Transcription
Periodic ReviewofValidated SystemsPhiladelphiaYau Kai WongApril 2013
Agenda Purpose of the Periodic Review What to Review Report on PR Remediation2
Regulatory requirementBoth the FDA and EU GMP’s detail therequirement for demonstrating that a computersystem remains in a validated state throughout itsoperating history. FDA 21 CFR 211.68(b) “Input to and output from thecomputer or related system offormulas or other records or datashall be checked for accuracy. Thedegree and frequency of input/outputverification shall be based on thecomplexity and reliability of thecomputer or related system.”3
Regulatory requirement EU Annex 15 “Facilities, systems, equipmentand processes, includingcleaning, should be periodicallyevaluated to confirm that theyremain valid. Where nosignificant changes have beenmade to the validated status, areview with evidence thatfacilities, systems, equipmentand processes meet theprescribed requirements fulfillsthe need for revalidation.”4
Purpose of the Periodic Review The purpose of the PeriodicReview is to ensure that thesystem remains compliant withregulation, is fit for its intendeduse, and satisfies companypolicies & procedures. It may also fit with the companiesOperation Excellence / ContinuousImprovement program.5
Objectives of Periodic Review To provide independent assurance to theprocess owner and senior management thatcontrols are in place around the system beingreviewed and are functioning correctly. Thesystem is validated and controls are workingadequately to maintain the validation status. To identify those controls that are notworking and to help the process owner andsenior management improve them and thuseliminate the identified weaknesses. Theimpact of a finding may be applicable to asingle computerized laboratory system or allsystems in a laboratory.6
Benefits of Periodic Review Quality and the Business Improve the operation Maintain compliance Support the continuousimprovement7
Frequency of Periodic Review The frequency of performing PeriodicReviews should be dependent on theComplexity, Criticality, Novelty, andOperating History of the (computer) system. For example an automatedcontrol system (Category 4 / 5)the computer system periodicreview should be performed morefrequently than an off the shelfitem.8
Frequency of Periodic Review The periodic review of computersystems can be a considerableoverhead for regulatedcompanies. Low risk to patientsafety and GMP requirementsmay not require a periodicreview. The decision andrationale must be documented.9
Frequency of Periodic Review Once the operating history has beenestablished and the system is stable(minimal incidents and changes) thenthe frequency can be reduced. The frequency of review should bedefined with a minimum and maximumtime between reviews, for example ascale of 1 to 4 years can be set for thereview period. Only new GAMP category4 and 5 Computer Systems would havean annual review period. This would beextended as discussed above as theoperating history demonstrated that thesystem operation is stable.10
Frequency of Periodic Review Non configurable systemsstarting with a frequencyof 2 years when firstinstalled through to amaximum 4 years once astable operating historyis established.11
Overview of the PR process12
Who performs Periodic Review Process Owner – laboratory person who isresponsible for the system System Owner – the person responsible for theavailability and support of the system IT - system administrator or a member of thecomputer validation group Quality Assurance13
Qualification of reviewer Knowledge of the GxP Experience working with computerized systemsand knowing where (noncompliance) "bodies"can be buried and where bad practices canoccur Understanding & knowledge of the currentprocedures used by the company Open and flexible approach, coupled with theunderstanding that there are many ways ofbeing in control Good interpersonal skills coupled with a hide asthick as an elephant's14
Planning for a periodic review Scheduling Recruit of personnel Coordination for system documentation retrieval Assign review tasks15
Carry out periodic review Static Sit in a room and read andevaluate system documentation orlogs against procedures andpolices Dynamic Look at the system and see how thesoftware and instrument operates,examine the IT support, and havediscussions with users and IT staffIn reality, the periodic review is amixture of the dynamic and staticoptions16
Performing the ReviewPeriodic review can be a labor and timeintensive process .Two methods which can be followed forestablishing and maintaining the validated state. Traditional periodic review Continual monitoring andtrending17
Performing the Review Continual monitoring and trending Equipment history or validation equipment files Change control records, deviations, incidents logs Trending of the system Risk assessments18
What to review System ID # & location Validation status System security & access Audit trail Change control Backup and restore &disaster recovery Deviation CAPAs Trending19
Conducting the Periodic Review Prepare a checklist Obtain information from the person thatyou will interview and have discussionswith during the PR Ask open-ended questions “state of MO” – “show me” to verify List of current company SOPs Review of the last system validation20
Conducting the Periodic Review Review of the last system validation Validation plan Validation summary report User requirement specifications Current system configuration Operational review21
Documentation of the PeriodicReview Periodic Review Report Findings recommendations22
Actions for Periodic Review CAPAs Remediation Re-validate Patching Upgrade / update software, documentation System decommissioning / retire23
CSV FDA Warning Letter: PeriodicReviewObservation6. Your firm failed to check the accuracy of the input to and output fromthe computer or related systems of formulas or other records or dataand establish the degree and frequency of input/output verifications [21CFR § 211.68(b)].For example, the performance qualification of your (b)(4) systemsoftware (Validation No. 4000-03-PQ-0002) failed to include verificationof the expiration date calculations in the (b)(4) system. In addition, thereis no established degree and frequency of performing the verification.Discrepancy reports have documented that product labeling withincorrect expiration dates have been created and issued for use.Your response states that you opened Investigation T-139 and youprovide a January 29, 2010 through February 26, 2010 completiontimeline. You have not provided a response to correct this violation andestablish a corrective action plan to assure that computer systems areproperly qualified.24
The frequency of review should be defined with a minimum and maximum time between reviews, for example a scale of 1 to 4 years can be set for the review period. Only new GAMP category 4 and 5 Computer Systems would have an annual review period. This would be extended as discussed above as the operating history demonstrated that the
