Transcription
Task Force Computer validation13 January 2003GMPComputer validation GuideFinal draft Version 2December 2002Revision History:Version 1Version 2August 2002References to 21 CFR part 11 in Chapter 6. “Legal Reference” –December 2002COMPVALFINALDRAFTDECEMBER2002.DOCpage 1 / 40
Task Force Computer validation13 January 2003GMPContents1Contents. 22Acknowledgement . 23Introduction . 44Glossary. 45Scope. 46Legal requirements . 57Guidance . 57.1Strategy . 57.1.17.1.27.1.37.1.47.1.5Approach .6Analysis .6Inventory.6Risk Analysis .6Economics .77.2Compliance. 77.3Project Plan . escription.8Organisation .8Project Manager .8System Owner and Sponsor .8Users .8Developer/ Supplier .9Site Computer Support .9Quality Unit .9Responsibility Matrix.9System Life Cycle. 7.4.197.4.20Introduction.9GAMP Categories.10System Life Cycle Process .13Planning .13Specification .13Supplier / Vendor selection .14Design and construction .15Acceptance Testing .15Implementation and acceptance .16Ongoing operation; .17Use of system.17Security .18Back up and Restore .18Disaster recovery.18Contingency planning .18Business continuity .18Preventive maintenance .19Corrective maintenance (Problem reporting) .19Change control .19Audit trail.19COMPVALFINALDRAFTDECEMBER2002.DOCpage 2 / 40
Task Force Computer validation13 January ng .19Periodic evaluation .19Archiving.19Retirement phase .20Infrastructure .20Validation deliverables and activities .20Appendices . 228.1Practical checklists for computer validation.228.2User Requirement Specification Traceability Matrix .258.3Definition: .268.4 Change Control.278.4.1 Scope .278.4.2 Change control system .278.5Matrix .298.6Benefits.298.7References.308.7.1 FDA Web site/FDA Guidelines .308.7.2ICH .308.7.3G.A.M.P .308.7.4IEEE 730, 828, 829, 830, 1012 .308.7.5ISO Standards .308.82Glossary . 30AcknowledgementThis document was prepared by a Task Force consisting of representatives fromvarious companies that participate in the Active Pharmaceutical IngredientsCommittee of CEFIC.We thank all the members mentioned below for their efforts, cooperation,creativeness, constructive comments and endurance. Without these elements thisdocument would not have reached its present status.The members of this Task Force are:Lisa Näsman * (Astra Zeneca)Claude Becker (Seloc/PCAS)Gert Beets * (OmniChem)Jean-Pierre Bovee (Aventis)Gerben Canninga * (Diosynth)Nigel Cryer (MSD/Merck)William Cuijpers * (Diosynth)Kees Piket (Solvay Pharmaceuticals)Willy Verhaegen (OmniChem)COMPVALFINALDRAFTDECEMBER2002.DOCpage 3 / 40
Task Force Computer validation13 January 2003GMPAllert Wiersema (DSM Anti-Infectives)* these members left prior to finishing the document or joined later3IntroductionIn the last decade, computerised systems have become a vital part in the manufacture ofActive Pharmaceutical Ingredients.Typical applications are Process Control Systems (DCS, PLC, SCADA), LaboratoryInformation Management Systems (LIMS), Laboratory Instrument Control Systems andBusiness Systems (ERP, MRP II).cGMP regulations imply that the functionality’s of those computerised systems, which haveinfluence on the quality of the API, should be validated.Validation shall demonstrate that the parameters defined as critical for its operation andmaintenance are properly (adequately) controlled/managed.It is essential that the validation is practical and achievable, adds value to the project,and is concentrated on the critical elements of the system.This Guideline outlines the scope and legal requirements for the validation of computerisedsystems, chapter 7 gives a comprehensive methodology suitable for most situations withinAPI production control and data handling situations.For some specific cases the coverage may be less extensive and/or subsections may bemerged depending on the criticality and the importance of the systems to be validated.Where specialist validation cases are to be handled chapter 8 gives the official guidance,references and industry guidelines.4 GlossaryRefer to chapter 8.85ScopeThis guide is intended for use by manufacturers of Active Pharmaceutical Ingredients (APIs)and intermediates that use computerised systems for various parts of the process leading tothe manufacture of an API or intermediate. It provides interpretation of existing cGMPguidelines related to the validation of quality critical computerised. These interpretations aimto be practical on one hand and acceptable for both the industry and authorities on the other.The emphasis is on explaining “what to do” and to a lesser degree in “how to do”.Whenever practical and feasible, attention will be paid to linking validation of computerisedsystems with other types of validation, like process validation and equipment validation.Within this guide attention will be paid to two essential parts of computerised systems:1. Infrastructure2. ApplicationsCOMPVALFINALDRAFTDECEMBER2002.DOCpage 4 / 40
Task Force Computer validation13 January 2003GMPWhen applying the contents of this guide it should be realised that not all computerisedsystems will contain all of the elements (a through e) mentioned below.The following aspects will be covered:a. hardwareb. operating systemc. network systemd. data base management systeme. system softwaref. strategyg. complianceh. project plani. system life cyclej. change controlApart from the above-mentioned subjects, supporting activities as training of personnel,documentation and use of checklists will be covered. Attention will be given to the aspect ofrisk-analysis in relation to validation of computerised systems.NoteAlthough no guidance will be included in this document related to electronic records andsignatures (refer to 21 CFR part 11), this subject area must be considered in the URS (alsosee chapter 6).6 Legal requirementsComputerised systems used in the manufacture of API’s should be properly developed,validated and maintained to assure data and product integrity.The newly developed guidance for the manufacture of API’s (ICH Q7a) covers theserequirements. It should be noted that according to the current understanding, 21CFR part 11is not legally binding for API manufacturers; however it is advisable to consider the principlesand recommendations contained in this document prior to validating computerized systemsas required by ICH Q7a.7Guidance7.1 StrategyIn today’s business environment computerised systems are used more and more. It is criticalto design and validate them so that they are fit for purpose and meet user as well ascompliance requirementsThere is a need for clarification of this very complex and often misunderstood area ofcompliance. This area is increasingly the domain of a few consultants and experts.This document will provide clear transparent guidance for API-manufacturers.It will help industry to redress the balance between too much, often ineffective,documentation with too little impact on quality assurance. This will bring about a costeffective, added value efficient and effective way of performing validation of computersystems that are maintained in compliance.A strategy to achieve this will be set out in a pragmatic approach using a Validation Planincluding the elements below.COMPVALFINALDRAFTDECEMBER2002.DOCpage 5 / 40
Task Force Computer validation13 January 2003GMP7.1.1 Approach1. The approach to validation of computer systems should be based on common sense anduse techniques that are familiar within other areas of validation and also business.2. It is important to establish the final objective of validation and to choose an approachwhere a positive response is given, every time the following questions are asked: Will this have added value? Is this the most efficient way? Is this the most effective way? Can we achieve 80 % of the objective with 20 % of the effort?3. One way to assist with these decisions is to use simple flowcharts.7.1.2 AnalysisA priority for validation activities can be established by analyzing a system inventory for thecriticality, validation s
signatures (refer to 21 CFR part 11), this subject area must be considered in the URS (also see chapter 6). 6 Legal requirements Computerised systems used in the manufacture of API’s should be properly developed, validated and maintained to assure data and product integrity. The newly developed guidance for the manufacture of API’s (ICH Q7a) covers these requirements. It should be noted .
