Parasoft Quality SystemsAutomated Processes for FDA Software Compliance

2011

Why the need for Regulation?

FDA Analysis Reveals:

� 3,140 Medical Device Recalls (1992-1998)

� 242 (7.7%) attributable to Software Failures

� 192/242 (79%) caused by software defects introduced when changes were made to the software after release

Software Validation Best Practices

A principle means of Avoiding such Defects & Resultant Recalls

FDA Guidance on Software Compliance

“General Principles of Software Validation”

� Based on generally recognized software validation principles

� Lists elements acceptable to FDA for Software Validation

� Recommends conducting Verification Activities throughout the SDLC

� Recommends integration of SDLC Mgt & Risk Mgt activities

FDA Verification & Validation

Software Verification

� Software Development Output meets Input Requirements

� Software Testing

� Static Analysis

� Dynamic Analysis

� Code Inspections

� Walkthroughs

� Others…

FDA Verification & Validation

Software Validation

� The Software consistently fulfills all of the requirements, which in turn meet the end users needs

� Traceability

“…the validation of software typically includes evidence that all software requirements have been implemented correctly and completely and are traceable to system requirements”

� Visibility

“A conclusion that software is validated is highly dependent uponcomprehensive software testing, inspections, analyses, and otherverification tasks performed at each stage of the software development life cycle”

FDA Compliance – Summary

� A set of Effective Software Verification Activities

� Should be performed Throughout the SDLC

� Outside Visibility into these regular Activities (Audit)

� Full Requirements Traceability

� Effective Regression Tests for Post-Release Code Changes

� Data Collection, Correlation & Report Generation (Audit)

� Process Improvement

� Integration of SDLC Management and Risk Management

One Final Consideration…

“FDA Worried That Class I Recall Jump Reflects Industry Rush To Market”

Article preview from "The Gray Sheet"- May 24, 2010

“A recent spike in Class I medical device recalls has led FDA to question whether manufacturers are sacrificing

quality to rush products to market”

Parasoft Concerto = FDA Compliance

Processes and best practices that assists organizations to meet FDA guidelines and medical device industry standards for

software development

1

Working Within IDE

Deliver Tasks and Monitor Work

Project Overview

Is your project on time?Is your project on budget?Will it have the right functionality?

Parasoft Concerto = FDA Compliance

Processes and best practices that assists organizations to meet FDA guidelines and medical device industry standards for

software development

1Manage the Process 2Control the Process

Iteration Overview

Real-Time Traceability

Traceability – Natural Workflow

& Validation ScenariosTasks are correlated to Code… & Automated Tests…

Automated Traceability: Requirements are correlated to Tasks

Parasoft Concerto = FDA Compliance

Policy-Driven FDA Compliance allows you to manage the process by exception

1Manage the Process

3Manage By Exception

2Control the Process

Policy Driven Compliance

Productivity

Verification

Traceability

More V&V Policies in Part2!

Policies for SDLC Management

Red = Exception: Take Action

Will it have the right functionality?

Is you project on time?

Yellow = Warning

Green = On Track

Is your project on budget?

Policies for Risk Management

Software Development Process Improvement

A closed-loop process to manage and improve the software development lifecycle

1Manage the Process

3Manage By Exception

Analyze and Improve42

Control the Process

Parasoft Proprietary and Confidential

Real-Time FDA Process Compliance

FDA Software Validation Compliance

� Verification and Validation

� Best Practices, Visibility & Traceability

Parasoft Concerto, the infrastructure for FDA compliance

plus real-time data that tracks:

� Is your project on time?

� Is your project on budget?

� Will it have the right functionality?

� Will it work?