Validating Computerized Systems

Only a small number of information technology (IT) projects are completed entirely successfully; approximately a third are cancelled and more than half significantly exceed deadlines and budgets (Figure 1). This is often because software suppliers have little or no experience of the validation required for the programs. However, validated software is important because good IT projects can help to reduce costs.

Pharmaceutical manufacturing process quality is governed by the requirements of the European Union's (EU's) EU-GMP Guideline, which covers implementing both hardware and software systems in production areas. The area concerning computer systems is described in Annex 11 "Computerized Systems," part of which requires that computer systems are validated from an early stage.

Figure 1: The success and failure of IT projects.

EU requirements

The principle of Annex 11 is that "when a computerized system replaces a manual operation, there should be no resultant decrease in product quality or quality assurance. Consideration should be given to the risk of losing aspects of the previous system, which could result from reducing the involvement of operators." Additionally, it is essential that there is close co-operation between key personnel and those involved in implementing the system.

Annex 11 details how personnel responsible for computerized systems must be appropriately trained to manage and use such systems. This includes ensuring that relevant expertise is available to advise on aspects of design, validation, installation and operation of computerized systems.

According to the annex guidelines, the system requirements can be summarized as follows:

• The system should be in a stable environment, eliminating interference from extraneous factors.

• There must be a detailed written description of the system, which needs to be kept up to date.

• A computerized system should be thoroughly tested before it is used. If a manual system is replaced, the two should be run in parallel for a time as part of the testing and validation procedure.

• Data should only be entered or amended by authorized persons, and suitable methods of

• preventing unauthorized entry must be in place. When critical data are entered manually, there should be an additional check on the accuracy of the record; this may be done by a second operator or by validated electronic means.

• It should be possible to obtain clear printed copies of electronically stored data. Data should be regularly backed up and stored at a separate, secure location.

• A procedure should be established to record and analyse system errors, and to enable corrective action to be taken.

Generally, it is the company using the computerized systems that must ensure validation and compliance with Annex 11 requirements. It also has to ensure that its supplier works in accordance to the requirements.

Issues

Annex 11 devotes only a brief paragraph to the complex subject of validation. It offers little definitive advice to those implementing computerized systems, and leaves much scope for interpretation. However, it does contain an important statement, which frequently causes problems: "Validation should be considered as part of the complete life cycle of a computer system." Often, the responsible personnel are not aware of this and assume that validation is a single process that takes place at the end of the development phase.

Figure 2: Each phase must be validated throughout the project life cycle.

Validation, however, is a continuous process that includes stages such as planning, specifying, programming, testing, commissioning, documenting, operation, monitoring and modifying. Each stage must be validated to comply with Annex 11 requirements. It is essential that if a system is modified, all stages must be validated again (Figure 2). For example, if a user requirement specification (URS) document is not validated at every stage, it cannot be compared with the completed computerized system. More work will be required to bring the URS up to date.

If each stage is validated, the result is a comprehensive document. The relationship between the effort needed to produce the documentation and the actual system development work is frequently misjudged - the ratio is approximately 8:1 (Figure 3).

Producing the large amounts of documentation that validation requires is often avoided. Because developers do not primarily associate documentation with functionality, there is no immediate association with system quality. Developers often do not understand the importance of validation documentation until further into the project, by which time it is far more difficult to produce. Inexperienced vendors underestimate the amount of documentation required to validate systems and often just provide general unified modelling language (UML) diagrams and comments. The fact that validation requires extensive documentation must be made clear from the outset, because the quality of a system decreases without this documentation (Figure 4).

Figure 3: The relationship between documentation and system development and Figure 4: Quality decreases without documentation.

Critical factors

Successful validation is based on a quality assurance (QA) system that encompasses all the departments involved in an IT project. Standard operating procedures (SOPs) must be provided for the work, and only by working to the SOPs will the implemented system achieve the required validation and quality.

If quality is to be maintained, this principle has to be adhered to. If, for example, a URS is produced according to a particular SOP then all further work on the document must be performed according to the same SOP. It is also important to maintain traceablity during the life cycle of the system. This procedure leads to complete documentation and is a requirement for successful audits.

Computerized systems are often produced by external providers.

To save time and money at a later stage, it is important that the vendor has experience of validation and works according to QA procedures. Although companies should ensure that the vendor is working according to the required guidelines, both sides must be aware of the requirements of computer system development. Only a system developed according to these guidelines will be successfully validated after implementation.

Benefits

Many projects fail because of the difficulties addressed earlier in this article. Computerized systems can bring significant cost benefits if they are implemented into processes that, traditionally, have not been automated. For example, during the course of a packaging project, work was produced by a number of people in different areas. The work had to be checked by a second person after all alterations had been made and so the document was sent to proofreaders. Problems arose when a number of copies of the document were circulated, resulting in many copies of the same document being proofed. Because all of the copies were editable, inadvertent changes were being made, resulting in a number of documents with differing content; the whole process, therefore, did not conform to EU-GMP guidelines. It also allowed the possibility of the wrong document being released.

A validated process would require that a uniquely identifiable document is proofed. Because digitally produced documents are frequently still processed manually, the system does not comply with validation guidelines and QA requirements. Many companies still use manual processes because, until recently, appropriate computerized systems have not been available.

Implementing a computerized system can eliminate the risks of human error inherent in manual systems. The system makes it possible to locate the document to be proofed from a central store. In place of the document, the system provides a non-editable version to the proofreader, which only allows correction notes to be attached, eliminating the possibility of inadvertent changes. The system allows all proofreaders to check the relevant document from one location and add their annotations to this single document.

Summary

Manual systems are still used for many processes, despite not conforming to the EU guidelines. However, these systems are increasingly being replaced with validated computer systems. The pharmaceutical industry can benefit from the significant time and cost savings to be gained by implementing computerized systems.