Transcript Slide 1

Introduction to GAMP4
2
IF IT’S NOT DOCUMENTED IT’S A RUMOUR!
Eurotherm Life Sciences Group
3
GAMP Guide History
1994 – UK Pharmaceutical Industry Computer System Validation
Forum set up (now known as the GAMP forum)
1994 – First draft issued
1995 – Version 1
1996 – Version 2
1998 – Version 3
2001 – Version 4
With GAMP4, the target audience has been expanded from just
pharmaceuticals to the whole healthcare industry including biotechnology
and medical devices. The scope has been expanded to cover automated
systems within Good Clinical Practice (GCP), Good Laboratory Practice
(GLP) and Good Distribution Practice (GDP) in addition to the original
Good Manufacturing Practice (GMP) environment.
Eurotherm Life Sciences Group
4
Lots of Nasty Acronyms
GCP
GDP
GLP
GMP
GxP
Good Clinical Practice
Good Distribution Practice
Good Laboratory Practice
Good Manufacturing Practice
All of the above!! Sometimes cGxP with ‘c’ for ‘current’
URS
VMP
User Requirements Specification
Validation Master Plan
IQ
OQ
PQ
Installation Qualification
Operational Qualification
Performance Qualification
SOP
Standard Operating Procedure
Eurotherm Life Sciences Group
5
Jargon for ‘project’ activities
GAMP4 – “Good Automated Manufacturing Practice” as defined in the GAMP4
Guide for Validation of Automated Systems. A set of guidelines for both users and
suppliers – MORE LATER!
Validation – “Establishing documented evidence which provides a high degree of
assurance that a specific process will consistently produce a product meeting its
pre-determined specifications and quality attributes”
Installation Qualification [IQ] – “Documented verification that a system is
installed according to written and pre-approved specifications”.
Operational Qualification [OQ] - “Documented verification that a system
operates according to written and pre-approved specifications throughout all
specified operating ranges”.
Performance Qualification [PQ] – “Documented verification that a system is
capable of performing or controlling the activities of the processes it is required to
perform or control, according to written and pre-approved specifications, while
operating in its specified operating environment.
Eurotherm Life Sciences Group
6
Jargon continued…
Calibration – “The set of operations which establish, under specified conditions,
the relationships between values indicated by a measuring instrument, or values
represented by a material measure or a reference material, and the corresponding
values of a quantity realised by a reference standard.”
Change Control – “A formal process by which qualified representatives of
appropriate disciplines review proposed or actual changes to a computer system.
The main objective is to document the changes and ensure that the system is
maintained in a state of control.”
Life Cycle Concept
Life Cycle Concept – “An approach to computer system development that begins
with identification of the user's requirements, continues through design, integration,
qualification, user validation, control and maintenance, and ends only when
commercial use of the system is discontinued.”
21 CFR part 11
21 CFR part 11 – FDA regulation covering the use of electronic records and
electronic signatures – MORE LATER!
Eurotherm Life Sciences Group
7
Validation
What is validation?
“Establishing documented evidence which provides a high degree
of assurance that a specific process will consistently produce a
product meeting its pre-determined specifications and quality
attributes”
What needs to be validated?
Pharmaceutical Process which produce drugs for the human and
animal Consumption.
What is validated?
• Process
• Ensures that the process does what it supposed to do backed with
documentary proof.
Who is responsible for validation?
The manufacturer is responsible for obtaining the validation.
Eurotherm Life Sciences Group
8
Validation..
What could be our responsibility?
• Provide a system with documentary evidence that satisfies the Users
requirement specification.
• The system documentary evidence will be integrated into the overall
process documentation which will be submitted for the process
validation.
Eurotherm Life Sciences Group
9
Principle of validation
• Document what is to be done
• Document how it is to be done
• Do it
• Produce documented evidence that it was done in accordance with
the “how”
• Demonstrate that it remains in a state of control
Eurotherm Life Sciences Group
10
Where Does Process Validation begin?
• Validate the API process beginning at the point where the
structure of the active ingredient become evident.
• Secondary Process
• Packaging
• Includes
• Storage
• Utilities
• HVAC
Eurotherm Life Sciences Group
11
GAMP4 Structure
Principles and Framework
- objectives of the Guide
- overview of validation
- validation lifecycle
- IT systems
- process control systems
- benefits of validation
- good practice definitions
- glossary
- source material.
GAMP
principles
and framework
APPENDICES
Management
Development
Operation
GOOD PRACTICE
GUIDES
TRAINING MATERIALS
Eurotherm Life Sciences Group
Appendices
Management activities
- validation planning/reporting
- risk assessment
- project change control, etc
Development activities
- specification
- code production
- testing
Operating activities
-service level agreements
- performance monitoring
- archive, etc
12
Validation
Plan
PLANNING
AND
DEFINITION
Vendor
Preliminary
Assessment
User
Requirement
Specification
Risk Assessment
+ Critical
Parameters
Specification
Approval
KEY:
User Responsibility
Joint Responsibility
Supplier Responsibility
Supplier
Detailed
Assessment
Supplier
Quality
Plan
Functional
Design
Specification
Hardware
Test
Specification
Hardware
Design
Specification
Integration
Software
Integration
Testing
DESIGN REVIEW AND
ACCEPTANCE
Factory
Acceptance
Testing
Installation
Qualification
Operational
Qualification
COMMISSIONING
AND
QUALIFICATION
Performance
Qualification
Validation
Report
ONGOING
OPERATION
RETIREMENT
Eurotherm Life Sciences Group
Change
Control
System
Security
Service Level
Agreement
Record
Retention
Periodic
Review
Backup and
Recovery
Retirement
Performance
Monitoring
Business
Continuity
Planning
Project Document Management
Software
Module
Testing
Project Change Control
Hardware
Acceptance
Testing
Project Configuration Management
DEVELOPMENT
TESTING
AND
SYSTEM BUILD
Software
Project Traceability Matrix
Produce
Hardware
Acceptance
Test
Specification
IQ
Software
Software
Protocol
Module
Module Test
OQ
Specifications Specifications
Protocol
PQ
Protocol
Produce
Design Review and continued Risk Assessment
DESIGN
AND
DEVELOPMENT
13
Ongoing
Operation
GAMP Lifecycle
User
Requirements
Process
Qualification
Functional
Specification
Customer
responsibility
Operational
Qualification
Installation
Qualification
Software Hardware
Design
Design
Joint
responsibility
Integrated
Testing
Hardware
Build
Configuration
/ coding
Eurotherm Life Sciences Group
Module
Testing
Eurotherm
responsibility
14
GAMP and Traceability
Update requirements documentation
Functional
Specification
Document
Control
Software Hardware
Design
Design
Document
Control
Operational
Qualification
Installation
Qualification
Integrated
Testing
Hardware
Build
Configuration
Control
Eurotherm Life Sciences Group
Configuration
/ coding
FAULT
Re-Test
Module
Testing
Update configuration
15
GAMP4 Lifecycle – Planning and Definition
Supplier
(appendix
M2)
PLANNING
ANDAssessment
DEFINITION
Validation
planning (appendix
M1)
Validation
User Requirements Specification
(Appendix D1)
Plan
Covering
both
preliminary
assessment
Risk Assessment (Appendix M3) and detailed
D T C
e
r
h
supplier
audit.
s a a
Hierarchy
of Validation Master Plans and individual system
Has Design
to specify:
i
c n
Review and Traceability Matrix (Appendix M5)
Makes
recommendations
for audit
planning
execution
and alsog e g
Covering
riskincluding:
assessment
as part
of theand
validation
process.
Validation
Plans
•Operational
requirements
(process
control,
calculations,
n a ea
Covering
design
review
planning
andRisk
deliverables.
Vendor
User
Assessmentetc)Typically,
contains
example
checklists
for
both
postal
(preliminary
Initial
risk assessment
during
URS
generation
to
identify
how
much
•GxP
criticality
assessment
b
Preliminary
Requirement
+ Critical
review
isAssessment
required
at the
end
of
each
specification
stage.
assessment)
audits
and
full
supplier
audits.
•Data
requirements
(capacity,
access,
archive,
etc)
Specification
Parameters
validation
effort to
is cover
required
which
areas are
critical to GxP Re il Co
•validation
strategy
theand
revised
lifecycle
model
In order
for safety,
theother
review
process
to be meaningful,
•Interfaces
(operator,
equipment,
plant)
product
quality,
environmental
protection,
or business av formal
i
n
Specification
•formal
list
of
validation
deliverables
i
t
t
traceability of user requirements through to design documentation
continuity.
•Environment
(layout, physical)Approval
e y
r
and
tests carried
out
required.
Anphase
example traceabilityw matrix
•formal
acceptance
criteria
foriseach
lifecycle
o
Review
of
the
risk
assessment
during
the
design
and development
•Constraints
(timescales,
compatibility
with
other
equipment,
etc)
M
l
format is provided.
•formal
detail
of change
and
document
management
stage
(to ensure
thatcontrol
choice
of
supplier
/
implementation
method
a
Supplier
Detailed
•Life
Cycle
(development
/
test
requirements,
deliverables,
etc)
t
procedures
be followed
has not to
introduced
additional
risks)
Assessment
r
Change
Control
(Appendix
•formal
list ofofSOP’s
toassessment
be createdM8)
or
Review
the
risk
atupdated
completion of the design review i
x
prior
to validation
testing
(to ensure
thatauthorisation,
any
or and
Change
request,
disposition
and
completion
•Actions
and
procedures
required
to maintain
theproblems
validatedidentified
state
implemented
have not
introduced additional risks).
approval from
afterwork-arounds
handover
project to ongoing
operation
KEY:
DESIGN AND
User Responsibility
DEVELOPMENT
Once the system is in ongoing
operation, risk assessment should
Joint Responsibility
form
part of the
ongoing change
control
strategy.
Supplier
Responsibility
Document
Management
(Appendix
M10)
The
appendix also
describes
an example
assessmentrecords
process and
Production,
approval,
issue,
change,riskwithdrawal,
used
to identify risks, categorise according to severity and likelihood
storage
and
determine
Eurotherm Life
Sciences
Group appropriate mitigation strategies.
D
o
c
u
m
e
n
t
M
a
n
a
g
e
m
e
n
t
16
GAMP4 Lifecycle – Design and Development
Supplier
Quality
Plan
(Appendix
D T C
r
h
e
DESIGN AND DEVELOPMENT
a
a
Quality
and Project
Planning
s
Functional
Specification
(Appendix D2)M6)
c n
i
Hardware Design Specification (Appendix D3)
Plan
needs to Design
include:
Software
Design
Specifications
(Appendix
D4)
Specification
replies/ Module
to
technical
requirements
from
URS and
needs gto e g
Functional
Acceptance
Test
Test
Specifications
(Appendix
D6)
n a e
Needs
to include:
Design
Specification
Software
Production
(Appendix
D5)
include:
•UserNeed
quality
requirements
(eg procedure references)
b
to include:
Specification
Need
to
include:
C
R i
•Computer
Systemneeds
(mainto
computer,
storage, peripherals,
Each
module
address:
•Functional
requirements
(process
control,
calculations,
etc)
•Supplier quality system (certification
details, activities to be undertaken,
l
o
e
IQ
interconnections)
Hardware
Hardware
Software
Software
i
n
v
Protocol
and
procedures
controlling
these,
responsibilities
for eachIntegration
activity)Test
•Data
requirements
access,
archive,
etc)
Software
Design
Specification
Test
Design(capacity,
Design
t
t
i
•Inputs
and
Outputs
(instruments
used,
accuracy,
isolation,
range,
timing)
•Scope
of
Tests
Specification
Specification
Specifications
Spec
•Project
Plan(operator,
(eg
Gantt
chart)
•Identification
(name,
version,
controlling
specification,
history) we y or
•Interfaces
other
equipment,
plant)
•System
Description
(split
into
/ interaction
of modules)
OQmodules
•Environment
(temperature,
humidity, EMC,
etc)execution, ordering of tests,
•Overview
and
Test
Plan Protocol
(procedure
for test
•Project
organisation
(contacts,
project
team
names
and
titles,Module
interface toM l
•Traceability
(commenting
of etc)
additions
/ deletions,
cross
reference
Software
Software
•Non-Functional
Attributes
(availability,
maintainability)
•System
Data
(files,
databases,
a
personnel
required, etc)
•Electrical
Supplies
earthing,
UPS, etc) Test
Module
to QA)
t
change
source)(filtering, loading,
Specifications
Specifications
PQ
•Module
Descriptions
r
•Test Requirements
(hardware,
software, test equipment, test
Protocol
•Deliverable
items (format,
media)
•Programming
Standards
i
software/data,
documentation)
x
Produce
Produce
•ActivitiesHardware
(milestones, start/end dates for activities,
allocation
of
Software
•Test Scripts
(unique
reference,
traceability to specification, preSoftware
Module
Design
Specification
personnel)
Source code
attempts
that programming
are
requisites,
test review
instructions,
datato
toensure
be
recorded,
acceptancestandards
criteria, post
•Module
Overview
(function, split
into
sub-programs)
applied
and that modules are in accordance with specifications.
test
actions)
KEY:
•Module Data (files, databases, etc)
DEVELOPMENT
User Responsibility
TESTING
AND
Joint
Responsibility
•Sub-Program
Descriptions
(language,
SYSTEM BUILD
Supplier Responsibility
standards, functions, parameters,
etc)
•Sub-Program Data (locally declared items)
Eurotherm Life Sciences Group
D
o
c
u
m
e
n
t
M
a
n
a
g
e
m
e
n
t
17
GAMP4 Lifecycle – Testing, Build, Acceptance
C
o
DEVELOPMENT TESTING
n
Hardware
Software Module
AND SYSTEM BUILD
f
Acceptance
Testing
i
Testing
Testing (Appendix
D6)
g
u
Test procedure (documentedIntegration
in specification) needs to address:r
a
t
i
•Pre-requisites (availability of documentation, test equipment, test
o
Software
n
etc)
Integration
T C
r
h
a a
c n
e g
a e
b
R i C
e
l
o
v
i
n
i
t
t
data
e y
r
w
o
M
l
Testing
M
a
•Testing Philosophy (witnessing requirements, documentation and
a
t
retention of results, indelible recording of results, etc)
n
r
DESIGN REVIEW
a
i
•Test Script Execution (what happens
if acceptance criteria are met
/ not
Factory
AND ACCEPTANCE
g
x
Acceptance
e
met?)
Testing
m
e
•Test Results File (completed tests, documentation of test incidents
/
n
faults, etc)
t
KEY:
User Responsibility
Joint Responsibility
Supplier Responsibility
Eurotherm Life Sciences Group
COMMISSIONING
AND
QUALIFICATION
D
e
s
i
g
n
D
o
c
u
m
e
n
t
M
a
n
a
g
e
m
e
n
t
18
GAMP4 Lifecycle – Commissioning, Qualification
C
o
COMMISSIONING AND
Installation
n
QUALIFICATION
Qualification
f
Installation Qualification [IQ] – “Documented verification that a systemi
g
is installed according to written and pre-approved specifications”.
u
Operational
r
Qualification
a
Operational Qualification [OQ] - “Documented verification that a
t
system
operates
according
to written
Validation
Reporting
(appendix
M7) and pre-approved specifications oi
Performance
throughout all specified operating
ranges”.
n
New material detailing best practice
for validation reporting for both
Qualification
M
individual lifecycle phases and the final validation report.
Performance Qualification [PQ] – “Documented verification that a
a
n
system is capable of performing
or controlling the activities of the
Validation Report
a
processes it is required to perform or control, according to written and g
pre-approved specifications, while operating in its specified operating e
m
environment.
e
n
t
KEY:
User Responsibility
Joint Responsibility
Supplier Responsibility
Eurotherm Life Sciences Group
ONGOING
OPERATION
T
r
a
c
e
a
b
i
l
i
t
y
M
a
t
r
i
x
C
h
a
n
g
e
C
o
n
t
r
o
l
D
o
c
u
m
e
n
t
M
a
n
a
g
e
m
e
n
t
19
GAMP4 Lifecycle –Ongoing Operation
Appendix
O5 –O1
Performance
Monitoring
Appendix
– Periodic Review
ONGOING OPERATION
Guideline
for parameters
to bewhether
monitored
(eg disk
utilization,
times)
and
Guideline
for establishing
validated
state
is beingresponse
maintained
(checking
Service Level
Periodic Review
Performance
appropriate
notification
mechanisms.
operation
of O2Change
to
O8
plus
assessing
changes
in
environment,
legislation,
Control
Agreement
Monitoring
operating
personnel)
Appendix
O6 –procedures,
Record Retention,
Archiving and Retrieval
System Security Record Retention
Backup and
Business
Appendix
O2
–
Service
Level
Agreements
Guideline to address retention (security, indexing,
availability
during full retention
Recovery
Continuity
Planning
period,
etc) of all
records.
Particular
requirements
for electronic
record
archival
Procedure
forGxP
defining
support
requirements
and agreeing
support
provisions
and between
retrieval.user and supplier (including control of fault reporting, workarounds /
patches
spares
/ consumables, routine calibration, support for
Appendix
O7/ upgrades,
– Backup and
Recovery
RETIREMENT
Retirement
software tools / hardware / infrastructure etc)
Guideline for data and software backups to guard against physical loss or accidental
Appendix O3 – Automated System Security
deletion.
Guideline
ensuringContinuity
control, integrity,
availability and confidentiality of data.
Appendix
O8 –forBusiness
Planning
Appendix
O4 – broad
Operational
Control
Guideline
covering
issuesChange
of business
continuity planning including risk
assessment;
disaster
recovery
procedures;authorization,
contingency planning;
emergency
KEY:
Guideline
for review,
risk assessment,
documentation
and re-test
User
Responsibility
response
planning;
training;
and rehearsal
of the
continuity plan.
of
changes.
Allows
exclusion
of like-for-like
replacement
and emergency repairs
Joint
Responsibility
Supplier Responsibility
(though
repairs
undergo the
same review and control ‘after the
Appendix
O9emergency
– EU Guideline
onmust
Computerized
Systems
event’).
APV Specialist section interpretation of the Annex 11 ‘Computerized Systems’
Eurotherm Life Sciences Group
20
GAMP Hardware and Software Categories
- Risk of failure increases with the progression from standard to
bespoke.
- Many systems are built up multiple components of various
categories.
- Validation strategy needs to reflect this in order to ensure that
effort is correctly focused.
Eurotherm Life Sciences Group
21
GAMP Software Categories (1)
CATEGORY 1 – Operating Systems
VALIDATION APPROACH - Record version (include service
pack). The Operating System will be challenged indirectly by the
functional testing of the application.
PROCESS CONTROL SYSTEM EXAMPLES
Instrument operating system is usually not
separable from firmware – see category 2
Most SCADA or DCS workstation software
runs on one of the Microsoft Windows ®
operating systems
Eurotherm Life Sciences Group
22
GAMP Software Categories (2)
CATEGORY 2 – Firmware
VALIDATION APPROACH
- For non-configurable firmware record version. Calibrate instruments as
necessary. Verify operation against user requirements.
- For configurable firmware record version and configuration. Calibrate
instruments as necessary and verify operation against user requirements.
- Manage custom (bespoke) firmware as Category 5 software
PROCESS CONTROL SYSTEM EXAMPLES
Instrument firmware including set-up
parameters.
3-Term Controllers, Recorders, etc
Eurotherm Life Sciences Group
23
GAMP Software Categories (3)
CATEGORY 3 – Standard Software Packages
VALIDATION APPROACH
- Record version (and configuration of environment) and verify operation
against user requirements.
- Consider auditing the supplier for critical and complex applications.
PROCESS CONTROL SYSTEM EXAMPLES
Provided that ‘off the shelf’ solutions are
purchased rather than creating bespoke
toolkits:
Historical data viewers
Statistical analysis packages
Configuration management tools
Application development tools
Diagnostic tools
Eurotherm Life Sciences Group
24
GAMP Software Categories (4)
CATEGORY 4 – Configurable Software Packages
VALIDATION APPROACH
- Record version and configuration, and verify operation against
user requirements.
- Normally audit the supplier for critical and complex applications.
- Manage any custom (bespoke) programming as Category 5.
PROCESS CONTROL SYSTEM EXAMPLES
Control schemes configured from library
blocks
Simple mimics
Recipes
Eurotherm Life Sciences Group
25
GAMP Software Categories (5)
CATEGORY 5 – Custom (Bespoke) Software
VALIDATION APPROACH
- Audit supplier and validate complete system .
PROCESS CONTROL SYSTEM EXAMPLES
Sequence Function Charts
Custom reporting using SQL queries
Complex mimics running scripts
Eurotherm Life Sciences Group
26
GAMP Software Categories Spreadsheets / Tools
Special Considerations for Spreadsheets
Can fall into category 3, 4 or 5 depending on use.
Examples:
Category 3 – used purely to generate a paper document
Category 4 – more complex application involving templates
Category 5 – spreadsheet application using custom macros
Application Development and Diagnostic Tools
Can be bespoke or off-the-shelf
Validation requirements depend on software category and on
whether the tool directly supports the business process (eg
application builder) or only supports the development or
management of applications (eg configuration management tool)
Eurotherm Life Sciences Group
27
GAMP Hardware Categories
CATEGORY 1 – Standard Components
VALIDATION APPROACH
- Record model, version, serial number. Verify correct installation /
connection. Apply change control.
CATEGORY 2 – Custom Built Components
VALIDATION APPROACH
- As for standard components but also require a design
specification and acceptance test. Supplier may be audited.
Eurotherm Life Sciences Group
28
The Eurotherm GAMP Offering
AIM – to understand how Eurotherm
interprets the GAMP lifecycle and
software / hardware categories
Eurotherm Life Sciences Group
29
Example Architecture 1 – Control System
Ethernet
Eurotherm
Suite
Server /
Viewer
ALIN




Visual
supervisor
Profibus
2500 I/O
Eurotherm Life Sciences Group
30
Example Categorisation 1 – Control System
HARDWARE
PC
Eurotherm
Suite
Viewer
SOFTWARE
PC
Windows NT
Eurotherm Suite
Database,
Security,
Alarming,
Mimics,
Trending.
GAMP4 SOFTWARE CATEGORIESY
1 – Operating System
2 - Firmware
3 – Standard Software Package
4 - Configurable Software Package
5 - Custom Software
T800
T800

Visual
supervisor
Continuous Control
and mimics
Sequencing
GAMP4 HARDWARE CATEGORIES
1 – Standard Components
2 - Custom Built Components
2500 I/O
Eurotherm Life Sciences Group
2500
2500
31
Example Architecture 2 – Graphic Recorders
Ethernet
PC viewer
running
Bridge 5000


5180V
Eurotherm Life Sciences Group
Data PC
running
Review
5180V
32
Example Categorisation 2 – Graphic
Recorders
PC
Remote PC
Windows NT
(inc ftp server)
Windows NT
Review
Bridge 5000
5180V
5180V
Config
Config
Review
configuration
Recorder configurations shown as category 4
Also available treated as category 2 for simple
configurations only (no user screens, no maths channels)
Software
Categorisation
1 – operating system 2 - parameterised firmware 3 – ‘off the shelf’
Eurotherm Life Sciences Group
4 - configured
5 - coded
33
Project Deliverables Compared
Category 2 Graphic Recorder
PLANNING
AND
DEFINITION
Category 4 / 5 Visual Supervisor
Quality Plan
Standard Functional Spec
Standard IQ Spec
Produce
Hardware
Produce
Configuration
Functional Specification
SPECIFICATIO
N, DESIGN,
CONSTRUCTIO
N
Hardware
DS + TS
Produce
Hardware
IQ
Spec
OQ
Spec
Hardware Test
Module
FS +TS
Produce
Software
SW Module Test
DEVELOPMENT
TESTING AND
SYSTEM BUILD
Internal Test
Installation Qualification
Integrated Test
DESIGN REVIEW
& ACCEPTANCE
Factory Acceptance
COMMISSIONING
AND
QUALIFICATION
Installation Qualification
COMPLETION OF QUALIFICATION AND ONGOING OPERATION (TO CUSTOMER
PROCEDURES)
Eurotherm Life Sciences Group
End Slide