Computerized Systems Validation

Siegfried Schmitt, principal consultant, PAREXEL, discusses how to assure compliance for automated systems.

Q. We have recently updated our list of computerized systems that require validation, including only systems that store or display data. While all systems on this list have been validated, some were validated more than five years ago. Is this approach compliant with 21 Code of Federal Regulations (CFR) Part 11?

A. There is no simple yes or no answer to your question, as we must first look at your list of systems. It is essential to maintain an inventory of all systems in your facility, including those that are automated. Though US regulations do not specifically require it, it is beneficial to include the following information in the inventory list (1):

• What is the intended use of the system?

• Is the system GxP relevant?

• Does the system create or store electronic records/electronic signatures?

• Does the system link to the validation documentation?

The inventory list should have all systems in your facility listed, with a brief rationale of the underlying factors for your decision on each entry--for example, perhaps the building management system in building 101 is only used for the control of the cafeteria and is thus deemed non-GxP relevant. Based on the intended use for each system, one should be able to answer quite easily the second question regarding GxP relevance. All GxP relevant systems must be validated (2).

It’s also worth noting that the inclusion/exclusion criteria you mentioned for systems that require validation (i.e., must store or display data) may be restrictive. There typically are many automated systems in a facility, such as manufacturing equipment that are critical to process control and product quality, without necessarily storing or displaying data. It is best to expand your criteria to prevent missing any of these systems.

Whether validation performed prior to 2010 was adequate depends on whether or not you complied with the applicable regulations and continue to do so (2). Thus, the expectation by FDA and other regulatory agencies is that you verify in intervals (e.g., once every three years, following a major upgrade, etc.) the continued compliance status of your computerized system.

Regarding compliance with 21 CFR Part 11 on Electronic Records/Electronic Signatures (ER/ES) (3, 4), where you identified a system to store ER/ES, your validation should have covered the ER/ES relevant regulations and guidance documents. Only a review of your validation documentation could determine if you did comply with all the applicable regulations, including Part 11 requirements. This is where your link to the validation documentation is helpful.

While there are many nuances to determining compliance for certain systems, timeframes, and regulations, your inventory list is essential and the most valuable reference document. It can be used for internal use or for review during audits or inspections, but it must be complete and up to date.

References
1. European Commission, EudraLex, The Rules Governing Medicinal Products in the European Union, Vol. 4, EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use Part 1, Annex 11: Computerised Systems, accessed July 1, 2015.
2. FDA, General Principles of Software Validation; Final Guidance for Industry and FDA Staff (FDA, January 11, 2002), accessed July 1, 2015.
3. FDA, CFR Title 21, Part 11 (Government Printing Office, Washington, DC, revised April 1, 2014), accessed July 1, 2015.
4. FDA,Guidance for Industry Part 11, Electronic Records; Electronic Signatures--Scope and Application (FDA, August, 2003), accessed July 1, 2015.

Article DetailsPharmaceutical Technology
Vol. 39, No. 9
Pages: 74

Citation: When referring to this article, please cite it as "Computerized Systems Validation,” Pharmaceutical Technology39 (9) 2015.