implement an effective risk based compliance process · pdf filebased compliance process for...

Implement an Effective Risk

Based Compliance Process for

Electronic Data

Chris WubboltApril 27, 2016

17th Annual Computer and Software Validation

www.QACVConsulting.com 1

Objectives


• Implement an Effective Risk and

Compliance Process for Electronic Data

• Understand Current Regulatory Data

Integrity Expectations

• Organizational Approaches to Implement

Data Integrity Processes

• Examples

Current Regulatory Requirements

and Guidance


FDA – Data Integrity Guidance and

Compliance with CGMP (April 2016)

WHO - Guidance on Good Data and

Record Management Practices

(September 2015)

MHRA - MHRA GMP Data Integrity

Definitions and Guidance for Industry

(March 2015)

FDA and MHRA Guidance


FDA

• Q&A format

• Includes key terms

• Specific data integrity topics are discussed.

MHRA

• Data integrity program

• Example driven

• Governance

• Data life cycle

FDA Guidance


FDA expects data to be accurate and reliable.

Flexible and risk-based strategies to prevent and detect data integrity issues.

Ensuring data integrity is an important component of industry’s responsibility to ensure the safety, efficacy, and quality of drugs, and of FDA’s ability to protect the public health.

FDA Guidance

ALCOA


Data Integrity

Completeness, consistency, and accuracy of

data.

Attributable

Legible

Contemporaneous

Original

Accurate

Enduring

Retrievable

FDA GuidanceStatic & Dynamic Records


Static

• Fixed-data document such as a paper record or an electronic image.

Dynamic

• Format that allows interaction between the user and the record content.

• Chromatographic record

• Allows user to change the baseline.

• Reprocess chromatographic data.

• Resulting peaks may appear smaller or larger.

• Spreadsheet

• User modification of formulas or entries used to compute test results.

FDA GuidanceStatic & Dynamic Records


Acceptability of retaining paper printouts or static records instead of original electronic records from stand-alone computerized laboratory instruments?

Control strategies must ensure that original laboratory records, including paper and electronic records, are subject to second-person review to make certain that all test results are appropriately reported.

FDA Guidance


System Suitability: %RSD < 2.0%

%RSD 3.9%

FDA GuidanceCGMP Records


Any data created as part of a CGMP record must be evaluated by the quality unit.

Data must be maintained for CGMP purposes.

Electronic data generated to fulfill CGMP requirements should include relevant metadata.

To exclude data, there must be a valid, documented, scientific justification for its exclusion

FDA GuidanceAudit Trails


Audit trails that capture changes to critical data be reviewed with each record and before final approval of the record.

FDA recommends routine scheduled audit trail review based on the complexity of the system and its intended use.

FDA GuidanceCGMP Records - Finding


•Upon review of the audit trail configuration within LIMS, audit trails were turned off for many of the tables within the XXX Module.

Documentation was not available to justify why the audit trails for these tables was turned off. For example,

• The audit trail was not turned on for the XXX table, which is used when jobs, such as stability time pulls, are cancelled or suspended.

• This was observed by reviewing the audit trail configuration within the system.

• Audit trail configuration is documented within Design specification, XXX, YYY, version 2.0, approval date 11-Mar-2016.

FDA GuidanceWorkflows


Validation of “workflows”

• A workflow, such as creation of an electronic master production and control record, is an intended use of a computer system to be checked through validation.

• If you validate the computer system, but you do not validate it for its intended use, you cannot know if your workflow runs correctly.

FDA GuidanceControls to manage risks


Implement appropriate controls to manage risks associated with each element of the system.

Controls that are appropriately designed to validate a system for its intended use address software, hardware, personnel, and documentation.


FDA GuidanceControls to manage risks – understand

your data flows

Material

Weight


“Standard Build”

• Date/time stamp controls

• Network backup

• Access controls

FDA GuidanceControls to manage risks – understand

your data flows

Non-Standard

Build

X

• Audit logs not backed up

• User access not controlled

FDA GuidanceElectronic Signature


ALCOAAttributable

EDC System

• How long of a delay? 2-3 hours, sometimes next day

• Issue – system response is slow at times

• Cause – batch jobs being run cause slow system response

• Type of batch jobs? Principle Investigator approval of eCRFS

• What date/time is applied for electronic signature?

• Answer: When batch is run.

• Data integrity issue – date and time stamp is not the same as

when PI entered electronic signature user ID and password.

FDA Guidance


•It is not acceptable to record data on pieces of paper that will be discarded after the data are transcribed to a permanent laboratory notebook.

Similarly, it is not acceptable to store data electronically in temporary memory, in a manner that allows for manipulation, before creating a permanent record.

Electronic data that are automatically saved into temporary memory do not meet CGMP documentation or retention requirements.

MHRA Guidance


• Policies and procedures

• Training

Data Governance

System

• Initial generation to archival / destructionData Lifecycle

• Degree of effort and resources to apply organisational and technical controls should be commensurate with its criticality.

Risk

Data Governance


Data ownership

throughout the lifecycle

Consider

• Design

• Operation

• Monitoring of processes / systems

Control over intentional & unintentional

changes

Data Lifecycle


Considerations

• Ownership – who owns the data

• System Access – authorized users

• Definition of Raw Data

• Paper

• Electronic

• Hybrid

Data Lifecycle


Data Lifecycle


The eClinical Forum and PhRMA EDC Task Group

Data Lifecycle


Considerations

• Signatures – electronic or handwritten

• Audit Trails and Metadata

• Review of Records

• Paper

• Electronic

• Hybrid


Data Integrity

Data Availability

Data Retention

Considerations for Data Integrity

Considerations for Data Integrity


Calibration

Calibration

IT Controls

Record Management

IT Controls

- User access

Record Retention

& Archival

IT Controls

Validation

Aligning Data Integrity to the

Quality System


Policies and Procedures

Record Integrity Policy

Good Documentation Practices

Raw Data Definition

Operational Procedures Handling of data

Roles and Responsibilities

Review and approval of data

Integrating the Data Integrity

Program into the Quality System


Policies and Procedures

Validation

Security and Administration

Record Retention

Backup and Restore

Disaster Recovery

Monitoring Data Integrity Program

Audits

Reviews

Questions


Chris Wubbolt

QACV Consulting, LLC

Telephone: 610-442-2250

E-mail: [email protected]

implement an effective risk based compliance process · pdf filebased compliance process for...

Documents