Computer System
Validation (CSV)
By: Abdelrahman Ahmed
What is a computerized System :
GAMP 5: A computerized system includes
hardware, software, and network components.
Annex 11: Covers input, electronic processing,
and output of information for reporting/control.
FDA Vision of Software Validation:
Software validation confirms that software
specifications meet user needs and intended use.
It ensures consistent fulfillment of requirements.
System Lifecycle Phases
Concept Project
Retirement Operation
Concept Phase:
Identify Evaluate Decide
Identify need Evaluate Decide to build,
for benefits, scope, buy, or modify a
computerized and cost. system.
solution.
Project Phase:
Plan, specify, Assess supplier
configure, and and document
verify. quality.
Determine GxP
applicability
and regulations.
User Requirements Specification
(URS)
Defines what the Based on user Should be clear,
system should do. needs and complete, and
business processes. verifiable.
Types of Requirements
Operational
Data Management
Technical
Interface
Regulatory (Audit trail, e-signature, etc.)
Design & Specifications
Define logical
Ensure system
arrangements, data
designed to meet
flows, interfaces, and
intended use.
security.
Qualification Stages
DQ: Design Qualification
IQ: Installation Qualification
OQ: Operational Qualification
PQ: Performance Qualification
Testing & Verification
Confirms specifications Includes functional,
met and defects integration, and
corrected. acceptance tests.
Validation Report & Traceability
Matrix
Summarizes Provides
Links URS to
validation statement of
tests and
activities and fitness for
outcomes.
deviations. intended use.
Operation Phase:
Handover to operational users.
Establish service, incident, and change
management.
Conduct periodic review and security
management.
Security & Record Management
Protect systems and data Use secure access and Define retention and
from loss or change. password policies. archival procedures.
Change Management
All changes must be Maintain change history
proposed, reviewed, and and assess impact.
tested.
System Retirement:
WITHDRAWAL: REMOVE DECOMMISSIONING DATA MIGRATION TO
FROM ACTIVE USE. AND DISPOSAL. NEW SYSTEMS.
Risk Management
Assess, control and review Focus on patient safety,
risks. product quality and data
integrity.
Annex 11 Key Points
Data transfer Accuracy Backup, Electronic
and storage checks for archival, and signatures and
validation critical data audit trails security
controls
Lifecycle Scaling
• System impact
Scale validation activities • Complexity
based on: • Supplier capability
• Business criticality
GAMP Software Categories
Category 3: Category 5:
Category 1: Category 4:
Non- Custom
Infrastructure Configured
Configured Applications
Software Categories and
Validation Approach
GAMP CATEGORY VALIDATION APPROACH
1
Record version number
(Infrastructure software)
Verify correct installation
Software Categories and
Validation Approach
GAMP Category Validation approach
Impact Assessment
21 CFR Part 11 assessment
Risk Assessment
URS
Consolidated CSV Protocol including Test
3 Protocol/Scripts
o Record version number, verify correct installation
(Non-Configured Software)
o Risk-based testing against requirements as
dictated by use (for simple systems regular
calibration may substitute for testing)
CSV Report including Test Report and Traceability
Matrix
Procedures in place for maintaining compliance and
Software Categories and
Validation Approach
GAMP Category Validation approach
Impact Assessment
21 CFR Part 11 assessment
Risk Assessment
URS including Functional Requirements
Risk-based supplier assessment (demonstrate that the supplier has adequate QMS)
CSV Protocol
4 Test Protocol including Test Scripts
o Installation Qualification
(Configured Software) o Risk-based testing to demonstrate that the system works as designed
Design and Configuration Specifications (this may be retained by the supplier)
Data Migration / Conversion Protocol (if applicable)
Test Report
Data Migration / Conversion Report
Traceability Matrix
CSV Report
Procedures in place for maintaining compliance and fitness for intended use
Procedures in place for managing data
Software Categories and
Validation Approach
GAMP Category Validation approach
Same as Category 4, plus:
5
More rigorous supplier assessment, with possible
(Customized Software) supplier audit
Full lifecycle approach
Design and code review
Best Practices for CSV
Validate
Define policies Inventory and according to
Train staff.
and SOPs. assess systems. risk and
complexity.
Conclusion
Computer System Validation
ensures compliance, quality and
data integrity throughout a system’s
lifecycle.
Thank you for your Time
