COMPLIANCE ACCELERATED

White Paper:
Automating Document Control Processes to Comply with FDA and ISO Requirements: Increase Efficiency, Ensure Compliance and Improve Profitability

Creating a Paperless Process Using MasterControl

If you like our white papers, youll love our products. See what our customers say about MasterControl products.

White Paper
COMPLIANCE ACCELERATED

The purpose of document control systems is to ensure that manufacturers build products that are safe and reliable. ISO and FDA Current Good Manufacturing Practices (CGMP) presume that both the process and documentation that directs company processes follows pre-approved methods and that any change to these methods is restricted to authorized personnel and tracked for future review. All FDA-regulated and ISO-certified companies are mandated to have a document change control system. Inefficient document control systems cost FDA-regulated manufacturers millions of dollars. This significant loss in revenue can primarily be attributed to the inefficiencies that occur when using a paper/hybrid-electronic system. (Wherein document change control is managed in a manual fashion or using a combination of both paper and electronic files.) Manual systems are errorprone, delay a products time to market, and introduce product quality problems that can result in stringent regulatory penalties. In fact, the FDA cites inadequate change management as a major cause for Form 483 observations. Examples of common shortcomings include documents with missing dates or missing numbering schemes, uncontrolled copies and document changes without approvals or explanations. To eliminate these inadequacies, regulated companies are turning to electronic-based quality management systems. Todays quality management systems provide integrated solutions to handle everything from corrective /preventive actions (CAPA) through change control and training. This article will focus on document control processes within the quality system lifecycle and provide insight into the capabilities needed to automate change control processes that will increase efficiency, ensure compliance with FDA requirements and improve overall profitability. OVERVIEW To eliminate the problems FDA-regulated companies are being cited for during inspections and audits, a change management / change control software solution must incorporate the following capabilities: Compliance Management Document Management Revision Control Intuitive System Administration Tools General Users/Viewer Usability Open Architecture Complete Implementation and Validation Tools

COMPLIANCE MANAGEMENT In order to move from a manual, paper-based system to an electronic, automated system, manufacturers must follow the guidelines outlined in regulation 21 CFR Part 11 for using electronic records and signatures. These guidelines include the following: Multi-password access and signatureforced expiration - The FDA requires two distinct identification components for document compliant change control: one for login and one for document approval. Options should be available for configuring the length of the password and alphanumeric combinations to maintain the highest level of security for the system. Password expiration, encryption and certification are also necessary. Account and intruder lockout - An account should be automatically locked for both login and approval anytime a password or login is compromised. If any unauthorized attempt is made during either login or approval, the intruder lockout feature is activated (after the number of unauthorized login attempts or approval attempts has been reached). The system administrator should be able to customize the number of password attempts.

Automating Document Control Processes

White Paper
COMPLIANCE ACCELERATED

Figure 1 Change control as part of the quality management lifecycle Signature manifestation on the document - Signature manifestations are required for FDA regulated companies to meet Part 11 requirements and should be automatically appended to each document. Manifestations should include first name, last name, date, time and meaning of the electronic signature. Manifestations should also appear on all human-readable forms that are either viewed electronically or printed on paper. Change control rational - Changes made to document metadata should be tracked. (The Metadata contains document attributes like title, author, etc.) Each time a change is made to any metadata, a user must enter a reason for the change. The system must track each of these changes and make them available for review.

DOCUMENT MANAGEMENT Document management capabilities boost efficiency and ensure compliance by eliminating labor-intensive tasks like physically routing documents for approval, storage and distribution. Format agnostic - The system must be able to control any document regardless of the application used to create (e.g, Word processing, spreadsheets, CAD, video, audio) Document lifecycle management - Documents must be managed through their lifecycle statuses of Draft, Released and Archived. (See Figure 2) Lifecycles can be based on document type and need to automatically adjust document security based on lifecycle status. Audit trail history / record archiving - A secure, time-stamped audit trail of all changes made to any record should be maintained and accessible to the appropriate users and departments. All of this information needs to be automatically captured and secured. Reporting functionality would track past versions, metadata and approval history of the record, from the time it was created until the present.
3

Automating Document Control Processes

White Paper
COMPLIANCE ACCELERATED

Centralized, Secure Repository - Documents should be securely stored to ensure only authorized access, while making it easy to protect against disaster. Document cross-linking - In manufacturing environments, documents complement one another. For example, a form may be associated to a standard operating procedure (SOP), or an equipment manual associated with a maintenance drawing, etc. A document control system should allow document linking to provide users the relevant information needed to do their job.

REVISION CONTROL AUTOMATION Document revision control represents one of the most time-consuming tasks and one of the tasks that is most ripe for automation. When automating document control processes users will find that with the right solution they can accomplish the following: Ensure control of all document versions/revisions - Be able to present the currently released document, while simultaneously managing collaborative changes that will result in a new revision. Control rogue documents - A system should alleviate the consequences of uncontrolled electronic documents by enabling copies to Self Destruct after the configurable time allotted to the document expires. For example, a document that is saved outside the system and e-mailed to another person would be impossible to open 48-hours after it is copied from the system. Similarly, a system should offer capabilities to manage printed documents. Anytime a document is printed from the system, expiration dates and times should be automatically watermarked prominently on the document. Automate document routing, approval and escalations - Document routing and approvals should be automated to notify all approvers or collaborators in the authorization chain. Configurable, time-based escalation features can expedite approval and collaboration cycles in case users are too slow to act or are unavailable. Upon approval, old versions would automatically revision while users affected by the change are assigned a task be trained or retrained. (Training is addressed in a supplementary white paper available from MasterControl) Automatic document replacement (draft to release to archive) - As documents are approved old versions should automatically move to an archive vault and be replaced by the newest version. This eliminates any possibility of employees using the incorrect version. (See Figure 2) Unlimited pre-determined and ad-hoc routing steps - Routes for document collaboration or approval should be pre-configurable for use at anytime or added on the fly. Each step in a route can have one or many approvers assigned to it to allow for the creation of a combination of serial and parallel routing. Real-time, repeatable e-mail notification - Customizable e-mail notification should be provided to alert users in a route to take action of their specific tasks. Managers would be notified when tasks are completed to proactively monitor collaboration, change management, approval and training cycles. Electronic signature/approval history tracking - Managers should be able to view electronic signature details, approval history and cycle statuses as needed during the change management process. Automatic distribution upon approval - After the completion of approval cycles, documents should be automatically distributed to users affected by the change and old versions are archived. (See Figure 2)

Automating Document Control Processes

White Paper
COMPLIANCE ACCELERATED

Figure 2 - Document change control lifecycle INTUITIVE SYSTEM ADMINISTRATION TOOLS Easy to use system administration tools should be provided to comfortably manage the entire system: Easy to use route builder capabilities with visual drag-and-drop interface - System administrators should be able to easily build approval routes, thereby reducing the need for dedicated IT resources. Configurable user rights and roles - System administration tools to easily create a variety of individually tailored user and security roles should exist. For example, some users may only need limited find and view rights while others may need broad edit privileges. Managing these roles when adding users and passwords for login or electronic signatures within a centralized location improves usability and saves time. Automated conversion/publishing to PDF - Optional document publishing to PDF throughout the document lifecycle should be completely automated. PDF conversion from multiple document types into a common, unalterable format helps improve efficiency and reduce costs by eliminating additional desktop software that would be required for users to view documents. Advanced system reporting - A variety of standard and custom reports should be available like audit trail, master list, cycle time and revision history to proactively manage the system to provide peace of mind with audit and inspection preparedness.

Automating Document Control Processes

White Paper
COMPLIANCE ACCELERATED

Figure 3 - Route Builder - What you see is what you get (WYSIWYG), drag and drop GENERAL USER / VIEWER USABILITY A change control management system should provide users an intuitive interface to increase usability and system acceptance: Browser-based / thin client access A browser-based system provides industry standard connectivity, ease of use and company-wide access regardless of physical location. This helps connect remote employees, customers and supply chain members into the change management loop. These members can participate in processes like collaboration, document change, notification and training from any location. Full-text /metadata searching Capabilities to search either the metadata or the full-text of all the documents using any keyword or string of words should be available. Only a list of documents that both meet the search criteria and match user security rights become accessible. Boolean and wildcard search operators should be provided to narrow down search results. Finding documents through graphically linked groupings - The system should offer users a graphical interface to quickly find the information required to do their job. Similar to a Windows or Macintosh desktop tree, users should be able to point and click on folders that contain additional folders, projects and individual documents like work instructions, procedures, etc. Documents must be able to reside in multiple trees, to facilitate different user search logic, and automatically update upon revision to ensure that the most current document is always used.

Automating Document Control Processes

White Paper
COMPLIANCE ACCELERATED

OPEN ARCHITECTURE A change control system should provide system administrators a platform that is industry-proven and easy to deploy. Users need a familiar and intuitive interface to increase usability and system acceptance. Web-based - Internet-based systems provide users and IT managers alike a powerful, industry standard platform offering pervasive access and ease of use. With web-based solutions, companies can leverage industry-standard SSL and 128 bit encryption capabilities to secure the data communications that take place between the web browser and application, while still gaining the benefits of 24x7, anytime-anywhere access for authenticated users. Integrate with other applications - Open system architectures, platforms and industry-common SQL database technologies provide flexible integration gateways to other quality system applications like CAPA, training, etc. (See Figure 1) Integrating quality sub systems to work in tandem helps organizations leverage all the necessary data and information to improve decision making that progress product quality, ensure compliance and increase profits. Large corporate systems like MRP software can also be integrated to share information and data effected by changes in procedures, drawings, bills of lading, etc. Easy to use Graphical User Interface (GUI) An intuitive interface throughout the application allows system administrators to easily build visual routes and manage the system for collaboration and change management approval cycles. And, end users can quickly find the information they need. An easy to use GUI is an important ingredient for a successful implementation by improving overall system use and acceptance.

COMPLETE IMPLEMENTATION & VALIDATION TOOLS FDA-regulated companies looking for document control, change management or change control systems should search out applications that have complete services for implementation and validation. Training for IT managers, system administrators and general users - A variety of training should be available for system administrators, advanced users (PowerUsers) and general users (Viewers) that is mindful of the product, the industry, and the customers unique practices. Such training should be available at the vendors facility, at the customer site, live over the Web, and/or pre-recorded. Validation tools and services - Organizations should ensure the solution provider has been audited by similar companies within the appropriate industry and have a good user-base of references. Vendors should provide all the necessary validation tools and services for buyers to either perform their own validation or elicit complete services from the vendor. The vendors validation tools and services should follow Good Automated Manufacturing Practice (GAMP) guidelines for computer systems validation. Vendors that offer their own validation tools and services are more familiar with the system and can usually accelerate validation.

CONCLUSION FDA-regulated companies would agree that moving from a manual, paper environment to an electronic system for document control and change management is challenging. It is an endeavor that includes costs for upgrading IT infrastructures (if necessary), the training of users and the validation of the system. However, most, if not all of the companies that have made the transition can prove that the benefits of automation include a faster return on investment (ROI). More importantly, the automation of these change control tasks eliminate common errors that are cited in FDA 483 Observations yielded by companies using manual, paper-based/hybrid-electronic systems.

Automating Document Control Processes

White Paper
COMPLIANCE ACCELERATED

Related Videos

Reducing Risk with MasterControl Using MasterControl for FDA Compliance Using MasterControl for ISO Compliance
About MasterControl Inc.

MasterControl produces software solutions that enable regulated companies to get their products to market faster, while reducing overall costs and increasing internal efficiency. MasterControl securely manages a companys critical information throughout the entire product lifecycle. Our software is known for being easy to implement, easy to validate and easy to use. MasterControl QMS and QEM solutions include quality management, document management/document control, product lifecycle management, audit management, training management, bill of materials, supplier management, submissions management, and more. Supported by a comprehensive array of services based on industry best practices, MasterControl provides our customers with a complete information management solution across the entire enterprise. For more information about MasterControl, visit www.mastercontrol.com, or call: 1.800.825.9117 (U.S.); +44 (0) 1256 325 949 (Europe); or +81 (03) 6801 6147 (Japan).

2010 MasterControl Inc. All rights reserved. REV: 0010

Automating Document Control Processes

COMPLIANCE ACCELERATED

MasterControl Inc.
Corporate Headquarters:
MasterControl Inc. 6322 S. 3000 E. Ste. 110 Salt Lake City, UT 84121 United States Phone: 800.825.9117 Fax: 801.942.7088 www.mastercontrol.com

Asian Headquarters:
MasterControl KK Aios Akihabara 702 3-2-2 Ueno Taito-ku Tokyo 110-0005 Japan Phone: +81 (3) 6801 6147 Fax: +81 (3) 6801 6148 www.mastercontrol.co.jp

European Headquarters:
MasterControl Global Limited First Floor North Wing Matrix House Basing View Basingstoke RG21 4FF United Kingdom Phone: +44 (0) 1256 325 949 Fax: +44 (0) 1256 325 289 www.mastercontrolglobal.co.uk Germany Office Mendelstrasse 11 48149 Muenster Germany Phone: +49 (0) 251 980 2140 Fax: +49 (0) 251 980 2149 www.mastercontrol-global.de Email: [email protected]