Risk Management

• When you implement new software, your team will create a risk assessment of the computerised system. The risk assessment should account for patient safety, data integrity, and product quality. Risk management should be applied throughout the computerized system’s lifecycle,
• Ask your software vendor if they can help you create a risk assessment and update your Standard Operating Procedures. Although responsibility for risk management ultimately lies with sites and sponsors, many vendors  are happy to help with the process.
• Decisions regarding validation and data integrity controls should be based on a well-documented risk assessment.

Personnel

• There should be close cooperation between all relevant personnel such as Process Owner,System Owner, Qualified Persons and IT. All personnel should have appropriate qualifications, level of access and defined responsibilities to carry out their assigned tasks.

Suppliers and Service Providers

• Formal agreements between the manufacturer and third parties must be in place When third parties (e.g. suppliers, service providers) are used to provide, install, configure, integrate, validate, maintain (e.g. via remote access), modify or retain a computerized system or related service or for data processing, these agreements should include clear statements of the responsibilities of the third party. IT-departments should be considered analogous.
• This point help us to understand the importance of supplier competence, reliability, and documentation review in selecting products or services. A risk assessment should determine the need for audits. Users of commercial off-the-shelf products should ensure user requirements are met through documentation review. Quality system and audit information should be accessible to inspectors upon request for software and implemented systems.

Validation : EU Annex 11 emphasizes the need for manufacturers to validate their systems throughout their lifecycle, ensuring that they meet their intended use and consistently producing results that meet predetermined criteria. Computerized system validation includes the following requirements:

• Manufacturers should justify their standards, protocols, acceptance criteria, procedures, and records based on risk assessment, covering relevant steps of the life cycle
• Validation documentation should include change control records and reports on deviations observed during the process
• An up-to-date listing of relevant systems and their GMP functionality should be available, with detailed descriptions for critical systems
• User Requirements Specifications should be based on documented risk assessment and GMP impact, traceable throughout the life cycle
• The regulated user should ensure that the system is developed in accordance with an appropriate quality management system, and the supplier should be assessed appropriately
• For bespoke or customized systems, there should be a process for formal assessment and reporting of quality and performance measures throughout the life cycle
• Appropriate test methods and scenarios, including system parameter limits, data limits, and error handling, should be demonstrated, with documented assessments for testing tools and environments
• Validation should include checks to ensure data integrity during data transfer or migration to another format or system.

These principles aim to ensure the reliability, security, and compliance of computerized systems handling data in regulated environments.

• Data Integrity and Security: Emphasis is placed on built-in checks to ensure correct and secure entry and processing of electronically exchanged data to reduce risks.
• Accuracy Checks: Critical manually entered data should undergo additional verification to ensure accuracy, considering the potential consequences of inaccuracies.
• Data Storage: Measures should be taken to protect stored data against physical and electronic damage, and regular checks for accessibility, readability, and accuracy are necessary.
• Printouts: Systems should allow for clear printed copies of electronically stored data, indicating any changes made since the original entry.
• Audit Trails: Systems should generate audit trails recording GMP-relevant changes and deletions, with documentation of reasons for such actions.
• Change and Configuration Management: Changes to computerized systems must follow defined procedures to ensure proper management and documentation.
• Periodic Evaluation: Regular evaluations of computerized systems are necessary to maintain validity and compliance with regulations.
• Security: Access controls should restrict system access to authorized personnel only, with various methods like passwords and biometrics employed based on system criticality.
• Incident Management: All incidents, including system failures and data errors, need to be reported, assessed, and investigated, with appropriate corrective and preventive actions taken.
• Electronic Signature: Electronic signatures should be equivalent to handwritten signatures, with clear linkage to respective records and time/date information.
• Batch Release: Access for certifying and releasing batches should be limited to Qualified Persons, with electronic signatures used to record responsible individuals.
• Business Continuity: Procedures should ensure the continuity of critical processes during system breakdown, with documented and tested alternative arrangements.
• Archiving: Data archiving procedures should ensure accessibility, readability, and integrity, with provisions for retrieval after system changes and periodic testing of retrieval capabilities.