Gu_a_para_Validaci_n_de_Sistemas_Computarizados_1736946486.pptx

CSV

1. An Expert Guide to Commonly Overlooked Basics and Best Practices The FDA Group | 1-833-FDA- GROUP 1 Preparing for Computer System Validation (CSV)

2. The FDA Group, LLC 2 The FDA Group | 1-833-FDA- GROUP We are a global leader in life science consulting , staff augmentation , and FTE recruitment to the life science industry. We also offer a Functional Service Program for bundled service discounts. We have over 2,500 consultants, over 225 of whom are former FDA. We currently have boots on the ground in 46 states and 47 countries. Our exclusive life science focus, dedicated account management teams, 95% placement success rate, and 97% client satisfaction rating are the reasons that we are only firm in the industry that backs all its service offerings with a Total Quality Guarantee. Learn more and connect with us » www.TheFDAGroup.com

3. A Brief Introduction 3 The FDA Group | 1-833-FDA- GROUP Rashida is a seasoned quality assurance and compliance professional with a robust background in computer system validation (CSV) and auditing in the pharmaceutical, medical device and biologics sectors. As an industry consultant serving as a Senior Validation Engineer, she offers a deep understanding of regulatory requirements and quality systems, underpinned by over a decade of experience in the industry. In her current role at The FDA Group, she leverages her CSV expertise to evaluate computer systems for clients, ensuring they comply with all relevant regulations and standards. Her skills extend to conducting audits, managing quality systems, and providing guidance on regulatory compliance. Introduction Rashida Ray

4. Introduction 4 The FDA Group | 1-833-FDA- GROUP In the complex landscape of the FDA- regulated industries, Computer System Validation (CSV) is critical, ensuring that systems operate consistently and produce results that meet predetermined specifications. CSV is not merely an industry recommendation; it’s a regulatory necessity that bridges the gap between technology and regulatory compliance. This white paper offers guidance on a few of the basic best practices that are widely overlooked, particularly at the outset of a project, as gleaned from an in-depth conversation with a senior validation expert and consultant, Rashida Ray. The insights drawn from this discussion highlight the core components that drive successful CSV projects, including planning and project management, effective communication, understanding and adherence to FDA regulations and expectations, the value of external consultants, and the necessity for continuous improvement in CSV practices. Understanding and implementing CSV processes can often pose challenges in an industry where regulatory standards are paramount. This white paper intends to provide an in- depth understanding of these challenges and offer practical solutions to navigate them successfully.

5. Introduction (cont.) 5 The FDA Group | 1-833-FDA- GROUP Need expert CSV support? Contact us today to rapidly access the industry’s top validation experts. Our consultants work closely with FDA- regulated firms to ensure and validate computer systems, data integrity, and quality. Our experts validate the integrity and quality of your computer systems and data. We can help you: Assess system requirements and documentation. Evaluate data governance using risk-based strategies, addressing any compliance gaps. Validate computer systems for safety, reliability, and availability, including cloud systems. Access hard- to-find expertise in proprietary and commercial software, focusing on regulatory requirements. Our services include: Computerized and cloud system Validation. Data integrity infrastructure setup. Third-party and vendor audits, including mock pre- approval inspections. Risk assessments and mitigation. Remediation for data integrity gaps. Data Governance program development. Responses to FDA- 483 and warning letters. Audit support and preparation. Training in data integrity and computer system validation.

6. CSV Basics: A Brief Review 6 The FDA Group | 1-833-FDA- GROUP What is CSV? CSV is a documented process for assuring that a computer system does exactly what it is designed to do consistently and reproducibly. The process ensures that the system meets all predetermined requirements and is fit for its intended use. It helps to ensure data integrity, patient safety, and product quality— and reduce the risk of product recalls and regulatory action. In FDA- regulated industries, CSV ensures that all computer systems controlling manufacturing processes are validated. This includes systems for production, quality control, and distribution. What does CSV involve? The CSV process involves several steps: planning, specification, programming, testing, documentation, and operation. Each step is crucial and must be performed correctly to ensure the system's validation.

7. CSV Basics: A Brief Review (cont.) 7 The FDA Group | 1-833-FDA- GROUP What are the key components of a CSV plan? A CSV plan includes defining the system, identifying the key users, outlining the intended use, and detailing the validation strategy. It also includes risk assessment, defining responsibilities, and setting timelines. What are the FDA’s expectations regarding CSV? The FDA has specific expectations for CSV in the industries it regulates, particularly in the pharmaceutical, medical device, and biotech sectors. Here are some of them »

8. CSV Basics: A Brief Review (cont.) 8 The FDA Group | 1-833-FDA- GROUP Regulatory Compliance: The FDA expects that all computer systems used in the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished products intended for human use should comply with 21 CFR Part 11 and other relevant regulations. Validation Documentation: The FDA expects firms to maintain comprehensive documentation of the validation process. This includes validation plans, system specifications, test protocols, and test results. The documentation should be sufficient to demonstrate that the system is validated and operates correctly. Risk Assessment : The FDA expects companies to perform risk assessments to identify the potential impact of system failures on product quality, patient safety, and data integrity. The level of validation effort should be commensurate with the level of risk. Data Integrity: The FDA expects that CSV processes will ensure data integrity. This includes generating accurate and reliable data, preventing unauthorized access or changes to data, and maintaining audit trails. Change Control: The FDA expects a robust change control process. Any changes to the system, including software updates or hardware changes, should be documented and validated to ensure that they do not adversely affect system performance or data integrity. Training: The FDA expects that individuals responsible for the design, operation, maintenance, and validation of computer systems are adequately trained to perform their duties. Periodic Review: The FDA expects companies to periodically review validated systems to ensure they remain in a state of control and continue to meet their intended purpose. Vendor Assessment: If third-party software or systems are used, the FDA expects companies to assess the vendor's ability to provide a product that will meet the user's requirements and regulatory expectations.

9. Common CSV Challenges & Best Practices 9 The FDA Group | 1-833-FDA- GROUP 1. Planning

10. 1. Planning 10 The FDA Group | 1-833-FDA- GROUP Teams often fail to fully consider the impact and reach of a system they plan to implement. Siloed thinking limits their perspective of the implications on other departments. They create specifications based on their department's needs without considering that other departments may also use the system, resulting in issues down the line. The best solution is to create a process map that details how the system will be used, what areas will be affected, and how the data flows through the system. With a process map in hand, you can identify specific requirements based on the system's use in different departments. Understanding how data is collected, where it resides, and how it's manipulated can help identify potential issues with data integrity.

11. 1. Planning (cont.) 11 The FDA Group | 1-833-FDA- GROUP Process Mapping in CSV: A Brief Explainer Process maps are graphical representations of tasks performed in an operation, providing an overarching and detailed view of involved activities. They help identify the individual components that contribute to the successful execution of a process, thereby ensuring system standardization. Here are some things to keep in mind when creating process maps in preparation for CSV »

12. 1. Planning (cont.) KEY CONSIDERATIONS & BEST PRACTICES: Designate a Process Owner: The process owner, who is well-versed in all aspects of the process including activities, materials, suppliers, teams, and the system itself, plays a crucial role in developing a process map. They guide the process and are often responsible for its successful execution. Master the Process: Staff should ideally have a thorough understanding of the process to prevent errors such as unclear objectives, unnecessary process modifications, mismatched activities, unachievable user requirements, or designing a system unfit for its intended purpose. Set Clear Objectives: Clear, measurable, achievable, and consistent goals must be defined for the process, addressing what needs to be done, how it will be done, and why. After setting the objective, the process's expectations, needs, and deliverables should be identified. Identify Process Components: The key components of a process include input sources, inputs, operational processes, support processes, outputs, and customers. Create the Process Map: With the components identified, a process map can be drawn to identify the interrelationships between different processes or threads. The mapping can be done from a broad view to a more detailed one, involving macro, process, activities, and tasks. 12 The FDA Group | 1-833-FDA- GROUP

13. 1. Planning (cont.) 13 The FDA Group | 1-833-FDA- GROUP In addition to developing a process map, it’s also important to establish procedures and technical solutions to control your data , for instance, to know who has access to the system and ensure that unauthorized individuals can't tamper with the raw data, and avoid potential issues with editing final reports. Consider how the new system could affect existing procedures and whether they need to be revised accordingly. As for the tools to create these process maps, consider platforms like Microsoft Visio, Lucidchart, or even hand- drawing them. However, the most important part— and often the most overlooked— is asking the right questions to understand how the system operates and the regulatory or security controls needed around it. Consider the following questions when structuring your CSV planning and crafting process maps »

14. 1. Planning (cont.) 14 The FDA Group | 1-833-FDA- GROUP Intended Use and User Requirements What is the primary purpose of the system, and how will it be used? Who are the end- users, and what are their specific requirements and expectations? What are the critical functionalities and features the system must have? Data Management and Data Integrity How is data collected, stored, and processed within the system? Are there critical data fields that require additional security or validation checks? How is raw data generated and captured, and how is it protected from manipulation or deletion? System Validation and Testing What validation approach will be used for the system (e.g., GAMP, ASTM E2500)? What are the critical components and functionalities that need to be validated? How will testing be conducted, and what specific tests are required to ensure system functionality and integrity?

15. 1. Planning (cont.) 15 The FDA Group | 1-833-FDA- GROUP Security and Access Controls Who should have access to the system, and what are their specific roles and permissions? Are there any data privacy or security regulations that must be adhered to? How will unauthorized access be prevented, and what measures are in place to protect sensitive data? Change Control and Configuration Management How will changes to the system (e.g., software updates, configurations) be managed and documented? What is the implementation process, and how will their impact be assessed? Are there any regulations or guidelines regarding change control that need to be followed? Audit Trails and Data Traceability How will the system maintain an audit trail of user activities and system events? Can the system provide a comprehensive data history and traceability for all critical processes? What measures are in place to detect and investigate data discrepancies or anomalies?

16. 1. Planning (cont.) 16 The FDA Group | 1-833-FDA- GROUP Disaster Recovery and Business Continuity What is the plan for system backup, disaster recovery, and business continuity in case of system failures or data loss? Are there any regulatory requirements related to data backup and disaster recovery that must be considered? Compliance and Regulatory Requirements What specific regulations and standards apply to the system (e.g., 21 CFR Part 11, EU Annex 11, GxP)? How will the system be designed and implemented to meet these regulatory requirements? What documentation and evidence will be needed to demonstrate compliance? Training and User Support What training will be provided to users to ensure they can effectively use the system and understand its compliance requirements? How will ongoing user support and system maintenance be handled?

17. 1. Planning (cont.) 17 The FDA Group | 1-833-FDA- GROUP "When you have your intended use, create a process map of the entire system, understanding how it will be used and what it will affect. Then, get to know your system better to visualize data integrity aspects like how the data is acquired, where it is, how it's collected, and what measures are in place to ensure it can't be tampered with or deleted. These steps in planning a CSV project are incredibly crucial but very commonly overlooked.” — Rashida Ray

18. 1. Planning (cont.) — Action items ACTION ITEMS: Develop a thorough understanding of the system’s intended use and its potential effects on various departments from the outset. When initiating a new CSV project or implementing a new system, the first step is to clearly define the desired functionalities and objectives of the system. One way to do this is through a stakeholder analysis. Identify all potential stakeholders, their needs, and their expectations. This should include direct users of the system and those who may be affected indirectly. This could be someone from another department that uses data from the system or a manager who relies on reports generated by it. Gather insights from these stakeholders through interviews or surveys to understand how they may interact with or be affected by the system and compile it in a document for reference. 18 The FDA Group | 1-833-FDA- GROUP

19. 1. Planning (cont.) — Action items ACTION ITEMS: Create a process map detailing the system's use in different functional areas. Identify all the key stakeholders who will be involved in the process (end- users of the system, IT personnel, quality assurance team, regulatory personnel, management, etc.). Then, gather information from them regarding each person's tasks, the data they use or generate, their decisions, and their tasks' outcomes. With this information in hand, you can draft the process map. It can be a simple flowchart or a more detailed value stream map. Once the draft process map is complete, validate it with the stakeholders to ensure it accurately represents the process. 19 The FDA Group | 1-833-FDA- GROUP

20. 1. Planning (cont.) — Action items ACTION ITEMS: Also consider creating a data- specific process map to visualize how data is collected, where it resides, and how it's used. Data lineage tools visually represent your data landscape— showing you where your data comes from, how it moves over time, and how it's transformed. This can be very valuable in understanding and managing your data processes. These tools also make identifying potential data integrity risks easier and ensure that data is handled per regulatory requirements. 20 The FDA Group | 1-833-FDA- GROUP

21. 1. Planning (cont.) — Action items ACTION ITEMS: Evaluate existing procedures and revise them as needed to accommodate the new system. A change impact analysis can help you identify the potential effects of the new system on existing procedures. This exercise involves identifying the changes that will be introduced by the new system, analyzing how these changes will affect existing processes, and planning necessary adjustments. The analysis should consider both direct changes (e.g., tasks that will be performed differently) and indirect changes (e.g., changes in data flow that might affect other processes). 21 The FDA Group | 1-833-FDA- GROUP

22. 1. Planning (cont.) — Action items ACTION ITEMS: Consider using visual aid tools such as Visio for process mapping, but also ensure that the right questions are being asked to capture the full scope of the system's operation. A simple strategy is incorporating "What if?" scenarios in your process mapping. Identify potential issues or events that could occur during system operation and then work through how the system and users would respond in each scenario. This can help ensure that your process maps are comprehensive and realistic. It also promotes problem-solving and can reveal weaknesses or oversights in the proposed system or processes. 22 The FDA Group | 1-833-FDA- GROUP

23. Common CSV Challenges & Best Practices 23 The FDA Group | 1-833-FDA- GROUP 2. Communication

24. 2. Communication 24 The FDA Group | 1-833-FDA- GROUP “Silo mentality” is both pervasive and insidiously hard to recognize when different departments operate in relative isolation. If left to fester, it can lead to systems or processes that may serve one team’s individual needs but often fail to accommodate the needs of other departments. Without genuine cross- departmental collaboration, CSV, like many other types of projects whose outcomes impact more than one side of the business, suffers from friction and inefficiency. Early and comprehensive communication involving all departments impacted by the new system is the key to mitigating this. Too often teams are brought in last minute when their feedback is largely inconsequential due to how far along the process is, making the whole exercise feel counterproductive .

25. 2. Communication (cont.) 25 The FDA Group | 1-833-FDA- GROUP Another commonly overlooked aspect of communication is the regular holding of cross- functional meetings . Regular sessions allow for critical questions to be asked, ideas to be brainstormed, and requirements to be gathered, ultimately facilitating proactive rather than reactive process optimization. Including subject matter experts from each department in these meetings is also beneficial, as their specialized knowledge can offer unique insights and direction that might otherwise not have been obvious. One of Rashida’s central points revolves around asking the right questions when considering a new system, such as, "What do we need it to do?" and "How can we optimize our existing processes?" This approach ensures the collection of necessary requirements and the selection of a system that meets the needs of most departments.

26. 2. Communication (cont.) 26 The FDA Group | 1-833-FDA- GROUP Similarly, Rashida underscores the importance of keeping everyone informed and included in the process. The sentiment of being necessary and included contributes to a more cohesive working environment and is crucial to successfully implementing new systems. Coupled with this, Rashida highlights the importance of critical thinking and mapping processes, where each department's procedures are scrutinized to understand how a new system will affect them and how the process can be optimized. "What I've seen many times is people don't talk to each other, there are no cross- functional team meetings, even though they know that other departments are affected. So you're creating an even bigger process map at this point, right? Because you have different departments that are affected by this particular system. That would require some cross- functional team meetings. There might be some subject matter experts from each department, some sort of manager from that department, that can really give a lot of good insight on certain things and how the system can be integrated into their own existing processes.” — Rashida Ray

27. 2. Communication (cont.) — Action items ACTION ITEMS: Hold a cross- functional team meeting ahead of the project. A few major goals of this session should be to (1) understand how the new system will affect each department, (2) provide an opportunity for departments to exchange information about their processes, and (3) gather specific requirements from each group. You may come to learn that even more departments are impacted than were initially assumed. 27 The FDA Group | 1-833-FDA- GROUP

28. 2. Communication (cont.) — Action items ACTION ITEMS: Identify department- level subject matter experts. Managers or directors should identify and delegate tasks to department subject matter experts. These individuals will be instrumental in providing detailed insights into integrating the new system into their processes. Don't assume expertise based on job titles alone. Instead, allow people to self-nominate based on their interests, knowledge, and experience. Encourage peers to recommend one another. 28 The FDA Group | 1-833-FDA- GROUP

29. 2. Communication (cont.) — Action items ACTION ITEMS: Plan for early involvement. Include all relevant departments from the earliest stages of the project. This will ensure their feedback can significantly influence the project and prevent last- minute changes that may cause inconvenience, delays, and rework. Communicate clearly with the software vendor. Bring the vendor a comprehensive list of requirements, concerns, and questions. Don't hesitate to ask for clarifications, demonstrations, or proof of concept. Maintain a clear and regular line of communication with the vendor and document all interactions for reference. 29 The FDA Group | 1-833-FDA- GROUP

30. Common CSV Challenges & Best Practices 30 The FDA Group | 1-833-FDA- GROUP 3. Understanding Regulations

31. 3. Understanding Regulations 31 The FDA Group | 1-833-FDA- GROUP The third basic but major challenge facing businesses involved in CSV is understanding the complexity of regulations and regulatory expectations. This challenge emerges from the rapid pace of changes in regulations, the high turnover of personnel within organizations, and the dynamic nature of the regulatory environment itself. This issue often arises when companies treat regulatory compliance as an exercise in box- checking, often following regulatory guidelines without understanding their underlying purpose. This lack of understanding typically stems from ineffective training— and can lead to teams unknowingly violating FDA regulations. The most effective solution to a training problem is bringing in an outside party to reveal knowledge gaps with an unbiased perspective and provide the requisite training . Internal training, which is sometimes sufficient, often fails to cover the extent of knowledge gaps.

32. 3. Understanding Regulations (cont.) 32 The FDA Group | 1-833-FDA- GROUP Treat regulatory compliance as more than a paper exercise, prioritizing patient safety and quality at all times. Focus training on specific regulations like 21 CFR Part 11, Part 820, and the most current guidances. Third-party gap assessments can be extremely valuable in identifying blind spots in the organization's understanding and application of these regulations. Again, the importance of a fresh perspective to illuminate potential gaps and provide new solutions can’t be overstated. This includes hiring new employees with different experiences and ideas that can contribute to a richer understanding of regulations and better compliance practices. In addition, Ray points out the usefulness of bringing in consultants, even when it may not seem obvious, to provide a fresh pair of eyes and help improve processes. The key takeaway from Ray's discussion is the crucial need for external training and consulting to enhance the understanding and effective application of regulations in CSV, underlining the significant role of consultants in maintaining quality and patient safety in compliance activities.

33. 3. Understanding Regulations (cont.) 33 The FDA Group | 1-833-FDA- GROUP "When you have a project, and regardless of what happened, whether you receive a 483, or there was some sort of audit finding of some kind, from a vendor, audit, etcetera. You have those findings, and you look at those findings as an exercise. And you treat it as if we need to get this done because they told us so. But not because you actually understand and know what those regulations are. And that really comes down to training. And you don't know what you don't know. You know, you've been doing things a certain way. You don't necessarily understand why that way is not compliant with FDA regulations. You know, you don't understand why performing certain shortcuts is a big problem. So honestly, the only way to do that is to bring someone in from the outside to do the training." — Rashida Ray

34. 3. Understanding Regulations (cont.) — Action items ACTION ITEMS: Provide regulatory training as part of CSV. Training is essential to ensure everyone understands the regulations and can apply them practically. Instead of simply treating findings as exercises, the team should fully understand the regulations. Consider bringing outside experts to provide a fresh perspective and a more impactful training session. Conduct gap assessments. External parties should perform routine gap assessments on your systems to ensure they meet all relevant regulations. This can help reveal unknown gaps in the system. Contact a reputable external auditor to conduct these assessments and use their findings to prioritize remediation efforts. 34 The FDA Group | 1-833-FDA- GROUP

35. 3. Understanding Regulations (cont.) — Action items ACTION ITEMS: Leverage experience gleaned from different companies. When consultants or new hires join your team, they bring a wealth of experience from different companies and projects. They can point out potential risks or suggest improvements based on their previous experiences. Regularly tap into this knowledge by fostering an open, sharing culture where past experiences are seen as valuable learning opportunities. 35 The FDA Group | 1-833-FDA- GROUP

36. 3. Understanding Regulations (cont.) 36 The FDA Group | 1-833-FDA- GROUP Here are some key documents and guidelines to consider covering through training to prepare for CSV properly. Talk to us about a training engagement if you spot internal knowledge gaps. 21 CFR Part 11 This is the FDA's regulation on electronic records and electronic signatures. It sets the criteria under which electronic records and signatures are considered trustworthy, reliable, and equivalent to paper records. FDA's Guidance for Industry: Computerized Systems Used in Clinical Investigations This document provides recommendations on the use of computerized systems in clinical investigations. It covers data collection, record keeping, and record retention. FDA's Guidance for Industry: Electronic Source Data in Clinical Investigations This guidance provides recommendations on capturing, using, and archiving electronic data in FDA- regulated clinical investigations.

37. 3. Understanding Regulations (cont.) 37 The FDA Group | 1-833-FDA- GROUP General Principles of Software Validation This FDA guidance provides a comprehensive overview of the principles and practices of software validation, including requirements, verification, and validation processes. GAMP 5 (Good Automated Manufacturing Practice) While not an FDA document, GAMP 5 is widely recognized in the pharmaceutical industry. It provides a structured approach to CSV and is often used as a best practice guide for system validation. PIC/S Guidance on Good Practices for Computerized Systems in Regulated GxP Environments This document, from the Pharmaceutical Inspection Convention and Pharmaceutical Inspection Co-operation Scheme (PIC/S), provides guidance on the validation and management of computerized systems used in GxP environments. ICH E6(R2) Good Clinical Practice This is an international ethical and scientific quality standard for designing, conducting, recording, and reporting trials that involve human subjects. It includes guidelines on electronic trial data handling. FDA's Data Integrity and Compliance With Drug CGMP Questions and Answers This guidance addresses data integrity issues that can arise during the lifecycle of computerized systems.

38. 3. Understanding Regulations (cont.) 38 The FDA Group | 1-833-FDA- GROUP General Principles of Software Validation This FDA guidance provides a comprehensive overview of the principles and practices of software validation, including requirements, verification, and validation processes. GAMP 5 (Good Automated Manufacturing Practice) While not an FDA document, GAMP 5 is widely recognized in the pharmaceutical industry. It provides a structured approach to CSV and is often used as a best practice guide for system validation. PIC/S Guidance on Good Practices for Computerized Systems in Regulated GxP Environments This document, from the Pharmaceutical Inspection Convention and Pharmaceutical Inspection Co-operation Scheme (PIC/S), provides guidance on the validation and management of computerized systems used in GxP environments. ICH E6(R2) Good Clinical Practice This is an international ethical and scientific quality standard for designing, conducting, recording, and reporting trials that involve human subjects. It includes guidelines on electronic trial data handling. FDA's Data Integrity and Compliance With Drug CGMP Questions and Answers This guidance addresses data integrity issues that can arise during the lifecycle of computerized systems. Computer Software Assurance for Production and Quality System Software To harmonize with international standards, the FDA released this CSA draft guidance in September 2022. The FDA switched focus from compliance to quality and encourages the use of automation and new technologies. USDM practices a modern, streamlined approach to CS) and is updating Cloud Assurance to include a true risk-based CSA approach.

39. Working with a CSV Consultant 39 The FDA Group | 1-833-FDA- GROUP Preparing to Work With a CSV Consultant

40. Working with a CSV Consultant 40 The FDA Group | 1-833-FDA- GROUP Here are a few common scenarios that signal the need for a third-party CSV consultant. Implementation of New Systems Whenever a firm implements a new computer system, it needs to ensure that the system is validated in accordance with FDA regulations. A CSV consultant can provide expert advice on properly validating the system. Upgrades or Changes to Existing Systems Significant changes or upgrades to a computer system can potentially impact its validated status. A CSV consultant can help determine the impact of these changes and guide the revalidation process, if necessary.

41. Working with a CSV Consultant (cont.) 41 The FDA Group | 1-833-FDA- GROUP Audit/Inspection Findings If an audit or inspection by the FDA or other regulatory body uncovers issues related to computer system validation, a CSV consultant can help address those findings. They can guide the company in correcting deficiencies and preventing similar issues in the future. Training Needs If a company's employees need training on computer system validation, a CSV consultant can provide or help develop a comprehensive training program— and ensure the training meets both regulatory requirements and the company's specific needs.

42. Working with a CSV Consultant (cont.) 42 The FDA Group | 1-833-FDA- GROUP Regulatory Updates When there are significant changes to the regulatory landscape related to CSV, such as new guidance from the FDA, a CSV consultant can assist the firm in understanding and implementing these changes. Risk Management Support A CSV consultant can assist with identifying and managing risks associated with computer systems, which is especially valuable when launching a new product or entering new markets.

43. Working with a CSV Consultant (cont.) 43 The FDA Group | 1-833-FDA- GROUP Resource Constraints If the company doesn't have sufficient in-house expertise or resources to manage CSV activities, a CSV consultant can fill in these gaps. Preparation for Regulatory Inspections To prepare for an FDA inspection, a CSV consultant can conduct a pre-inspection audit (or mock inspection) to identify potential CSV issues and help the company address them proactively.

44. Working with a CSV Consultant (cont.) 44 The FDA Group | 1-833-FDA- GROUP When preparing to bring in a CSV consultant, setting a foundation that promotes efficient collaboration and desired outcomes is critical. The consultant's role, after all, is not just to perform a specific task but to bring a fresh perspective and specialized knowledge that could significantly enhance your team's approach to validation. But just how much value you can derive from a third-party expert relies heavily on your team's readiness and openness to this professional partnership. With this in mind, Rashida recommends a three- pronged approach to ensure that industry teams maximize the benefits of working with a CSV consultant. This strategy revolves around rigorous project planning, clear communication with subject matter experts, and cultivating an open mindset toward change and continuous improvement. These elements are designed not just to facilitate the consultant's work but to foster an environment that invites innovation, transparency, and collective success.

45. Working with a CSV Consultant (cont.) 45 The FDA Group | 1-833-FDA- GROUP 1. Plan and Scope Out the Project Teams should thoroughly outline the specific project processes in a detailed document or visual diagrams (like process maps) before the consultant arrives. This could include the objectives of the project, the technology involved, key stages, dependencies, and the resources needed. This preliminary work— to the extent it can be done without the consultant’s help— will enable the consultant to understand the task more efficiently and effectively, reducing the time spent on initial familiarization.

46. Working with a CSV Consultant (cont.) 46 The FDA Group | 1-833-FDA- GROUP 2. Prepare and Communicate with Subject Matter Experts Teams should compile a comprehensive list of points of contact, including the names, roles, and contact information of SMEs who are relevant to the project— and that the consultant may need to engage. These could be department leads, IT specialists, or quality assurance managers, just to name a few. The team should then notify these individuals about the upcoming project and the consultant's role. Informing SMEs about the consultant's expected outreach helps to reduce surprises and promote smoother communication. Furthermore, having a shared understanding of the project amongst all parties can reduce potential “information hoarding” and cultivate a sense of collaboration and trust from the start.

47. Working with a CSV Consultant (cont.) 47 The FDA Group | 1-833-FDA- GROUP 3. Be Open-Minded and Accepting of Change Teams should maintain an open mind throughout the project. This includes being open to new ideas, procedures, or technologies the consultant might introduce. It's important to remember that even established procedures can have room for improvement, particularly if issues have been identified in audits. Teams should be prepared to actively engage in constructive dialogue about potential changes rather than dismissing them out of hand because they deviate from 'how things have always been done.’ To facilitate this, teams could organize regular project meetings where the consultant can explain their approach and the team can provide feedback, generating shared understanding and mutual respect.

48. Working with a CSV Consultant 48 The FDA Group | 1-833-FDA- GROUP Get rapid access to the industry's best CSV and data integrity consultants.

49. The FDA Group 49 The FDA Group | 1-833-FDA- GROUP Thorough CSV ensures your system stands up to scrutiny, leaving you secure in the knowledge that your data is safe, reliable, and available. Our CSV experts implement systems and obtain “fit for use” certification in the areas of computer and cloud systems validation and data integrity. Our CSV and data integrity assessment framework can be applied to proprietary and commercially available software. Projects are planned and executed by leading CSV experts with intimate knowledge of current regulatory requirements and years of experience enhancing IT operations, control systems, and data integrity for pharmaceutical, medical device, and biotechnology companies.

50. The FDA Group 50 The FDA Group | 1-833-FDA- GROUP Our comprehensive data integrity and computer systems validation services include, but are not limited to: Computerized and Cloud System Validation (CCSV) and qualification Establishing data integrity infrastructures Third party CMO audits Vendor audits Mock Pre- Approval Inspection (PAI) audits of data integrity Formal risk assessments and risk mitigation strategies Additionally, we assist clients in: Planning and remediation assistance for data integrity gaps Guidance and development of Data Governance and Data Management Programs FDA- 483 and warning letter responses for data integrity Pre- audit preparation and support during audits Training and development of training programs in data integrity and CSV

51. Thank You Contact the experts at The FDA Group. US Toll- Free: 1- 833- FDA- GROUP International: +001 508 926 8330 [email protected] thefdagroup.com Subscribe to our Insider Newsletter: insider.thefdagroup.com 51 The FDA Group | 1-833-FDA- GROUP