A life-sciences company needed to expand its manufacturing operations, as it could no longer manage its data with a paper-based system. Within six months, it had to select, install, and validate a system that would be able to handle an increasing amount of data. The six-month deadline coincided with the validation of the new manufacturing facilities and the arrival of the FDA for an audit; the system had to be online by then.
The Company’s Business
The company’s manufacturing specialty is plasma-based products – antibodies purified from human plasma for therapeutic and preventative uses. It provides cGMP-manufacturing services offering start-to-finish manufacturing ranging from research and product development, through fermentation and purification, to final formulation, fill and finishing.
Accepting the Challenge
Novatek International took on the company’s challenge as the vendor and solutions provider for this project. It was able to take on this task because of its broad range of compliant software solutions, including the Environmental Monitoring Software System (EM System) designed for pharmaceuticals, biotechs, chemicals, biologicals, contract labs, and medical industries. Also helpful was the extensive company experience in 21 CFR Part 11 compliant solutions for the entire product lifecycle of healthcare quality operations, media, and technical writing.
Software
The Environmental Monitoring Program is a CFR 21 Part 11 compliant system. The design of the features in the software is based on PDA technical report 13 and ISO 14644, and 21 CFR Part 11.The software consists of two main sections, one for the environmental monitoring of a facility, and theother for the utility (WFI, clean steam, compressed air, etc.) systems used during manufacturing.
Data from viable and non-viable monitoring, water analysis, clean steam, and compressed gases are securely captured and easily trended to ensure site “state of control.” The investigation window allows the user to investigate Out of Specification (“OOS”) values, with the capability to add any files such as pictures, audio video, and scanned documents, etc. to the report.
Timeline
The timeline (Figure 1) illustrates the major milestones throughout the course of the project. The article discusses the implementation process in chronological order based on this timeline.
April 14, 2003 Novatek arrived on-site at the company’s facility for a technical demonstration of the Environmental Monitoring System. In attendance from the vendor side was a sales representative and one of the engineers. The client brought in their QA director, IT manager, validation specialist, manager of microbiology, and two system users.
The full day meeting with the people in attendance facilitated the exchange of all essential information. This included the system’s features and their ability to meet with the company’s needs, the quality of the accompanying validation scripts, and the system’s ability to meet with compliancy regulations.
At this meeting, the vendor provided the URS document for the Environmental Monitoring System. The goal of writing a good user requirement is for system users, QA, and IT personnel to describe in detail the requisite functionality and to define it in terms that are understood by all. The client was having difficulty defining the requirements that would meet their needs; there was a need at this point for the vendor to step in and provide the requirements for the existing system. The client was then able to use the document as a base, expanding on the already present system with requirements specific to them. With these requirements the company was able to, over the course of the next two weeks, write their own requirements while at the same time conduct a gap analysis on the base software, and their own system requirements.
May 17, 2003 The vendor and client finalized negotiations of the licensing, validation costs, support, and training costs for a complete Environmental Monitoring implementation and the service agreement detailing the responsibilities of both parties was signed. The service agreement is the legal document that covers all aspects of the services to be rendered, including but not limited to email/telephone support, on-site support when needed, escalation policies, help desk availability, and payment schedule based on project milestones. The process of drafting and approving this document was two weeks in length with several revisions sent to both parties for approval.
June 2, 2003 The client sent a conditional purchase order to the vendor. Since the costs of on-site audits for vendors are high, most companies have a policy of allowing for audits only after a commitment to purchase has been made. The purchase order is then considered final upon the completion of and response to an on-site quality audit at the vendor engineering offices.
June 16, 2003 The client was offered the opportunity to either purchase an existing audit from a third party auditor that specializes in 21 CFR Part 11 software systems and the companies who develop them, or conduct their own audit at a time convenient to both the client and vendor. The client chose to conduct the audit themselves and the date selected was June 16, 2003, since the client was on a six-month deadline and saw no reason to delay moving ahead with this phase of the implementation.
The vendor audit consisted of an amalgamation of company procedures and product quality. Principles of good programming, practices, and the necessary supporting documentation were covered in detail while assessing how the EM System would stand up to an FDA inspection. The goal of the assessment was to acquire sufficient information to take an overall view on the appropriateness of vendor and system.
The comprehensive audit examined the software development and business practices of the vendor. The audit was on-site, and included the company overview, which primarily focused on the company and system’s ability to meet with the standards detailed in the “General Principles of Software Validation; Final Guidance for Industry and FDA Staff.”
Topics addressed in this document included:
• Quality planning and management: SOPs are in place and applied, testing meets with specified guidelines.
• Software development: life cycle model, user requirements, design documents, code reviews, coding conventions, code validations.
• Maintenance and support: version control, regularly scheduled updates accompanied by required revalidation documents.
The audit closure meeting was positive, with only a few minor observations. It was determined that the vendor would have 30 days to respond to the observations. In the interim, the project continued, and the initial pilot installation was scheduled for a date convenient to both parties.
June 30, 2003 Prior to arrival, the vendor sent the client an Installation Requirement Document (IRD) and a Minimum Requirement Document (MRD), which they completed, approved, and returned. These documents verified that the client had all the prerequisites in place to install the system. Some of the pre-requisites were to have the database server installed and to verify that all client computers met with the minimum hardware requirement to support the system once installed. The IRD and MRD are documents that are later added to the final validation document.
The vendor arrived onsite to perform the initial pilot installation with a team of three; consisting of two engineers and one trainer. The visit was three days in duration.
The technical activities were as follows:
• All client computers were installed and configured
• Database server was set-up with the database
• Database security was configured
• System users were configured
Once these were accomplished, focus was given to the users’ training.
It was imperative that training be an integral part of all phases of the project validation process, and included as part of the documentation. Users were trained in three phases: by demonstration; hands-on use of the system; and an evaluation of their abilities to properly use and understand all system functionalities. Users were recognized as trained on a provided document, which was ultimately included as part of the final validation document, and a training certificate was placed in their training files.
In addition to being trained on system features, IT was also trained in system set up, security configurations for database access, and user set-up in the EM system. Figure 2 illustrates the roles and tasks of personnel in the system. All personnel involved were appropriately trained based on their role in the implementation.
The initial pilot allowed users to familiarize themselves with the software and evaluate any requirements not apparent before a complete system use. This also provided the opportunity for system testing at the client’s site, required as part of the validation process specified in the “Guidelines for Software Validation” released by the FDA. User input and reaction to the system was documented via the control log communication process.
All companies are unique and this client was no exception. Users of the system were also trained on the use of the Control Logs, which are used to track changes to the software that were requested, documented, implemented, and approved.
Tracking changes to the software was accomplished with the control log file. This method provided clear communication between the vendor and the system users, and allowed for individual approval of each change request during the pilot phase. The updates of the changes were tracked by date and exe. version number, and input into the last column of the table that make up the control log.
July 21, August 11, & September 15, 2003
Between the initial installation and the update milestones, the vendor added some of the changes to the system that were requested via the control log. These update features were sent to the client’s IT personnel for application to both the database server and client computers. The IT personnel were able to apply the updates due to their system training during the initial installation, and by using our included “ReadMe” file, which contains detailed instructions on applying the new files and executing the requisite scripts.
August 11, 2003 was the closure date for any additional change requests. This deadline was necessary to provide Novatek with enough time to finish the development of new features and run them through the rigorous software quality testing. This also allowed the vendor to sign off on the updated documents that include the user specification, design specification, and the validation test scripts.
September 15, 2003 was the deadline date for all new system additions. The final updates to the system were sent to the client for installation and final approval.
At each stage of update, more system training was conducted with the users. These training sessions were conducted using a combination of Webex and Net Meeting software, allowing for comprehensive illustrations of the new features. Each new feature introduced into the system was added to the training sessions, to eliminate confusion as to the requested functionality and the feature implemented to address it.
October 13, 2003 The validation package greatly reduced the time, effort, and expense required to comply with Part 11 for the client. Starting with a well-developed package, the vendor added the system specific tests, documentation modifications, and situational controls thereby cutting compliance effort to approximately ten percent of the cost of assuring compliance for a custom developed system.
The vendor arrived at the client’s site to execute the validation plan. During the preceding three weeks, the client was using the pilot system to write the SOPs for system use, disaster recovery, back-up, etc. – all the SOPs that are required as part of the validation of a 21 CFR Part 11 compliant system. The duration of the visit was three days, with two vendor engineers executing the validation test scripts that includes verification that all required SOPs have been written.
November 1, 2003 Once the vendor had completed the on-site validation, the client, with further assistance, conducted a full risk assessment on the EM system using the FEMA model (Failure Mode and Effect Analysis), adapted for CS-Validation. This is comprised of:
• Step 1: Identify all functionalities of the CS (use URS, FS and DS for Reference)
• Step 2: Assess the GMP-Relevance of every functionality
• Step 3: Identify possible malfunctions by reversing the effect of every intended funtionality
• Step 4: Assess the probability of appearance (low = 1, medium = 2, high = 3), the importance (low = 1, medium = 2, high = 3, extreme = 4) and the probability of detection (high = 1, medium = 2, low = 3) of the fault
• Step 5: Calculate Risk Priority Value (A x I x D)
• Step 6: For RP-Values of 7 or higher define protective measures (Module Testing, IQ Tests, OQ Tests, PQ Test, Maintenance)
• Step 7: Re-assess risk, taking successful protective measures into account. This time, the RP-Values should be below 7.
December 1, 2003 With all deviations and deficiencies closed, the client was ready to go live on schedule.
Success
The success of the EM implementation was viewed in the following two ways:
• In the short term: How it addressed the issues, which justified acquiring the EM System.
• In the long term: How the future development of the laboratory was enhanced by increased use and reliance on the EM System.
The goal of the EM implementation was to improve the efficiency of the laboratory in full compliance with 21 CFR Part 11 requirements. Thus, the success of an EM implementation hinged on a cross-functional team that was well represented. The most successful EM implementations have been those that had a high degree of acceptance of the system by all departments (especially laboratory staff). The only way to achieve this is to have the laboratory drive the implementation process with the support of management, validation and compliance representatives, QA, and IT.
Future
Both parties consider the implementation a success. The client was pleased to be able to start in its new facility with the hybrid (combination of paper and electronic). It will go completely electronic within the next twelve to eighteen months, while the vendor has made allowances for the system to be prepared when the FDA approves the use of E-sigs for the client.
