Sharon Strause

Computer System Validation—

Definition and Requirements
Welcome to “Computer Validation Forum.” tently produce a quality result meeting its predetermined
This column discusses topics and issues associated specifications. Many will recognize this definition as an
with computer validation in order to provide a useful interpretation of the US Food and Drug Administration’s
resource for daily work applications. It provides infor- original process validation definition.
mation regarding regulatory requirements for the
validation and qualification of computerized systems. Components Of A Computer System
Computer systems are used widely in the daily work The components of a computer system include hardware,
structure of all the life science industries. Technical software, operating procedures, processes, and personnel.
considerations associated with computer systems and The Figure illustrates the areas required for consideration
the validation and qualification required are broad in the validation and qualification of computer systems.
and complex. Understanding the basic principles
supporting computer systems is fundamental to daily IMPORTANCE OF PROJECT MANAGEMENT
operations. Control and compliance are the key inte- A CSV project that meets budget, is implemented in a
grators for all computer systems in the life science timely fashion, and meets all the regulatory requirements
industries today. for the system must start with a formal project planning
Your questions, comments, and suggestions are process and a system development lifecycle (SDLC). These
required to fulfill the objective for this column. Please programs require both an experienced project manager
send your comments to column coordinator Sharon and a qualified validation manager. FDA has stated many
Strause at [email protected] or to journal coordinat- times, “Those who fail to plan, plan to fail.” Planning is
ing editor Susan Haigney at [email protected] a critical factor for the entire CSV project. If your com-
pany does not have a project management tool, there
KEY POINTS are many on the market which can be utilized to keep
The following key points are discussed in this article: track of multiple timelines, deadlines, personnel, critical
• The definition of computer system validation (CSV) meetings, and due dates.
• Project management and the software development There are many SDLC processes, which are used in vali-
lifecycle (SDLC) are the starting points dation—the waterfall model, the V-model, the “Onion”
• Requirements are the primary key to CSV model. It doesn’t matter what SDLC process is used as
• Other points to consider include US Food and Drug long as it begins with the development of the project and
Administration requirements, the overall quality pro- ends with the ongoing maintenance of the system once
cess, validation, and documentation. implemented. It also includes the ultimate retirement
of the system.
INTRODUCTION Once a project management team has been established
This first installment of “Computer Validation Forum” they can begin requirements gathering.
introduces a series on the subject of computer system
validation (CSV) by defining CSV, looking at the REQUIREMENTS
importance of project management, and specifying Requirements will determine the scope of the project. The
CSV requirements. validation and/or qualification should be the first major
deliverable for any computer system. Again referring to
THE DEFINITION OF CSV the Figure, requirements include the following:
Computer system validation establishes documented • Software. How the software is to operate.
evidence providing a high degree of assurance that a • Hardware. The hardware including the server
specific computerized process or operation will consis- • Controlling system. The operating system on

[
For more Author ABOUT THE AUTHOR
information, Sharon Strause is a senior consultant with EduQuest, Inc. Sharon may be reached at sastrause@
go to aol.com.
gxpandjvt.com/bios

Special Edition: Computer & Software Validation 1

Sharon Strause

the server and the

Figure: Areas for validation and qualification.
database used to Areas to be Validated
collect the data from the
software.
•E  quipment. Equipment
is other computer systems Software Hardware
1 2 Equipment
or pieces of manufactur- 4
ing equipment with which
the software may interact.
• Operating procedures Operating
Procedures and
and documentation. Documentation
These all have require- 5
ments that include peo- Controlling System Controlled Process
ple who will be doing the (Computer System) 6
3
work of validation, people
who will be trained to Total System
(Computerized System) …and
build the system, and peo- 7 all the links
ple who will be trained to between the boxes
Operational Environment
utilize the system once it 8
is in place.
•C  ontrolled processes.
Established controlled processes and change control the foundation of the overall project and the validation
need to be reviewed or addressed to ensure that con- required. CSV can be as simple as an Excel spread-
trol is maintained throughout the life of the project sheet or as complex as an enterprise resource system,
and for the ongoing stability of the system once vali- thus the reason for the critical nature of realistic and
dation and qualification is complete. testable requirements.
• Total computerized system. Networks may be Once testable requirements have been established,
local or wide area, may utilize the web, may be the project can begin; validation can be established; risk
within a corporate intranet or utilize the facilities evaluation can be started; and the goal of a validated and
of the Internet. qualified system can be reached.
•O  perating environment. Security will be
addressed as both a part of the operating environ- POINTS TO CONSIDER
ment, the software and operating systems on the Additional points should be considered in the valida-
hardware, and all interfaced equipment. tion and qualification of a CSV, including FDA require-
Another way of determining the requirements is to ments, quality process, validation checkpoints, and
ask the questions “who, what, why, where, and when.” documentation.
Answering those questions will make the requirements
gathering process easier and will help in determining the FDA Requirements
priorities of the system. FDA requirements regarding current good practices
Once the system requirements have been gathered, (CGXPs) are as follows:
the process of determining the regulatory requirements • Hardware is considered to be equipment within the
will begin (see Reference section). For what will the data meaning of the CGXP regulations
developed on the system be utilized? Regulations need • Software is regarded as records or standard operating
to focus on the purpose, use, and reporting of the data. procedures (SOPs) within the meaning of the CGXP
There may be regulations outside of FDA that will be regulations
impacted by the data. For example, in an enterprise • Software maintenance is considered revision or
resource planning system, data will be subject to finan- change control
cial regulations, possible Environmental Protection • Record controls require programs to ensure accuracy
Agency (EPA) regulations, possible Occupational Safety and security of computer inputs, outputs, and data
and Health Administration (OSHA) regulations, etc. • Record access requirements—available for inspection
Again requirements will help to determine the regula- and subject to reproduction.
tions required and ultimately the extent of the valida-
tion and qualification that will need to be done on the Quality Process
computer system. The quality process needs to be in place and should
Requirements gathering should take time, because it is include the following:

2  Special Edition: Computer & Software Validation

 Sharon Strause

• SDLC methodology • Installation plan and records

• Project planning • Training plan, procedures, and evidence of training
• Personnel qualifications • SOPs
• Documentation standards and procedures • User acceptance
• Methods for review and approval • Validation report
• Design standards • Retention of critical documentation.
• Programming standards
• Configuration management Documentation
• Testing standards and procedures Documented evidence should include the following:
• Separation of development, test, and production • Validation plan
environments (logical/physical) • Business and system function requirements
• Move to production process • System design specifications
• Clearly defined responsibilities • Validation protocol
• Involvement of customer/user, quality assurance • Test plans, scripts, results
professionals, and technology professionals • Documented development testing (i.e., unit, integra-
• Change management tion, system testing)
• Change control • Installation qualification
• Training process • Operation qualification
• Process for continuous evaluation, incident monitor- • Performance qualification
ing, and error correction • Validation report
• Processes and procedures for physical and logical • Standard operating procedures
security of system and data. • Manuals (e.g., development, user, support)
• Change records
Validation • Logs, operational records, audit results.
Validation checkpoints should be in place as part of
the overall project management process. Consider the
following: REFERENCES
• Evaluation, analysis, and rationale for system and 21CFR11, Electronic Records, Electronic Signatures.
its validation 21CFR210, Current Good Manufacturing Practice in Manufactur-
• Validation strategy ing, Processing, Packing, or Holding of Drugs: General.
• Business, system, and function requirements 21CFR 211, Current Good Manufacturing Practice for
• Detailed system design specifications Finished Pharmaceuticals.
• Validation protocol 21CFR820, Quality System Regulation. JVT
• Test plan
• Development testing and verification (structural, ARTICLE ACRONYM LISTING
unit, integration, and system) CGXP Current Good (ALL) Practices
• Vendor and supplier evaluations CSV Computer System Validation
• Hardware and software qualification (installation EPA US Environmental Protection Agency
qualification, operation qualification, performance FDA US Food and Drug Administration
qualification) GXP ALL Good Manufacturing Practices
• Procedures IQ Installation Qualification
• Utilization OQ Operational Qualification
• Administration OSHA Occupational Safety and Health Administration
• Maintenance PQ Production (Performance) Qualification
• Monitoring SDLC System Development Lifecycle
• Change management
• Change control

Originally published in the Spring 2009 issue of Journal of Validation Technology

Special Edition: Computer & Software Validation 3