Siegfried Schmitt, PhD, is Vice President Technical at Parexel International, Siegfried.Schmitt@parexel.com.

Siegfried Schmitt

Q. We recently performed a detailed assessment of our computer systems for compliance with the applicable regulations, especially 21 Code of Federal Regulations Part 11 (1). The aim was to remedy critical systems first, if any gaps were found. However, almost all systems ended up in the critical category and many of these have compliance gaps. We do not have the resources to address all of these now, so how can we prioritize?

 Your approach to perform a review and apply a risk assessment (RA) is commendable and correct. As you did not provide details about the criteria in your RA and how you weigh them, my answer has to be generic as this is a common issue when it comes to computer systems.

The principles of computer systems validation (CSV) are not dissimilar to process validation. To validate a process, you need to have qualified equipment. Similarly, for CSV, you need to have a qualified infrastructure. Once this is in place, you can then validate software for business purposes. This allows you to focus your compliance assessment on the software.

The next step is to perform a straightforward triage (see

Next comes the risk assessment, and in order to do this logically and compliant, we should follow regulatory guidance. FDA guidance states, “The extent of validation studies should be commensurate with the risk posed by the automated system” (2). Guidance from the Medicines and Healthcare products Regulatory Agency (MHRA) in the United Kingdom states, “Validation effort increases with complexity and risk (determined by software functionality, configuration, the opportunity for user intervention and data lifecycle considerations)” (3). The key word here is complexity. When you look through your inventory of computerized systems, you should be able to at least make a distinction between simple and complex systems, such as a Karl Fischer titrator and a chromatography data management system.

The regulations demand that your validation is for the intended use of the computerized system. The intended use should be documented or referenced in the system inventory. All too often, companies fail to document the intended (i.e., actual) use of the system. For example, an electronic quality management system may have many modules, but you may only be using the documentation management and the training module. When you assess your system for compliance, make sure that you assess these modules specifically, instead of a whole range of installed, yet not used, modules.

Now you should have been able to identify the critical systems and the gaps in compliance based on intended use. It is generally possible to categorize the remediation effort for eliminating these gaps into short-, medium-, and long-term activities. A short-term solution may be to stop using a particular instrument; a medium-term solution may be an upgrade of the software or a revalidation exercise; and a long-term measure could be the replacement of a piece of automated equipment.

Coming back to your question, you may want to review your approach to assessing your systems and verify you really understand each item’s intended use based on the above recommendations. This should leave you with a much more manageable task in hand.

 Title 21 Part 11 Electronic Records; Electronic Signatures.
2.FDA, 

Data Integrity and Compliance with Drug CGMP, Questions and Answers, Guidance for Industry

‘GXP’ Data Integrity Guidance and Definitions 

Siegfried Schmitt is vice president technical, Parexel.


Volume 44, Number 9
September 2020
Page: 66

When referring to this article, please cite it as S. Schmitt, "Computer Systems Validation–a (Un-)Manageable Task?," 

Articles

An assessment can identify the critical systems and the gaps in compliance based on intended use, says Siegfried Schmitt, vice president technical, Parexel.

Computer Systems Validation–a (Un-)Manageable Task?

Q. In a recent audit, we were asked about the meaning of the signatures on our controlled documents. Our reply was that it clearly states that the signatories are either authors, reviewers, or approvers. The auditor considered our response insufficient, pointing out that we often have up to 10 reviewers. Though the names and titles of these are given, their review responsibilities are not defined or described. We are unclear how to make the meaning of the signatures more precise.

	A. The regulations do not provide much detail with regards to your question. For example, the European Union guidelines (1) require, “Documents containing instructions should be approved, signed, and dated by appropriate and authorised persons.” The US regulations are a little bit more specific in 21 

) Part 11 (2) regarding the signing of electronic records and state, “This information must include the printed name of the signer, the date and time when the signature was executed, 

 [emphasis added] (such as review, approval, responsibility, and authorship) associated with the signature.”

	The question is whether the meaning of the signatures in your documents is clear enough and unambiguous. Let us look at an example, such as a cleaning standard operating procedure (SOP) for manufacturing equipment. An author, most likely a member of the operations team, prepares the document. There will be several reviewers, possibly including manufacturing, engineering, validation, quality unit, regulatory affairs, and health and safety. These reviewers will each have a different perspective from which they perform their review.

	One could argue that the role and the associated job description define sufficiently what a reviewer has to do. In theory, yes; but in practice this is often not the case. Therefore, companies typically apply one of two approaches: either define the controlled documents review and approval responsibilities in a document (e.g., the SOP for SOPs) or add the meaning to each signature in the signature list.

 is an example of such a review responsibilities matrix.

	If we apply this to the cleaning SOP example, we would expect:

		The operators to check if the instructions can actually be performed (technical feasibility)

		Managers in manufacturing to check the functional correctness of the cleaning procedures (e.g., cross-reference cleaning validation reports) and to verify that the instructions are clear and logical

		The validation team to verify that the cleaning procedures are in concurrence with previously executed cleaning validations

		The quality unit to ensure that the document uses the correct template and format, that the procedure meets regulatory requirements, and that any related change controls or audit/inspection commitments have been met

		The regulatory affairs department to confirm that the procedure is in concurrence with the manufacturing licenses

		The health and safety executive to check that all required safety precautions are applied, for example, where flammable or corrosive solvents are used.

	In summary, it is good industry practice to clarify the precise remit for each of the reviewers of a controlled document, rather than just apply the general term of ‘reviewer.’ This does not have to be as difficult as the example herein.

	And finally: are you still sure you need up to 10 reviewers?

EudraLex Vol. 4 Part I Chapter 4 Documentation

.
	2. Electronic Records; Electronic Signatures, 


	Vol. 43, No. 11
	November 2019
	Page: 59

	When referring to this article, please cite it as S. Schmitt, "Signatures–What’s in a Name?," 

It is good industry practice to clarify the precise remit for each of the reviewers of a 
controlled document, says Siegfried Schmitt, PhD, vice-president, technical, Parexel Consulting.
