CSV: Computer Systems Validation
"GMP-related computerized systems should be validated. The depth and scope of the validation depends on the diversity, complexity, and criticality of the computerized application." - FDA Guidance for Industry, Q7A Good Manufacturing Practice for Active Pharmaceutical Ingredients. Additional references below.
Gray Matter Consulting approaches Computer Systems Validation with our motto in mind:
IQ IT: Intelligent Quality through Information Technology
Some companies take the "kill 'em with paperwork" approach to validation, wasting time and resources on unnecessary activities. Some companies underestimate the importance of the process, and receive 483s for failure to validate.
At Gray Matter Consulting, we believe in "right-sizing" the validation effort by:
- Keeping the validation focused on the intended use of the system,
- Efficiently employing a risk-based approach, concentrating on high-risk elements,
- Recognizing the size and resources of your organization,
- Leveraging well-written documentation from audited vendors, and
- Applying a Systems Integration Lifecycle when better-suited to COTS software than the traditional Software Development Lifecycle (SDLC).
FDA Announces Part 11 Inspections to Begin "Soon"
In 1997, FDA implemented 21 CFR Part 11 Electronic Records; Electronic Signatures, regulations governing the use of "records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations." - 21 CFR 11.1(b)
FDA's 21 CFR Part 11 regulation requires validation of systems for to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
FDA announced last month that the agency will "soon" begin a series of Part 11-focused inspections taking into account interpretation and enforcement discrection outlined in FDA guidances. As a result, Computer Systems Validation will be placed under the agency's microscope.
While most data in electronic format regulated by FDA predicate rules, including GxP regulations, are subject to Part 11 and Computer Systems Validation, there are important exceptions outlined in FDA guidances that can alleviate burdens associated with compliance.
FDA intentionally left regulations open to interpretation by affected industries. While this has given organizations the flexibility to use current technology, industry standards, and best practices to implement and validate information systems, it has also led to confusion in interpreting these regulations.
Gray Matter Consulting can assist you in assessing your systems for Part 11 applicability and validate accordingly, including Part 11 requirements as necessary, leveraging FDA's self-described enforcement discretion.
IQ IT: Intelligent Quality through Information Technology
The Gray Matter approach to Computer Systems Validation
FDA Regulations and Guidances:
"GMP-related computerized systems should be validated. The depth and scope of the validation depends on the diversity, complexity, and criticality of the computerized application." - FDA Guidance for Industry, Q7A Good Manufacturing Practice for Active Pharmaceutical Ingredients.
“Both the CGMP regulations (§ 211.110) and quality systems models call for the monitoring of critical processes that may be responsible for causing variability during production. For example:
• Process steps must be verified by a second person (§ 211.188). Process steps can also
be performed using a validated computer system." - FDA Guidance for Industry: Quality Systems Approach to Pharmaceutical cGMP Regulations.
"When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented." - 21 CFR 820 Quality System Regulation.
"Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine. Such procedures and controls shall include the following:
(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. 21 CFR Part 11, Electronic Records; Electronic Signatures.
"GMP-related computerized systems should be validated. The depth and scope of the validation depends on the diversity, complexity, and criticality of the computerized application." - FDA Guidance for Industry, Q7A Good Manufacturing Practice for Active Pharmaceutical Ingredients.
“Both the CGMP regulations (§ 211.110) and quality systems models call for the monitoring of critical processes that may be responsible for causing variability during production. For example:
• Process steps must be verified by a second person (§ 211.188). Process steps can also
be performed using a validated computer system." - FDA Guidance for Industry: Quality Systems Approach to Pharmaceutical cGMP Regulations.
"When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented." - 21 CFR 820 Quality System Regulation.
"Persons who use closed systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine. Such procedures and controls shall include the following:
(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. 21 CFR Part 11, Electronic Records; Electronic Signatures.