The presentation details software validation approaches for the pharmaceutical industry, highlighting the importance of compliance with regulatory requirements, particularly with regard to computerized systems. It emphasizes the collaborative roles of users, developers, and management in ensuring proper validation processes, while also discussing risks associated with system failures and the need for thorough documentation. The FDA's guidance on validation and enforcement discretion for legacy systems is also reviewed, outlining key responsibilities and expectations throughout the system lifecycle.

1. This presentation is compiled by “ Drug Regulations” a
non profit organization which provides free online
resource to the Pharmaceutical Professional.
Visit http://www.drugregulations.org for latest
information from the world of Pharmaceuticals.
1/9/2014
1

2. This presentation is compiled from freely
available resources like the websites of FDA,
EMA, WHO.
 “Drug Regulations” is a non profit
organization which provides free online
resource to the Pharmaceutical Professional.
 Visit http://www.drugregulations.org for
latest information from the world of
Pharmaceuticals.

Drug Regulations : Online
Resource for Latest Information
1/9/2014
2

3. 
This presentation describes approaches for software validation used
to automate laboratory research procedures, consolidate data
collection
and
analysis
and/or
run
sophisticated
QC
or
manufacturing operations.

Several approaches to software validation exist and may be
appropriate for a specific project.

The scope of any validation effort depends upon a number of factors


Origin of the software (custom vs. off-the-shelf) and


Size and complexity of the software,
Whether the functions are critical or non-critical in nature.
By effectively planning the process, validation time and resources
can be reduced while meeting regulatory requirements.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
3

4. 
When equipment breaks, there are typically obvious and immediate
symptoms. Catastrophic results can often be avoided

Computer system defects can typically be very difficult to recognise
and severe problems may result without being detected until well
after the problem started

Drug companies, the airline industry, public utilities, nuclear power
plants and other industries where quality is critical have seen very
expensive consequences from improper computer system operation

Many of these consequences cost far more than the cost of
Computer Validation
Drug Regulations : Online Resource for Latest
Information
1/9/2014
4

5. 
Significant increase in the use of computer-
related systems in the Life Sciences industries.

These systems must satisfy cGMP requirements

Legitimate questions have been raised
concerning the scope and methods which should
be employed in validations.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
5

6. 
Responsibility of the end-user to assure that
systems
used
are
in
compliance
with
applicable regulations.

Many users rely too heavily upon vendorsupplied information and test data to support
their system validation.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
6

7. 
The extent of testing and the type of documentation
required to support validation is unclear

Difficult to delineate vendor and user responsibilities
when validating vendor-supplied systems.

Validation of computer-related systems is often
complex, and any number of alternate approaches
can be utilized.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
7

8. In general, a combination of hardware, software,
people, documents, inputs, processing, and outputs
working together
Inputs
Software
Hardware
Controlling System
Controlled process
outputs
Equipment
Operating Procedures &
Documentation
People and Training
Drug Regulations : Online Resource for Latest
Information

9. • MRP/ERP system?
• LIMS system?
• Laboratory Instruments (e.g. Chromatography)?
• Automated manufacturing or packaging equipment?
• IT systems, including those supporting network and
infrastructure?
• Spreadsheets or databases?
Drug Regulations : Online Resource for Latest
Information
1/9/2014
9

10. 
FDA approach is based on three main elements: (Guidance)
◦ Part 11 will be interpreted narrowly
◦ Fewer records subject to part 11
◦ For those records that remain subject to part 11, FDA intends to exercise
enforcement discretion with regard to part 11 requirements for
 Validation
 Audit trails
 Record retention
 Record copying

Systems that were operational before the effective date of part
11 (also known as legacy systems)
◦ FDA will enforce all predicate rule requirements, including predicate rule
record and recordkeeping requirements.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
10

11. 
FDA's exercise of enforcement discretion as
described in this guidance is limited to specified
part 11 requirements

FDA intends to enforce all other provisions of
part 11 including, but not limited to, certain
controls for closed systems in § 11.10.
◦ For example, FDA intends to enforce provisions related
to the following controls and requirements:
Drug Regulations : Online Resource for Latest
Information
1/9/2014
11

12. ◦ Limiting system access to authorized individuals
◦ Use of operational system checks
◦ Use of authority checks
◦ Use of device checks
◦ Determination that persons who develop, maintain,
or use electronic systems have the education,
training, and experience to perform their assigned
tasks
Drug Regulations : Online Resource for Latest
Information
1/9/2014
12

13. ◦ Appropriate controls over systems documentation
◦ Controls
for
open
systems
corresponding
to
controls for closed systems bulleted above (§
11.30)
◦ Requirements related to electronic signatures
 (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)
Drug Regulations : Online Resource for Latest
Information
1/9/2014
13

14. ◦ FDA intends to exercise enforcement discretion
regarding
specific
part
11
requirements
for
validation of computerized systems (§ 11.10(a) and
corresponding requirements in § 11.30).
Drug Regulations : Online Resource for Latest
Information
1/9/2014
14

15. ◦ Take into account the impact the systems have on
ability to meet predicate rule requirements.
◦ Consider the impact those systems might have on
the accuracy, reliability, integrity, availability, and
authenticity of required records and signatures.
◦ Even if there is no predicate rule requirement to
validate a system, in some instances it may still be
important to validate the system.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
15

16. ◦ Base validation approach on
 A justified and documented risk assessment
 A determination of the potential of the system to affect
product quality and safety, and record integrity.
◦ Validation would not be important for a word
processor used only to generate SOPs.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
16

17. 
Audit Trails
◦ Enforcement discretion related to computer-generated, timestamped audit trails (§ 11.10 (e), (k)(2) and any corresponding
requirement in §11.30).
◦ Also comply with all applicable predicate rule requirements
related to documentation
 Date (e.g., § 58.130(e))
 Time, or sequencing of events
 Requirements for ensuring that changes to records do not obscure
previous entries
Drug Regulations : Online Resource for Latest
Information
1/9/2014
17

18. 
Audit Trails
◦ Have them even if there are no predicate rule
requirements
 (for date, time, or sequence of events)
◦ Alternatively
have
other
physical,
logical,
or
procedural security measures in place.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
18

19. 
Audit Trails
◦ Base your decision on
 The need to comply with predicate rule requirements
 A justified and documented risk assessment
 A determination of the potential effect on product
quality and safety and record integrity
Drug Regulations : Online Resource for Latest
Information
1/9/2014
19

20. 
Audit Trails
◦ Apply appropriate controls based on such an
assessment.
◦ Audit trails appropriate when records are
 Created
 Modified
 Deleted
Drug Regulations : Online Resource for Latest
Information
1/9/2014
20

21. 
Legacy Systems
◦ FDA to exercise enforcement discretion for systems
that otherwise were operational prior to August 20,
1997
◦ FDA not to take enforcement action if all the
following criteria are met for a specific system:
Drug Regulations : Online Resource for Latest
Information
1/9/2014
21

22. 
Legacy Systems …..contd
◦ The system was operational before the effective date.
◦ The system met all applicable predicate rule requirements before
the effective date.
◦ The
system
currently
meets
all
applicable
predicate
rule
requirements.
◦ You have documented evidence and justification that the system is
fit for its intended use (including having an acceptable level of
record security and integrity, if applicable).
Drug Regulations : Online Resource for Latest
Information
1/9/2014
22

23. 
Applies to all forms of computerised systems used as part of a
GMP regulated activities.

A computerised system is a set of software and hardware
components which together fulfil certain functionalities.

The application should be validated;

IT infrastructure should be qualified.

Where a computerised system replaces a manual operation, there
should be no resultant decrease in product quality, process
control or quality assurance.

There should be no increase in the overall risk of the process.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
23

24. 
Validation
◦ Documentation and reports should
 Cover life cycle.
 Include change control
 Deviations during validation process
◦ Justify
standards,
protocols,
acceptance
criteria, procedures and records based on their risk
assessment.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
24

25. 
Validation
◦ List all relevant systems and their GMP functionality
◦ For critical systems prepare
 System description
 Physical and logical arrangements
 Data flows
 Interfaces with other systems or processes
 Hardware and software pre-requisites
 Security measures
Drug Regulations : Online Resource for Latest
Information
1/9/2014
25

26. 
Validation
◦ Prepare user requirements Specifications
 Describe the required functions
 Base it on documented risk assessment and GMP
impact
 Make it traceable throughout the life-cycle
Drug Regulations : Online Resource for Latest
Information
1/9/2014
26

27. 
Validation
◦ Ensure that the system has been
developed in
accordance with Q M S
◦ Assess the supplier appropriately
◦ Ensure formal assessment and reporting of quality
& performance measures of bespoke or customised
computerised systems for life cycle.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
27

28. 
Validation
◦ Demonstrate evidence of appropriate test methods
and test scenarios
 System (process) parameter limits
 Data limits
 Error handling
◦ Document adequacy of Automated testing tools and
test environments.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
28

29. 
Validation
◦ If data are transferred to another data format or
system, validation should include checks that data
are not altered in value and/or meaning during this
migration process.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
29

30. New Computer System
Existing Computer System
Def inesy stem
Function Structure
Def ine Sof tware
Def inesy stem
Function Structure
Design/Specif y
hardware
Qualif y Sy stem
Dev elop
Sof tware
I ns t all hardware
Rev iew operating
experience
Verif y Sof tware
Qualif y hardware
Test Indiv idual
Modules (Computer
Sy stem)
Data
Integrate
ComputerizedSy stem
Dataanaly sis
Test Integrated
modules
(Computerized
Sy stem)
Validation
Acceptance
Demonstratetotal
sy stem operation
(Computer-Related
Sy stem)
Ongoings y s t em ev aluat ion
Change
Conduct sy stem
testing (if needed)
F ileD oc um ent at ion
1/9/2014
30

31. 
Users play a key validation role in:
 Starting the process for new or existing systems
 Performing some major steps (e.g. Requirements)
 Writing and following operating procedure
 Maintaining the validated state while in use

Developers play a key role in many steps including:
 Design, coding, testing, changes, support

Support groups (IT, IR, SCS, Infrastructure):
 Maintain proper network environment
 Troubleshooting and maintenance
 Desktop and infrastructure control
Drug Regulations : Online Resource for Latest
Information
1/9/2014
31

32. 
QA and Validation
Author some major documents
Approve major documents that others write
Provide advice, training, auditing

Senior management for each group decides:
Which systems to buy or build
How much resource to make available
What risks are acceptable
Drug Regulations : Online Resource for Latest
Information
1/9/2014
32

33. Incorporate multi-functional participation

◦
Management Information Systems
◦
Developers
◦
Vendors
◦
Consultants
◦
Software QA
◦
Executive Management
Drug Regulations : Online Resource for Latest
Information
1/9/2014
33

34. Responsibilities

◦
Definition
◦
Planning
◦
Risk Assessment
◦
Evaluation of intended use
◦
Execution
◦
Documentation
◦
Review
◦
Approval
Drug Regulations : Online Resource for Latest
Information
1/9/2014
34

35. 
Have a combination of skill sets in the team

Include individuals who are experienced with
◦
Regulations
◦
Validation approaches
◦
Systems
◦
Processes
◦
Intended users
Drug Regulations : Online Resource for Latest
Information
1/9/2014
35

36. The level of documentation required depends on

◦
Complexity and intended use of the system;
◦
Origin of the software/system (vendor supplied or
developed internally).
◦
Examples
of
documentation
required
to
support
validation:
Drug Regulations : Online Resource for Latest
Information
1/9/2014
36

37. 
Validation SOPs and Policies

Project Management Plan

Validation Plan

Traceability Analysis

Risk (Hazard) Management

System Topology and

Specification and Documents
Plan

Computerized System Design
Installation Summaries
Configuration Management

Plan
Validation Protocols / Test
Case Procedures

Change Management Plan

IQ/OQ/PQ Reports

System Test Plans

Validation Reports

Computer-Related System
Requirements Specification
Drug Regulations : Online Resource for Latest
Information
1/9/2014
37

38. 1. PLAN
Validation Activities
4. DESIGN & REVIEW
5. CONSTRUCT & TEST
2. DEFINE
6. INTEGRATE/INSTALL
Requirements
7. QUALIFY
8. EVALUATE
3. SELECT
Computerized System
Vendors
Drug Regulations : Online Resource for Latest
Information

39. 
Write and approve validation policies

Write specific SOPs for validation of Computer Systems

Develop protocols

Review test data

Write summary reports to assure the validation objectives are met

Use validation Project Plan to

Identify the systems to be included

Procedures to be followed

Timeline for a specific validation project
Drug Regulations : Online Resource for Latest
Information
1/9/2014
39

40.  Project resources and budget requirements

Validation Project Plan for
 Single system,
 Combination of systems
 Entire facility.

Establish specific responsibilities

Establish expectations for each validation
activity
Drug Regulations : Online Resource for Latest
Information
1/9/2014
40

41.  Create a document of high level goals of validation
 Specify
“what”
at
a
high
level
should
be
accomplished by the CSV
 Review available documentation
 Conduct interviews with users
 Map existing processes
Drug Regulations : Online Resource for Latest
Information
1/9/2014
41

42.  Initial focus on
 Functionality
 Operational and performance parameters
 Overall objectives for the validation effort
 Specify the requirement in detail to support testing
that requirement and defining acceptance criteria.
 Trace back protocols to each requirement
 via a Traceability Matrix
Drug Regulations : Online Resource for Latest
Information
1/9/2014
42

43.  Requirements traceable to Functional Specifications
and testing
 Unambiguous, clear, concise
 Testable and measurable
 Typically written and approved by end-user
 Basis for system acceptance testing
 Should be approved before the design review
Drug Regulations : Online Resource for Latest
Information
1/9/2014
43

44.  The highest level design document responding
directly to the User Requirements Specification
 All system inputs, outputs, and interfaces
 All functions and performance requirements
 Error definition and handling
 Ranges, limits, defaults
 Safety considerations
Drug Regulations : Online Resource for Latest
Information
1/9/2014
44

45.  Internal development group or an outside company.
 Consider vendor‟s ability to provide a system which can
be validated
 Selection Criteria
 Technical competency
 Qualified to supply
 Support for the proposed system
 Knowledge of validation requirements
 Experience in providing systems for cGMP applications
Drug Regulations : Online Resource for Latest
Information
1/9/2014
45

46.  Type of software being evaluated
 Type hardware being evaluated
 For off-the-shelf software and standard hardware
 History of customer satisfaction is of importance
 For custom developed systems
 Vendor‟s Quality Assurance System
Drug Regulations : Online Resource for Latest
Information
1/9/2014
46

47. Primary Responsibility
for Specification
Primary Responsibility
for Testing
Testing of the URS
More User involvement for custom
systems, less for packaged
Supplier
Functional
Specification
Performance
Qualification
Testing of the
Functional Specification
Design
Specification
Testing of the
Operation
Qualification
Installation
Qualification
Design Specification
Build System
Design
Specification
Unit Testing
Requirement Specification
System Testing
Drug Regulations : Online Resource for Latest
Information
User
More Supplier involvement for custom
systems, less for packaged
User Requirements
Specification
User
Supplier

48.  Computerized System Design Specification
 Document or a collection of documents
 Describes clearly and completely
 How the computerized system will Operate
 Satisfy Computer-Related System Requirements
Specification
 Both normal and abnormal operating conditions
 Information about the interfaces between the
computerized system and its operating environment
Drug Regulations : Online Resource for Latest
Information
1/9/2014
48

49.  Applies to both the computer system and the controlled
function/process
 joint responsibility of the vendor and user.
 Interfaces between the computerized system and its
operating environment.
 The Design Specification can not be developed until
the vendors and the specific hardware and software
have been selected.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
49

50.  Defines how the system should meet the
requirements, including…
 Architecture AND interfaces
 All functions
 Data processing and integrity
 Security
 Backup, archive, and restoration
 disaster recovery
 Data definition
Drug Regulations : Online Resource for Latest
Information
1/9/2014
50

51.  Activity performed to verify that all deliverables
from Requirements and Design Phases are
produced and…
 are clear and concise
 are complete, current, and traceable
 electronic record and signatures addressed
 are testable
 show system fit for purpose
Drug Regulations : Online Resource for Latest
Information
1/9/2014
51

52.  Complete Design Review before starting
 Perform in accordance with written Programming
Standards
 Programming Standards should define appropriate
rules for writing source code (e.g. dead code,
structure, naming)
Drug Regulations : Online Resource for Latest
Information
1/9/2014
52

53.  The computerized system may be constructed by
developing custom software and hardware for the
application - or purchasing established products - or a
combination of both.
 From a validation perspective, custom developed
software and hardware require the greatest amount of
testing since they have never been proven effective.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
53

54.  Three categories of software can be defined:
 System software
 Configurable software
 Application specific software
Drug Regulations : Online Resource for Latest
Information
1/9/2014
54

55. GAMP Classification
No
GAMP 4
GAMP 5
1
Operating Systems
Infrastructure Software
2
Firmware
No longer used
3
Standard Software Packages
Non configured Products
4
Configurable Software
Packages
Configured Products
5
Custom (bespoke) Software
Custom Applications
Drug Regulations : Online Resource for Latest
Information
1/9/2014
55

56.  These categories are not intended to be rigid but
they allow distinctions to be made so that
validation approaches are appropriate.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
56

57.  Efficient Environment
 Defined processes
 Assigned responsibilities
 Planned audits
 Structured reviews
 Management controls
Drug Regulations : Online Resource for Latest
Information
1/9/2014
57

58.  Should be completed before formal testing
 Verify code complies with Programming Standards
 Check to ensure all pre-defined system
specifications are addressed
 Check for coding errors
Drug Regulations : Online Resource for Latest
Information
1/9/2014
58

59. „White Box‟ *
●
Unit Testing/Structural Testing
●
Low level
out
in
„Black Box‟ *
●
System & Acceptance testing
●
Functional Testing
●
Higher level
in
out
Manual Calculation
Drug Regulations : Online Resource for Latest
Information

60.  Define and justify the how the system will be
tested and how much
 Address how tests are traceable to specifications
 Testing approach should address
 Normal operation
 Entire design range, boundaries, stress
 Failure modes, including power failure
 Should be approved before testing starts
Drug Regulations : Online Resource for Latest
Information
1/9/2014
60

61.  Lists the test objective
 Traceable to specifications
 Lists test pre-requisites
 Reproducible test steps
 Clear acceptance criteria
Drug Regulations : Online Resource for Latest
Information
1/9/2014
61

62.  Record all raw data and derived results
 Ticks, „ok‟, „yes/no‟, „Pass/Fail‟ or similar are not valid
results
 Record a „Pass/Fail‟ conclusion of whether results met
acceptance criteria
 Signature and date of test performer
 Signature and date of test result approver
 References to incident log for failures
Drug Regulations : Online Resource for Latest
Information
1/9/2014
62

63.  Used to…
 Collate test result documentation
 Conclude each phase of testing
 Authorise subsequent testing phases
 Summarises the testing outcome, addresses test
failures
Drug Regulations : Online Resource for Latest
Information
1/9/2014
63

64.  Unit Testing
 Focuses verification effort on the smallest unit of software
design – the software component or module
 Integration Testing
 “If they all work individually, why do you doubt that they‟ll work
when we put them together?”
 The problem is “putting them together” – interfacing
 Data may be lost
 One module can have an inadvertent, adverse effect on
another; sub-function when combined
 Global data structure can present problems
Drug Regulations : Online Resource for Latest
Information
1/9/2014
64

65. 
Regression Testing
 Each time a new module is added as part of integration
testing, the software changes
 New data flow paths are established
 New I/O and control logic is invoked
 Regression testing is the re-execution of some subset of tests
that have already been conducted to ensure that changes have
not propagated unintended side effects
Drug Regulations : Online Resource for Latest
Information
1/9/2014
65

66. 
Smoke testing
 An integration testing
 Software components that have been translated into code are
integrated into a “build” – data files, libraries, reusable modules,
and engineered components that are required to implement one
or more product
 The intent of testing here is to uncover show stoppers – errors
that have the highest likelihood of throwing the software project
behind schedule
 The build is integrated with other builds and the entire product is
smoke tested daily
Drug Regulations : Online Resource for Latest
Information
1/9/2014
66

67. 
Unit Testing



An encapsulated class is the focus of unit testing
Operations within the class are, however, the smallest unit
Integration Testing

Thread based testing

Integrates a set of classes required to respond to one input or event for the
system

Used based testing

Begins the construction of the system by testing independent classes – use
very few if any server classes

Testing dependent classes – which use independent classes
Drug Regulations : Online Resource for Latest
Information
1/9/2014
67

68. 
Integration Testing
 Cluster Testing
 A cluster of collaborating classes (determined by
examining the CRC) to uncover errors in
collaboration
Drug Regulations : Online Resource for Latest
Information
1/9/2014
68

69.  Proper integration, installation and commissioning
of a computerized system is essential to the
successful qualification of the system.
 A packaged system may be integrated at the
vendors site
 More complex systems may be integrated at the
users site
Drug Regulations : Online Resource for Latest
Information
1/9/2014
69

70.  Data Load
 Operational and Support Plans (e.g.
SOP, training, service contracts, security, support
processes)
 Specify procedures employed in the Validation Plan.
 Specify responsibility for all tasks in the Validation Plan.
 Demonstrate proper installation of hardware & software
in Installation Qualification (IQ)
Drug Regulations : Online Resource for Latest
Information
1/9/2014
70

71.  Qualification is a procedure of testing and collecting data
to provide a high level of assurance that a computerized
system operates in accordance with the system
specification.
 Write & approve protocols in advance
 Protocols should specify the following
 Goals of testing
 Test methods
 Acceptance criteria
 Who is responsible for testing
Drug Regulations : Online Resource for Latest
Information
1/9/2014
71

72.  IQ (Installation Qualification) verifies that all aspects of
installing hardware and software meet specifications
and that user manuals, SOP‟s and backup procedures
are in place.
 OQ (Operational Qualification) verifies that the system
operates throughout its anticipated ranges according to
its specifications and identifies all important
parameters.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
72

73.  PQ (Performance Qualification) verifies that a
system performs its intended function in
accordance with its specifications.
 Testing is completed on the entire system while
operating in its normal environment.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
73

74.  In order to assure that the system remains in a validated state,
Performance Monitoring is required to continually test a system‟s
performance in executing defined processes:

Periodic calibration and maintenance

Continuous monitoring of critical parameters

Confirmation of security measures

Provisions for contingency planning, disaster recovery and personnel
training
 Change Control procedures must be established to keep a CRS in
a validated state during planned and unplanned changes.
Drug Regulations : Online Resource for Latest
Information
1/9/2014
74

75. Summary: Validation requirements for Software
Programme
overrides
Edits,
input
manipulation
Language
Name,
function
Software
identification
Fixed and
Variable
Set points
Input,
output
Drug Regulations : Online Resource for Latest
Information

76. Summary: Validation requirements for Software
Key aspects
Software
development
Software
security
Drug Regulations : Online Resource for Latest
Information

77. Summary: Validation requirements for Software
Function
Worst case
Documentation
Validation
Revalidation
Repeats
Drug Regulations : Online Resource for Latest
Information

78. 
This presentation was compiled from freely
available resources like the websites of FDA,
EMA, WHO.
 “Drug Regulations” is a non profit
organization which provides free online
resource to the Pharmaceutical Professional.
 Visit http://www.drugregulations.org for
latest information from the world of
Pharmaceuticals.
Drug Regulations : Online
Resource for Latest Information
1/9/2014
78