regulatory expectations globally, including in the EU and UK.

1. Understanding Computerised System Validation

Computerised System Validation (CSV) is a crucial process ensuring that a computerized system consistently produces accurate and reliable data as per its intended use. The FDA describes validation as “establishing documented evidence that a system does what it purports to do”. Validation efforts should aim to ensure that the system adheres to predefined specifications throughout its lifecycle, which typically includes the following stages:

• User Requirements Specification (URS): Detailing the operational needs of the system.
• Functional Specification (FS): Outlining how the system will meet the URS.
• Design Specification (DS): Providing detailed design plans for the system.
• Installation Qualification (IQ): Ensuring that the hardware and software installation has been completed correctly.
• Operational Qualification (OQ): Validating the system’s operational functionality against the design specifications.
• Performance Qualification (PQ): Confirming the system performs as intended in the working environment.

Adhering to guidelines like GAMP 5, which advocates for a risk-based approach to CSV, particularly in the context of the Computer Software Assurance (CSA) strategy, can help streamline and enhance the validation process. The CSA approach emphasizes validating software systems based on risk assessment, ensuring that critical systems receive appropriate oversight while minimizing unnecessary validation burden on non-critical systems.

2. Importance of Periodic Review

The periodic review of validated systems is vital for maintaining compliance and data integrity throughout a system’s lifecycle. Regular assessments are necessary to ensure that systems not only operate as intended but also comply with current regulatory standards and evolving technologies. Inherent in the periodic review process is the evaluation of:

• Continued compliance with regulations, such as 21 CFR Part 11, which governs electronic records and signatures.
• Identifying any necessary updates to meet changing regulatory landscapes or technological advancements.
• Validation of system modifications to ensure they do not adversely affect data integrity and functionality.
• Assessment of cybersecurity controls to safeguard against threats that could compromise data integrity.

Additionally, the periodic review process should be documented meticulously, including the rationale for decisions made, findings identified, and actions taken. This documentation serves as evidence of compliance during inspections and audits by regulatory bodies. The FDA emphasizes that electronic records must be reliable, accurate, and consistent across the board, reinforcing the need for ongoing review.

3. Conducting a Periodic Review

The following steps outline a structured approach to conducting a periodic review of a validated system:

Step 1: Setting the Frequency of Reviews

Establish a schedule for routine reviews based on the complexity, risk, and importance of the system. For high-risk systems, more frequent reviews may be necessary, while lower-risk systems may require less frequent evaluations. Common practices suggest conducting an annual review but can be adjusted as per the specific needs of the organization.

Step 2: Assembling a Review Team

A multidisciplinary team should perform the periodic review, comprising members from quality assurance, IT, development, and operations. This diversity ensures various perspectives are considered, particularly concerning compliance, functionality, and performance metrics.

Step 3: Reviewing Documentation and Validation Status

Verify that all relevant documentation, including the URS, FS, DS, IQ, OQ, and PQ protocols, is current and complete. Confirm that any previous corrective actions have been addressed. Additionally, review any modifications made since the last validation to ascertain whether they necessitate a new validation cycle.

Step 4: Assessing System Performance

Assess the system’s performance against established metrics. This should include:

• Check for operational issues reported by users.
• Review system audit trails and logs for anomalies.
• Examine incident reports to identify patterns of failure or underperformance.

Document findings to address any identified concerns or potential risks proactively, reinforcing the ongoing commitment to compliance and data integrity.

Step 5: Ensuring Compliance with Cybersecurity Controls

In today’s digital age, cybersecurity has become an integral aspect of maintaining the integrity of computerized systems. The review should entail:

• Evaluating current cybersecurity measures against evolving threats.
• Ensuring that user access controls and authentication measures remain effective.
• Conducting penetration testing and vulnerability assessments to identify weaknesses.

Step 6: Documentation and Follow-up Actions

All findings and decisions made during the periodic review must be documented comprehensively. Recommendations or necessary corrective actions should be clearly outlined, with designated responsibilities and timelines for completion. This documentation will provide evidence of due diligence in case of regulatory inspections.

4. Decommissioning Validated Systems

Decommissioning a validated system requires careful planning and execution to ensure that data integrity is maintained and compliance requirements are satisfied even after the system is no longer in use. The following steps outline the decommissioning process:

Step 1: Evaluation for Decommissioning

Decide whether a system should be decommissioned based on factors such as:

• End of lifecycle or obsolescence of the technology.
• Redundancy after the implementation of a new system.
• Consistent underperformance impacting operational efficiency.

Step 2: Data Migration and Archiving Strategy

Prior to decommissioning, a thorough strategy for data migration and archiving should be formulated. This involves:

• Identifying critical data that needs to be transferred to new systems or archived effectively.
• Ensuring that the archived data is immutable and compliant with regulatory requirements concerning data retention, including timelines as outlined in FDA Guidance Documents.
• Establishing a plan for maintaining accessibility of archived data for future reference or audit purposes.

Step 3: Secure System Shutdown

Decommissioning a system should culminate in its secure shutdown to prevent unauthorized access. This includes:

• Revoking all user access to ensure that no further interactions are possible.
• Documenting the shutdown process and actions taken.

Step 4: Post-Decommissioning Review

After the decommissioning, carry out a review to ensure that all actions taken were aligned with compliance requirements and that no residual issues remain. This review encompasses:

• Confirmation that all data has been adequately transferred or archived.
• Assessing if any corrective actions remain outstanding.

5. Cloud SaaS Validation Considerations

As organizations increasingly adopt Cloud Solutions and Software as a Service (SaaS) platforms for operational purposes, the requirements for validation have evolved. Organizations must ensure that providers meet FDA expectations around compliance and data integrity. The key considerations include:

• Contractual Agreements: Ensure contracts with vendors include compliance with FDA regulations and clearly define expectations for both parties.
• Configuration Management: Validate the configuration of the cloud system to align with its use policy, ensuring it supports intended functionalities.
• Periodic Assessment of Vendor Controls: Regularly review cybersecurity controls utilized by cloud providers to provide assurance that data integrity is maintained.

Conclusion

Periodic review and the decommissioning of validated systems are critical components of a robust lifecycle management strategy within regulated environments. Adhering to FDA guidance and ensuring compliance with 21 CFR Part 11 is paramount in managing risks associated with electronic records and data integrity. By establishing a systematic approach towards these processes, organizations can uphold compliance, protect data integrity, and prepare for future regulatory landscapes.

Ongoing training and awareness within organizations about the importance of CSV, validation methodologies such as the GAMP 5 CSA approach, and maintaining a culture of compliance can reinforce the integrity of data management practices. Through continuous improvement, organizations can ensure they remain aligned with not only US regulations but also global best practices in pharmaceutical and clinical research.