Pharmaceutical computer systems validation : quality assurance, risk management and regulatory compliance

800 Pages·2010·37.106 MB·English

by  Wingate, Guy

2ND
Pharmaceutical Computer Systems Validation: Quality Assurance, Risk Management and Regulatory Compliance EDITION S E C O N D E D I T I O N
SECOND EDITION
About the book
QP Pharmaceutical
Since the last edition, a new paradigm for computer validation has emerged, one that considers the benefits uh
of Quality Management Systems, science based product and process understanding, and the application of a aa
l
risk based approach. This new edition has been thoroughly revised to address new and emerging industry itr
ym
standards, discuss the latest thinking on computer validation and verification principles, and share real-world A Computer
experience on how to put these principles into practice. The most comprehensive guide on computer sa
compliance currently available, this book could make all the difference in ensuring efficient and effective suc
re
compliance of your computer systems. a
u
n
Other features of the Second Edition include: ceti Systems Validation
,c
• 18 chapters covering organization responsibilities, project implementation, operation and maintenance of Ra
systems (including decommissioning and archiving), practical troubleshooting, handling regulatory iskl C
inspections, metrics, and the opportunity for performance improvement Mo
• 18 new and updated case studies by industry experts, which demonstrate how these computer validation am Quality Assurance, Risk Management
n
principles are put into practice ap
g
• Discussion of latest industry GMP guidelines – includes ISPE GAMP®5 guide, ASTM E2500, and ICH Q7, Q8 eu
and Q9 mt and Regulatory Compliance
e
e
• A focus on regulatory requirements covering GCPs, GLPs, GMPs, and GDPs – complete with recent nr
observations from the FDA t a S
y
n
• The latest advancements in electronic records and signatures ds
Rte
This book is essential for all those in the pharmaceutical and healthcare industry who work to develop e
m
and validate/verify computerized systems. g
u
ls
a
About the editor toVa
r
Guy WInGATE, Ph.D. is Quality Director at GlaxoSmithKline. A well-known speaker on computer validation, yl
Cid
Dr. Wingate has over twenty years of experience in the pharmaceutical industry. He is a visiting lecturer at
o
a
university of Manchester’s M.Sc. Pharmaceutical Engineering Advanced Training program and Dublin Institute m
t
of Technology’s accredited M.Sc. Validation Science program. Dr. Wingate is an active member of the ISPE and pi
lo
is the current Chair of GAMP Council, which is responsible for the internationally recognized suite of GAMP ian
Guides on computer compliance. Dr. Wingate’s extensive list of published work includes the books Validating n
c
Corporate Computer Systems and the previous edition of Pharmaceutical Computer Systems Validation. e
H8894
Wingate
Telephone House, 69-77 Paul Street, London EC2A 4LQ, UK Edited by Guy Wingate
52 Vanderbilt Avenue, New York, NY 10017, USA
www.informahealthcare.com
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
Pharmaceutical Computer
Systems Validation
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
Pharmaceutical Computer
Systems Validation
Quality Assurance, Risk Management and
Regulatory Compliance
Second Edition
Edited by
Guy Wingate
GlaxoSmithKline
Barnard Castle, U.K.
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
InformaHealthcareUSA,Inc.
52VanderbiltAvenue
NewYork,NY10017
#2010byInformaHealthcareUSA,Inc.
InformaHealthcareisanInformabusiness
NoclaimtooriginalU.S.Governmentworks
PrintedintheUnitedStatesofAmericaonacid-freepaper
10 9 8 7 6 5 4 3 2 1
InternationalStandardBookNumber-10:1-4200-8894-7(Hardcover)
InternationalStandardBookNumber-13:978-1-4200-8894-6(Hardcover)
Thisbookcontainsinformationobtainedfrom authenticandhighlyregarded sources.Reprinted materialis quotedwith
permission,andsourcesareindicated.Awidevarietyofreferencesarelisted.Reasonableeffortshavebeenmadetopublish
reliabledataandinformation,buttheauthorandthepublishercannotassumeresponsibilityforthevalidityofallmaterials
orfortheconsequenceoftheiruse.
Nopartofthisbookmaybereprinted,reproduced,transmitted,orutilizedinanyformbyanyelectronic,mechanical,or
othermeans,nowknownorhereafterinvented,includingphotocopying,microfilming,andrecording,orinanyinformation
storageorretrievalsystem,withoutwrittenpermissionfromthepublishers.
For permissiontophotocopyor usematerialelectronicallyfromthiswork,please accesswww.copyright.com(http://
www.copyright.com/)orcontacttheCopyrightClearanceCenter,Inc.(CCC)222RosewoodDrive,Danvers,MA01923,
978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For
organizationsthathavebeengrantedaphotocopylicensebytheCCC,aseparatesystemofpaymenthasbeenarranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for
identificationandexplanationwithoutintenttoinfringe.
LibraryofCongressCataloging-in-PublicationData
Pharmaceuticalcomputersystemsvalidation:qualityassurance,riskmanagement
andregulatorycompliance/editedbyGuyWingate.—2nded.
p.;cm.
Rev.ed.of:Computersystemsvalidation/editor,GuyWingate.BocaRaton,
Fla.:Interpharm/CRC,c2004.
Includesbibliographicalreferencesandindex.
ISBN-13:978-1-4200-8894-6(hardcover:alk.paper)
ISBN-10:1-4200-8894-7(hardcover:alk.paper)1. Pharmaceuticalindustry—
Management.2. Pharmaceuticalindustry—Dataprocessing.3. Healthfacilities—
Riskmanagement.4. Riskmanagement—Dataprocessing.I.Wingate,Guy.II.
Computersystemsvalidation.
[DNLM:1. ComputerSystems—standards.2. DrugIndustry–standards.3. Drug
Industry—instrumentation.4. GuidelineAdherence.5. HealthCareSector—
standards.6. QualityControl.7. SoftwareValidation.QV26.5P53522010]
HD9665.5.C6642010
615.106804—dc22
2009049688
ForCorporateSalesandReprintPermissionscall212-520-2700orwriteto:SalesDepartment,52VanderbiltAvenue,
7thfloor,NewYork,NY10017.
VisittheInformaWebsiteat
www.informa.com
andtheInformaHealthcareWebsiteat
www.informahealthcare.com
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
For Sarah, Katherine, Robert, and Edward
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
Validation should be viewed as an integral
part of the overall computer system’s life cycle.
It should promote improved process control
and not bureaucracy. Good practice and
common sense should prevail.
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
Foreword to the Second Edition
Itispleasingtonotethatthesecondeditionhasbeensignificantlyenhancedandupdatedsince
2004.Itseeksto anticipatesomeemergingFDAandEUrequirements(1–4).Itisalignedwith
thelatestfiftheditionoftheGAMPGuide(5),explainsthelatestthinkingfromASTM(6)and
DIA (7), and presents developing industry best practice. Regulatory inspection findings and
FDA Warning Letters have been analyzed; risk-based decisions are now considered in more
detail;casestudieshavebeenrevisitedtotakeaccountofregulatoryandtechnologicaltrends;
thereareadditionalcasestudiesondatabasesandspreadsheets,togetherwithnewmaterialon
PAT and process control systems to fit with pending new guidance from ISPE/GAMP.
IamhappytorepeattherecommendationthatIgavein2004,insupportofthisbookand
itseditorandteamofcollaboratingauthors:“Whetheryouarelookingforthemissingpieceof
thejigsawpuzzleforyourprojectguidanceonhowtomeettheregulationsinapracticalsense,
(whilst making cost-effective use of your investments), this information resource [which puts
principles into practice] is a good place to start! ”
Anthony J. Trill
Senior Inspector
MHRA (Retired)
REFERENCES
1. Food and Drug Administration. Pharmaceutical CGMPs for the 21st Century: A Risk-Based
Approach.Rockville,MD,2004.
2. International Conference on Harmonisation. Quality Risk Management, Q9 Document, Technical
RequirementsforRegistrationofPharmaceuticalsforHumanUse,2005.Availableat:www.ich.org.
3. FoodandDrugAdministration.21CFRpart211.Supplementaryinformation.Rockville,MD,2008.
4. EuropeanCommission.DraftAnnex11.ComputerisedSystems(EUguidelinetoGoodManufactur-
ingPracticesforMedicinalProductsforHumanandVeterinaryUse),PublicConsultationDocument.
Brussels,April2008.
1
5. InternationalSocietyforPharmaceuticalEngineering.GAMP 5:Risk-BasedApproachtoCompliant
GxPComputerisedSystems.Tampa,Florida,2008.Availableat:www.ispe.org.
6. American Society for Testing and Materials. E2500-07 standard guide for specification, design and
verificationofpharmaceuticalandbiopharmaceuticalmanufacturingsystemsandequipment,2007.
7. Drug Information Association. Computerized Systems used in Non-Clinical Safety Assessment:
CurrentConceptsinValidationandCompliance(knownasRedAppleII),2008.
Editor’sNote:TonyTrillhaswrittenapersonalreflectiononhiscareerintheMHRAinspecting
computersystems, whichcan befound online:
“A regulator’s perspective of his GAMP experience,” Anthony Trill, retired senior
MHRAinspector,onlineexclusivearticle,PharmaceuticalEngineering.November/December
2008, Vol. 28 No. 6.
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
Foreword to the First Edition
Computer technology is all pervasive. It hides behind the smallest button on domestic
appliances and is in smart cards and security devices, mobile phones, cash dispensers, PCs,
integratednetworks,processplant,automobiles,“jumbojets,”andpowerplants.Automation
is everywhere and is gathering complexity, innovation, andmomentum, and we have to rely
onitmoreandmoreinoureverydaylives.Theinexorableriseofautomationisalsoseeninthe
corporatestrategiesofpharmaceuticalmanufacturerscallingforinvestmentinnewtechnology
toimprovebusinessefficiencyandcompetitiveedge.Whensuchtechnologyisassociatedwith
high-risk public safety projects or the production and control of life-saving medicines or
devices, we (businesses and regulators) need to know that it is reliable, quality assured, and
validated.Easytosay,butthetechnology(andtheterminology)isdifficulttounderstand,let
alone prove and qualify, if you are not an electronic systems engineer or a latent Einstein.
Pharmaceutical and healthcare companies have historically engineered their businesses
to be profitable while ensuring that quality is built into their medicinal products, or devices,
through the observance of GxPs (viz GCPS, GLPs, GMPs, etc.) which essentially require
computerized systems in the pharmaceutical sector to be fully documented, defined as to
functionality, quality assured, and validated. This book considers the requirements of the
various international regulations, guides, and codes in historical perspective and leads the
reader into business and project life cycle issues and activities. This book is invaluable in
bridging the gap between theory and practice and is supported by case studies from
experiencedprofessionalpractitionersandengineerswhohavehadtofaceuptothechallenges
of proving the quality, structural integrity, and validation of different systems in the “real
world” (process control, utility management, networked control, information and high level
business IT, and integrated real-time application, etc.). The case studies are organized
hierarchically from low-level instruments and PLCs through integration to higher-level
proprietary electronic document and information management systems, and beyond.
Pharmaceutical and healthcare companies that invest in computerized systems need
systemsthataredeliveredontime andwithinbudgetandthatfulfillbusinessfunctionaland
performance requirements. In their rush to place new products and versions on the market,
however, computer software and systems suppliers rarely delivered error-free products. In
fact, some two-thirds of life cycle costs can be incurred after delivery of the software and
systemtotheusers.Pharmaceuticalandhealthcarecompaniesdonotwantlotsofdowntime,
disruption,andescalatingcostsonceasystemhasbeendeliveredandimplemented(1,2).And,
ofcourse,inGxPapplications,anydeficiencieswillbeofparticularinterestduringregulatory
inspections.
Inspectorsandinvestigatorsworkingforthedifferentnationalregulatorybodieshaveto
apply their national GxPs and regulations when assessing these systems. While these are
published, they are not necessarily up to date and, as we all would acknowledge, they are
often open to interpretation not only by different inspectors, depending on their background
and training, but also depending on the particular computerized system and application.
Regulators need to be satisfied that computerized systems installed in pharmaceutical
companies are fit for their intended purposes by considering the nature of the application,
specifications, quality assurance of the development life cycle activities, qualification,
performance validation, in-use controls, accuracy, and reliability in the context of relevant
GxPs. The increasing complexity of (integrated) propriety computer systems, critical
applications, project validation issues, and inspection findings have been considered before
[Shaji][7x10 Tight][D:/informa_Publishing/WINGATE_2400029/z_production/z_3B2_3D_files/
978-1-4398-1879-4_CH0000_O.3d][22/1/010/17:2:14][1–32]
ForewordtotheFirstEdition ix
together with the challenge for all parties (as ever) to apply sensible regulations and cost-
effective good computer validation practices (1,3,4).
Thepharmaceuticalandhealthcareindustries(includingsoftwareandsystemsuppliers
and developers) have also reportedly had some difficulty in ensuring that these projects
actuallydelivertheproposedbusinessbenefitsandthatthesystems,asbuilt,actuallymeetthe
specificationsandarereliableandvalidatedandquiteapartfromdeterminingjusthowmuch
and what type of validation evidence is required to satisfy the different regulatory bodies,
particularly the FDA. While the GAMP Guide (5) and, to some extent, the PDA 18 report (6)
provide the latest interpretation of acceptable development and project guidance in this field
(toensurecompliancewiththeneedsoftheprincipleregulatorybodiesaroundtheworld),and
TickIT provides a guide to software quality system construction and certification (using ISA
9001:1994) (7), there has been a lack of papers on practical experiences from pharmaceutical
sector project teams seeking to implement new technology.
Today,boththeindustryandregulatorshaveamuchbetterunderstanding(8)oftheways
and means to develop and validate computerized systems. Regulatory inspections now have
moretodowithrisk-basedassessmentsofwhatthesesystemsarebeingusedforinthecontextof
broaderGxPrequirementsratherthansoftwareandsystemvalidationperse.Inspectors(9)now
rarely concentrate on “simply” inspecting computerized systems as an entity on sites; they are
moreoftendirectlyconcernedwithwhatthesystemsarebeingusedforandhowtheyarebeing
used and controlled. Risk-based findings for noncompliances associated with computerized
systemswilloftenbelinkedwithotherchaptersoftheEUorPIC/SGMPapartfromannex11.
However, where a detailed inspection of a computerized system is indicated (from risk
assessmentsor otherinspections), it canbe arranged asa specific exercise.
It is interesting to note the ongoing collaboration between ISPE and PDA (10,11) to
publish guidance on electronic records and management and to influence opinion. It is to be
hopedthatthetechnologicalimplementationofelectronicrecordsandsignaturerequirements
worldwidewillnotbefrustratedbyalackofunderstandingandagreementbyallstakeholders
of the real issues. Recognition must be given to the need for regulated users to have robust
information security management practices and a risk-based approach applied to important
relevant records and inspection compliance.
I believe that this book will be welcomed by novices and experts, suppliers, developers,
purchasers, and regulators alike in providing insight into the practical aspects of these complex
automation–and life cycle–related projects. Many staff assigned tovalidationprojects could also
benefitfromsharingtheexperienceofotherpractitioners.Whetheryouarelookingforthemissing
pieceofthejigsawforyourprojectorguidanceonhowtomeettheregulationsinapracticalsense,
thisinformationresource(whichputsprinciplesintopractice)isagoodplacetostart!
Anthony J. Trill
Senior Inspector
MHRA
REFERENCES
1. Stokes T, Branning RC, Chapman KG, et al. Good Computer Validation Practices Common Sense
Implementation.BuffaloGrove:InterpharmPress,Inc.,1994.
2. Wingate GAS. Computer systems validation: a historical perspective. Pharmaceutical Engineering,
July/August1995,pp.8–12.
3. TrillAJ.EUGMPRequirements andthegoodautomated manufacturingpractice (GAMP)supplier
guide for the validation of automated systems for pharmaceutical manufacturing. Pharmaceutical
Engineering,May/June1995,pp.56–62.
4. TrillAJ.AnEU/MCAviewofrecentindustryguidestocomputervalidation,includingGAMP1996,
PDA technical report 18, and the validation toolkit. Proceedings of PIC/S Seminar “Inspection of
ComputerSystems,”Sydney,Australia,September1996.
5. International Society for Pharmaceutical Engineering. Good Automated Manufacturing Practice
1
GuideforValidationofAutomatedSystems(knownasGAMP 4),2001.Availableat:www.ispe.org.
6. ParenteralDrugAssociation.TheValidationofComputerRelatedSystems,TechnicalReportNo.18.
JPharmSciTechnol1995;49(1).
7. TickIT Guide.A guidetosoftware quality managementsystem construction andcertification using
ISO9001:2000,issue5.0.DISC/BSITickITOffice,London,2000.