Computer systems validation testing

Friedli D, Kappeler W, Zimmermann, S. Validation of computer system practical testing of a standard LIMS. Pharmaceut Acta Helv 1998 72 343-8. 

Validation Team A well-defined validation team with a well-written description of responsibilities is required and assures the adequate realization of the validation tasks. A validation team should be composed by different responsibilities responsible-of-validation team, team leader, archive manager, test coordinator, quality assurance member, tester, and witness. The responsible-for-validation team elaborates and approves the VMP, protocols, and reports. The team leader should be responsible for the computer system validation and utilization. An archive manager is responsible for the management of all computer system validation documents. The test coordinator is responsible for the computer system test and coordinates the elaboration and operation of tests for evaluating the performance of the computer system. A quality assurance member is required to periodically inspect and train the personnel and review all the validation documents. The tester is responsible for the execution of the tests required to perform the validation protocol. The witness is responsible for observing and reviewing the operations of the tester. 

Steps for equipment qualification and computer system validation with examples on type and extent of testing... 

Whether a control system comprises distinct instruments for nominal control functions and process monitoring, or an integrated control system, a nominal set of control function tests are necessary. The tests described encompass both controller capability and equipment performance. These tests may be completed during the FAT as part of a separate computer system validation. 

Providing documented evidence to achieve and maintain the validated status and uphold GMP compliance requires a systematic approach and rigorous controls throughout all phases of the computer system validation life cycle. Formal testing at key stages in the life cycle will provide records to demonstrate that predefined requirements have been met and that the computer system is fully documented. 

Documentation. Since the validation protocol is documentation intensive, existing documents, reports, vendor manuals, etc. should be used. The development of the protocol and the methodology used for validation should fit the existing management/committee structure whenever possible. Computer systems validation should not create a new documentation structure but rather pull together the necessary information for documentation and testing from that which already exists. 

Protocol Summary. A summary of the protocol documentation. including an analysis of the test results, the compliance audit of the system, and any system modifications should be submitted to the computer systems validation committee for their review and approval. It is recommended that the system not be used until final validation approval is received from the committee. 

Computer systems validation, as established in 21 CFR Part 211.68, Automatic, Mechanical, and Electronic Equipment, is one of the most important requirements in FDA-regulated operations and an element of the system life cycle (SLC). In addition to the testing of the computer technology, other verifications and inspection activities include code walkthroughs, dynamic analysis and trace analysis. These activities may require 40% of overall project efforts. 

The development model associated with the SLC contains the software engineering tasks and associated work products necessary to support the computer system validation effort. It breaks the systems development process down into sub-periods during which discrete work products are developed. This approach leads to well-documented systems that are easier to test and maintain, and for which an organization can have confidence that the system s functions will be fulfilled with a minimum of unforeseen problems. 

Computer systems validation is an element of the SLC. In addition to the software and hardware testing, other verification activities include code walkthroughs, dynamic analysis, and trace analysis. 

All computer systems performing regulated operations must be validated. To support computer systems validation, standard instmments, microcontrollers, and smart instrumentation are functionally tested (black box test) and the installed versions recorded. 

This citation talks to a core concept of computer systems validation development procedures and system specifications. Note that the firm was not cited for lack of validation testing of the software but for lack of design controls. Effective design controls would have included written design procedures. Adherence to these procedures would have... 

Whether or not the site has copies of the documentation for the computer system validation and for the installation testing from the vendor... 

It is not typical to receive a separate functional and design specification these are often included as part of the building s environmental control package. If this proves to be the case, then it is not necessary to rewrite these specifications. The recommended approach is to create a matrix that references those parts of the environmental control package that are relevant to the computer system validation requirements for the critical functions. Also, ensure that this matrix is mapped back to the URS in order to ensure that the URS is met. This matrix will form the basis of the Requirement Traceability Matrix (RTM), which is intended to assure that all requirements have been addressed, that the functionality is appropriate, consistent, and meets predefined standards, and that the system is appropriately tested. The functional/design specification or the relevant sections of the environmental control package should typically address ... 

The V-Model commonly used in the pharmaceutical and healthcare industry for computer systems validation is presented in Figure 38.4. The model illustrates the cascade approach and the relationship between specifications and testing. This V-Model can now be developed to fit the incremental approach (see Figure 38.5). 

Computer system validation activities will occur both during as well as at the end of the database development life cycle. Successful validation is highly dependent upon a comprehensive approach to specifications, reviews, installation, inspections, analyses, and testing of both the system hardware and software. 

These tests, along with all other validation activities, may be summarized in an overall computer system Validation Plan (VP) which is prepared early in the system development life cycle (often concurrent with the system-detailed user requirements definition). 

The OECD covers a series of activities and personnel. Responsibilities, training, quality assurance (QA), standard operating procedures (SOPs), study plans and study reports, data production and recording, equipment maintenance and calibration, computers and validation, test systems and test substances, and archiving are the primary areas covered by the GLPs. 

Software and computer system validation differ from hardware validation in that it is harder to specify absolute performance criteria and functional specifications for software and to define tests and acceptance criteria. There are many publications that deal with the validation of software and computer systems in one way or another. However, either they are not specific for the requirements of analytical laboratories or they are not specific to computers in the laboratory. 

QA SQPs should specify the amount of data to be audited and how the data points are chosen for audit. An auditor may choose to perform more thorough and more frequent audits on a recently validated system. The validation report can be used to assist in determining what and how much to audit. For example, if data summary printouts from the chromatographic computer system are used in the report, the validation report should be reviewed to verify that this summary function was tested during validation. If this portion of the computer software was successfully validated, verifying a few values from each table in the report may be sufficient. 

For computer systems that do not require formal validation, at a minimum, user acceptance testing should be performed. This User Acceptance Testing should be outlined in a facility SOP, where the system is tested and assured to perform in the desired function effectively. The User Acceptance should be documented, and the system should be released for specific uses. 

Software producers must fulfill the requirements for development, testing, and documentation. When the user is confident that these requirements have been met, and the system functions adequately to fulfill his or her needs, the user must perform validation prior to placing the software in service. An analytical laboratory is an example of an end-user that conducts testing prior to software/computer system installation. 

The computerized systems, both hardware and software, that form part of the GLP study should comply with the requirements of the principles of GLP. This relates to the development, validation, operation and maintenance of the system. Validation means that tests have been carried out to demonstrate that the system is fit for its intended purpose. Like any other validation, this will be the use of objective evidence to confirm that the pre-set requirements for the system have been met. There will be a number of different types of computer system, ranging from personal computers and programmable analytical instruments to a laboratory information management system (LIMS). The extent of validation depends on the impact the system has on product quality, safety and record integrity. A risk-based approach can be used to assess the extent of validation required, focusing effort on critical areas. A computerized analytical system in a QC laboratory requires full validation (equipment qualification) with clear boundaries set on its range of operation because this has a high... 

Computers were first used in laboratories to calculate results and generate reports, often from an individual instrument. As automated analysers were developed, so the level of computerization increased and computers now play a major role in the modem laboratory. They are associated with both the analytical and organizational aspects and the term Laboratory Information Management System (LIMS) is often used to describe this overall function. Such systems are available that link the various operations associated with the production of a validated test result, from the receipt of the sample to the electronic transmission of the report to the initiator of the request, who may be at a site removed from the laboratory. Other uses include stock control, human resource management and budgets. 

Water system Cleaning practices Computer validation Process validation Test methods validation Sterilization procedures Stability evaluation... 

At the opposite end of the spectrum, consider a computer system used to track inert material in a warehouse. Errors in the system may inconvenience the production schedule, but have little or no chance of causing real harm. Even a complete misidentification will be quickly corrected in a QA test of final product. For such a system some validation is stiU necessary, but a higher tolerance could be used (smaller samples, less frequent rechecks, and broader testing parameters). 

System validation has always focused on the integrity of data once they are entered into a system, but if a research scientist misenters a data point or a robotic system misaligns a test tube, data that meet aU validation tests but are erroneous or misassigned can corrupt the end result. In effect, if your finger slipped and you typed in a 3 when you meant a 2 your computer wdl still add properly, but the answer you receive will be incorrect—GIGO the ultimate accuracy of laboratory systems is based in part on the accuracy of the data that are entered. 

Risk assessment is the first critical step in the validation of a computer system. After risk assessment, the validation protocol must be created, including all the points referred in the VMP. The procedures to be executed in a computer system should be defined, in addition to the specifications and tests to be performed. These tests could be trials for IQ, OQ, and PQ. After the test procedure and data evaluation, a validation report must be available. Therefore, a very well written and periodically reviewed (e.g., every year) VMP, validation protocol, and validation report are always necessary. 

A retrospective validation is applicable to computer systems in use when the VMP is elaborated. In this case, the real use of the system must be pointed out in order to allow a correct test plan. 

---