Validation of Computer Systems & Software – A Practical Approach

1. Seminar on Validation Requirements for Regulatory ComplianceIndian Pharmaceutical Association Date : 8th October,2011 Venue : Sci Tech Centre, Jogeshwari (W) - Mumbai Validation of Computer Systems & Software – A Practical Approach Presented By Mr. Vasishtha Mehta Director Epitome Technologies Private Limited

2. Topics Covered • Applicability of Computer System Validation • GAMP Guide Lines & Good Practices Models • GAMP V Model & Validation Project • Practical Requirements

3. Applicability of Computer System Validation

4. Use of Automated Systems Quality Systems (Annual Product Review,Customer Complaints, Training Records, CAPA, SOP Administration, Adverse Event Reporting) Facilities & Equipment Systems Packaging & Labeling Systems Materials Systems Production Systems Laboratory Systems HVAC Autoclaves Calib & Maint WFI Inv Mgmt Dispensary Dist Systems WH Mgmt Process Inst Control Sys EBR ERP Label Gen OCR Sys Fill Check Artwork Lab Inst LIMS C of A E-Notebooks

5. Automating GMP Areas Equipment Cleaning and Use (211.182) Component, Container, Closure and Labeling Records (211.184) Master Production Records (211.186) Batch Production Records (211.188) Production Record Review (211.192) Laboratory Records (211.194) Distribution Records (211.196) Complaint Files (211.198) Returned Drug Products (211.204) Drug Product Salvaging (211.208) Personnel Qualifications (211.25) Consultants (211.34) Equipment Cleaning and Maint. (211.67) Automated Equipment (211.68)* Written Procedures (211.100) Materials Examination and Usage (211.122) Packaging and Labeling Oper. (211.130) Drug Product Inspection (211.134) Distribution Procedures (211.150) Reserve Samples (211.170) Records and Reports (211.180)

6. System Validation - Objectives Extensive Use of Software in GxP Environment calls for Automated Systems’ Validation to ensure • System Functioning vis-à-vis its intended use • Insurance against Data Manipulation • Data Integrity on Networks • System Performance in Validated State

7. GAMP Guidelines & Good Practices Models

8. Guidelines - GAMP • Good Automated Manufacturing Practices (GAMP) provides the Framework for Automated System Validation • Current version GAMP 5 emphasizes Risk Based Approach to Software Validation with Life Cycle Model

9. GAMP Categories

10. Current Good Practices Models • Process Control Systems • PLC / DCS / SCADA / BMS • Laboratory Computerized Systems • Application Software Like HPLC /GC /FTIR etc • Global Information Systems • ERP Systems Like SAP / BaaN • Document Management Systems

11. GAMP V Model & Validation Project

12. System Usage SOP’s System Maintenance Custom Monitoring Program Corrective / Preventative Action PQ Test Report Updated Risk Management Plan PQ Protocols User Acceptance Criteria System Usage SOP’s Validation Planning Checklist Risk Management Plan Supplier Audit OQ Protocols IQ / OQ Test Report Updated Risk Management Plan User Requirement Specification Functional Requirement Specification Design Requirement Specification IQ Protocols Installation Qualification Protocols Operational Qualification Protocols Trace Matrix Updated Risk Management Plan Configuration Drawing Performance Qualification Protocols Sample Usage SOPs Final Validation Report Configuration Homework Training Records GAMP V Model User Training Go Live! ValidationDocumentation Validation Plan Training Records Validation Review Final Validation Report Updated Risk Management Plan Validation Planning Checklist Risk Management Plan Supplier Audit Protocol Test Records PQ Testing User Requirements Specification Sample Usage SOP’s Functional Requirements Specification OQ Testing Protocol Test Records Validation Planning Checklist Risk Management Plan Supplier Audit Trace Matrix Design Requirements Specification IQ Testing User Requirement Specification Functional Requirement Specification Design Requirement Specification Protocol Test Records HW /SW Requirements Installation Qualification Protocols Operational Qualification Protocols Trace Matrix Off the Shelf SOFTWARE Customer Installation & Configuration Performance Qualification Protocols Sample Usage SOPs Final Validation Report SysAdmin Training

13. Practical Requirements

14. Process Control Systems • Distributed Control Systems • Programmable Logic Controllers • SCADA / BMS

15. Process Control Systems • Access Control & Password Management • Program Back Up for PLC / HMI / SCADA • Set Parameter Ranges To Be Restricted / Defined • Alarm Management • System Clock Synchronization • System Design Documents V/s Configuration Check • Printers & Reports • Electronic Records & Signatures – Wherever Applicable • Life Cycle Management

16. Office computer Servere.g., for printing and archiving Programmable instruments Laboratory Computerized Systems Instrument Software • HPLC, GC, FTIR etc • Stability Cambers, Incubators

17. Laboratory Computerized Systems • Access Control & Password Management • Adequate User Ids • Data Back Up & Restore • Data Security • Laboratory Network & Server Qualification • System Clock Synchronization • Printers & Records • Electronic Signatures & Records • Life Cycle Management

18. Global Information Systems • Enterprise Resource Planning Systems • SAP, Other ERP Packages • Document Management Systems

19. Global Information Systems - ERPs • cGMP vs. System Configuration • Interfacing of Quality Management System (BMRs) vs. ERP Records • Access Control & Password Management • Adequate User Ids • Data Back Up & Restore • Data Security • Network & Server Qualification • Paper Records vs. Electronic Records • Electronic Signatures • Life Cycle Management

20. Maintaining Control in Operation Maintaining Control in Operation (Post Validation) Program should ensure the following – • All up-dates / new development / implementation are in line with the Change Control Procedures • Risk Assessment is carried out for all up-dates / new development / implementation • Validation documents (SOPs / Protocols / Specifications) are reviewed and updated periodically • Audit the Validation Status of various systems • Monitor the Performance of Systems Periodically

21. Road Map To Compliance • Formulate Computer System Validation Policy – Top Line Statement • Form the Core Team • Formulate Validation Master Plan • Define IT policies & Procedures • For New Systems Follow GAMP V Model – URS to PQ • For Existing Systems • Take the inventory of Systems • Carry Out Impact Analysis • Carry Out Risk Assessment for each System • Close the Gaps • Update the URS and follow GAMP v Model • Maintain Control in Operation

22. Summary • Software System Validation is Critical for All Regulatory Functions including Research and Manufacturing • Scope of CSV covers All Software Systems in GxP Area • Prevailing GAMP Guidelines Provide Framework for Designing CSV Program • GAMP Advocates Life Cycle Approach and Risk Assessment to ascertain CSV Scope • Careful Planning of CSV reduces Duplicate Activities and Cost • Identification of Electronic Records and Maintenance Thereof is Critical for All Software Systems • Maintaining Control in Operation is Essential Post Validation

23. Questions & Comments

24. Thank You For Your AttentionSincerely Yours