software quality regulatory trendsvalidationcenter.com/wp-content/uploads/software-quality... ·...

1925 West Field Court, Suite 125, Lake Forest, IL 60045 Validation Center™praxislifesciences.com | +1(847) 295-7160 validationcenter.com

Software Quality Regulatory Trends

By Praxis Life Sciences

Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.

© 2018 Praxis Life Sciences. All rights reserved.

Validation Center™validationcenter.com

Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295-7160 1

Software Quality Regulatory Trends© Copyright 2018 by Praxis Life Sciences. All rights reserved. No part of these materials may be reproduced or transmitted in any form without the written permission of Praxis.

v.17.04

Your Praxis Facilitator

Validation Center™ © 2018 Praxis Life Sciences 2

• Debra Bartel, MBA, CQA, PMP

• Principal, Praxis Life Sciences

• 25+ years experience specializing in software quality assurance, validation and regulatory compliance, Information Systems project management, and process design.

• Prior to joining Praxis, held management positions in the pharmaceutical industry in both Quality Assurance and Information Systems organizations

• Active member of American Society for Quality (ASQ), Northeastern Illinois Section, Software Division

Intro to Praxis Life Sciences


Follow us!





Target Audience

• Pharmaceutical & Biologics• Medical Device• Clinical Studies• Blood Products

Industries

• Operating in the US• Selling to the US MarketRegions

• IT Personnel and Managers• Software Quality Personnel and

Managers• Software Testers and Protocol Writers

Personnel

© 2018 Praxis Life Sciences 4PraxisLifeSciences.comValidation Center™

Webinar Outline


• Applicable Regulations and Guidance• Recent and Approaching Change1

• Data Integrity2

• FDA Enforcement Statistics3

• FDA Enforcement Analysis4

• FDA Enforcement Trends5

• Recent FDA Warning Letters 6

PraxisLifeSciences.com

Applicable Regulations and GuidelinesPart 1

Recent and Approaching Changes





Part 1: Regulations, Guidelines, & Changes

Section Overview– Sources of Regulations & Guidelines:

• FDA

• ICH• Eudralex• PIC/s• WHO

– Changes Highlights• Changes implemented in 2015 - 2018

• Changes pending• Flagged with symbol

© 2018 Praxis Life Sciences 7PraxisLifeSciences.comValidation Center™

Framework for Regulations, Guidelines


Part 1 will address the key places to look for regulations and guidelines related to

computer systems and software

Software Quality Assurance, Validation, and Information Technology professionals operate in an ever changing

regulatory environment.

It can be difficult to find the time to monitor the US and international information to be aware of new regulations,

guidance documents, and enforcement trends.

21 CFR 58 Good

21 CFR 210,211, 820, 606 Good Manufacturing Practices

21

CF

R 1

1E

lectr

onic

Re

co

rd

21

CF

R 5

0, 54

,

ICH E6 Good Clinical Practice ICH Q7 Good Manufacturing Practice

ICH Q9 Quality Risk Management

Eu

dra

lex

V4

Ch

ap

ter

4 D

oc

um

en

tatio

n

Eu

dra

lex V

4 A

nnex 1

1

Eu

dra

lex

V4

An

nex 1

5 Q

ualific

atio

n a

nd V

alid

atio

n

FDA Guidance: Computerized Systems Used in Clinical InvestigationsFDA Guidance: Gener

FDA Guidance: Validation of Blood Establishment Computer Systemsa

l Prin

cip

les o

f So

ftwa

re V

alid

atio

nComputerised Systems

56 Good Clinical Practices

La

bo

rato

ry P

rac

tic

es

& Signatures



Regulations (Laws)FDA 21 CFR ….

Eudralex Volume …

ICH Guidelines

FDA Guidance & Reference Documents

PIC/SGuidance Documents

GAMPGuides(ISPE)

ISOStandards

etc.

Company policies & procedures

influences

EMAReflection

Papers






Eudralex Volume …

ICH Guidelines






GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers

FDA: General


Electronic Records; Electronic Signatures

Scope:

General electronic records and signature requirements for electronic records

• created, modified, maintained, archived, retrieved, or transmitted, under any FDA records requirements

• submitted to the FDA

Includes topics such as electronic record and signature validation, record protection, audit trails, training, documentation, change control, passwords

199721 CFR 11

FDA: General


Provides a better explanation of the scope of records included in Part 11

Explains which parts of Part 11 the FDA intends to enforce vs. where the FDA plans to use “enforcement discretion” while re -examining the Part 11 regulation

Refers the reader to “General Principles of Software Validation” for

validation guidance.

Electronic Records; Electronic Signatures 199721 CFR 11

Part 11, Electronic Records; Electronic Signatures – Scope and Application 2003Guidance





FDA: General



2002General Principles of Software ValidationGuidance


Scope:

• Software in medical devices• Blood establishment software• Software in manufacturing equipment• Software used to support the quality system

Provides an integrated approach to software validation and risk management.

FDA: General


FDA’s manual for ORA lab analysts contains a chapter on

spreadsheet validation.

2003FDA Office of Regulatory Affairs Laboratory ManualReference

2002General Principles of Software ValidationGuidance



FDA: General


Posted on the FDA web site in July, 2010





FDA: Pharmaceutical


Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General

Current Good Manufacturing Practice for Finished Pharmaceuticals

FDA ORA Guide to Inspection of Computerized Systems in Drug Processing

21 CFR 210

21 CFR 211

Reference

Scope:

• Preparation of drug products for humans or animals

CFR 211 Provides requirements for:

• Controls of computer systems• Change control

The ORA document gives insight to questions that FDA auditorssometimes ask

• Validation• Back-ups

• Record content, management,and retention

FDA: Medical Devices


Quality System Regulation

Off-The-Shelf Software Use in Medical Devices

Contents for Premarket Submissions for Software Contained in Medical Devices

21 CFR 820

Guidance

Guidance

Scope:

• Design, manufacture, packaging, labeling, storage, installation, and servicing ofall finished medical devices intended for human use.

CFR 820 provides requirements for:

• Design controls• Automated processes

The Guidance documents provide additional recommendations for device software topics such as documentation, risk assessment & management, change management, virus protection and networks.

• CAPA• Validation

• Record content, management, and retention



Design Considerations for Devices Intended for Home UseGuidanceInteresting Contents:

• Recommended practices to mitigate the unique risks of home use medical devices. • Recommended Design Controls for home use medical devices• Brief discussion regarding best practices for software design, testing, and

upgrades.

Mobile Medical AppsGuidanceInteresting Contents:

• Definitions of Mobile Medical Apps• Regulations that apply to Mobile Medical Apps• Examples of apps that are Mobile Devices• Examples of apps that are not Medical Devices

2015

General Wellness: Policy for Low Risk DevicesGuidanceInteresting Contents:

• FDA compliance policies for devices that promote healthy life styles• Examples of low-risk wellness devices

2016







Contents of Premarket Submissions for Management of Cybersecurity in Medical Devices

Guidance

Interesting Contents:

• Design and development considerations to ensure cybersecurity• Recommendations regarding hazard analyses, trace matrices, risk mitigation and technical measures, such as user authentication, code authentication, and detection of security breaches

Medical Device Data Systems, Image Storage Devices, and Image Communications Devices

Guidance


• FDA does not intend to enforce regulatory controls for devices classified as Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communication Devices

• Definitions and examples of the categories of devices listed above.

2015

Postmarket Management of Cybersecurity in Medical DevicesGuidance


• Expectations for medical device manufacturers to monitor, identify and address cybersecurity vulnerabilities for their medical devices.

2016

FDA: Biological Products


Biological Products: General

Scope:

• Manufacture, inspection, and adverse event reporting for any virus, therapeutic serum, toxin, antitoxin, or analogous product applicable to the prevention, treatment or cure of diseases or injuries of man

Prov ides requirements for:• Record types, content, management and retention• Computer generated vaccine adverse event reporting system forms

21 CFR 600

FDA: Blood & Components


Current Good Manufacturing Practice for Blood and Blood Components

Scope:

• Manufacture of blood and blood products

CFR prov ides requirements for:

• Record content, management and retention

21 CFR 606





FDA: Blood & Components


Guidance provides FDA recommendations for:

• Software vendor selection• System documentation and records• Contents of Validation Plans and Validation Reports• Validation scope• System risk assessments• Validation procedures and activities• Validation after changes

Blood Establishment Computer System Validation in the User’s

FacilityGuidance

Changes to an Approved Application: Biological Products: Human Blood and Blood Components Intended for Transfusion or for Further Manufacture

Guidance

Guidance provides FDA recommendations for:

• Reporting changes associated with various types and uses of Blood Establishment Computer Software (BECS)

FDA: Human Based Products


Human Cells, Tissues, and Cellular and Tissue-Based Products

Scope:

• Creation of a unified registration and listing system for establishments that manufacture human cells, tissues, and cellular and tissue-based products (HCT/P's) and to establish donor-eligib il ity, current good tissue practice, and other procedures to prevent the introduction, transmission, and spread of communicable diseases by HCT/P's.

Provides requirements for:

• Computer validation• Record content, management and retention

Requires compliance to 21 CFR 211 for HCT/Ps that are drugs and 21 CFR 820 for HCT/Ps that are medical devices.

21 CFR 1271

Current Good Tissue Practice (CGTP) and Additional Requirements for Manufacturers of Human Cells, Tissues, and Cellular and Tissue-Based Products (HCT/Ps)

Guidance

FDA: Clinical Studies


Protection of Human Subjects

Scope:

• Clinical investigations regulated by the FDA, including drugs, medical devices,biological products, dietary supplements, infant formulas, and food & color additives

CFR 50 & 56 provide requirements for:

• Record content, management, and retention

Institutional Review Boards

21 CFR 50

21 CFR 56





FDA: Clinical Studies


Computerized Systems Guidance provides:

• Recommendations on topics such as SOPs, record retention formats, system security, audit trails, system controls, user training, and system documentation

Source Data Guidance provides:

• Recommendations on topics such as electronic source data capture, electronic data review, retention of records by clinical investigators, and access to electronic source data

Computerized Systems Used in Clinical InvestigationsGuidance

Electronic Source Data in Clinical InvestigationsGuidance

FDA: Nonclinical Labs


Good Laboratory Practice for Nonclinical Laboratory Studies

Scope:

• Conduct of nonclinical laboratory studies to support applications forresearch or marketing permits for FDA regulated products, such as drugs ,biological products, medical devices, and food & color additives

Prov ides requirements for:• Record content, management and retention

This regulation includes computer data in its definition of “raw data”. Requirements for generation, management, storage, retention, and protection of raw data are found throughout the document.

21 CFR 58


Eudralex Volume …

ICH Guidelines


ICH




GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers





ICH Members


ICH members include the• Japanese Ministry of Health, Labour and Welfare (MHLW)• Japanese Pharmaceutical Manufacturers Association (JPMA)• European Union (EU)• European Federation of Pharmaceutical Industries and Associations (EFPIA)• US Food and Drug Administration (FDA)• US Pharmaceutical Research and Manufacturers of America (PhRMA)• Observers from

• Canada • World Health Organization (WHO)

ICH: Clinical Studies


Guideline for Good Clinical Practice

Scope:

• Responsibilities and expectations of all participants in the conduct ofclinical trials, including investigators, monitors, sponsors and IRBs.

Prov ides computer system guidelines for:

• Record content, management and retention• Audit trails• Validation• SOPs• Security• Back-ups

E6

2016

ICH: API Manufacturing


Scope:

• Good manufacturing practice (GMP) for the manufacturing of active pharmaceutical ingredients (APIs). “Manufacturing” is defined to include

all operations of receipt of materials, production, packaging, repackaging, labeling, relabeling, quality control, release, storage and distribution.


• Record content, management and retention• Audit trails• Validation and qualification• Record protection• Incident investigation

Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients

• SOPs• Security• Back-ups• Change control

Q7

2016





ICH: Quality Risk


Scope:

• Principles and examples of tools of quality risk management that can beapplied to all aspects of pharmaceutical quality including development,manufacturing, distribution, and the inspection and submission/reviewprocesses throughout the lifecycle of drug substances, drug products,and biological and biotechnological products

This guideline provide examples of how risk management concepts can be applied to computer system design and validation.

Quality Risk ManagementQ9


Eudralex Volume …

ICH Guidelines


European Union




GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers

European Union Members


European Union members include

AustriaBelgiumBulgariaCroatiaCyprusCzech RepublicDenmark

EstoniaFinlandFranceGermanyGreeceHungaryIreland

ItalyLatviaLithuaniaLuxembourgMaltaNetherlandsPoland

PortugalRomaniaSlovakiaSloveniaSpainSwedenUnited Kingdom*

* In June 2016, the UK citizens voted to leave the EU





Eudralex: Computerised Systems


Annex 11 provides additional rules for computer systems

Topics include:• Validation • System documentation• System placement• Training

Status:

A new version went into effect on June 30, 2011

NOTE: Adopted by PIC/S in 2014

Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use

Computerised Systems

• Security and access• Audit Trails• Change control• Back-ups

Volume 4

Annex 11

• Alternate procedures for useduring system down time

• Error analysis and correction• Outside service providers

Eudralex: Qualification & Validation



Qualification and Validation

Annex 15 provides additional rules for qualification and validation

Validation topics include:

• Planning (VMPs)• Documentation• Change control• Revalidation

• Qualification of •Design•Installation•Operation•Performance

Volume 4

Annex 15

2015

Eudralex: Quality Risk



Quality Risk Management

Scope:

Based on ICH Q9, Quality Risk Management.Principles and examples of tools of quality risk management that can beapplied throughout the lifecycle of drug substances, drug products, and biological and biotechnological products.

Computer System topic:

Includes areas where risk management principles can be applied. E.g., software design, selection, verification, and validation

Volume 4

Annex 20





Eudralex: Clinical Studies


Clinical Trial Guidelines

Inspections

Scope:

Guide for GCP inspectors to use during inspections related to clinical trials

Status:

In effect. Version dated May 28, 2008.Minor correction to scope was made in September, 2012.

Guidance for the Conduct of GCP Inspections –Computer Systems

Volume 10

Chapter IV

Annex III

Eudralex Volume 10, Chapter IV, Annex IIIConduct of GCP Inspections – Computer Systems

Eudralex: Clinical Studies


“The EU GCP inspectors agreed to use as the reference for inspection of

Computer Systems the published PIC/S Guidance on Good Practices for Computerized Systems

in “GXP” Environments (PI 011-3)”

EC: Distribution


Good Distribution Practice of Medicinal Products for Human Use Guidelines

This document outlines GDP (good distribution practice) expectations for computer system topics such as:• Validation for computer systems used to segregate product prior to use• Security • System documentation• Back-ups• Data retention• Procedures for addressing system failures.

Principles of Good Distribution Practice of ActiveSubstances for Medicinal Products for Human Use Guidelines

2015This document outlines GDP (good distribution practice) expectations for importers and distributors of APIs. Computer system topics include:• Use of systems to segregate damaged, falsified, and expired product• Validation of Warehouse Management Systems• Requirements for electronic documentation





EMA: Clinical Studies


Expectations for Electronic Source Data & Data Transcribed to Data Collection Tools in Clinical TrialsReflection Paper

• Validation• SOPs for system use• Audit trails• Backups

• System security• Data safeguards• User training• Record archival

Reflection Paper for Laboratories that Perform the Analysis or Evaluation of Clinical Trial SamplesReflection Paper

These documents outlines GCP (good clinical practice) inspectors’

expectations for computer system topics such as :

• Computer system validation and re-validation• SOPs for computer system installation, validation, and maintenance• Administration and access rights• System documentation• Interfaces• Upgrades and patches

• Risk assessment• Location• Disaster recovery

EMA: Data Integrity


Questions and Answers: Good Manufacturing Practice– Data Integrity Compliance

• Data Life Cycle• Data Risk Assessment and Risk Reduction• Review of Electronic Data• Data Integrity Self-Inspection

• Data Integrity Responsibilities for Outsourced Activities

Online Guidance2016

PIC/S




GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers


Eudralex Volume …

ICH Guidelines






PIC/S Participants


PIC/S is an international group that provides a harmonized framework for cGXP inspectors

PIC/S Participating Authorities include

PIC/S Partners include

Pharmaceutical Inspection Convention (PIC) and

Pharmaceutical Inspection Co-operation Scheme (PIC Scheme)

ArgentinaAustraliaAustriaBelgiumCanadaChinese TaipeiCroatiaCyprusCzech RepublicDenmark

EstoniaFinlandFranceGermanyGreeceHong KongHungaryIcelandIndonesiaIran

IrelandIsraelItalyJapanKoreaLatviaLiechtensteinLithuaniaMalaysiaMalta

MexicoNetherlandsNew ZealandNorwayPolandPortugalRomaniaSingaporeSlovak RepublicSlovenia

South AfricaSpainSwedenSwitzerlandThailandTurkeyUkraineUnited KingdomUSA

EME EDQM UNICEF WHO

PIC/S: Medicinal Products


Scope:

Guide for establishments that manufacture finished pharmaceuticals and active pharmaceutical ingredients.

Status:

In effect as of January, 2013.

Annex 11 topics include:• Risk Management• Suppliers & Vendors• Validation• Data Management

PE 009 Guide to Good Manufacturing Practices for Medicinal Products

• Audit Trails• Security• Change Control• Periodic Evaluation

• Configuration Management• Incident Management • Electronic Signatures• Business Continuity

Computerised SystemsAnnex 11

PIC/S: Blood Establishments


Scope:

Guide for GMP-inspectors to use during inspections of establishments that collect, prepare, store, dispatch, and/or provide quality control and quality assurance of human blood and blood components.

Prov ides computer system guidelines for:• Validation • Security and access• Audit trails• Disaster recovery

PE 005 Good Manufacturing Practice Guide for Blood Establishments.

• Change control• Back-ups• Special considerations when

system is used to release results





PIC/S: Healthcare Establishments


Scope:

Guide for inspectors to use during inspections of healthcare establishments which prepare medicinal products for direct supply to patients.

Prov ides computer system guidelines for:• Electronic records and documents• Appropriate use of a validated computerized system for verifying

material identity, weight, and volume.

PE 010 Guide to Good Practices for the Preparation of Medicinal Products in Healthcare Establishments

PIC/S: Distribution


Scope:

Guide for inspectors to use during inspections to ensure high standards of quality assurance and integrity for distribution of medicinal products.


• Validation for any system providing segregation of products prior to use• Retaining up-to-date, written documentation of systems• Authorization for people who enter or change data• Data protection and retention• Implementation of procedures to be followed in the event of system

failure• Computerized record retention• Specifically required data elements

PE 011 Guide to Good Distribution Practice for Medicinal Products

PIC/S: Computerised Systems


Scope:

Recommendations for inspectors to use during inspections of computerized systems. “GxP” includes manufacturing, clinical, laboratory,

and distribution.

Prov ides computer system guidelines for:• Validation • System life cycle• Security and access• Audit trails• Supplier assessment• Personnel qualifications

PI 011 Good Practices for Computerised Systems Used in Regulated “GXP” Environments

• Change control• Service agreements• Back-ups• Error reporting• Electronic signatures• Training





WHO: Pharmaceuticals


Scope:

This document contains the collective views on pharmaceutical manufacturing from an international group of experts - including representatives from international regulatory agencies, EU, IFPMA, IGPA, IPEC, PIC/S, UNICEF, BSP and US.

Provides computer system guidelines, including:

• Computer system qualification and validation• Self-Inspection of validation and re-validation programs • Documentation requirements for electronic data and records management • Responsibil ities of the Quality Function in qualification and validation• Outline of information that needs to be associated with a signature or electronic

password • Labeling exceptions when using fully validated computerized systems• Recommendations to use validated computer programs for Batch Processing

and Packaging records

Annex 2 Good Manufacturing Practices for Pharmaceutical Products: Main Principles

www.ValidationCenter.com


Data Integrity

Part 2





Hot Topic

Validation Center™ 52© 2018 Praxis Life Sciences

2015 2016 2017 2018

2015 – March: MHRA GMP Data Integrity Definitions and Guidance for Industry

2016 – April: FDA [DRAFT] Data Integrity and Compliance with CGMP Guidance for Industry

2016 ~June: WHO [DRAFT] Guidance on Good Data and Records Management Practices

2018 – March: MHRA ‘GxP’ Data Integrity Guidance and Definitions

2016 – August: EMA Questions and Answers: Good Manufacturing Practice

– Data Integrity Compliance

2016 – August: PIC/S [DRAFT] Good Practices for Data Management and Integrity in

Regulated GMP/GDP Environments

What is Data Integrity?


• ATTRIBU TA BLE

• Clear identification of who performed the taskA

• LEGIBLE

• Human readableL

• CONTEMPORANEOUS LY RECORDED

• Recorded in real timeC

• ORIGINAL or TRUE COPY

• Initial capture or complete copy, including metadataO

• ACCURATE

• Correct and completeA

Metadata


Information about the data that makes the data meaningful

66Data

mgunit of

measure

Joe L. Smith

lab analyst who ran test

GX-0032-A

lab instrument that generated the data

2017-02-2715:23:01 GMT

when data generated

2017-02-27 13:23:01 GMT 66 original test result2017-02-27 13:32:32 GMT 67 changed by J.Jones

2017-02-28 11:00:06 GMT deleted by M.Cooper

Audit trail

Metadata





Access Restrictions


• Eliminate sharing of User IDs• Eliminate use of Generic accounts (e.g., System Admin)• Restrict system access to authorized people and roles.

This includes access for:o generating, changing, and voiding datao altering specifications, process parameters, test

methodso changing system settings

• Assign System admin roles (i.e., roles with rights to alter fi les, change settings) only to personnel independent from those responsible for record content.

Audit Trail Reviews


• Review the Audit Trails associated with critical data, including:o Product testing resultso Sample run sequenceso Process parameters

• For critical data, review the audit trails prior to record approval and batch release. For other data, set the review frequency based on risk.

• Ensure that the audit trails reviews are performed by the group with record review responsibility, per CGMP regulations. Often this is the Quality Unit for critical data.

Electronic Copies


• If generating electronic copies as ‘true copies’ of

either paper or electronic records, ensure that:o the content and meaning is preservedo the information is accurate and completeo metadata is retainedo the record remains readily available

• Implement written procedures for creating and verifying ‘true copies’

• Validate data migrations and transfers to ensure that they have been designed for data integrity





Back Ups


• Implement back-up processes for data, metadata, system settings, configurations, and parameters for the purpose of disaster recovery.

• Validation the back-up processes• Periodically test the back-up processes

Validation


In addition to simply validating purchased softw are applications, validate for each intended use, e.g., • Workflow s• Process Steps• Settings / Configurations

o Drop down lists of critical values, security groups, audit trail settings, password expiration

• Calculations• User-created reports• Connection to specif ic equipment

Unacceptable Practice Elimination


• Recording data on a piece of paper, and then discarding

the paper af ter the data is transcribed into the sy stem• Storing electronic data in temporary memory, in a

manner that allows f or manipulation, bef ore creating a permanent record

• Placing records (e.g., chromatograms) in long-term

storage at the end of the day rather than upon completion of the run.

• Re-sampling, re-testing, or re-processing with the goal of achiev ing a specif ic result or to ov ercome an unacceptable result, i.e., testing into compliance

• NOTE: Written procedures should be established to ensure that for valid cases of re-sampling, re-testing, or re-processing, there is appropriate authorization and all test result retained.





Reports of Data Falsification


Investigate all reports of suspected or known data falsification or alteration of records under the CGMP quality system to:• Determine of the extent of the issue (e.g. limited to

one area or product, systemic)• Determine the effect of the falsification on patient

safety, product quality, or data reliability• Determine the root cause• Ensure that corrective action is taken• Monitor for new instances

Outsourced Activities


• For all outsourced critical activities (e.g., manufacturing, testing, order fulfillment) include confirmation of data integrity practices during:o Initial qualification of outsourced service providero Periodic re-qualification

• Include data integrity expectations within quality agreements

Outsourced Systems


• For Hosted and Cloud (e.g., SaaS) software providers, include confirmation of data integrity practices during:o Initial qualification of outsourced serviceso Periodic re-qualification

• Include data integrity expectations and responsibilities within SLAs and other contracts to ensure:o Data security: vendor staff, other clients,

cybersecurity o Ability to access current and archived data

(including audit trails and other metadata)o Data ownership and mobility





Training


Train Staff in:• Principles of data integrity• Detection of data integrity issues• Reporting suspected data integrity issues

FDA Enforcement Statistics

Part 3

Part 3: FDA Enforcement Statistics

Section Overview– 2010-2017 Total Enforcement Actions– 1992-2017 Total Warning Letters






FDA Enforcement Statistics


Source: FDA Enforcement Summary Fiscal Years 2010-2017

Actions 2010 2011 2012 2013 2014 2015 2016 2017

Injunctions 17 16 17 19 10 21 17 12

Seizures 10 15 8 6 4 1 4 3

Recalls Events 3,799 3,640 4,075 3,844 2,924 2,789 2,847 2,945

Recalled Products

9,361 9,288 9,469 8.044 8,061 9,178 8,305 9,199

Debarments 13 16 20 6 1 17 1 5

FDA Warning Letter Statistics


Source: FDA Enforcement Story 2001-2008; FDA Enforcement Summary 2009-2017

1712 17881594 1557

1038 1140 905 9001154 1032

755 582 725535 538 471 445 474

652 680 736 708470 603 558 443

1,040

4,146

6,052

8,220

16,629

14,032

14,875

0

2,000

4,000

6,000

8,000

10,000

12,000

14,000

16,000

18,000

All Warnings, except for Tobacco Products

Tobacco Products

Warning Letters, by year

FDA Warning Letter Statistics


210 217

114

168

8542

95 86

94

76151

161

20 17

84 4

6

335275

154

236 253

199

76

113

100

11965

35

0

100

200

300

400

500

600

700

800

2012 2013 2014 2015 2016 2017

Non-Tobacco

Warning Letters, by year

CVMCenter for Veterinary Medicine

CFSANCenter for Food Safety and Applied Nutrition

CBERCenter for Biologics Evaluation and Research

CDERCenter for Drug Evaluation and Research

CDRHCenter for Device and Radiological Health

Source: FDA Enforcement Summary 2012-2017





FDA Warning Letter Analysis

Part 4

Part 4: FDA Warning Letter Analysis


Section Overview– Data Source

• FDA Warning Letters related to Software and Computers• 3 Year Date Range: 2015 through 2017

– Summaries• By industry segment• By system type• By topic

• By validation topic

Warning Letter Example


Warning Letter Information

Issue Date Issuing District







Warning Letter Information

RegulatoryReference

Specific Observations



FDA Warning Letter Example

AuditFinding

Observations

Audit Standard

Software & Computer Warning Letters


3 Year Summary by Industry Segment

39.3%

29.8%

29.8%

0.5% 0.5% Medical Device GMP (21CFR 820)

Pharma GMP (21 CFR211)

Pharma API GMP (ICHQ7)

Drugs in Animals (21CFR 530)

Dietary SupplementsGMP (21 CFR 111)







3 Year Summary by System Type

“Other” system types include systems for Labeling, Annual Product Review, Service Records, Livestock

Tracking, Audit Management, Product Design Software, Equipment Tracking, Qualification Tracking, and Supplier Approval Tracking,

22%

58%

4%

4%

6%

Device/produc t Software

Laboratory Sy stems

Manufacturing Contr ol S oftware

Compla ints System s

Non-conform ance S ystems

CAPA Sys tems

Inventory Contro l Sy stems

Cal ibr ation Management

Building M anagem ent

CoA

Others (< 1% eac h)

1% each



3 Year Summary by Observation Topic

“Other” observation topics include Suitability for Use, Data Accuracy, Vendor Management, Quality Oversight, Risk Analysis, Change Control, Electronic Signatures, Back-Ups, Internal Audits

19%

21%

17%

13%

11%

4%

4%2% 9%

ValidationData RetentionSecurityAudit TrailsData IntegritySystem Documentat ionCAPASOPs & TrainingOthers (<2% each)

FDA Warning Letter Excerpts


DATA

RETENTION

Firm failed to conduct back-ups for the Server used to store, back-up, and/or archive raw test data from computer system controlling and monitoring HPLC systems. During the inspection the server was observed as being tagged out-of-service.

Personnel informed the investigators that the computer software was upgraded and the raw data was lost during the software upgrade.

Clinical Investigator failed to retain records for the time required stating that source documents were not available because the computer "crashed."

During our inspection, we requested that you display original electronic data for… drug samples. Your analyst was unable to retrieve requested data, and explained that he deletes older data to make space for newly acquired data.

21%

Inspection uncovered only 38 raw data files on the hard drive of the Atomic Absorption Spectrophotometer, while analysts stated that the AAS had been used for over 400 analyses.







Quality control analysts used a shared login account to access HPLC systems. This shared account allowed analysts, without traceability, to change the date/time settings of the computer, to modify file names, and to delete original data.

Our investigator observed that your quality control manager and deputy manager had full administrativ e rights on all of your computerized systems, which allows them to manipulate data and turn off audit trails.

System administrator priv ileges … include the ability to modify and delete

raw data files and to lock/unlock reprocessing in the chromatographic data system. Our investigators documented numerous instances where these privileges were reassigned without documentation or j ustification some of which resulted in extensiv e manipulation of data.

17%

Security

Information technology (IT) staff share usernames and passwords to access your electronic storage system. IT staff can delete or change directories and files without identifying individuals making changes



13%

There is no specific requirement regarding any rev iew of the

audit trails. Such an audit may well have detected the datemanipulation which was occurring at your facility.

Your system does not hav e an audit trail to document changes.

Rev iew of audit trails is not required.

Changes in study data could not be detected as there was no audit trail.

Audit trail functionality for some systems used to conduct CGMP operationswas enabled only the day before the inspection, and there were no quality unit procedures in place to rev iew and ev aluate the audit trail data.

Audit

Trails

Seven out of the firm’s HPLC systems used for API testing had the audit trail

feature disabled, although all had audit trail functionality



DATA

INTEGRITY

During the inspection, analyst remov ed a USB thumb driv e

from a computer controlling an HPLC and instead exited the room. After 15 minutes, management provided what they asserted was the USB thumb drive in question.

During the inspection, we reviewed an electronic HPLC log and determined that the audit trail was disabled.

For the related substances analysis there were 3 sample injections, all named“TEST,” which were run prior to the reported sample injections. The “TEST” data was stored in the “Trial” folder located on a PC) with no audit trail.

Audit trail for the residual solvent stability testing indicated that an analyst manipulated the computerized gas chromatography (GC) system to falsify results for multiple batches. For example, the analyst set the PC clock back

to make it appear as if testing had been done seven months earlier.

11%







DOCUMENT-ATION

User requirements are not required by either your firm or anyof your contracting organizations for any software custom scripts created that can be used as part of a software Hot Fix

(urgent software correction).

There are no documents that define the software's features and functions,

operating env ironment, or hardware requirements.

4%

Design changes hav e not been documented. For example, the change from using a serial port to using a USB port on the printed circuit board for connecting the measurement device to a computer has not been documented.

The validation reports do not have documentation of the software v ersion

used for the units under test.



CAPA

4%Product Change Controls which are corrective and preventive actions for handling software coding defects do not always include inv estigating the cause of all nonconformities relating to product, processes and the quality system, and identifying

action(s) needed to correct and prev ent recurrence of nonconforming product and other quality problems..

Your firm failed to follow your procedure (QMS17, Complaint Process) for documenting complaints with an associated data search of similar complaints, in that a software complaint was not associated with a data search of

similar complaints. Your firm’s hardware and software complaint customer interface department manager stated that for software and hardware

complaints, the department does not typically search for related complaints as required by the firm’s complaint handling procedure.



Procedures for entering critical comments were inadequate.

Computer System is incomplete because it fails to prov ide detailed

instructions to ensure correct specimen identification. A technician identified the specimen by scanning the barcode on the collection record instead of the barcode on the specimen. Consequently an incorrect blood group was entered into the database and the patient receiv ed incompatible red cells.

The adverse drug experience reporting system has not been fully validated because the application was released into production using an Interim Validation Report (IVR) that is still not final. Critical issues (deviations) identifiedin your interim validation report include the following: lack of training for your system support team, incomplete SOPs and Work Instructions.

CAPA procedures did not describe use of an electronic system.

2%

SOPs &

Training







3 Year Summary by Observation Topic – Validation Only

“Other” observation validation topics include Inadequate Requirements, Incomplete Design Documentation, Went Live with Known Critical Defects, Inadequate Test Evidence, and Failure to Approve Release Notes

46%

14%

16%

13%

4%7% System not validated

Changes not validated

Insufficient Test ing

Inadequate Validation SOPs

Inadequate Test Evidence

Other (<4% each)



You released software patches for various changes. You have no documentation of v alidation or j ustification or v erification for the seven patches.

Failure to validate your software used for fluid delivery and heat disinfection inyour water purification systems. For example, implementation of remote changes in operating parameters changed the output of the system. These type of changes require re-validation of the system. You failed to follow your own procedure for change controls when criticallimits were changed to suit a client’s needs.

You changed the software which controls the user interfaceprogram to a new version and were unable to provide any documentation to show v alidation or v erification procedures were conducted prior to installing the program intoall of your systems.

Change

Validation

14%



16% The performance qualification failed to include v erification

of the expiration date calculations in the system. Discrepancy reports have documented that product labeling with incorrect expiration dates have been created and issued for use.

Design verification and validation to introduce the XXXXX recorder was noteffective. Sixteen (16) dev ices were returned to your firm for hardware/software additional upgrades.

Your firm’s most current validation of the software is inadequate in that the validation that was conducted for version XXX consisted primarily of function testing (black-box testing) and lacks other elements of software validation including structure testing (white-box testing).

Insufficient

Testing

Firm uses software in in-process and final product testing. The software is used for measuring the top profile during manufacturing. The software v alidation did not address this capability.







13%

Inadequate Validation SOPs

Validation procedures do not include:a) requirements which ensure that protocols with acceptance

criteria are established prior to the performance of validation activities; and

b) requirements which ensure that the results of design

v alidation, including identification of the design, methods,and the measuring equipment used, are documented.

Validation procedures did not require adequate level of software testing and documentation.

Software Quality Assurance Procedure, states that validation should be conducted in light of the “level of concern”; however, the procedure does not provide a process for determining “lev el of concern” and establishing

v alidation plans that are appropriate to the identified lev el of concern.

FDA Warning Letter Trends

Part 5

Part 5: FDA Warning Letter Trends


Data Source» FDA Warning Letters » 3 Three-year Date Ranges:

• 2009 through 2011• 2012 through 2014• 2015 through 2017

Summaries» By industry segment» By system type» By topic

• By validation topic







9 Year Trend by Industry Segment (%)

59

2 1

16

18

411

63

1714

1 3

3930 30

10

10203040506070

2009-2011 2012-2014 2015-2017

# Observations:140202191



9 Year Trend by System Type (%)

12

36

3 6 4 311 9

312

31 30

105 4 2 2 1 4

11

58

22

4 4 1 1

11

010203040506070

2009-2011 2012-2014 2015-2017




9 Year Trend by Topic (%)

40

6 6

0 1

13

3

11 12

1

7

33

12 116 5 6 4 6

26

9

19 2117

13 11

4 4 2 2 16

05

1015202530354045

2009-2011 2012-2014 2015-2017








9 Year Trend by Validation Topic (%)

43

15

4 7 9 73

12

45

11 9 84 7 4

11

46

14 1316

2 2 25

05

101520253035404550

2009-2011 2012-2014 2015-2017


Recent Warning Letters

Part 6

Part 6: Recent FDA Warning Letters


Section Overview– Examples of FDA Warning Letters





Recent FDA Warning Letter


Failure to v alidate device software.

Software was released with known "critical" lev el defects.

Verification and Validation test results/raw data were performed. Sections of the tests were not performed, unsigned, and/or missing.

Electronic sign-off copy of the Verification and Validation Report that sequences were entered as pass without supporting data to demonstrate the test was

performed. Raw test data was discarded.

Failure to establish Serv icing procedures. Specially, the service manual did not address issues related to software failures.

Regulatory Reference 21 CFR 820 (Device)

System Type Device Software

Topic(s) Validation, Procedures

FDA Organization San Francisco District



Regulatory Reference ICH Q7

System Type Laboratory System

Topic(s) Security, Audit Trails

FDA Organization CDER

HPLC computer software lacked activ e audit trail functions to record changes to analytical methods, including information on original methodology, the identity

of the person making the change, and the date of the change.

In addition, your laboratory systems did not hav e access controls to prev ent

deletion or alteration of raw data.

During the inspection, your analysts demonstrated that they were given inappropriate user permissions to delete HPLC data files.

The gas chromatograph (GC) computer software lacked password protection

allowing uncontrolled full access to all employees.



Failure to retain Electronic case report forms (eCRFs). Study coordinator used a sponsor-provided laptop. During the closeout visit, the sponsor’s monitor took the laptop computer. The actual eCRF data disks were nev er obtained from

the sponsor. The firm was responsible as the investigator to retain copies of the eCRFs for two years after the investigation was discontinued.

The study coordinator stated that she transcribed vital -sign data from the dialysis center’s Patient Treatment Records onto the study flowsheets, and then used

the flowsheets to enter the data into the eCRFs. However, a comparison of the Patient Treatment Records and the flowsheets suggests that for some visits, the

study coordinator recorded the post-dialysis v ital-sign data on the study flowsheets rather than the pre-dialysis v ital-sign data. This discrepancy raises

questions about the reliability of the data.

Regulatory Reference 21 CFR 312 (Clinical)

System Type Clinical Trial

Topic(s) Data Retention & Integrity

FDA Organization CDER







Failure to establish and maintain adequate procedures to ensure that all purchased or otherwise received product or services conform to specified

requirement. For example:

• Firm failed to complete purchasing control activities according to its purchasing control procedure "Selection and Approval of Service Supplier" for its software supplier responsible for software development for the XXXXXX medical device.

• Firm’s "Purchasing Control for Outside Services" procedure does not assure that software suppliers complete both function and structural software testing.

Regulatory Reference 21 CFR 820 (Medical Devices)

System Type Medical Device Software

Topic(s) Vendor Management

FDA Organization Florida Distric t

www.ValidationCenter.com


Need Help?


ValidationCenter.com Library of SOPs and CSV templates

Online and Classroom CSV

Training

Software QA and Validation Program

Implementation or Improv ementValidation Serv ices

Audit Readiness Assessments





Thank You!


Thanks for your interest in Software Quality Regulatory Trends

Any questions about what we have discussed today?Please, feel free to contact me:

Deb Bartel

+1 (847) [email protected]

validationcenter.com | praxislifesciences.com

Follow us!