A manufacturing division of a major pharmaceutical corporation owned and operated a number of Kaye Validator thermal validation systems. Historically, the facility’s Metrology department had outsourced the scheduled calibration of the Kaye Validators and their sensor input modules (SIMs) to the vendor, which limited their control over the time it took to return the units to service. In the interest of simplifying the logistics and minimizing the turnaround time for these calibrations, the Metrology unit purchased the vendor’s Kaye Validator AVS ICAL calibration software system to perform calibrations in-house.
It was determined by the manufacturer’s quality team that the software system, which automated the calibration process and reported its results in a certificate of calibration, was subject to the rules of 21 CFR Part 11 (i.e. Part 11) for electronic records, as well as 21 CFR 58.63 for the maintenance and calibration of equipment. As such, the corporation reached out to Performance Validation (PV) software validation support.
While the manufacturing division’s was governed under a robust verification and validation (V&V) system based on ASTM guidelines, it had relied on its business technology (BT) division the ownership and support of software validation of in the past. As a Metrology tool, the new ICAL software did not fall under the ownership of the BT services division. This presented a challenge for the stakeholders to produce a software validation package that would comply with Part 11, while also satisfying the requirements of the division’s V&V procedures.
The PV Computer System Validation (CSV) team was called in to lead the validation effort. The CSV team member worked with client stakeholders to determine a means of assimilating a GAMP software validation approach within the framework of the client’s V&V procedures. The CSV team member initiated and managed the V&V project within the client’s electronic change control system.
The process began with business risk and quality risk assessments. Initially, the vendor’s off-the-shelf software package seemed to present no unusual risks beyond possible failure of its intrinsic functionally. The software was provided by a qualified vendor and required no configuration for its intended use. However, per the client’s procedure, the software system was formally assessed to identify any possible gaps in data integrity requirements. The assessment determined that, although the resulting certificate of calibration report would be printed to hard-copy and controlled under formal engineering document management as the primary record, the electronic report file and intermediate data files used to generate the report file were not adequately controlled and protected by the vendor software, as delivered.
It was also recognized that the software was intended to run in a Windows 7 environment. This presented additional risk, as Windows 7 was no longer supported by the business technology division. Replacement of a Windows 7 system would be an obstacle for recovery of the ICAL installation in the event of hardware or operating system failure on the host computer.
In order to mitigate the identified risks, the team turned to their automation engineering resource to install the ICAL software in a Window 7 VMWare environment and create custom code to automate the backup of the electronic report file and intermediate data files to a secure network directory.
With the risk mitigation solutions identified, the PV CSV team member completed the risk assessment documents . Based on the findings of the assessment and the requirements for implementation of the ICAL software system identified therein, the PV CSV team member drafted a verification qualification strategy to prescribe acceptance criteria and related verification testing measures. A technical document for configuration and backup/recovery was developed and approved. Work instructions for system software use were created and activated in the Maintenance electronic management system.
A verification testing protocol was developed by the PV CSV team member in collaboration with the automation engineer and the Metrology end-user, and the verification testing was completed successfully.
The ICAL software system was qualified for implementation in the Metrology unit, enabling Operations to receive timely calibration services for their Kaye Validator systems in support of further thermal validation projects.
The PV CSV team member provided the experience and insight to integrate the GAMP approach to computer system validation within the client’s V&V process.
Throughout the project, several stakeholders (i.e., Metrology, Maintenance, Operations, Engineering Compliance, Validation Quality, Data Integrity, and Engineering were required to weigh in on the approach to mitigation of risks. Several risks and possible mitigation solutions were considered and agreements made under team consensus. Several obstacles in stakeholder and resource availability affected the project schedule. However, working with the engineering project manager, the PV team member was able to satisfy the affected timelines.
The PV CSV team member was committed to staying on top of this coordinated effort by scheduling regular team meetings and facilitating continuous electronic communication with stakeholders to identify and resolve issues in a timely manner.