Computer auditing checklist

In order to audit effectively studies with electronically generated data, QA should create a special checklist or add electronic issues to a current checklist. The checklist should include items such as ensuring that the computer system in use is current and validated and that necessary maintenance is documented. 

The most important factors for the entire process of equipment qualification and computer system validation in analytical laboratories are proper planning, execution of qualification according to the plan, and documentation of the results. The process should start with the definition of the analytical technique and the development of user requirement and functional specifications. For computer systems, a formal vendor assessment should be made. This can be done through checklists and vendor documentation with internal and/or external references. For very complex systems, it should go through a vendor audit. 

The purpose of the following checklist is to help to determine if a computer system complies with the FDA Rule 21 CFR 21 Part 11 for electronic records and electronic signatures. This audit questionnaire apphes to systems that meet the definition of a closed system as defined in Section 11.3 (b)(4) of the rule and which do not utilize biometrics identification methods. 

An inventory of systems and knowledge, of which one is GMP-critical, must be maintained and available for inspections. An MHRA preinspection checklist has this as one of its opening topics. The availability or otherwise of this information is a clear indicator of whether management is in control of its computer systems validation. The use of an inventory need not be limited to inspection readiness it could also be used for determining supplier audits and periodic reviews, etc. Many pharmaceutical and healthcare companies use a spreadsheet or database to maintain this data. Where a site s inventory is managed between a number of such applications (perhaps one per laboratory, one for process control systems, one for IT systems), care must be taken that duplicate entries are avoided and, equally, that some systems are missed and not listed anywhere. It should be borne in mind that where spreadsheets and databases are used to manage an inventory, it should be validated just like any other GxP computer application. 

Efforts should be made to simplify the form for the registration of accidents and near accidents as far as possible. It is an important principle that the design of the form shall not create a barrier towards the reporting and investigation of accidents and near accidents. Some of the data are fed directly into the computer and need not show up on the form for the supervisor s first report. No specific form is needed for the in-depth investigations. Checklists should be developed to support the investigations. There are also other tools to be considered such as checklists and record sheets for use in workplace inspections, risk analyses and SHE audits. 

---