Computerised Systems in Pharmaceuticals

8/13/2019 Computerised Systems in Pharmaceuticals

1/36

Date Insert onMaster Slide

Slide 1

Computerised Systems

Alfred HuntInspector

Wholesale Distribution Information Day, 28th September 2012


2/36

Index

Slide 228th September 2012

What is a computerised system

Updates to EU GDPs

Expectations

Case studies


3/36


4/36

What is a Computerised System


GAMP 5


5/36

Slide 5

Computerised Systems withinWholesaling

Systems which may impact on productquality

Provide safety or quality data

Impact operational reliability

Maintain regulated data

A few examples

Inventory Management Systems

Sales and Invoicing Systems Temperature Monitoring Systems

Document Management Systems

28th September 2012


6/36

Question

In the event of a recall how would you identify who yousupplied the affected product to?

a) By manually checking through all paper invoices

b) By manually checking a goods-out logbook

c) By manually checking through electronic records

d) By running a product search on an electronic inventory /invoicing system?



7/36

Why New Requirements?

Patient safety

Product quality

Data integrity Where a computerised system replaces a

manual operation, there should be noresultant decrease in product quality orquality assurance

Did we build the right system & did webuild it correctly?



8/36Slide 8

Revised EU Guideline on GDP (Draft)

Section 3.19

Before a computerised system is brought into use, itshould be demonstrated through appropriatevalidation or verification studies, that the system is

capable of achieving the desired results accurately,consistently and reproducibly.

28th September 2012


9/36Slide 9

Section 3.20Written detailed description

Diagrams

Kept up-to-date

Principles Objectives

Security Measures

System scope

Main features

How the system is used

How the system interacts with other systems


28th September 2012


10/36Slide 10

Section 3.21

Data should only be entered or amended by personsauthorised to do so


28th September 2012


11/36

Slide 11

Section 3.22

Data should be secured by physical or electronicmeans and protected against accidental or un-authorised modifications. Stored data should be

checked periodically for accessibility. Data should beprotected by backing up at regular intervals. Back updata should be retained for a period stated in nationallegislation but at least 5 years at a separate andsecure location.


28th September 2012


12/36

Section 3.23

Procedures to be followed if the system fails or breaksdown should be defined. This should include systemsfor the restoration of data.

Slide 12


28th September 2012


13/36

Configurable

Non - Configurable

What to Do???

Slide 13

Risk of Failure / Defects

Standard Software

& Hardware

Custom Software

& Hardware

Greater complexity

Less user experience

28th September 2012

Level of Validation


14/36

Life Cycle Approach

1. Concept(User Requirement Specification - URS)

2. Project(Functional Specification, Design Specification)

3. Operation

(Ongoing maintenance systems)4. Retirement

GAMP 5

Supplier InvolvementIs the system being validated the same as the proposedsystem?



15/36

User Requirement Specification

Slide 15

A document that specifies the requirements for acomputerised system what it should do

Should be commensurate with level of risk,complexity and novelty of system

Should be detailed enough to allow for subsequent

verification of system requirements

May include operational requirements , functionalrequirements , data requirements, technicalrequirements, interface requirements, performancerequirements, security requirements, maintenance

requirements, retirement requirements For commercially available systems - may be part

of purchasing document

28th September 2012


16/36

Software Validation

Slide 16

Category Validation Approach

1

Infrastructure Software

Record version (include service pack).

Verify Correct Installation

3

Non - Configured

URS

Record version and verify installation

Risk based tests against requirements

Procedures put in place for maintaining compliance

Consider auditing supplier for critical and complex applications

4

Configured

As above, plus

Life cycle approach

Supplier questionnaireAdequate QMS

Risk based tests against requirements in a test environmentRisk based tests against requirements within the business process

5

Custom

As above, plus

Full life cycle documentation

Design and source code review GAMP 5 Appendix M 4

28th September 2012


17/36

Hardware Validation

Hardware Category 1 - Standard Hardware Installation and connection

Record model, version number, serial number

Change Control

Hardware Category 2 - Custom Built Hardware

As above plus...

Design Specification and Acceptance Testing

Verification of compatibility of interconnected

hardware Supplier audit



18/36

Load Reviews

Ensuring that your system can cope with alleventualities

Minimum level through to greater than expectedload

Repeat if new area / site added

Growth modelling

Number of users number of transactions memory capabilities



19/36

Suppliers

Provide / Install / Configure / Integrate / Validate /Maintain / Modify / Retain

Suitability?

Competence?

Technical Agreements

Audit



20/36

Case Study 1

A wholesaler uses an off-the-shelf software packagefor inventory management and accounting purposes.The system was installed on a standard networked ITsystem. All wholesaling transactions are processedusing the system and it is used as their primarymethod of traceability.



21/36

Step 1

Determine category of system

Software Category 3 (Non-configurable system)

Hardware Category 1

Step 2

Determine approach to be taken (may include)

Functionality versus URS

Record version of software/hardware, verify correct installation

Allowable users

Verify data entry capability (product, code, quantity, location)

Verify processes (orders, picking, FEFO, returns)Verify data is retrievable and accurate

Run systems side-by-side if upgrading

Training, Procedures etc


Case Study 1


22/36

Case Study 2

A wholesaler installs a temperature monitoringsystem into their warehouse. The system consists ofwireless probes which send a signal to a relay boxwhich in turn sends a signal to a receiving unit linkedto a PC. The data is uploaded via broadband to thesystem suppliers hosting site. In order to access the

data the wholesaler must log in to the supplierswebsite.

http://cs.dogpile.com/ClickHandler.ashx?du=http://www.faqs.org/photo-dict/photofiles/list/682/1092thermometer.jpg&ru=http://www.faqs.org/photo-dict/photofiles/list/682/1092thermometer.jpg&ld=20120918&ap=1&app=1&c=info.dogpl&s=dogpile&coi=372380&cop=main-title&euip=89.101.136.129&npp=1&p=0&pp=0&pvaid=b40444e105e440cd8d0d3309bfe1b2bb&sid=1830193568.2629679241886.1347978554&vid=1830193568.2629679241886.1331897470.320&fcoi=417&fcop=bottomnav&fpid=2&ep=1&mid=9&hash=76146CE87CA4E13988A4A2A310516DCD


23/36

Step 1

Determine category of system

Software - Category 4 (Configurable system)

Hardware Category 2

Step 2

Determine approach to be taken (may include)

URS / Functional Specification (may be combined)

Operation and performance of system versus URS & FS

SLA with supplier, consider audit

Record version of software, hardware details

Verify operation of system under load conditions

User access levels

Ensure data storage is secureVerify data is retrievable and accurate

Verify hardware is compatible and functioning (commission andcalibrate)

Run systems side-by-side if upgrading

Training, Procedures etc


Case Study 2


24/36

Other Requirements

User procedures

Training

Software package documentation

Hardware package documentation Passwords

Routinely change (Different cases,numbers, characters)

Not to be shared!

Usernames specific for person & not

ambiguous



25/36

Change Management

Changes to a part of the system pose arisk due to interdependencies

Does the process owner know if suppliermakes a change? (SLA)

Version controlled Record, assess, approve and document

changes

http://cs.dogpile.com/ClickHandler.ashx?du=http://3.bp.blogspot.com/_7E-V2lucIao/TO7JKYZl6BI/AAAAAAAAAUQ/ywAWcfC4WUg/s1600/change-management1.jpg&ru=http://3.bp.blogspot.com/_7E-V2lucIao/TO7JKYZl6BI/AAAAAAAAAUQ/ywAWcfC4WUg/s1600/change-management1.jpg&ld=20120918&ap=1&app=1&c=info.dogpl&s=dogpile&coi=372380&cop=main-title&euip=89.101.136.129&npp=1&p=0&pp=0&pvaid=ff6bbad559ce439c8ca7404e8fe7f380&sid=1830193568.2629679241886.1347978554&vid=1830193568.2629679241886.1331897470.320&fcoi=417&fcop=topnav&fpid=2&ep=1&mid=9&hash=F5BD5FFC387E8FCB5CC425D87D5EFD25


26/36

Retention

5 years (Depending on products!) Regulatory duty

Preserve content and meaning

Back-ups (archiving / long term retention) validation of data and media integrity(number of uses etc)

Restoration (time, routine verification)

Separate and secure location

http://cs.dogpile.com/ClickHandler.ashx?du=http://darrellcreswell.files.wordpress.com/2010/10/throw-out-the-trash.jpg&ru=http://darrellcreswell.files.wordpress.com/2010/10/throw-out-the-trash.jpg&ld=20120918&ap=6&app=1&c=info.dogpl&s=dogpile&coi=372380&cop=main-title&euip=89.101.136.129&npp=6&p=0&pp=0&pvaid=34b5d63e109f4b45aa6f11a9e89c92d6&sid=1830193568.2629679241886.1347978554&vid=1830193568.2629679241886.1331897470.320&fcoi=417&fcop=topnav&fpid=2&ep=6&mid=9&hash=BB95361FC97C3B20140806CE01743BF3


27/36

Ongoing Maintenance

Ongoing monitoring of systemsperformance

Error Logs

Operator training

Change control

Maintenance of user manuals / SOPs

Updates to system



28/36

Recovery after failure

Restoring system to correct state Log file of transaction records

Incomplete transactions

Protocols and procedures for testing

Manual data entry

Outage investigation

http://cs.dogpile.com/ClickHandler.ashx?du=http://www.oxfamblogs.org/fp2p/wp-content/uploads/Confused-Players.jpg&ru=http://www.oxfamblogs.org/fp2p/wp-content/uploads/Confused-Players.jpg&ld=20120918&ap=10&app=1&c=info.dogpl&s=dogpile&coi=372380&cop=main-title&euip=89.101.136.129&npp=10&p=0&pp=0&pvaid=51fb9543cbf549ab82f83ba98bcd2cc0&sid=1830193568.2629679241886.1347978554&vid=1830193568.2629679241886.1331897470.320&fcoi=4&fcop=results-bottom&fpid=2&ep=10&mid=9&hash=6D6267EBDC0E485BEE0288A5E9BB4F32


29/36

Retrospective Validation

Legacy systems / Reclassification Focus attention on those computerised

systems with most impact on patientsafety, product quality, and data integrity

Risk assessments History of use

Maintenance

Error logs

Validation plan / Gap assessment



30/36

Risk Management

Useful for retrospective validation Assess risks Apply controls

Linked to the protection of the patient

Level of effort, formality, documentationshould be commensurate with the level ofrisk



31/36

Databases

Databases and repositories should also bevalidated

Database integrity size?

Compatibility with other systems



32/36

Commercial Spreadsheet Applications

Highly configurable

Difficult to validate

Audit trails

Changes



33/36

Outsourced Services

E.g. Temperature monitoring Security of data

Control of data / ownership

Access

Service Level Agreements

Disclaimers



34/36

Considerations

Patient safety is priority Audit trail

Ease of validation

Electronic signatures

Support from supplier



35/36

Further Guidance!

Slide 35

PIC/S Good Practice for Computerised Systems in

regulated GXP Environments www.picscheme.org

Eudralex Volume 4 GMP Guide Annex 11:Computerised Systems

GAMP 5 - Good Automated Manufacturing Practice

28th September 2012
http://www.picscheme.org/http://www.picscheme.org/


36/36

Thank you

[email protected]

[email protected]

01-6764971
mailto:[email protected]:[email protected]://www.imb.ie/http://www.imb.ie/mailto:[email protected]:[email protected]:[email protected]:[email protected]

Computerised Systems in Pharmaceuticals

Documents

Transcript of Computerised Systems in Pharmaceuticals