Computer systems are widely used in the pharmaceutical industry. That’s why computer system validation (CSV) and other risk-based assurance approaches have become quite important in regulated activities. They are used to provide documented evidence that these computerized systems are fit for their intended use and support reliable processes, product quality, patient safety, and data integrity.
Get to know more about CSV through this article.
What Is Computer System Validation?
Computer System Validation (CSV) in the pharmaceutical industry is a documented process. It is used to establish that a computerized system is apt for its intended use and performs consistently as required.
CSV is important in the pharmaceutical industry in ensuring data integrity, product quality, and patient safety. It is a lifecycle-based activity. It can include planning, requirements definition, risk assessment, system specification, testing, documentation, release, change control, and ongoing review. The specific activities and level of rigor should be appropriate to the intended use, complexity, and risks that are linked with the computerized system.
Also Read: What Is Computer Software Assurance (CSA)
Importance Of CSV in the Pharmaceutical Industry
It is important that the patient’s safety is not compromised at any cost. This is the major reason why each requirement is in place and must be complied with. Everything comes down to patient safety and effectiveness. Computer system validation is done to ensure that the system that is planned to be implemented meets all the requirements set forward. It also helps identify and control risks that could affect product quality, patient safety, or data integrity.
The data generated can be trusted. It can be used for regulatory submissions, decision-making, and reporting as well. The potential risk can be identified, evaluated, and managed with computer system validation. The risks can be resolved before they can cause damage to the quality of the product and safety of the patient, as well as the reputation of the company. Documentation of the validation process is required. It allows for tracking the activities and modifications performed on the system.
FDA Guidance and Regulatory Principles for Computerized Systems in Pharma
The FDA does not have a single guidance document that is dedicated exclusively to Computer System Validation (CSV) for pharmaceutical products. Instead, there are CGMP requirements that apply to expectations for computerized systems used in pharmaceutical manufacturing and other GMP activities. There’s also an FDA guidance addressing computerized systems, electronic records, and data integrity.
Q7A Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients
FDA’s Q7A guidance addresses computerized systems used in GMP activities associated with active pharmaceutical ingredients. It states that GMP-related computerized systems should be validated, with the extent and scope of validation determined by the diversity, complexity, and criticality of the computerized application. The guidance also addresses controls relating to data, system access, changes, backups, and system failures.
FDA’s Guidance on Part 11, Electronic Records; Electronic Signatures
It provides additional regulatory interpretation for electronic records and electronic signatures that fall within the scope of 21 CFR Part 11. FDA explains that Part 11 should be considered together with the applicable predicate rules and that organizations should assess the effect of computerized systems on the accuracy, reliability, integrity, availability, and authenticity of regulated records and signatures.
Data Integrity and Compliance with Drug CGMP Guidance
The FDA further establishes expectations concerning the reliability and accuracy of data generated and maintained under CGMP. It supports a risk-based approach to preventing and detecting data-integrity problems in pharmaceutical operations.
Therefore, pharmaceutical companies should consider the applicable CGMP requirements, computerized-system expectations, electronic-record requirements, and data-integrity principles when establishing their CSV framework.
Regulatory Requirements for CSV in Pharma
Pharmaceutical companies should establish controls and documented evidence to demonstrate that GMP-relevant computerized systems are fit for their intended use, appropriately controlled, and maintained in a validated state throughout their lifecycle. The specific activities and level of documentation should be proportionate to the system’s intended use, complexity, and potential impact on product quality and data integrity.
The practical requirements can include the following:
1. Define Intended Use and Requirements
The intended use of the computerized system should be clearly defined before validation activities are performed. User and functional requirements should provide an appropriate basis for evaluating whether the system can perform its intended functions.
2. Execute a Risk Assessment
A documented risk assessment should be used. It will identify functions and data that could affect product quality, patient safety, or data integrity. The outcome of the assessment can be used to determine the appropriate extent of testing, documentation, controls, and other validation activities.
3. Perform Appropriate Validation and Testing
Validation activities should provide documented evidence that the computerized system performs as intended. Depending on the system, this may involve requirements verification, qualification, functional testing, performance testing, or other appropriate testing activities.
Traditional activities such as IQ, OQ, and PQ may be applicable where appropriate, but they should not be presented as mandatory steps for every computerized system.
4. Control Electronic Records and Signatures Where Applicable
Where electronic records or electronic signatures fall within the scope of 21 CFR Part 11, applicable requirements should be incorporated into the system’s controls and validation approach.
5. Protect Data Integrity
Appropriate controls need to be implemented so that GMP data can be protected from unauthorized access, inappropriate modification, loss, or other risks that could compromise its reliability or integrity. Every system’s controls are different, and they may affect user access management, audit trails, data review, backup, and other technical or procedural controls.
6. Manage Changes
Changes to validated computerized systems should be managed through an established change-control process. Changes should be assessed for their potential impact on the validated state, and additional testing or validation should be performed where necessary.
7. Maintain the Validated State
Computerized systems should remain under appropriate control throughout their operational lifecycle. Periodic review, incident management, change control, and other lifecycle activities should be used to determine whether the system continues to perform as intended.
8. Maintain Appropriate Documentation
Validation and lifecycle activities should be supported by appropriate documentation. Depending on the system and validation approach, this may include requirements, risk assessments, specifications, test records, deviations, change records, approval records, and validation summary documentation.
Also Read: Best Document Management Systems For Pharma
Components of a Computer System Validation Plan
A CSV or validation plan should define the scope, responsibilities, strategy, and activities required to establish that a computerized system is fit for its intended use. The exact contents may vary according to the system, its risks, and the applicable quality system. This plan translates the applicable validation strategy and risk-based requirements into a documented plan of activities, responsibilities, deliverables, and acceptance criteria.
System Definition: A detailed description of the system in the process of being validated.
Key user identification: Identifying the end users or stakeholders who interact with the system during and after validation.
Intended Use: Outline the use of the system for its purpose. It must clearly define the operational parameters of the system.
Validation Strategy: The strategies planned to be used for the validation of the system must be stated here. A detailed description of how the validation phases will be performed should be provided.
Risk Assessment: Identification and evaluation of risks that could affect the system’s intended use, product quality, patient safety or data integrity, with appropriate controls defined based on the risk.
Responsibilities: State the responsibilities of each person involved in each task or activity in the validation process.
Timelines: Setting proper timelines for validation processes.
Phases of the Computer System Validation Process
Computerized-system validation is generally approached across the system lifecycle, beginning with planning and requirements and continuing through testing, release, operation, change control, and periodic review. The specific activities and documentation should be determined according to the system’s intended use and risk.
Validation Master Plan (VMP)
A VMP is generally an organization- or site-level document that establishes the overall validation strategy, scope, responsibilities, and approach. A system-specific validation plan can then define the activities applicable to the individual computerized system.
The VMP acts as a roadmap for validation. It covers scope setting, goals, and methodologies, justification of the strategies, determination of acceptance criteria, and preliminary tests. It also establishes the overall scope and extent of the validation program.
User Requirement Specifications (URS)
This documents the user’s intended needs for the computerized system. It includes required functions, features, and relevant performance expectations. Each requirement should have a unique identifier to support traceability to subsequent verification or testing activities. This also helps to prevent the omission of the functionalities that are planned during its development.
Design Qualification (DQ)
Design Qualification (DQ), where applicable, provides documented evidence that the proposed design of equipment or a computerized system is suitable for its intended purpose and aligns with predefined requirements. The applicability and extent of DQ should depend on the system, its complexity, and the organization’s validation approach.
IQ, OQ, and PQ
IQ, OQ, and PQ are traditional qualification activities used where applicable. Installation Qualification (IQ) provides documented evidence that the system or equipment is installed according to specified requirements. Operational Qualification (OQ) evaluates whether it operates as intended across specified operating ranges. Performance Qualification (PQ) provides evidence that the system or equipment performs effectively and reproducibly under intended conditions.
A Validation Summary Report
After the planned validation activities are complete, a validation summary report can be created. It can document the activities performed, deviations or issues identified, acceptance of results, outstanding actions, and the conclusion regarding the system’s suitability for intended use.
Ongoing Review and Maintenance
Validated computerized systems should be maintained throughout their lifecycle. Periodic review should be performed at an appropriate frequency based on the system’s risks, changes, incidents, performance, and regulatory or business requirements. The review should consider whether the system remains in a validated state and whether changes or other events require additional validation activities.
Life Cycle Model of CSV
A lifecycle model provides a structured approach for planning, developing, testing, implementing, operating, and maintaining a computerized system. The V-model is one commonly used approach. That’s because it connects requirements and specifications with corresponding verification and testing activities. Organizations may use other appropriate lifecycle models depending on the system, development approach, and risk profile.
Challenges in Computer System Validation
Common challenges include those in the areas of planning, communication, and understanding the regulatory requirements.
Planning
Failure to consider the range of impact and the reach of the system they plan to implement is a major problem. Isolated thinking can lead to a limited perspective and hold back the implementation of the system to other departments. Specifications are developed based on the needs of a particular department. They fail to consider that the system can also be utilized by other departments as well, which will cause issues.
Communication
Lack of communication within and also with other departments is a huge issue. Improper communication and lack of cross-departmental collaboration will lead the CSV to move through inefficiency and friction. It also leads to not being able to accommodate the needs of other departments.
Recognition Of Regulatory Requirements
Regulatory requirements can be complex to understand. This can be due to the dynamic nature of the regulatory environment. Moreover, companies tend to comply with the regulatory requirements, as it is necessary to do so for the approval process. They don’t really understand the need for all this compliance and work along with it just to meet the requirements. Ineffective training can be a cause for this lack of understanding.
Best Practices for Successful CSV Implementation
For the implementation of successful computer system validation, certain things can be followed. Some of them are as follows:
- Process Maps/Mapping: Representing the tasks or activities performed in an operation graphically is called process mapping. This gives a detailed view of the activities involved in the operation.
- The first step in initiating a CSV project is to define the desired functionalities of the system and system objectives clearly. Conducting stakeholder analysis is a way to do this.
- Assemble teams early and communicate with them. Regularly conduct cross-functional meetings. These allow for asking and addressing critical questions, brainstorming, deciding on requirements, and provide for a proactive optimization of the process.
- Subject matter experts should also be included from each department. A wide range of knowledge and expertise can be beneficial.
- Product quality, patient safety, and data integrity should be considered throughout the computerized system lifecycle. Gap assessments may be conducted internally or with support from a qualified third party to identify potential gaps in the organization’s processes, controls, and regulatory understanding.
- Risk-based Validation: Apply a risk-based approach to determine the scope and depth of validation activities rather than applying identical testing requirements to every system.
- Change Control: Establish change-control procedures so that proposed system changes are assessed for their potential impact on the validated state and additional validation activities are performed where justified.
Conclusion
These are the best practices that can be considered for a successful CSV. Advantages of a third-party gap assessment have already been discussed. At Artixio, with the help of our team of regulatory experts, we ensure a streamlined approach towards the validation process and in understanding the right requirements. Connect with us through info@artixio.com.
FAQs
Q. What is the role of Computer System Validation in the pharma industry?
Computer System Validation provides documented evidence that a computerized system is suitable for its intended use and performs as required under defined conditions. In pharmaceutical environments, it supports control of risks affecting product quality, patient safety, and data integrity.
Q. What are the phases of computer system validation?
CSV is a lifecycle-based activity rather than a universally prescribed sequence. Depending on the system and risk, activities may include planning, requirements definition, risk assessment, design/specification, testing or qualification, validation reporting, release, change control, and periodic review. Traditional qualification activities such as IQ, OQ, and PQ may be used where appropriate.
Q. Why is 21 CFR part 11 important in CSV?
21 CFR Part 11 establishes requirements for electronic records and electronic signatures that fall within its scope. During CSV, organizations should determine whether the computerized system creates, modifies, maintains, archives, retrieves, or transmits electronic records that are subject to Part 11 and ensure that applicable controls are addressed.
Q. What is the difference between Computer System Validation (CSV) and Computer Software Assurance (CSA)?
Computer Software Assurance (CSA) is a risk-based approach described by FDA for establishing confidence in automation used in medical-device production and quality-management systems. CSV is a broader term commonly used in regulated industries for establishing documented evidence that computerized systems are fit for intended use. The terminology and regulatory expectations can differ depending on the industry and applicable regulatory framework.
