MASTER VALIDATION PLAN PROCEDURE DRAFT DRAFT OF A POSSIBLE COMPUTER SYSTEMS VALIDATION MASTER PLAN PROCEDURE

Transcription

1 DRAFT OF A POSSIBLE COMPUTER SYSTEMS VALIDATION MASTER PLAN PROCEDURE 1. PURPOSE The purpose of this SOP is to define the minimum requirements for Computer Systems Validation (CSV) at (insert name of company here) 2. SCOPE This SOP applies only to computerized systems that are released for production use after this SOP becomes effective. A computerized system is covered by this SOP if it collects, stores, analyzes, or reports information in support of GxP activities within (insert company name). The CSV Contact, in conjunction with management, is responsible for determining if a particular system falls within the scope of this SOP. A decision tree is included as Attachment A as a guide in determining the applicability of this SOP to a particular computerized system. Computerized instrument systems that are routinely verified may be outside the scope of this SOP. The CSV Contact, in conjunction with management, is responsible for making this determination. 3. AUDIENCE This SOP applies to all personnel within (insert company name), whether employees, contractors, or consultants, who develop, implement, use, support, or manage (insert company name) computerized systems within the scope of this SOP as defined in Section 2 above. External organizations (e.g., Contract Labs and Contract Manufacturers) that perform GxP activities on behalf of (insert company name) are expected to have their own procedures regarding validation of the computerized systems they utilize. Divisions within (insert company name) who utilize external services are responsible for determining computer validation procedures exist and are current. **** REFERENCE VERSION ONLY 1

2 4. REFERENCES ****** Managing the Document Management Records Center ***** Any other relevant SOP s and references 5. ATTACHMENTS Attachment A: CSV SOP Scope Decision Tree 6. DEFINITIONS AND RESPONSIBILITIES Change Control: The process of assuring that a computerized system remains validated following a change. It includes assessing the impact of the change and repeating appropriate activities from the validation process. Computerized System: An organized set of hardware, software, associated equipment, instrumentation, documentation (e.g., manuals and Standard Operating Procedures) and personnel designed to perform one or more business functions. A computerized system may be a stand-alone unit or may consist of several interconnected units. Computerized systems include desktop systems, client/server systems, and host-based systems. CSV Contact: The CSV Contact (may be an individual or a team) for a particular computerized system is assigned by management to address validation issues for that system. Responsibilities include: determining if a particular system falls within the scope of this SOP, in conjunction with management determining the extent of validation required in consultation with management and appropriate technical personnel coordinating validation activities determining the extent of revalidation necessary as part of change control seeking advice from the CSV Steering Group as needed CSV Steering Group: The CSV Steering Group is a working group comprised of (insert company name) division representatives. This group is responsible for providing advice and guidance regarding appropriate and consistent implementation of the CSV SOP. Division: A division is a group of departments with one representative on the (insert company name) Management Board. GxP: Equivalent to and an abbreviation for GLP, GMP, and GCP considered together. **** REFERENCE VERSION ONLY 2

3 Information: For purposes of this SOP, information includes but is not limited to: data, images, and documents. IQ/OQ (Installation Qualification / Operational Qualification): Documented evidence that all key components of the computerized system have been correctly installed according to manufacturer s requirements and specifications and are operating correctly. Management: (insert company name) division management is responsible for ensuring compliance with this CSV SOP within their division. Management responsibilities specified elsewhere within this SOP may be delegated to other individuals. Revalidation: The process of assuring that a computerized system remains validated over time. It includes assessing the collective impact of any changes and repeating appropriate activities from the validation process. Validation: The process which establishes evidence and associated documentation that a computerized system is developed according to quality software engineering principles, that it provides the functionality capability required by its users, and that it will continue to do so over time. 7. POLICIES/PROCEDURES Computerized systems that fall within the scope of this SOP must be validated before being used for production work Characteristics of Validated Computerized Systems Validated computerized systems have the following characteristics: developed by qualified personnel according to a pre-defined development procedure which produced pre-defined deliverables (i.e., evidence that the procedure was followed) protected from unauthorized modification satisfied user requirements supported and maintained by qualified personnel in accordance with change control procedures utilized by trained and qualified users involved management approval of the validation process validation deliverables reviewed and approved by qualified personnel **** REFERENCE VERSION ONLY 3

4 These characteristics apply to large, multi-user applications as well as to single-use programs (e.g., Excel macros) that are within the scope of this SOP. These characteristics are the minimum requirements for a validated system within (insert company name). The CSV Contact and management are responsible for determining what additional requirements are warranted based on the type of system and its use within the division Inventory of Computerized Systems in Scope Divisions using systems that fall within the scope of this SOP must maintain an inventory of these systems. This inventory, at a minimum, must contain the name of the system and the name of the CSV Contact(s). The inventory is updated as systems are introduced and is reviewed annually for accuracy and completeness. For systems that are shared across divisions, the system is included in each division s inventory but the CSV Contact is the same for each entry. For purposes of this inventory, a computerized system can be a group of systems (e.g., a group of statistical macros or programs) Change Control Components of a validated computerized system (e.g., hardware, operating system software, application software, configuration parameters, user access information) are subject to change control. Management is involved in approval of the change control process Standard Operating Procedures Divisions who use computer systems that fall within the scope of this SOP are responsible for ensuring that the activities listed below are addressed in SOPs. If these activities are the responsibility of the division, they need to be included in division SOPs. If these activities are the responsibility of other areas within (insert company name) or J&J (e.g., Information Management & Technology or J&J networking and Computing Services), the division needs to verify that these activities are included in the other area s SOPs. An SOP may include multiple activities. An SOP may be relevant to multiple systems. Systems Development and Infrastructure Vendor evaluation and audits Systems development Hardware and software IQ/OQ Security (e.g., physical access to the system or information and logical system access via username/password) User Procedures **** REFERENCE VERSION ONLY 4

5 System use including fall back procedures if the system is unavailable Training Raw data definition Maintenance Procedures Problem reporting Change control including changes to the infrastructure Configuration management (i.e., maintaining information regarding the system configuration at any point in time) Periodic review and evaluation to ensure that the validated state has been maintained Backup and restore Archive and dearchive (information and systems) Maintenance of hardware and software (e.g., identification of responsibility for ongoing maintenance and support) 7.5. Joint Business Initiatives Projects which fall into the category of Joint Business Initiatives (JBIs) i.e., are joint projects between (insert company name) and groups or companies outside(insert company name), may define their own project-specific validation methodology and approach. It is the responsibility of a (insert company name) representative on the project team to ensure that the validation methodology and approach meet the minimum requirements specified in this SOP Training and Experience Personnel who develop, use, or support computerized systems that fall under this SOP must be suitably qualified and trained. To document qualifications and training, divisions which include these personnel must maintain curriculum vitae and training records in compliance with division and company policies and procedures Records Records (documentation and other systems deliverables) supporting computerized systems covered by this SOP are maintained in accordance with (insert company name) Document Management SOP s. **** REFERENCE VERSION ONLY 5

6 7.8. Revalidation The CSV Contact listed in the systems inventory (see section 7.2) is responsible for determining the extent of any revalidation. Management is responsible for ensuring that any revalidation activities are approved by qualified personnel. **** REFERENCE VERSION ONLY 6

7 ATTACHMENT A CSV SOP SCOPE DECISION TREE (This decision tree is to be used as a guide in determining the applicability of the CSV SOP to a particular computerized system.) Is the system used in support of GxP activities? Does the system feed information to a system used in support of GxP activities? Does it collect, store, or analyze information that supports the safety, efficacy, manufacture, or quality of company products? Does it report information in support of GxP activities? t Within Scope Is it used only for word processing or graphics presentations? Is it an instrument? Is its performance routinely verified? Within Scope System = computerized system **** REFERENCE VERSION ONLY 7