Conceptos Básicos y Marco Regional para la Validación de ...¡sicosyMarcoRegional... · Conceptos Básicos y Marco Regional para la Validación de Software 7 1. “Validación es

1

1Conceptos Básicos y Marco Regional para la Validación de Software


2


World’s changes

The Pharmaceutical Industry has adapted its business model in response to growing industry constraints and the decline of the primary-care focused blockbuster therapy.

Principal Key Success Factors of success in this “scenario” are:

Maintaining Quality

Optimising Process

Cost Management

Reducing Time to Market

Optimising Supply Chain

Latino America Consultores, with its experience, is one of the most Qualified Partners in South America to achieve that goal, according to cGMP requirements, with a special focus on Pharmaceutical Business Evolution.


International Support

Momentum Life Science™

Support in R&D

Engineering, Design & Construction Support

Qualification, Validation & Management

Technology Transfer

IT in Compliance

Business Development & Alliance

Regulatory Affairs

Quality in Outsourcing & Auditing

Training

Business Process Re-engineering

Feasibility Studies

3


Product Knowledge

Product & Process Support Supports for Formulation, Pilot Phases, Scale Up and Industrialization Process Qualification Technology Transfer Support

Regulatory Affairs & Compliance International Regulatory Support Supports in Preparation Dossiers Supports in Preparation of Technical File for Medical Devices Preparation and Implementation of Variation Procedures

Engineering

Project: URS, Feasibility, Preliminary Budgeting, Conceptual Design, Basic Design, Detailed Design, Design Qualification

Verification: Equipment & Plant Qualification Support, Utilities Qualification Support, Analytical Methods & Equipment Qualification, Information & Data Management System Validation

Compliance, Innovation & Data ManagementERP, LIMS, DCS, SCADA, WMS, EDMS have to be in Compliance.

Feasibility Study & Software & Supplier Selection

Solution Providing & System Integration Support

Computer System Validation (GAMP 5.0), 21 CFR 11 Compliance

GxP Risk Assessment & Remediation Plan Management

Support for IT Infrastructure Management & Enhancement, Networks Qualification

Legacy System Assessment & Full Plant Remediation Support


Computer System ValidationBasic Principles,

International References

4


1. “Validación es la recopilación y documentación de evidencias suficientes para dar certeza razonable, dado el estado de la ciencia, que el proceso en consideración opera, y / u operará, según lo esperado” (B. Loftus, Process Validation - The Regulatory View, Proceedings of the Proprietary Association, 1979 Manufacturing Controls Seminary)

2. “Validación es establecer evidencia documentada la cual proporciona un alto grado de certeza que un proceso especifico producirá consistentemente un producto que cumpla las especificaciones y características de calidad predeterminadas” (FDA Guideline on General Principles of Validation, 1987)

3. La validación es una estrategia definida de prácticas y procedimientos inter-relacionados que en combinación con métodos de producción de rutina y técnicas de control de calidad ofrece garantía documentada de que un sistema está funcionando como se pretende de manera repetitiva y / o que un producto cumple con las especificaciones predeterminadas. (PDA TM#1 revised, Draft 13, Glossary)

Validación: DEFINICIÓN


The GAP between manufacturer's “good intention” and low number of examined products could be supported and justified by validation

Validation ”says”…… “it’s working constantly under specification”

Could be Applied to preliminarily examination & scheduling of process details & to test and demonstrate that process is working properly

Efficacy of a well performed validation is underlined by the automatic reduction of production defects, waste … Plant Projects errors or re-work reduction

Whatever the Process could be validation ask the same: “demonstrate… & document objectively the proper functioning”

…. Why Validation?

5


Principle

The introduction of computerised systems into systemsof manufacturing, including storage, distribution andquality control does not alter the need to observe therelevant principles given elsewhere in the Guide.

Where a computerised system replaces a manualoperation, there should be no resultant decrease inproduct quality or quality assurance.

Consideration should be given to the risk of losingaspects of the previous system which could result fromreducing the involvement of operators.

The Starting Point

Annex 11 EU GMP


Functional Correctness (During Usage)

Data Correctness (enforced after 21 CFR Part 11) Accuracy

Validity

Availability

Confidentiality

Risk Management (enforced after FDA guidelines of 2004)

Computerised Systems – Regulatory Req.

6


The Scenario

The Regulatory Reference (regulatory scenario) for Pharmaceutical will see different “actors” :

Regulatory Agency (INAME, ANVISA, INVIMA, FDA, EMA, PIC/S, ICH …)

Standard Agency/Association (ISO, BSI, …)

Industrial Associations (ISPE, PDA, GAMP, …)


… are classifiable in:

Rules, emitted by Health Authority (Code of Federal Regulations, EU Directives, …)

Guide Lines for Inspections (FDA, PIC/S, ICH, …)

Guide line for Developments and Construction, Validation & Compliance of Plant, Equipments & Systems (ISPE, PDA, …)

Technical Rules & Standards (ISO 17799 / BSI 7799, …)

The Scenario - Documents

7


… Not only 21 CFR Part 11


USA and OUT of USA

Compliance and 21 CFR Part 11 is a Legal requisite to sell in USA

USA market represent value 50-60% of World’s Market

PIC/S Guidance PI 011

“Good practices for computerised systems in regulated “GxP” environment”

European Union EMA

Annex 11 (old version)

New Annex 11 (2011)

8


REGIONAL REGULATIONS

CSV Local Regulations

Argentina Regulations Brasil Regulations Colombia Regulations Mexico Regulations


ARGENTINA REGULATIONS

Disposición ANMAT Nº 2819/2004 (con las modificaciones de la Disp. ANMAT Nº 4844/2005) – OMS informe 32 (1995)Buenas Prácticas de Fabricación para Elaboradores, Importadores / Exportadores de Medicamentos.

4. CALIFICACIÓN Y VALIDACIÓN

4.11 Es de importancia crítica prestar particular atención a la validación de métodos analíticos de ensayo, sistemas automatizados y procedimientos de limpieza.

MINISTERIO DE SALUDAdministración Nacional de Medicamentos, Alimentos y Tecnología Médica

9


COLOMBIA REGULATIONS

21. PROCESAMIENTO ELECTRÓNICO DE DATOS (INFORMÁTICA)21.1 ¿Existe un sistema de procesamiento y registro electrónico de datos? Informativo21.2 ¿Existen personas capacitadas responsables y autorizadas para el acceso al sistema (entrada de datos, consultas y modificaciones)? Crítico21.3 ¿Hay un procedimiento validado que indique las medidas a tomar en caso de una falla del sistema? Crítico21.4 ¿Existe un procedimiento de seguridad que únicamente permita el acceso de personal autorizado al sistema? Crítico21.5 ¿Se editan los datos y archivan en el historial del lote? Informativo21.6 ¿Son de fácil acceso y disponibilidad por parte del personal autorizado los datos correspondientes al registro de producción de cada lote? Crítico21.7 ¿Se tiene grabación de reserva de los registros de la información archivados electrónicamente? Crítico21.8 ¿Está convenientemente almacenada esta información? Crítico21.9 ¿Existe un procedimiento escrito para los casos de emergencia?


BRASIL REGULATIONS

Current RegulationAgência Nacional de Vigilância SanitáriaResolução - RDC nº 17, de 16 de abril de 2010

Reference WHO Technical Reports 908 –

WHA Report 37 – 2003

Sistemas Computarizados Titulo VII SISTEMAS DE

INFORMAÇÃOCOMPUTADORIZADOS

GUIA DE VALIDAÇÃO DESISTEMASCOMPUTADORIZADOS

ANVISA

10


Mexican REGULATIONS

14.6.1 Deben validarse los sistemas yaplicaciones computacionales relacionadoscon:

14.6.1.1 Transferencias de insumos yproducto.

14.6.1.2 Disposición de insumos y producto.

14.6.1.3 Control de procesos y análisis.

14.6.1.4 Control de sistemas críticos.

14.6.4 Registros y firmas electrónicas Audit Trail Firmas Electrónicas Registros Electrónicos

NOM-059-SSA1-2006


Computer System ValidationFDA - 21 CFR part 11

EMA - GMP - Annex 11

PIC/S

11


21 CRF Part 11

Rules were written for a “paper world”

Rules asks hand-written signatures

Technology has been made “Obsolete” rules for many aspects

Computerized Systems could provide big advantage to Pharmaceutical & regulated Industries

… Industry asks itself to verify with regulatory agency the permission to utilize Electronic Signatures

Electronic Record &Electronic Signature Management

Part 11--ELECTRONIC RECORDS; ELECTRONIC SIGNATURES

Subpart A--General Provisions

11.1 Scope.

11.2 Implementation.

11.3 Definitions.

Subpart B--Electronic Records

11.10 Controls for closed systems.

11.30 Controls for open systems.

11.50 Signature manifestations.

11.70 Signature/record binding.

Subpart C--Electronic Signature

11.100 General requirements.

11.200 Identification mechanisms and controls.

11.300 Controls for identification codes/passwords.


21 CRF Part 11 – ER Key Points

Validation

Accurate and complete copies

Protection of records

Limiting system access

Secure audit trails

Operational system checks

Authority checks

Validity of source Training and experience

Policies and procedures defining responsibilities

Control over system documentation

Signature manifestation

Signature/record linking

12


Subpart B: Validation & Protection

Validation: Discerning invalid/altered records involves:

Ability to identify when changes were made

Who made the changes

Whether these changes were authorized

Protection:

Protection of records to ensure:

Accurate and Ready Retrieval

Throughout the records retention period

Ensure security of records by maintaining adequate backups and backup procedures

Companies should specify their retention periods


Subpart B: System Access

To protect against unauthorized input, deletion or modification of data including user IDs

Right of entry on a “Need to do Basis”

Keys, ID cards, codes, terminal access

Authorized and documented

Key Issues Staff Changes, damage/loss, unavailable

codes, distribution lists

Records of attempted unauthorized access

13


Subpart B: Audit Trails

Created by the system independently of operators

Must record date and time of entries and actions that create, modify or delete electronic records

Record changes must not obscure previous data


Subpart C: E-Sigs

Unique signatures

Verified identity before allocation

Certification by user firm

Two distinct components - unless biometric

Use of components during sessions

Used by genuine owner

Administered to prevent fraud

Uniqueness of each combined ID and password

Periodic checking, recall or revision

Loss management

Transaction safeguards

Testing of devices

14


Principle

The introduction of computerised systems intosystems of manufacturing, including storage,distribution and quality control does not alter theneed to observe the relevant principles givenelsewhere in the Guide.

Where a computerised system replacesa manual operation, there should be noresultant decrease in product quality orquality assurance.

Consideration should be given to the risk oflosing aspects of the previous system whichcould result from reducing the involvement ofoperators.

Annex 11 Computerised Systems


New Annex 11

Maintain old principle with the introduction of Risk Based Approach

Define the validation of the application and qualification of IT infrastructure

Requirements organized as life cycle

More specific requirements

Basic requirements electronic signatures

15


Implementation of computerised systems The structure and functions of the computer system(s) Planning and life-cycle management Management and responsibilities User requirement specifications (URS) Functional specifications (FS) Suppliers, software developers and quality

management Important QMS and software standards attributes Testing Validation strategies and priorities GAMP validation approach based on different

categories of software products Retrospective validation

PI 011 – Key Elements


Computer System ValidationGAMP® 5

Introduction

16


GAMP Good Practice Guides

One of the Answer: GAMP Guides

GAMP® 5

Validation of LaboratoryComputerized Systems

Risk-Based Approach toElectronic Records & Signatures

Calibration Management

Validation of ProcessControl Systems

Validation of Legacy Systems

IT Infrastructure Control andCompliance

Global Information SystemsControl and Compliance

Testing of GxP Systems

Electronic Data Archiving


Process Control: DCS, SCADA, MES (Manufacturing Execution

Systems), HVAC, Dispensing

Application: ERP, DSS (Decision Support System),

Regulatory eCTD, Document Management System

Laboratory LIMS, CDAS, Software for Instrument

Infrastructure: Network, Basic Software, Domain,

Notification System, Virtualisation

GAMP® 5 – Scope & Application

17


GAMP® 5 – ACCEPTANCE

Acceptance of GAMP Guidance by regulators worldwide

Widespread incorporation of concepts and methods into policies and procedures of manufacturing companies worldwide

Many suppliers have adopted GAMP as the cornerstone of their quality systems

Covers “good practice” not just a compliance guide


ICH Q9 Quality Risk Management

Good alignment with current GAMP riskapproach and strategic direction

Q9 adopted as overall framework for riskmanagement approach in GAMP 5

Impact of Q8 and forthcoming Q10 ISPE Product Quality Lifecycle Implementation

(PQLI) Initiative Practical Implementation of ICH Guidance and

Quality by Design ASTM Standards e.g. ASTM E2500 Standard Guide for

Specification, Design, and Verification ofPharmaceutical and BiopharmaceuticalManufacturing Systems and Equipment

GAMP® 5 – ALLIGNMENT

18


From System Risk Based Approachto Process Risk Based Approach

A computerized system is considered as acomponent of a wider system &/or process,especially in an Integrated “Quality by Design”Environment

A Computer System Validation Separated byProcess Validation could be not anymorenecessary (& sometimes inconsistent)

GAMP5 encourage adopting an IntegratedApproach

GAMP® 5 – EVOLUTION


1. Product & Process Knowledge

2. Integrated Life Cycle Approach in a QMS Environment

3. Flexible & Scalable Life Cycle Activities

4. Quality Risk Management

5. Maximize Supplier Involvement & participation

GAMP® 5 – KEY CONCEPT

19


GAMP® 5 – SOFTWARE CATHEGORIES


M1 Validation Planning

M2 Supplier Assessment

M3 Science Based Quality Risk Management

M4 Categories of Software and Hardware

M5 Design Review and Traceability

M6 Supplier Quality and Project Planning

M7 Validation Reporting

M8 Project Change and Configuration Management

M9 Document Management

M10 System Retirement (*)

GAMP® 5 – MANAGEMENT APPENDICES

20


D1 User Requirements Specifications

D2 Functional Specifications

D3 Configuration and Design

D4 Management, Development, and Review of Software

D5 Testing of Computerized Systems

D6 System Descriptions (*)

D7 Data Migration (*)

GAMP® 5 – DEVELOPMENT APPENDICES


GAMP® 5 – USING GAMP®5

21


GAMP® 5 – BASIC APPROACH


GAMP® 5 – LIFE CYCLE PHASES

22


GAMP® 5 – NON CONFIGURED SYSTEMS


GAMP® 5 – CONFIGURABLE SYSTEMS

23


GAMP® 5 – CUSTOM SYSTEMS


Computer System ValidationUse of

Risk Assessment

24


Full Assessment – Metodology

DELIVERABLES

Prj.Planning&

Inventory

1

SystemsList

GMP&

Risk Assessment

2

Activity

Assessment21 CFR Part 11

3

GapAnalysis

4

Planning

5

Risk Assessment

Report

SystemAssessment

Report

GapAnalysisReport

ActionPlan

RemediationPlan


La metodología del Análisis se aplica de acuerdo con los siguientes pasos:

1. Mapeo de Procesos (GxP)2. Identificación de Funciones Criticas3. Identificación del Escenario de riesgo4. Evaluación de probabilidad5. Evaluación de severidad del impacto6. Asignación de clasificación al riesgo7. Evaluación de la probabilidad de detección8. Asignación de prioridad al riesgo

El riesgo está basado en la identificación de un “Evento o Escenario de Riesgo”. Para cada amenaza al sistema, se identifica un posible evento de riesgo, relacionado con una operación-no correcta y/o una potencial corrupción o incumplimiento GxP de los datos que se manejan. Los posibles eventos relacionados a un mal funcionamiento del sistema se listan en el Risk Assessment Report.A cada riesgo se asocia una acción correctiva que va a impactar en la validación del sistema.

Using Risk Based Approach

METODOLOGÍA DEL ANÁLISIS DE RIESGO

25


Computer System ValidationExample of Suggested Activity

&

Deliverables Structures


RA - Risk Assessment

VP Validation

PLAN

TM Traceability

Matrix

FRS Functional Requirements Specifications

SDS System Design

Specifications

IQInstallation

Qualification

OQOperational Qualification

RA Datasheet RA Report

(RAR – CA) Collected Lists &

Documents

RA Results Scope , Objectives Roles &

Responsibility Activities &

Deliverables Criteria Management

Issues Draft Scheduling

RAR CA Type Description Owner Status Reporting/TO

DO PLAN

FRS ref . & IQ CODE Scope &

Description Test Conditions Expect. Results Collected Result Report

Main Document User’s Process Flow, & Blue

Print Manuals Implementation Project

Documents Configuration Docs Customization Docs User’s SOP, Application

Manuals

PQPerformances Qualification

Process Item / Process Flow Id. Process

Description Scope of Test &


System general architecture Equipment Technical

Datasheet System’s SOP Standard installation reports System Installed components System environment’s IT Working instruction & rules

System Risk Based Assessment& Remediation Planning/Controls System Description System Testing

SDS ref. & IQ CODE Scope &


DOC Hierarchy

26


Comply International Rules show Innovation,Knowledge & affordability, and it’s a PowerfulBusiness Item

Design an Qualifying Process & Plant incompliance with FDA or EMA requirements,means that the Product, once ready to export, arecompatible with the most restrictive internationalrules;

A structure prepared to manage qualified processmeans reduction of Technology Transfer Time ,both IN & OUT;

An Integrated QMS, supported by QualifiedProcesses & Systems, reduce Inspection Risksand Inspection Preparation Time;

Qualified Processes means reduction ofRegistration Time

A Full Compliant Plant increase Group Trust andGroup Visibility

Benefit of Compliance


27


Muchas Gracias por su Atención

Leandro Mbarakleandro.mbarak@latconsultores.com.arwww.latconsultores.com.ar

Gilberto Rossigilberto.rossi@latconsultores.com.arwww.latconsultores.com.ar