A CASE STUDY: The modification of a legacy process control system

1. A CASE STUDY: The modification of a legacy process control system [The case for data integrity without “Part 11" compliance] Presented by John T. English Validation & Regulatory Compliance

2. A Case Study: Legacy and Data Integrity Preliminary Observations • Part 11 compliance has meta-expectations • Not every system is a mainframe or networked • Criticality is in the eye of the beholder! • Not all data is created equally.

3. A Case Study: Legacy and Data Integrity Response to a production need • Adapt an existing custom application platform • Use ‘proven’ technologies to avoid delay • Have all calculations and record-keeping be as automated and paperless as possible • Let the operators do their jobs and ‘just walk away’

4. A Case Study: Legacy and Data Integrity • What were the results?

5. A Case Study: Legacy and Data Integrity SYSTEM DESIGN • INFRASTRUCTURE: Intel Processor/ Windows 9X PLC • APPLICATION ENVIRONMENT: Custom/bespoke applications Higher level language program for instructions Graphic tool for HMI Standard tool for Ladder Logic • ORGANIZATIONAL Procedures Documentation Training

6. A Case Study: Legacy and Data Integrity ISSUES: 1. SDLC Informal Methodology, not an elaborate Model. 2. SECURITY The ‘ ON/OFF’ switch security approach Locked doors do not = locked system 3. PROCEDURES Covered system operation NOT system data 4. DATA ARCHIVING See Number 3 – ‘NOT’ 5. AUDIT TRAILS None apparent.

7. A Case Study: Legacy and Data Integrity Response: Lack of Data Integrity Solution: A. Write the SOP to document the existing data backup “practice” ‘Take credit for …’ copying file, maintaining drive, storing transmittal media and archive of date to network directory under security B. Overcome Objections: It’s not fully compliant The FDA won’t like it They only want to see optical media

8. A Case Study: Legacy and Data Integrity Response: Lack of Data Integrity Solution: C. Demonstrate the ability to retrieve data All files were available Rapid retrieval IT security combined with departmental procedures Time and date stamping

9. A Case Study: Legacy and Data Integrity Source for the following :US FDA Office of Regulatory Affairs Investigation Operations Manual (2003)Chapter 5 Establishment Inspection • Subchapter 520 - Evidence Development Sections 527-529

10. A Case Study: Legacy and Data Integrity

11. A Case Study: Legacy and Data Integrity 527.44 Data Integrity of Records Provided by Firm • Many manufacturers are using computers to store records concerning complaints, failure data, returned goods, servicing, testing results and others. Record traceability and data integrity are always concerns when you copy or use computerized data. • It is difficult to determine what records are to be designated as originals or copies of original records. It is important, when obtaining hardcopy or copy of computerized data, for you to capture some method of dating. The date of an electronic file can be captured by recording the date and time from a file listing in DOS or with File Manager in Windows. This may not always be possible, but some attempt should be made to date and time stamp electronic data.

12. A Case Study: Legacy and Data Integrity FINAL NOTES • Compliance is not supposed to an unattainable goal • Errors are expected – and expected to be controlled • ‘A good procedure today is better than a plan to make a perfect system some time in the future.’ • In a perfect world, data integrity will NOT be an issue. For the rest of us, there is still the FDA.

13. A Case Study: Legacy and Data Integrity A Reflection: “Machines are built by menand will always be at risk of failing. All we can do is make themas safe as possible and ensure that those who operate the machines act responsibly."