© A

BB E

utec

h Pr

oces

s So

lutio

ns

Computer Systems and Part 11 Compliance

IQPC 29th July

21 CFR Part 11Risk Based Approach

© A

BB -

2Content of presentation

� Risk based initiative� Effect on 21 CFR Part 11� A practical solution� A real life example� Effect on training� Maintaining compliance

© A

BB -

3FDA recent announcements

� Aug 2002: A risk-based approach to pharmaceutical GMP � Feb 2003: Progress report on risk-based approach� Feb 2003: New draft guidance on Part 11

© A

BB -

4A risk-based approach - why?

� Not enough inspections� Not enough inspectors

� Keep down the cost for safe drugs

Required to inspect

facilities every 2 years

© A

BB -

521 CFR 11 initiative

� July 1992: Draft rule is published (ANPRM)� March 1997: Final rule is published� July 1999: Enforcement policy� 2001-2002: Draft guidance� Feb 2003: Withdrawal of enforcement policy� Feb 2003: Withdrawal of draft guidance� Feb 2003: Issue of new draft guidance

© A

BB -

6Changes to 21 CFR 11

� Responsibility for Part 11 moved from ORA to CDER� Part 11 group headed by Joe Famulare (not Paul Motise)� Part 11 rule may be revised� New draft guidance (replaces ‘old’ draft guidance)� Enforcement policy withdrawn

ORA: Office for Regulatory Affairs

CDER: Centre for Drug Evaluation and Research

© A

BB -

7Changes to 21 CFR 11 guidance� Reinforcement of predicate rule requirements� Promotion of risk-based approach� Narrowed interpretation of Electronic Record:

� Regulated records that are maintained in electronic format only� Regulated records that are maintained in electronic and paper

format, and electronic record is used for regulated activity

� Enforcement discretion for:� Legacy systems� §11.10(a) Validation� §11.10(b) Record copying� §11.10(c) Record retention� §11.10(e) Audit trails

Before Aug 1997

© A

BB -

8What has NOT Changed with 21 CFR 11� No changes to Electronic Signatures� No changes to Electronic Record clauses:

� §11.10(d) System access controls� §11.10(f) Enforce sequence steps� §11.10(g) Application access controls� §11.10(h) Device checks� §11.10(i) Competence of people� §11.10(k) Document controls

� No changes to open systems� No changes to signature and record linking

Can I use group

passwords?

How do I prove this for

my ‘old’ system?

What extra controls do

I need?

© A

BB -

9Definition of Electronic Record

Electronic Records

Submitted Records

GxP RecordsApply

Validation

ApplyPart 11

ApplyPart 11 ?

Apply Validation ?

© A

BB -

10Example: Electronic Batch Record System

Masterrecipe

Paper PaperPaper Electr. Electr. Electr.

Batchreport

Signedbatchreport

Batchrecipe

Workingrecipe

Batchdata

© A

BB -

11Risk Based ERES Remediation

Where are most of us now ?

Interpretations

Policies

Action planInventory Assessments

© A

BB -

12

Since Most Industry Part 11 Programmes Started the Goal Posts Have Moved

Legacy systems?

Audit trails?

Defer low risk systems? FDA Expectations?

© A

BB -

13Where Do We Go From Here?

We need to prioritise quickly according to risk:-� We can remove whole systems by applying high level

filters � We can make quick decisions on the obvious

replacements� Then we can look at the detailed risks for a few systems

in the middle

� So How?

© A

BB -

14Risk Based 21 CFR 11 Process Overview

MASTER INVENTORY

1000 systems

Filter out :

Gamp Cat 1 & 2

Filter out non-GxP

No GxP electronic records

400 Systems for next stage

Assess Age, GxP Risk, Cost and

BenefitReplacement systems this year

Procedural remediation

50 for detailed study

600 Systems for

No Action

Replacement systems years 2 and 3

© A

BB -

15

S/w Category DescriptionGAMP 1 Operating system (remove from scope)GAMP 2 Firmware (remove from scope)GAMP 3 Standard software packageGAMP 4 Configurable software packageGAMP 5 Custom built or bespoke system

Automatic Filter Stage 1……Gamp Category

Remove from scope and record documented rationale………..

Normal validation and qualification still applies

© A

BB -

16

No

Automatic Filter Stage 1……GxP

Yes

If the system malfunctions or fails in any

Way – is the risk that it could affect product

or critical product data negligible ?No further action

Does the system create, modify or store

Records ‘required’ by predicate rules ? OR

Does the system create, modify or store records

which are submitted to the FDA?

System out of scope

Document rationale

System in scope

Yes

No

The GxP filter

© A

BB -

17Stage 2 Assessment of Sub-Inventory

� Suggested Risk Factors� GxP Risk

� Impact � Likelihood� Detection

� Inspection risk - Low / Medium / High� Pre-/Post-1997 (could be stage 1)� Business Risk - Low / Medium / High� Technical Risk - Low / Medium / High� Project Risk - Low / Medium / High� Cost - Low / Medium / High

SUB-INVENTORY

Sort by :

GxP risk (e.g. GAMP)

Inspection risk

Age

Business risk

Technical risk

Project risk

Cost

© A

BB -

18GxP Risk – Impact and Likelihood

Likelihood and GxP Impact Dimensions

Risk Likelihood Low Medium High High Medium GxP

Impact Low

Level One

Level TwoLevel Three

© A

BB -

19GxP Risk - Probability of Detection

Compare Risk Level & Probability of Detection to Assign Priorities

Probability of DetectionLow Medium High

12Risk

Classification3

High priority

Medium priority

Low Priority

© A

BB -

20Apply Initial Filters – Assign ERES Priority

© A

BB -

21Apply Risk/Cost/Benefit Filters – Assign Overall Priority

© A

BB -

22Key Benefits of Risk Based ERES Remediation

� Ties in with the underlying capital expenditure� Reduces inspection risk sooner than non risk-based

approach� Generates the rationale and justifications for upgrade /

remediation plans for all systems� Is based on a realistic and pragmatic approach to Part

11

Gives the most risk reduction for least time and money

© A

BB -

23Risk Based Remediation Planning

0102030405060708090

2003 2004 2005 2006

low risk addressed in year

med riskaddressed in year

high riskaddressed in year

Poly. (high riskaddressed in year)

Cumulative risk

reduction

© A

BB -

24Chromatography Data System Example

� Labtech Chromatography Data System� Access to the facility is controlled by building access keycard� The system has a client server architecture � Implementation date June 1997 cost £75K� Used for chromatographic data acquisition, data handling,

reporting� Operating system Windows 95, application software version 1.02

(Aug 98)� Automatic audit trail or e-sigs not available in v1.02� Group password available at application level, this is configured

and known to all users� System developer or maintainer CV’s not available

© A

BB -

25Chromatography Data System Example� Labtech Chromatography Data System cont.

� SOP for system operation and administration is available � The system is validated following a 1992 CSV validation

procedure and validation is based upon vendor IQ and OQ� Complete configuration management and change control history

for the system is not available� System documentation is held within the department, this is not

listed or held centrally � Reports are printed to paper and signed. Original copies are

retained in the laboratory and PDF renditions are e-mailed to the study leader.

� The system is backed up weekly to Jazz drive. Back up covers raw data and report folders.

� The system is used for manufacturing QA and clinical studies

© A

BB -

26Chromatography Data System Example

� Complete three high level filter fields� GxP filter

� If the system malfunctions or fails in any way - is the risk that it could affect product or critical product data negligible ……No

� Electronic records filter� Does the system create, modify or store records ‘required’ by

predicate rules ? Or does the system create modify or store records which are submitted to the FDA ? ……YesTherefore GxP Filter = YesPredicated or submitted records = Yes

� Gamp category = 4 (Configurable software package) filterGamp Categories 3-5 remain within scope

� The system remains in scope and is assigned an ERES priority of 3

© A

BB -

27Apply Initial Filters – Assign ERES Priority

© A

BB -

28Undertake More Detailed Assessment

� GxP risk� Impact…(H) and likelihood…(M)� Probability of detection…(H)

� Business risk� Low / Medium / High…(M)

� Technical Risk� Low / Medium / High….(L)

� Project Risk� Low / Medium / High….(L)

� Budget Cost� Low / Medium / High…(M)

� Additional Business benefit� Low / Medium / High…(M)

© A

BB -

29Undertake More Detailed Assessment

Sort by priority vs. risk and cost(Labtech CDS priority v risk / cost rating = 156)

© A

BB -

30As This System Remains Within Scope

� Prepare a System Risk Assessment Summary� Summarise risk assessment findings� Document known compliance gaps from existing information� Justify system prioritisation - using stage 2 absolute risk value� Justify system remediation timescales� Detail any short-term or procedural remediation measures

completed or required (use remediation workflow guides as relevant - to increase efficiency / reduce costs)

� Sign off document and retain as evidence of due diligence

© A

BB -

31So What Does This Mean for Part 11 Training?

Still need to:� Give awareness training to

many …� … so that they can

operate/maintain correctly.

However…� Fewer in depth studies means

fewer people to train as experts.

© A

BB -

32A Further Thought on Maintaining Compliance…

� As well as procedures and training …� We need to be clear where Part 11 fits into our project

life cycles� GAMP gives little or no help on this� The ABB view is:a) At supplier audit and …b) At functional specification and …c) During operational qualification

© A

BB -

33Predicting the future

� CSV and Part 11 to merge?� Increased application of Part 11 in associated areas?� Drawing benefits from electronic signatures?� Application of EU directive on electronic signatures?

� Increased use of electronic tools in validation?

� Electronic archiving issues resolved?� Electronic submissions the norm?� PAT applied to validation?

© A

BB -

34Finally: are we keeping up with today ?

“The Agency is developing procedures for archiving

documents with electronic signatures. Until these are in place, electronic documents requiring signatures must be

accompanied by a paper copy.”

FDA Guidance to Industry

Jan1999

Jan2001

Jan200x?

© A

BB -

35Thank you!

Questions on this presentation can be directed to:

Bob Mauger bob.mauger@gb.abb.comJenny HoFoongHeng jenny.hofoongheng@sg.abb.com

ABB Industry Pte Ltd2 Ayer Rajah CrescentSingaporeTel: (65) 776 5711