The life sciences are not like pens or bras. When a pen is manufactured incorrectly or suffers from shoddy inputs, a consumer just pulls out a different pen. When a life sciences product deviates from specs, be it a pharmaceutical or medical device, public health is affected and the defect might not even be readily observable.
This reality is why life sciences companies are regulated by the Federal Drug Administration (FDA), and it is why they must follow good manufacturing practices (GMP) so there is reliability, consistency, and traceability all along the manufacturing process. Part of the required FDA validation is ensuring that the software used by a life sciences business follows GMP and FDA regulations.
Initial and ongoing process validation is a requirement for businesses in the pharmaceuticals, medical devices, cell & gene therapy, and life sciences contract development and manufacturing business (CDMO) according to 21 CFR of FDA regulations. In 21CFR part 11, the FDA specifically defines the FDA validation process for the software used by a life sciences business.
The FDA validation process checks for the capabilities and proper configuration of several key areas in the software used by life sciences businesses.
1. Security and Control. Businesses must prove that the software handles data securely. This includes minimum password requirements and password expirations, automated log-outs, role-based access, and all the other security basics that limit access to a software system.
2. Process Validation and Controls. Businesses need to show that the software enforces the consistent processes a life sciences firm outlines as part of its larger FDA validation, and that workflows that require approval are strictly enforcing this approval.
3. Electronic Signatures. Each piece of master data needs timestamps and user access logs, as well as an audit trail of any changes that were made. Businesses must prove the software they use keeps track of when and by whom a piece of data was added or changed.
4. Good Manufacturing Practices (GMP). The software used must be validated to show that it conforms to GMP practices that will ensure consistency in the manufacturing process.
5. Product History Records. The software must be shown to keep track of each drug or medical device manufactured so everything produced can be tracked and traced in case there is an issue during manufacture.
6. Track and Trace. Beyond just a record of each product manufactured, the FDA validation in 21CFR part 11 requires that the software systems keep track of what went into the making of each product, where the product currently exists in a warehouse or where it was delivered, and any transaction involving the product.
7. Recall Management. Part of FDA software validation also includes proving that the system is capable of managing a product recall if it is necessary. If there is a quality issue, the software should be able to research, identify, and quarantine products that need recalling.
How to FDA Validate for Life Sciences Software
Software validation is all about proving that the computer systems a life sciences firm relies on meet FDA requirements. The process of software validation consists of identifying software systems that fall under FDA validation requirements (financial systems don’t need to be validated, for instance), testing to see that the software meets all requirements, and documenting the tests to validate the system.
Usually, a life sciences business works with a third-party validation firm to prove that its systems meet FDA requirements. The business configures the software to meet FDA requirements, and it documents all applicable processes. Then the validation firm tests and confirms that the software works as specified, much like a financial audit verifies accounting records.
When needed, validation firms also can provide guidance on the steps necessary to prepare for validation.
When to Validate Software and Re-validate It
Before a software system can be used in the manufacture of a life sciences product, it must be validated so the company can prove to the FDA the software meets the above requirements. If the software is modified, it must be re-validated.
The good news is that minor software updates do not require re-validation. The FDA is concerned with software modification that might potentially alter the above validation requirements while being mindful of the burden that validation can place on a business. So updates that alter functionality require re-validation, but minor updates such as security fixes do not.
This makes software upgrades tricky for life sciences businesses, especially in the age of the cloud when updates are often rolled out automatically to a business. ERP solutions such as SAP Business ByDesign conveniently sidestep this issue by enabling a business to selectively turn on new functionality instead of forcing it on customers, however. This helps life sciences businesses control when they change their software system and thus when they must re-validate.
Reducing the Time and Cost of FDA Validation
Life Sciences businesses must validate the software they use for making and distributing products. The software validation process can be significantly reduced with a turnkey solution that comes preconfigured for validation, however.
Navigator offers a range of prepackaged ERP solutions built on SAP Business ByDesign for various life sciences segments. These prepackaged solutions come preconfigured for the needs of FDA validation, making the process about documenting validation instead of configuring the system to meet these validation needs. This cuts the time and money needed to validate the software.
For more on FDA validation and ERP, learn about our validation services or watch our webinar on busting the myths of FDA validation.