Validation Strategies for Equipment from Multiple Vendors World... · Validation Strategies for Equipment from Multiple Vendors. ... Password Policies OS Authentication. ... • Easy

Slide 1Chairperson: Rita Willis

Welcome to our E-Seminar:

Validation Strategies for Equipment from Multiple Vendors


Agenda for Today’s Session

1. Update on Part 11 scope according to the FDA guidance released in August 2003 and recent FDA warning letters.

2. Overview and discussion of technical controls mandated by 21 CFR Part 11, using examples from a real world system (Cerity for Pharmaceutical QA/QC).


New Part 11 Approach

1

Assess Risk - Evaluate Level of Controls Appropriate to Risk

Narrow Scope - Identify Electronic Records that Require Part 11 Compliance

Determine Predicate Rule Requirements

Implement Appropriate Part 11 Controls

Part 11 Records Not Part 11 Records

2

3

4

5

Ref: Famulare - Murray - McIntire


“Enforcement Discretion”!?

“While the re-examination of Part 11 is under way, we intend to exercise enforcement discretion with respect to certain Part 11 requirements. That is, we do not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of Part 11 as explained in this guidance. However, records must still be maintained or submitted in accordance with the underlying predicate rules, and the Agency can take regulatory action for noncompliance with such predicate rules. ”


Overview: Part 11 Technical ControlsSection Requirement Responsibility*

§11.10a Systems must be validated Proc.

§11.10b Accurate and complete copies Tech.

§11.10c Protection of records Proc., Tech.

§11.10d Access limited to authorized individuals

Proc., Tech.

§11.10e Secure, computer-generated, time-stamped audit trail

Tech.

§11.10f/g/h Checks (device, authority, system checks)

Tech.

§11.50 Signature Manifestations Tech.

§11.70 Signature/Record Linking Tech.

§11.100 Uniqueness of e-sig to the individual

Proc., Tech.

§11.200 E-Sig Components and Controls Proc., Tech.

§11.300 Controls for identification codes and passwords

Proc., Tech.

* Proc. = Pharmaceutical company is usually responsible to develop procedural controls Tech. = Supplier is usually responsible to implement technical controls

= Enforcement discretion (Part11 Guidance Aug.03)


Mandatory Technical Controls

• Limited System Access• Operational Systems Checks• Authority Checks, Device Checks• Training• Policies (e.g. E-signature accountability)• System Documentation


Warning Letters Speak Louder than Ever

• "Warning letters will speak louder than ever now because when industry receives a warning letter they will know that it is not just the view of a particular investigator of a particular district or even of a particular region. It means that the center has determined that these are significant enough violations that, if they are not corrected, an enforcement action will follow and that means the chief council has been involved and also agrees with that“. (Horowitz, May 2003)


Recent FDA 483 cGMP Warning Letter (1)

• “… Laboratory records do not include complete data derived from all tests including a record of all calculations performed in connection with the test [21 CFR 211.194(a)(5)]. For example, in process tablet weights and calculations generated during friability testing are recorded on scrap paper and transferred to the batch record. The original raw data is then discarded and could not be verified.”

Source: File No.: 04-NWJ-02, www.fda.gov

http://www.fda.gov/



• …”Out-of-specification (OOS) results were invalidated, without a thorough investigation, supporting data, documentation, or justification. For example: Confirmed OOS results, …, were invalidated by Quality Assurance, that concluded that the chromatographs were incorrectly integrated. The Chromatographs were reprocessed with adjusted baseline parameters, yielding acceptable results, and the lots were released for distribution. However, the laboratory investigation concluded that the results could not beinvalidated and that no problems were observed during the chromatographic run.”

Source: Warning Letter No. 2004-NOL-03, www.fda.gov



• “Failure to maintain records of the inspections of automatic, mechanical or electronic equipment, including computers or related systems. [211.68(a)].

For example, the firm failed to maintain any background data to verify that testing of laboratory HPLC’s (…) had been performed or produced acceptable results. Also, written and approved protocols for testing of these HPLC's were not maintained.”

Source: File No. 04-NWJ-01, www.fda.gov

http://www.fda.gov/


Break Number 1

For questions, at break please dial 1 on your phone, or type onto the chat screen at any time during the presentation.


Agilent Cerity for Pharmaceutical QA/QC

• Models the way analysts work in pharmaceutical QA/QC

• Implements 21 CFR Part 11 technical controls (e-records and e-signatures)

• Fully scaleable, failure resilient client/server system

• Eliminates external calculations

• “Level 4”-instrument control for Agilent 6890/6850, 1100 (3D), 35900E

• Full instrument control for Waters Alliance

• Suite of computer-based compliance protocols and services, including network qualification

The failure resilient networked data system that fully supports the everyday tasks of pharmaceutical QA/QC laboratories.


Cerity Client/Server System

• Networked chromatography instruments (GC, LC2D and LC3D)

• Fully scaleable from one to hundreds of users and instruments

• Central data repository (Oracle 9i RDBMS)

• Networked client PCs (access to any instruments from anywhere)


Protection of Records

11.10 (c): “Procedures and controls shall include: Records must be protected to enable accurate and ready retrieval throughout the record retention period”

Implementation Examples from Agilent Cerity:• Strict revision control of records in the database • Ensure record uniqueness (globally unique identifiers, GUIDs)• Security services protect against intentional/accidental modification• Migration from legacy systems (instruments and data)

Sign Keep Secure Maintain Integrity Retrieve Safely


Protection of Records/Version Control (§11.10c)

Calibration TableRevision

Sample Result Revisions quantified

with thisrevision of the

Calibration Table

Previous results shall not be overwritten


Limited System Access (§11.10d)

11.10 (d): “Procedures and controls shall include: Limiting system access to authorized individuals.”

Implementation Examples from Agilent Cerity: All Cerity utilities require mandatory loginAuthentication leverages operating system authenticationNo duplicate user account system needs to be maintained for Cerity


Leveraging Operating System Security

IT Policies

IT implements

User Accounts

Operating System (OS)

Security, Password Policies

OS Authentication


Leveraging Operating System Security

User Accounts

Security, Password Policies

OS Authentication

Check User’s Capabilities in Cerity

IT PoliciesCerity Login

IT implements Authenticate User

Cerity DB

Operating System (OS) Application (leveraging OS)


Notification of Unauthorized Access (§11.10d)

•Win2k Audit Policy and resulting audit trail


Controls for Identification Codes and Passwords (§11.300)

Cerity reuses operating system (OS) security system

Cerity reuses password policies (security policies) defined for the operating system


Leverage from Operating System (OS) Security

Manage users in system administration console using a standard IT tool (“MMC”)

Authenticated OS users are granted access rights to the Cerity applications

Directly reuse password and security policies defined by IT group


Computer-Generated Audit Trail (§11.10e)

• Part 11: “(…) Computer generated, time-stamped, audit trails to independently record the date and time of of operator entries and actions (…)”

• New Guidance: “We recommend that you base your decision on whether to apply audit trails, or other appropriate measures, on the need to comply with predicate rule requirements, a justified and documented risk assessment (…).”

Example Screen: Logbook fields available in the report layout editor.


Device Check (§11.10h): Early Maintenance Feedback “EMF”

LEVEL 4 Instrument Control

• Tracks critical wear&tear parameters of the instrument

• Software documents EMF alerts in the instrument Logbook before something breaks


System Check (§11.10g) Example: Formal Results Review/Approval

11.10 (g): “Operational system checks to enforce permitted sequencing of steps and events as appropriate .”


Automated System Checks: Limit Checking

Automated result evaluation against user-defined limits

Limits per compound

Automated notification of limit check result

User defined limit check action

Limits per sample group


Automated System Checks:Spectral Compound Confirmation

• Easy graphical representation of the results

• Color coding allows for quick visual result inspection

• Spectra results review of overlaid and residual spectra

• Parameter change requires reprocessing – no interactive modification


Automated System Checks:Spectral Compound Purity NEW

spectral compound

purity analyses using

DAD and FLD data

• Residual window

replaces similarity curve

• New warning level

• New setting of noise

threshold and minimum

response range

simplifies result

interpretation

• Interactive mode

• Automated modePurity result displayin the spectra window

New: Spectra residuals window shows the spectra difference

Automatic audit trail of all purity modifications in table and audit-trail


Summary Part 11 Controls – Real World Examples

Required Technical Control Examples for Resulting User Requirements • Limiting system access to authorized

individuals • Mandatory login screens • Security policies • Password policies (password strength, password

aging, account lockout etc.) • Inactivity timeout

• Use of authority checks to verify authorization of the user to perform a certain function

• Configurable user access rights based on training and job responsibility

• Use of device checks to check the validity the source of input

• Syntax and value checks for entry dialogs • Bi-directional instrument communication and control

(“Level 4 control”) • Instrument logbooks • Network monitoring • Early Maintenance Feedback (EMF)

• Use of operational system checks that enforce the sequence of permitted steps

• Automated custom calculations, spectra compound confirmation, spectra peak purity and limit checking

• Enforce result review process (analyst review, peer review, QA approval)

• Requirements related to electronic signatures

• Electronic sign-off for critical system tasks • Electronic review/rejection/approval of results


Summary

• Implementation of the technical controls for 21 Part 11 has manyaspects (technical, procedural, educational)

• New Guidance is more diligent regarding some Part 11 requirements such as audit trails and remediation of legacy systems

• Provisions for access security, record integrity, device and system checks continue to be strong Part 11 requirements

• Your implementation decisions must be based on predicate rule requirements and documented risk assessment

• This presentation discussed how appropriate technical controls can be implemented using existing technology


References and Recommended Reading

• L. Huber: Risk Management Plan, Labcompliance Best Practices Series, www.labcompliance.com/books/risk, 2003

• L. Huber: Standard Operating Procedure Risk Assessment for 21 CFR Part 11, Labcompliance Best Practices Series, www.labcompliance.com/books/risk, 2003

• W. Winter: 21 CFR 11 revisited: Risk-based approach for networked system compliance and the role of network qualification, Bioprocess International 1 (7) July 2003

• W. Winter, L. Huber: Instrument Control in Pharmaceutical Laboratories— Compliance with 21 CFR Part 11 and the New Draft Guidance, Pharmaceutical Technology Europe, Special Issue “21 CFR PART 11: COMPLIANCE AND BEYOND” MARCH 2003`,

http://www.labcompliance.com/books/risk





References and Recommended Reading (2)

• ISPE GAMP Forum, Risk Assessment for Use of Automated Systems Supporting Manufacturing Processes Part 1 – Functional Risk (Pharmaceutical Engineering, May/June 2003, Volume 23 (3), page 16-26

• www.ispe.org and www.pda.org: Good Practice and Compliance for Electronic Records and Signatures:

• Part 1: Good Electronic Records Management (GERM),July 2002

• Part 2: Complying with 21 CFR Part 11, Electronic Records and Signatures September 2001.

• GAMP 4 Guide for Validation of Automated Systems, December 2001 www.ispe.org

http://www.ispe.org/



http://www.pda.org/

http://www.pda.org/






• Wolfgang Winter, Electronic records are here to stay, Biopharm Europe, Special Issue September 2002, 29-31

• L. Huber, Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories Part 1, - Overview and Requirements, Biopharm 12 (11), 28-34, 1999

• W. Winter, L. Huber, Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 2 –Security Aspects for Systems and Applications, BioPharm 13 (1), 44-50, 2000; reprinted in Pharmaceutical Technology 24 (6), 74-87, June 2000

• W. Winter and L Huber: Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 3 –Data Security and Data Integrity BioPharm 13 (3), 2000, pages 45-49



• L. Huber and W. Winter: Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 5 –The Importance of Instrument Control and Data Acquisition BioPharm 13 (9), 2000, Agilent publication number 5988-0946EN

• W. Winter and L. Huber: Implementing 21CFR Part 11 - Electronic Signatures and Records in Analytical Laboratories, Part 6, Biopharm and LCGC North America November 2000 Supplement

Documents

Validation Strategies for Equipment from Multiple Vendors World... · Validation Strategies for Equipment from Multiple Vendors. ... Password Policies OS Authentication. ... • Easy