CS for Production System Owner

Reaching the Target...
• Maintenance
– System Owner should create Maintenance Procedures for the CS
– Vendor should provide a Maintenance Contract
– Version Management and Change Control Procedures must be
ready and operative
• Validation Report
– Document collects all results of all Validation Activities
– All Actions must be completed according to Validation Plan
– The correct Sequence of Actions must be evident
– Deviations and Follow-Up Meassures must be reported
• ...and then
– Release of the validated Computerized System for
productive Operation by the Responsible
of the System Owner

Phase 6: Keep it Validated
• Maintain System and Error System Owner
Logbooks
• Follow Data Backup Procedures System Owner
• Configuration and Version System Owner

Management
• Follow Change Control Procedures System Owner
• Self-Inspections and (Re-)Training System-Owner

of Users

For More Information go to...
www.iapbv.nl
www.gti-scarabaeus.com
www.csv-pharma.de


How To Validate Computerized Systems

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

How To Validate Computerized Systems

Uploaded by

Copyright:

Available Formats

How to Validate Computerized

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

Marketing/ Sales Production

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

• CS Validation Master Plan System Owner

• User Requirement Spec. (URS) System Owner

• Vendor Auditing / Vendor Selection System Owner

• Functional Specification (FS) Vendor

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

Design Specification Installation

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

• Software Module Specification Vendor

• Design Qualification (DQ) System Owner

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

• Defines the Validation Strategy for the specific Computerized System

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

• Module Testing (100% !) Vendor

• Optional Factory Acceptance Test System Owner/

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

Activity / Document Responsibility

• Optional Site Acceptance Test (SAT) System Owner

• Training Plan and User Training System Owner/

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

Activity / Document Responsibility

• Operational Qualification (OQ) System Owner

• Performance Qualification (PQ) System Owner

• FDA 21 CFR Part 11 Compliance System Owner/

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

Activity / Document Responsibility

• Release of CS for Production System Owner

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

• Configuration and Version System Owner

• Self-Inspections and (Re-)Training System-Owner

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

© 2003 Manuel Droesler, IT-Engineer and certified Computer Validation Specialist,

You might also like