A Practical Approach to Managing Risks in Computer System Validation

Transcription

1 White Paper A Practical Approach to Maagig Risks i Computer System Validatio The risk-based approach to validatio is gaiig wider acceptace i the pharmaceutical world. Orgaizatios are workig towards adoptig the risk-based approach i order to validate their systems, while optimizig resources ad reducig costs. This white paper will discuss best practices for riskbased validatio ad elucidate the approach ad steps towards practical risk maagemet methods durig the computer system validatio process.

2 About the Author Kavitha Ayalasomayajula Kavitha Ayalasomayajula is a Domai Cosultat with the Pharma IT Solutios ad Iovatio group of Life Scieces ISU at TCS. She has bee associated with TCS for over 12 years ad has bee actively ivolved i compliace activities for Life Scieces customers. Kavitha is a domai expert o the various regulatios related to IT compliace for the pharmaceutical Idustry, icludig Computer System Validatio ad Electroic Records Electroic Sigatures (ER; ES) regulatios. About the Domai TCS offers a full services play across the etire Life Scieces value chai helpig customers advace Cliical Trial efficiecies, accelerate Drug Discovery, maximize Maufacturig Productivity ad improve Sales ad Marketig effectiveess. Global Life Scieces compaies derive value from TCS Drug Developmet services such as Data Maagemet, Biostatistics, Pharmacovigilace etc (ow available o TCS ow platform), Serializatio offerigs, S&M CRM ad Aalytics, IT&IS Trasformatio services, Eterprise experiece i SAP, Oracle ad ew age busiess solutios icludig Mobility ad Big Data. I additio, TCS has a dedicated Life Scieces Iovatio Lab which esures that its customers have the tools ad iovative solutios they eed to solve complex busiess challeges Regulatory IT Compliace, a part of the Pharma IT Solutios ad Iovatio group, is a specialized group withi the Life Scieces uit, workig o compliace solutios. It addresses the regulatory IT requiremets, privacy, ad other security eeds of Pharmaceutical orgaizatios. 2

3 Table of Cotets 1. Risk Maagemet i Computer System Validatio Need for a Risk-based approach to Computer System Validatio Applyig the Risk-based approach to Computer System Validatio Risk Idetificatio ad Evaluatio Determiatio of Validatio Effort Idustry Guidace to Risk-based approach i Computer System Validatio TCS Approach to Risk-based Computer System Validatio 7 2. Coclusio 9 3. Ackowledgemets 9 4. Refereces 9 3

4 1. Risk Maagemet i Computer System Validatio The Life scieces idustry is costatly challeged by ewer ad ever evolvig striget regulatios ad the eed to esure compliace to these. Hece it is becomig essetial for orgaizatios to focus their resources effectively to esure miimal risks to patiets ad maximum resource utilizatio. I order to achieve this, they have bee weighig the risks by performig a risk assessmet ad the determiig optios or steps based o the outcomes. This approach of performig a risk assessmet ad deployig resources accordigly has bee adopted by orgaizatios for over a decade. However, there have bee o clear guidelies for the idustry. All orgaizatios perform a risk assessmet ad based o the assessmet, adopt steps like reducig testig effort or reducig documetatio effort to optimize the total effort. 1.1 Need for a Risk-based Approach to Computer System Validatio Orgaizatios were performig validatio usig the traditioal approach of validate everythig, which etailed spedig a huge amout of effort o testig to prove that the systems were performig as iteded. With the 21 Code of Federal Regulatios (CFR) Part 11 regulatios comig ito effect i1997, the focus shifted to idetifyig the criticality of the applicatio based o the electroic record ad sigature requiremets. This resulted i criticality beig applied as a parameter for determiig the urgecy ad eed for validatio. The Good Automated Maufacturig Practice (GAMP) 4 guidace published i 2001, gave way for formal risk assessmets to be performed. However, there was o guidace o the subject of effectively utilizig the risk assessmet, forcig orgaizatios to sped more effort o validatio o a cautioary ote. Icreasig costs ad the eed to optimize spedig ad reduce uwated costs; alog with the icreased focus o regulatios have led orgaizatios to adopt the Risk-based approach to validatio. 1.2 Applyig the Risk-based Approach to Computer System Validatio It is importat for pharmaceutical orgaizatios to esure that the expected regulatios are met. It is equally importat to adopt a framework for evaluatig the impact of the regulatios o patiet safety, while allocatig adequate effort to mitigate the risk. Efficiet risk maagemet is the key to brigig i cost ad effort efficiecies i the validatio effort. A good uderstadig of the busiess processes ivolved ad the ability to relate the impact of these o the related regulatios ad quality attributes affectig patiet safety is imperative. Risk assessmet requires that the risk be measured agaist the key Critical Quality Attributes (CQA) that could impact patiet safety. The CQAs for measurig the risks to patiet safety are - Impact of the computer system o patiet safety, quality, ad itegrity Impact o busiess processes ivolved Regulatory requiremets System classificatio (software categorizatio based o GAMP 5) ad architecture Supplier assessmet (if supplier is ivolved) 4

5 The primary priciples for quality risk maagemet are: Idetificatio ad evaluatio of the risks associated with the computer system to patiet safety. Determiatio of the effort required to validate the system i order to efficietly address the risks. Risk Idetificatio High Risk High Effort Risk Evaluatio Low Risk Low Effort Validatio Effort Right Sized Validatio Effort 1.2.1Risk Idetificatio ad Evaluatio Figure 1: Risk Maagemet Priciples The risk idetificatio process requires the IT system i cosideratio to be evaluated agaist all defied CQA. After the system is evaluated agaist the key CQAs, a qualitative aalysis is performed ad the risk level of the system is idetified, based o the risk level assiged to each CQA Impact o patiet safety, quality ad itegrity: A aalysis eeds to be performed to determie how the computer system is used ad what impact the data i the system ca have o the processes impactig patiet safety. For example, a system cotaiig cliical trial data would be havig a higher impact o patiet safety whe compared to a system storig fiacial data. Impact o busiess processes ivolved: A detailed aalysis should be made joitly with the busiess teams to determie the various busiess processes ad the possible impact of the computer system o the busiess process. Regulatory requiremets: Regulatory requiremets pertaiig to the computer system should be idetified ad accordigly the decisio regardig the risk level of the system should be made. System classificatio (software categorizatio based o GAMP 5) ad architecture: GAMP 5 guidace suggests that the category of the software should be a key cosideratio towards defiig the effort required for validatio. GAMP 5 suggests the cosideratio that ifrastructure software ad ay Commercial-Off-The-Shelf (COTS) software (cofigured/o-cofigured) is assumed to have udergoe testig by the supplier. Their wide usage ad acceptace i the idustry has lead to the uderstadig that they are relatively less risky systems tha i-house built bespoke systems. Supplier assessmet (if supplier is ivolved): GAMP 5 puts emphasis o evaluatig ad relyig o the suppliers Quality Maagemet System for systems provided by a supplier. It is assumed that the 5

6 product would have already udergoe striget quality measures as part of supplier QMS, ad so, the focus ca be limited to verifyig the iteded use of the product by the pharmaceutical compay. A detailed aalysis of the busiess processes ivolved, as well as, the fuctioal ad techical implemetatio details of the system, is performed Determiatio of Validatio Effort The evaluatio of the various risks that the system could pose directly or idirectly towards patiet safety is used to determie the level of activities ad the extet of effort that should be spet o its validatio. For example, a cliical trial maagemet system would be classified as a high risk system ad would require a exhaustive amout of validatio to be performed to prove that the system was meetig its iteded use. However, a low risk system like a ticketig system would require miimum validatio. The risk level of the system ad the effort ad level of validatio required are directly proportioal. 1.3 Idustry Guidace to Risk-based approach i Computer System Validatio The ICH guidace for idustry, Q9 Quality Risk Maagemet, offers a systematic approach to quality risk maagemet ad suggests a methodical process for the assessmet, cotrol, commuicatio, ad review of risks. Iteratioal Society of Pharmaceutical Egieers (ISPE) GAMP 5 has also issued guidace o how to adopt a risk-based approach to validatio based o the various categories of software i cosideratio. We will focus o the GAMP 5 guidace o the risk-based approach ad its implemetatio. The ISPE GAMP5 guidace is aliged to the ICH Q9 guidace ad both suggest the use of risk assessmet as the key iput to decidig the extet ad effort for validatio. GAMP 5 has classified software s uder various categories based o its complexity, reliability based o its exteded use i the idustry, ad the likelihood of failure. GAMP 5 has stressed to rely o the maturity of the suppliers Quality Maagemet System (QMS). It suggests that a evaluatio should be performed of the suppliers QMS ad accordigly the suppliers documetatio be relied upo ad thereby reduce the effort of validatig the product. The software categories i GAMP 5: - Category 1: Ifrastructure Software (icludes operatig systems, database maagers, middleware, ad ay other tools for etwork moitorig, batch job schedulig tools etc.) Category 3: No-Cofigured Software (icludes all COTS software that comes with a default cofiguratio) Category 4: Cofigured Software (icludes COTS systems that ca be cofigured as per busiess processes as well as customized) Category 5: Custom or Bespoke Software Note: Firmware was earlier classified as Category 2 uder GAMP 4. This classificatio was removed uder GAMP 5. GAMP suggests the idetificatio ad evaluatio of risks throughout the life cycle of the software. Key risk areas must be idetified ad efforts focused oly o the poit of risk. 6

7 1.4 TCS Approach to Risk-based Computer System Validatio TCS has defied a comprehesive framework for Computer System Validatio based o Geeral Priciples of Software Validatio; Fial Guidace for Idustry FDA ad the guidace from ISPE GAMP 5 o the riskbased approach to validatio. We effectively follow the below detailed approach for validatig systems ad have bee able to optimize the effort based o the risks associated with the system. The efforts optimizatio of effort has bee performed throughout the life cycle of validatio. The testig efforts have bee optimized by focusig o the key ad critical fuctioality esurig that the key busiess risks are addressed. Risk Assessmet Perform a Regulatory Compliace Determiatio Assessmet to aalyze the busiess process ivolved i the system ad the determie the various applicable regulatios. The assessmet report details the applicable regulatios ad the requiremet for validatio. Perform Regulatory Compliace Detail Assessmet to determie the various regulatios applicable accordig to the busiess process ivolved. This process esures that the applicable regulatios are determied ad drilled dow ito the requiremets as regulatory requiremets. It helps determie system criticality with respect to GxP, CSV, ER; ES applicability, ad also to idetify major risks i the project egagemet. Perform Electroic Records Electroics Sigatures Compliace Detail Assessmet that assist i idetifyig the various ER; ES compliace requiremets applicable to the IT system. Add the idetified ER; ES applicable requiremets ito the fuctioal requiremets documet. Classify the system based o GAMP 5 software categories ad perform a supplier assessmet for the various software to be used to determie the maturity of the supplier s QMS, the output of which is used to optimize the validatio effort. The supplier assessmet will focus o the supplier s quality policy ad processes for software developmet, people traiig, testig ad defect maagemet, chage, ad release maagemet. Risk Plaig Documet the validatio pla, defiig the strategy ad extet of validatio, with the key iputs beig the regulatory compliace detail assessmet report, GAMP 5 categorizatio of software, ad the supplier assessmet report. Risk Aalysis Perform a Fuctioal Risk Assessmet to determie the critical fuctios ad their impact to the busiess processes. This will help determie the extet of testig for these critical fuctios. Based o the assessmet of each fuctio, testig will be performed to address each key risk. Risk Reductio Based o the output of the Fuctioal Risk Assessmet, idetify the key fuctios ad determie the extet ad type of testig for each of them ad accordigly devise the testig pla.it will also address 7

8 the focus areas for testig based o the category of software as per GAMP 5 software categorizatio. Ay idetified risks that caot be verified through testig or the system cotrols i place, will be addressed by meas of process cotrols through stadard operatig procedures. ER/ES Compliace Assessmet Regulatory Compliace Assessmet GAMP 5 Category Assessmet Risk Assessmet Supplier Assessmet Validatio Plaig Risk Plaig Fuctioal Risk Assessmet Risk Aalysis Testig ad Process Cotrols Support Processes (BCP/DR, Chage Cotrol, Backup) Risk Reductio Periodic Review Security Review Chage Review Risk Review Figure 2 Perform the testig as per the defied pla ad documet ay deviatios. Determie ad deploy the various support processes such as, Busiess Cotiuity Plaig (BCP), Disaster Recovery (DR), Backup ad Restore, ad Chage Cotrol that are required to be established for the system based o the criticality of the system. For a low risk system, it may ot be required to have a BCP or DR defied. However, for high risk systems, a clearly defied ad tested BCP should be i place. Risk Review Defie the periodicity ad the process for the periodic review of the system based o the risk level of the system Ay gaps idetified i the validated state of the system must be reviewed ad closed. 8

9 The above procedure takes ito cosideratio the type of the system (cofigurable, bespoke), the maturity of the quality processes of the supplier (if applicable) ad hece, gives the opportuity to leverage the experiece ad maturity of the supplier i the process of validatig the system. The validatio of the system should also factor i the category of the system. Specifically, for the ocofigurable software, the focus should be oly o testig the system agaist its iteded use, rather tha the etire fuctioality it could offer. For cofigurable software, testig should verify the correctess of the cofiguratio ad test the iteded use of the system. Coclusio Our approach to risk-based validatio is a practical approach to validatig systems i a effective maer, while esurig the optimal utilizatio of resources. The adoptio of risk maagemet throughout the life cycle of a system is a effective tool for determiig effort based o risk. Orgaizatios should be able to adopt the risk-based framework to its existig framework for validatio ad reap the beefits of right sizig, while adherig to regulatory compliace requiremets. Ackowledgemets I would like to thak Sajeev Sachdeva, Head Pharma IT Solutios ad Iovatio Group, TCS Life Scieces for the guidace he provided i developig this white paper. I would also like to thak Nada Thakur, Head Regulatory IT Compliace, TCS Life Scieces for his valuable iputs ad support which this paper has beefited sigificatly from. Refereces [1] Kevi C Marti ad Dr. Arthur Perez, (2008), GAMP 5 Quality Risk Maagemet Approach, Pharmaceutical Egieerig, the Official magazie of the ISPE. [2] GAMP: A Risk-Based Approach to Compliat GxP Computerized Systems, 9

10 Cotact For more iformatio, cotact Subscribe to TCS White Papers TCS.com RSS: Feedburer: About Tata Cosultacy Services (TCS) Tata Cosultacy Services is a IT services, cosultig ad busiess solutios orgaizatio that delivers real results to global busiess, esurig a level of certaity o other firm ca match. TCS offers a cosultig-led, itegrated portfolio of IT ad IT-eabled ifrastructure, egieerig TM ad assurace services. This is delivered through its uique Global Network Delivery Model, recogized as the bechmark of excellece i software developmet. A part of the Tata Group, Idia s largest idustrial coglomerate, TCS has a global footprit ad is listed o the Natioal Stock Exchage ad Bombay Stock Exchage i Idia. For more iformatio, visit us at IT Services Busiess Solutios Cosultig All cotet / iformatio preset here is the exclusive property of Tata Cosultacy Services Limited (TCS). The cotet / iformatio cotaied here is correct at the time of publishig. No material from here may be copied, modified, reproduced, republished, uploaded, trasmitted, posted or distributed i ay form without prior writte permissio from TCS. Uauthorized use of the cotet / iformatio appearig here may violate copyright, trademark ad other applicable laws, ad could result i crimial or civil pealties. Copyright 2013 Tata Cosultacy Services Limited TCS Desig Services I M I 07 I 13