CSA Revolution Series: Computer Software Assurance

DIRECT FROM THE SOURCE

FDA - INDUSTRY CSA TEAM

FICSA Team

Boston Scientific CSA Case Study for PM/Calibration System"Episode 5 ” - Live Webinar Series, Thursday September 3 rd , 2020

Khaled Moussally

EVP, Clients & Regulatory Relations

COMPLIANCE GROUP

Ray Murphy

Principal Engineer Corporate Software Quality

BOSTON SCIENTIFIC

Damien McPhillips

Sr. Manager Corporate Software Quality & Digital Health

BOSTON SCIENTIFIC

PANELISTS

Hosted By

Damien McPhillips SR. MANAGER CORPORATE SOFTWARE QUALITY & DIGITAL HEALTH

Khaled is a Quality & Compliance executive and a thought leader providing cutting-edge solutions to Life Sciences industry. After spending over 25+ years with corporate in IT, Manufacturing and Quality, Khaled transitioned into consulting to bring about a paradigm shift in Quality & Compliance by leveraging his experience with regulatory agencies. Khaled is a key participant of the MDIC “Case for Quality Initiatives” and a member of the “FDA – Industry CSA team” contributing to the FDA draft guidance “Computer Software Assurance (CSA) for Manufacturing, Operations, and Quality System Software”. Khaled is on the “ISPE GAMP America Steering Committee” and has co-presented with the FDA in numerous industry conferences on how to reduce CSV cycle times while enhancing quality by applying CSA concept.

FDA - Industry CSA (FICSA) Team Members

Damien McPhillips is a Senior Quality Manager leading the Global Software & Digital Healthteams across Boston Scientific with responsibility for quality and compliance. Damien hasmore than 20 years’ experience delivering software validation optimization across large scaleenterprise wide projects. Over the past 15 years Damien has held leadership roles within BSCwith oversight for Non-Device Software, Device Software, Cybersecurity, Digital Health andEmerging Technologies such as Artificial Intelligence and Machine Learning. Damien has ledteams to deliver significant value improvement and associated cost savings through processoptimization and has championed quality system standardization across the BSCnetwork. Damien has been actively engaged with the CSA team since it was formed and hasbeen the key thought leader around risk-based testing within the guidance document.

Ray Murphy PRINCIPAL ENGINEER CORPORATE SOFTWARE QUALITY

Ray Murphy is a computer system validation subject matter expert with 30 years experience inquality engineering, quality auditing, quality management, regulatory compliance and softwarevalidation.For the past 13 years, he has worked for Boston Scientific where he has responsibility for non-device software validation lifecycles for equipment qualification, IT validation and spreadsheetvalidation. His responsibilities include the implementation of strategic quality initiatives andcorporate quality policies and standards. While improving the agility of these processes, hesupports teams in developing compliant and value-add CSV solutions. He has been a valuedcontributor this CSA team since 2017 and developed several examples on the application of thisdraft guidance.

Khaled MoussallyEXECUTIVE VICE PRESIDENT CLIENTS & REGULATORY RELATIONS

Hosted By

CSA Revolution Series By the FDA - Industry CSA Team (FICSA)

Game Changer Kick Off Webinar SeriesApril 23rd, 2020

With Cisco Vicenty from FDA

Episode 1 - Gilead Sciences

Episode 2 - Johnson & Johnson Episode 3 – Fresenius Episode 4- Medtronic

Compliance Group White Paper on CSA

Want to catch-up on previous CSA Episodes?

https://complianceg.com/webinar

Agenda

❑ Meet the “FDA- Industry CSA Team”(FICSA) Members!

❑ Cultural Barriers Paralyzing Industry

❑ Boston Scientific CSA Case Study for PM/Calibration System

Objectives

❑ Start thinking how you want to implement CSA

❑ Digitize your current paper CSA processes

❑ Create awareness to accelerate innovation and realize value

❖ No need to wait for the FDA Draft Guidance to be released

❑ Next Steps

Hosted By

❑ Risk Assessment CSV-Paper Process Vs CSA-Paperless

❑ Questions?

Contributions also provided by past team members:Stacey Allen, Jason Aurich, Sean Benedik, Laura Clayton, Bill Hargrave, Joe Hens, Scott Moeller, John Murray, Penny Sangkhavichith, Dana Guarnaccia, and Curt Curtis.

FDA - Industry CSA Team (FICSA)

Company Name

Baxter Healthcare Tina Koepke

Boston Scientific Damien McPhillips

Boston Scientific Ray Murphy

Compliance Group Khaled Moussally

Edwards Lifesciences Andy Lee

FDA Cisco Vicenty

Fresenius Medical Care Bill D'Innocenzo

Fresenius Medical Care Marc Koetter

Gilead Sciences Ken Shitamoto

Gilead Sciences Senthil Gurumoorthi

Johnson and Johnson Ron Schardong

Company Name

Johnson and Johnson Reggie George

Lantheus Imaging Lou Poirier

Medtronic Frankie Bill

Medtronic Michael Branch

Medtronic April Francis

NeuroVision Imaging Pepe Davis

Ortho-Clinical Diagnostics Des Chesterfield

Siemens Digital Industries Jason Spiegler

Siemens Digital Industries Greg Robino

Roche Thorsten Ruehl

Omnicell Frank Meledandri Sr.

Join FICSA LinkedIn Group

Hosted By

www.fda.gov

FDA CDRH Fiscal Year 2020 (FY 2020) Proposed Guidance Development

FDA announcement link. https://www.fda.gov/medical-devices/guidance-documents-medical-devices-and-radiation-emitting-products/cdrh-proposed-guidances-fiscal-year-2020-fy-2020

Draft Guidance Topics

❑ Content of Premarket Submissions for Cybersecurity of Medical Devices of Moderate and Major Level of Concern

❑ Surgical Staplers and Staples – Labeling Recommendations

❑ Non-binding Feedback After Certain FDA Inspections of Device Establishments

❑ Select Updates for Recommendations for Clinical Laboratory Improvement Amendments of 1988 (CLIA) Waiver Applications for Manufacturers of In Vitro Diagnostic Devices

❑ Recommendations for Dual 510(k) and Clinical Laboratory Improvement Amendments Waiver by Application Studies

❑ Computer Software Assurance for Manufacturing, Operations, and Quality System Software

❑ Patient Engagement in Clinical Trials

❑ Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices

❑ Lifecycle Regulatory Requirements of Medical Device Servicing (Device Servicer vs Remanufacturer)

❑ Guidance on an Accreditation Scheme for Conformity Assessment of Medical Devices to FDA-Recognized Consensus Standards (ASCA).

A-List: Prioritized Guidance Documents that CDRH Intends to Publish in FY2020

Hosted By

Cultural Barriers Paralyzing Industry

Summary of Impact

• Manufacturers are reluctant to invest

• When they invest, the documentation

burden is excessive (not commensurate

with Risk) impacting “Time to Value”

• Cybersecurity (Enterprise) risk increases

➢ Slow to upgrade/ implement patches due

to “revalidation” lifecycle burden

• Impacts on all Centers across FDA!

“We are risk-based… everything is high risk!”

“Too much documentation – lot of overhead for little value!”

“Most deviations are documentation errors, not Software bugs - we trip over ourselves!”

“We validate all Software… like product Software!”

“Data mining? We looked at purchasing an inexpensive BI tool, but CSV cost was too high.”

“The real pain no one discusses, is the CSV burden over the lifecycle of maintaining software.”

“It took 4x longer for CSV than the actual analysis!”

“What If analysis not practical to maintain”

For software not used in product, manufacturers refer to significantly more burdensome guidance (20+ years old),

based on Fear of a 483, based on prior FDA Investigations and 3rd Party Consultants.

Hosted By

Guidance BenefitsCalibration/PM focus

Our Mission and Values

Boston Scientific is dedicated to

transforming lives through innovative

medical solutions that improve the

health of patients around the world.

CaringMeaningful

Innovation

High

Performance

Global

CollaborationDiversity

Winning

Spirit

Boston Scientific Confidential – Access Limited to Authorized Personnel Do not copy, display or distribute externally. 9

Finding Solutions that Address Complex Clinical Needs

Neurological

• Chronic pain

• Parkinson’s disease

• Essential tremor

Respiratory

• Asthma

• Lung cancer

Urology & Pelvic Health

• Kidney stones

• Enlarged prostate

• Erectile dysfunction

• Heavy menstrual bleeding

• Uterine fibroids & polyps

• Stress urinary incontinence

Cardiovascular

• Coronary and vascular disease

• Heart failure

• Stroke risk reduction

• Arrhythmias

• Valvular heart disease

Digestive

• Colon cancer

• Pancreatic cancer

• Pancreatitis

• Liver cancer

• Kidney cancer

• Gastrointestinal bleeding

Boston Scientific Confidential – Access Limited to Authorized Personnel Do not copy, display or distribute externally. 10

Boston Scientific Transforming Lives Across the Globe

32,000 employees at

141 sites including 16

principal manufacturing

centers worldwide Approximately 44%

of our net sales in 2019

were international

Approximately 120 countries

with commercial

representation

BSC assist FDA to author new Non-Device Software Guidance(Scope: Enterprise Software Validation, Equipment Qualification & Data Mining)

Boston Scientific Internal – Access Limited to all Internal BSC Personnel.

Applying Risk Based

Validation to Non

Device Software:

Guidance Benefits:

• Improved Quality & Efficiency• More time challenging system, less time on

documentation

• Significant Annual Validation Savings• Validation effort reduced by 30%

• Enterprise Software

• Automated Manufacturing Equipment

• Reduced burden on Data Mining &

Spreadsheet Validation

BSC Implementation

• Trialling new guidance principles on new

Preventative Maintenance & Calibration

System

• Developed and rolled out a smart

procedure to promote Data Mining

• Planning to implement the guidance in our

procedures relating to equipment, software

systems and spreadsheet validation

procedures

Common CSV Pain Points

Takes forever

Too much focus on

document generation

Perceived Regulatory

burden -doing things for the

auditor

.

Test Scripts that often run

into tens of pages

Test Script errors & costly

defect management

01

02

03

04

05

Traditional Validation Approach

BSC implementing new Calibration and Preventative Maintenance software

system to drive efficiency and quality improvements.

Existing Calibration System

• ~1200 Test Cases Written

• Multiple dry runs

• 200+ protocol generation

errors corrected

• 1 Formal test execution

• 0 Defects found

• Critical Thinking not

Applied

• EVERY feature tested the

same

• Arduous Documentation

Approach

• Inefficient Use of

Resources

There MUST be a better way!

Guidance Benefits

Applying new guidance

• Leverage vendor

• Risk based evaluation

• Streamlined testing

Intended Use

Boston Scientific Internal – Access Limited to all Internal BSC Personnel. 16

1

2

3

What, Why Who When?

Provide Equipment Control;

Track asset calibration &

maintenance.

Regulations?

820.72 Inspection, measuring

and test equipment

820.70 (i) Automated

Processes

21 CFR Part 11

Interfaces

MES

Indirectly impacts product quality or

human safety

Required for regulatory

compliance

Feature Risk

Feature Risk

Analysis

Medium

Indirectly impacts product quality or

human safety

Required for regulatory

compliance

Feature Risk

Feature Risk

Analysis

Medium

Indirectly impacts product quality or

human safety

Required for regulatory

compliance

Feature Risk

Feature Risk

Analysis

Medium

Indirectly impacts product quality or

human safety

Required for regulatory

compliance

Feature Risk

Feature Risk

Analysis

Medium

Test Evidence

Low Risk Features Ad-hoc testing (e.g. Location details)

Medium Risk

Features

High Risk Features

Unscripted testing (e.g. ERES)

Scripted testing (e.g. Scheduled

Calibration Work Order Completion

and Approval)

25%

70%

5%

• Established high level test plan

objectives

– No step by step test script

procedure required

• Each Test had a Pass and Fail

• Name and Date of Tester

captured

Unscripted Testing

Ad-hoc Testing

• No pre-approved test scripts

• Describe what was tested to

verify that the feature worked

correctly

– Include name of tester and

date of test execution

Risk-Based Validation

Vendor

Audits

Unscripted, Ad hoc Testing

Risk Based

Approach

• All functionality is tested but only high risk

functionality requires traditional scripted testing.

• Utilize unscripted and ad-hoc techniques for

Low/medium risk.

• Scale the level of vendor

audit to the risk of the

application.

• Leverage testing by the

vendor to further scale

validation effort.

• Risk based validation

(a) Scale validation activities based on risk.

(b) Leverage vendor audits.

(c) System risk / risk based features.

Next Steps

Hosted By

❑ Start thinking how you want to implement CSA

❑ Digitize your current paper CSA processes

❑ Create awareness to accelerate innovation and realize value

❖ No need to wait for the FDA Draft Guidance to be released

WAITING!

Hosted By

FDA - Industry CSA (FICSA) Webinar’s Schedule

Register Here Episode 6 September 17th

Lou PoirierIT Director, Quality Systems

Open discussion with Lou: CSA - Organizational Culture Change

Coming October/November 2020

Khaled Moussally - khaled@complianceg.com

Questions?

Contacts

Hosted By

Stephen Cook - stephen@complianceg.com

BONUS MATERIAL / APPENDIX SLIDES

The Meat - “FDA - Industry CSA Team Recommendations”

Note: All of these concepts fall within and comply

with current FDA Regulations!

Hosted By

WAITING!

www.fda.gov

Focus on Assurance Shift the discussion

www.fda.gov

What does FDA care about?Risk Considerations

• Direct impact to device quality and device safety thatalso has a direct patient safety risk

• Directly impacts physical properties of the product or manufacturing process identified as essential to device safety or device quality by the manufacturer

• Measures, inspects, analyzes, and or dispositions the product or process

• Determines acceptability or performs process correctionswithout human intervention, awareness, or review

• Directly impacts labeling, instructions for use, or directalerts or communications to the user

• Automates surveillance, trending, or tracking of product quality or patient safety issues identified as essential by the manufacturer

16

www.fda.gov

Appropriate methods and activities for software assurance

• Take a least-burdensome approach – focus on value for the Manufacturer, not the Investigator.

• Leverage existing activities and supplier data. Do not reinvent the wheel; takecredit for work already done

• Leverage use of process controls to mitigate risk

• Use Computer System Validation tools to automate assurance activities

➢ Scope of 21 CFR 820.70(i) is applied when computers or automated data processingsystems are used as part of production or quality system.

➢ FDA does not intend to review validation of support tools. Manufacturer determines assurance activity of these tools for their intended use.

➢ Part 11 narrowly scoped and is under enforcement discretion apply appropriately

• Use Agile testing methods and unscripted testing as appropriate

• Use electronic data capture and record creation, as opposed to paper documentation, screen shots, etc

• Leverage continuous data and information for monitoring and assurance

17

www.fda.govwww.fda.gov

Acceptable record of resultsAssurance Approach Test Plan Test Results Record (Digital Acceptable)

Unscripted Testing: Ad-hoc (with least-burdensome documentation)

• Testing of features and functions with no test plan

• Details regarding any failures/deviations found

• Summary description of features and functions tested• Issues found and disposition• Conclusion statement• Record of who performed testing and date

Unscripted Testing:Error guessing

• Testing of feature and function fail-modes with no test plan

• Details regarding any

failures/deviations found• Summary description of fail-modes tested• Issues found and disposition• Conclusion statement• Record of who performed testing and date

Unscripted Testing:Exploratory Testing

• Establish high level test plan objectives for features and functions (no step-by-step procedure is necessary)

• Pass/fail for each test planobjective

• Details regarding any failures/deviations found

• Summary description of features and functions tested• Result for each test plan objective – only indication of pass/fail• Issues found and disposition• Conclusion statement• Record of who performed testing and date

Scripted Testing:Limited

• Limited Test cases (step-by-step procedure) identified

• Expected results for the test cases• Identify unscripted testing applied• Independent review and approval of

test plan.

• Pass/fail for test case identified• Details regarding any

failures/deviations found and disposition regarding fails

• Summary description of features and functions tested• Result for each test case - only indication of pass/fail• Issues found and disposition• Conclusion statement• Record of who performed testing and date• Signature and date of appropriate signatory authority

Scripted Testing:Robust

• Test objectives

• Test cases (step-by-step procedure)

• Expected results

• Independent review and approval of

test cases.

• Pass/fail for test case• Details regarding any

failures/deviations found and disposition regarding fails

• Detailed report of assurance activity• Result for each test case - only indication of pass/fail• Issues found and disposition• Conclusion statement• Record of who performed testing and date• Signature and date of appropriate signatory authority

PAPERLESS VALIDATION TOOL

Copyrighted content. All rights reserved

Polarion CSA Package

CSA Methodology

Shorter Cycle

TimesCompliant

Siemens Polarion

Paperless /

Contactless

Industry

Leading ALM

Siemens Polarion CSA Template

Polarion CSA Screenshots

Polarion CSA Screenshots