Validation Best Practices Jeb Bullis Senior Account Executive

Transcription

1 Validation Best Practices Jeb Bullis Senior Account Executive

2 Today s Topics Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Validating Applications References Questions

3 Amadeus Mission: Compliance Process Control To enable our customers to manage, control, and change highly regulated processes and their associated content to reduce regulatory risk and sustain compliance over time. Processes WWW People Content

4 Agenda Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Validating Applications References Questions

5 Testing Activities in which a system or component is executed under specified conditions, the results are observed or recorded and an evaluation is made of some aspect of the system or component. (IEEE)

6 Verification Checking and reviewing project artifacts to ensure that the desired process was followed Confirmation through the provision of objective evidence that specified requirements have been fulfilled. (ISO) The process of evaluating a system or component to determine whether the system of a given development phase satisfies the conditions imposed at the start of that phase. (IEEE) Encompassing unit and integration testing

7 Validation Obtaining evidence and determining that the system actually functions as expected Establishing documented evidence that provides a high degree of assurance that a specific process will consistently produce a product meeting its predetermined specifications and quality attributes. (FDA) The process of evaluating a system or component during or at the end of the development process to determine whether a system or component satisfies specified requirements. (IEEE)

8 Verification vs. Validation Verification is set of activities to ensure that a function is developing properly ; Validation is a different set of activities to ensure that the function that has been built is working properly. (Verification) Are we producing the product right? (Validation) Are we producing the right product? -Boehm

9 Testing Levels The test phase of the validation life cycle ensures that the computerized system functions as expected and meets its intended use. The test phase is divided into the following four levels: Unit Testing Integration Testing System Testing (OQ) User Acceptance Testing (PQ)

10 Agenda Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Validating Applications References Questions

11 Regulatory Requirements Code of Federal Regulations, Title 21, Part 11, Electronic Records; Electronic Signatures General Principles of Software Validation; Final Guidance for Industry and FDA Staff, 11-Jan-2002 Guidance for Industry, Part 11, Electronic Records; Electronic Signatures Scope and Application, August 2003 Predicate Rules that may Apply to a Specific System Components of regulations that require regulated companies to provide information to the FDA or maintain information for review by the FDA For example, Part 820 Good Manufacturing Practice for management of SOPs

12 21 CFR Part 11 & Validation February Draft Guidance Part 11 incorporated in GMP Initiative at CDER Joe Famulare, made head of Part 11 Compliance Committee - FDA Part 11 Guidance for Industry Withdrawn!! Validation, Glossary ( 01); Maintenance ( 02); Elec. Copies ( 03) FDA s New Draft Part 11 Scope & Application Emphasis GAMP4 Guide & CDRH Principles of Software Validation Predicate Rule Requirements & Documented Risk Assessment FDA Final Guidance Timetable slipped into September Excerpts: PDA Vancouver Conference on Pharmaceutical Manufacturing

13 21 CFR Part 11 & Validation September Final Guidance Part 11 Remains in Effect Emphasized Joe Famulare reviewed Final Guidance at FDA/FDA DC Conf. FDA Part 11 Guidance will not be Reissued FDA s Final Part Part 11 Scope & Application Emphasis Joe Famulare noted this is NOT temporary; it s the approach GAMP4 Guide & CDRH Principles of Software Validation Predicate Rule Requirements & Documented Risk Assessment FDA Changes to Part 11 will take Years to enact Joe Famulare 6 mo. Public discussion prior to new rulemaking Excerpts: PDA Vancouver Conference on Pharmaceutical Manufacturing

14 What Should I Tell My Boss? It appears the FDA heard and heeded industry Past regulation by podium repudiated FDA to apply a narrower scope to enforcement Focus on the Predicate Rules, not on ALL electronic records created FDA s Final Part Part 11 Scope & Application Emphasis It is important that this new guidance not be overinterpreted to imply a relaxation of validation requirements [e.g. 21 CFR (i) reference] Excerpts: PDA Vancouver Conference on Pharmaceutical Manufacturing

15 Agenda Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Industry Trends Validating Documentum Applications References Questions

16 Projecting Compliance Across the Enterprise The quality system provides the foundation for the manufacturing systems that are linked and function within it... Page 6, Inspection Criteria; FDA CDER Draft Guidance for Industry, Sept. 2004

17 FDA Investigator Focal Points Review firm s predicate recordkeeping requirements and procedures for providing electronic and paper copies Review the overall security of electronic record-keeping Review Validation documentation Review firm s self-audit, corrective action plan and progress Training of IS and technical personnel Does the firm maintain a validated state?

18 Validation Overview 7 Phases Plan Analyze Design Construct Test Deploy Maintain Risk Assessment Validation Planning Vendor Assessment Training Planning Gather and Assess Requirements Determine Technical Architecture Determine System Design Configure Development Environment Configure and Develop Application Software Develop Installation Script or Instructions Unit Testing Integration Testing System Testing User Acceptance Testing Set Up and Qualify Production Environment Deliver Software to Client Workstations Migrate Legacy Data Train Users Issue Procedures Perform Validation Assessment Business Continuity Planning Disaster Recovery Planning System Administration Backup and Recovery Change Control Periodic Review On-going User Training Publish Release Memo

19 Risk Based Validation Approach We recommend that you base your approach on a justified and documented risk assessment, and a determination of the potential of the system to affect product quality and safety and record integrity. (21 CFR Part 11 Scope and Application 9/03/03)

20 Risk Based Assessment of Functionality Creating and importing documents (M) Editing content and properties (M) Searching for documents (H) Copying documents (M) Viewing documents (H) Printing documents Controlled (H) Uncontrolled (L) Reviewing & annotating documents (M) Approving documents (H) Processing To Be Read notifications (H) Making approved documents effective (H) Creating change requests (M) Reviewing & approving change requests (H) Obsoleting a document (H) Performing periodic review (H) Building document relationships (L) Exporting documents (L) Setting and enforcing security (H) Electronic signatures and records (H) Capturing and displaying audit trails (H)

21 Approach to Validation Based on Predicate Rules If the Amadeus eqcm ECM repository is used for managing quality SOPs and compliance processes Validate the use of SOPs because of the GMP predicate rule, 21 CFR Part 820. Validate the CAPA system because of GMP predicate rule, 21 CFR If there is no FDA predicate rule with respect to the type of documents to be validated, do not validate.

22 Agenda Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Validating Applications References Questions

23 When is a Computerized System Required to be Validated? It depends on your requirements and how you interpret the regulations under which your system will function Validation is typically required when the system: Affects product safety, identity, strength, efficacy, or quality Contains information that is: Submitted to, or provided for, a regulatory agency in accordance with the predicate rules Used to demonstrate compliance with government regulations Used by healthcare professionals to obtain a professional opinion that would influence the use of a product Provided to patients or the public to dictate the use of the product

24 What is a Validation Plan? A document, which describes the overall strategy and responsible parties for validating a system within its operating environment. (FDA) The FDA does not tell you how to validate a computerized system. The validation plan describes how you intend to validate the system. The FDA will hold you accountable for following the processes and developing the deliverables described in the project-specific validation plan.

25 What Happens if I did not Follow the Validation Plan? You must revise and re-approve the validation plan to reflect your actual processes, or You must document a project deviation, which summarizes the issue and rationale, and include it in the validation summary report.

26 How can I Validate a System that is already in Production? Take a retrospective validation approach Similar to validating an off-the-shelf product with little vendor knowledge Consider specific system circumstances (e.g. how long in production) and develop an appropriate validation plan Thoroughly document any assumptions in your validation plan

27 What Happened to the OQ & PQ Validation Phases? The FDA s General Principles of Software Validation states: While IQ/OQ/PQ terminology has served its purpose well and is one of many legitimate ways to organize software validation tasks at the user site, this terminology may not be well understood among many software professionals, and it is not used elsewhere in this document. Operational Qualification is equivalent to System Testing Performance Qualification is equivalent to User Acceptance Testing

28 What User Roles Participate in Validation Activities? Application Architecture Representative Auditing Lead Business/System Owner Business Process Lead Business Support Representative Change Request Approver Change Request Originator CIT Representative Developer Development Lead End-User Infrastructure Representative Project Manager Quality Assurance Lead Release Manager Subject Matter Expert System Administrator Technical Architect Technical Lead Technical Support Representative Testing Lead Training Lead Validation Analysts Validation Lead

29 What Validation Deliverables are Produced? Validation Master Plan Risk Assessment Report Vendor Assessment Report Training Plan User Requirements Specification System Requirements Specification Project Glossary Technical Architecture Specification Detailed Design Specifications Code Review Forms (only if customized) Unit, Integration, System and User Acceptance Test Plan Scripts Reports Test Incident Reports Validation Summary Report Data Migration Plan System Release Memo Change Request Form Periodic Review Report Business Continuity Plan Standard Operating Procedures Training Records

30 Agenda Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Validating Applications References Questions

31 Using a GAMP-4 Validation Methodology

32

33 Actionable Intelligence For Compliance

34 Actionable Compliance Intelligence Delivered

35 Agenda Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Validating Applications References Questions

36 References Code of Federal Regulations, Title 21, Part 11, Electronic Records; Electronic Signatures GAMP Guideline for the Validation of Automated Systems Version 4 (ISPE, 2001) General Principles of Software Validation; Final Guidance for Industry and FDA Staff, 11-Jan-2002 Guidance for Industry, Part 11, Electronic Records; Electronic Signatures Scope and Application, August 2003 IEEE Std , IEEE Standard for Software Project Management Plans IEEE Std , IEEE Standard for Software Verification and Validation, 9-Mar-1998 IEEE Std 1012a-1998, Supplement to IEEE Standard for Software Verification and Validation: Content Map to IEEE/EIA IEEE Std (R2002), IEEE Standard for Software Reviews IEEE Std (R2002), IEEE Standard Classification for Software Anomalies IEEE Std , IEEE Standard for Software User Documentation, 20- Dec-2001

37 References IEEE Std , IEEE Standard for Software Maintenance IEEE Std 1233,1998, IEEE Guide for Developing System Requirements Specifications, 8-Dec-1998 IEEE Std , IEEE Recommended Practice for Architectural Description of Software Intensive Systems IEEE Std (R2002), IEEE Standard Glossary of Software Engineering Terminology IEEE Std , IEEE Standard for Software Configuration Management Plans IEEE Std , IEEE Standard for Software Test Documentation IEEE Std 830,1998, IEEE Recommended Practice for Software Requirements Specifications, 25-Jun-1998 IEEE Std , IEEE Recommended Practice for Software Design Descriptions ISO 14971:2000(E), Medical Devices Application of Risk Management to Medical Devices, ISO, 2000.

38 Agenda Introduction Key Terms Regulatory Requirements Validation Overview Best Practice Responses to Frequently Asked Questions Validating Applications References Questions

39 Amadeus Solutions, Inc. Jeb Bullis Account Executive

40 Current Global Regulations BSI DISC PD MoReq Data Protection Act of :1999 CRFB - France Dublin Core SEC 17a-4 NASD 3010 FERC Part 125 UK Metadata Framework Sarbanes-Oxley Basel II Rev. Proc HIPAA SEC 17a DICOM Freedom of 21 CFR Part 11 The National Archive (TNA) Information Act of 2000 ISO US Patriot Act NARA Part 1234 FSA - SYSC BaFin Germany GLBA DoD esign Act ISO Common Criteria