Overview on “Computer System Validation” CSV

HI this is Anil Sharma, Executive Compliance in USV LTD. I want to share my brief knowledge on CSV with you. I hope my presentation will help you to understand basics of CSV.

1. Overview on
“Computer System
Validation”
Prepared by: Anil Sharma & Gaurab Thakur (USV LTD-QCMT)

2. Computer system Validation

FDA defines validation as “Establishing documented
evidence which provides a high degree of assurance
that a specific process will consistently produce a
product meeting its predetermined specifications and
quality attributes”.

4. “Validation Approach”
Validation of GxP impacting computerized system
should be based on the following key steps:
High Level Risk Assessment
Implementation of life cycle model for GxP
impacting computerized system

5. “Deliverable flow”
URS
High Level Risk Assessment (Assessment of Risk & Software Categorization)
Software Vendor Assessment
Validation Plan
Functional Specification/Design Specification/Configuration Specification
Functional Risk Assessment
Installation Qualification
Operation Qualification
Performance Qualification/Operation and Performance Qualification
Traceability Matrix
Validation Summary Report
System Release
Note: Above flow can be vary depending on the criticality of the software or a specific approach for
software.

6. “Identification of level of Risk”
For GxP relevant system, assess the ‘Level of Risk’
 Assessment regarding GxP relevance (Yes/No).
 Assessment regarding Business relevance (Yes/No).
 Assessment regarding Failure Consequence (High/Moderate/Low).
 If system has direct impact on, Product Quality, Patient safety and
Data Integrity then system failure consequences shall be “High”.
No direct impact then rate as “Moderate”.
No impact then rate as “Low”.

7. “Identification of level of Risk”
Scoring System:
Yes = 10, No = 0, High = 20, Moderate = 08 & Low = 02
Higher level of risk = More effort and more deliverables.
GxP
Relevance
Business
Relevance
Failure
Consequence
Calculated
Risk
Level of Risk
Yes Yes High 40 High
No Yes High 30 High
Yes Yes Moderate 28 Moderate
No Yes Moderate 18 Moderate
No Yes Low 12 Low
No No Low 02 Low

8. “Software Categorization”
GAMP-5 Category
1.Infrastructure Software
2.This category is no more
valid
3.Non-Configured
Examples
Operating System
Network Monitoring Tools
Spread sheets, C++, JAVA
Anti Virus
Firmware Based Applications
Commercial OFF the Shelf
(COTS) Software (Microsoft Office)
Laboratory Instruments

9. “Software Categorization Continued”
GAMP-5 Category
4. Configured Software
5. Customized Software
Examples
LIMS
SCADA
ERP
Chromatography data
systems
Customized PLC's
Customized Firmware
Internally and external
developed Software
Tailor Made

12. CSV Regulations
21CFR 11, Electronic record & Electronic Signatures,
Subpart B-Electronic Records, Sec11.10, Controls for closed systems:-
a) Validation of systems to ensure accuracy, reliability, consistent intended
performance, and the ability to discern invalid or altered records.
21CFR part 211, Current Good Manufacturing practice for Finished
pharmaceuticals
Subpart D, Equipment, Sec. 211.68(b).
Input to and output from the computer or related system of formulas or other
records or data shal be checked for accuracy.
21CFR part 1271, Human cells, Tissues, Cellular and Tissue based products,
Subpart D, Current good tissue practice, Sec. 1271.160(d)
You must validate the performanceof computer software for the intended use.

13. CSV Regulations
21CFR 820, Quality System Regulation,
 Subpart C-Design Control, Sec. 820.30(g),
Design validation shall include software validation and risk analysis.
Subpart G-Production and Process Control, Sec. 820.70(i),
When computer or automated data processing system are used as apart of production
or a quality system, the manufacturer shall validate computer software for its
intended useaccording to an established protocol.
Eudralex vol.4, Good Manufacturing practice, Medicinal product for Human and
veterinary Use. Annex11 Computerised systems.
The application should be validated; IT infrastructure should be qualified.
ICH Q7A, Good Manufacturing practice for Active pharmaceutical Ingredients
GMP related computerized system should be validated. The depth and scope of the
validation depands on the diversity, complexity and criticality of the
computerized application.

14. CSV Regulations
PIC/S PE 009-11, Guide to Good Manufacturing Practices for Medicinal
Products,
5.40 GMP related computerized system should be validated.
PIC/S PE 011-1, Guide to Good Distribution Practices for Medicinal Products,
Before a computerized system is bought into use, it should be demonstrated, through
appropriate validation or verification studies.
PIC/S PI 011, Guide Practices for Computerized System Used in Regulated
“GxP” Environments,
4.9 The regulated user should be able to demonstrate through the validation
evidance that they have a high level of confidence in the integrity of the computer
system.

15. CSV Regulations
WHO, Specifications for Pharmaceutical Preparations,
6.3 Critical computerized system should be validated before use.
WHO, Good Manufacturing Practices for Pharmaceutical products,
4.11 Particular attention should be paid to the validation of anaytical test method,
automated system and cleaning procedures.

16. CSV Guidelines
In 1983 the FDA published a guide to the inspection of ‘Computerized System’ in
Pharmaceutical Processing, also known as ‘Bluebook’.
USFDA-General Principles of Software Validation;Final Guidance for industry and
FDA staff.
WHO Guidelines on validation, Appendix-5, Validation of Computerized Systems.
Good Practices for Computerized System in regulated “GxP” Environments.
EDQM-Validation of Computerized System core Document.
GAMP-5 ISPE, A Risk-Based Approach to Compliant GxP Computerized
Systems.
CEFIC-Computer Valodation Guide (Jan 2003).

17. Why validation is needed??
•Regulatory and industry focus on patient safety, product quality and
data integrity.
•Avoid duplication of activities.
•Reduces risk and legal liability.
•Having the evidence that computer systems are correct for their
purpose and operating properly represents a good business practice
•Software is constantly evolving to keep up with the increasingly
complex needs of the people that use it; therefore validation is an on-
going necessity.