Guidelines/Regulations that apply to the pharmaceutical and medical device industry

Code of Federal Regulation Title 21

➔ 21CFR Part 11: Electronic records and signatures
◆ for computer systems or equipment
➔ 21CFR Part 210: Current good manufacturing practices in manufacturing,
processing, packaging, holding of drugs (human health)
◆ definitions
➔ 21CFR Part 211: Current good manufacturing practices for finished pharmaceuticals
◆ for companies
◆ production of medicine
➔ 21CFR Part 820: Medical devices
◆ quality system regulations

ISO
➔ ISO 13485: Medical devices
◆ quality management systems
◆ requirements for regulatory purposes
◆ for organizations involved in the design, production, installation and servicing
of medical devices and related services
➔ ISO 14644-1: Classification of air cleanliness and associated controlled environments
◆ for HVAC systems

Good Automated Manufacturing Practice 5

➔ GAMP5: A Risk-based Approach to Compliant GxP Computerized Systems
◆ for the methodology/strategy of computer system validation
COMPUTER SYSTEM VALIDATION
Confirmation by examination and provision of objective evidence that the particular
requirements for a specific intended use can be consistently fulfilled

Intended use: when performing a validation, its focus should be on the intended use of the
system or process

Software categories:
➔ GAMP Category 1: Layered software, software used to manage the operating
environment
◆ It supports or runs diverse applications
◆ Operating systems in general (Windows, iOS, Linux)
➔ GAMP Category 2: Custom built hardware components
◆ USUALLY NOT PERFORMED
◆ For camera, computer, mouse, etc.
➔ GAMP Category 3: Non Configured, software cannot be configured to suit the
business process
◆ Commercial software; people buy it, install it and use it
◆ Not adaptable to the needs of the user
◆ Office (Word, Powerpoint)
➔ GAMP Category 4: Software, often very complex, that can be configured by the user
to meet the specific needs of the user’s business process
◆ Base software
◆ ERP, ORACLE, SAP, Excel spreadsheets
➔ GAMP Category 5: Custom, software custom designed and coded to suit the
business process
◆ Usually made and designed from scratch, according to the needs of the user;
nobody else can use it
◆ Code

V-Model strategy:
Category 3:
User requirements → Non configured product → PQ/Validation plan testing

Category 4/5:
User requirements → Functional specification → Configuration specification → Code review
→ IQ/Validation plan testing → OQ/Verification plan testing → PQ/Validation plan testing

Documentation:
Category 3:
➔ Software Validation Master Plan (SMVP)
➔ Software Validation Applicability (SVA)
➔ User Requirements Specification (URS)
➔ Software Installation Qualification plan in production environment (SIQ Production)
➔ Software Installation Qualification report in production environment (SIQ Production)
➔ Performance Qualification / Validation plan (PQ)
➔ Performance Qualification / Validation report
➔ Software Validation Master Report (SVMR)
Category 4/5:
➔ Software Validation Master Plan (SMVP)
➔ Software Validation Applicability (SVA)
➔ User Requirements Specification (URS)
➔ Functional Requirement Specification (FRS)
➔ Functional Risk Assessment (FRA)
➔ Design Specification (DS)
➔ Code review (CR)
➔ Software Installation Qualification plan in test environment (SIQ Test)
➔ Software Installation Qualification report in test environment
➔ Operation Qualification / Verification plan (OQ)
➔ Operation Qualification / Verification report
➔ Software Installation Qualification plan in production environment (SIQ Production)
➔ Software Installation Qualification report in production environment (SIQ Production)
➔ Performance Qualification / Validation plan (PQ)
➔ Performance Qualification / Validation report
➔ Software Validation Master Report (SVMR)

Master plan:
➔ Document that structures and describes the software, the intention of use, the roles
and responsibilities, how to perform the validation, the strategy to follow according to
the GAMP5 category of the software and the deliverable documents
➔ It can also explain how many softwares are used in the company/project

Software validation applicability:

➔ Document that justifies if the software/system or changed to be made are required to
be validated or not
➔ It is determined by the guidelines (part 210, 211 and 820) and regulations (ISO
13485) and the intended use
➔ If any question is answered “yes”, the software/system needs to be validated
➔ Elaborated by the subject matter expert, quality, developers, validation, etc.

User requirement:
➔ Requirements to be satisfied based on the intended use of the system
➔ Clear, not vague and testeable
➔ Elaborated by the subject matter expert of the area or process that requires the
software, but user gives us the expectations
➔ References - regulations (820, GAMP5), SMVP and SVA

Functional specification:
➔ How the system functions satisfy the user requirements
➔ Each user requirements can have one or more functionalities that help the system
execute the user requirements
➔ Each functionality must be linked to a user requirement; an identifier is assigned to
the user requirement that its linked
➔ Clear, not vague and testable
➔ Elaborated by subject matter expert/developer that develops the solution
➔ References - user requirements
Functional risk assessment:
➔ Functionalities are evaluated for risk analysis
➔ The risk, possible failure scenarios and focus validation efforts on high impact
functionalities are defined
➔ Run test scenarios - positive (correct) and negative (wrong); these detect failures in
the system and possible mitigation actions
➔ Low risk - only perform positive test
➔ Medium/High risk - perform positive and negative test
➔ Probability (given by expert/developer) vs Severity (given by user)
➔ Elaborated by all experts (manufacturing, quality, etc.), development/support team
and validation
➔ Fail mode - given by developer on how the system can fail

Design specification:
➔ How the system design satisfies the functionalities of the system; how the developed
solution will look like
➔ Each design specification must be linked to a functional specification; an identifier is
assigned to the functional requirement that its linked
➔ Clear, not vague and testable
➔ Elaborated by subject matter expert/developer that develops the solution
➔ References - user requirements, functional requirements

Configuration review:
➔ Checklist of the solution code developed
➔ Comply with good practices of software development, clear, without dead code and
without sections of code in comments
➔ Once performed and approved, no modifications are allowed without prior
authorization
➔ Run in OQ and PQ

IQ / Installation plan (Verification environment):

➔ Purpose of installation plan, scope to be covered and steps to be followed to install
and configure the software/hardware
➔ Developed by subject matter expert/developer
➔ Reviewed and approved by the developer, quality team and user
➔ Once approved, the execution can begin
➔ References - code, design specification
➔ Take screenshots to prove that the requirements are met

OQ / Installation plan (Verification environment):

➔ Verification that operation is according to written and pre-approved specifications
➔ Testing/verification against specifications to demonstrate correct operation of
functionalities
 ➔ Negative scenarios are challenged to verify the capability of containing of high risk
scenarios
➔ References - IQ report, functional requirements

Traceability matrix:
➔ Requirements are addressed and traced to the appropriate functional and design
elements in the specifications, so requirements can be traced to the appropriate
verification
➔ Can assist the assessment and management of change
➔ Should be focused on aspects critical to patient safety, product quality and data
integrity

IQ / Installation plan (Production environment):

➔ Verification that a system is installed according to written and pre-approved
specifications
➔ Checking, testing or other verification to demonstrate correct installation and
configuration of software/hardware
➔ Prove that the test doesn’t affect the manufacturing process

PQ / Validation plan:
➔ User requirements of the system are tested in production environment to
demonstrate that it is secure for production use
➔ Negative scenarios are not tested, they were already tested in OQ
SISTEMAS DEJADOS DE TAREA
➔ LIMS ➔ SOX
➔ ERP ➔ ALM
➔ EAM ➔ EDHR
➔ MES ➔ Shop floor

SOX → financial record management system

➔ Record, save and manage all the financial transactions
➔ GAMP category 4

ALM → application lifecycle management

➔ Supervision of a software application from its inception all the way through to its
retirement; real-time collaboration
➔ GAMP category 5

ERP → enterprise resource planning

➔ Automate and manage core business processes for optimal performance
➔ Keeps all information in one place (financials, supply chain, operations, commerce,
reporting, manufacturing, human resources, etc.)
➔ Most commonly used to track
➔ GAMP category 4

MES → manufacturing execution system

➔ Monitors, tracks, documents and controls the process of manufactured goods (raw
material to finished product)
➔ Production process tracking
➔ GAMP category 4

LIMS → laboratory information management system

➔ Manage samples and associated data
➔ Track and store information about a sample from entering a lab to until it has
undergone processing (biological sample to meaningful result)
➔ GAMP category 4

Shop floor
➔ Easy-to-read front-end to show manufacturing performance, efficiency, quality details
and current activities developed
➔ Real-time production status, inventory and warehouse management and
adjustments, documentation, quality
➔ GAMP category 4

EAM → enterprise asset management

➔ Manage, plan, optimize, execute and track the status of the assets and maintenance
activities needed
➔ GAMP category 4
EQUIPMENT QUALIFICATION
Qualification:
➔ Verify that equipment is functioning properly and produced the intended results
➔ More complex PQ than CSV

Documents:
➔ Validation master plan
➔ Qualification plan
➔ URS (User Requirement Specification)
➔ FS (Functional Specification)
➔ Functional Risk Assessment (FRA)
➔ DS (Design Specification)
➔ FAT (Factory Acceptance Test)
➔ SAT (Site Acceptance Test)
➔ Commissioning
➔ IQ (Installation Qualification)
➔ IQ-R (Installation Qualification Report)
➔ OQ (Operation Qualification)
➔ OQ-R (Operation Qualification Report)
➔ PQ (Performance Qualification)
➔ PQ-R (Performance Qualification Report)

Validation master plan:

➔ Contains company’s data, describes the validation project and responsible general
procedures, validation protocols and reports

Qualification plan:
➔ Equipment and its intention of use is described
➔ Validation strategy according to GAMP5
➔ Similar to CSV, due to presence of control systems like embedded software/PLC

User requirement specification:

➔ Requirements to be satisfied based on the intended use
➔ Elaborated by subject matter expert (company)

Functional specification:
➔ How the system functions satisfy the user requirements
➔ User requirements can have one or more functionalities
➔ Functionalities are linked to a user requirement by identifier
➔ Elaborated by subject matter expert (manufacturer); you have to check with them if
the functionalities satisfy the user requirements
➔ Which component satisfy the user requirement

Functional risk assessment:

➔ Focused on components
➔ Risk analysis evaluates each functionality to know the possible failure scenarios and
focus validation efforts on those of high impact
➔ Probability vs severity
 ➔ Run tests - positive (correct) and negative (wrong); to detect failures in the system
and implement mitigation action
➔ Elaborated by experts in use of the system (manufacturing, quality, etc.)
development/support team and validation
➔ Diverse fail modes

Design specification:
➔ Material and how components work
➔ How the system design satisfies the functionalities
➔ Each must be linked to a function specification
➔ Clear, not vague and testable
➔ Elaborated by subject matter expert/manufacturer

Factory acceptance test (FAT):

➔ Verify new and packaged equipment meets its purpose
➔ Validates the operation of the equipment
➔ Make sure all specifications and requirements are met
➔ Scope - acceptability and credibility of the equipment
➔ Performed by manufacturer through pilot test on their site
a. Planning
b. Documentation
● Compile reference documents given by the manufacturer
c. Testing
● Raw data taken, recorded and submitted review drawings, NDT,
procedures of transport/storage

Site acceptance test (SAT):

➔ Final confirmation that performance in FAT is repeated after installation onsite,
ensuring no change or damage
➔ Full functional testing after installed and integrated with support system
➔ Performed by access control system (ACS) engineer

Commissioning:
➔ Assuring all systems and components of a building/plant are designed installed,
tested, operated and maintained according to the operational requirements
➔ Also for existing units and systems subject to expansion, renovation or revamping

Installation qualification (IQ):

➔ Has been installed according to its design specifications, recommendations and
complies with good manufacturing practices
➔ Derivable test documents
◆ Documentation ◆ Drawings
◆ Physical aspects ◆ Components
 ◆ Construction materials ◆ Diagrams
◆ Installation site ◆ Backup, configuration and
◆ Instrument calibration software structure
◆ External services ◆ Power circuit protection
◆ Hardware configuration ◆ Physical/local security
◆ Control cabinet heat
dissipation

Operation qualification (OQ):

➔ Equipment is operating in accordance with its functional specifications and good
manufacturing practices
➔ Test of functions; more standardized tests than in CSV
➔ Derivable test documents:
◆ Training ◆ Power failure test
◆ Standard operating ◆ Communication failure
procedure (SOP) ◆ Backup and restoration
◆ Personnel qualification ◆ Software security
◆ Preventive maintenance ◆ Sequence of operation
◆ Control system inputs and ◆ Limit or boundary levels
outputs ◆ Electromagnetic
◆ Screen configuration and levels/radiofrequency test
navigation ◆ Reports, records and/or
◆ Testing of alarms and audit trail
interlocks
Performance qualification (PQ):
➔ Focused on the intended use of equipment
➔ Evaluated integrally, demonstrating it has the capacity to consistently provide
product/service according to user requirements/regulations
➔ Statistical studies for PQ tests:
◆ AQLs (Acceptance Quality Levels/Limits): Cartoner, blister (grosor del
plástico de blister), liofilizador (freeze dryer, solo de proceso de secado)
únicamente visuales
◆ CP: Stands for "process capability" and measures the ability of your
manufacturing process to produce a product within specification limits
◆ CPK: Stands for "process capability index" and measures how close your
manufacturing process is to the center of the specification limits
◆ Experimentos binomiales: Introducir unidad de producto trampa para verificar
si se rechazan por no cumplir con la condición; comunes en sistemas de
peso o visuales (cartoner, labeler, verificadora de peso, blister)
◆ Diseño de experimentos: Matriz de combinaciones para identificar la mejor
opción, en función del ANOVA (comparar todo) para seleccionar el método
de mejor rendimiento
 EQUIPOS DEJADOS DE TAREA
➔ Cartoner ➔ Biosafety cabinet
➔ Weigher checker ➔ Freeze drying
➔ Blister packaging ➔ Autoclave
➔ Sleever ➔ Labeling

Equipment IQ OQ PQ

Cartoner Documents & Drawings Sealing system (verify that

verification (drawings are the Rollers are heated to the
available, verify that required temperature to seal
installation is in the the box)
appropriated space, drawing Cutting system (verify that
corresponds to the physical the
installation)
Verification of the technical
specifications for in-house
& subcomponents (confirm
that the components are
present and tagged as per
specifications and drawings)
Utilities verification
(electrical, compressed air
connections & cooling water
font)
Material of construction
verification (the construction
material meets the Design
Qualification and the material
testing certificated are
provided by the manufacturer)
Critical Instrument
Calibration Verification (all
critical instruments have been
calibrated before starting the
OQ)

Weight Verify that the weighing Repeatability test (repeatedly Weight Variation test (Verify
checker balance is securely anchored weighting to check that the weight variation
and shock proof consistency) complies with the user
Verify that all electrical Corner Load test (a load is requirements, using 3 samples
connections are done properly weighed on all 4 sides of the at different machine speeds
and that they’re safe weighing area) (rpm))
Equipment is vibration free Accuracy test (different
That is no observable damage masses ranging from minimum
load to max load are weighed
for accuracy)
Blister Testing of programmable Verification of rejection of
packaging logic controller’s processor blister without product (All
PLC (Verify by observation the empty blisters shall be rejected
normal operation of the by the system)
processor module’s LED Verification of rejection for
status indicator after turning broken units
on) Verification of rejection of one
Verification of Man-Machine empty pocket
Interface Screens (verify that
all of the functions on each
screen is according to the
manual)
Power & Emergency Failure
Recovery Verification (verify
that in the event of a power
loss or communications failure,
the equipment will stop in safe
conditions)
Emergency Operation
Verification (verify that the
equipment will be inoperative
in case of an emergency stop)
Alarms Verification (verify
the alarms function and
respond according to the
system design)

Sleever

Biosafety Utilities verification Initial certifications (Prior to Airflow smoke pattern test
cabinet (electrical services, gas use a qualified certifier tested (ensure that the system in an
services specifically to Valves) the cabinet) aseptic area provides an
Verification of the technical Alarm conditions and their unidirectional airflow using a
specifications for in-house & expected results dry ice/Titanium chloride torch,
subcomponents (Damage and watching the smoke flow
claims occurred while in transit being unidirectional up to the
or within the building) working height)
Connecting to an Exhaust HEPA Filters Leak test (using
System (verify if a qualified the PAO/ DOP liquid
installer has completed the penetration through the filter
connections to the BSC) media and obtaining a result of
Hygienic Hermetic Finish less than 0.01% to test
efficiency)
UV radiation intensity test
(determines the energy output
of the UV lamp’s sufficiency in
killing the microorganisms
 within the cabinet’s work)
Vibration Test (determines
the amount of vibration in an
operating cabinet using a
vibrating testing meter)

Freeze Leak test (using a placebo run Sensor calibration (to ensure
drying verify that the sealing and the equipment is reaching the
capping phase is done specified temperatures)
correctly and the finished Vacuum system (to verify that
product has no leaks) the pressure can be achieved
Temperature and relative from ambient conditions)
humidity test (demonstrate
the ability of the system to
provide a Temp and RH within
a specified range/to help verify
that the moisture of the sample
is removed by the correct
process of sublimation w/Data
Logger equipment)

Autoclave Utilities verification Empty chamber temperature Same as OQ but in dynamic

(electrical, Steam pressure, mapping conditions
Water pressure,compressed Simulated load chamber
air pressure) temperature mapping and the
Documents & Drawings verification of the sterilization
verification (verify that efficiency using biological
installation is in the indicators
appropriated space, that i has Alarm conditions and their
a biosafety barrier and a expected results
seismic anchoring; drawing
corresponds to the physical
installation)

Labeling Power & Emergency Failure Camera testing:

Recovery Verification (verify No label test (Verify that the
that in the event of a power sensors are working by setting
up a no container-no
loss or communications failure,
label test, to avoid label
the equipment will stop in safe wasting)
conditions) Rejection for broken units
Emergency Operation (Verify that the sensors reject
Verification (The labeler will all broken labels)
stop automatically upon loss of DoE (heating tunnel, plastic
electricity, air, or other major shrinks uniform into the
container)
utility and will require operator
intervention to re-start)

HVAC Air velocity measurement Temperature and relative

system and calculation of air humidity test (demonstrate
changes (measure the air to the ability of the system to
verify that it’s balanced and provide a Temp and RH within
capable of delivering air a specified range Datallogger
velocity changes per hour) equipment)
Integrity (leak test) of the No viable particle test
HEPA Filters (using the PAO/ (compliance with ISO 14644-1
DOP liquid penetration through cleanliness class, using a
the filter media and obtaining a particle counter)
result of less than 0.01% to Airborne viable particle
test efficiency) monitoring (determine the
Differential pressure test airborne microbial
(verify the capability of the contamination level, exposing
system to provide a pressure media plates to the critical
gradient among different locations Soy-tri casein media,
rooms Manometer) or Potato-dextrose agar to
Temperature and relative cover both bacteria and fungi
humidity test (demonstrate growth)
the ability of the system to
provide a Temp and RH within
a specified range f.e.
Datalogger equipment)
No viable particle test
(compliance with ISO 14644-1
cleanliness class, using a
particle counter)
Airborne viable particle
monitoring (determine the
airborne microbial
contamination level, exposing
media plates to the critical
locations Soy-tri casein media,
or Potato-dextrose agar to
cover both bacteria and fungi
growth)
Airflow direction test (ensure
that the system in an aseptic
area provides an unidirectional
airflow using a dry ice /
Titanium chloride torch, and
watching the smoke flow being
unidirectional up to the
working height)
HVAC VALIDATION
Is one component in the overall approach that covers premises, systems/utilities, equipment,
process, etc.

Air flow patterns

Design Qualification (DS):

A previous inspection of the design of the area, its components and its intention of one, to
previously document the characteristics of the area, conditions to be met and the equipment,
components and their capacities, previous to its installation and construction.

Installation Qualification (IQ):

Verify and document the quality, installation and integrity of the HVAC
Equipment specification
Equipment identification
Calibration components
Major component verification
Leveling and alignment
Verification of utilities
Verification of installation
Checklist of duct network
Drawings

revision de filtros y cómo el aire se mueve a través del sistema o tu habitación

se revisa en el oq, estático; pq, condiciones dinámicas
en las cabinas no mides el aire de afuera, solo el aire de adentro

OQ
medición de corrientes de aire
medir el aire y verificar que este aire realmente esté balanceado en toda el cuarto/cámara
cómo se mueve y qué tanto cambia la corriente de aire; si bien no tienes puerta, solo entras
normal
se realiza con el cuarto cerrado
realizado por anemómetro; mide el cambio/reemplazo de aire por hora
integridad de filtro HEPA
calidad del filtro; el filtro debe retener todas las partículas
pongo aerosol frente al filtro, hago que opere (le pasas aire), usas un aerosol fotómetro y
con eso conoces si tuviste penetración del producto por el filtro
si no pasa, el filtro sí funciona bien (1 partícula de 1M), dependiendo de la necesidad del
lugar donde estás trabajando
poner una capa de aceite y hago que pase el aire, el aire que regresa/pasa tiene que pasar
limpio (0.01%)
DOP/PAO; contador/medidor de partículas

diferencia de presión
medir la capacidad que tiene tu sistema que tiene la capacidad de crear una gradiente de
presiones

la gradiente se genera entre dos lugares con diferente presión y permite que se mueva a un
cuarto de mayor a menor presión
con manómetro
tipos de esclusa:
pozo
burbuja
cascada

prueba de temperatura y presión

Observe the temperature and relative humidity through respective display units wherever
installed. Use a Hygrometer to check the reading of Temperature and RH in other rooms.
Temperature and RH in the area to be checked and recorded
con datalogger/registrador de datos (termohigrómetro)

prueba de dirección/flujo de corriente

ver hacia dónde va el humo y asegurarte de que se vaya hacia donde está el sistema de
aire
se hace con humo (cloruro de titanio TiCl4)
si el sistema de filtración está en el techo, el humo se tiene que ir para arriba; si no lo jala y
se empieza a llenar la habitación, el sistema de filtración no está funcionando

partículas no viables
contador de partículas
para contar qué tantas partículas hay y que esté permitido por la ISO
puedo tener según la clasificación ISO

clasificación ISO - te da el nivel de esterilidad del cuarto para poder realizar sus actividades;
indicado por tamaño de partícula
1: aséptico (vacunas)
3-4: para trabajos farmacéuticos
7: preparaciones farmacéuticas

partículas viables
vas, dejas una placa con dos diferentes agares (soya tricaseína y papa dextrosa para
hongos); uso de medio y condiciones más comunes para las bacterias/hongos más
comunes
se realiza a dos condiciones porque las bacterias y los hongos crecen a diferentes
condiciones

PQ
se puede repetir
temperatura humedad
partículas viables
partículas no viables