Extensive Pharmacia Drug LIMS Validation WL

Company: Pharmacia Corp. Product name: Sterile drug products
Product category: Human drugs Date: 1/11/01

The xxxx operation uses both the _____ System and _____ network computer software programs for materials and data management functions. The _____ performs functions typical of a laboratory information management system. The quality control unit uses this program for disposition of materials, special studies, stability testing programs, and generation of summary test reports. Once material is dispositioned, _____ communicates information to the _____ network program used by warehouse and production personnel to control material in storage and production. Both the _____ and _____ network programs work in concert acting as the sole source of information which controls and maintains the status of raw materials and finished goods in the warehouse. Your operations use these programs in a similar manner to control in-process materials during manufacturing operations. These network program systems are deficient in that:

The system design documentation has not been maintained or updated throughout the life of the _____ software dating back to 1985 despite significant changes and modification that have taken place. These include program code, functional/structural design, diagrams, specifications, and text description of other programs that interface with _____

The program uses a purchased custom configurable materials management software package. The software validation documentation failed to adequately define, updated and control significant elements customized to configure the system for the specific needs of the operations. The following had not been maintained or updated from original release/design specification dating back to approximately 1985:

Your response for the _____ acknowledges that the system has not been maintained throughout its life and there are gaps in the documentation. You indicate rather than expending resources on reviewing validation documentation that in some cases is 15 years old, you are looking forward to a replacement of the _____ system with a new validated computer system in the near future. In the interim your validation effort was to review only the current system documentation with respect to the Investigator’s computer concerns. You evaluated the functionality and reliability of _____ by comparing the printout of 21 US batches against source documents and no errors were found. As a result you concluded that the _____ system functions correctly and reliably and has been validated. Your response fails to trace back to source code, and the related software development cycle which establish evidence that all software requirements have been implemented correctly and completely and are traceable to system requirements. Software is validated in its controlled development and in control of ongoing maintenance of the software and its documentation throughout its life cycle. You make no commitment to retrospectively put the historical documentation together.

Your response for _____ indicates upgrading _____ version _____ installed during 1997 to version _____ on or about December 2001 and inclusion of corrective actions in version _____ Also you will continue to use, and complete a retrospective evaluation of _____ on or about December 2000. The inspection reports that the documents reviewed did not define the system as being validated but was a qualification document for the _____ version upgrade. The records did not describe the custom configuration of the _____ system as it is in place. Your response did not evaluate requirements or trace changes to determine side effects. Further, your response failed to address the issue of what sites are approved for use the _____ application nor does it address defining what restrictions will be in place for each site with respect to defining what functions in MOVEX are approved for use at each site. In order to consider a computer system to be validated, all elements which make up the system must be clearly defined. Appropriate systems definition documentation, properly updated when necessary throughout the life cycle of the software, is part of the control and ongoing maintenance of a computer program. Your response fails to discuss extending the retrospective evaluation to other elements of the system needing to be defined and controlled as part of the overall configuration management.

It could be difficult to retrospectively validate a computer system if there were changes and revisions that were not documented and the cumulative affects of many revisions had not been assessed. Lack of sufficient system documentation would make it impossible to perform meaningful retrospective validation. FDA concludes that the _____ and _____ systems lack adequate validation and therefore are unacceptable for use in the production of the drug products. Please indicate whether you can perform a retrospective validation of the _____ and _____ systems or rely in the interim on manual operations, that use source documentation until the new validated computer systems are functional.

The xxxxx local computer systems lacked adequate validation and/or documentation controls. For example:
– The _____ computer control alarm system that monitors the air handling units temperature, humidity, and airflow/pressure, the _____ water system, and temperature of various freezers and refrigerators, lacked the following:
– Adequate handling of records generated with inaccurate time frames dating back sixteen years for mainframe computer clock and three years for the local workstation computer clock due to Y2K compliance related issues.
– Appropriate procedures to ensure that records are included with validation documentation, maintained, and updated when changes were made.

– Validation documentation failed to include complete and updated system design documentation, and complete wiring/network diagrams to identify all computers and devices connected to the _____ system.

– Change control documentation approving change in the software. In addition, there was no qualification _____ documentation for this change.

– The _____ equipment’s computer used for _____ filling operations which retains equipment errors that occur during filling operations, lacked the capacity to retain electronic data. After every 15th filling operation, the information was overwritten due to the storage capacity of the equipment’s hard drive.

– The QCU failed to ensure that adequate procedures were put into place to define and control computerized production operations, equipment qualifications. documentation review and laboratory operations.

Validation documentation failed to include complete and updated system design documentation, and complete wiring/network diagrams to identify all computers and devices connected to the _____ system.

Our review also included your company’s response letters to the FDA-483 observations dated July 20, 2000, August 17, 2000, September 4, 2000, October 1, 2000, November 17 and 28, 2000, and December 11, 2000. We acknowledge that many corrections have been made, or are in progress. Your response to observation 1 addressing the _____ and _____ computer validation and observation 4.a, addressing media filled units was inadequate as discussed above. Except for observations 1 and 4, the corrections when fully implemented appear to satisfactorily address the deficiencies listed on the FDA-483. The CGMP deviations identified above or on the FDA-483 issued to your firm are not to be considered an all-inclusive list of the deficiencies at your facility. FDA inspections are audits, which are not intended to determine all deviations from CGMPs that exist at a firm. If you wish to continue to ship your products to the United States, it is the responsibility of your firm to assure compliance with all U.S. standards for Current Good Manufacturing Practices.

FDA District: Rockville, MD
SoftwareCPR Keywords: Human Drugs; Laboratory information system

About the author

Amy enjoys researching and writing about developments in medical technology and how that intersects with US law. She received her J.D. from the University of Florida Levin College of Law in 2020 and now works as a Regulatory Associate for SoftwareCPR®, a general-purpose regulatory consulting firm that is recognized globally for their expertise with standards and national regulations pertaining to medical device, mobile medical app, and HealthIT software.

SoftwareCPR Training Courses:

IEC 62304 and other emerging standards for Medical Device and HealthIT Software

Our flagship course for preparing regulatory, quality, engineering, operations, and others for the activities and documentation expected for IEC 62304 conformance and for FDA expectations. The goal is to educate on the intent and purpose so that the participants are able to make informed decisions in the future.  Focus is not simply what the standard says, but what is meant and discuss examples and approaches one might implement to comply.  Special deep discount pricing available to FDA attendees and other regulators.

3-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Brian Pate

Next public offering:  TBD

Email training@softwarecpr.com to request a special pre-registration discount.  Limited number of pre-registration coupons.

Registration Link:

TBD

 


 

Being Agile & Yet Compliant (Public or Private)

Our SoftwareCPR unique approach to incorporating agile and lean engineering to your medical device software process training course is now open for scheduling!

  • Agile principles that align well with medical
  • Backlog management
  • Agile risk management
  • Incremental and iterative software development lifecycle management
  •  Frequent release management
  • And more!

2-days onsite (4 days virtual) with group exercises, quizzes, examples, Q&A.

Instructors: Mike Russell, Ron Baerg

Next public offering: March 7 & 28, 2024

Virtual via Zoom

Registration Link:

Register Now

 


 

Medical Device Cybersecurity (Public or Private)

This course takes a deep dive into the US FDA expectations for cybersecurity activities in the product development process with central focus on the cybersecurity risk analysis process. Overall approach will be tied to relevant standards and FDA guidance documentation. The course will follow the ISO 14971:2019 framework for overall structure but utilize IEC 62304, IEC 81001-5-1, and AAMI TIR57 for specific details regarding cybersecurity planning, risk characterization, threat modeling, and control strategies.

2-days onsite with group exercises, quizzes, examples, Q&A.

Instructor: Dr Peter Rech, 2nd instructor (optional)

Next public offering:  TBD

Corporate Office

15148 Springview St.
Tampa, FL 33624
USA
+1-781-721-2921
Partners located in the US (CA, FL, MA, MN, TX) and Canada.