Understand what computer system validation is, which systems you need to validate, and how to apply this process in your company.

In highly regulated industries such as pharmaceuticals, food, or cosmetics, it’s only reasonable that their computerized systems are also subject to regulation. This validation process for the software used within a company is extremely important, but not everyone knows how to carry it out.

That’s why, in this article, we’ll cover what this validation process is, which systems you need to validate, and how to apply this process in your company.

What Is Computer System Validation?

Used primarily in the pharmaceutical industry, computer system validation is a process used to formally test, verify, and document that a computer system performs exactly as it was implemented to do.

Beyond that, computerized system validation also checks whether the program operates in an accurate, consistent, and reproducible manner, ensuring safety, reliability, and traceability.

The most commonly used guidelines for system validation are found in GAMP (Good Automated Manufacturing Practice) and in the FDA’s 21 CFR (Code of Federal Regulations) Part 11 (Food and Drug Administration).

In Brazil, ANVISA (the National Health Surveillance Agency) provides the Computerized Systems Validation Guide, which is based on both the GAMP standard and the FDA’s 21 CFR standard.

FDA 21 CFR Part 11

FDA Part 11 requires that electronic documentation be accurate, reliable, easily retrievable, and secure, so that it can replace paper documentation.

Some of the required controls include:

• Data must be stored in electronic format and be archivable. Electronic records must be as reliable as paper records;
• The system must ensure that electronic signatures are as reliable and secure as handwritten signatures;
• Complex passwords must be required;
• Screen lock must be triggered after a period of inactivity;
• Only authorized personnel may use the system;
• The system must have different access levels based on their importance;
• The system must be able to generate an audit trail.

In other words, the system must be able to perform all of these actions to be eligible for validation.

GAMP

Good Automated Manufacturing Practice (GAMP) is a set of guidelines and procedures that pharmaceutical companies and users of automated systems use to validate their systems and ensure compliance with regulations such as FDA 21 CFR Part 11.

Put simply, the controls listed in FDA 21 CFR Part 11 are what the computerized system must do, and GAMP is the methodology used to achieve those controls.

The GAMP framework covers all phases of the manufacturing process, taking a risk-based approach to computerized system validation.

Which Systems Should You Validate?

Not all computerized systems go through validation; the systems that need to be validated are known as GxP-relevant systems, which is basically shorthand for systems relevant to Good Laboratory, Manufacturing, or Distribution Practices, among others.

In other words, all systems that can impact aspects such as patient health, product quality, and data integrity must be validated.

Before validation, however, it’s necessary to map out all the systems that need to go through this process, taking into account what the system manages, whether it has a direct relationship with product manufacturing, and whether the data it stores has implications for product traceability.

Published by ANVISA in 2020, the Computerized Systems Validation Guide presents a list of the types of systems that must be validated.

If the answer to any of the questions below is “Yes,” the system has a GxP impact and must therefore be validated.

Does the system store data that affects product traceability?

Does the system manage:

• The automated operation of critical production equipment or individual laboratory instruments (e.g., compressors, fluid bed dryers, HPLC, dissolution testers, etc.)?
• The automated operation of critical utility generation (e.g., purified water, air conditioning, clean air, water for injection, etc.)
• Registration of presentations, dosages, raw materials, packaging, potencies, batch sizes, production stages, master formulas, etc.?
• Production planning (e.g., production orders, batch numbers, raw materials, packaging, etc.)?
• The materials purchasing process (e.g., supplier qualification, control of orders from pre-qualified suppliers, quantities, potencies, specifications, etc.)?
• Receipt of materials (e.g., batch numbers, sampling plan, physical condition, damage records, etc.)?
• Storage of materials (e.g., status, location, movements and transfers, recalls, etc.)?
• The weighing center (e.g., weighing orders, potencies, fractioning, containers, scales, labels and seals, weighing results, operators, product batches, material batches, etc.)?
• Production control (e.g., manufacturing orders, in-process controls, records, operators, materials, batch numbers, equipment used, usage and operation sequences, alarms, samples, etc.)?
• Customer service (e.g., complaints, actions, adverse events, etc.)?
• Documentation (e.g., issuance, distribution, revision, obsolete version control, training, etc.)?
• Quality systems (e.g., out-of-specification results, self-inspection, deviations, change control, records of raw material, packaging, or product test results, periodic review, etc.)?
• Training program (e.g., scope, instructors, attendance lists, certificates, etc.)?
• Equipment (e.g., maintenance plan and execution, calibration plan and execution, qualification plan and execution, etc.)?

How to Validate a System

After mapping out the systems that require validation, it’s necessary to assess whether all of them are relevant.

If any system fails to meet all the criteria required to go through the validation process, procedures must be developed to cover the system’s shortcomings, a step known as the mitigation process, and if that isn’t possible, a system change should be considered.

Validating a system generally requires a multidisciplinary team, responsible for preparing and reviewing documents and for preparing and executing tests.

According to ANVISA, the required documents make up what is called the “document lifecycle,” consisting of documents that record the following topics: definition of a system’s specifications for procurement, system acquisition, installation, release, routine use, and decommissioning.

Beyond that, there is also the system lifecycle, made up of:

• Concept: used to revisit, improve, and automate processes based on user needs, as well as to define initial requirements and decide whether or not to proceed with the project;
• Project: covers planning, evaluation, and selection of suppliers, as well as specifications, configurations, and tests in order to authorize the start of operation;
• Operation: the longest phase, in which managing and maintaining the validated state is essential;
• Decommissioning: the final phase, covering decisions on which data will be retained, migration and destruction processes, among others.

After the risk analysis, the risks identified for each system must be tested through installation qualification, operational qualification, and performance qualification.

Once these tests are approved, the system must be installed in a production environment, and the installation qualification must be tested again.

Once the system goes into production, it must be monitored for a predetermined period to ensure it is functioning correctly.