EU Annex 11 update. An ISPE interpretation

Transcription

1 EU Annex 11 update An ISPE interpretation

2 ISPE Interpretation Published by Winnie Cappucci Chris Clark Tim Goossens Sion Wyn Disclaimer ISPE cannot ensure and does not warrant that computerized systems managed in accordance with this interpretation will be acceptable to regulatory authorities

3 Why a New Revision? Increased use of computerised systems with Increased complexity Increased use of electronic documents Final 1 January 2011 In operation: 30 June 2011

4 Most Significant Aspects of Revision Risk based approach to Validation Operational controls Harmonization with current industry good practice Clarification of the acceptability of electronic records and signatures

5 Update of Chapter 4 Principle Required GMP documentation Record/Report type Generation and Control of documentation Good Documentation Practices Retention of Documents Procedures and records Other

6 Contents of Annex 11 Principle General Risk Management, Personnel, Suppliers and Service Providers Project Phase Validation Operational Phase Data, Accuracy checks, Data storage, Printouts, Audit trails, Change and configuration management, Periodic evaluation, Security, Incident management, Electronic signature, Batch release, Business continuity, Archiving Glossary

7 Updated Annex 11 and Chapter 4 Equivalent to the FDA s Part 11 regulation for Electronic Records and Signatures

8 Annex 11 Changes Increased Scope Risk Management Roles and Responsibilities Suppliers and Service Providers Validation Ensuring Data Integrity Electronic Signatures IT Support Maintaining Validation

9 Increased Scope of Annex 11 Applies to all forms of computerised systems used as part of a GMP regulated activities The application should be validated; IT infrastructure should be qualified. Where a computerised system replaces a manual process there should be no resultant decrease in product quality, process control or quality assurance

10 Risk Management Throughout the System Life Cycle Dependent on Patient safety Product quality Data integrity Justified and documented risk assessment In line with Q9 and GAMP5

11 New Roles and Responsibilities Close cooperation between all relevant personnel New roles defined: Process owner Person responsible for the business process System owner Person responsible for the availability and maintenance of a computerised system And the security of the data

12 Suppliers and Service Providers Major expansion into four classes: Formal agreements, including ITdepartments Competence and reliability of supplier Audit Review documentation of COTS products Availability of quality system and audit information to inspectors

13 Validation Life cycle approach Manufacturers justify approach based on Risk assessment Listing of systems (link with Annex 15 & VMP) Current system description for critical systems Requirement for URS and Traceability Development within QMS Customised or bespoke systems Test methods and tools

14 Controls for Ensuring Data Integrity Covered by sections: Data Accuracy checks Printouts Audit trails Security Minimize risks of a wrong decision based on wrong data Data Migration Data Archiving Check after Changes to s/w or IT-infrastructure

15 Electronic Signatures Same impact as handwritten Be permanently linked Include date and time

16 IT Support of Validated Systems Backup To be checked periodically Security Incident management All incidents reported and assessed. RCA of critical incidents resulting in CAPA Business continuity Documented and tested

17 Maintaining Validation Change and Configuration Management Procedure defined Involves Risk Assessment Documented Periodic Evaluation (periodic review) Changes made Compliant with GMP Deviations and incidents Upgrades Security

18 More information