GMP and critical Computerised Systems

During GMP inspections, inspectors should first look at the GMP-critical systems. According to EFG 11's AIM (German only) (Aide-Mémoire of EFG 11 - Monitoring of computerised systems), critical systems should be given priority. The problem, however, is the identification of critical systems. Neither the EU GMP Guideline nor Annex 11 or Annex 15 give any guidance on the identification of critical systems. In EU-GMP Annex 11 there is only a reference to critical systems:

"4.3 ... For critical systems an up to date system description detailing the physical and logical arrangements, data flows and interfaces with other systems or processes, any hardware and software pre-requisites, and security measures should be available."

This inevitably also means that the company needs a system to determine the criticality of computer-supported systems, i.e. it creates a corresponding SOP for this purpose.

Taking a look at the system landscape in a GMP operation, it is difficult to describe an assessment of the criticality of the systems. Here are some examples:

• ERP/MES 
• Warehouse management systems 
• Production systems (automation technology) 
• Weighing systems 
• Training management 
• Calibration and maintenance management 
• Packaging line and labelling 
• Quality control systems (e.g. LIMS, HPLC, IR, ...)
• Quality assurance systems (e.g. SOP management, deviation management) 
• Archiving and backup systems 
• WFI system 
• Mixers, homogenisers 
• Calibration software for pipettes 
• Steam steriliser 
• and much more

Which of these systems are non-critical? Are there any non-critical GMP-relevant systems at all? Or should we perhaps assess criticality differently (low, medium, high)?

We find an important hint in the German AMWHV (Arzneimittel- und Wirkstoffherstellungsverordnung) in § 2 Definitions.

For the purposes of this regulation - "19. critical equipment or devices are those that may come into contact with the products or may otherwise have an influence on the quality or safety of the products." .

The first half-sentence is quite clear. For "or may otherwise have an influence on the quality or safety of the products" a risk assessment is helpful. PIC/S PI 041 also helps here and gives some examples:

• systems used to control the purchasing and status of products and materials;
• systems for the control and data acquisition for critical manufacturing processes;
• systems that generate, store or process data that is used to determine batch quality;
• systems that generate data that is included in the batch processing or packaging records; and
• systems used in the decision process for the release of products

EFG 11's AIM also helps us here. It specifies the following critical systems:

• Systems that control production processes at the field level (e.g. reactor control, filling line, mixer). 
• Systems that control higher-level processes (PLS, MES) 
• Systems that control production processes in the immediate production environment (e.g. RLT systems, CIP/SIP processes, systems for the production and distribution of WFI or aqua purificata) 
• Systems in the area of IPC and quality control (multifunction testers, HPLC systems, CDS, LIMS, ELN)

With the help of this guidance, we have already received a lot of help in identifying critical systems.

The inspector will find further interesting information in the Aide Memoire INSPECTION OF DATA MANAGEMENT AND INTEGRITY (PIC/S PI 049-1). The document practically presents an implementation of PI 041-1 in question form, but without reaching its level of detail. Unfortunately, this document is not public, so that direct extracts are not available. However, the following remarks can be made.

The document contains an appendix in which one can find information on determining the risk (criticality) of systems. Using a flow chart, an attempt is made to divide systems into four risk classes.

• Class 4 are non GMP-relevant systems 
• Class 3 are systems with low priority 
• Class 2 are systems with medium priority. They have an indirect influence on product quality and patient safety. 
• Class 1 are systems with high priority. They have a direct influence on product quality and patient safety.

In the author's opinion, this is also an error in thinking. Indirect influence does not necessarily mean lower risk. Both direct and indirect influence can affect quality or patient safety. The decisive factor is always the "intended use". This also follows from the second half-sentence of § 2 of the German AMWHV in the definitions ("or may have another influence on the quality or safety of the products").

However, one important point can be taken from the flow chart in PIC/S PI 049-1, that there are no GMP systems that are uncritical.