Know the Global Regulations for Change Control


Published on

1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Know the Global Regulations for Change Control

  1. 1. IVT s 11th Annual Conference onIVT’sChange Control Know the Global Regulations for Change Control Ch C t l Joseph Zec Sr. Manager & Corporate Software Steward Corporate Software Quality Assurance Boston Scientific Corp January 28, 2013 1
  2. 2. Agenda10% of what we do is invent things. Theother 90% is spent changing them. p g g Why regulate change control? The regulator s view regulator’s Warning Letter survey Factors to consider in developing a change control process 2
  3. 3. Why regulate change y egu ate c a gecontrol?“The FDA’s analysis of 3140 medical devicerecalls conducted between 1992 and 1998reveals that 242 of them are attributable tosoftware failures. Of those software relatedrecalls,recalls 192 (or 79%) were caused by softwaredefects that were introduced when changeswere made to the software after its initialproduction and distribution.” – General Principles of Software Validation 3
  4. 4. The Regulator’s Perspective“Appropriate controls shall be exercisedover computer or related systems to p yassure that changes in master productionand control records or other records areinstituted only by authorized personnel.” – 21 CFR Part 211 68(b) 211.68(b) 4
  5. 5. The Regulator’s Perspective“When computers or automated datapprocessing systems are used as part of g y pproduction or the quality system, themanufacturer shall validate computer psoftware for its intended use according toan established protocol. All software pchanges shall be validated before approvaland issuance.” – 21 CFR Part 820.70(i) 820.70(i 5
  6. 6. The Regulator’s Perspective“Each manufacturer shall establish andmaintain procedures for the identification, p ,documentation, validation or whereappropriate verification, review, and pp p , ,approval of design changes before theirimplementation.” p – 21 CFR Part 820.30(i) 820.30(i 6
  7. 7. The Regulator’s Perspective“Unlike hardware, software is not a physicalentity and does not wear out. In fact, softwaremay improve with age, as latent defects arediscovered and removed. However, as softwareis constantly updated and changed, such changedimprovements are sometimes countered by newdefects introduced into the software during thechange.” – General Principles of Software Validation 7
  8. 8. The Regulator’s Perspective“Seemingly insignificant changes in softwarecode can create unexpected and very significantproblems elsewhere in the software program.The software development process should besufficiently well planned, controlled, and planned controlleddocumented to detect and correct unexpectedresults from software changes.” changes. – General Principles of Software Validation 8
  9. 9. The Regulator’s Perspective“When any change (even a small change) ismade to the software, the validation status ofthe software needs to be re-established. re-Whenever software is changed, a validationanalysis should be conducted not just forvalidation of the individual change, but also todetermine the extent and impact of that changeon the entire software system.” – General Principles of Software Validation 9
  10. 10. The Regulator’s Perspective“Any changes to a computerised systemincluding system configurations should only bemade in a controlled manner in accordance witha defined procedure.” – European Commission GMP Annex 11 10
  11. 11. The Regulator’s Perspective“Data gathered during [Stage 3] might suggest ways toimprove and/or optimize the process by altering someaspect of the process or product such as the operating product,conditions (ranges and set-points), process controls, set-component, or in-process material characteristics. A in-description of the planned change, a well-justified well-rationale for the change, an implementation plan, andqquality unit approval before implementation must be y pp pdocumented (§ 211.100). Depending on how the (§proposed change might affect product quality, additionalprocess design and process qualification activities couldbe warranted.” – General Principles of Process Validation 11
  12. 12. Warning Letter SurveyYour firm has not established appropriatecontrols over computer or related systems toassure that changes in master production andcontrol records or other records are institutedonly by authorized personnel. Your firm also personnelfails to maintain a backup file of data enteredinto the computer or related system [21 CFR §211.68(b)].– cGMP; Automatic, mechanical, and electronic equipment– 23 Feb 2012 UAE pharmaceutical company 12
  13. 13. Warning Letter SurveyChanges to a product, production process,quality controls, equipment or facilities were notreported to FDA through a supplement, CBE-30report to FDA or an annual report [21 C.F.R. §601.12].601 12]– Biologics Licensing; Changes to an approved application– 15 Dec 2011 German pharmaceutical company 13
  14. 14. Warning Letter SurveyFailure to establish and maintain adequate procedures for validatingdevice design as required in 21 CFR 820.30(g). For example, therewere four revisions of the [redacted] shelf life environmental design [ ] gverification protocol. The first revision was never used, the secondrevision was used at the start of the validation and the third revisionwas used at the completion of the real time aging of the units andthe verification/validation of the tests. The final revision requires h f / ld f h h f lthat the real life units be tested at x and y months. The testing thatwas done was done at v and w months, instead of x and ymonths.months The testing report was reviewed and accepted by a designcross functional group which included the project manager,regulatory affairs, quality assurance and research and development.– QSR; Design Controls; Design Validation– 2 Jul 2010 US medical device company 14
  15. 15. Warning Letter SurveyFailure to establish and follow procedures for theidentification, documentation, and validation orverification of design changes prior to theimplementation of the changes as required by 21CFR § 820 30(i) 820.30(i).– QSR; Design Controls; Design Changes– 12 Aug 2009 US medical device company g p y 15
  16. 16. Warning Letter SurveyFailure to perform design control activities andestablish Design History Files for the reusablesharps containers, as required by 21 CFR820.30(a) through (j). Specifically, your firm hasmade several changes to the design of thereusable sharps containers and these changeshave not been documented, and verificationand/or validation of these changes have notbeen performed.– QSR; Design Controls 16– 30 Jan 2008 US medical device company
  17. 17. Warning Letter Survey“You should have conducted a riskanalysis when you significantlychanged the design of the device andadded new indications for use use” “Device Malfunctions Lead to Surgery, Warning Letter” The GMP Letter Dec 2008 Letter, 17
  18. 18. Warning Letter Survey“Failure to establish and maintain writtenprocedures for changes to a specification,method, process, or procedure…” procedure…”(warning letter dated Feb 21, 2003) FDA Denver District Office 18
  19. 19. Warning Letter Survey“Failure to assure that specification changes shallbe subject to controls as stringent as thoseapplied to the original device…” device…”(warning letter dated Apr 7, 1995) Journal of Validation Technology 19
  20. 20. Developing a C a ge Co t o e e op g Change ControlProcessTypical Change Control process: Change Initiation Proposal Review Change Planning & Assessment Change Development Change g Verification Change Release 20
  21. 21. Factors to Consider Remember the “Control” in Change Control Analysis Review and Approvals Documentation produced by the process Process should recognize that some changes are riskier than others Consider process training requirements 21
  22. 22. Questions ? Thank Th k you! ! 22