Post on 01-May-2021
CSA Revolution Series: Computer Software Assurance
DIRECT FROM THE SOURCE
FDA - INDUSTRY CSA TEAM
FICSA Team
Boston Scientific CSA Case Study for PM/Calibration System"Episode 5 ” - Live Webinar Series, Thursday September 3 rd , 2020
Khaled Moussally
EVP, Clients & Regulatory Relations
COMPLIANCE GROUP
Ray Murphy
Principal Engineer Corporate Software Quality
BOSTON SCIENTIFIC
Damien McPhillips
Sr. Manager Corporate Software Quality & Digital Health
BOSTON SCIENTIFIC
PANELISTS
Hosted By
Damien McPhillips SR. MANAGER CORPORATE SOFTWARE QUALITY & DIGITAL HEALTH
Khaled is a Quality & Compliance executive and a thought leader providing cutting-edge solutions to Life Sciences industry. After spending over 25+ years with corporate in IT, Manufacturing and Quality, Khaled transitioned into consulting to bring about a paradigm shift in Quality & Compliance by leveraging his experience with regulatory agencies. Khaled is a key participant of the MDIC “Case for Quality Initiatives” and a member of the “FDA – Industry CSA team” contributing to the FDA draft guidance “Computer Software Assurance (CSA) for Manufacturing, Operations, and Quality System Software”. Khaled is on the “ISPE GAMP America Steering Committee” and has co-presented with the FDA in numerous industry conferences on how to reduce CSV cycle times while enhancing quality by applying CSA concept.
FDA - Industry CSA (FICSA) Team Members
Damien McPhillips is a Senior Quality Manager leading the Global Software & Digital Healthteams across Boston Scientific with responsibility for quality and compliance. Damien hasmore than 20 years’ experience delivering software validation optimization across large scaleenterprise wide projects. Over the past 15 years Damien has held leadership roles within BSCwith oversight for Non-Device Software, Device Software, Cybersecurity, Digital Health andEmerging Technologies such as Artificial Intelligence and Machine Learning. Damien has ledteams to deliver significant value improvement and associated cost savings through processoptimization and has championed quality system standardization across the BSCnetwork. Damien has been actively engaged with the CSA team since it was formed and hasbeen the key thought leader around risk-based testing within the guidance document.
Ray Murphy PRINCIPAL ENGINEER CORPORATE SOFTWARE QUALITY
Ray Murphy is a computer system validation subject matter expert with 30 years experience inquality engineering, quality auditing, quality management, regulatory compliance and softwarevalidation.For the past 13 years, he has worked for Boston Scientific where he has responsibility for non-device software validation lifecycles for equipment qualification, IT validation and spreadsheetvalidation. His responsibilities include the implementation of strategic quality initiatives andcorporate quality policies and standards. While improving the agility of these processes, hesupports teams in developing compliant and value-add CSV solutions. He has been a valuedcontributor this CSA team since 2017 and developed several examples on the application of thisdraft guidance.
Khaled MoussallyEXECUTIVE VICE PRESIDENT CLIENTS & REGULATORY RELATIONS
Hosted By
CSA Revolution Series By the FDA - Industry CSA Team (FICSA)
Game Changer Kick Off Webinar SeriesApril 23rd, 2020
With Cisco Vicenty from FDA
Episode 1 - Gilead Sciences
Episode 2 - Johnson & Johnson Episode 3 – Fresenius Episode 4- Medtronic
Compliance Group White Paper on CSA
Want to catch-up on previous CSA Episodes?
https://complianceg.com/webinar
Agenda
❑ Meet the “FDA- Industry CSA Team”(FICSA) Members!
❑ Cultural Barriers Paralyzing Industry
❑ Boston Scientific CSA Case Study for PM/Calibration System
Objectives
❑ Start thinking how you want to implement CSA
❑ Digitize your current paper CSA processes
❑ Create awareness to accelerate innovation and realize value
❖ No need to wait for the FDA Draft Guidance to be released
❑ Next Steps
Hosted By
❑ Risk Assessment CSV-Paper Process Vs CSA-Paperless
❑ Questions?
Contributions also provided by past team members:Stacey Allen, Jason Aurich, Sean Benedik, Laura Clayton, Bill Hargrave, Joe Hens, Scott Moeller, John Murray, Penny Sangkhavichith, Dana Guarnaccia, and Curt Curtis.
FDA - Industry CSA Team (FICSA)
Company Name
Baxter Healthcare Tina Koepke
Boston Scientific Damien McPhillips
Boston Scientific Ray Murphy
Compliance Group Khaled Moussally
Edwards Lifesciences Andy Lee
FDA Cisco Vicenty
Fresenius Medical Care Bill D'Innocenzo
Fresenius Medical Care Marc Koetter
Gilead Sciences Ken Shitamoto
Gilead Sciences Senthil Gurumoorthi
Johnson and Johnson Ron Schardong
Company Name
Johnson and Johnson Reggie George
Lantheus Imaging Lou Poirier
Medtronic Frankie Bill
Medtronic Michael Branch
Medtronic April Francis
NeuroVision Imaging Pepe Davis
Ortho-Clinical Diagnostics Des Chesterfield
Siemens Digital Industries Jason Spiegler
Siemens Digital Industries Greg Robino
Roche Thorsten Ruehl
Omnicell Frank Meledandri Sr.
Join FICSA LinkedIn Group
Hosted By
www.fda.gov
FDA CDRH Fiscal Year 2020 (FY 2020) Proposed Guidance Development
FDA announcement link. https://www.fda.gov/medical-devices/guidance-documents-medical-devices-and-radiation-emitting-products/cdrh-proposed-guidances-fiscal-year-2020-fy-2020
Draft Guidance Topics
❑ Content of Premarket Submissions for Cybersecurity of Medical Devices of Moderate and Major Level of Concern
❑ Surgical Staplers and Staples – Labeling Recommendations
❑ Non-binding Feedback After Certain FDA Inspections of Device Establishments
❑ Select Updates for Recommendations for Clinical Laboratory Improvement Amendments of 1988 (CLIA) Waiver Applications for Manufacturers of In Vitro Diagnostic Devices
❑ Recommendations for Dual 510(k) and Clinical Laboratory Improvement Amendments Waiver by Application Studies
❑ Computer Software Assurance for Manufacturing, Operations, and Quality System Software
❑ Patient Engagement in Clinical Trials
❑ Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices
❑ Lifecycle Regulatory Requirements of Medical Device Servicing (Device Servicer vs Remanufacturer)
❑ Guidance on an Accreditation Scheme for Conformity Assessment of Medical Devices to FDA-Recognized Consensus Standards (ASCA).
A-List: Prioritized Guidance Documents that CDRH Intends to Publish in FY2020
Hosted By
Cultural Barriers Paralyzing Industry
Summary of Impact
• Manufacturers are reluctant to invest
• When they invest, the documentation
burden is excessive (not commensurate
with Risk) impacting “Time to Value”
• Cybersecurity (Enterprise) risk increases
➢ Slow to upgrade/ implement patches due
to “revalidation” lifecycle burden
• Impacts on all Centers across FDA!
“We are risk-based… everything is high risk!”
“Too much documentation – lot of overhead for little value!”
“Most deviations are documentation errors, not Software bugs - we trip over ourselves!”
“We validate all Software… like product Software!”
“Data mining? We looked at purchasing an inexpensive BI tool, but CSV cost was too high.”
“The real pain no one discusses, is the CSV burden over the lifecycle of maintaining software.”
“It took 4x longer for CSV than the actual analysis!”
“What If analysis not practical to maintain”
For software not used in product, manufacturers refer to significantly more burdensome guidance (20+ years old),
based on Fear of a 483, based on prior FDA Investigations and 3rd Party Consultants.
Hosted By
Guidance BenefitsCalibration/PM focus
Our Mission and Values
Boston Scientific is dedicated to
transforming lives through innovative
medical solutions that improve the
health of patients around the world.
CaringMeaningful
Innovation
High
Performance
Global
CollaborationDiversity
Winning
Spirit
Boston Scientific Confidential – Access Limited to Authorized Personnel Do not copy, display or distribute externally. 9
Finding Solutions that Address Complex Clinical Needs
Neurological
• Chronic pain
• Parkinson’s disease
• Essential tremor
Respiratory
• Asthma
• Lung cancer
Urology & Pelvic Health
• Kidney stones
• Enlarged prostate
• Erectile dysfunction
• Heavy menstrual bleeding
• Uterine fibroids & polyps
• Stress urinary incontinence
Cardiovascular
• Coronary and vascular disease
• Heart failure
• Stroke risk reduction
• Arrhythmias
• Valvular heart disease
Digestive
• Colon cancer
• Pancreatic cancer
• Pancreatitis
• Liver cancer
• Kidney cancer
• Gastrointestinal bleeding
Boston Scientific Confidential – Access Limited to Authorized Personnel Do not copy, display or distribute externally. 10
Boston Scientific Transforming Lives Across the Globe
32,000 employees at
141 sites including 16
principal manufacturing
centers worldwide Approximately 44%
of our net sales in 2019
were international
Approximately 120 countries
with commercial
representation
BSC assist FDA to author new Non-Device Software Guidance(Scope: Enterprise Software Validation, Equipment Qualification & Data Mining)
Boston Scientific Internal – Access Limited to all Internal BSC Personnel.
Applying Risk Based
Validation to Non
Device Software:
Guidance Benefits:
• Improved Quality & Efficiency• More time challenging system, less time on
documentation
• Significant Annual Validation Savings• Validation effort reduced by 30%
• Enterprise Software
• Automated Manufacturing Equipment
• Reduced burden on Data Mining &
Spreadsheet Validation
BSC Implementation
• Trialling new guidance principles on new
Preventative Maintenance & Calibration
System
• Developed and rolled out a smart
procedure to promote Data Mining
• Planning to implement the guidance in our
procedures relating to equipment, software
systems and spreadsheet validation
procedures
Common CSV Pain Points
Takes forever
Too much focus on
document generation
Perceived Regulatory
burden -doing things for the
auditor
.
Test Scripts that often run
into tens of pages
Test Script errors & costly
defect management
01
02
03
04
05
Traditional Validation Approach
BSC implementing new Calibration and Preventative Maintenance software
system to drive efficiency and quality improvements.
Existing Calibration System
• ~1200 Test Cases Written
• Multiple dry runs
• 200+ protocol generation
errors corrected
• 1 Formal test execution
• 0 Defects found
• Critical Thinking not
Applied
• EVERY feature tested the
same
• Arduous Documentation
Approach
• Inefficient Use of
Resources
There MUST be a better way!
Guidance Benefits
Applying new guidance
• Leverage vendor
• Risk based evaluation
• Streamlined testing
Intended Use
Boston Scientific Internal – Access Limited to all Internal BSC Personnel. 16
1
2
3
What, Why Who When?
Provide Equipment Control;
Track asset calibration &
maintenance.
Regulations?
820.72 Inspection, measuring
and test equipment
820.70 (i) Automated
Processes
21 CFR Part 11
Interfaces
MES
Indirectly impacts product quality or
human safety
Required for regulatory
compliance
Feature Risk
Feature Risk
Analysis
Medium
Indirectly impacts product quality or
human safety
Required for regulatory
compliance
Feature Risk
Feature Risk
Analysis
Medium
Indirectly impacts product quality or
human safety
Required for regulatory
compliance
Feature Risk
Feature Risk
Analysis
Medium
Indirectly impacts product quality or
human safety
Required for regulatory
compliance
Feature Risk
Feature Risk
Analysis
Medium
Test Evidence
Low Risk Features Ad-hoc testing (e.g. Location details)
Medium Risk
Features
High Risk Features
Unscripted testing (e.g. ERES)
Scripted testing (e.g. Scheduled
Calibration Work Order Completion
and Approval)
25%
70%
5%
• Established high level test plan
objectives
– No step by step test script
procedure required
• Each Test had a Pass and Fail
• Name and Date of Tester
captured
Unscripted Testing
Ad-hoc Testing
• No pre-approved test scripts
• Describe what was tested to
verify that the feature worked
correctly
– Include name of tester and
date of test execution
Risk-Based Validation
Vendor
Audits
Unscripted, Ad hoc Testing
Risk Based
Approach
• All functionality is tested but only high risk
functionality requires traditional scripted testing.
• Utilize unscripted and ad-hoc techniques for
Low/medium risk.
• Scale the level of vendor
audit to the risk of the
application.
• Leverage testing by the
vendor to further scale
validation effort.
• Risk based validation
(a) Scale validation activities based on risk.
(b) Leverage vendor audits.
(c) System risk / risk based features.
Next Steps
Hosted By
❑ Start thinking how you want to implement CSA
❑ Digitize your current paper CSA processes
❑ Create awareness to accelerate innovation and realize value
❖ No need to wait for the FDA Draft Guidance to be released
WAITING!
Hosted By
FDA - Industry CSA (FICSA) Webinar’s Schedule
Register Here Episode 6 September 17th
Lou PoirierIT Director, Quality Systems
Open discussion with Lou: CSA - Organizational Culture Change
Coming October/November 2020
Khaled Moussally - khaled@complianceg.com
Questions?
Contacts
Hosted By
Stephen Cook - stephen@complianceg.com
BONUS MATERIAL / APPENDIX SLIDES
The Meat - “FDA - Industry CSA Team Recommendations”
Note: All of these concepts fall within and comply
with current FDA Regulations!
Hosted By
WAITING!
www.fda.gov
What does FDA care about?Risk Considerations
• Direct impact to device quality and device safety thatalso has a direct patient safety risk
• Directly impacts physical properties of the product or manufacturing process identified as essential to device safety or device quality by the manufacturer
• Measures, inspects, analyzes, and or dispositions the product or process
• Determines acceptability or performs process correctionswithout human intervention, awareness, or review
• Directly impacts labeling, instructions for use, or directalerts or communications to the user
• Automates surveillance, trending, or tracking of product quality or patient safety issues identified as essential by the manufacturer
16
www.fda.gov
Appropriate methods and activities for software assurance
• Take a least-burdensome approach – focus on value for the Manufacturer, not the Investigator.
• Leverage existing activities and supplier data. Do not reinvent the wheel; takecredit for work already done
• Leverage use of process controls to mitigate risk
• Use Computer System Validation tools to automate assurance activities
➢ Scope of 21 CFR 820.70(i) is applied when computers or automated data processingsystems are used as part of production or quality system.
➢ FDA does not intend to review validation of support tools. Manufacturer determines assurance activity of these tools for their intended use.
➢ Part 11 narrowly scoped and is under enforcement discretion apply appropriately
• Use Agile testing methods and unscripted testing as appropriate
• Use electronic data capture and record creation, as opposed to paper documentation, screen shots, etc
• Leverage continuous data and information for monitoring and assurance
17
www.fda.govwww.fda.gov
Acceptable record of resultsAssurance Approach Test Plan Test Results Record (Digital Acceptable)
Unscripted Testing: Ad-hoc (with least-burdensome documentation)
• Testing of features and functions with no test plan
• Details regarding any failures/deviations found
• Summary description of features and functions tested• Issues found and disposition• Conclusion statement• Record of who performed testing and date
Unscripted Testing:Error guessing
• Testing of feature and function fail-modes with no test plan
• Details regarding any
failures/deviations found• Summary description of fail-modes tested• Issues found and disposition• Conclusion statement• Record of who performed testing and date
Unscripted Testing:Exploratory Testing
• Establish high level test plan objectives for features and functions (no step-by-step procedure is necessary)
• Pass/fail for each test planobjective
• Details regarding any failures/deviations found
• Summary description of features and functions tested• Result for each test plan objective – only indication of pass/fail• Issues found and disposition• Conclusion statement• Record of who performed testing and date
Scripted Testing:Limited
• Limited Test cases (step-by-step procedure) identified
• Expected results for the test cases• Identify unscripted testing applied• Independent review and approval of
test plan.
• Pass/fail for test case identified• Details regarding any
failures/deviations found and disposition regarding fails
• Summary description of features and functions tested• Result for each test case - only indication of pass/fail• Issues found and disposition• Conclusion statement• Record of who performed testing and date• Signature and date of appropriate signatory authority
Scripted Testing:Robust
• Test objectives
• Test cases (step-by-step procedure)
• Expected results
• Independent review and approval of
test cases.
• Pass/fail for test case• Details regarding any
failures/deviations found and disposition regarding fails
• Detailed report of assurance activity• Result for each test case - only indication of pass/fail• Issues found and disposition• Conclusion statement• Record of who performed testing and date• Signature and date of appropriate signatory authority
PAPERLESS VALIDATION TOOL
Copyrighted content. All rights reserved
Polarion CSA Package
CSA Methodology
Shorter Cycle
TimesCompliant
Siemens Polarion
Paperless /
Contactless
Industry
Leading ALM
Siemens Polarion CSA Template
Polarion CSA Screenshots
Polarion CSA Screenshots