Computer System Validation- How Early in Product Development?

We are sometimes asked how early in development companies need to start worrying about computer system validation? While predicate rules do not directly answer this question, information can be obtained from current industry practices, FDA inspection observations and predicate rules which address data integrity issues. The following is a summary of the major GxPs and how organizations can align themselves with cGMPs:

GLP (laboratory) compliant labs would be expected to validate electronic systems used to generate, store and process data used in the areas of toxicology and biosafety. This information would be used to support later regulatory filings and registrations. For example, electronic archiving systems, systems for converting archived data or migrating data, systems for copying archived data should be validated and ALCOA Plus principles apply.

Computer system validation expectations for GCP (clinical) practices are not as clear, e.g, there is no definition of raw data. However, GCP studies should provide “data capable of meeting statutory standards for marketing approval” and require the investigator to keep “adequate and accurate case histories.” GCP-compliant labs should consider the uses to which the data will be used.

While there are no known regulations requiring the use of automated systems, when such systems are used for required activities, they fall within FDA’s software validation expectations.  For example, if the nature of your work requires you to keep records and you choose to do so using a computer system – you need to be able to demonstrate the integrity of the data created and stored in the system. Thus, ALCOA Plus principles apply, and that’s where software validation and Part 11 compliance come in.

For GDP (development), if it is “purely” at the research or discovery stage, than the controls discussed above [which are good business practices] are not required by FDA or other health agencies.

On the other hand, if the strategy is to keep good records and then use them later, say in the submission process – then the data will need to have come from a validated system.  This then comes down to deciding whether it is in the organization’s interest to validate and keep the system under positive change control, or re-generate the data under new studies.

Also, if the work is medical device-related, care should be taken regarding what data is developed under what systems that will contribute to the Device History File. Once you have the systems for GLP and GCP, this is not a large stretch for an organization and leverages those investments for GDP.

The Windshire Group offers computer validation consulting services and associated training. For further information, please contact info@windshire.com; (+1) 844.686.5750