Operating systems validation requirements

FDA device regulation is focused on the device and the device manufacturer. CLIA, on the other hand, focuses on laboratory quality, including the quality of the laboratory test results provided by the devices used, whether developed in-house or as a test kit in commercial distribution to multiple laboratories. The programs differ substantially in approaches and in data requirements. FDA requires unique submissions for each test under its purview, evaluates both performance and labeling, and requires demonstration of analytical validity and clinical validity as appropriate. CLIA inspects laboratories using a system approach based on key probes of the operating system. CLIA requires a demonstration of analytical performance and quality control but does not require a showing of either clinical validity or clinical utility. 

This book, relevant to FDA-regulated operations, provides practical information to enable compliance with computer systems validation requirements, while highlighting and efficiently integrating the Part 11 requirements into the computer validation program. The ideas presented in this book are based on many years of experience in the United States Department of Defense and FDA-regulated industries in various computer systems development, maintenance, and quality functions. 

Validation is key to establishing most critical GMP operations. Typical systems that require validation are as follows ... 

This approach requires a valid estimate of the uncertainty from each participant. Where there is an effective system in operation for validating participants ... 

The computerized systems, both hardware and software, that form part of the GLP study should comply with the requirements of the principles of GLP. This relates to the development, validation, operation and maintenance of the system. Validation means that tests have been carried out to demonstrate that the system is fit for its intended purpose. Like any other validation, this will be the use of objective evidence to confirm that the pre-set requirements for the system have been met. There will be a number of different types of computer system, ranging from personal computers and programmable analytical instruments to a laboratory information management system (LIMS). The extent of validation depends on the impact the system has on product quality, safety and record integrity. A risk-based approach can be used to assess the extent of validation required, focusing effort on critical areas. A computerized analytical system in a QC laboratory requires full validation (equipment qualification) with clear boundaries set on its range of operation because this has a high... 

This chapter defines the terms, responsibilities, requirements and recommended procedures involved in pre-installation, installation qualification (IQ), operational qualification (OQ) and performance qualification (PQ), which are all part of a typical HPLC system validation process. As the FDA does not publish a definitive reference or cookbook for these procedures, the suggestions herein are only recommendations. These have been successfully incorporated into formal standard operating procedures (SOPs) that have been implemented at a number of larger pharmaceutical establishments. As long as proper SOPs... 

Validation Team A well-defined validation team with a well-written description of responsibilities is required and assures the adequate realization of the validation tasks. A validation team should be composed by different responsibilities responsible-of-validation team, team leader, archive manager, test coordinator, quality assurance member, tester, and witness. The responsible-for-validation team elaborates and approves the VMP, protocols, and reports. The team leader should be responsible for the computer system validation and utilization. An archive manager is responsible for the management of all computer system validation documents. The test coordinator is responsible for the computer system test and coordinates the elaboration and operation of tests for evaluating the performance of the computer system. A quality assurance member is required to periodically inspect and train the personnel and review all the validation documents. The tester is responsible for the execution of the tests required to perform the validation protocol. The witness is responsible for observing and reviewing the operations of the tester. 

Note The instruments used in the laboratories vary significantly in the design and operation complexity. The validation requirements should reflect the level of complexity of the instrument. It is obvious that the amount of effort required to validate a simple pH meter will be different from that required for a fully automated dissolution system. The Good Automated Manufacturing Practice (GAMP)... 

Computer system validation activities must ensure that all computer systems operating on the GMP environment perform consistently to the required standards. 

Whatever the validation approach, the fundamental requirement for computer system validation is to establish documented evidence that provides a high degree of assurance that the system consistently operates in accordance with predetermined specifications. The EC guide to GMP also requires periodic critical revalidation to be considered to ensure processes and procedures remain capable of achieving the intended results. 

Description of process/environment Quality-related critical parameters Purpose and objectives of the system Major benefits of the system Special requirements Specific training needs System operating strategy Related GMP compliance/regulations Physical and logical boundaries System GMP risk assessment System validation rationale Life-cycle documentation Assumptions and prerequisites Limitations and exclusions Quality-related critical parameters/data Standard operating procedures System requirement specification Supplier and system history... 

Describe and define the operations, system, or equipment to be validated. The operation or equipment should be analyzed carefully and then defined as precisely as possible. Since this definition will determine the requirements of each of the following steps in the process, no key item should be missing or forgotten. 

The effort required for prospective validation makes it necessary that QA principles are satisfied. The effort should bring together all the technical functions engineering, which documents and qualifies the process equipment, the facility, and the systems production, which checks that its operating systems are working properly QA, which builds on the database that had been accumulated during the development phase and development, which certifies that its process performed as designed. In short, the objective of the work is to show that the product may be routinely produced with confidence. 

The validation of computer systems is an exercise in project management. The fact that computers are involved does not mean that the approach will be significantly different. It does mean that the responsible users will be the focal point of computer systems validation they will have to assume the responsibility for validation of the computer systems they use just as they are responsible for all other compliance aspects of their operation. MIS will play a key role since their computer expertise and interface with the suppliers is required throughout the process. 

Computer systems validation, as established in 21 CFR Part 211.68, Automatic, Mechanical, and Electronic Equipment, is one of the most important requirements in FDA-regulated operations and an element of the system life cycle (SLC). In addition to the testing of the computer technology, other verifications and inspection activities include code walkthroughs, dynamic analysis and trace analysis. These activities may require 40% of overall project efforts. 

A computer systems validation program for regulated operations can be established based on the regulatory requirements, SQA practices, SQE practices, and type of software. 

Computer systems validation, implied in 21 CFR Part 211.68, established in 21 CFR Part 11.10(a), and defined in the recent draft FDA guideline,4 is one of the most important requirements applicable to computer systems performing regulated operations. Computer systems validation is the confirmation (by examination and the provision of objective evidence) that computer system specifications conform to user needs and intended uses, and that all requirements can be consistently fulfilled. It involves establishing that the computer system conforms to the user, regulatory, safety, and intended functional requirements. 

Qualification is the process of demonstrating whether a computer system and its associated controlled process/operation, procedural controls, and documentation are capable of fulfilling the specified requirements. Sidebar 10-11 depicts the context of the qualification activities and the computer systems validation process. The physical components of the systems are reviewed and its specific elements, subunits, and parameters are documented. A qualification also serves to verify and document the acceptability of the design, implementation, integration, and installation of the computer system components. The execution of the qualification is the mechanism by which documented evidence is created that verifies that the computer system performs according to its predetermined specification. 

No formal documents defining the validation requirements for computer systems. Specifications to define the intended software operation were not available. 

Software tools supporting the functionality of applications should also be validated. Specific validation is not required because validation is inferred by validating the correct operation of the application itself. Examples include operating systems (GAMP Category 1 Software) that should be validated as GAMP Category 1 software. 

The Validation Report authorizing use of the computer system should not be issued until all operation and maintenance requirements, including document management, calibration, maintenance, change control, security, etc., have been put in place. 

Computer systems employed should meet or exceed the validation requirements for the manual functions they replace. The new computer system must be at least as reliable as the computer system it replaces. Pharmaceutical and healthcare regulations do not mandate parallel operation of manual systems being replaced by compnterized systems. If a period of parallel operation has been decided npon, it shonld be mn with the pnrpose of demonstrating that the computerized system is better than the old manual system, and the manual system can be decommissioned. It is unacceptable, however, to rely on parallel operating as the sole basis of validation. The replacement system mnst be vahdated in its own right. 

---