Configured application software validation

Configurable application software usually includes custom configurable packages such as Manufacturing Resource Planning (MRP 11), Documentum , Maximo and so on. Validation of such systems requires an audit of the supplier and validation of any bespoke application software. 

Configurable software packages—validation life cycle with qualification of the hardware and application software... 

Server Application Application software products such as the MRP II software product. GAMP level 4 software requiring a supplier audit, validation of the configuration, and confirming the operability of the standard element of the software (e.g., SAP R/3). There may also be some standard software such as GAMP level 3 requiring the version to be recorded and operability confirmed (e.g., third-party utilities provided with the server application). 

When purchasing configurable software, it is often the practice to evaluate the criticality of the application to the regulatory operation, in order to determine if a supplier evaluation is warranted and feasible. If a supplier evaluation is not warranted or feasible, the rationale for this must be documented and retained with the system validation documentation. As in the previous case, the end user is responsible for ensuring that the program is suitable for its intended purpose when used in a regulatory environment. 

Because no records are yet saved to a durable media, Part 11 is not applicable to these computer systems, or to other computer systems with similar configuration. However, Part 11 may be used as the model to validate the software, hardware, and any associated interfaces. In this case, the following elements in Part 11 are applicable ... 

It is important to understand too that customization will further increase validation costs (e.g., custom PLC applications will probably incur a 10% validation cost rather than the 5% indicated in Figure 17.2, which assumed a configured COTS application). Table 17.1 compares the relative increased costs associated with custom applications, configured COTS applications, and standard COTS products that do not require configuration. The further the cost of validation decreases, the more the standard software can be leveraged. The exploitation of standard software is explored further in Chapter 14. 

Client Applications A client may be used for more than one application (e.g., MRP II, LIMS, and EMS). Each application will have an associated file set providing what is often referred to as its Graphical User Interface (GUI). File sets are usually built into standard client set-ups. Individual files may include some element of configuration. GAMP level 3 (e.g., Windows NT) and GAMP level 4 software require the version to be recorded, operability confirmed, and any configuration validated. Supplier Audit requirements are usually satisfied as part of the server application validation. 

Configurable Software Consider audit, validate application, and any bespoke code. 

Standard software packages are called canned or COTS (commercial off-the-shelf) configurable packages in the United States. Examples include Lotus 1-2-3 , Microsoft Excel and other spreadsheet packages. There is no requirement to validate the software package however, new versions should be treated with caution. Validation efforts should concentrate on the application, which includes... 

---