A Road Map to COTS CSV HPLC 1

A Road Map to COTS CSV, HPLC 1 A Road Map to COTS Computer System Validation based on a HPLC, as example Ulf Segerstéen Pharma Quality Europe AB Quality PQE Information Technology Pharmaceuticals SARQ, 3 rd of October, 2002 PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 2 21 CFR Part 11 effective Incipit requires. . Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records (§ 11. 10(a)) …. The Bar is being raised COMPLIANCE NEW Quality PQE Information Technology Pharmaceuticals PART 11 COMPLIANCE STD CSV COMPLIANCE NEW STD ER ER NEW CSV COMPLIANCE OLD STD NO ER PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 3 Guidance Content: GUIDANCE KEY ELEMENTS n. System Requirements Specifications (5. 1) n. Documentation of Validation Activity (5. 2) n. Equipment Installation (5. 3) n. Dynamic Testing (5. 4) n. Static Verification Techniques (5. 5) n. Extent of Validation (5. 6) n. Independence of Review (5. 7) n. Change Control (5. 8) n SPECIAL CONSIDERATIONS: COTS products and Internet n CFR 21 P 11 GUIDANCE Example of Guidance: Independence of Review Computer system validation should be performed by persons other than those responsible for building the system. Two approaches to ensuring an objective review are: (1) Engaging a third party (2) dividing the work within an organization such that people who review the system (or a portion of the system) are not the same people who built it. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 4 COTS (Commercial Off-The Shelf) products CFR 21 P 11 GUIDANCE Commercial software used in electronic record keeping system subject to part 11 needs to be validated, just as programs written by end users need to validated (…) We do not consider commercial marketing alone to be sufficient proof of a program’s performance suitability (…) See 62 Federal Register 13430 at 1344 -13445 March 20, 1997 WRONG APPROACH SYSTEM IS A COMMERCIAL PACKAGE, WIDELY USED RIGHT APPROACH SYSTEM IS A COMMERCIAL PACKAGE, WIDELY USED IT’S OK. NOT NEED TO BE VALIDATED END USER REQ SPECS SW STRUCTURAL INTEGRITY FUNCTIONAL SW TESTING Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 5 New Trend - Partnership by-Outsourcing Validation Activities What’s in it for the Customer ? • Staying focused on his business - be more cost-effective. • Staying on top of the requirements - stay compliant rather than spending time solving regulatory issues. • Sharing the latest knowledge - don’t be active in all fields and save time for the core business. • Being prepared for what’s to come - get resources when needed, don’t let them be an added cost to the Products. • Being part of the solution NOT part of the problem - give the organization confidence to handle changes and challenges. • Always having access to a Partner to discuss and solve issues with. What’s in it for the Partner ? • Client staying focused on his business makes easier for the Partner to support him. • Client staying updated on the requirements gives the Partner flexibility to act more proactively. • Sharing the latest knowledge makes the Client and the Partner understand each other, reducing misunderstandings and increasing efficiency. • Being prepared for what is to come helps the Partner to keep prices down and gives the Client more accurate budget control. • Being part of the solution, NOT part of the problem, helps both parties in solving and anticipating potential problems. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 6 The Lifecycle Activities for a COTS, using a Project perspective: SPECIFY PLAN TO BE PROACTIVE TEST START UP CONTROL SUPPORT & IMPROVE Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 7 The Lifecycle Activities for a COTS, cont. SPECIFY TEST URS (PROCESS) PROCESS Q EVALUATION FAT & SAT VALIDATION PLAN TEST PLAN MASTER INDEX (MI) DRAFT SOP’s Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it START UP USER GUIDE SYSTEM ORG. & DOC’s VALIDATION REPORT SOP’S (Approved)

A Road Map to COTS CSV, HPLC 8 The Lifecycle Activities for a COTS, cont. User Requirement Specification based on: • the lab Process including the HPLC-equipment, HWplatform, SW-application, printer, expected filestorage and user interactions. SPECIFY • requirements for compliance to CFR 21 Part 11 (ER & ES) and other applicable Gx. P regulations URS (PROCESS) EVALUATION VALIDATION PLAN MASTER INDEX (MI) CFR 21 P 11 GUIDANCE • testable requirements It is important that your end user requirements specifications take into account • predicate rules • part 11 • and other needs unique to your system that relate to ensuring • record authenticity • integrity • signer non-repudiation • and, when appropriate, confidentiality. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 9 CFR 21 P 11 GUIDANCE COTS End User Requirements Specifications End users should document their requirements specifications relative to part 11 requirements and other factors, as discussed above. Pharma Industry Define what you need (all factors) Define what predicate rule needs Define what Part 11 needs User Requirements Specifications Quality Assurance ______ System Owner _____ March, 2002 Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 10 The Lifecycle Activities for a COTS, cont. SPECIFY URS (PROCESS) EVALUATION Evaluation based on: • the CS fulfilling the Process that it is to be used within. • Risk Assessment Index, based on complexity of the CS and on the criticality for failure during the process. RISK MANAGEMENT=RISK APPROACH+RISK ACTIVITIES • the Suppliers expected role, process and responsibilities VALIDATION PLAN during the Project for developing + testing (FAT), installing and testing at the customers site (SAT), supporting the CS over time MASTER INDEX and license agreements. (MI) • fulfillment of compliance to CFR 21 Part 11 (ER & ES) and other valid Gx. P regulations • referenced other Pharmaceutical customers using the system. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 11 The Lifecycle Activities for a COTS, cont. Evaluation of WHAT approach to take: GOLDEN RULE PROCESS CRITICALITY DATA COMPLEXITY SYSTEM CATEGORY VALIDATION EFFORT SHOULD BE MAXIMUN FOR HIGH CRITICAL AND COMPLEX SYSTEMS. EFFORT MIGHT BE REDUCED THROUGH AUDITS IN CASE OF SW STANDARDS Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 12 Criticality Assessment • High Software application whose features and functions have a direct impact on the quality, performance and efficacy of drug products • Medium Software used for business process analysis, information and documentation systems that poses some business risk, or can have an indirect impact on drug products • Low Packaged Software used for business purposes that poses no business risk Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 13 Risk Assessment Evaluation The Risk Assessment Index (RAI) is a rationale to evaluate the criticality and complexity of computerized systems. • • System Complexity is higher when system: · Performs detailed algorithm or calculations · Interfaces with other computerized systems · performs extensive data input checking · processes numerous types of transactions · requires extensive support to be maintained · involves a large number of users Gx. P Criticality is an index of the impact of the system on pharmaceutical product or on raw data safety and traceability System Complexity RAI definition Gx. P Criticality (see next page) Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 14 Risk Assessment Evaluation …that brings to RAI definition: Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 15 RAI used for evaluating HOW to perform the Supplier Evaluation RISKS EVALUATION THROUGH REFERENCES RAI=0 -2 EVALUATION THROUGH EXPERIENCES RAI=5 -6 RAI=3 -4 REQUEST FOR INFORMATION RAI=7 -8 3 RD PARTY AUDIT RAI=9 SPECIFIC FIRM AUDIT COSTS Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 16 CFR 21 P 11 GUIDANCE COTS Functional Testing of SW dependent on Supplier Documentation available When the end user cannot directly review the program source code or development documentation more extensive functional testing might be warranted than when such documentation is available to the user. DEVELOPMENT DOCS REDUCE VALIDATION EFFORT Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 17 The Lifecycle Activities for a COTS, cont. SPECIFY Validation Plan based on: • Validation Strategy which is based on the Evaluation. • available Validation Methods, Tools and knowledge URS (PROCESS) • a Validation Process that are documented as a matrix of all Validation Activities (VA), based on RAI that are expected to EVALUATION be executed for a HPLC (COTS). Rational given for VA’s that are not to be performed. Correspondent User roles in the Project VALIDATION PLAN and Supplier roles to these activities in the project are used in the same matrix. MASTER INDEX (MI) • statement for compliance to CFR 21 Part 11 (ER & ES) and other valid Gx. P regulations • required Supplier-, System Documentation and User Organization and SOPs for supporting and maintaining the CS. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 18 Project Documentation • User Requirements R E A L I Z E Validation Documentation • Validation Plan • Validation Protocols and Records • Validation Report Maintenance Documentation • Registration • Support Agreements for HW and SW • SOP´s Master Index (MI) O P E R A T E Escrow User Documentation Quality PQE Information Technology Pharmaceuticals Validation Documentation Change Control Documents Backup Log PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it IQ Log Periodic Review

A Road Map to COTS CSV, HPLC 19 The Lifecycle Activities for a COTS, cont. SPECIFY TEST Prerequisites to move to Test phase: URS (PROCESS) Reviewed and Approved URS EVALUATION Approved EVALUATION REPORT VALIDATION PLAN Reviewed and Approved VALIDATION PLAN MASTER INDEX (MI) Standard Index produced for all documents Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 20 TESTING IS THE KEYSTONE OF THE VALIDATION PROCESS. . . TESTING VAL PLAN SOPs VAL REPORT INDEPENDENCE FROM DEVELOPMENT CFR 21 P 11 GUIDANCE USR FSP Tests should include not only “normal or “expected” values, but also stress conditions. Test conditions should extend to • boundary values, • unexpected data entries, • error conditions, • reasonable challenges, • branches, • and combinations of inputs. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 21 The perfect path …. . PROGRAM BUILD TESTING This testing is performed on units of modules, integrated units of code and the program as a whole. STRUCTURAL TESTING This testing takes into account the internal mechanism of a system or component (white box testing). Structural testing should show that the software creator followed contemporary quality standards. This testing usually includes inspections of the program code and development documents. Quality PQE Information Technology SYSTEM TEST FAT/ SAT FUNCTIONAL TESTING This testing involves running the program under known conditions with defined inputs and documented outcome that can be compared to pre-defined expectations (“black box” testing) Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it OQ/PQ

A Road Map to COTS CSV, HPLC 22 Life & Test Cycle Model: URS User Requirement Specification Performance/Process Qualification Risk Analysis S Functional Specification U P Risk Analysis P L Design Specification I E R Quality PQE Information Technology Pharmaceuticals Operation Qualification Installation Qualification Source Code / Source Code Testing PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 23 The Lifecycle Activities for a COTS, cont. TEST Test Plan based on: • Validation Plan and RAI of the CS. • FAT, which would include review of Supplier Evaluation, Test, System & User documentation from the Supplier PROCESS Q FAT & SAT TEST PLAN DRAFT SOP’s • SAT, which would include witness during IQ and OQ on site together with Supplier. These tests should normally include test for compliance to CFR 21 Part 11. • PROCESS QUALIFICATION, which would include performing the complete lab process as required by URS and User Guide, should also include CS Administration tests. • DRAFT SOPs could be in one document for this type of systems and should be available at PQ. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 24 The Lifecycle Activities for a COTS, cont. TEST START UP Prerequisites to move to Start Up phase: PROCESS Q FAT & SAT Reviewed and Approved PROCESS Q based on DRAFT versions of the User Guide and SOP’s Approved FAT & SAT REPORT TEST PLAN Reviewed and Approved TEST PLAN DRAFT SOP’s Filed in the Master Index (MI) Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 25 The Lifecycle Activities for a COTS, END START UP: THROUGH CS DECISION based on: USER GUIDE approved and Users trained SYSTEM ORG. & DOC’s VALIDATION REPORT SYSTEM ORGANISATION trained on CS and System Documentation available. VALIDATION REPORT, no remaining corrections, all documents in MI approved. SOP’S (Approved) (included in MI) Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 26 Example of a Validation Tool to a COTS TOOL REUSABLE VALIDATION TOOL 1 -CS Req. & SOP 2 -Validation Plan & Report 3 -Test Plan & Report 4 -Validation Plan & Report APPENDIX 1 -CS Req. & SOP: • URS/FS/DS and user guide • Training • CS Security and authorization (incl. Backup and Contingency) • Maintenance • Change Control • Periodic Review 2 -VALIDATION P&R Matrix with: • Activities incl. CFR 21 Part 11 -declaration • Responsibility • Expected Output 4 -Validation Report • Reported Output • Deviations • Summary • Approval/Rejection 2 -Test Plan & Report Ver. 1 Matrix with: • Test case • Expected Result 4 -Test Plan & Report Ver. 2 • Reported Result • Deviations/Re-test • Summary & Recommend. Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 27 Effort Saving Effort by “Reusing” the Tool Effort Save PQE Information Technology A Quality pp Cri lic tic at al io ns Infrastructure Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 28 Finally: To be in Compliance means: Coordination (Policy & Standards) Cooperation (sharing knowledge & support) Capacity (make realistic Plans for big changes) Competence (get trained to gain competence) Consistency (use same measurements & tools) Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it

A Road Map to COTS CSV, HPLC 29 We envision to conveniently engineer innovative technology in order to synergistically facilitate value-added leadership skills to stay competitive in tomorrow's world Dilbert Quality PQE Information Technology Pharmaceuticals PHARMA QUALITY EUROPE / www. pqe. it / u. segersteen@pqe. it