Computerized Systems Validation (CSV) in Biopharmaceutical Industries

Introduction

In 1990, when two European pharmaceutical manufacturers failed to meet computer compliance expectations and were momentarily forbidden from exporting their products to the United States, the problem of computer system validation assumed a high profile in Europe, EU requirements for computer systems compliance were issued a few years later in 1993 and can be found in Annex 11 in the EU GMPs [1]. So that biopharmaceutical companies should appoint a senior management representative with particular responsibility for ensuring the implementation of computer compliance requirements. This person, often graded as a Director, is a must-hearted champion of GxP’s cause. This senior position’s power and accountability should be obviously described and recorded. It is anticipated that the senior manager responsible for regulatory compliance will hire skilled and experienced personnel and guarantee that the CSV requirements carried out is carried out correctly and efficiently [2]. The failure to comply with regulations can has significant financial implications. Noncompliance issues may lead to delays in the issue of a license or its withdrawal and thus an embargo on the distribution of companies products in the relevant marketplace [3]. Successful validation relies on a number of fundamental supporting procedures being operated satisfactorily. These include instruction, document management, change control, configuration management, traceability specifications, self-inspection, and deviation management. Computer Systems Validation (CSV) is central to the life sciences industry [4].

IT Infrastructure Control and Compliance

The GAMP® Good Practice Guide: IT Infrastructure Control and Compliance: covers a range of IT Infrastructure, from those operating globally to isolated or semi-isolated. Key aspects considered include:

• IQ, OQ of infrastructure components.
• Configuration management and change control of infrastructure components.
• Settings the infrastructure components in a highly dynamic environment.
• Management of risks to IT Infrastructure.
• Service providers fot critical infrastructure processes to be envolved.
• Security management in relation to access controls.
• Data integrity.
• Backup, restore, and disaster recovery.

• Archiving. To avoid unnecessary effort, this Guide describes a horizontal, or platform based, approach, the benefits of which include:
• Higher level of standardization throughout the entire life cycle
• Minimal overlap in documentation
• Minimal overlap in qualification This categorization covers the computerized systems, which have an impact on the Products related to patient safety, product quality, and data integrity. The categorization basically covers software and hardware Categories as explained in Tables 1 & 2. A. Software Categories
• Minimal overlap in audits, inspections, and assessments [10].

GAMP 5 Categories

Importance of URS

Recent research has highlighted that in the pharmaceutical and bio-medical industry, 32% of all equipment procurement is unsatisfactory. The major problem has been identified as companies not specifying in sufficient detail and or accuracy, what their actual needs are. The lack of a fully detailed company approved User Requirements Specification (URS) , leads to many companies having to resort to otherwise un-necessary and costly retrospective actions in modifying the equipment or producing unspecified documentation or engineering drawings, post procurement. These extraneous GMP requirements often cost more than the equipment [11].

Typical Software Requirements [12]

Typical software requirements should specify the following:

• All software System inputs;
• All software System outputs;

System Development Life Cycle [12]

The system development life cycle (SDLC) can be defined as, a framework for developing computer based information system. In order words, SDLC is the overall process of developing information system through a multi-step process from investigation of initial requirements through analysis, design, implementation and maintenance. These activities are carried out in different phases, which are explained in figure 2.

Click to enlarge

Qualification Activities [2,13]

The validation process for 21 CFR Part 11 compliance consists of these core elements:

• Comprehending the regulatory requirements.
• Ensuring compliance with CSV requirements in a cost-effective process.
• Preparing validation CSV master plan.
• Writing the CSV protocol.
• Conducting testing protocol of software and computer systems – initial and ongoing.

• Ensuring that the bare minimum documentation that FDA inspectors will ask for are available.
• Qualifying the IT systems network infrastructure and validating the network systems.
• The key activities in computer system qualification explained briefly in Figure 3.

Click to enlarge

Project Phase Deliverables

Following section provide a snapshot of project phases deliverables applicable for software validation. However, the actual deliverables to be created, reviewed and approved for a project should be identified in the project validation plan in accordance to the approach defined for the project as explained in Table 3.

Compliance Strategy

The objective must be to achieve compliance as cost- effectively as possible. Many biopharmaceutical companies have subsequently found at their expense that inefficient compliance programs are extremely costly, involving much more work than is really necessary [5].

Figure 4 illustrates three basic compliance strategies by comparing the cost associated with compliance (prospective validation) compared to the costs of non- compliance (combined effect of retrospective validation and disturbance of company).

Click to enlarge

Common Reasons for CSV Failure

Without adequate planning and preparation [5], computer system validation can encounter several problems, eventually leading to failure of the process. Problems include:

a. Inadequate documentation of plans. b. Inadequate definition of what constitutes the computer system. c. Inadequate definition of expected results. d. Inadequate specification of software. e. Software that does not meet its specifications. f. Unavailable source code for software.

Regulatory Requirements

This section identifies the Regulatory requirements, determined by following regulations [1, 14, 15]:

I. US Food & Drug Administration - Code of Federal

Regulations, Title 21, part 11: “Electronic Records; Electronic Signatures; Final Rule” II. Guide to Good Manufacturing Practice for Medicinal Products (The Rules Governing Medicinal Products in the European Community, Volume IV – Annex 11). The Regulatory Requirements are grouped according to the following Regulatory Topics [16, 17, 18, 19].

• Quality System: related to the Quality System and to the associated documentation
• Security: related to the general features of System Security and Security of Regulated Electronic Record managed by the system
• Integrity: related to the Integrity of the Regulated Electronic Record managed by the system and associated Validation documentation
• Traceability: related to the Traceability of the Regulated Electronic Record managed by the system
• Accountability: related to the Regulated Electronic Signatures managed by the system More details about the requirements in Table 4.

Click to enlarge

11.300 (a) 12.1 Uniqueness of Codes

11.10 (g) 12.1

Integrity 11.10 (a) cards, personal codes with passwords, biometrics, restricted access to computer equipment and data storage areas safeguards in place to prevent unauthorized use of passwords and/or identification codes, The system can detecr and report in an immediate and urgent manner any attempts at Authority Check their unauthorized use to the system security unit Automatically log out Automatic Log Off users after a defined period of inactivity Users should work only under their own user profiles encompassing unique user IDs and individual passwords or User Profiles Security other access keys and not share these with othersCreation, change, and cancellation of access authorizations should be recorded.

Data should be secured

by both physical and electronic means against damage. Stored data should be checked for accessibility, readability and accuracy. Access to data should be ensured throughout the retention period.

Decisions on the extent

of validation and data integrity controls should be based on a justified and documented risk assessment of the computerized system. 11 Periodic Review Computerized systems

4.7 Validation Testing

4.8 Data Migration

6 Invalid Records Invalid Records

Altered Record Altered Record

16 Business Continuity Business Continuity

should be periodically evaluated to confirm that they remain valid.

URS should describe the required functions of the computerized system and be based on

4.4 User Requirements

documented risk assessment and GMP

impact.

An up to date listing of all relevant systems and

4.3 System Specifications

their GMP functionality

(inventory) should be available Evidence of appropriate test methods and test scenarios should be demonstrated. Particularly, system (process) parameter limits, data limits and error handling should be considered.

If data are transferred to another data format or system, validation should include checks Verification that data are not altered in value and/or meaning For critical data entered manually, there should be an additional check Detection on the accuracy of the data.

Validation of systems to

ensure accuracy, reliability, consistent intended performance, Detection

and the ability to discern invalid or altered records availability of computerized systems supporting critical processes, provisions should be made to ensure continuity of support for those processes in the event of a system breakdown

Click to enlarge

Device Check Device Check Devices check to see if that maintains a time sequenced audit trail for those changes made To building into the system the creation of a batch release it should be possible to generate printouts indicating if any of the data has been The system should be capable of recording all deletion operations. This record should be secure from subsequent changed in order to falsify that or any other

11.3 (a,b,d) Physical and/or logical

controls should be in place to restrict access to computerized system Uniqueness of identification Components (i.e. code to authorized persons.

The extent of security controls depends on the and password) criticality of the computerized system.

Initial and periodic testing of devices, such as tokens or cards, that

system requires validation to be comply GMP requirements, Examples for these systems mentioned in table 5.

Examples from Computerized System Required CSV

In biopharmaceutical industries many computerized

Conclusion

Without adequate planning and preparation, computer system validation can encounter several problems, eventually leading to failure of the process so the successful computer system validation (CSV) is highly dependent upon the quality assurance system, a formal System Development Life Cycle, and the qualification tasks performed throughout the this cycle. CSV must establish a level of confidence‖ that the system consistently meets the requirements and user requirements. As most methodologies require that specifications and test protocols are written, approved by qualified staff, and acted upon, it is possible to adapt the validation methodology to most situations, provided that the system requirements and functionality can be shown to be tested and proven, and that the system development, implementation, and operation is under control. Above all the system must be shown to operate correctly. Above all, the device must be shown to function properly, reliably and in compliance with its requirements. The system must be validated according the quality system and approved protocols to provide the user by data integrity, security, traceability and accountability.

Acknowledgment

Many thanks for Dr. Momtaz Wasfy for his revision and his generously contributed to the work presented in this review. In particular, Eng. Amr Mostafa for their tremendous support, but also for giving me many wonderful opportunities to learn many amazing things from them.