Rick Jairam, M.Sc., PMP

GlaxoSmithKlineGlaxoSmithKline

What is Analytical Equipment LifecycleWhat is Analytical Equipment Lifecycle Management?

Purchasing through decommissioning. Includes equipment selection, validation, calibration, q p , , ,incident handling/troubleshooting, change control, periodic review.

Focus on GxP COTS (Commercial Off the Shelf) equipment following SILC (software implementation lifecycle)

Impacts: business cost lab efficiency complianceImpacts: business cost, lab efficiency, compliance

GAMP quote: “In a typical regulated laboratory, if the validation process is not well devised and executed, lab computerized systems may cost nearly as much to validate as they do to purchase.”to validate as they do to purchase.

About 10% of COTS instrumentation will not meet i f d li I i l duser requirements after delivery. Issues may include

software bugs, method requirements, pharmacopeia requirements, throughput requirements (automated q , g p q (systems), 21 CFR 11etc.

Poor Management of the lifecycle can lead to:Poor Management of the lifecycle can lead to:

Delay the use of new systems for severalDelay the use of new systems for several months.I fl t lid ti tInflate validation costsExposure to unnecessary compliance risk

d bReduce return on investment by increasing equipment down time.

1. Validation Plan2. Risk assessment3. User requirements4 Supplier assessment4. Supplier assessment5. IQ/OQ6. PQ/PM/Calibration7 Configuration Management7. Configuration Management8. Tracematrix & VSR9. Training, Use SOPs

Ch C l10. Change Control11. Data Backup/recovery & System administration12. Incident handling and troubleshooting13. Periodic Review14. Decommissioning

Select right equipment to meet userSelect right equipment to meet user requirementsSingle set of global requirements desirableSingle set of global requirements desirable but often difficult to achieve.Supplier Assessment looking for evidence ofSupplier Assessment – looking for evidence of a quality management system – based on equipment risk categorizationequipment risk categorization.Initial installation/validation and ongoing support from vendorsupport from vendor.

>90% of analytical equipment in a typical lab>90% of analytical equipment in a typical lab is Commercial Off The Shelf (COTS)COTS systems allow a streamlined simplifiedCOTS systems allow a streamlined, simplified validation process without dealing with design elementsdesign elements.Relies on vendor to have a good quality management system – risk deflectionmanagement system – risk deflectionNeed to have COTS definitionRisk based approach: GAMP categorizationRisk based approach: GAMP categorization

Attributes:Attributes:Exist a priori – not to be developedNon trivial install base (more than a fewNon trivial install base (more than a few copies)B h t dBuyer has no access to source codeVendor controls developmentV.Basili, B.Boehm. “COTS-Based Systems Top 10 List” IEEE Computer 34(5), May 2001, pp 91-93

Risk Based approach cGMPs for 21st centuryRisk Based approach cGMPs for 21st centuryScale validation effort based on equipment complexity and likelihood of problemcomplexity and likelihood of problem detection (risk to data integrity) - GAMP

C C C C C CCat A Cat B Cat C Cat D Cat ESimplefirmware

Simple firmware

Complex firmware

Software Software

No computer No computer No computer computer computer

No data output

Calibration storage

Method storage

Data storage Data storage andprocessingprocessing

Stirrers,sonicators

pH meters, balances

HPLC connected to validated CDS

HPLC with Chemstation control only

HPLC with Chemstation

y

May be generic for COTS equipmentMay be generic for COTS equipmentSpecifies approach (risk based)Key DeliverablesKey Deliverables ResponsibilitiesD il d j W k B kd SDetailed project Work Breakdown Structure (WBS), task duration, task sequencing,

i t b t h dl d bresource assignments best handled by a business (non GxP) project plan, e.g. MS ProjectProject.

Operation rangeOperation rangePerformance requirementsSoftware inputs outputs calculationsSoftware inputs, outputs, calculations Data integrity 21CFR11 requirementsM b ifi blMust be verifiableMust be traceable to test cases

Correct installation of hardware and softwareCorrect installation of hardware and softwareIdentification of all hardware and software -Inventory updateInventory update

Configuration:D fi iti f tDefinition of systemSecurity settings

d dCommunication, data acquisition and processing settingsData Backup - Automated means preferred.

Testing that the system will functionTesting that the system will function according to operational specifications throughout intended operational range -g p gverification of correct operation of hardware and software.

d l b d b d bVendor protocol can be used, but need to be reviewed to ensure that it meets user requirements offers time and resourcerequirements – offers time and resource savings.Responsibility for validation is on customerResponsibility for validation is on customer, not vendor.

System reliably meets user requirements inSystem reliably meets user requirements in production - Ongoing testing to maintain validated statevalidated stateDetermine appropriate system suitability, calibration tests and limitscalibration tests and limitsScheduling systemSystem for OOT investigations and businessSystem for OOT investigations and business notification

Trace requirements to testingTrace requirements to testingSummarize validation activitiesIncidents/deviations resolution of exceptionIncidents/deviations – resolution of exception reportsLi it tiLimitations on useRelease system for use

Mechanism for requesting evaluatingMechanism for requesting, evaluating, authorizing, testing and implementing changes to a validated systemchanges to a validated system.Emergency – repairProceduralized pre approvedProceduralized – pre-approvedPlanned - futureM t d fi h t t f i tMust define what aspects of equipment lifecycle will be under formal change controlCh l b il llChange control system must be agile to allow rapid changes

Incident/Problem reporting and resolution –Incident/Problem reporting and resolution –input to change control processVendor/internal resourceVendor/internal resourceGenerally more cost effective to use internal resource however need to consider:resource, however need to consider:Internal skill setR Ti i dResponse Time required

Setup user groups and accounts to meet dataSetup user groups and accounts to meet data integrity requirementsControl access to system and any externalControl access to system and any external dataComputer system maintenanceComputer system maintenanceSystem restoration in event of failureI id t ti d tIncident reporting and managementTypically independent of user to maintain d i idata integrity

Maintaining validated stateMaintaining validated stateWhat category of system will require formal reviewreview.How often? 1-3 yearsWh t t iWhat to reviewChanges to hardware, software, locationDocumentation is current – user requirementsSecurityIncidents

May be driven by usage metrics age/supportMay be driven by usage metrics, age/support, incidents.Inventory updatesInventory updatesClose out calibrationR l f ft & h dRemoval of software & hardwareRecord retention – software and data

Validation expectations and equipmentValidation expectations and equipment complexity /computerization has increased.Most medium/large pharma companies have gresponded by having dedicated resource/ group to manage the lifecycle efficientlyAlternatively have contracted aspects to vendorAlternatively have contracted aspects to vendor or third party.Cost of contracting generally about 50% higher.Cost of contracting generally about 50% higher. Still need to have internal accountability (audits) and governance. Training and retention of kill d l i k f l i lskilled personnel is key to a successful internal

group.

Parts of the lifecycle may be handled as projects,Parts of the lifecycle may be handled as projects, e.g validation – benefit from the application of good project management best practices (PMBOK®)(PMBOK ).Others are ongoing operationsNeed to have integration between projects and g joperations.Detailed knowledge of equipment that is developed during validation may be needed laterdeveloped during validation may be needed later in the lifecycle (calibration, use, troubleshooting etc.)Integration is helped by a good electronicIntegration is helped by a good electronic equipment management system.

Validation Plan Risk A

COTS Equipment Lifecycle Management

Generic and C biValidation Plan Assessment Combine

Project start Project end

IQUser Requirements

Configuration Management

Traceability matrix and

VSR

Supplier Assessment OQ/PQ

Use

Data Backup and Recovery

TrainingUse,

Calibration SOPsElectronic

Equipment Management

System

PQ / C lib ti

Change C t l

Incident Handling & Periodic

R iSoftware

Ad i i t tiCalibrationControl gtroubleshootingReview Administration

Decommissioning

Proper management of the analyticalProper management of the analytical equipment lifecycle is required to meet business and regulatory requirementsbusiness and regulatory requirements.Efficient control of the lifecycle can be achieved using good project and riskachieved using good project and risk management practices.Equipment validation adds business value andEquipment validation adds business value and should not be viewed as only a regulatory exercise that is measured by the amount ofexercise that is measured by the amount of paper generated.