Validation of

Computer Systems & Software

A Practical Approach
Presented By
Mr. Vasishtha Mehta
Director
Epitome Technologies Private Limited

Seminar on Validation Requirements for Regulatory Compliance

Indian Pharmaceutical Association
Date : 8th October,2011 Venue : Sci Tech Centre, Jogeshwari (W) - Mumbai

Topics Covered
Applicability of Computer System Validation
GAMP Guide Lines & Good Practices Models
GAMP V Model & Validation Project
Practical Requirements

Applicability of Computer System

Validation

Use of Automated Systems

Quality Systems
(Annual Product Review, Customer Complaints, Training Records,
CAPA, SOP Administration, Adverse Event Reporting)

Facilities &
Equipment
Systems

HVAC
Autoclaves
Calib & Maint
WFI

Materials
Systems

Inv Mgmt
Dispensary
Dist Systems
WH Mgmt

Production
Systems

Process Inst
Control Sys
EBR
ERP

Packaging &
Labeling
Systems

Label Gen
OCR Sys
Fill Check
Artwork

Laboratory
Systems

Lab Inst
LIMS
C of A
E-Notebooks

Automating GMP Areas

Personnel Qualifications (211.25)
Consultants (211.34)
Equipment Cleaning and Maint. (211.67)
Automated Equipment (211.68)*
Written Procedures (211.100)
Materials Examination and Usage
(211.122)
Packaging and Labeling Oper. (211.130)
Drug Product Inspection (211.134)
Distribution Procedures (211.150)
Reserve Samples (211.170)
Records and Reports (211.180)

Equipment Cleaning and Use (211.182)

Component, Container, Closure and
Labeling Records (211.184)
Master Production Records (211.186)
Batch Production Records (211.188)
Production Record Review (211.192)
Laboratory Records (211.194)
Distribution Records (211.196)
Complaint Files (211.198)
Returned Drug Products (211.204)
Drug Product Salvaging (211.208)

System Validation - Objectives

Extensive Use of Software in GxP Environment
calls for Automated Systems Validation to
ensure
System Functioning vis--vis its intended
use
Insurance against Data Manipulation
Data Integrity on Networks
System Performance in Validated State

GAMP Guidelines & Good Practices

Models

Guidelines - GAMP
Good Automated Manufacturing Practices
(GAMP) provides the Framework for Automated
System Validation
Current version GAMP 5 emphasizes Risk Based
Approach to Software Validation with Life Cycle
Model

GAMP Categories
Category

Software Type

CSV Criticality

Operating System

Low

Firmware

Removed in GAMP 5

Standard Software
Packages
Configurable Software
Packages
Custom or Bespoke
Systems

Medium - High

4
5

Medium - High
High

Current Good Practices Models

Process Control Systems
PLC / DCS / SCADA / BMS

Laboratory Computerized Systems

Application Software Like HPLC /GC /FTIR etc

Global Information Systems

ERP Systems Like SAP / BaaN
Document Management Systems

GAMP V Model & Validation Project

GAMP V Model

System Usage SOPs

User Training
User Training

Validation
Documentation
Validation
Plan
Validation
Validation
Planning
Checklist
Planning

Checklist

Risk
Risk
Management
Plan
Manageme

Supplier Audit

User
Functional
Design
Requiremen
User Requiremen Requiremen
PQ Protocols
t
t
t
Requirements
Acceptance
System
Usage
Sample
Usage
Specification
Specificatio UserSpecificatio
Specificatio
Criteria
SOPs
SOPs
n
n
n
Installation
Functional
Qualificatio
Requirements
Specification
n Protocols

Validation
Validation
Review
Review

Operational
Qualificatio
OQ Protocols
n Protocols

Trace
Matrix

PQ Testing
PQ Testing

OQ Testing
OQ Testing

Protocol Test
Records

Requirements

Off the Shelf

Off the Shelf
SOFTWARE
SOFTWARE

Customer
Customer
Installation &
Installation &
Configuration
Configuration

SysAdmin
SysAdmin
Training
Training

Configuration
Drawing

Configuration
Homework
Training Records

Updated Risk
Management
Plan

Updated Risk
Management
Plan

PQ Test
Report

Protocol Test
Records

Trace
Matrix

Performanc
Final
e Design
Sample
Validation
RequirementsUsage
Qualificatio
SOPs
IQ Testing
IQ Protocols
Report IQ Testing
Specification
HW /SW
n Protocols

Protocol Test
Records

Final
Validation
Report

System Maintenance
Custom Monitoring
Program

Training Records

Supplier
Audit

nt Plan

Go
GoLive!
Live!

Corrective / Preventative
Action

Updated Risk
Management
Plan

Validation
Planning
Updated Risk
IQ / OQ TestChecklist
Management
Report
Plan
User
Requiremen
t
Specificatio
n

Risk
Manageme
nt Plan

Supplier
Audit

Functional
Requiremen
t
Specificatio
n

Design
Requiremen
t
Specificatio
n

Installation
Qualificatio
n Protocols

Operational
Qualificatio
n Protocols

Trace
Matrix

Performanc
e
12
Qualificatio
n Protocols

Sample
Usage SOPs

Final
Validation
Report

Practical Requirements

Process Control Systems

Distributed Control Systems
Programmable Logic Controllers
SCADA / BMS

14

Process Control Systems

Access Control & Password Management
Program Back Up for PLC / HMI / SCADA
Set Parameter Ranges To Be Restricted / Defined
Alarm Management
System Clock Synchronization
System Design Documents V/s Configuration Check
Printers & Reports
Electronic Records & Signatures Wherever
Applicable
Life Cycle Management
15

Laboratory Computerized Systems

Office computer
Server
e.g., for printing and
archiving

Programmable instruments

Instrument Software

HPLC, GC, FTIR etc

Stability Cambers, Incubators

16

Laboratory Computerized Systems

Access Control & Password Management
Adequate User Ids
Data Back Up & Restore
Data Security
Laboratory Network & Server Qualification
System Clock Synchronization
Printers & Records
Electronic Signatures & Records
Life Cycle Management

17

Global Information Systems

Enterprise Resource Planning Systems
SAP, Other ERP Packages

Document Management Systems

18

Global Information Systems - ERPs

cGMP vs. System Configuration
Interfacing of Quality Management System (BMRs) vs.
ERP Records
Access Control & Password Management
Adequate User Ids
Data Back Up & Restore
Data Security
Network & Server Qualification
Paper Records vs. Electronic Records
Electronic Signatures
Life Cycle Management
19

Maintaining Control in Operation

Maintaining Control in Operation (Post Validation) Program
should ensure the following

All up-dates / new development / implementation

are in line with the Change Control Procedures
Risk Assessment is carried out for all up-dates /
new development / implementation
Validation documents (SOPs / Protocols /
Specifications) are reviewed and updated
periodically
Audit the Validation Status of various systems
Monitor the Performance of Systems Periodically
20

Road Map To Compliance

Formulate Computer System Validation Policy Top Line
Statement
Form the Core Team
Formulate Validation Master Plan
Define IT policies & Procedures
For New Systems Follow GAMP V Model URS to PQ
For Existing Systems
Take the inventory of Systems
Carry Out Impact Analysis
Carry Out Risk Assessment for each System
Close the Gaps
Update the URS and follow GAMP v Model

Maintain Control in Operation

21

Summary
Software System Validation is Critical for All Regulatory
Functions including Research and Manufacturing
Scope of CSV covers All Software Systems in GxP Area
Prevailing GAMP Guidelines Provide Framework for
Designing CSV Program
GAMP Advocates Life Cycle Approach and Risk
Assessment to ascertain CSV Scope
Careful Planning of CSV reduces Duplicate Activities and
Cost
Identification of Electronic Records and Maintenance
Thereof is Critical for All Software Systems
Maintaining Control in Operation is Essential Post
Validation

Questions & Comments

Thank You For Your Attention

Sincerely Yours