software quality regulatory trends - validation...

1925 West Field Court, Suite 125, Lake Forest, IL 60045 Validation Center™praxislifesciences.com | +1(847) 295-7160 validationcenter.com

Software Quality Regulatory Trends

By Praxis Life Sciences

Reproduction or re‐transmission in any form or by any means, electronic or mechanicalwithout prior written permission from Praxis is prohibited.

© 2016 Praxis Life Sciences. All rights reserved.

Validation Center™validationcenter.com

Praxis Life Sciences | praxislifesciences.com1925 West Field Court, Suite 125, Lake Forest, IL 60045 | +1 (847) 295‐7160 1

Software Quality Regulatory Trends© Copyright 2016 by Praxis Life Sciences. All rights reserved. No part of these materials may be reproduced or transmitted in any form without the written permission of Praxis.

v.17.01

Your Praxis Facilitator

Validation Center™ © 2016 Praxis Life Sciences 2

• Debra Bartel, MBA, CQA, PMP

• Principal, Praxis Life Sciences

• 25+ years experience specializing in software quality assurance, validation and regulatory compliance, Information Systems project management, and process design.

• Prior to joining Praxis, held management positions in the pharmaceutical industry in both Quality Assurance and Information Systems organizations

• Active member of American Society for Quality (ASQ), Northeastern Illinois Section, Software Division





Intro to Praxis Life Sciences


Follow us!

Target Audience

• Pharmaceutical & Biologics• Medical Device• Clinical Studies• Blood Products

Industries

• Operating in the US• Selling to the US MarketRegions

• IT Personnel and Managers• Software Quality Personnel and

Managers• Software Testers and Protocol Writers

Personnel

© 2016 Praxis Life Sciences 4PraxisLifeSciences.comValidation Center™





Webinar Outline


• Applicable Regulations and Guidance• Recent and Approaching Change1

• FDA Enforcement Statistics2

• FDA Enforcement Analysis3

• FDA Enforcement Trends4

• Recent FDA Warning Letters 5

PraxisLifeSciences.com

Applicable Regulations and GuidelinesPart 1

Recent and Approaching Changes





Part 1: Regulations, Guidelines, & Changes

Section Overview

– Sources of Regulations & Guidelines:• FDA

• ICH

• Eudralex

• PIC/s

• WHO

– Changes Highlights• Changes implemented in 2014 - 2016

• Changes pending

• Flagged with symbol

© 2016 Praxis Life Sciences 7PraxisLifeSciences.comValidation Center™

Framework for Regulations, Guidelines


Part 1 will address the key places to look for regulations and guidelines related to

computer systems and software

Software Quality Assurance, Validation, and Information Technology professionals operate in an ever changing

regulatory environment.

It can be difficult to find the time to monitor the US and international information to be aware of new regulations,

guidance documents, and enforcement trends.

21 CFR 58 Good

21 CFR 210,211, 820, 606 Good Manufacturing Practices

21

CF

R 1

1E

lec

tro

nic

Re

co

rd

21

CF

R 5

0, 5

4,

ICH E6 Good Clinical Practice ICH Q7 Good Manufacturing Practice

ICH Q9 Quality Risk Management

Eu

dra

lex

V4

Ch

ap

ter

4 D

oc

um

en

tati

on

Eu

dra

lex V

4 A

nn

ex 1

1

Eu

dra

lex

V4

An

ne

x 15

Qu

alific

ation

an

d V

alid

ation

FDA Guidance: Computerized Systems Used in Clinical InvestigationsFDA Guidance: Gener

FDA Guidance: Validation of Blood Establishment Computer Systemsal P

rinciples of S

oftware V

alidation

Computerised Systems

56 Good Clinical Practices

La

bo

rato

ry P

rac

tic

es

& Signatures







Regulations (Laws)FDA 21 CFR ….

Eudralex Volume …

ICH Guidelines

FDA Guidance & Reference Documents

PIC/SGuidance Documents

GAMPGuides(ISPE)

ISOStandards

etc.

Company policies & procedures

influences

EMAReflection

Papers


Eudralex Volume …

ICH Guidelines






GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers





FDA: General


Electronic Records; Electronic Signatures

Scope:General electronic records and signature requirements for electronic records

• created, modified, maintained, archived, retrieved, or transmitted, under any FDA records requirements

• submitted to the FDA

Includes topics such as electronic record and signature validation, record protection, audit trails, training, documentation, change control, passwords

199721 CFR 11

FDA: General


Scope:• Software in medical devices• Blood establishment software• Software in manufacturing equipment• Software used to support the quality system

Provides an integrated approach to software validation and risk management.

General Principles of Software Validation 2002Guidance

Electronic Records; Electronic Signatures 199721 CFR 11





FDA: General


2003

Provides a better explanation of the scope of records included in Part 11

Explains which parts of Part 11 the FDA intends to enforce vs. where the FDA plans to use “enforcement discretion” while re-examining the Part 11 regulation

Refers the reader to “General Principles of Software Validation” for validation guidance.

Part 11, Electronic Records; Electronic Signatures – Scope and Application

Guidance



FDA: General


FDA’s manual for ORA lab analysts contains a chapter on spreadsheet validation.

2003FDA Office of Regulatory Affairs Laboratory ManualReference

2003Part 11, Electronic Records; Electronic Signatures – Scope and Application

Guidance







FDA: General


Posted on the FDA web site in July, 2010

FDA: Pharmaceutical


Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General

Current Good Manufacturing Practice for Finished Pharmaceuticals

FDA ORA Guide to Inspection of Computerized Systems in Drug Processing

21 CFR 210

21 CFR 211

Reference

Scope:• Preparation of drug products for humans or animals

CFR 211 Provides requirements for:• Controls of computer systems• Change control

The ORA document gives insight to questions that FDA auditorssometimes ask

• Validation• Back-ups

• Record content, management,and retention





FDA: Medical Devices


Quality System Regulation

Off-The-Shelf Software Use in Medical Devices

Contents for Premarket Submissions for Software Contained in Medical Devices

21 CFR 820

Guidance

Guidance

Scope:• Design, manufacture, packaging, labeling, storage, installation, and servicing of

all finished medical devices intended for human use.

CFR 820 provides requirements for:• Design controls• Automated processes

The Guidance documents provide additional recommendations for device software topics such as documentation, risk assessment & management, change management, virus protection and networks.

• CAPA• Validation

• Record content, management, and retention



Design Considerations for Devices Intended for Home UseGuidance

Interesting Contents:• Recommended practices to mitigate the unique risks of home use medical devices. • Recommended Design Controls for home use medical devices• Brief discussion regarding best practices for software design, testing, and

upgrades.

2014

Mobile Medical AppsGuidance

Interesting Contents:• Definitions of Mobile Medical Apps• Regulations that apply to Mobile Medical Apps• Examples of apps that are Mobile Devices• Examples of apps that are not Medical Devices

2015

General Wellness: Policy for Low Risk DevicesGuidance

Interesting Contents:• FDA compliance policies for devices that promote healthy life styles• Examples of low-risk wellness devices

2016







Contents of Premarket Submissions for Management of Cybersecurity in Medical Devices

Guidance

Interesting Contents:• Design and development considerations to ensure cybersecurity• Recommendations regarding hazard analyses, trace matrices, risk mitigation and technical measures, such as user authentication, code authentication, and detection of security breaches

Medical Device Data Systems, Image Storage Devices, and Image Communications Devices

Guidance

Interesting Contents:• FDA intention to not enforce regulatory controls to devices classified as Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communication Devices

• Definitions and examples of the categories of devices listed above.

2014

2015

FDA: Biological Products


Biological Products: General

Scope:• Manufacture, inspection, and adverse event reporting for any virus, therapeutic serum, toxin, antitoxin, or analogous product applicable to the prevention, treatment or cure of diseases or injuries of man

Provides requirements for:• Record types, content, management and retention• Computer generated vaccine adverse event reporting system forms

21 CFR 600





FDA: Blood & Components


Current Good Manufacturing Practice for Blood and Blood Components

Scope:• Manufacture of blood and blood products

CFR provides requirements for:• Record content, management and retention

21 CFR 606

FDA: Blood & Components


Guidance provides FDA recommendations for:• Software vendor selection• System documentation and records• Contents of Validation Plans and Validation Reports• Validation scope• System risk assessments• Validation procedures and activities• Validation after changes

Blood Establishment Computer System Validation in the User’s Facility

Guidance

Changes to an Approved Application: Biological Products: Human Blood and Blood Components Intended for Transfusion or for Further Manufacture

Guidance2014

Guidance provides FDA recommendations for:• Reporting changes associated with various types and uses of

Blood Establishment Computer Software (BECS)





FDA: Human Based Products


Human Cells, Tissues, and Cellular and Tissue-Based Products

Scope:• Creation of a unified registration and listing system for establishments that

manufacture human cells, tissues, and cellular and tissue-based products (HCT/P's) and to establish donor-eligibility, current good tissue practice, and other procedures to prevent the introduction, transmission, and spread of communicable diseases by HCT/P's.

Provides requirements for:• Computer validation• Record content, management and retention

Requires compliance to 21 CFR 211 for HCT/Ps that are drugs and 21 CFR 820 for HCT/Ps that are medical devices.

21 CFR 1271

Current Good Tissue Practice (CGTP) and Additional Requirements for Manufacturers of Human Cells, Tissues, and Cellular and Tissue-Based Products (HCT/Ps)

Guidance

FDA: Clinical Studies


Protection of Human Subjects

Scope:• Clinical investigations regulated by the FDA, including drugs, medical devices,

biological products, dietary supplements, infant formulas, and food & color additives

CFR 50 & 56 provide requirements for:• Record content, management, and retention

Institutional Review Boards

21 CFR 50

21 CFR 56





FDA: Clinical Studies


Computerized Systems Guidance provides:• Recommendations on topics such as SOPs, record retention formats, system

security, audit trails, system controls, user training, and system documentation

Source Data Guidance provides:• Recommendations on topics such as electronic source data capture, electronic

data review, retention of records by clinical investigators, and access to electronic source data

Computerized Systems Used in Clinical InvestigationsGuidance

Electronic Source Data in Clinical InvestigationsGuidance

FDA: Nonclinical Labs


Good Laboratory Practice for Nonclinical Laboratory Studies

Scope:• Conduct of nonclinical laboratory studies to support applications forresearch or marketing permits for FDA regulated products, such as drugs,biological products, medical devices, and food & color additives

Provides requirements for:• Record content, management and retention

This regulation includes computer data in its definition of “raw data”. Requirements for generation, management, storage, retention, and protection of raw data are found throughout the document.

21 CFR 58






Eudralex Volume …

ICH Guidelines


ICH




GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers

ICH Members


ICH members include the• Japanese Ministry of Health, Labour and Welfare (MHLW)• Japanese Pharmaceutical Manufacturers Association (JPMA)• European Union (EU)• European Federation of Pharmaceutical Industries and Associations (EFPIA)• US Food and Drug Administration (FDA)• US Pharmaceutical Research and Manufacturers of America (PhRMA)• Observers from

• Canada • World Health Organization (WHO)





ICH: Clinical Studies


Guideline for Good Clinical Practice

Scope:• Responsibilities and expectations of all participants in the conduct ofclinical trials, including investigators, monitors, sponsors and IRBs.

Provides computer system guidelines for:• Record content, management and retention• Audit trails• Validation• SOPs• Security• Back-ups

E6

ICH: API Manufacturing


Scope:• Good manufacturing practice (GMP) for the manufacturing of active pharmaceutical ingredients (APIs). “Manufacturing” is defined to include all operations of receipt of materials, production, packaging, repackaging, labeling, relabeling, quality control, release, storage and distribution.

Provides computer system guidelines for:• Record content, management and retention• Audit trails• Validation and qualification• Record protection• Incident investigation

Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients

• SOPs• Security• Back-ups• Change control

Q7

2016





ICH: Quality Risk


Scope:• Principles and examples of tools of quality risk management that can beapplied to all aspects of pharmaceutical quality including development,manufacturing, distribution, and the inspection and submission/reviewprocesses throughout the lifecycle of drug substances, drug products,and biological and biotechnological products

This guideline provide examples of how risk management concepts can be applied to computer system design and validation.

Quality Risk ManagementQ9


Eudralex Volume …

ICH Guidelines


European Union




GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers





European Union Members


European Union members include

AustriaBelgiumBulgariaCroatiaCyprusCzech RepublicDenmark

EstoniaFinlandFranceGermanyGreeceHungaryIreland

ItalyLatviaLithuaniaLuxembourgMaltaNetherlandsPoland

PortugalRomaniaSlovakiaSloveniaSpainSwedenUnited Kingdom*

* In June 2016, the UK citizens voted to leave the EU

Eudralex: Computerised Systems


Annex 11 provides additional rules for computer systems

Topics include:• Validation • System documentation• System placement• Training

Status:A new version went into effect on June 30, 2011

NOTE: Adopted by PIC/S in 2014

Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use

Computerised Systems

• Security and access• Audit Trails• Change control• Back-ups

Volume 4

Annex 11

• Alternate procedures for useduring system down time

• Error analysis and correction• Outside service providers

2014





Eudralex: Qualification & Validation



Qualification and Validation

Annex 15 provides additional rules for qualification and validation

Validation topics include:• Planning (VMPs)• Documentation• Change control• Revalidation

• Qualification of •Design• Installation•Operation•Performance

Volume 4

Annex 15

2015

Eudralex: Quality Risk



Quality Risk Management

Scope:Based on ICH Q9, Quality Risk Management.Principles and examples of tools of quality risk management that can beapplied throughout the lifecycle of drug substances, drug products, and biological and biotechnological products.

Computer System topic:Includes areas where risk management principles can be applied. E.g., software design, selection, verification, and validation

Volume 4

Annex 20





Eudralex: Clinical Studies


Clinical Trial Guidelines

Inspections

Scope:Guide for GCP inspectors to use during inspections related to clinical trials

Status:In effect. Version dated May 28, 2008.Minor correction to scope was made in September, 2012.

Guidance for the Conduct of GCP Inspections –Computer Systems

Volume 10

Chapter IV

Annex III

Eudralex Volume 10, Chapter IV, Annex IIIConduct of GCP Inspections – Computer Systems

Eudralex: Clinical Studies


“The EU GCP inspectors agreed to use as the reference for inspection of Computer Systems the published PIC/S Guidance on Good Practices for

Computerized Systems in “GXP” Environments (PI 011-3)”





EC: Distribution


Good Distribution Practice of Medicinal Products for Human Use

Guidelines

This document outlines GDP (good distribution practice) expectations for computer system topics such as:

• Validation for computer systems used to segregate product prior to use• Security • System documentation• Back-ups• Data retention• Procedures for addressing system failures.

EC: Distribution


Principles of Good Distribution Practice of ActiveSubstances for Medicinal Products for Human Use

Guidelines

This document outlines GDP (good distribution practice) expectations for importers and distributors of APIs. Computer system topics include:

• Requirements for electronic documentation• Use of systems to segregate damaged, falsified, and expired product• Validation of Warehouse Management Systems

2015





EMA: Clinical Studies


Expectations for Electronic Source Data & Data Transcribed to Data Collection Tools in Clinical Trials(In effect as of August 1, 2010)

Reflection Paper

This document outlines GCP (good clinical practice) inspectors’ expectations for computer system topics such as:

• Validation• SOPs for system use• Audit trails• Backups• System security• Data safeguards• User training• Record archival

EMA: Clinical Studies


Reflection Paper for Laboratories that Perform the Analysis or Evaluation of Clinical Trial Samples (Adopted February 28, 2012)

Key Sections for Software and Computer Systems

• 5.0 – Definitions of “Computerised System” and “Validation of a Computerised System”

• 6.16 - Expectations for computer validation, documentation, interfaces, upgrades, patches, risk assessment, re-validation, location, administration, access rights, and disaster recovery

• 6.17 - Expectations for audits of computer validation documentation

• 6.19 - Expectations for SOPs on computer system installation, validation, and maintenance

Reflection Paper





PIC/S




GAMPGuides(ISPE)

ISOStandards

etc.

influences

EMAReflection

Papers


Eudralex Volume …

ICH Guidelines


PIC/S Participants


PIC/S is an international group that provides a harmonized framework for cGXP inspectors

PIC/S Participating Authorities include

PIC/S Partners include

Pharmaceutical Inspection Convention (PIC) and

Pharmaceutical Inspection Co-operation Scheme (PIC Scheme)

ArgentinaAustraliaAustriaBelgiumCanadaChinese TaipeiCroatiaCyprusCzech Republic

DenmarkEstoniaFinlandFranceGermanyGreeceHong KongHungaryIceland

IndonesiaIrelandIsraelItalyJapanKoreaLatviaLiechtensteinLithuania

MalaysiaMaltaNetherlandsNorwayPolandPortugalRomaniaSingaporeSlovakia

SloveniaSouth AfricaSpainSwedenSwitzerlandThailandUkraineUnited KingdomUSA

EME EDQM UNICEF WHO





PIC/S: Medicinal Products


Scope:Guide for establishments that manufacture finished pharmaceuticals and active pharmaceutical ingredients.

Status:In effect as of January, 2013.

Annex 11 topics include:• Risk Management• Suppliers & Vendors• Validation• Data Management

PE 009Guide to Good Manufacturing Practices for Medicinal Products

• Audit Trails• Security• Change Control• Periodic Evaluation

• Configuration Management• Incident Management • Electronic Signatures• Business Continuity

Computerised SystemsAnnex 112014

PIC/S: Medicinal Products Annex 11


Excerpts from Eudralex Volume 4 and PIC/S Annex 11 Computerised Systems

Risk Management

Risk management should be applied throughout the lifecycle of the computerised system taking into account patient safety, data integrity and

product quality. As part of a risk management system, decisions on the extent of validation and

data integrity controls should be based on a justified and documented risk assessment of the computerised system.

System InventoryAn up to date listing of all relevant systems and their GMP functionality

(inventory) should be available.







Software Suppliers & Service Providers

When third parties (e.g. suppliers, service providers) are used e.g. to provide, install,configure, integrate, validate, maintain (e.g. via remote access), modify or retain acomputerised system or related service or for data processing, formal agreements must

exist between the manufacturer and any third parties, and these agreements should include clear statements of the responsibilities of the third party.

The competence and reliability of a supplier are key factors when selecting a product or service provider. The need for an audit should be based on a risk assessment.

Documentation supplied with commercial off-the-shelf products should be reviewed by regulated users to check that user requirements are fulfilled.

Quality system and audit information relating to suppliers or developers of software and implemented systems should be made available to inspectors on request.




Excerpts from Eudralex Volume 4, Annex 11 Computerised Systems

Validation

The validation documentation and reports should cover the relevant steps of the lifecycle. Manufacturers should be able to justify their standards, protocols, acceptance

criteria, procedures and records based on their risk assessment.

Validation documentation should include change control records (if applicable) andreports on any deviations observed during the validation process.

The regulated user should take all reasonable steps, to ensure that the system has beendeveloped in accordance with an appropriate quality management system. The supplier

should be assessed appropriately.

For critical systems an up to date system description detailing the physical and logicalarrangements, data flows and interfaces with other systems or processes, any hardware

and software pre-requisites, and security measures should be available.







Validation

User Requirements Specifications should describe the required functions of thecomputerised system and be based on documented risk assessment and GMP impact.

User requirements should be traceable throughout the life-cycle.

Evidence of appropriate test methods and test scenarios should be demonstrated.Particularly, system (process) parameter limits, data limits and error handling should beconsidered. Automated testing tools and test environments should have documented

assessments for their adequacy.

If data are transferred to another data format or system, validation should include checks that data are not altered in value and/or meaning during this migration process.




Accuracy Checks

For critical data entered manually, there should be an additional check on the accuracy of the data. This check may be done by a second operator or by validated electronic means.

Data Storage

Data should be secured by both physical and electronic means against damage. Stored data should be checked for accessibility, readability and accuracy.

Access to data should be ensured throughout the retention period.

Regular back-ups of all relevant data should be done. Integrity and accuracy of backupdata and the ability to restore the data should be checked during validation and

monitored periodically.








Change and Configuration Management

Any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure.

Periodic Evaluation

Computerised systems should be periodically evaluated to confirm that they remain in a valid state and are compliant with GMP.

Such evaluations should include, where appropriate, the current range of functionality, deviation records, incidents, problems, upgrade history,

performance, reliability, security and validation status reports.




Incident Management

All incidents, not only system failures and data errors, should be reported and assessed.

The root cause of a critical incident should be identified and should form the basis of corrective and preventive actions.

Electronic Signature

Electronic records may be signed electronically. Electronic signatures are expected to:

a. have the same impact as hand-written signaturesb. be permanently linked to their respective record,c. include the time and date that they were applied.








Business Continuity

For the availability of computerised systems supporting critical processes, provisions should be made to ensure continuity of support for those processes

in the event of a system breakdown (e.g. a manual or alternative system).

The time required to bring the alternative arrangements into use should be based on risk and appropriate for a particular system and the business process

it supports.

These arrangements should be adequately documented and tested.


PIC/S: Blood Establishments


Scope:Guide for GMP-inspectors to use during inspections of establishments that collect, prepare, store, dispatch, and/or provide quality control and quality assurance of human blood and blood components.

Provides computer system guidelines for:• Validation • Security and access• Audit trails• Disaster recovery

PE 005Good Manufacturing Practice Guide for Blood Establishments.

• Change control• Back-ups• Special considerations whensystem is used to release results





PIC/S: Healthcare Establishments


Scope:Guide for inspectors to use during inspections of healthcare establishments which prepare medicinal products for direct supply to patients.

Provides computer system guidelines for:• Electronic records and documents• Appropriate use of a validated computerized system for verifying

material identity, weight, and volume.

PE 010Guide to Good Practices for the Preparation of Medicinal Products in Healthcare Establishments

PIC/S: Distribution


Scope:Guide for inspectors to use during inspections to ensure high standards of quality assurance and integrity for distribution of medicinal products.

Provides computer system guidelines for:• Validation for any system providing segregation of products prior to use• Retaining up-to-date, written documentation of systems• Authorization for people who enter or change data• Data protection and retention• Implementation of procedures to be followed in the event of system

failure• Computerized record retention• Specifically required data elements

PE 011 Guide to Good Distribution Practice for Medicinal Products

2014





PIC/S: Computerised Systems


Scope:Recommendations for inspectors to use during inspections of computerized systems. “GxP” includes manufacturing, clinical, laboratory, and distribution.

Provides computer system guidelines for:• Validation • System life cycle• Security and access• Audit trails• Supplier assessment• Personnel qualifications

PI 011Good Practices for Computerised Systems Used in Regulated “GXP” Environments

• Change control• Service agreements• Back-ups• Error reporting• Electronic signatures• Training

WHO: Pharmaceuticals


Scope:This document contains the collective views on pharmaceutical manufacturing from an international group of experts - including representatives from international regulatory agencies, EU, IFPMA, IGPA, IPEC, PIC/S, UNICEF, BSP and US.

Provides computer system guidelines, including:• Computer system qualification and validation• Self-Inspection of validation and re-validation programs • Documentation requirements for electronic data and records management • Responsibilities of the Quality Function in qualification and validation• Outline of information that needs to be associated with a signature or electronic

password • Labeling exceptions when using fully validated computerized systems• Recommendations to use validated computer programs for Batch Processing

and Packaging records

Annex 2Good Manufacturing Practices for Pharmaceutical Products: Main Principles

2014





www.ValidationCenter.com


FDA Enforcement Statistics

Part 2





Part 2: FDA Enforcement Statistics

Section Overview– Statistics

• 1997-2010 Total Inspections

• 2010-2015 Total Enforcement Actions

• 1992-2015 Total Warning Letters

• 1993-2011 Total Arrests & Convictions


FDA Inspection Statistics


15,506

18,185

16,920

15,146

18,649

18,572

22,543

21,805

19,803

17,641

15,581 15,245

15,954

15,245

0

5000

10000

15000

20000

25000

1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010

FDA Inspections – Fiscal Years 1997-2010

Source: FDA Enforcement Story 2001-2008; FDA Enforcement Summary 2009-2010





FDA Enforcement Statistics



Enforcement 2010 Count 2011 Count 2012 Count 2013 Count 2014 Count 2015 Count

Injunctions 17 16 17 19 10 21

Seizures 10 15 8 6 4 1

Recalls Events 3,799 3,640 4,075 3,844 2,924 2,789

Recalled Products 9,361 9,288 9,469 8.044 8,061 9,178

Debarments 13 16 20 6 1 17

FDA Warning Letter Statistics



1712 17881594 1557

1038 1140 905 9001154 1032

755 582 725535 538 471 445 474 652 680 736 708

470 603

1,040

4,146

6,052

8,220

16,629

0

2,000

4,000

6,000

8,000

10,000

12,000

14,000

16,000

18,000

All Warnings, except for Tobacco Products

Tobacco Products

Warning Letters, by year





FDA Warning Letter Statistics


Source: FDA Enforcement Summary 2015

CFSAN, 236CVM, 117

CBER, 4

CDER, 76

CDRH, 168

0 50 100 150 200 250

FY 2015 Non-Tobacco Warning Letters

CDRH: Center for Device and Radiological HealthCDER: Center for Drug Evaluation and ResearchCBER: Center for Biologics Evaluation and ResearchCVM: Center for Veterinary MedicineCFSAN: Center for Food Safety and Applied Nutrition

FDA Arrest & Conviction Statistics


Source: FDA Enforcement Story 2001-2008; FDA Enforcement Summary 2009-2011* NOTE: Enforcement Summaries do not contain complete arrest/conviction data

58 58

146111

177

250

373

421 422372

345

383

535

341

496

386

10

56

106 8370

194211

353 353317

206 196

275 279

344369 370

255

0

100

200

300

400

500

600

1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011

Arrests Convictions





FDA Warning Letter Analysis

Part 3

Part 3: FDA Warning Letter Analysis


Section Overview

– Data Source• FDA Warning Letters related to Software and Computers

• 3 Year Date Range: 2013 through 2015

– Summaries• By industry segment

• By system type

• By topic• By validation topic





Warning Letter Example


Warning Letter Information

Issue Date Issuing District



Warning Letter Information

RegulatoryReference

Specific Observations







FDA Warning Letter ExampleAudit

Finding

Observations

Audit Standard

Software & Computer Warning Letters


3 Year Summary by Industry Segment

48.8%

49.3%

0.5%1.0%

0.5%Medical Device cGMP, Tracking(CFR 820, 821)

Pharma/Bio cGMP (CFR 211,Q7A)

Pharma/Bio Clinical (CFR 50,312)

Blood cGMP (CFR 606, 211,820)

Tissue/Cellular cGMP (CFR1271)







3 Year Summary by System Type

“Other” system types include systems for Labeling, Calibration Management, Building Management, Inspection Systems, Rework/Internal Failure Management, Non-Conformance Tracking, Clinical Trial Data Management, Service Records, Prescription Orders Fulfilment, Donor Tissue Tracking, Distribution, CAPA, Call Centers, and Quality Management

27%

45%

7%

4%

3%2%

2%10% Device/product Software

Laboratory Systems

Manufacturing Control Software

Complaints Systems

Inventory Control Systems

Document Management Systems

Blood Management Systems

Others (< 2% each)



3 Year Summary by Observation Topic

“Other” observation topics include Change Control, Suitability for Use, Quality Oversight and Risk Analysis

26%

17%

16%

14%

7%

5%

4%

4%3% 4%

Validation

Data Retention

Audit Trails

Security

Data Integrity

CAPA

Operating Procedures & Training

System Documentation

Vendor Management

Others (<3% each)





FDA Warning Letter Excerpts


DATARETENTIONDATARETENTION

Firm failed to conduct back-ups for the Server used to store, back-up, and/or archive raw test data from computer system controlling and monitoring HPLC systems. During the inspection the server was observed as being tagged out-of-service.

Personnel informed the investigators that the computer software was upgradedand the raw data was lost during the software upgrade.

Clinical Investigator failed to retain records for the time required stating that source documents were not available because the computer "crashed."

Firm deleted multiple HPLC data files acquired in 2013 allegedly to clear up hard drive space without creating back-ups.

17%

Firm discarded OOS (out of specification) laboratory records and deleted OOS electronic analytical data. Firm selectively reported only passing results.



Audit TrailsAudit Trails

16%

There is no specific requirement regarding any review of theaudit trails. Such an audit may well have detected the datemanipulation which was occurring at your facility.

Your system does not have an audit trail to document changes.

Review of audit trails is not required.

Changes in study data could not be detected as there was no audit trail.

This system does not include and audit trail or any history of revisions that would record any modification or deletion of raw data or files. Your laboratorycomputer system lacks necessary controls to ensure that data is protectedfrom tampering, and it also lacks audit trail capabilities to detect data that could potentially be compromised.







SecuritySecurity

…. failed to implement an adequate system for authorizing, granting, and rescinding computer access to functions in the XXXXXXXX and adequate computer security provisions to assure data integrity. Current users do not use appropriate access such as passwords and user-id and personnel who have changed jobs still have access to the system .

Laboratory Managers (QC and R&D) gained access to the XXXXXXXX computer system through a common password. Analysts …. operated thesystem following the login by laboratory managers.

System administrator privileges … include the ability to modify and delete rawdata files and to lock/unlock projects for reprocessing in the chromatographicdata acquisitions system. Our [FDA] investigators documented numerousinstances where these privileges were reassigned without documentation or justification some of which resulted in extensive manipulation of data.

14%



DATAINTEGRITYDATAINTEGRITY

Your firm was unable to locate a product lot implicated in a customer complaint, ….. which was identified as being part of the current inventory in your firm’s validated inventorycontrol system XXXXX.

There are discrepancies between the CRFs and the sponsor’s electronic devicelot sheet.

The clinical signs and symptoms of disease that you reported in the electroniccase report form …. could not be verified against information within the sourcedocuments for 17 of the 30 subjects enrolled in the study XXXXX.

Electronic records were not routinely checked for accuracy, …. Our investigators found numerous discrepancies between the electronic data filesand documentation in laboratory notebooks.

7%







CAPACAPA

Product Change Controls which are corrective and preventive actions for handling software coding defects do not always include investigating the cause of all nonconformities relating to product, processes and the quality system, and identifyingaction(s) needed to correct and prevent recurrence of nonconforming product and other quality problems..

Your firm failed to follow your procedure (QMS17, Complaint Process) for documenting complaints with an associated data search of similar complaints, in that a software complaint was not associated with a data search of similar complaints. Your firm’s hardware and software complaint customer interface department manager stated that for software and hardware complaints, the department does not typically search for related complaints as required by the firm’s complaint handling procedure.

5%



SOPs & TrainingSOPs & Training

Procedures for entering critical comments were inadequate.

Computer System is incomplete because it fails to provide detailed instructions to ensure correct specimen identification. A technician identified the specimen by scanning the barcode on the collection record instead of the barcode on the specimen. Consequently an incorrect blood group was entered into the database and the patient received incompatible red cells.

The adverse drug experience reporting system has not been fully validated because the application was released into production using an Interim Validation Report (IVR) that is still not final. Critical issues (deviations) identifiedin your interim validation report include the following: lack of training for your system support team, incomplete SOPs and Work Instructions.

CAPA procedures did not describe use of an electronic system.

4%







3 Year Summary by Observation Topic – Validation Only

“Other” observation validation topics include Inadequate Validation Plan, No Source Code Evaluation, and No Trace Matrix, Incomplete Design Documentation, and Went Live with Known Critical Defects

43%

10%14%

8%

4%

4%

4%

3%3%

7%System not validated

Changes not validated

Inadequate Validation SOPs

Insufficient Testing

No testing / Unfinished Testing

Inadequate Test Evidence

No Clear Acceptance Criteria

Acceptance Criteria not Met

Incomplete Requirements

Others (<3% each)



You released software patches for various changes on …., ….., …… You haveno documentation of validation or justification or verification for the seven patches.

Failure to validate your software used for fluid delivery and heat disinfection inyour water purification systems. For example, implementation of remote changes in operating parameters changed the output of the system. These typeof changes require re-validation of the system. You failed to follow your ownprocedure for change controls when critical limits were changed to suit a client’s needs.

You changed the software which controls the user interfaceprogram for the XXXXXX to a new version and were unable toprovide any documentation to show validation or verification procedures were conducted prior to installing the program intoall of your systems.

ChangeValidationChangeValidation

12%







14%

Inadequate Validation SOPsInadequate Validation SOPs

Validation procedures do not include:a) requirements which ensure that protocols with acceptance

criteria are established prior to the performance of validationactivities; and

b) requirements which ensure that the results of designvalidation, including identification of the design, methods,and the measuring equipment used, are documented.

Validation procedures did not require adequate level of software testing and documentation.

Software Quality Assurance Procedure, states that validation should be conducted in light of the “level of concern”; however, the procedure does not provide a process for determining “level of concern” and establishing validation plans that are appropriate to the identified level of concern.



Testing done by a Canadian site had incomplete sections.No Testing -UnfinishedTesting

No Testing -UnfinishedTesting

4%

Sections of the tests were not performed, unsigned, and/or missing

InsufficientTestingInsufficientTesting

8% The performance qualification failed to include verification of the expiration date calculations in the system. Discrepancy reports have documented that product labeling with incorrect expiration dates have been created and issued for use.

Design verification and validation to introduce the XXXXX recorder was noteffective. Sixteen (16) devices were returned to your firm for hardware/software additional upgrades.

Your firm’s most current validation of the XXXXX software is inadequate in that the validation that was conducted for version XXX consisted primarily offunction testing (black-box testing) and lacks other elements of software validation including structure testing (white-box testing).







Inspection revealed discrepancies between the printed chromatograms and the operational qualification protocol for the HPLC system, including injection sequences and values to calculate relative standard deviation.

Acceptance criteria were not established prior to the performance of validation activities. System verification and validation activities were executed under Software Verification Reports. Acceptance criteria were not established prior to executing these activities.

Inadequate AcceptanceCriteria

Inadequate AcceptanceCriteria

4%

InadequateTest EvidenceInadequateTest Evidence

4%

The validation procedures do not include requirements which ensure that protocols with acceptance criteria are established prior to the performance of validation activities

The Software Qualification does not define acceptance criteria for the test.

FDA Warning Letter Trends

Part 4





Part 4: FDA Warning Letter Trends


Section Overview

– Data Source» FDA Warning Letters

» 3 Three-year Date Ranges: • 2007 through 2009

• 2010 through 2012

• 2013 through 2015

– Summaries» By industry segment

» By system type

» By topic• By validation topic



9 Year Trend by Industry Segment (%)

Rel

ativ

e P

erce

nt

21 CFR …

1

68

2

18

4 7

70

2 1 1

14

3 41

5

49 49

0.5 1 00

1020304050607080

2007-2009 2010-2012 2013-2015

# Observations:136168203

0.5





Part 11 Enforcement


Topic Pattern 2002-2004

2005-2007

2008-2010

2011-2015

21 CFR Part 11Electronic Records &

Signatures

Enforcement Gone?

7% 2% - -

14 Year Trend (%)

Part 11 Enforcement


Is Part 11 Enforcement Gone?

Not Exactly…In recent years, the FDA has been citing predicate rules rather than 21 CFR Part 11

There is no documentation to establishthat the system … has been properlyvalidated. Access to your system hasnot been limited.

2001 PART 11 CITATIONFirm went live; however, the validation was incomplete.

2011 PART 606 CITATION

The laboratory is using an electronicrecord system …. that is not set up tocontrol the security and data integrity …not password controlled, no back-upprovision, and no audit trail.

2002 PART 11 CITATIONAll employees share the same user name and password.

2012 PART 820 CITATION

There is no audit trail in place to deletion of raw data.

2013 PART 211 CITATIONS

Firm failed to maintain a back-up file of data entered into the computer system.







9 Year Trend by System Type (%)

42

17

84

2

7 7

1 0 1

11

40

14

7 75 4 5 3 3 3

8

27

45

74 3 2 0 1 2

9

05

101520253035404550

2007-2009 2010-2012 2013-2015

# Observations:

142174208



9 Year Trend by Topic (%)

Rel

ativ

e P

erce

nt

45

4 36

1013

53 4

1 3 3

36

51

69

13

9

4 54 3 4

26

17 16 14

75 4 4

2 2 13

0

5

10

15

20

25

30

35

40

45

50

2007-2009 2010-2012 2013-2015








9 Year Trend by Validation Topic (%)R

elat

ive

Per

cent

43

14

6

13

52 3 3 2 2

8

43

15

58 9

15 5 5 5

43

1014

84 4 4 3 1 1 3 4

05

101520253035404550

2007-2009 2010-2012 2013-2015


Recent Warning Letters

Part 5





Part 5: Recent FDA Warning Letters


Section Overview– Examples of FDA Warning Letters

Recent FDA Warning Letter


Failure to validate device software.

Software was released with known "critical" level defects.

Verification and Validation test results/raw data were performed. Sections of the tests were not performed, unsigned, and/or missing.

Electronic sign-off copy of the Verification and Validation Report that sequences were entered as pass without supporting data to demonstrate the test was

performed. Raw test data was discarded.

Failure to establish Servicing procedures. Specially, the service manual did not address issues related to software failures.

Regulatory Reference 21 CFR 820 (Device)

System Type Device Software

Topic(s) Validation, Procedures

FDA Organization San Francisco District







Regulatory Reference ICH Q7

System Type Laboratory System

Topic(s) Security, Audit Trails

FDA Organization CDER

HPLC computer software lacked active audit trail functions to record changes to analytical methods, including information on original methodology, the identity

of the person making the change, and the date of the change.

In addition, your laboratory systems did not have access controls to prevent deletion or alteration of raw data.

During the inspection, your analysts demonstrated that they were given inappropriate user permissions to delete HPLC data files.

The gas chromatograph (GC) computer software lacked password protection allowing uncontrolled full access to all employees.



Failure to retain Electronic case report forms (eCRFs). Study coordinator used a sponsor-provided laptop. During the closeout visit, the sponsor’s monitor took the laptop computer. The actual eCRF data disks were never obtained from

the sponsor. The firm was responsible as the investigator to retain copies of the eCRFs for two years after the investigation was discontinued.

The study coordinator stated that she transcribed vital-sign data from the dialysis center’s Patient Treatment Records onto the study flowsheets, and then used the flowsheets to enter the data into the eCRFs. However, a comparison of the

Patient Treatment Records and the flowsheets suggests that for some visits, the study coordinator recorded the post-dialysis vital-sign data on the study

flowsheets rather than the pre-dialysis vital-sign data. This discrepancy raises questions about the reliability of the data.

Regulatory Reference 21 CFR 312 (Clinical)

System Type Clinical Trial

Topic(s) Data Retention & Integrity

FDA Organization CDER







Failure to establish and maintain adequate procedures to ensure that all purchased or otherwise received product or services conform to specified

requirement. For example:

• Firm failed to complete purchasing control activities according to its purchasing control procedure "Selection and Approval of Service Supplier" for its software supplier responsible for software development for the XXXXXX medical device.

• Firm’s "Purchasing Control for Outside Services" procedure does not assure that software suppliers complete both function and structural software testing.

Regulatory Reference 21 CFR 820 (Medical Devices)

System Type Medical Device Software

Topic(s) Vendor Management

FDA Organization Florida District

www.ValidationCenter.com






Need Help?


ValidationCenter.com Library of SOPs and CSV templates

Online and Classroom CSV Training

Software QA and Validation Program ImplementationValidation Services

Audit Readiness Assessments

Thank You!


Thanks for your interest in Software Quality Regulatory Trends

Any questions about what we have discussed today?

Please, feel free to contact me:

Deb Bartel

+1 (847) [email protected]

validationcenter.com | praxislifesciences.com

Follow us!