Conceptos Básicos y Marco Regional para la Validación de

Transcripción

Conceptos Básicos y Marco Regional para la Validación de Software
1
2
1
World’s changes
The Pharmaceutical Industry has adapted its business model
in response to growing industry constraints and the decline of
the primary-care focused blockbuster therapy.
Principal Key Success Factors of success in this “scenario”
are:
 Maintaining Quality
 Optimising Process
 Cost Management
 Reducing Time to Market
 Optimising Supply Chain
Latino America Consultores, with its experience, is one of
the most Qualified Partners in South America to achieve that
goal, according to cGMP requirements, with a special focus
on Pharmaceutical Business Evolution.
3
International Support
 Support in R&D
 Technology Transfer
 Business Process Re-engineering
 Feasibility Studies
Momentum Life Science™
 Regulatory Affairs
 Qualification, Validation & Management
 Engineering, Design & Construction Support
 Business Development & Alliance
 Quality in Outsourcing & Auditing
 IT in Compliance
 Training
4
2
Product Knowledge
Engineering

Project: URS, Feasibility, Preliminary Budgeting, Conceptual Design, Basic Design,
Detailed Design, Design Qualification

Verification: Equipment & Plant Qualification Support, Utilities Qualification Support,
Analytical Methods & Equipment Qualification, Information & Data Management System
Validation
Product & Process Support
 Supports for Formulation, Pilot Phases, Scale Up and Industrialization
 Process Qualification
 Technology Transfer Support
Regulatory Affairs & Compliance
 International Regulatory Support
 Supports in Preparation Dossiers
 Supports in Preparation of Technical File for Medical Devices
 Preparation and Implementation of Variation Procedures
Compliance, Innovation & Data Management
ERP, LIMS, DCS, SCADA, WMS, EDMS have to be in Compliance.






Feasibility Study & Software & Supplier Selection
Solution Providing & System Integration Support
Computer System Validation (GAMP 5.0), 21 CFR 11 Compliance
GxP Risk Assessment & Remediation Plan Management
Support for IT Infrastructure Management & Enhancement, Networks Qualification
Legacy System Assessment & Full Plant Remediation Support
5
Computer System Validation
Basic Principles,
International References
6
3
Validación: DEFINICIÓN
1.
“Validación es la recopilación y documentación de evidencias
suficientes para dar certeza razonable, dado el estado de la
ciencia, que el proceso en consideración opera, y / u operará,
según lo esperado” (B. Loftus, Process Validation - The
Regulatory View, Proceedings of the Proprietary Association,
1979 Manufacturing Controls Seminary)
2.
“Validación es establecer evidencia documentada la cual
proporciona un alto grado de certeza que un proceso
especifico producirá consistentemente un producto que
cumpla las especificaciones y características de calidad
predeterminadas” (FDA Guideline on General Principles of
Validation, 1987)
3.
La validación es una estrategia definida de prácticas y
procedimientos inter-relacionados que en combinación con
métodos de producción de rutina y técnicas de control de
calidad ofrece garantía documentada de que un sistema está
funcionando como se pretende de manera repetitiva y / o que
un producto cumple con las especificaciones
predeterminadas. (PDA TM#1 revised, Draft 13, Glossary)
7
…. Why Validation?
The GAP between manufacturer's “good intention”
and low number of examined products could be
supported and justified by validation
Could be Applied to preliminarily examination &
scheduling of process details & to test and demonstrate
that process is working properly
Validation ”says”…… “it’s working constantly under
specification”
Efficacy of a well performed validation is underlined by
the automatic reduction of production defects, waste …
Plant Projects errors or re-work reduction
Whatever the Process could be validation ask the
same: “demonstrate… & document objectively the
proper functioning”
8
4
The Starting Point
Principle
The introduction of computerised systems into systems
of manufacturing, including storage, distribution and
quality control does not alter the need to observe the
relevant principles given elsewhere in the Guide.
Where a computerised system replaces a manual
operation, there should be no resultant decrease in
product quality or quality assurance.
Consideration should be given to the risk of losing
aspects of the previous system which could result from
reducing the involvement of operators.
Annex 11 EU GMP
9
Computerised Systems – Regulatory Req.


Functional Correctness (During
Usage)
Data Correctness (enforced after
21 CFR Part 11)





Accuracy
Validity
Availability
Confidentiality
Risk Management (enforced after
FDA guidelines of 2004)
10
5
The Scenario
The Regulatory Reference (regulatory
scenario) for Pharmaceutical will see
different “actors” :
 Regulatory Agency (INAME, ANVISA, INVIMA,
FDA, EMA, PIC/S, ICH …)
 Standard Agency/Association (ISO, BSI, …)
 Industrial Associations (ISPE, PDA, GAMP, …)
11
The Scenario - Documents
… are classifiable in:
 Rules, emitted by Health Authority (Code of
Federal Regulations, EU Directives, …)
 Guide Lines for Inspections (FDA, PIC/S, ICH,
…)
 Guide line for Developments and Construction,
Validation & Compliance of Plant, Equipments
& Systems (ISPE, PDA, …)
 Technical Rules & Standards (ISO 17799 / BSI
7799, …)
12
6
… Not only 21 CFR Part 11
13
USA and OUT of USA
 Compliance and 21 CFR Part 11 is a Legal
requisite to sell in USA

USA market represent value 50-60% of World’s
Market
 PIC/S Guidance PI 011

“Good practices for computerised systems in
regulated “GxP” environment”
 European Union EMA


Annex 11 (old version)
New Annex 11 (2011)
14
7
REGIONAL REGULATIONS
CSV Local Regulations




Argentina Regulations
Brasil Regulations
Colombia Regulations
Mexico Regulations
15
ARGENTINA REGULATIONS
MINISTERIO DE SALUD
Administración Nacional de
Medicamentos, Alimentos y
Tecnología Médica
Disposición ANMAT Nº 2819/2004 (con
las modificaciones de la Disp. ANMAT Nº
4844/2005) – OMS informe 32 (1995)
Buenas Prácticas de Fabricación para
Elaboradores, Importadores /
Exportadores de Medicamentos.
4. CALIFICACIÓN Y VALIDACIÓN
4.11 Es de importancia crítica prestar
particular atención a la validación de
métodos analíticos de ensayo, sistemas
automatizados y procedimientos de
limpieza.
16
8
COLOMBIA REGULATIONS
21. PROCESAMIENTO ELECTRÓNICO DE DATOS (INFORMÁTICA)
21.1 ¿Existe un sistema de procesamiento y registro electrónico de
datos? Informativo
21.2 ¿Existen personas capacitadas responsables y autorizadas para
el acceso al sistema (entrada de datos, consultas y modificaciones)?
Crítico
21.3 ¿Hay un procedimiento validado que indique las medidas a tomar
en caso de una falla del sistema? Crítico
21.4 ¿Existe un procedimiento de seguridad que únicamente permita
el acceso de personal autorizado al sistema? Crítico
21.5 ¿Se editan los datos y archivan en el historial del lote?
Informativo
21.6 ¿Son de fácil acceso y disponibilidad por parte del personal
autorizado los datos correspondientes al registro de producción de
cada lote? Crítico
21.7 ¿Se tiene grabación de reserva de los registros de la información
archivados electrónicamente? Crítico
21.8 ¿Está convenientemente almacenada esta información? Crítico
21.9 ¿Existe un procedimiento escrito para los casos de emergencia?
17
BRASIL REGULATIONS
Current Regulation
Agência Nacional de Vigilância Sanitária
Resolução - RDC nº 17, de
16 de abril de 2010
ANVISA
Reference
 WHO Technical Reports 908 –
WHA Report 37 – 2003
Sistemas Computarizados
 Titulo VII SISTEMAS DE

INFORMAÇÃO
COMPUTADORIZADOS
GUIA DE VALIDAÇÃO DE
SISTEMAS
COMPUTADORIZADOS
18
9
Mexican REGULATIONS
NOM-059-SSA1-2006
14.6.1 Deben validarse los sistemas y
aplicaciones computacionales relacionados
con:
14.6.1.1 Transferencias de insumos y
producto.
14.6.4 Registros y firmas electrónicas
 Audit Trail
 Firmas Electrónicas
 Registros Electrónicos
14.6.1.2 Disposición de insumos y producto.
14.6.1.3 Control de procesos y análisis.
14.6.1.4 Control de sistemas críticos.
19
FDA - 21 CFR part 11
EMA - GMP - Annex 11
PIC/S
20
10
21 CRF Part 11
Electronic Record &
Electronic Signature
Management
Part 11--ELECTRONIC RECORDS;
ELECTRONIC SIGNATURES
 Rules were written for a “paper world”
 Rules asks hand-written signatures
 Technology has been made “Obsolete”
Subpart A--General Provisions
11.1 Scope.
11.2 Implementation.
11.3 Definitions.
rules for many aspects
Subpart B--Electronic Records
 Computerized Systems could provide
11.10 Controls for closed systems.
11.30 Controls for open systems.
11.50 Signature manifestations.
11.70 Signature/record binding.

Subpart C--Electronic Signature
11.100 General requirements.
11.200 Identification mechanisms and controls.
11.300 Controls for identification
codes/passwords.
big advantage to Pharmaceutical &
regulated Industries
… Industry asks itself to verify with
regulatory agency the permission to
utilize Electronic Signatures
21
21 CRF Part 11 – ER Key Points













Validation
Accurate and complete copies
Protection of records
Limiting system access
Secure audit trails
Operational system checks
Authority checks
Validity of source
Training and experience
Policies and procedures defining responsibilities
Control over system documentation
Signature manifestation
Signature/record linking
22
11
Subpart B: Validation & Protection


Validation: Discerning invalid/altered records involves:

Ability to identify when changes were made

Who made the changes

Whether these changes were authorized
Protection:

Protection of records to ensure:

Accurate and Ready Retrieval

Throughout the records retention period

Ensure security of records by maintaining
adequate backups and backup procedures

Companies should specify their retention periods
23
Subpart B: System Access





To protect against unauthorized input,
deletion or modification of data
including user IDs
Right of entry on a “Need to do Basis”
Keys, ID cards, codes, terminal
access
Authorized and documented
Key Issues


Staff Changes, damage/loss, unavailable
codes, distribution lists
Records of attempted unauthorized
access
24
12
Subpart B: Audit Trails
 Created by the system independently of
operators
 Must record date and time of entries and
actions that create, modify or delete
electronic records
 Record changes must not obscure previous
data
25
Subpart C: E-Sigs












Unique signatures
Verified identity before allocation
Certification by user firm
Two distinct components - unless biometric
Use of components during sessions
Used by genuine owner
Administered to prevent fraud
Uniqueness of each combined ID and
password
Periodic checking, recall or revision
Loss management
Transaction safeguards
Testing of devices
26
13
Annex 11 Computerised Systems
Principle
The introduction of computerised systems into
systems of manufacturing, including storage,
distribution and quality control does not alter the
need to observe the relevant principles given
elsewhere in the Guide.
Where a computerised system replaces
a manual operation, there should be no
resultant decrease in product quality or
quality assurance.
Consideration should be given to the risk of
losing aspects of the previous system which
could result from reducing the involvement of
operators.
27
New Annex 11





Maintain old principle with the
introduction of Risk Based
Approach
Define the validation of the
application and qualification of IT
infrastructure
Requirements organized as life
cycle
More specific requirements
Basic requirements electronic
signatures
28
14
PI 011 – Key Elements












Implementation of computerised systems
The structure and functions of the computer system(s)
Planning and life-cycle management
Management and responsibilities
User requirement specifications (URS)
Functional specifications (FS)
Suppliers, software developers and quality
management
Important QMS and software standards attributes
Testing
Validation strategies and priorities
GAMP validation approach based on different
categories of software products
Retrospective validation
29
GAMP® 5
Introduction
30
15
One of the Answer: GAMP Guides
GAMP Good Practice Guides
GAMP® 5

Validation of Laboratory
Computerized Systems

Risk-Based Approach to
Electronic Records &
Signatures


Calibration Management

Validation of Legacy
Systems

IT Infrastructure Control and
Compliance

Global Information Systems
Control and Compliance


Testing of GxP Systems
Validation of Process
Control Systems
Electronic Data Archiving
31
GAMP® 5 – Scope & Application

Process Control:

DCS, SCADA, MES (Manufacturing Execution
HVAC, Dispensing
Systems),

Application:


Laboratory


ERP, DSS (Decision Support System),
Regulatory eCTD, Document
Management System
LIMS, CDAS, Software for Instrument
Infrastructure:

Network, Basic Software, Domain,
Notification System, Virtualisation
32
16
GAMP® 5 – ACCEPTANCE
 Acceptance of GAMP Guidance by
regulators worldwide
 Widespread incorporation of
concepts and methods into policies
and procedures of manufacturing
companies worldwide
 Many suppliers have adopted GAMP
as the cornerstone of their quality
systems
 Covers “good practice” not just a
compliance guide
33
GAMP® 5 – ALLIGNMENT
ICH Q9 Quality Risk Management







Good alignment with current GAMP risk
approach and strategic direction
Q9 adopted as overall framework for risk
management approach in GAMP 5
Impact of Q8 and forthcoming Q10
ISPE Product Quality Lifecycle Implementation
(PQLI) Initiative
Practical Implementation of ICH Guidance and
Quality by Design
ASTM Standards
e.g. ASTM E2500
Standard Guide for
Specification, Design, and Verification of
Pharmaceutical
and
Biopharmaceutical
Manufacturing Systems and Equipment
34
17
GAMP® 5 – EVOLUTION
From System Risk Based Approach
to Process Risk Based Approach



A computerized system is considered as a
component of a wider system &/or process,
especially in an Integrated “Quality by Design”
Environment
A Computer System Validation Separated by
Process Validation could be not anymore
necessary (& sometimes inconsistent)
GAMP5 encourage
Approach
adopting
an
Integrated
35
GAMP® 5 – KEY CONCEPT
1. Product & Process Knowledge
2. Integrated Life Cycle Approach in a
QMS Environment
3. Flexible & Scalable Life Cycle
Activities
4. Quality Risk Management
5. Maximize Supplier Involvement &
participation
36
18
GAMP® 5 – SOFTWARE CATHEGORIES
37
GAMP® 5 – MANAGEMENT APPENDICES

M1 Validation Planning

M2 Supplier Assessment

M3 Science Based Quality Risk
Management

M4 Categories of Software and Hardware

M5 Design Review and Traceability

M6 Supplier Quality and Project Planning

M7 Validation Reporting

M8 Project Change and Configuration
Management

M9 Document Management

M10 System Retirement (*)
38
19
GAMP® 5 – DEVELOPMENT APPENDICES

D1 User Requirements
Specifications

D2 Functional Specifications

D3 Configuration and Design

D4 Management, Development,
and Review of Software

D5 Testing of Computerized
Systems

D6 System Descriptions (*)

D7 Data Migration (*)
39
GAMP® 5 – USING GAMP®5
40
20
GAMP® 5 – BASIC APPROACH
41
GAMP® 5 – LIFE CYCLE PHASES
42
21
GAMP® 5 – NON CONFIGURED SYSTEMS
43
GAMP® 5 – CONFIGURABLE SYSTEMS
44
22
GAMP® 5 – CUSTOM SYSTEMS
45
Use of
Risk Assessment
46
23
Full Assessment – Metodology
Activity
1
2
3
Prj.Planning
&
Inventory
GMP
&
Risk Assessment
Assessment
21 CFR Part 11
Systems
List
Risk
Assessment
Report
4
System
Assessment
Report
5
Gap
Analysis
Planning
Gap
Analysis
Report
Action
Plan
DELIVERABLES
Remediation
Plan
47
Using Risk Based Approach
METODOLOGÍA DEL ANÁLISIS DE
RIESGO
La metodología del Análisis se aplica de acuerdo
con los siguientes pasos:
1.
2.
3.
4.
5.
6.
7.
8.
Mapeo de Procesos (GxP)
Identificación de Funciones Criticas
Identificación del Escenario de riesgo
Evaluación de probabilidad
Evaluación de severidad del impacto
Asignación de clasificación al riesgo
Evaluación de la probabilidad de detección
Asignación de prioridad al riesgo
El riesgo está basado en la identificación de un
“Evento o Escenario de Riesgo”.
Para cada amenaza al sistema, se identifica un
posible evento de riesgo, relacionado con una
operación-no correcta y/o una potencial corrupción o
incumplimiento GxP de los datos que se manejan.
Los posibles eventos relacionados a un mal
funcionamiento del sistema se listan en el Risk
Assessment Report.
A cada riesgo se asocia una acción correctiva que
va a impactar en la validación del sistema.
48
24
Example of Suggested Activity
&
Deliverables Structures
49
DOC Hierarchy
RA - Risk
Assessment
SDS System
Design
Specifications
 RA Datasheet
 RA Report
(RAR – CA)
 Collected Lists &
Documents
VP
TM
Validation
PLAN
Traceability
Matrix
 RA Results
 Scope , Objectives
 Roles &
Responsibility
 Activities &
Deliverables
 Criteria
 Management
Issues
 Draft Scheduling
 RAR
 CA
 Type
 Description
 Owner
 Status
 Reporting/TO
DO
 PLAN
System Risk Based Assessment
& Remediation Planning/Controls
 System general architecture
 Equipment Technical
Datasheet
 System’s SOP
 Standard installation reports
 System Installed components
 System environment’s
 IT Working instruction & rules
FRS Functional
Requirements
Specifications
 Main Document
 User’s Process Flow, & Blue
Print
 Manuals
 Implementation Project
Documents
 Configuration Docs
 Customization Docs
 User’s SOP, Application
Manuals
System Description
IQ
Installation
Qualification
 SDS ref. & IQ
CODE
 Scope &
Description
 Test Conditions
 Expect. Results
 Collected Result
 Report
OQ
Operational
Qualification
 FRS ref . & IQ
CODE
 Scope &
Description
 Test Conditions
 Expect. Results
 Report
PQ
Performances
Qualification
 Process Item /
Process Flow Id.
 Process
Description
 Scope of Test &
Description
 Test Conditions
 Expect. Results
 Report
System Testing
50
25
Benefit of Compliance
Comply International Rules show Innovation,
Knowledge & affordability, and it’s a Powerful
Business Item





Design an Qualifying Process & Plant in
compliance with FDA or EMA requirements,
means that the Product, once ready to export, are
compatible with the most restrictive international
rules;
A structure prepared to manage qualified process
means reduction of Technology Transfer Time ,
both IN & OUT;
An Integrated QMS, supported by Qualified
Processes & Systems, reduce Inspection Risks
and Inspection Preparation Time;
Qualified Processes means reduction of
Registration Time
A Full Compliant Plant increase Group Trust and
Group Visibility
51
52
26
Muchas Gracias
por su Atención
Gilberto Rossi
Leandro Mbarak
[email protected]
[email protected]
www.latconsultores.com.ar
www.latconsultores.com.ar
53
27

Conceptos Básicos y Marco Regional para la Validación de

Transcripción

Documentos relacionados