1925 West Field Court, Suite 125, Lake Forest, IL 60045 Validation Center™praxislifesciences.com | +1(847) 295-7160 validationcenter.com
Software Quality Regulatory Trends
By Praxis Life Sciences
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 1
Software Quality Regulatory Trends© Copyright 2016 by Praxis Life Sciences. All rights reserved. No part of these materials may be reproduced or transmitted in any form without the written permission of Praxis.
v.17.01
Your Praxis Facilitator
Validation Center™ © 2016 Praxis Life Sciences 2
• Debra Bartel, MBA, CQA, PMP
• Principal, Praxis Life Sciences
• 25+ years experience specializing in software quality assurance, validation and regulatory compliance, Information Systems project management, and process design.
• Prior to joining Praxis, held management positions in the pharmaceutical industry in both Quality Assurance and Information Systems organizations
• Active member of American Society for Quality (ASQ), Northeastern Illinois Section, Software Division
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 2
Intro to Praxis Life Sciences
Validation Center™ © 2016 Praxis Life Sciences 3
Follow us!
Target Audience
• Pharmaceutical & Biologics• Medical Device• Clinical Studies• Blood Products
Industries
• Operating in the US• Selling to the US MarketRegions
• IT Personnel and Managers• Software Quality Personnel and
Managers• Software Testers and Protocol Writers
Personnel
© 2016 Praxis Life Sciences 4PraxisLifeSciences.comValidation Center™
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 3
Webinar Outline
Validation Center™ © 2016 Praxis Life Sciences 5
• Applicable Regulations and Guidance• Recent and Approaching Change1
• FDA Enforcement Statistics2
• FDA Enforcement Analysis3
• FDA Enforcement Trends4
• Recent FDA Warning Letters 5
PraxisLifeSciences.com
Applicable Regulations and GuidelinesPart 1
Recent and Approaching Changes
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 4
Part 1: Regulations, Guidelines, & Changes
Section Overview
– Sources of Regulations & Guidelines:• FDA
• ICH
• Eudralex
• PIC/s
• WHO
– Changes Highlights• Changes implemented in 2014 - 2016
• Changes pending
• Flagged with symbol
© 2016 Praxis Life Sciences 7PraxisLifeSciences.comValidation Center™
Framework for Regulations, Guidelines
Validation Center™ © 2016 Praxis Life Sciences 8
Part 1 will address the key places to look for regulations and guidelines related to
computer systems and software
Software Quality Assurance, Validation, and Information Technology professionals operate in an ever changing
regulatory environment.
It can be difficult to find the time to monitor the US and international information to be aware of new regulations,
guidance documents, and enforcement trends.
21 CFR 58 Good
21 CFR 210,211, 820, 606 Good Manufacturing Practices
21
CF
R 1
1E
lec
tro
nic
Re
co
rd
21
CF
R 5
0, 5
4,
ICH E6 Good Clinical Practice ICH Q7 Good Manufacturing Practice
ICH Q9 Quality Risk Management
Eu
dra
lex
V4
Ch
ap
ter
4 D
oc
um
en
tati
on
Eu
dra
lex V
4 A
nn
ex 1
1
Eu
dra
lex
V4
An
ne
x 15
Qu
alific
ation
an
d V
alid
ation
FDA Guidance: Computerized Systems Used in Clinical InvestigationsFDA Guidance: Gener
FDA Guidance: Validation of Blood Establishment Computer Systemsal P
rinciples of S
oftware V
alidation
Computerised Systems
56 Good Clinical Practices
La
bo
rato
ry P
rac
tic
es
& Signatures
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 5
Framework for Regulations, Guidelines
Validation Center™ © 2016 Praxis Life Sciences 9
Regulations (Laws)FDA 21 CFR ….
Eudralex Volume …
ICH Guidelines
FDA Guidance & Reference Documents
PIC/SGuidance Documents
GAMPGuides(ISPE)
ISOStandards
etc.
Company policies & procedures
influences
EMAReflection
Papers
Regulations (Laws)FDA 21 CFR ….
Eudralex Volume …
ICH Guidelines
Company policies & procedures
Framework for Regulations, Guidelines
Validation Center™ © 2016 Praxis Life Sciences 10
FDA Guidance & Reference Documents
PIC/SGuidance Documents
GAMPGuides(ISPE)
ISOStandards
etc.
influences
EMAReflection
Papers
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 6
FDA: General
Validation Center™ © 2016 Praxis Life Sciences 11
Electronic Records; Electronic Signatures
Scope:General electronic records and signature requirements for electronic records
• created, modified, maintained, archived, retrieved, or transmitted, under any FDA records requirements
• submitted to the FDA
Includes topics such as electronic record and signature validation, record protection, audit trails, training, documentation, change control, passwords
199721 CFR 11
FDA: General
Validation Center™ © 2016 Praxis Life Sciences 12
Scope:• Software in medical devices• Blood establishment software• Software in manufacturing equipment• Software used to support the quality system
Provides an integrated approach to software validation and risk management.
General Principles of Software Validation 2002Guidance
Electronic Records; Electronic Signatures 199721 CFR 11
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 7
FDA: General
Validation Center™ © 2016 Praxis Life Sciences 13
2003
Provides a better explanation of the scope of records included in Part 11
Explains which parts of Part 11 the FDA intends to enforce vs. where the FDA plans to use “enforcement discretion” while re-examining the Part 11 regulation
Refers the reader to “General Principles of Software Validation” for validation guidance.
Part 11, Electronic Records; Electronic Signatures – Scope and Application
Guidance
General Principles of Software Validation 2002Guidance
Electronic Records; Electronic Signatures 199721 CFR 11
FDA: General
Validation Center™ © 2016 Praxis Life Sciences 14
FDA’s manual for ORA lab analysts contains a chapter on spreadsheet validation.
2003FDA Office of Regulatory Affairs Laboratory ManualReference
2003Part 11, Electronic Records; Electronic Signatures – Scope and Application
Guidance
General Principles of Software Validation 2002Guidance
Electronic Records; Electronic Signatures 199721 CFR 11
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 8
FDA: General
Validation Center™ © 2016 Praxis Life Sciences 15
Posted on the FDA web site in July, 2010
FDA: Pharmaceutical
Validation Center™ © 2016 Praxis Life Sciences 16
Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General
Current Good Manufacturing Practice for Finished Pharmaceuticals
FDA ORA Guide to Inspection of Computerized Systems in Drug Processing
21 CFR 210
21 CFR 211
Reference
Scope:• Preparation of drug products for humans or animals
CFR 211 Provides requirements for:• Controls of computer systems• Change control
The ORA document gives insight to questions that FDA auditorssometimes ask
• Validation• Back-ups
• Record content, management,and retention
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 9
FDA: Medical Devices
Validation Center™ © 2016 Praxis Life Sciences 17
Quality System Regulation
Off-The-Shelf Software Use in Medical Devices
Contents for Premarket Submissions for Software Contained in Medical Devices
21 CFR 820
Guidance
Guidance
Scope:• Design, manufacture, packaging, labeling, storage, installation, and servicing of
all finished medical devices intended for human use.
CFR 820 provides requirements for:• Design controls• Automated processes
The Guidance documents provide additional recommendations for device software topics such as documentation, risk assessment & management, change management, virus protection and networks.
• CAPA• Validation
• Record content, management, and retention
FDA: Medical Devices
Validation Center™ © 2016 Praxis Life Sciences 18
Design Considerations for Devices Intended for Home UseGuidance
Interesting Contents:• Recommended practices to mitigate the unique risks of home use medical devices. • Recommended Design Controls for home use medical devices• Brief discussion regarding best practices for software design, testing, and
upgrades.
2014
Mobile Medical AppsGuidance
Interesting Contents:• Definitions of Mobile Medical Apps• Regulations that apply to Mobile Medical Apps• Examples of apps that are Mobile Devices• Examples of apps that are not Medical Devices
2015
General Wellness: Policy for Low Risk DevicesGuidance
Interesting Contents:• FDA compliance policies for devices that promote healthy life styles• Examples of low-risk wellness devices
2016
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 10
FDA: Medical Devices
Validation Center™ © 2016 Praxis Life Sciences 19
Contents of Premarket Submissions for Management of Cybersecurity in Medical Devices
Guidance
Interesting Contents:• Design and development considerations to ensure cybersecurity• Recommendations regarding hazard analyses, trace matrices, risk mitigation and technical measures, such as user authentication, code authentication, and detection of security breaches
Medical Device Data Systems, Image Storage Devices, and Image Communications Devices
Guidance
Interesting Contents:• FDA intention to not enforce regulatory controls to devices classified as Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communication Devices
• Definitions and examples of the categories of devices listed above.
2014
2015
FDA: Biological Products
Validation Center™ © 2016 Praxis Life Sciences 20
Biological Products: General
Scope:• Manufacture, inspection, and adverse event reporting for any virus, therapeutic serum, toxin, antitoxin, or analogous product applicable to the prevention, treatment or cure of diseases or injuries of man
Provides requirements for:• Record types, content, management and retention• Computer generated vaccine adverse event reporting system forms
21 CFR 600
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 11
FDA: Blood & Components
Validation Center™ © 2016 Praxis Life Sciences 21
Current Good Manufacturing Practice for Blood and Blood Components
Scope:• Manufacture of blood and blood products
CFR provides requirements for:• Record content, management and retention
21 CFR 606
FDA: Blood & Components
Validation Center™ © 2016 Praxis Life Sciences 22
Guidance provides FDA recommendations for:• Software vendor selection• System documentation and records• Contents of Validation Plans and Validation Reports• Validation scope• System risk assessments• Validation procedures and activities• Validation after changes
Blood Establishment Computer System Validation in the User’s Facility
Guidance
Changes to an Approved Application: Biological Products: Human Blood and Blood Components Intended for Transfusion or for Further Manufacture
Guidance2014
Guidance provides FDA recommendations for:• Reporting changes associated with various types and uses of
Blood Establishment Computer Software (BECS)
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 12
FDA: Human Based Products
Validation Center™ © 2016 Praxis Life Sciences 23
Human Cells, Tissues, and Cellular and Tissue-Based Products
Scope:• Creation of a unified registration and listing system for establishments that
manufacture human cells, tissues, and cellular and tissue-based products (HCT/P's) and to establish donor-eligibility, current good tissue practice, and other procedures to prevent the introduction, transmission, and spread of communicable diseases by HCT/P's.
Provides requirements for:• Computer validation• Record content, management and retention
Requires compliance to 21 CFR 211 for HCT/Ps that are drugs and 21 CFR 820 for HCT/Ps that are medical devices.
21 CFR 1271
Current Good Tissue Practice (CGTP) and Additional Requirements for Manufacturers of Human Cells, Tissues, and Cellular and Tissue-Based Products (HCT/Ps)
Guidance
FDA: Clinical Studies
Validation Center™ © 2016 Praxis Life Sciences 24
Protection of Human Subjects
Scope:• Clinical investigations regulated by the FDA, including drugs, medical devices,
biological products, dietary supplements, infant formulas, and food & color additives
CFR 50 & 56 provide requirements for:• Record content, management, and retention
Institutional Review Boards
21 CFR 50
21 CFR 56
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 13
FDA: Clinical Studies
Validation Center™ © 2016 Praxis Life Sciences 25
Computerized Systems Guidance provides:• Recommendations on topics such as SOPs, record retention formats, system
security, audit trails, system controls, user training, and system documentation
Source Data Guidance provides:• Recommendations on topics such as electronic source data capture, electronic
data review, retention of records by clinical investigators, and access to electronic source data
Computerized Systems Used in Clinical InvestigationsGuidance
Electronic Source Data in Clinical InvestigationsGuidance
FDA: Nonclinical Labs
Validation Center™ © 2016 Praxis Life Sciences 26
Good Laboratory Practice for Nonclinical Laboratory Studies
Scope:• Conduct of nonclinical laboratory studies to support applications forresearch or marketing permits for FDA regulated products, such as drugs,biological products, medical devices, and food & color additives
Provides requirements for:• Record content, management and retention
This regulation includes computer data in its definition of “raw data”. Requirements for generation, management, storage, retention, and protection of raw data are found throughout the document.
21 CFR 58
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 14
Regulations (Laws)FDA 21 CFR ….
Eudralex Volume …
ICH Guidelines
Company policies & procedures
ICH
Validation Center™ © 2016 Praxis Life Sciences 27
FDA Guidance & Reference Documents
PIC/SGuidance Documents
GAMPGuides(ISPE)
ISOStandards
etc.
influences
EMAReflection
Papers
ICH Members
Validation Center™ © 2016 Praxis Life Sciences 28
ICH members include the• Japanese Ministry of Health, Labour and Welfare (MHLW)• Japanese Pharmaceutical Manufacturers Association (JPMA)• European Union (EU)• European Federation of Pharmaceutical Industries and Associations (EFPIA)• US Food and Drug Administration (FDA)• US Pharmaceutical Research and Manufacturers of America (PhRMA)• Observers from
• Canada • World Health Organization (WHO)
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 15
ICH: Clinical Studies
Validation Center™ © 2016 Praxis Life Sciences 29
Guideline for Good Clinical Practice
Scope:• Responsibilities and expectations of all participants in the conduct ofclinical trials, including investigators, monitors, sponsors and IRBs.
Provides computer system guidelines for:• Record content, management and retention• Audit trails• Validation• SOPs• Security• Back-ups
E6
ICH: API Manufacturing
Validation Center™ © 2016 Praxis Life Sciences 30
Scope:• Good manufacturing practice (GMP) for the manufacturing of active pharmaceutical ingredients (APIs). “Manufacturing” is defined to include all operations of receipt of materials, production, packaging, repackaging, labeling, relabeling, quality control, release, storage and distribution.
Provides computer system guidelines for:• Record content, management and retention• Audit trails• Validation and qualification• Record protection• Incident investigation
Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients
• SOPs• Security• Back-ups• Change control
Q7
2016
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 16
ICH: Quality Risk
Validation Center™ © 2016 Praxis Life Sciences 31
Scope:• Principles and examples of tools of quality risk management that can beapplied to all aspects of pharmaceutical quality including development,manufacturing, distribution, and the inspection and submission/reviewprocesses throughout the lifecycle of drug substances, drug products,and biological and biotechnological products
This guideline provide examples of how risk management concepts can be applied to computer system design and validation.
Quality Risk ManagementQ9
Regulations (Laws)FDA 21 CFR ….
Eudralex Volume …
ICH Guidelines
Company policies & procedures
European Union
Validation Center™ © 2016 Praxis Life Sciences 32
FDA Guidance & Reference Documents
PIC/SGuidance Documents
GAMPGuides(ISPE)
ISOStandards
etc.
influences
EMAReflection
Papers
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 17
European Union Members
Validation Center™ © 2016 Praxis Life Sciences 33
European Union members include
AustriaBelgiumBulgariaCroatiaCyprusCzech RepublicDenmark
EstoniaFinlandFranceGermanyGreeceHungaryIreland
ItalyLatviaLithuaniaLuxembourgMaltaNetherlandsPoland
PortugalRomaniaSlovakiaSloveniaSpainSwedenUnited Kingdom*
* In June 2016, the UK citizens voted to leave the EU
Eudralex: Computerised Systems
Validation Center™ © 2016 Praxis Life Sciences 34
Annex 11 provides additional rules for computer systems
Topics include:• Validation • System documentation• System placement• Training
Status:A new version went into effect on June 30, 2011
NOTE: Adopted by PIC/S in 2014
Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use
Computerised Systems
• Security and access• Audit Trails• Change control• Back-ups
Volume 4
Annex 11
• Alternate procedures for useduring system down time
• Error analysis and correction• Outside service providers
2014
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 18
Eudralex: Qualification & Validation
Validation Center™ © 2016 Praxis Life Sciences 35
Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use
Qualification and Validation
Annex 15 provides additional rules for qualification and validation
Validation topics include:• Planning (VMPs)• Documentation• Change control• Revalidation
• Qualification of •Design• Installation•Operation•Performance
Volume 4
Annex 15
2015
Eudralex: Quality Risk
Validation Center™ © 2016 Praxis Life Sciences 36
Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use
Quality Risk Management
Scope:Based on ICH Q9, Quality Risk Management.Principles and examples of tools of quality risk management that can beapplied throughout the lifecycle of drug substances, drug products, and biological and biotechnological products.
Computer System topic:Includes areas where risk management principles can be applied. E.g., software design, selection, verification, and validation
Volume 4
Annex 20
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 19
Eudralex: Clinical Studies
Validation Center™ © 2016 Praxis Life Sciences 37
Clinical Trial Guidelines
Inspections
Scope:Guide for GCP inspectors to use during inspections related to clinical trials
Status:In effect. Version dated May 28, 2008.Minor correction to scope was made in September, 2012.
Guidance for the Conduct of GCP Inspections –Computer Systems
Volume 10
Chapter IV
Annex III
Eudralex Volume 10, Chapter IV, Annex IIIConduct of GCP Inspections – Computer Systems
Eudralex: Clinical Studies
Validation Center™ © 2016 Praxis Life Sciences 38
“The EU GCP inspectors agreed to use as the reference for inspection of Computer Systems the published PIC/S Guidance on Good Practices for
Computerized Systems in “GXP” Environments (PI 011-3)”
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 20
EC: Distribution
Validation Center™ © 2016 Praxis Life Sciences 39
Good Distribution Practice of Medicinal Products for Human Use
Guidelines
This document outlines GDP (good distribution practice) expectations for computer system topics such as:
• Validation for computer systems used to segregate product prior to use• Security • System documentation• Back-ups• Data retention• Procedures for addressing system failures.
EC: Distribution
Validation Center™ © 2016 Praxis Life Sciences 40
Principles of Good Distribution Practice of ActiveSubstances for Medicinal Products for Human Use
Guidelines
This document outlines GDP (good distribution practice) expectations for importers and distributors of APIs. Computer system topics include:
• Requirements for electronic documentation• Use of systems to segregate damaged, falsified, and expired product• Validation of Warehouse Management Systems
2015
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 21
EMA: Clinical Studies
Validation Center™ © 2016 Praxis Life Sciences 41
Expectations for Electronic Source Data & Data Transcribed to Data Collection Tools in Clinical Trials(In effect as of August 1, 2010)
Reflection Paper
This document outlines GCP (good clinical practice) inspectors’ expectations for computer system topics such as:
• Validation• SOPs for system use• Audit trails• Backups• System security• Data safeguards• User training• Record archival
EMA: Clinical Studies
Validation Center™ © 2016 Praxis Life Sciences 42
Reflection Paper for Laboratories that Perform the Analysis or Evaluation of Clinical Trial Samples (Adopted February 28, 2012)
Key Sections for Software and Computer Systems
• 5.0 – Definitions of “Computerised System” and “Validation of a Computerised System”
• 6.16 - Expectations for computer validation, documentation, interfaces, upgrades, patches, risk assessment, re-validation, location, administration, access rights, and disaster recovery
• 6.17 - Expectations for audits of computer validation documentation
• 6.19 - Expectations for SOPs on computer system installation, validation, and maintenance
Reflection Paper
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 22
PIC/S
Validation Center™ © 2016 Praxis Life Sciences 43
FDA Guidance & Reference Documents
PIC/SGuidance Documents
GAMPGuides(ISPE)
ISOStandards
etc.
influences
EMAReflection
Papers
Regulations (Laws)FDA 21 CFR ….
Eudralex Volume …
ICH Guidelines
Company policies & procedures
PIC/S Participants
Validation Center™ © 2016 Praxis Life Sciences 44
PIC/S is an international group that provides a harmonized framework for cGXP inspectors
PIC/S Participating Authorities include
PIC/S Partners include
Pharmaceutical Inspection Convention (PIC) and
Pharmaceutical Inspection Co-operation Scheme (PIC Scheme)
ArgentinaAustraliaAustriaBelgiumCanadaChinese TaipeiCroatiaCyprusCzech Republic
DenmarkEstoniaFinlandFranceGermanyGreeceHong KongHungaryIceland
IndonesiaIrelandIsraelItalyJapanKoreaLatviaLiechtensteinLithuania
MalaysiaMaltaNetherlandsNorwayPolandPortugalRomaniaSingaporeSlovakia
SloveniaSouth AfricaSpainSwedenSwitzerlandThailandUkraineUnited KingdomUSA
EME EDQM UNICEF WHO
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 23
PIC/S: Medicinal Products
Validation Center™ © 2016 Praxis Life Sciences 45
Scope:Guide for establishments that manufacture finished pharmaceuticals and active pharmaceutical ingredients.
Status:In effect as of January, 2013.
Annex 11 topics include:• Risk Management• Suppliers & Vendors• Validation• Data Management
PE 009Guide to Good Manufacturing Practices for Medicinal Products
• Audit Trails• Security• Change Control• Periodic Evaluation
• Configuration Management• Incident Management • Electronic Signatures• Business Continuity
Computerised SystemsAnnex 112014
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 46
Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems
Risk Management
Risk management should be applied throughout the lifecycle of the computerised system taking into account patient safety, data integrity and
product quality. As part of a risk management system, decisions on the extent of validation and
data integrity controls should be based on a justified and documented risk assessment of the computerised system.
System InventoryAn up to date listing of all relevant systems and their GMP functionality
(inventory) should be available.
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 24
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 47
Software Suppliers & Service Providers
When third parties (e.g. suppliers, service providers) are used e.g. to provide, install,configure, integrate, validate, maintain (e.g. via remote access), modify or retain acomputerised system or related service or for data processing, formal agreements must
exist between the manufacturer and any third parties, and these agreements should include clear statements of the responsibilities of the third party.
The competence and reliability of a supplier are key factors when selecting a product or service provider. The need for an audit should be based on a risk assessment.
Documentation supplied with commercial off-the-shelf products should be reviewed by regulated users to check that user requirements are fulfilled.
Quality system and audit information relating to suppliers or developers of software and implemented systems should be made available to inspectors on request.
Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 48
Excerpts from Eudralex Volume 4, Annex 11 Computerised Systems
Validation
The validation documentation and reports should cover the relevant steps of the lifecycle. Manufacturers should be able to justify their standards, protocols, acceptance
criteria, procedures and records based on their risk assessment.
Validation documentation should include change control records (if applicable) andreports on any deviations observed during the validation process.
The regulated user should take all reasonable steps, to ensure that the system has beendeveloped in accordance with an appropriate quality management system. The supplier
should be assessed appropriately.
For critical systems an up to date system description detailing the physical and logicalarrangements, data flows and interfaces with other systems or processes, any hardware
and software pre-requisites, and security measures should be available.
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 25
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 49
Validation
User Requirements Specifications should describe the required functions of thecomputerised system and be based on documented risk assessment and GMP impact.
User requirements should be traceable throughout the life-cycle.
Evidence of appropriate test methods and test scenarios should be demonstrated.Particularly, system (process) parameter limits, data limits and error handling should beconsidered. Automated testing tools and test environments should have documented
assessments for their adequacy.
If data are transferred to another data format or system, validation should include checks that data are not altered in value and/or meaning during this migration process.
Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 50
Accuracy Checks
For critical data entered manually, there should be an additional check on the accuracy of the data. This check may be done by a second operator or by validated electronic means.
Data Storage
Data should be secured by both physical and electronic means against damage. Stored data should be checked for accessibility, readability and accuracy.
Access to data should be ensured throughout the retention period.
Regular back-ups of all relevant data should be done. Integrity and accuracy of backupdata and the ability to restore the data should be checked during validation and
monitored periodically.
Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 26
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 51
Change and Configuration Management
Any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure.
Periodic Evaluation
Computerised systems should be periodically evaluated to confirm that they remain in a valid state and are compliant with GMP.
Such evaluations should include, where appropriate, the current range of functionality, deviation records, incidents, problems, upgrade history,
performance, reliability, security and validation status reports.
Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 52
Incident Management
All incidents, not only system failures and data errors, should be reported and assessed.
The root cause of a critical incident should be identified and should form the basis of corrective and preventive actions.
Electronic Signature
Electronic records may be signed electronically. Electronic signatures are expected to:
a. have the same impact as hand-written signaturesb. be permanently linked to their respective record,c. include the time and date that they were applied.
Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 27
PIC/S: Medicinal Products Annex 11
Validation Center™ © 2016 Praxis Life Sciences 53
Business Continuity
For the availability of computerised systems supporting critical processes, provisions should be made to ensure continuity of support for those processes
in the event of a system breakdown (e.g. a manual or alternative system).
The time required to bring the alternative arrangements into use should be based on risk and appropriate for a particular system and the business process
it supports.
These arrangements should be adequately documented and tested.
Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems
PIC/S: Blood Establishments
Validation Center™ © 2016 Praxis Life Sciences 54
Scope:Guide for GMP-inspectors to use during inspections of establishments that collect, prepare, store, dispatch, and/or provide quality control and quality assurance of human blood and blood components.
Provides computer system guidelines for:• Validation • Security and access• Audit trails• Disaster recovery
PE 005Good Manufacturing Practice Guide for Blood Establishments.
• Change control• Back-ups• Special considerations whensystem is used to release results
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 28
PIC/S: Healthcare Establishments
Validation Center™ © 2016 Praxis Life Sciences 55
Scope:Guide for inspectors to use during inspections of healthcare establishments which prepare medicinal products for direct supply to patients.
Provides computer system guidelines for:• Electronic records and documents• Appropriate use of a validated computerized system for verifying
material identity, weight, and volume.
PE 010Guide to Good Practices for the Preparation of Medicinal Products in Healthcare Establishments
PIC/S: Distribution
Validation Center™ © 2016 Praxis Life Sciences 56
Scope:Guide for inspectors to use during inspections to ensure high standards of quality assurance and integrity for distribution of medicinal products.
Provides computer system guidelines for:• Validation for any system providing segregation of products prior to use• Retaining up-to-date, written documentation of systems• Authorization for people who enter or change data• Data protection and retention• Implementation of procedures to be followed in the event of system
failure• Computerized record retention• Specifically required data elements
PE 011 Guide to Good Distribution Practice for Medicinal Products
2014
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 29
PIC/S: Computerised Systems
Validation Center™ © 2016 Praxis Life Sciences 57
Scope:Recommendations for inspectors to use during inspections of computerized systems. “GxP” includes manufacturing, clinical, laboratory, and distribution.
Provides computer system guidelines for:• Validation • System life cycle• Security and access• Audit trails• Supplier assessment• Personnel qualifications
PI 011Good Practices for Computerised Systems Used in Regulated “GXP” Environments
• Change control• Service agreements• Back-ups• Error reporting• Electronic signatures• Training
WHO: Pharmaceuticals
Validation Center™ © 2016 Praxis Life Sciences 58
Scope:This document contains the collective views on pharmaceutical manufacturing from an international group of experts - including representatives from international regulatory agencies, EU, IFPMA, IGPA, IPEC, PIC/S, UNICEF, BSP and US.
Provides computer system guidelines, including:• Computer system qualification and validation• Self-Inspection of validation and re-validation programs • Documentation requirements for electronic data and records management • Responsibilities of the Quality Function in qualification and validation• Outline of information that needs to be associated with a signature or electronic
password • Labeling exceptions when using fully validated computerized systems• Recommendations to use validated computer programs for Batch Processing
and Packaging records
Annex 2Good Manufacturing Practices for Pharmaceutical Products: Main Principles
2014
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 30
www.ValidationCenter.com
Validation Center™ © 2016 Praxis Life Sciences 59
FDA Enforcement Statistics
Part 2
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 31
Part 2: FDA Enforcement Statistics
Section Overview– Statistics
• 1997-2010 Total Inspections
• 2010-2015 Total Enforcement Actions
• 1992-2015 Total Warning Letters
• 1993-2011 Total Arrests & Convictions
Validation Center™ © 2016 Praxis Life Sciences 61
FDA Inspection Statistics
Validation Center™ © 2016 Praxis Life Sciences 62
15,506
18,185
16,920
15,146
18,649
18,572
22,543
21,805
19,803
17,641
15,581 15,245
15,954
15,245
0
5000
10000
15000
20000
25000
1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010
FDA Inspections – Fiscal Years 1997-2010
Source: FDA Enforcement Story 2001-2008; FDA Enforcement Summary 2009-2010
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 32
FDA Enforcement Statistics
Validation Center™ © 2016 Praxis Life Sciences 63
Source: FDA Enforcement Story 2001-2008; FDA Enforcement Summary 2009-2015
Enforcement 2010 Count 2011 Count 2012 Count 2013 Count 2014 Count 2015 Count
Injunctions 17 16 17 19 10 21
Seizures 10 15 8 6 4 1
Recalls Events 3,799 3,640 4,075 3,844 2,924 2,789
Recalled Products 9,361 9,288 9,469 8.044 8,061 9,178
Debarments 13 16 20 6 1 17
FDA Warning Letter Statistics
Validation Center™ © 2016 Praxis Life Sciences 64
Source: FDA Enforcement Story 2001-2008; FDA Enforcement Summary 2009-2015
1712 17881594 1557
1038 1140 905 9001154 1032
755 582 725535 538 471 445 474 652 680 736 708
470 603
1,040
4,146
6,052
8,220
16,629
0
2,000
4,000
6,000
8,000
10,000
12,000
14,000
16,000
18,000
All Warnings, except for Tobacco Products
Tobacco Products
Warning Letters, by year
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 33
FDA Warning Letter Statistics
Validation Center™ © 2016 Praxis Life Sciences 65
Source: FDA Enforcement Summary 2015
CFSAN, 236CVM, 117
CBER, 4
CDER, 76
CDRH, 168
0 50 100 150 200 250
FY 2015 Non-Tobacco Warning Letters
CDRH: Center for Device and Radiological HealthCDER: Center for Drug Evaluation and ResearchCBER: Center for Biologics Evaluation and ResearchCVM: Center for Veterinary MedicineCFSAN: Center for Food Safety and Applied Nutrition
FDA Arrest & Conviction Statistics
Validation Center™ © 2016 Praxis Life Sciences 66
Source: FDA Enforcement Story 2001-2008; FDA Enforcement Summary 2009-2011* NOTE: Enforcement Summaries do not contain complete arrest/conviction data
58 58
146111
177
250
373
421 422372
345
383
535
341
496
386
10
56
106 8370
194211
353 353317
206 196
275 279
344369 370
255
0
100
200
300
400
500
600
1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011
Arrests Convictions
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 34
FDA Warning Letter Analysis
Part 3
Part 3: FDA Warning Letter Analysis
Validation Center™ © 2016 Praxis Life Sciences 68
Section Overview
– Data Source• FDA Warning Letters related to Software and Computers
• 3 Year Date Range: 2013 through 2015
– Summaries• By industry segment
• By system type
• By topic• By validation topic
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 35
Warning Letter Example
Validation Center™ © 2016 Praxis Life Sciences 69
Warning Letter Information
Issue Date Issuing District
Warning Letter Example
Validation Center™ © 2016 Praxis Life Sciences 70
Warning Letter Information
RegulatoryReference
Specific Observations
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 36
Warning Letter Example
Validation Center™ © 2016 Praxis Life Sciences 71
FDA Warning Letter ExampleAudit
Finding
Observations
Audit Standard
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 72
3 Year Summary by Industry Segment
48.8%
49.3%
0.5%1.0%
0.5%Medical Device cGMP, Tracking(CFR 820, 821)
Pharma/Bio cGMP (CFR 211,Q7A)
Pharma/Bio Clinical (CFR 50,312)
Blood cGMP (CFR 606, 211,820)
Tissue/Cellular cGMP (CFR1271)
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 37
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 73
3 Year Summary by System Type
“Other” system types include systems for Labeling, Calibration Management, Building Management, Inspection Systems, Rework/Internal Failure Management, Non-Conformance Tracking, Clinical Trial Data Management, Service Records, Prescription Orders Fulfilment, Donor Tissue Tracking, Distribution, CAPA, Call Centers, and Quality Management
27%
45%
7%
4%
3%2%
2%10% Device/product Software
Laboratory Systems
Manufacturing Control Software
Complaints Systems
Inventory Control Systems
Document Management Systems
Blood Management Systems
Others (< 2% each)
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 74
3 Year Summary by Observation Topic
“Other” observation topics include Change Control, Suitability for Use, Quality Oversight and Risk Analysis
26%
17%
16%
14%
7%
5%
4%
4%3% 4%
Validation
Data Retention
Audit Trails
Security
Data Integrity
CAPA
Operating Procedures & Training
System Documentation
Vendor Management
Others (<3% each)
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 38
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 75
DATARETENTIONDATARETENTION
Firm failed to conduct back-ups for the Server used to store, back-up, and/or archive raw test data from computer system controlling and monitoring HPLC systems. During the inspection the server was observed as being tagged out-of-service.
Personnel informed the investigators that the computer software was upgradedand the raw data was lost during the software upgrade.
Clinical Investigator failed to retain records for the time required stating that source documents were not available because the computer "crashed."
Firm deleted multiple HPLC data files acquired in 2013 allegedly to clear up hard drive space without creating back-ups.
17%
Firm discarded OOS (out of specification) laboratory records and deleted OOS electronic analytical data. Firm selectively reported only passing results.
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 76
Audit TrailsAudit Trails
16%
There is no specific requirement regarding any review of theaudit trails. Such an audit may well have detected the datemanipulation which was occurring at your facility.
Your system does not have an audit trail to document changes.
Review of audit trails is not required.
Changes in study data could not be detected as there was no audit trail.
This system does not include and audit trail or any history of revisions that would record any modification or deletion of raw data or files. Your laboratorycomputer system lacks necessary controls to ensure that data is protectedfrom tampering, and it also lacks audit trail capabilities to detect data that could potentially be compromised.
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 39
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 77
SecuritySecurity
…. failed to implement an adequate system for authorizing, granting, and rescinding computer access to functions in the XXXXXXXX and adequate computer security provisions to assure data integrity. Current users do not use appropriate access such as passwords and user-id and personnel who have changed jobs still have access to the system .
Laboratory Managers (QC and R&D) gained access to the XXXXXXXX computer system through a common password. Analysts …. operated thesystem following the login by laboratory managers.
System administrator privileges … include the ability to modify and delete rawdata files and to lock/unlock projects for reprocessing in the chromatographicdata acquisitions system. Our [FDA] investigators documented numerousinstances where these privileges were reassigned without documentation or justification some of which resulted in extensive manipulation of data.
14%
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 78
DATAINTEGRITYDATAINTEGRITY
Your firm was unable to locate a product lot implicated in a customer complaint, ….. which was identified as being part of the current inventory in your firm’s validated inventorycontrol system XXXXX.
There are discrepancies between the CRFs and the sponsor’s electronic devicelot sheet.
The clinical signs and symptoms of disease that you reported in the electroniccase report form …. could not be verified against information within the sourcedocuments for 17 of the 30 subjects enrolled in the study XXXXX.
Electronic records were not routinely checked for accuracy, …. Our investigators found numerous discrepancies between the electronic data filesand documentation in laboratory notebooks.
7%
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 40
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 79
CAPACAPA
Product Change Controls which are corrective and preventive actions for handling software coding defects do not always include investigating the cause of all nonconformities relating to product, processes and the quality system, and identifyingaction(s) needed to correct and prevent recurrence of nonconforming product and other quality problems..
Your firm failed to follow your procedure (QMS17, Complaint Process) for documenting complaints with an associated data search of similar complaints, in that a software complaint was not associated with a data search of similar complaints. Your firm’s hardware and software complaint customer interface department manager stated that for software and hardware complaints, the department does not typically search for related complaints as required by the firm’s complaint handling procedure.
5%
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 80
SOPs & TrainingSOPs & Training
Procedures for entering critical comments were inadequate.
Computer System is incomplete because it fails to provide detailed instructions to ensure correct specimen identification. A technician identified the specimen by scanning the barcode on the collection record instead of the barcode on the specimen. Consequently an incorrect blood group was entered into the database and the patient received incompatible red cells.
The adverse drug experience reporting system has not been fully validated because the application was released into production using an Interim Validation Report (IVR) that is still not final. Critical issues (deviations) identifiedin your interim validation report include the following: lack of training for your system support team, incomplete SOPs and Work Instructions.
CAPA procedures did not describe use of an electronic system.
4%
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 41
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 81
3 Year Summary by Observation Topic – Validation Only
“Other” observation validation topics include Inadequate Validation Plan, No Source Code Evaluation, and No Trace Matrix, Incomplete Design Documentation, and Went Live with Known Critical Defects
43%
10%14%
8%
4%
4%
4%
3%3%
7%System not validated
Changes not validated
Inadequate Validation SOPs
Insufficient Testing
No testing / Unfinished Testing
Inadequate Test Evidence
No Clear Acceptance Criteria
Acceptance Criteria not Met
Incomplete Requirements
Others (<3% each)
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 82
You released software patches for various changes on …., ….., …… You haveno documentation of validation or justification or verification for the seven patches.
Failure to validate your software used for fluid delivery and heat disinfection inyour water purification systems. For example, implementation of remote changes in operating parameters changed the output of the system. These typeof changes require re-validation of the system. You failed to follow your ownprocedure for change controls when critical limits were changed to suit a client’s needs.
You changed the software which controls the user interfaceprogram for the XXXXXX to a new version and were unable toprovide any documentation to show validation or verification procedures were conducted prior to installing the program intoall of your systems.
ChangeValidationChangeValidation
12%
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 42
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 83
14%
Inadequate Validation SOPsInadequate Validation SOPs
Validation procedures do not include:a) requirements which ensure that protocols with acceptance
criteria are established prior to the performance of validationactivities; and
b) requirements which ensure that the results of designvalidation, including identification of the design, methods,and the measuring equipment used, are documented.
Validation procedures did not require adequate level of software testing and documentation.
Software Quality Assurance Procedure, states that validation should be conducted in light of the “level of concern”; however, the procedure does not provide a process for determining “level of concern” and establishing validation plans that are appropriate to the identified level of concern.
FDA Warning Letter Excerpts
Validation Center™ © 2016 Praxis Life Sciences 84
Testing done by a Canadian site had incomplete sections.No Testing -UnfinishedTesting
No Testing -UnfinishedTesting
4%
Sections of the tests were not performed, unsigned, and/or missing
InsufficientTestingInsufficientTesting
8% The performance qualification failed to include verification of the expiration date calculations in the system. Discrepancy reports have documented that product labeling with incorrect expiration dates have been created and issued for use.
Design verification and validation to introduce the XXXXX recorder was noteffective. Sixteen (16) devices were returned to your firm for hardware/software additional upgrades.
Your firm’s most current validation of the XXXXX software is inadequate in that the validation that was conducted for version XXX consisted primarily offunction testing (black-box testing) and lacks other elements of software validation including structure testing (white-box testing).
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 43
FDA Warning Letter Excerpts
Validation Center™ © 2015 Praxis Life Sciences 85
Inspection revealed discrepancies between the printed chromatograms and the operational qualification protocol for the HPLC system, including injection sequences and values to calculate relative standard deviation.
Acceptance criteria were not established prior to the performance of validation activities. System verification and validation activities were executed under Software Verification Reports. Acceptance criteria were not established prior to executing these activities.
Inadequate AcceptanceCriteria
Inadequate AcceptanceCriteria
4%
InadequateTest EvidenceInadequateTest Evidence
4%
The validation procedures do not include requirements which ensure that protocols with acceptance criteria are established prior to the performance of validation activities
The Software Qualification does not define acceptance criteria for the test.
FDA Warning Letter Trends
Part 4
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 44
Part 4: FDA Warning Letter Trends
Validation Center™ © 2016 Praxis Life Sciences 87
Section Overview
– Data Source» FDA Warning Letters
» 3 Three-year Date Ranges: • 2007 through 2009
• 2010 through 2012
• 2013 through 2015
– Summaries» By industry segment
» By system type
» By topic• By validation topic
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 88
9 Year Trend by Industry Segment (%)
Rel
ativ
e P
erce
nt
21 CFR …
1
68
2
18
4 7
70
2 1 1
14
3 41
5
49 49
0.5 1 00
1020304050607080
2007-2009 2010-2012 2013-2015
# Observations:136168203
0.5
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 45
Part 11 Enforcement
Validation Center™ © 2016 Praxis Life Sciences 89
Topic Pattern 2002-2004
2005-2007
2008-2010
2011-2015
21 CFR Part 11Electronic Records &
Signatures
Enforcement Gone?
7% 2% - -
14 Year Trend (%)
Part 11 Enforcement
Validation Center™ © 2016 Praxis Life Sciences 90
Is Part 11 Enforcement Gone?
Not Exactly…In recent years, the FDA has been citing predicate rules rather than 21 CFR Part 11
There is no documentation to establishthat the system … has been properlyvalidated. Access to your system hasnot been limited.
2001 PART 11 CITATIONFirm went live; however, the validation was incomplete.
2011 PART 606 CITATION
The laboratory is using an electronicrecord system …. that is not set up tocontrol the security and data integrity …not password controlled, no back-upprovision, and no audit trail.
2002 PART 11 CITATIONAll employees share the same user name and password.
2012 PART 820 CITATION
There is no audit trail in place to deletion of raw data.
2013 PART 211 CITATIONS
Firm failed to maintain a back-up file of data entered into the computer system.
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 46
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 91
9 Year Trend by System Type (%)
42
17
84
2
7 7
1 0 1
11
40
14
7 75 4 5 3 3 3
8
27
45
74 3 2 0 1 2
9
05
101520253035404550
2007-2009 2010-2012 2013-2015
# Observations:
142174208
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 92
9 Year Trend by Topic (%)
Rel
ativ
e P
erce
nt
45
4 36
1013
53 4
1 3 3
36
51
69
13
9
4 54 3 4
26
17 16 14
75 4 4
2 2 13
0
5
10
15
20
25
30
35
40
45
50
2007-2009 2010-2012 2013-2015
# Observations:143187251
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 47
Software & Computer Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 93
9 Year Trend by Validation Topic (%)R
elat
ive
Per
cent
43
14
6
13
52 3 3 2 2
8
43
15
58 9
15 5 5 5
43
1014
84 4 4 3 1 1 3 4
05
101520253035404550
2007-2009 2010-2012 2013-2015
# Observations:538672
Recent Warning Letters
Part 5
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 48
Part 5: Recent FDA Warning Letters
Validation Center™ © 2016 Praxis Life Sciences 95
Section Overview– Examples of FDA Warning Letters
Recent FDA Warning Letter
Validation Center™ © 2016 Praxis Life Sciences 96
Failure to validate device software.
Software was released with known "critical" level defects.
Verification and Validation test results/raw data were performed. Sections of the tests were not performed, unsigned, and/or missing.
Electronic sign-off copy of the Verification and Validation Report that sequences were entered as pass without supporting data to demonstrate the test was
performed. Raw test data was discarded.
Failure to establish Servicing procedures. Specially, the service manual did not address issues related to software failures.
Regulatory Reference 21 CFR 820 (Device)
System Type Device Software
Topic(s) Validation, Procedures
FDA Organization San Francisco District
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 49
Recent FDA Warning Letter
Validation Center™ © 2016 Praxis Life Sciences 97
Regulatory Reference ICH Q7
System Type Laboratory System
Topic(s) Security, Audit Trails
FDA Organization CDER
HPLC computer software lacked active audit trail functions to record changes to analytical methods, including information on original methodology, the identity
of the person making the change, and the date of the change.
In addition, your laboratory systems did not have access controls to prevent deletion or alteration of raw data.
During the inspection, your analysts demonstrated that they were given inappropriate user permissions to delete HPLC data files.
The gas chromatograph (GC) computer software lacked password protection allowing uncontrolled full access to all employees.
Recent FDA Warning Letter
Validation Center™ © 2016 Praxis Life Sciences 98
Failure to retain Electronic case report forms (eCRFs). Study coordinator used a sponsor-provided laptop. During the closeout visit, the sponsor’s monitor took the laptop computer. The actual eCRF data disks were never obtained from
the sponsor. The firm was responsible as the investigator to retain copies of the eCRFs for two years after the investigation was discontinued.
The study coordinator stated that she transcribed vital-sign data from the dialysis center’s Patient Treatment Records onto the study flowsheets, and then used the flowsheets to enter the data into the eCRFs. However, a comparison of the
Patient Treatment Records and the flowsheets suggests that for some visits, the study coordinator recorded the post-dialysis vital-sign data on the study
flowsheets rather than the pre-dialysis vital-sign data. This discrepancy raises questions about the reliability of the data.
Regulatory Reference 21 CFR 312 (Clinical)
System Type Clinical Trial
Topic(s) Data Retention & Integrity
FDA Organization CDER
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 50
Recent FDA Warning Letter
Validation Center™ © 2016 Praxis Life Sciences 99
Failure to establish and maintain adequate procedures to ensure that all purchased or otherwise received product or services conform to specified
requirement. For example:
• Firm failed to complete purchasing control activities according to its purchasing control procedure "Selection and Approval of Service Supplier" for its software supplier responsible for software development for the XXXXXX medical device.
• Firm’s "Purchasing Control for Outside Services" procedure does not assure that software suppliers complete both function and structural software testing.
Regulatory Reference 21 CFR 820 (Medical Devices)
System Type Medical Device Software
Topic(s) Vendor Management
FDA Organization Florida District
www.ValidationCenter.com
Validation Center™ © 2016 Praxis Life Sciences 100
Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.
© 2016 Praxis Life Sciences. All rights reserved.
Validation Center™validationcenter.com
Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 51
Need Help?
Validation Center™ © 2016 Praxis Life Sciences 101
ValidationCenter.com Library of SOPs and CSV templates
Online and Classroom CSV Training
Software QA and Validation Program ImplementationValidation Services
Audit Readiness Assessments
Thank You!
Validation Center™ © 2016 Praxis Life Sciences 102
Thanks for your interest in Software Quality Regulatory Trends
Any questions about what we have discussed today?
Please, feel free to contact me:
Deb Bartel
+1 (847) [email protected]
validationcenter.com | praxislifesciences.com
Follow us!