Data Integrity: Production Environment

Transcription

1 Data Integrity: Production Environment MANUAL AND AUTOMATED SYSTEMS Ciara Turley GMP Conference 12 th November 2014

2 Content GMP Guide requirements and application to processing equipment Security Audit trail Accuracy checks Storage of data Print outs Vendors URS and qualification Periodic evaluation Deficiencies cited 12th November

3 Security Management systems for data and for documents should be designed to record the identity of operators entering, changing, confirming or deleting data, including date and time. User access individual passwords Segregation of duties Overlap of duties risk assessed. 12th November

4 Audit trail Consideration should be given, based on a risk assessment, to building into the system the creation of a record of all GMP-relevant changes and deletions. For change or deletion of GMP relevant data the reason should be documented. Audit trails need to be available and convertible to an intelligible form and regularly reviewed Self Inspection. Incidents related to computerized systems that could affect the quality of intermediates or APIs or the reliability of records or test results should be recorded and investigated. 12th November

5 Data accuracy checks For critical data entered manually, there should be an additional check on the accuracy of the data. This check may be done by a second operator or by validated electronic means. The criticality and the potential consequences of erroneous or incorrectly entered data to a system should be covered by risk management. If data are transferred to another data format or system, validation should include checks that data are not altered in value and/or meaning during this migration process. 12th November

6 Storage of data Data should be secured by both physical and electronic means against damage. Access to data should be ensured throughout the retention period. Regular back-ups of all relevant data should be done. Integrity and accuracy of backup data and the ability to restore the data should be checked during validation and monitored periodically. 12th November

7 Print outs It should be possible to obtain clear printed copies of electronically stored data. Can the information be securely transferred or downloaded to storage media in an intelligible format and then reviewed / inspected? For records supporting batch release it should be possible to generate printouts indicating if any of the data has been changed since the original entry. 12th November

8 Vendors Competence and reliability of supplier assessed and documented. Agreements with suppliers for installation, qualification, maintenance, back up, administration access. 12th November

9 URS and qualification User Requirement Specifications should describe the required functions of the computerised system and be based on documented risk assessment and GMP impact. Evidence of appropriate test methods and test scenarios should be demonstrated. Particularly, system (process) parameter limits, data limits and error handling should be considered. 12th November

10 Periodic evaluations Computerised systems should be periodically evaluated to confirm that they remain in a valid state and are compliant with GMP. Such evaluations should include, where appropriate, the current range of functionality, deviation records, incidents, problems, upgrade history, performance, reliability, security and validation status reports. 12th November

11 Points to note: Understand the capability of your equipment, know if it stores electronic data, assess if parameters are changed what impact it will have. Computer programming can potentially replace human judgment. Annex 11 provides guidance to help ensure electronic record integrity, which in turn helps ensure product safety. Directive 2003/94/EC, 91/412/EEC Article 5: The manufacturer shall regularly review his manufacturing methods in the light of scientific and technical progress 12th November

12 Examples of Deficiencies The following deficiencies were noted with regards to the blister packaging machine There was no controlled recipe in place to confirm that parameter settings on the machine were those approved. The time on the HMI was incorrect the actual time (taken from the wall clock in the packaging area was recorded at 12:15, the machine time was displayed as 11:08. A generic operator password was in use Audit trails were not reviewed. The print out function was not enabled and there was no assessment to determine if stored data could be securely transferred or downloaded to storage media in an intelligible format for review Manufacturing data since 2003 from a previous manufacturer / owner was retained on machine. 12th November

13 Examples of Deficiencies The qualification and data integrity controls for the filling machine were considered inadequate in that: There was no technical agreement with the vendor A single generic user name and password was used to access and operate the equipment. The time setting on the software control was inaccurate. The audit trail could not be generated at the time of inspection. The system and security for archiving of data was not known The User Requirement Specification did not specifically state all the requirements for the machine and was not linked to any critical process parameters / variables 12th November

14 Examples of Deficiencies The company is advised that manufacturing controls should be updated in line with technical progress (ref. Directive 2003/94/EC, Article 5 (2)). In particular fluid bed dryers should be equipped with chart recorders to facilitate monitoring and recording of the granulate drying process. The qualification / revalidation was deficient in that there was no consideration of the impact of updated requirements since the initial IOQ, specifically Annex th November

15 References EU Guidelines to GMP EMA Questions and Answers: Good manufacturing practice 12th November