Know the Global Regulations for Change Control

IVT’s 11IVT’s 11thth Annual Conference onAnnual Conference onIVT s 11IVT s 11thth Annual Conference on Annual Conference on Change ControlChange Control

Know the Global Regulations forKnow the Global Regulations for

Ch C t lCh C t lChange ControlChange Control

Joseph ZecJoseph ZecSr. Manager & Corporate Software StewardSr. Manager & Corporate Software Steward

Corporate Software Quality AssuranceCorporate Software Quality Assurance

11

Boston Scientific CorpBoston Scientific CorpJanuary 28, 2013January 28, 2013

AgendaAgenda10% of what we do is invent things. The 10% of what we do is invent things. The other 90% is other 90% is spent changing them.spent changing them.p g gp g g

Why regulate change control?Why regulate change control?The regulator’s viewThe regulator’s viewThe regulator s viewThe regulator s viewWarning Letter surveyWarning Letter surveyFactors to consider in developing a changeFactors to consider in developing a changeFactors to consider in developing a changeFactors to consider in developing a changecontrol processcontrol process

22

Why regulate change Why regulate change y egu ate c a gey egu ate c a gecontrol?control?“The FDA’s analysis of 3140 medical device “The FDA’s analysis of 3140 medical device recalls conducted between 1992 and 1998 recalls conducted between 1992 and 1998 reveals that 242 of them are attributable to reveals that 242 of them are attributable to software failures. Of those software related software failures. Of those software related recalls 192 (or 79%) were caused by softwarerecalls 192 (or 79%) were caused by softwarerecalls, 192 (or 79%) were caused by software recalls, 192 (or 79%) were caused by software defects that were introduced when changes defects that were introduced when changes were made to the software after its initialwere made to the software after its initialwere made to the software after its initial were made to the software after its initial production and distribution.”production and distribution.”

General Principles of Software ValidationGeneral Principles of Software Validation33

–– General Principles of Software ValidationGeneral Principles of Software Validation

The The RRegulator’s egulator’s PPerspectiveerspective

““Appropriate controls shall be exercised Appropriate controls shall be exercised over computer or related systems to over computer or related systems to p yp yassure that assure that changeschanges in master production in master production and control records or other records are and control records or other records are instituted only by authorized personnel.”instituted only by authorized personnel.”

21 CFR Part 211 68(b)21 CFR Part 211 68(b)–– 21 CFR Part 211.68(b)21 CFR Part 211.68(b)

44


“When computers or automated data “When computers or automated data processing systems are used as part of processing systems are used as part of p g y pp g y pproduction or the quality system, the production or the quality system, the manufacturer shall validate computer manufacturer shall validate computer ppsoftware for its intended use according to software for its intended use according to an established protocol. All software an established protocol. All software ppchanges shall be validated before approval changes shall be validated before approval and issuance.”and issuance.”

55–– 21 CFR Part 820.70(21 CFR Part 820.70(ii))


“Each manufacturer shall establish and “Each manufacturer shall establish and maintain procedures for the identification, maintain procedures for the identification, p ,p ,documentation, validation or where documentation, validation or where appropriate verification, review, and appropriate verification, review, and pp p , ,pp p , ,approval of design approval of design changes changes before their before their implementation.”implementation.”pp

–– 21 CFR Part 820.30(21 CFR Part 820.30(ii))

66

The The RRegulator’s egulator’s PPerspectiveerspective“Unlike hardware, software is not a physical “Unlike hardware, software is not a physical entity and does not wear out. In fact, software entity and does not wear out. In fact, software may improve with age, as latent defects are may improve with age, as latent defects are discovered and removed. However, as software discovered and removed. However, as software is constantly updated and changed suchis constantly updated and changed suchis constantly updated and changed, such is constantly updated and changed, such improvements are sometimes countered by new improvements are sometimes countered by new defects introduced into the software during thedefects introduced into the software during thedefects introduced into the software during the defects introduced into the software during the change.”change.”



The The RRegulator’s egulator’s PPerspectiveerspective“Seemingly insignificant changes in software “Seemingly insignificant changes in software code can create unexpected and very significant code can create unexpected and very significant problems elsewhere in the software program. problems elsewhere in the software program. The software development process should be The software development process should be sufficiently well planned controlled andsufficiently well planned controlled andsufficiently well planned, controlled, and sufficiently well planned, controlled, and documented to detect and correct unexpected documented to detect and correct unexpected results from software changes.”results from software changes.”results from software changes.results from software changes.


88

The The RRegulator’s egulator’s PPerspectiveerspective“When any change (even a small change) is “When any change (even a small change) is made to the software, the validation status of made to the software, the validation status of the software needs to be rethe software needs to be re--established. established. Whenever software is changed, a validation Whenever software is changed, a validation analysis should be conducted not just foranalysis should be conducted not just foranalysis should be conducted not just for analysis should be conducted not just for validation of the individual change, but also to validation of the individual change, but also to determine the extent and impact of that changedetermine the extent and impact of that changedetermine the extent and impact of that change determine the extent and impact of that change on the entire software system.”on the entire software system.”



The The RRegulator’s egulator’s PPerspectiveerspective“Any changes to a “Any changes to a computerisedcomputerised system system including system configurations should only be including system configurations should only be made in a controlled manner in accordance with made in a controlled manner in accordance with a defined procedure.”a defined procedure.”

–– European Commission GMP Annex 11European Commission GMP Annex 11

1010

The The RRegulator’s egulator’s PPerspectiveerspective““Data gathered during Data gathered during [Stage 3] [Stage 3] might suggest ways to might suggest ways to improve and/or optimize the process by altering some improve and/or optimize the process by altering some aspect of the process or product such as the operatingaspect of the process or product such as the operatingaspect of the process or product, such as the operating aspect of the process or product, such as the operating conditions (ranges and setconditions (ranges and set--points), process controls, points), process controls, component, or incomponent, or in--process material characteristics. A process material characteristics. A description of the planned change, a welldescription of the planned change, a well--justified justified rationale for the change, an implementation plan, and rationale for the change, an implementation plan, and quality unit approval before implementation must be quality unit approval before implementation must be q y pp pq y pp pdocumented (documented (§§ 211.100). Depending on how the 211.100). Depending on how the proposed change might affect product quality, additional proposed change might affect product quality, additional process design and process qualification activities couldprocess design and process qualification activities could

1111

process design and process qualification activities could process design and process qualification activities could be warrantedbe warranted.” .” –– General Principles of Process ValidationGeneral Principles of Process Validation

Warning Letter SurveyWarning Letter SurveyYour firm has not established appropriate controls over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel Your firm alsoonly by authorized personnel. Your firm also fails to maintain a backup file of data entered into the computer or related system [21 CFR §into the computer or related system [21 CFR §211.68(b)].– cGMP; Automatic, mechanical, and electronic equipment

1212

– 23 Feb 2012 UAE pharmaceutical company

Warning Letter SurveyWarning Letter SurveyChanges to a product, production process, quality controls, equipment or facilities were not reported to FDA through a supplement, CBE-30 report to FDA or an annual report [21 C.F.R. §601 12]601.12].

Biologics Licensing; Changes to an approved– Biologics Licensing; Changes to an approvedapplication

– 15 Dec 2011 German pharmaceutical company1313

15 Dec 2011 German pharmaceutical company

Warning Letter SurveyWarning Letter SurveyFailure to establish and maintain adequate procedures for validating device design as required in 21 CFR 820.30(g). For example, there were four revisions of the [redacted] shelf life environmental design [ ] gverification protocol. The first revision was never used, the second revision was used at the start of the validation and the third revision was used at the completion of the real time aging of the units and h f / l d f h h f lthe verification/validation of the tests. The final revision requires

that the real life units be tested at x and y months. The testing that was done was done at v and w months, instead of x and ymonths The testing report was reviewed and accepted by a designmonths. The testing report was reviewed and accepted by a design cross functional group which included the project manager, regulatory affairs, quality assurance and research and development.

1414

– QSR; Design Controls; Design Validation– 2 Jul 2010 US medical device company

Warning Letter SurveyWarning Letter SurveyFailure to establish and follow procedures for the identification, documentation, and validation or verification of design changes prior to the implementation of the changes as required by 21 CFR § 820 30(i)CFR § 820.30(i).– QSR; Design Controls; Design Changes– 12 Aug 2009 US medical device companyg p y

1515

Warning Letter SurveyWarning Letter SurveyFailure to perform design control activities and establish Design History Files for the reusable sharps containers, as required by 21 CFR 820.30(a) through (j). Specifically, your firm has made several changes to the design of themade several changes to the design of the reusable sharps containers and these changes have not been documented, and verificationhave not been documented, and verification and/or validation of these changes have not been performed.

1616– QSR; Design Controls– 30 Jan 2008 US medical device company

Warning Letter SurveyWarning Letter Survey

““You should have conducted a risk You should have conducted a risk analysis when you significantlyanalysis when you significantlyanalysis when you significantly analysis when you significantly changed the design of the device and changed the design of the device and added new indications for use”added new indications for use”added new indications for useadded new indications for use

“Device Malfunctions Lead to Surgery, Warning Letter”“Device Malfunctions Lead to Surgery, Warning Letter”The GMP Letter Dec 2008The GMP Letter Dec 2008The GMP Letter, Dec 2008The GMP Letter, Dec 2008

1717

Warning Letter SurveyWarning Letter Survey“Failure to establish and maintain written “Failure to establish and maintain written procedures for changes to a specification, procedures for changes to a specification, method, process, or proceduremethod, process, or procedure…”…”

(warning letter dated Feb 21, 2003)(warning letter dated Feb 21, 2003)

FDA Denver District OfficeFDA Denver District OfficeFDA Denver District OfficeFDA Denver District Office

1818

Warning Letter SurveyWarning Letter Survey“Failure to assure that specification changes shall “Failure to assure that specification changes shall be subject to controls as stringent as those be subject to controls as stringent as those applied to the original applied to the original devicedevice…”…”

(warning letter dated Apr 7, 1995)(warning letter dated Apr 7, 1995)

Journal of Validation TechnologyJournal of Validation TechnologyJournal of Validation TechnologyJournal of Validation Technology

1919

Developing a Change Control Developing a Change Control e e op g a C a ge Co t oe e op g a C a ge Co t oProcessProcess

Typical Change Control process:Typical Change Control process:ChangeChange InitiationInitiationChange Change InitiationInitiation

ProposalProposalReviewReviewReviewReview

Change Change Planning & AssessmentPlanning & AssessmentChange DevelopmentChange DevelopmentChange Change VerificationVerification

2020

ggChange ReleaseChange Release

FFactors to Consideractors to Consider

Remember the “Control” in Change Remember the “Control” in Change ControlControl

AnalysisAnalysisReview and ApprovalsReview and ApprovalsReview and ApprovalsReview and Approvals

Documentation produced by the processDocumentation produced by the processProcess should recognize that someProcess should recognize that someProcess should recognize that some Process should recognize that some changes are riskier than otherschanges are riskier than others

2121

Consider process training requirementsConsider process training requirements

QuestionsQuestions

????Th k !Th k !

2222

Thank you!Thank you!

Know the Global Regulations for Change Control

Documents

Transcript of Know the Global Regulations for Change Control