Note: The views expressed in this article are those of the author and do not necessarily represent those of his/her employer, GxP Lifeline, its editor or MasterControl, Inc.
How many times have we read an observation like this by the U.S. FDA? "Your firm has failed to exercise appropriate controls over computer or related systems to assure that the input to and output from the computer or related systems of formulas, other records, or data, are checked for accuracy [21 CFR 211.68(b)]. For example, your firm's custom software for your Master Batch Production record, referred to as the 'I-131 Database,' has not been validated. This software is responsible for generating the batch production record, performing calculations to produce varying concentrations of drug product, and generating label information for customer vials and lead pigs."
In 2010, a similar statement was presented a total of 11 times as an observation to those regulated users under 21 CFR Part 211, which covers all operations of receipt of materials, production, packaging, repackaging, labeling, relabeling, quality control, release, storage and distribution for drug products for administration to humans or animals. If a computer system is carrying out functions to a product regulated by 21 CFR Part 211, the main section applicable for such computer system is Part 211.68.
Example of inputs that generate data to a computer system are thermocouple signals, timers, analytical test results, or the signals that a sensor feeds to the central processing unit (CPU) via a signal converter. An example of an output from a computer system is a signal generated that results in a form of mechanical action (valve actuation) or recorded data (generation of records). Some examples of a typical combination of inputs and outputs (I/Os) are computer systems, or supervisory control and data acquisition (SCADA), and program logic controllers PLC(s) exchanging data.
Specifically, PLCs are special purpose computers with a CPU, power supply, a programming panel and/or interface to a programming system, inputs, and outputs. PLCs provide the capability to support remote I/O, special purpose I/O, I/O housings, connection, cables, additional power supplies, communication boards, and so on.
The I/O's periodic accuracy verifications, required by the FDA, are very important. In one of the first significant cases, ICI and Glaxo were cited in 1990 for inadequate accuracy checks, I/O checks, and alarm testing. Since then, hundreds of regulated companies have been cited for not complying with this "modest" requirement.
This article covers one of the elements in 21 CFR 211.68(b)—I/O periodic accuracy verifications—applicable to computer systems, formulas employed to generate data on which quality decisions are based, and generation of electronic records and explains how to avoid receiving this observation.
Since 1978, 21 CFR 211.68(b) contains the following statement: "Input to and output from the computer or related system of formulas or other records or data shall be checked for accuracy."1 The interpretation rests on the availability of procedural controls and technologies to address and ensure the accuracy and security of I/Os during the lifecycle of a computer system.
I/Os periodic accuracy verifications, as required by 211.68(b), are applicable to computer systems exchanging data, data generated by formulas embedded in computer applications, and generation of e-recs on which quality decisions are made.
I/Os periodic accuracy verifications are elements of the periodic review and not the periodic review by itself.
Complementary to I/Os periodic accuracy verifications contained in Section 211.68(b), the FDA published in 1982 a Compliance Policy Guides (CPG) 425.400 (formerly CPG 7132a.07), "I/O Checking." According to this CPG, I/Os are to be tested for data accuracy as part of the computer system qualification and, after the qualification, as part of the computer system's ongoing performance evaluation program.
As part of the final rule for the drugs GMP regulation in early 1995, Section 211.68 was revised.2 The objective of this amendment was to make clear to the FDA regulated users the extent and frequency of scrutiny necessary to verify the accuracy of the computer systems and related systems I/O verifications. According to this revision, controls must be developed to prevent erroneous data I/Os. These controls to prevent erroneous I/Os are left up to the regulated user's discretion. The extent and frequency of the I/Os' periodic accuracy verifications must be guided by a written procedural control and based upon a variety of factors such as the complexity and consistency of the computer systems. This was, in my opinion, the beginning (in 1995) of a risk-based approach.
A broad verification and testing I/Os program must be implemented. During the computer system development, the I/Os verification may include design reviews, factory acceptance testing, commissioning, and qualification. An ongoing I/Os accuracy verification during the operational life shall be established and followed to verify hardware and software I/Os. Elements of the qualification testing are executed periodically to verify the correctness of the computer I/Os.
During the development of computer systems verification and qualification, test cases must be developed and executed to corroborate automated calculations of output data by using manual calculations.
Electromagnetic interference (EMI) may result in inaccurate or distorted input data to the computer. Therefore, peripheral devices, such as electrical power lines, motors, portable telephones, walkie-talkies, radio/TV broadcasts, and fluorescent lighting fixtures, should be made immune to EMI. Peripheral devices and signal transmission lines should be located as far as possible from sources of EMI. Shielding of signal transmission lines, grounding, filters, circuit design and proper design of the device's cabinet or housing are acceptable methods to prevent EMI. Testing on EMI must be performed and, if applicable, corrected.
During the qualification and operation of computer systems, test cases must be developed and executed to compare sensor indications with what the computer indicates. One method to verify the accuracy of an input field device is to force a known value and compare the value displayed on the screen.
Where computers are reporting events and controlling a function in real time, examine the time accuracy against a separate time piece. Accurate time keeping is especially important where time is a determinative, such as time-stamped events.
Undetected error, defective instrumentation or out-of-calibration instrumentation, for example, may also be the source of I/O errors after the qualification phase.
Computer systems exchanging data electronically with other systems should include appropriate built-in checks for the correct and secure entry and processing of data, in order to minimize the risks (EU Annex 11-5). For security purpose, the validity of the source of data input may be determined (Part 11.10(h), Device Checks).
Where critical data are being entered manually, there should be an additional check on the accuracy of the entry (ICH Q7 5.45).
Since 1978 there are regulatory requirements by the FDA on computer systems I/O periodic accuracy verifications.
A broad verification and testing I/Os program must be implemented during the computer systems development and as an ongoing verification during the operational life.
I/O errors can result in serious production errors and distribution of adulterated or misbranded products. Several recalls have, in fact, been conducted because of insufficient input/output checks.
The verification of outputs ensures that each reproduced record uses as input(s) reliable and accurate data.
Orlando Lopez is an independent consultant with 20+ years of information technology experience and more than a decade with QA and Compliance. He had managed a complete validation project at a medical device manufacturing facility, including facility, utilities, process equipment, R&D/QA laboratories, and processes (formulation and fabrication).
He established the computer validation initiative for compliance for multiple Johnson & Johnson companies such as McNeil and ITCS.
Recognized globally for expertise in computer system compliance, he was a member of the PDA Part 11 Core Team and the GAMP Infrastructure Special Interest Group. As part of the GAMP4 Guide, he led the development of the Operation Appendix O6, "Guidelines for Record Retention, Archiving and Retrieval." He has lectured globally, chairing several computer validation conferences.
He is the author of two books: "21 CFR Part 11 - "A Complete Guide to International Compliance," published by Sue Horwood Publishing Limited, and "Computer Infrastructure Qualification for FDA Regulatory Industries" published by Davis Healthcare International Publishing, 21 CFR Part 11 - A Complete Guide to International Compliance, published by Sue Horwood Publishing Limited (www.suehorwoodpubltd.com). Mr. Lopez may be reached at firstname.lastname@example.org.