A Risk Based Approach to Compliant GxP Computerized Systems.

If you haven’t read part 2 “Assessing System Requirements” click here to read now!

Design and Configuration

System Architecture:  

The system architecture employs User Requirements and Functional Specifications as foundational elements to create a detailed system blueprint. This blueprint, akin to an architectural plan for a house, provides stakeholders with a conceptual view of the system but is not sufficient for actual construction. It outlines the intended structure without specifying the exact construction methods. GAMP® 5 offers guidance on transforming these User Requirements and Functional Specifications into a comprehensive blueprint. This blueprint then serves as a schematic for the technical design of the system, integrating all specified requirements.

Configuration and Customization:

GAMP® 5 Second Edition delineates the differences between customization and configuration. Although the terms may appear similar, the distinction between a custom-built system and a configurable system is significant. For custom-built systems, regulatory agencies have higher expectations regarding documentation and evidence that the system is performing as intended.

Data Migration:

As new systems evolve and become commercially available, it is common to transfer data from an existing system to a new one. Data migration involves several considerations that might not be immediately obvious. Each piece of data carries specific attributes known as metadata, which define its characteristics. Therefore, transferring data from one validated system to another is more complex than simply moving an object from one location to another; it involves detailed planning and adherence to stringent requirements.

A comprehensive migration plan should address several key questions:

• At what stage is the data in its lifecycle process?
• Is there a data map outlining the relationship between the source and target data locations?
• What is the migration verification process? How will you confirm that all data has been accurately transferred?
• Are there any data connections to consider? How will interoperability with other systems be ensured, and will the data format be compatible?
• Is there an audit trail and how far back does it go?

The migration plan is crucial for identifying all necessary factors, and the GAMP® 5 Second Edition provides essential guidance to help develop this plan.

Documentation:

The phrase “If it’s not documented, it didn’t happen” is a well-known maxim in the pharmaceutical industry, emphasizing the critical importance of documentation. However, the notion that one cannot have too much documentation is misleading. Excessive documentation can indeed be counterproductive and potentially introduce inconsistencies and confusion.

The GAMP® 5 Second Edition provides guidelines on the appropriate level of documentation based on the type of system being implemented or modified. For instance, a simple Commercial Off the Shelf (COTS) solution might require only basic validation documentation, such as a Validation Plan, User Requirements, User Acceptance Testing, and a Validation Summary Report. In contrast, a more complex or custom system demands extensive documentation following a risk assessment. This could include a Validation Plan, User Requirements, Functional Specifications, a Migration Plan, a Traceability Matrix, among others.

The key is the Risk Assessment, which helps determine the necessary documentation and assigns responsibility for its completion and approval. This approach ensures that documentation is both efficient and adequate for the system’s needs.