Computer systems regulatory requirements

Each phase of the SLC must be controlled to maximize the probability that a finished system meets all quality, regulatory, safety, and specification requirements. If an SLC approach is applied properly, no additional work will be required to validate a system. For each SLC period and event, computer systems validation requires that the development processes are documented work products. As explained in Chapter 2, phase gate verification activities performed during each event may be a perfect place to review and quantify the quality of all products needed to support the next phase. 

The handbook additionally provides an extensive overview and comparison of commercially available computer systems and software for chemical emergency planning. This section provides technical guidance for hazard analysis and identification implementing regulatory requirements and descriptions of computer applications and systems applicable under SARA Title III. 

Some organizations develop risk assessment systems that first determine the regulatory impact of each computer system by using the following questions. If there is no regulatory impact, no validation activities are required by the regulating agencies. However, those systems can be validated for business or other reasons. 

The objective of this chapter is to examine computer system qualification as required for validation programs in the regulated pharmaceutical industry, providing guidance and reference on regulatory requirements, validation methodologies, and documentation. 

Computer systems used to collect and manage records must demonstrate to the FDA that regulated products are safe and efficacious. Increased attention being paid to computers systems by the regulatory authorities requires that a periodic evaluation of compliance must be carried out by computer systems developers,2 companies, industry, and/or the regulator. 

A computer systems validation program for regulated operations can be established based on the regulatory requirements, SQA practices, SQE practices, and type of software. 

Computer systems are validated for two important reasons to ensure that good business practices are followed, and to satisfy regulatory agency requirements. 

Certain discrete work products are expected when evidencing the development and maintenance work of computer systems compliance to regulatory requirements. The selected SLC should specify the overall periods and the associated events, and dictate the minimum requirements regardless of the chosen development method. These development methods and deliverables are also known as the development methodology. 

Computer systems validation, implied in 21 CFR Part 211.68, established in 21 CFR Part 11.10(a), and defined in the recent draft FDA guideline,4 is one of the most important requirements applicable to computer systems performing regulated operations. Computer systems validation is the confirmation (by examination and the provision of objective evidence) that computer system specifications conform to user needs and intended uses, and that all requirements can be consistently fulfilled. It involves establishing that the computer system conforms to the user, regulatory, safety, and intended functional requirements. 

Regulatory authorities hold the owner of the records known to be required by existing regulation responsible for assuring the compliance of the computer systems that record and manage such records. The FDA defined this responsibility in CPG 7132a. 12, Vendor Responsibility . 

FDA s authority to regulate the use of computers in food plants is derived from FD C Act Section 402 (a) (3). Specifically, conventional food is governed by the CGMP in Manufacturing, Packaging, or Holding Human Food (21 CFR Part 110, April 2001). 21 CFR 110.40(d) provides the regulatory requirements applicable to computer systems ... 

The implementation or update of a computer system is planned and executed in accordance with the organization s own project management practices. It is the project manager s responsibility to take into account the technological requirements, standards, procedural controls, regulatory requirements and related guidelines, and industry standards. 

Compliance assessments for computer systems are performed periodically, based on the applicable predicate regulatory and Part 11 requirements. These assessments must be performed in order to identify any functional gaps, and/ or procedural gaps, which may be present for each computer system implemented. The analysis will determine if operational, maintenance or security controls, specific to the system, provide a controlled environment ensuring the integrity of the electronic records and/or signatures as stated in the regulatory requirements. Additional information can be found in Chapter 19. 

The review and approval of the plan by QA is optional, but will provide an endorsement that the plan conforms to the current written procedures on computer systems validation, and that the document incorporates applicable regulatory requirements. 

After visiting and inspecting the supplier, the information obtained is analyzed against the acceptance criteria, current company requirements for the validation of computer systems, and the regulatory expectations for computing environments. A report is produced that documents the audit process, provides information on the current state of validation of the supplier and what may be needed for compliance and, based on the audit findings, provides a recommendation on whether the supplier can be used. 

An important item to be addressed during the implementation of every computer system is the long-term archiving of data and any associated metadata. The hardware and software supporting the repository must be robust, but also flexible enough to withstand the regulatory electronic records retention requirements. 

This appendix discusses the main FDA regulatory requirements and guidelines apphcable to computer systems performing regulated operations and their interpretation. The following regulations are covered ... 

A comprehensive US FDA guideline covering regulatory requirements apphcable to computer systems performing regulated function in the food industry can be found at mailto http //www.fda.gov/oralinspect ref/igs/foodcomp.html. 

Key principles for computer systems validation that might be included in the Validation Policy based on the GAMP 4 Guide are presented in Appendix 3A. These principles have been prepared to address the basic requirements of the following regulatory authorities ... 

System Owners/Users are accountable for assuring that computer systems used by them, or on their behalf by other organizations, in support of pharmaceutical regulatory requirements and pharmaceutical regulated areas or processes are compliant with pharmaceutical agency regulations, are properly validated, and are used in a compliant manner. 

---