jeb bullis senior account executive · • similar to validating an off-the-shelf product with...
TRANSCRIPT
Validation Best PracticesJeb Bullis
Senior Account Executive
Today’s Topics
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked Questions• Validating Applications• References• Questions
To enable our customers to manage, control, and changehighly regulated processes and their associated content to reduce regulatory risk and sustain compliance over time.
Amadeus’ Mission:Compliance Process Control
People Content
WWW
Processes
Agenda
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked Questions• Validating Applications• References• Questions
Testing
• Activities in which a system or component is executed under specified conditions, the results are observed or recorded and an evaluation is made of some aspect of the system or component. (IEEE)
Verification
• Checking and reviewing project artifacts to ensure that the desired process was followed• Confirmation through the provision of objective evidence that
specified requirements have been fulfilled. (ISO)• The process of evaluating a system or component to determine
whether the system of a given development phase satisfies the conditions imposed at the start of that phase. (IEEE)
• Encompassing unit and integration testing
Validation
• Obtaining evidence and determining that the system actually functions as expected• Establishing documented evidence that provides a high degree of
assurance that a specific process will consistently produce a product meeting its predetermined specifications and quality attributes. (FDA)
• The process of evaluating a system or component during or at theend of the development process to determine whether a system or component satisfies specified requirements. (IEEE)
Verification vs. Validation
• Verification is set of activities to ensure that a function is developing properly ;
Validation is a different set of activities to ensure that the function that has been built is working properly.
• (Verification) Are we producing the product right?
(Validation) Are we producing the right product?
- Boehm
Testing Levels
• The test phase of the validation life cycle ensures that the computerized system functions as expected and meets its intended use.
• The test phase is divided into the following four levels:
UserAcceptance
Testing(PQ)
SystemTesting
(OQ)
IntegrationTesting
UnitTesting
Agenda
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked Questions• Validating Applications• References• Questions
Regulatory Requirements
• Code of Federal Regulations, Title 21, Part 11, Electronic Records; Electronic Signatures
• General Principles of Software Validation; Final Guidance for Industry and FDA Staff, 11-Jan-2002
• Guidance for Industry, Part 11, Electronic Records; Electronic Signatures – Scope and Application, August 2003
• Predicate Rules that may Apply to a Specific System• Components of regulations that require regulated companies to
provide information to the FDA or maintain information for review by the FDA
• For example, Part 820 Good Manufacturing Practice for management of SOPs
21 CFR Part 11 & ValidationFebruary Draft Guidance
• Part 11 incorporated in GMP Initiative at CDER− Joe Famulare, made head of Part 11 Compliance Committee− -www.fda.gov/cder/gmp/21stcenturysummary.html
• FDA Part 11 Guidance for Industry Withdrawn!!− Validation, Glossary (’01); Maintenance (’02); Elec. Copies (’03)
• FDA’s New Draft Part 11 Scope & Application Emphasis− GAMP4 Guide & CDRH Principles of Software Validation− Predicate Rule Requirements & Documented Risk Assessment
• FDA Final Guidance Timetable slipped into SeptemberExcerpts: PDA Vancouver Conference on Pharmaceutical Manufacturing
21 CFR Part 11 & ValidationSeptember Final Guidance
• “Part 11 Remains in Effect” Emphasized− Joe Famulare reviewed Final Guidance at FDA/FDA DC Conf.
• FDA Part 11 Guidance will not be Reissued
• FDA’s Final Part Part 11 Scope & Application Emphasis− Joe Famulare noted this is NOT temporary; it’s the approach− GAMP4 Guide & CDRH Principles of Software Validation− Predicate Rule Requirements & Documented Risk Assessment
• FDA Changes to Part 11 will take Years to enact− Joe Famulare – 6 mo. Public discussion prior to new rulemaking
Excerpts: PDA Vancouver Conference on Pharmaceutical Manufacturing
What Should I Tell My Boss?
• It appears the FDA heard and heeded industry− Past “regulation by podium” repudiated
• FDA to apply a “narrower scope” to enforcement− Focus on the Predicate Rules, not on ALL electronic records created
• FDA’s Final Part Part 11 Scope & Application Emphasis
• It is important that this new guidance not be over-interpreted to imply a relaxation of validation requirements [e.g. 21 CFR 820.70(i) reference]
Excerpts: PDA Vancouver Conference on Pharmaceutical Manufacturing
Agenda
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked Questions• Industry Trends• Validating Documentum Applications• References• Questions
Projecting Compliance Across the Enterprise
“The quality system provides the foundation for the manufacturing systems that are linked and function within it.”…..Page 6, Inspection Criteria;FDA CDER Draft Guidance for Industry, Sept. 2004
FDA Investigator Focal PointsReview firm’s predicate recordkeeping requirements and procedures for providing electronic and paper copies
Review the overall security of electronic record-keeping
Review Validation documentation
Review firm’s self-audit, corrective action plan and progress
Training of IS and technical personnel
Does the firm “maintain a validated state”?
Maintain
Validation Overview – 7 Phases
• Risk Assessment
• Validation Planning
• Vendor Assessment
• Training Planning
• Gather and Assess Requirements
• Determine Technical Architecture
• Determine System Design
• Configure Development Environment
• Configure and Develop Application Software
• Develop Installation Script or Instructions
• Unit Testing
• Integration Testing
• System Testing
• User Acceptance Testing
• Set Up and Qualify Production Environment
• Deliver Software to Client Workstations
• Migrate Legacy Data
• Train Users
• Issue Procedures
• Perform Validation Assessment
• Publish Release Memo
MaintainDeployTestConstructDesignAnalyzePlan DeployTestConstructDesignAnalyzePlan
• Business Continuity Planning
• Disaster Recovery Planning
• System Administration
• Backup and Recovery
• Change Control
• Periodic Review
• On-going User Training
Risk Based Validation Approach
• “We recommend that you base your approach on a justified and documented risk assessment,
and a determination of the potential of the system to affect product quality and safety and record integrity.”
(21 CFR Part 11 Scope and Application 9/03/03)
Risk Based Assessment of Functionality• Creating and importing
documents (M) • Editing content and
properties (M)• Searching for documents (H)• Copying documents (M)• Viewing documents (H)• Printing documents
• Controlled (H)• Uncontrolled (L)
• Reviewing & annotating documents (M)
• Approving documents (H)
• Processing To Be Read notifications (H)
• Making approved documents effective (H)
• Creating change requests (M)• Reviewing & approving change
requests (H)• Obsoleting a document (H)• Performing periodic review (H)• Building document relationships (L)• Exporting documents (L)• Setting and enforcing security (H)• Electronic signatures and records
(H)• Capturing and displaying audit trails
(H)
Approach to Validation Based on Predicate Rules• If the Amadeus eQCM ECM repository is used for
managing quality SOPs and compliance processes…• Validate the use of SOPs because of the GMP predicate rule, 21
CFR Part 820.• Validate the CAPA system because of GMP predicate rule , 21 CFR
820.100If there is no FDA predicate rule with respect to the type of documents to be validated, do not validate.
Agenda
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked
Questions• Validating Applications• References• Questions
When is a Computerized System Required to be Validated?
• It depends on your requirements and how you interpret the regulations under which your system will function
• Validation is typically required when the system:• Affects product safety, identity, strength, efficacy, or quality• Contains information that is:
• Submitted to, or provided for, a regulatory agency in accordance with the predicate rules
• Used to demonstrate compliance with government regulations• Used by healthcare professionals to obtain a professional opinion that
would influence the use of a product• Provided to patients or the public to dictate the use of the product
What is a Validation Plan?
• A document, which describes the overall strategy and responsible parties for validating a system within its operating environment. (FDA)• The FDA does not tell you how to validate a computerized system.• The validation plan describes how you intend to validate the
system. • The FDA will hold you accountable for following the processes and
developing the deliverables described in the project-specific validation plan.
What Happens if I did not Follow the Validation Plan?• You must revise and re-approve the validation plan to
reflect your actual processes, or• You must document a project deviation, which
summarizes the issue and rationale, and include it in the validation summary report.
How can I Validate a System that is already in Production?• Take a “retrospective” validation approach
• Similar to validating an off-the-shelf product with little vendor knowledge
• Consider specific system circumstances (e.g. how long in production) and develop an appropriate validation plan
• Thoroughly document any assumptions in your validation plan
What Happened to the OQ & PQ Validation Phases?• The FDA’s General Principles of Software Validation
states:“While IQ/OQ/PQ terminology has served its purpose well and is one of many legitimate ways to organize software validation tasks at the user site, this terminology may not be well understood among many software professionals, and it is not used elsewhere in this document.”
• “Operational Qualification” is equivalent to “System Testing”
• “Performance Qualification” is equivalent to “User Acceptance Testing”
What User Roles Participate in Validation Activities?
Application Architecture RepresentativeAuditing LeadBusiness/System OwnerBusiness Process LeadBusiness Support RepresentativeChange Request ApproverChange Request OriginatorCIT RepresentativeDeveloperDevelopment LeadEnd-UserInfrastructure Representative
Project ManagerQuality Assurance LeadRelease ManagerSubject Matter ExpertSystem AdministratorTechnical ArchitectTechnical LeadTechnical Support RepresentativeTesting LeadTraining LeadValidation AnalystsValidation Lead
What Validation Deliverables are Produced?
Validation Master PlanRisk Assessment ReportVendor Assessment ReportTraining PlanUser Requirements SpecificationSystem Requirements SpecificationProject GlossaryTechnical Architecture SpecificationDetailed Design SpecificationsCode Review Forms (only if customized)
Unit, Integration, System and User Acceptance Test
PlanScriptsReportsTest Incident Reports
Validation Summary ReportData Migration PlanSystem Release MemoChange Request FormPeriodic Review ReportBusiness Continuity PlanStandard Operating ProceduresTraining Records
Agenda
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked Questions• Validating Applications• References• Questions
Using a GAMP-4 Validation Methodology
Actionable Intelligence For Compliance
Actionable Compliance Intelligence Delivered
Agenda
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked Questions• Validating Applications• References• Questions
References• Code of Federal Regulations, Title 21, Part 11, Electronic Records; Electronic
Signatures• GAMP Guideline for the Validation of Automated Systems Version 4 (ISPE,
2001)• General Principles of Software Validation; Final Guidance for Industry and
FDA Staff, 11-Jan-2002• Guidance for Industry, Part 11, Electronic Records; Electronic Signatures –
Scope and Application, August 2003• IEEE Std 1008-1987, IEEE Standard for Software Project Management Plans • IEEE Std 1012-1998, IEEE Standard for Software Verification and Validation,
9-Mar-1998• IEEE Std 1012a-1998, Supplement to IEEE Standard for Software
Verification and Validation: Content Map to IEEE/EIA 12207.1-1997• IEEE Std 1028-1997 (R2002), IEEE Standard for Software Reviews• IEEE Std 1044-1993 (R2002), IEEE Standard Classification for Software
Anomalies• IEEE Std 1063-2001, IEEE Standard for Software User Documentation, 20-
Dec-2001
References• IEEE Std 1219-1998, IEEE Standard for Software Maintenance• IEEE Std 1233,1998, IEEE Guide for Developing System Requirements
Specifications, 8-Dec-1998• IEEE Std 1471-2000, IEEE Recommended Practice for Architectural
Description of Software Intensive Systems• IEEE Std 610.12-1990 (R2002), IEEE Standard Glossary of Software
Engineering Terminology• IEEE Std 828-1998, IEEE Standard for Software Configuration Management
Plans• IEEE Std 829-1998, IEEE Standard for Software Test Documentation• IEEE Std 830,1998, IEEE Recommended Practice for Software Requirements
Specifications, 25-Jun-1998• IEEE Std. 1016-1998, IEEE Recommended Practice for Software Design
Descriptions• ISO 14971:2000(E), Medical Devices – Application of Risk Management to
Medical Devices, ISO, 2000.
Agenda
• Introduction• Key Terms• Regulatory Requirements• Validation Overview• Best Practice Responses to Frequently Asked Questions• Validating Applications• References• Questions
FSA -SYSC
GLBA
Sarbanes-Oxley
21 CFR Part 11
NARA Part 1234
HIPAA
eSign Act
SEC 17a-4
DoD 5015.2
ISO 15489-1
Common Criteria
BSI DISC PD 0008:1999
Basel II
Data Protection Act of 1998
Freedom of Information Act of 2000
The National Archive (TNA)
UK Metadata Framework
DICOM
Dublin Core
SEC 17a-3
FERC Part 125NASD 3010
US Patriot Act
Rev. Proc 97-22
ISO 15489-2
MoReqCRFB - France
BaFin – Germany
Current Global Regulations