Computer System Validation - Waters Corporation

© 2016 Waters Corporation 1

Computer

System

Validation

What is it and

why is it needed? An Overview


• Regulatory background and history

• The elements of CSV

GAMP, PICS and CSV

• What can different partners do for you?

Selecting a Validation Partner

Minimizing Validation Costs




GAMP, PICS and CSV





Radiation therapy machine used in the late 1980s

Parts of the software were from an earlier model that had hardware interlocks for safety - Therac 25 did not have hardware interlocks

The hardware and software combination in the Therac 25 was never tested before it was installed at the hospital

6 recorded accidents

After this, software validation for medical devices was required

In the 1990s, regulators started to ask about CSV for pharma systems

– GAMP was born!

Therac 25 – the start of CSV


GAMP

GAMP 5

–GAMP is a set of guidelines

–It is written by volunteers

–It is NOT a regulation

–Practical and pragmatic

GAMP is referenced by:

–US FDA

–EMA

–PIC/S

Other approaches are acceptable


Regulations for Pharmaceuticals

If you manufacture:

– active pharmaceutical ingredients (APIs),

– finished pharmaceuticals,

– or provide research and clinical trial services to such manufacturers,

then there are regulations and guidelines which should be followed

These are referred to as Good Manufacturing Practices (GMP)

Some of these GMP regulations focus on the integrity of data used to make decisions about product quality and product release (data integrity, and critical data), especially when computerized systems are used to create and store that critical data (the data are then classified as electronic records).


Main Body PIC/S GMP Guide – Part I: Basic Requirements For Medicinal

Products

– Part II: Basic Requirements For Active Pharmaceutical Ingredients

GMP Annexes

– Annex 1 Manufacture of sterile medicinal products

– Annex 2 Manufacture of biological medicinal substances and products for human use

– Annex 3 Manufacture of radiopharmaceuticals

– Annex 4 Manufacture of veterinary medicinal products other than immunologicals

– Annex 5 Manufacture of immunological veterinary medical products

– Annex 6 Manufacture of medicinal gases

– Annex 7 Manufacture of herbal medicinal products

– Annex 8 Sampling of starting and packaging materials

GMP Annexes (continued) – Annex 9 Manufacture of liquids, creams and

ointments

– Annex 10 Manufacture of pressurised metered dose aerosol preparations for inhalation

– Annex 11 Computerised systems

– Annex 12 Use of ionising radiation in the manufacture of medicinal products

– Annex 13 Manufacture of investigational medicinal products

– Annex 14 Manufacture of medicinal products derived from human blood or plasma

– Annex 15 Qualification and validation

– Annex 16 Qualified person and batch release

– Annex 17 Parametric release

– Annex 18 GMP Guide for active pharmaceutical ingredients

– Annex 19 Reference and retention samples

– Annex 20 Quality risk management

PIC/S GMP Guide PE 009-12 (October 2015)


Focus on Asia Pacific

APAC country or Region

GMP Regulation PIC/S Member

Population

ASEAN Countries

Earlier version PIC/S (PE 009-9)

Some 625 million

Japan Equivalent JGMP; PIC/S as official ‘guidance’

Yes 127 million

Republic of Korea

Equivalent KGMP

Yes 50 million

Australia Earlier version PIC/S (PE 009-8)

Yes 23 million

Republic of China (Taiwan)

Earlier version PIC/S (PE 009-10)

Yes 23 million

Hong Kong PIC/S PE 009-11 from October 2015

Yes 7.2 million

New Zealand

Ealier version PIC/S (PE 009-8)

Yes 4.5 million

People’s Republic of China

China GMP No 1.35 billion

Indian sub-continent

Separate country GMPs

No 1.7 billion

PIC/S member

Follow PIC/S GMP

Non Member


Compliance

Compliance is meeting the applicable regulations for the target

market

– For a pharmaceutical company selling within ASEAN

o PIC/S GMP covers all GMP requirements for manufacturing,

processing, distributing API and finished goods

o PIC/S Annex 11 covers computerized systems

• Any combination of hardware and software which fulfils a

functionality

• Requires security controls, procedures, training and validation

• “The application should be validated”

– There are also regulations for food, chemicals, pesticides etc.

o Generally all regulations are focussed on:

• The system is fit for intended use

• Being able to trust the data (data integrity)


Paper vs. Electronic Data

“the printed chromatograms used in drug manufacturing and testing do not satisfy the predicate rule requirements in 21 CFR Part 211. The electronic record must be maintained and readily available for review by, for example, QC/QA personnel or the FDA investigator”


Paper vs. Electronic Data

Even where paper records may still be acceptable:

– There is no audit trail for the inspector to review with paper records

– The inspector has no way to know if this is ALL of the data

All test results


Data Integrity

Regulatory agencies want:

– To see all of the data and metadata (electronically)

– Data recorded at the time it happened, by the person that did it

– Full history about everything that happened to the sample and its

data (audit trail, method versions)

– To be able to recreate the final result from the raw data

– Records to be available for the full retention period

– Only validated computerized systems to be used

This includes all of your mistakes!!


Compliant System

Release Testing

Qualification Validation

Compliant System

All three elements are required to achieve a

compliant Computerized System


Qualification vs. Validation

“Validation Cake” IQ/OQ qualification are just two

ingredients in the Validation Cake


Application Qualification vs. Validation

SOPs

Validation Plans/ Reports

Risk-based testing

Specifications/ RTM

IOQ

Product

Qualification: The product is installed and operating correctly to vendor specification at that point in time

Computerized Systems Validation (CSV): The product will meet its intended use throughout its operational life Ongoing compliance!


Computerized System Validation Life Cycle – V model

Computerized System Validation (CSV): achieving and maintaining compliance with applicable GxP regulations and fitness for intended use by:

• the adoption of principles, approaches, and life cycle activities within the framework of validation plans and reports

• the application of appropriate operational controls throughout the life of the system


Compliance for System Components

S T A N D A R D O P E R A T I N G P R O C E E D U R E S


Spanish Agency of Medicines Inspection January 2016, Spain

…use in quality control of non-qualified chromatographic

equipment, with operating faults, and with an unvalidated

computerized management system. As a result, the integrity,

reliability, up-to-dateness, originality and authenticity of the data

that are obtained cannot be guaranteed.

Consequences:

suspension of the manufacturing and quality control of medicinal products

activities

withdrawal from the market of all batches of all medicinal products that have been

manufactured by this pharmaceutical company during 2014, 2015 and 2016

to prohibit to place on the market any batch manufactured by the pharmaceutical

company

to stop supply to customers of medicinal products

Report ID INS16-001c




GAMP, PICS and CSV





If the system was a car…


Specification: Vendor vs. URS

USER REQUIREMENT SPECIFICATION

Engine Diesel

Seats 7

Transmission Auto; 4 WD

Load Space Camping / Fishing

Suspension Comfortable

Vendor’s Specification (page 1 of 20)


Making the Car “Fit for Use”

Car Computerized System

Diesel (fuel) IQ/OQ Qualifications

Oil, Coolant, Tyre pressure Validation Documents

Driving Licence Trained Users

Insurance, Registration SOPs

Annual Service Periodic Review


Life Cycle in Detail

Functions identified as high risk priority are given focus in the

Test Plan

Detailed Test Plan

Design & Configuration Specification

Controls to reduce risk are included in the SDS, and pass into the System

Configuration

Risk Assessment

Functions from the URS are assessed in the Risk

Assessment

Configuration

Project Planning Initial Definition

User Requirements Specification

Definition is expanded to capture

requirements

Validation Plan

Verification Activities

Verification activities challenge the risk-reduction

controls

Validation Summary Report

Summary report details any

deviations and residual

risks


Responsibilities

FDA CPG Sec. 425.200 Computerized Drug Processing;

Vendor Responsibility

– The end user is responsible for the suitability of computer systems

(hardware and software) used in manufacture, processing or holding of

a drug product.

GAMP 5, Main body §6

– Responsibility for the compliance of computerized systems lies with the

regulated company.

PIC/S document PE-011-3, §4.4

– The co-operation of the supplier is essential and it is important for

suppliers to anticipate the needs of regulated users for relevant product

development life cycle quality and validation information. Such an

approach also provides added value for the automated products.



S T A N D A R D O P E R A T I N G P R O C E E D U R E S



S T A N D A R D O P E R A T I N G P R O C E E D U R E S V E N D O R A S S E S S M E N T


Vendor X

– IQ/OQ protocol execution

– Validation ‘certificate’

Waters

– Validation Plan

– User Requirement Specification

– Risk Assessment

– Design & Configuration Specification

– IQ/OQ protocol execution

– Extended / customised OQ/PQ

– Traceability Matrix

– Validation Summary Report

– Training

– SOP generation

Range of Vendor Offerings


Vendor X

Customer Validation Load

Vendor Assistance

Final Responsibility for Compliance Time

CSV effort required


Waters

Customer Validation Load

Vendor Assistance

Final Responsibility for Compliance Time

CSV effort required


Leveraging Your Vendor


Regulated Manufacturer

• Has final responsibility for

compliance (under law)

• Has to defend the risk assessment

and validation approach during an

inspection

• Is liable for any penalties for non-

compliance

• May have limited in-house resource

available to conduct validation

Waters

• Has products based on an

accredited quality management

system

• Is able to support effective

customer validation

• Can offer onsite and remote

assistance with validation activities

• Has recognised expertise in CSV

• Is working to internationally

accepted guidelines (e.g. GAMP,

PIC/S) and applicable regulations

Responsibilities

An ideal software vendor like Waters can significantly reduce

the cost and time for the customer to complete validation




GAMP, PICS and CSV





Using Infrastructure to Minimise the Time and Cost of Compliance

Imagine you have a lab with…

– Multiple vendors…Waters, Vendor A, Vendor B, Vendor C

– All workstations

– Let’s take the case where you have 3 of each vendors

workstation….what is the impact of this on the time and cost to

validate?

– For each, unique data system, it will take roughly the same effort

and cost for each system.

o For the sake of discussion lets use…

= 3 Months = $100K USD


Scenario 1: Change Nothing

Waters

Vendor A

Vendor B

Vendor C

D

D

D

D

D

D

D

D

D

D

D

D

$ 800K USD 24 Months


Scenario 2: Centralise Data

Waters

Vendor A

Vendor B

Vendor C

D

D

D

D

$ 400K USD 12 Months

D

D

D

D

D

D

D

D


Scenario 3: Minimise Vendors

Waters

Vendor A

Vendor B

Vendor C

D

D

D

D

$ 100K USD 3 Months


Questions/Discussion