The Need to Validate a Computerised System

Why do we need to validate a Computerised System? What type of documentation should we create to make a system compliant as per recommended guidelines? These are some of the most sought-after questions when preparing a document to validate a GxP System.

Let us see a few statistics from the “Final Guidance for Industry and FDA Staff document” issued on Jan 11, 2002:

“The FDA’s analysis of 3140 medical device recalls conducted between 1992 and 1998 reveals that 242 of them (7.7%) are attributable to software failures. Of those software-related recalls, 192 (or 79%) were caused by software defects that were introduced when changes were made to the software after its initial production and distribution.”

It is important to understand how a software-related issue impacted product quality and resulted in the incorrect decision by Quality Department. When the paper-based documentation started migrating to a computerised system, IT companies started customizations to meet business requirements. Since it was a very new field and coding was done the first time as per the business requirements, some faulty logic may have impacted the output. For example, if a system is doing some calculation based on a formula and wrong logic was applied, it resulted in incorrect output.

The software used to automate any part of the device production process, or any part of the quality system must be validated for its intended use, as per 21 CFR §820.70(i). In addition, as per guidelines, all processes should be adequately designed and tested so that accurate and reliable results can be obtained.

21 CFR §820.70(i) statement:

(i) Automated processes. When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. In addition, all software changes shall be validated before approval and issuance. These validation activities and results shall be documented.

After understanding the need for validation of the new system, it is essential to know how many documents one should generate to establish that the system is working as per its intended use. The level of validation effort should be commensurate with the risk posed by the automated operation. Extensive testing, design verification, and validation are required when the application directly impacts the batch characteristics and is declared a GxP system.

GAMP5 simplifies it by referring to different categories based on certain questionnaires. When the evaluation is done for a system, the GxP assessment form is filled, and the system is declared as GxP relevant or a non-GxP system based on the response in the state. When a system is referred to as a GxP relevant, the need for computer system validation documentation increases. It becomes vital to involve various owners of the processes and relevant stakeholders to validate the entire activities.

Based on the GxP assessment of the system, the system category is also identified. There are four categories of software as per GAMP5 guidelines:

1. Category-1: Infrastructure Software

2. Category-2: No longer used in GAMP 5

3. Category-3: Non -Configured Products

4. Category-4: Configured Products

5. Category-5: Custom Applications

Based on the category of the system, documentation need is identified to meet the compliance needs.