Questions & Answers on EU GMP Guideline Annex 11 "Computerised Systems" - chapter 4

Since 30 June 2011 the industry has been to implement all requirements of Annex 11 "Computerised Systems" of the EU GMP Guideline. Within the context of the Conference on Computer Validation from 8 - 9 June 2011 in Mannheim, inspectors and industry experts have answered questions concerning the 17 chapters of Annex 11. You will find questions and answers on chapters 4 "Validation" below - answers were provided by Dr. Arno Terhechte, Bezirksregierung Münster,  and Eberhard Kwiatkowski, BAYER Pharma AG.

4. Validation
Annex 11 states: "4.1 The validation documentation and reports should cover the relevant steps of the life cycle. Manufacturers should be able to justify their standards, protocols, acceptance criteria, procedures and records based on their risk assessment.
4.2 Validation documentation should include change control records (if applicable) and reports on any deviations observed during the validation process.
4.3 An up to date listing of all relevant systems and their GMP functionality (inventory) should be available.
For critical systems an up to date system description detailing the physical and logical arrangements, data flows and interfaces with other systems or processes, any hardware and software pre-requisites, and security measures should be available.
4.4 User Requirements Specifications should describe the required functions of the computerised system and be based on documented risk assessment and GMP impact. User requirements should be traceable throughout the life-cycle.
4.5 The regulated user should take all reasonable steps, to ensure that the system has been developed in accordance with an appropriate quality management system. The supplier should be assessed appropriately.
4.6 For the validation of bespoke or customised computerised systems there should be a process in place that ensures the formal assessment and reporting of quality and performance measures for all the life-cycle stages of the system.
4.7 Evidence of appropriate test methods and test scenarios should be demonstrated. Particularly, system (process) parameter limits, data limits and error handling should be considered. Automated testing tools and test environments should have documented assessments for their adequacy.
4.8 If data are transferred to another data format or system, validation should include checks that data are not altered in value and/or meaning during this migration process."

(Q) What is the definition of "relevant systems"?
(A) Relevant / Substantial systems are systems used in order to implement or assist GMP requirements. These systems can be identified within the context of a risk analysis (also supporrted by a questionnaire).

(Q) Is there a definition for "critical"?
(A) No, but Annex 11, chapter 1 gives an indication. Critical systems are systems that directly or indirectly influence patient safety, product quality and data integrity.

(Q) How exact must GMP functionalities be described in the inventory?
(A) Only relevant to GMP - yes/no. In the inventory, a description of the general functions is sufficient, i.e. archiving of data, parts list management etc. Detailed information can be found in the system description.

(Q) In what way can the URS be created on the basis of a risk analysis if the risk analysis requires an URS as a pre- requisite?
(A) URS and risk analysis are two elements within the context of validation of computerised systems which are closely linked with each other. Requirements can result from a risk analysis but on the other hand it is possible to reach functional solutions on the basis of user requirements on the assessment of risks.

(Q) Data flows - does this also mean intersystem interfaces (for example, the interfaces between different modules in ERP- systems)?
(A) Every intersystem interfaces also need to be described, including any relevant change of data format.

(Q) Must all user requirements be traceable or only the ones classified as being GMP-relevant?
(A) User requirements, especially those classified as being GxP-critical should be traceable in order to evaluate whether the computerised system is fit for the respective purpose.

(Q) What levels of control are expected when using automated test tools?
(A) The level of control results from the criticality of the systems tested and the type of test tools used. A complete validation is not generally expected.

(Q) What should test scripts and test results look like in order to be accepted by the inspectors?
(A) Test scripts should contain a specification (expected result) and a description (test performance). The test result should indicate whether the specifications are fulfilled. Failed tests must be evaluated.

Questions and answers with regard to chapters 5 through 17 will be published in the coming issues of the GMP Journal.

The new Annex 11 "Computerised Systems" is the main topic of the "ECA Computer Validation Conference - The new annex 11" from 15-16 May 2012 in Copenhagen. 5 European inspectors and 7 industry representatives will discuss the consequences for the European healthcare industry. 

Compiled by
Dr. Andreas Mangel
CONCEPT HEIDELBERG (a service provider entrusted by the ECA Foundation)

Sources:
EU-GMP Guideline Annex 11
EMA Q+A to Annex 11