Lets Start CSV

 In regulated pharmaceutical industries and heading

the Quality, IT or Operations for the computer systems
used in-house.
 Associating with these highly regulated industries
means that regulators such as FDA, MHRA and
TGA..etc will examine the use and validation of these
computer systems.
Computerized system
validation (CSV)
 Computerized system validation (CSV) is
the documented process of assuring that a
computerized system does exactly what it is designed
to do in a consistent and reproducible manner.
 Documented system requirements are required for
CSV as they clearly stipulate the intended use of a
computer system application.
Let’s understand computer system validation
(CSV) in detail before explain importance of CSV.
 Computer system validation (sometimes called computer
validation or CSV) is the process of documenting that a
computer system meets a set of defined system
requirements. But the FDA’s idea of validation is much
broader than simply executing the software to validate
output meets specification requirements (dynamic
testing).
 Computer System Validation in a GxP environment also
includes static testing – inspections, walkthroughs, and
other review/analysis activities that can be performed
without actually running the software. FDA validation of
computer systems includes all of these dynamic and static
testing activities, with emphasis on producing documented
evidence that will be readily available for FDA inspectors.
• In addition rule 21 CFR Part 11 states that electronic
records may replace paper records and these electronic
records with electronic signatures are as secure as a
handwritten signature. This rule 21 CFR Part 11 impacts all
companies operating in GxP environment.

• Computer system validation is a critical tool to assure

quality of computer system performance. CSV enhances
the reliability of system, resulting in fewer errors and less
risk to process and data integrity. It also reduces long term
system and project cost by minimizing the cost of
maintenance and rework.
Computer System Validation - It’s
More Than Just Testing
 This requirement has naturally expanded to
encompass computer systems used both in the
development and production of, and as a part of
pharmaceutical products, medical devices, food, blood
establishments, tissue establishments, and clinical
trials.
Where CSV is applicable ? Benefits
of effective CVS
 Systems to make decisions on market release of drugs
and to create and retain market distribution records
 Systems to create and retain manufacturing orders and
manufacturing records, etc..
 Systems to control/manage manufacturing processes
and to retain relevant data .
 Systems to manage storage and inventory, etc. of raw
materials and products (including intermediates; the
same shall apply hereinafter)
Where CSV is applicable
 Systems to control/manage laboratory instruments
used for QC tests and systems to retain QC test results
and relevant data
 Systems to control/manage equipment and facilities,
including HVAC and water supply systems, etc., which
may have a significant impact on quality of products,
and systems to retain relevant data
 Systems to create, approve and retain documents
(SOPs, Quality Standard Code, Product Standard
Code, etc.)
CSV Regulations & Guidelines
 In 1983 the FDA published a guide to the inspection of
Computerized Systems in Pharmaceutical Processing, also
known as the 'bluebook‘. Recently both the American FDA
and the UK Medicines and Healthcare products Regulatory
Agency have added sections to the regulations specifically
for the use of computer systems.
 In the UK, computer validation is covered in Annex 11 of
the EU GMP regulations (EMEA 2011).
 The FDA introduced 21 CFR Part 11 for rules on the use of
electronic records, electronic signatures (FDA 1997).
 The FDA regulation is harmonized with ISO 8402:1994,
which treats "verification" and "validation" as separate and
distinct terms.
CSV Regulations & Guidelines
US FDA Compliance Policy Guidelines (CPGs)
 Drugs
 21 CFR Part 211 (211.68) – Automatic, Mechanical or
Electronic
 Equipment (cGMP for Finished Pharmaceuticals)
 Guide to Inspection of Computerized Systems in Drug
Processing, Feb 1983
 Guide to Inspection of Pharmaceutical Labs (July 1993)
 21 CFR 314 (314.70) – Supplements and other changes to an
 approved application (Applications for FDA Approval to
Market a new Drug)
 Computerized System in Drug Establishments (Feb, 1983)
CSV Regulations & Guidelines
 Medical Devices
 – 21 CFR Part 820 – Quality System Regulation (Medical
 Devices)
• Guidance Documents
 – General Principles of Software Validation (Jan, 2002)
 – Review of 510(k) for Computer Controlled Medical
Device
 – Compliance on Off-The Shelf Software Use in Medical
Devices (Sept, 1999)
 – Cybersecurity for Networked Medical Devices Containing
Offthe-Shelf (OTS) Software (Jan, 2005)
 – Medical Device Data Systems
CSV Regulations & Guidelines
 • Guidance Documents (contd.)
 – General Principles of Software Validation (Jan, 2002)
 – Review of 510(k) for Computer Controlled Medical Device
 – Compliance on Off-The Shelf Software Use in Medical Devices
 (Sept, 1999)
 – Cybersecurity for Networked Medical Devices Containing
Offthe-Shelf (OTS) Software (Jan, 2005)
 – Medical Device Data Systems
 – ISO 14971 – Application of Risk Management to Medical
Devices
 – ISO IEC 62034 – Medical device software – Software lifecycle
processes
CSV Regulations & Guidelines
 EU Regulations
 – EC Annex 11 – Computerized Systems (2011)
 – PIC/S PI 011-3 – Good Practices for Computerised Systems in
 Regulated ‘GXP’ Environments
 – European Medicines Agency answers to FAQs on Annex 11 as
 agreed by the GMP/GDP Inspectors Working Group
 – The APV Guideline “Computerized Systems” based on Annex
 11 of the EU-GMP Guideline.
 • API
 – Q7A GMP Guidance for APIs (Aug 2001)
 – CEFIC – Computer Validation Guide (Jan 2003)
CSV Regulations & Guidelines
 Clinical Trials
 – USFDA Guidance: Computerized System used in Clinical
 Investigations (May 2007)
 – USFDA Compliance Program 7348.810 – Sponsors, CROs and
 Monitors (March, 2011)
 – USFDA Guidance: Electronic Source Data in Clinical
 Investigations (Nov, 2012)
 – USFDA Information Sheet Guidance for IRBs, Clinical
 Investigators, and Sponsors FDA Inspections of Clinical
 Investigators
 – EMEA Procedure for conducting GCP Inspections requested by
 the EMEA (Sept 2007)
CSV Regulations & Guidelines
GAMP (Good Automated Manufacturing Practices, ISPE)
 – GAMP5 – A Risk Based Approach to Compliant GxP
 Computerized System
 – GAMP GPG – Calibration Management
 – GAMP GPG – Testing of GxP Systems
 – GAMP GPG – GxP Compliant Lab Computerized Systems
 – GAMP GPG – GxP Process Control Systems
 – GAMP GPG – Electronic Data Archiving
 – GAMP GPG – Global Information Systems Control and
Compliance
 – GAMP GPG – IT Infrastructure Control and Compliance
 – GAMP GPG - MES
GAMP as part of Your Quality
System
 Background
 Today, pharmaceutical company typically procure automated
systems via relatively small local system integrator companies
 These companies have widely different capabilities and
interpretations of how to comply to cGxP quality requirements
 Project execution standards, both in terms of cost control and
meeting schedules, vary dramatically for one integrator to another
 Large international pharmaceutical companies are looking to off
load the burden of managing many small suppliers in disparate
locations
 A need for a collaborative Quality System program for system
integrators exists
GAMP as Part of Your Quality
System, Definition’s of validation
 The collection and evaluation of data, from the process design
stage through commercial production, which establishes
scientific evidence that a process is capable of consistently
delivering quality products. (FDA)

 Documented evidence which provides a high degree of assurance

that a specific process will consistently result in a product that
meets predetermined specifications and quality characteristics.
(WHO)

 The documented evidence that the process, operated within

established parameters, can perform effectively and reproducibly
to produce a medicinal product meeting its predetermined
specifications and quality attributes.(EMA)
Validation?
 Key Words:
 “Documented evidence”
 “Pre-determined specifications”
Why is validation of Computer
Systems Important?
 It can be argued that it is more important to apply the principles
of validation to automated systems than to any other aspect of a
pharmaceutical process.

 Automated systems, especially software components cannot be

tested in the same way as a physical product
 Software is different, all software programs contain errors. How it is used
will determine whether the errors become apparent or not.
 Software application complexity can mean that we could not test every
permutation of inputs and use cases
 Therefore end line testing (while still an important feature of a good
quality system) cannot be relied upon on its own to ensure product
quality

 The FDA believes that the only way to develop validatable software
is within a ”Quality Regulated Environment.”
What is GAMP and why was it
developed?
 GAMP - Good Automated Manufacturing Practice
 1990, the UK Pharmaceutical Industry Computer Systems Validation
Forum (GAMP Forum) was set up to promote the better understanding of
validation of automated systems in pharmaceutical manufacturing
 improve understanding of the regulations and their interpretation, to improve
communication within the pharmaceutical industry and with its suppliers

 Why was GAMP developed?

 Each company, and indeed each project team within a company, tended to
apply personal preferences rather that a methodology for compliance
 To provide suppliers with a universal standard that would meet the requirements
of the pharmaceutical industry
 An independent standard that can be referenced within commercial contracts,
Suppliers can concentrate on quality concepts such as “repeatability”
GAMP Guide and Special Interest
Groups
 Guide releases and publication dates
 V 1.0, March 1995
 V 2.0 May 1996
 V 3.0 March 1998
 V 4.0 Dec 2001
 March 2008
 GAMP Organization
 Europe and America

 10 Special Interest Groups (SIGs)

 JETT and Process Control
How a Quality System assists
Validation
 FDA believes that companies with effective Quality
Systems provide the best environment for developing
software
 The repeatability and control over events that are
essential for the development of validatable systems
are best provided by a formal quality system. Systems
that regulate:
 What Actions are taken on a project
 How they are executed, and by Whom
 What Steps are to be taken to Confirm that they have been
implemented correctly
Implementation Using GAMP
Guidelines
 Keys steps involved for suppliers of computer systems
to ensure that their products can be successfully
validated
 V Model….>>
A Road Map to COTS
Computer System Validation
 21 CFR Part 11 effective Incipit requires ....

Validation of systems to ensure

accuracy, reliability, consistent
intended performance, and the ability to
discern invalid or altered records (§11.10(a))
…. The Bar is being raised
PART 11
COMPLIANCE
NEW
STD
COMPLIANCE

CSV
COMPLIANCE
NEW STD
CSV
COMPLIANCE
ER NEW OLD STD
ER NO ER
Guidance Content:
 GUIDANCE KEY ELEMENTS
System Requirements Specifications
Change Control
Documentation of Validation Activity
Equipment Installation
Static Verification Techniques
Extent of Validation
Independence of Review
Release of System
operational Management
 SPECIAL CONSIDERATIONS: COTS products and Internet
Example of Guidance: Independence of Review
Computer system validation should be performed by persons other
than those responsible for building the system.
Two approaches to ensuring an objective review are:
GUIDANCE
CFR 21 P 11

(1) Engaging a third party

(2) dividing the work within an organization such that people who
review the system (or a portion of the system) are not the same
people who built it.
COTS (Commercial Off-The Shelf) products
Commercial software used in electronic record keeping system
subject to part 11 needs to be validated, just as programs written by
end users need to validated
(…)
GUIDANCE
CFR 21 P 11

We do not consider commercial marketing alone to be sufficient

proof of a program’s performance suitability
(…)
See 62 Federal Register 13430 at 1344-13445 March 20,1997

WRONG APPROACH

SYSTEM IS A COMMERCIAL IT’S OK.

PACKAGE, WIDELY USED NOT NEED TO BE VALIDATED

RIGHT APPROACH
SYSTEM IS A COMMERCIAL
PACKAGE, WIDELY USED
END USER REQ SPECS
SW STRUCTURAL INTEGRITY
FUNCTIONAL SW TESTING
References:
 The FDA introduced 21 CFR Part 11 for rules on the use of electronic records, electronic
signatures (FDA 1997).
 UK, computer validation is covered in Annex 11 of the EU GMP regulations – EC Annex 11
– Computerized Systems (EMEA 2011).
 US FDA Compliance Policy Guidelines (CPGs) Drugs
 21 CFR Part 211 (211.68) – Automatic, Mechanical or Electronic Equipment (cGMP for
Finished Pharmaceuticals)
 21 CFR Part 11 Electronic records; electronic signatures
 FDA Guide to Inspection of Computerized Systems in Drug Processing, 1983.
 Guide to Inspection of Computerized Systems in Drug Processing, Feb 1983
 GAMP (Good Automated Manufacturing Practices, ISPE) – GAMP5 – A Risk Based
Approach to Compliant GxP
 Computerized System in Drug Establishments (Feb, 1983)
 21 CFR Part 820 – Quality System Regulation (Medical Devices)
 PIC/S PI 011-3 – Good Practices for Computerised Systems in Regulated ‘GXP’
Environments
 APIQ7A GMP Guidance for APIs (Aug 2001)
 CEFIC – Computer Validation Guide (Jan 2003)