Validation of Computer Systems in a Global Environment

June 2012

Presented at the National Validation Forum Presented by: Andrew Giles on 27 June 2012

This Presentation
Definitions Validations of computer systems in a global network environment. Examples of global systems and deficiencies When is a computer system required to comply to the code of GMP? Is there more to the inspection of computer systems than validation?
2

What first?
Understand the terms used in computer systems validation

Definitions
Acronym Full Name LAN Local Area Network Wide Area Network What & Where?
A computer network that connects computers and devices in a limited geographical area such as computer laboratory, office building or manufacturing site A computer network that covers a broad area (i.e., any network whose communications links cross metropolitan, regional, or national boundaries).
4

WAN

Definitions
Acronym Full Name MRP I or MRP II (MRP 2) ERP Material Resource Planning Enterprise resource planning What & Where?
Purchasing, warehouse and stock control systems. MRPII systems have simulation capability to answer "whatif" questions Is a company-wide computer software system used to manage and coordinate the resources, information, and functions of a business from shared data stores.
5

ERP Systems as an Example of a Global Network System

To follow is an example of where an ERP system can be a globally networked system

Issue
Companies regularly merge To gain efficiencies group management merge computer systems from different sites Sites that have been operating independently are often faced with corporate policies that require they will use particular software as specified by the corporate IT department or link existing systems with corporate systems
7

ERP Systems Example

SITE 2 Corporate Head Office SITE 1

MRP SYSTEM B
Supplier Warehouse

MRP SYSTEM A

ERP Systems Example

Issue
The TGA inspects a manufacturing site by geographical location That is in Australia Inspectors can legally enter the premises of the company named on the TGA Licence at the address specified on the TGA Licence, for purpose of conducting a GMP inspection
10

ERP Systems Example

SITE 2 Corporate Head Office SITE 1

Not Licensed or Inspected by the TGA

MRP SYSTEM B
Supplier Warehouse

TGA LICENSED SITE

MRP SYSTEM A

11

Issue
The concept is similar for an overseas site that is being certified by the TGA although the legal authority to enter the premises is different

12

If a manufacturer uses a computer system for GMP purposes then the inspector must be able to inspect all aspects of the systems to ensure that the system complies to the relevant parts of the code of GMP (including cGMP Medicinal Products part I clause 4.9 & Annex 11 and for APIs part II section 5.4) If a GMP system is not physically located on the site that is being inspected and/or the staff maintaining the system are not located on the site, this does not change the manufacturer's obligation to ensure and demonstrate that the system meets all the code requirements relating to the system
13

Often inspectors find that computer systems are not on the site that is being inspected and the systems are controlled by the corporate head office or a third party It is also very common for the company name of the corporate head office to be different to that on the licence/certificate and it is common for the corporate head office to be registered and located in a different country to the one that is being inspected
14

If a GMP related computer system is located/maintained on a site that is not licensed/certified by the TGA then the system will be considered deficient if the manufacturer asserts that the computer system is controlled by the corporate head office or other site but does not have evidence to demonstrating that the system meets the requirements of the GMP code available for inspection on the site that is being inspected at the time of an inspection.
15

The manufacturer can then either make all aspects required for the demonstration of compliance available on the site being inspected at the time of the inspection or

16

or The manufacturer can treat the site in which the computer system is located as an outside agency. This would be required even if the none licensed site was the corporate head office and considered by the manufacturer to be part of the group of companies to which they belonged. The company would then need to comply with all aspects of cGMP Med Annex 11 section 18: "When outside agencies are used to provide a computer service, there should be a formal agreement including a clear statement of the responsibilities of that outside agency (see Chapter 7)." Note: chapter 7 now applies.

17

Note: chapter 7 now applies. 7.1 There should be a written contract covering the manufacture and/or analysis arranged under contract and any technical arrangements made in connection with it. 7.2 All arrangements for contract manufacture and analysis including any proposed changes in technical or other arrangements should be in accordance with the marketing authorisation for the product concerned. 7.14. The contract should permit the Contract Giver to visit the facilities of the Contract Acceptor.
18

Note: chapter 7 now applies. The site that is being inspected must hold evidence demonstrating that the contracted third party is capable of meeting the cGMP requirements for computer systems

19

Deficiency Example
During an initially inspection of an Indonesian site the following was found: The site used an ERP system that was a customised system based on SAP.

20

Example
The manufacturer claimed that the system had been designed in Australia by the corporate head office and installed on many sites that were authorised by several different regulatory authorities. The global group of companies had a site with a TGA licensed site in Australia but the computer systems was not located or maintained from the licensed site. There were also several other sites linked to the system that had not been inspected by the TGA.

21

Example
The Enterprise Resource Planning (ERP) system was installed, controlled and maintained by the South East Asian corporate head office. At the time of the inspection, evidence of completed validation was not available on the Indonesian site. The manufacturer indicated that the ERP systems validation documentation were held at a Singaporean site as the systems was relevant to many sites controlled by the parent company in multiple different countries.
22

Example
The company relied on the ERP system to prevent the duplication of batch numbers. It was noted by the Inspector that the ERP system would accept a space in front of a batch number, which then allowed duplicate batch numbers to be entered into the system. As all records of validation and maintenance of the SAP system was not available at the Indonesian site it was not possible for the inspector to investigate this discrepancy any further.
23

Example
There were no agreements or procedures defining responsibilities for design and maintenance of the system. There were no SOPs, agreements with corporate IT, policies or validation documents on the Indonesian site.

24

Example
A deficiency was raised against Annex 11 sections 2 (Validation) and 18 (When outside agencies are used to provide a computer service). It was expected that the company would investigate the adequacy of their Service Level Agreements (SLA) and validation of the SAP system in light of the above observations.

25

Cases: System is Located on Another Licensed Site

If the corporate head office/corporate IT that is controlling GMP computer system(s) is on a site that is licensed/certified by the TGA then the TGA inspectors can include the inspection of the computer system during the inspection of the head office/other licensed site and the site that is being inspected only need to have procedures/SOP's that define their responsibilities with respect to the usage of the system available at the point of use.
26

Cases: System is Located on Another Licensed Site

However, be aware of site specific configurations or adaptations that may not be covered by the controlling site

27

When is a Computer System Required to Comply to the cGMP?

Whenever all or part of a computer system is used in manufacturing, quality control, quality assurance or release for supply as defined in the code

28

When is a Computer System Required to Comply to the cGMP?

Only the parts related to GMP functions are required to comply with the code but be aware some items like security can not be separated by GMP and Non GMP parts Remember GMP computer systems also consist of modules, operating systems and networks
29

When is a computer system required to comply?

Does Med Prod P1 Clause 4.9 Apply?

Data may be recorded by electronic data processing systems, ......... Batch records electronically stored should be protected by back-up transfer on magnetic tape, microfilm, paper or other means. It is particularly important that the data are readily available throughout the period of retention,.

30

When is a computer system required to comply?

Does Med Prod P1 Clause 5.29 Apply?

[5.29] Starting materials in the storage area should be appropriately labelled (see Chapter 5, Item 13). Labels should bear at least the following information:
........... When fully computerised storage systems are used, all the above information should not necessarily be in a legible form on the label.

31

When is a computer system required to comply?

Considerations
Possible questions to ask about the system Do any outputs from the system form part of the batch record? [4.18] Is any part of the system used in place of GMP documentation? [4.9]

32

When is a computer system required to comply?

Considerations
Questions
How do stores personnel know which stock is released for supply? [1.3 vii, Annex 11.19] How is quarantine/hold stock controlled?
[3.21] Where quarantine status is ensured by storage in separate areas, these areas must be clearly marked and their access restricted to authorised personnel. Any system replacing the physical quarantine should give equivalent security.

33

When is a computer system required to comply?

Considerations
Questions How is stock rotation controlled? [5.7] In the case of a recall how would materials be reconciled and returned materials isolated? [Chapter 8.12, 8.13, 8.14]
34

When is a computer system required to comply?

Considerations
Questions How is the sampling and re-sampling of quarantined materials controlled? What control systems are in place to remove reject materials from the warehouse for destruction?

35

When is a computer system required to comply?

Considerations
Questions How are batch records generated? Where are the formulations stored that make up a Bill of Material (BOM)?

36

When is a computer system required to comply?

Considerations
Questions Where are results from laboratory equipment first stored? i.e. are chromatograms or other results first collected on a hard drive or other computer based durable media?

37

When is a computer system required to comply?

Considerations
If the answer to any of the above questions indicate that a computer system is implicated in the GMP processes then the computer system forms part of the GMP quality system and could be subject to inspection.

38

Is there more to a inspecting computer systems than validation?

Validation is only a small part of what computer systems need to comply with Annex 11 refers to items such as security, change control, validation, back-up, archiving and audit trails

39

Validation
Inspectors will check that the manufacturers Validation Master Plan (VMP) includes computer systems There maybe a separate validation master plan for computer system or they maybe embedded in area VMPs

40

Annex 11 Section 2 on Validation

(A 11- S 2) Validation should be considered as part of the complete life cycle of a computer system. This cycle includes the stages of planning, specification, programming, testing, commissioning, documentation, operation, monitoring and changing.

41

Systems Development Life Cycle (SDLC)

The codes do not restrict manufacturers in which SDLC a manufacturer may use The manufacturer needs to define the SDLC and ensure that it is appropriate for the application

42

Systems Development Life Cycle (SDLC)

The most common SDLC is the V model Some of the alternative SDLCs that might be used are: Classical Waterfall Prototyping Joint Application Development (JAD) Rapid Application Development (RAD)

43

GAMP V Model SDLC

URS
USER REQUIREMENT SPECIFICATION

PQ
PERFORMANCE QUALIFICATION

FRS
FUNCTIONAL REQUIREMENT SPECIFICATION

OQ
OPERATIONAL QUALIFICATION

DS
DESIGN SPECIFICATION

IQ
INSTALLATION QUALIFICATION

CODE
44

Classic GAMP V Model SDLC

URS
USER REQUIREMENT SPECIFICATION

PQ
PERFORMANCE QUALIFICATION

FRS
FUNCTIONAL REQUIREMENT SPECIFICATION

OQ
OPERATIONAL QUALIFICATION

MISSING MAINTENACE AND DECOMMISSIONING IQ

DS
DESIGN SPECIFICATION INSTALLATION QUALIFICATION

CODE
45

Validation vs. version

Validation should be considered as part of the entire life cycle Check that the version that is validated matches the version of the live system There maybe multiple levels of version number. Are they covered in the IQ? Is configuration version controlled?
46

Validation vs. version

User Interface
Version number of each add-on Interface version number

Configuration settings

Configuration version number Base application version Number + service packs

Modular Add-Ons

BASE APPLICATION

DATABASE Operating system

DB version number

OS version number

47

Examples of components
e.g. quality packages, LIMS packages and accounting packages

User Interface

Remote access (eg. Citrix), Web access or direct access e.g. security settings and audit trails Purchased base software, customised components and patches e.g. Oracle, SQL or proprietary databases Also table field settings OS is both at the server and at the client
48

Configuration settings

Modular Add-Ons

BASE APPLICATION

DATABASE Operating system

Thank you for your attention

Questions?