The Future State of

Computer Validation, Part I

Increasing the Efficiency of
Computer Validation Practices
Rory Budihandojo,* David J. Bergeson, Paul D’Eramo, Ludwig Huber,
Orlando Lopez, Arthur Perez, David Selby, Guy Wingate, and Michael Wyrick

I
n Part I of this article, the authors address the regulatory,
business, and technological events and trends in computer
validation in the past 25 years. Current industry efforts and
the future of computer validation infrastructure will be dis-
cussed in Part II.

Regulatory events and trends

FDA, by way of its Modernization Act of 1997 (1), has indicated
The objective of this article is to attempt its intention to achieve the following goals by 2002 (2):
to look at the future state of computer ● official submissions received and archived electronically

validation principles based on the current ● electronic submissions and reviews accessed from the re-

events and trends in regulations, business viewer’s desktop computer

● standardized analytical tools
practices, and technology.This crystal-ball
● publicly releasable material available on the Internet.
approach will prepare the industry for the The above goals point to the agency’s movement toward more
future by establishing a current-state best- automated and electronic information. This movement also is
practice foundation of computer validation shown by the number of guidelines recently published by the
principles as well as improving computer agency in support of this activity. For example:
validation practices. ● “Guidance for Industry: Pilot Program for eIND Applications

for Biological Products” (3).

● “Guidance for Industry: Computerized Systems Used in Clini-

cal Trials” (4).

● “Guideline for Industry: Structure and Content of Clinical

Study Reports” (5).

● “Guidance for Industry: Regulatory Submissions in Electronic

Rory Budihandojo is head of R&D IT Quality and Testing,

Format for NDA” (6).
Centre of Excellence at GlaxoSmithKline, UP-9200, 1250 ● “Guidance for Preparing Data for Electronic ANDA Submis-

S. Collegeville Rd., Collegeville, PA 19426, tel. 610.917.7380, sions” (7).

e-mail [email protected]. David J. Bergeson ● “Revised Guidance for Providing Regulatory Submissions to
is a senior compliance consultant at KMI, a division of Parexel CBER in Electronic Format” (8).
International LLC. Paul D’Eramo is an executive director at
Johnson & Johnson. Ludwig Huber, PhD, is a product
Specific to 21 CFR Part 11 (Electronic Records and Electronic
marketing manager at Agilent Technologies. Orlando Signatures Rule), the agency has published a Compliance Pol-
Lopez is a senior consultant at McNeil Consumer Healthcare, icy Guide (9). A guidance document on this ruling also is being
a J&J company. Arthur Perez, PhD, is an associate developed, and a public docket has been established for public
director at Novartis Pharmaceuticals Corp. David Selby, comment on the regulation (10).
PhD, is a managing partner at Selby Hope International. Guy
Wingate, PhD, is head of GMS Global Computer Validation
Besides moving toward a more automated and electronic en-
at GlaxoSmithKline. Michael Wyrick is a director of IT vironment, the FDA Modernization Act indicated the agency’s
Consulting Services at KMI, a division of Parexel International intention of pursuing a harmonization effort between coun-
LLC. Mr. Budihandojo and Mr. Wyrick are members of tries to achieve mutual agreements in regulatory requirements
Pharmaceutical Technology’s Editorial Advisory Board. (11). An example of this harmonization effort that can be re-
*To whom all correspondence should be addressed. lated to computer validation activity is the discussion on the
86 Pharmaceutical Technology JULY 2001 www.phar maportal.com
integrity of data and computer software validity in section 5.8 ment currently is proceeding through review and approval
of the International Conference on Harmonization: “Guidance within Center for Devices and Radiological Health (CDRH).
on Statistical Principles for Clinical Trials” (12). An extrapola- Also related to this document is the AAMI project (cochaired
tion of this harmonization effort has the potential to address by a CDRH software engineer) to develop a software engi-
computer validation as part of the future global harmonized neering standard, i.e., the American National Standard for
regulatory requirement. Another agency effort is leveraging gov- Medical Device Software–Software Life Cycle Processes.
ernment agencies and the private sector to increase the knowl- It is important to recognize the influence of the software en-
edge base and the decision-making process for a more expedi- gineers in the Office of Science and Technology (CDRH) on the
ent review process (13). The importance of this initiative also direction of FDA in regulating software systems. A pertinent il-
was voiced by FDA Commissioner Jane Henney, MD, in her lustration is the statement made during the satellite broadcast
speech in February 2000 (14). Through the Product Quality Re- on design controls in December 1996 that software validation is
search Institute, cited by Dr. Henney, FDA has demonstrated a control of the development process, which foreshadowed state-
its willingness to work with industry and academia to ensure ments in two January 2001 Center for Drug Evaluation and Re-
that agency regulations and guidances are scientifically based. search warning letters: “Software is validated in its controlled de-
In addition to the above, the Government Paperwork Elimina- velopment and in control of ongoing maintenance of the software
tion Act, Public Law 105-277, Title XVII, which was signed into throughout its life cycle” (22).
law on 21 October 1998, mandates all agencies (including FDA) FDA also has issued warning letters related to the content of
to accept all documentation and signatures in electronic form, marketers’ Web sites because of site contents that are considered
where practical, by October 2003 (15). The effort to improve in violation of the Food, Drug, and Cosmetic Act such as those
and speed up the regulatory review process may increase the sites containing misleading or even false marketing or advertis-
future scope and types of computer systems to be validated. ing (23). Although this is not directly related to computer vali-
The increase in the number of domains affected by computer dation, it demonstrates the agency’s commitment to enforcing
validation could extend to the food industry, as demonstrated the validity of the content and data being claimed by marketers.
by FDA Guide to Inspection of Computerized System in the Food Hence, this demonstrates the need for verifying Web site content.
Processing Industry (16). In addition to the above events, FDA activities can influence
On the enforcement side, a quick search of the FDA Web site the industry and, consequently, also may affect computer vali-
for warning letters will reveal several that are related to com- dation activities. For example:
puter validation (17). Many observations (483s) related to com- ● Training of FDA investigators in computer validation and 21
puter validation that did not make it into warning letters also CFR Part 11. This training may lead to an increase in the num-
have been issued. Some examples of these observations dis- ber of computer system inspections and to more consistent
cussed issues related to expectations regarding documentation FDA computer system inspections.
of software development, remote access and software modifi- ● In the past four years, 11 drugs have been recalled from the

cation, software hazard analysis, and electronic chromatogra- market (24). These recalls have the potential to cause FDA to
phy files maintenance. These documents are available publicly look into patient data kept by health insurance companies as
and can be obtained through the Freedom of Information Act a means to a better postmarket drug monitoring program.
(18) as well as from the FDA Web site. Consequently, ensuring the integrity and confidentiality of
In addition to communicating its expectations for validation patient data becomes a factor that must be addressed by our
of computer systems and software through warning letters as industry and by the insurance industry. In addition, FDA also
previously mentioned, FDA has published a number of guid- may look into its drug approval process, which may translate
ance documents, and additional references are currently under into looking at the systems that generated and processed the
development. Some of the pertinent ones are: data submitted for drug approval.
● The guidance document “Off-the-Shelf Software Use in Medi- ● FDA also has allowed pharmacists to re-import prescription

cal Devices” (19), issued 9 September 1999, contains the lat- drugs (e.g., from Canada and Mexico). This allowance may af-
est ideas about software risk management. In a related co- fect drug pricing in the United States, which could adversely af-
operative project with the Association for the Advancement fect the amount of resources available for computer validation.
of Medical Instrumentation (AAMI), a software engineering Besides the United States, several other countries also have
standard for medical device software is under development. requirements related to computer validation, including Aus-
The draft standard requires compliance with ISO/IEC 14971 tralia, the United Kingdom, the European Union (EU), and
Medical Devices — Risk Management. Japan. Both the EU good manufacturing practice (GMP) di-
● The guidance document “Computerized Systems Used in Clini- rective, Annex 11, and Australia’s Therapeutic Goods Admin-
cal Trials” (20), issued in April 1999, provides current FDA istration (TGA) GMP have requirements for computer quality
views on features of regulated computer systems, their vali- assurance. As a matter of fact, the TGA GMP has required elec-
dation, and the expectations to have when off-the-shelf soft- tronic audit trails since 1991.
ware is used to achieve a regulated activity. After review of this section, one can easily conclude that there
● The draft guidance document “General Principles of Software is a future trend toward increased automation and electronic in-
Validation” (21), published in June 1997, has been revised in formation transfer and availability in our industry, which par-
response to industry and public comments, and the final docu- allels other industries. Also, the increased regulatory enforce-
88 Pharmaceutical Technology JULY 2001 www.phar maportal.com
ment focused on computer system integrity (i.e., computer vali- the Internet, the basic local alignment search tool (BLAST, 26)
dation) is a concern at a national and international level. and Entrez (a software tool to perform meta search and retrieval,
27) are just a couple of examples of computer programs being
Business events and trends used in genome science.
In the past few years, several major pharmaceutical companies The use of computers in other areas of research also has ex-
have merged or expanded their business presence by acquiring panded. For example, many sophisticated analytical techniques
other companies (e.g., Aventis, Novartis, Pharmacia, Glaxo- (e.g., X-ray crystallography and high-field multidimensional
SmithKline, and Pfizer’s acquisition of Warner-Lambert/Parke- nuclear magnetic resonance studies) are performed early in the
Davis). These newly expanded companies have looked at, or drug development process as part of structure elucidation and
will need to look at, how their businesses are conducted and eventually become part of regulatory submissions. Other ex-
how synergies in the newly formed or merged companies can amples include the use of electrophotography methodology for
achieve an increase in efficiency and productivity in research, developing a novel drug-delivery method (28) and the use of a
manufacturing, and sales and distribution. Hence, it is not un- Web-based application for reviewing clinical data and as a re-
common for these companies to review all aspects of their busi- mote clinical data capture tool (29). All of these examples are
ness processes and information technology strategies and prac- indications of the increased usage of computer systems, which
tices when looking for ways to increase efficiencies. The translates into increased computer validation activities.
bigger-is-better trend and the increased need to operate the
business more efficiently will have an effect on computer vali- Technological events and trends
dation. This effect will reveal itself in the need to validate the The advances of Internet- and information-browsing technol-
integration of various systems, the development of new sys- ogy without a doubt have played a major role in how informa-
tems, the retirement of systems, and other validation activities tion is being distributed and accessed, which leads the move-
related to those systems such as data migration and data archival ment of applications to this Web-browsing technology. These
activities. Furthermore, there is also the need to evaluate the so-called e-applications will take advantage of the Internet’s
computer validation practices carried over from the premerged global data distribution capability. Key points to consider when
or preformed companies and to harmonize those practices. In validating e-applications are the increased security risk and data
some cases, this has resulted in mature computer validation integrity factor as well as data privacy. The Public Key Infra-
programs being diminished in order to compensate for their structure (PKI) and Pretty Good Privacy (PGP) combination is
new partners having a less comprehensive program. one of the current mechanisms and methods available to
Within the business operation units (i.e., laboratories, qual- address data integrity and security issues. An example of this
ity controls, manufacturing, sales and distribution, etc.), the use trend is the availability of browsing technology as part of the
of computer systems, instruments, and equipment is proliferat- e-manufacturing implementation (30). Similar to the concept
ing. To increase operational efficiency in the automated busi- of MES, e-manufacturing is the total integration of the enter-
ness units, most companies are trying to integrate those systems. prise — from the plant floor all the way through to the customer
For example, the integration of the laboratory information — by using Web-based technologies. The result is a system that
management systems (LIMS) with the manufacturing resource is focused on solving business problems with an aggregate of
planning (MRP) and manufacturing execution systems (MES), software, hardware, and systems. In the future, computer sys-
etc., provides the firm with a more efficient interface between tem validation must be adaptable enough to address these ag-
departments and can be a facilitator for staff reduction as ad- gregates based on aspects unique to each technical solution.
ministrative tasks are assumed by more effective systems. Hence, The electronic data interchange effort has been around for a
these integration activities also will increase the need for com- few years, and standards are available. However, for business to
puter validation, especially in situations where human judgment business (B2B) e-applications, no standard exists for data in-
is removed from the processes. terfaces and the presentation of data for the interchanges. To
In the research arena, computers have played a major role in address the lack of standard, an e-business extended markup
advancing genome science and completing the mission for find- language (ebXML) effort has been sponsored by the United Na-
ing the sequence of human genes — advances that have led the tions Centre for Trade Facilitation and Electronic Business and
industry to new gene-therapy products and have the unlimited the Organization for the Advancement of Structural Informa-
potential to guide the industry to other new products. Com- tion Standard to develop an XML-based infrastructure for B2B
puters also will play a major role in the future research of these commerce that was scheduled to be completed in May 2001
potential gene-therapy products. Computers first will be used (31). Validation practitioners must keep up with not only the
in bioinformatics to predict the type of protein that is encoded technological advances of application software but also the ad-
by the newly sequenced DNA genes. After the type of protein vancement of security-related tools such as PKI and PGP and
is predicted, computers then will be used in proteomics to find new e-applications, including the ebXML technological effort.
the potential active interaction site for the proteins. Besides the Besides advances in software applications, there are techno-
major pharmaceutical and biotechnology companies, several logical advances in the hardware arena. Electronic ink is one ex-
companies have been formed to work in genomics. Jason Reed, ample (32). Lucent Technologies (Murray Hill, NJ) has demon-
PhD, vice-president of Gruss and Son Co. (New York, NY), pre- strated the world’s first flexible electronic ink display with plastic
dicted this business will grow to $2 billion in five years (25). On transistors (33). There also are advances in the availability of vari-
90 Pharmaceutical Technology JULY 2001 www.phar maportal.com
ous types of data storage mechanisms (e.g., compact flash and tion, infrastructure qualification, and 21 CFR Part 11 comp-
rewriteable CD-ROMs) as well as the availability of various com- liance. GAMP Americas has formed several SIGs such as
puting platforms and devices that are smaller and faster (e.g., e-applications, MES, clinical systems, medical device, labora-
smaller notebook computers and personal digital assistants). tory systems, joint equipment transition team forum (process
Computer validation staffs will feel the effect of these advances equipment), and suppliers’ forum. Additional information about
in the form of a need for an enhanced or enlarged skill set that GAMP and the associated SIGs is available on their Web sites.
allows them to handle the expanded range of technologies. The Parenteral Drug Association (PDA) has produced work
Advances in the infrastructure arena include a wider data products related to computer validation such as a harmonized
bandwidth that increases the amount of data that can be trans- glossary for computer validation, “Technical Report #31: Vali-
mitted and made available, an increase in public accessibility dation of Laboratory Data Acquisition Systems,” and “Techni-
to the Internet, and an increase in the number of users access- cal Report #32: Auditing Computer Product Suppliers” (35).
ing the Internet. The effect of the increasing number of users PDA and its Computer System Interest Group steering com-
(and presumably the number of hackers) and the increasing mittee are currently supporting task groups working on good
amount of data being transported is increased security risk, electronic records management and the revision of “Technical
therefore a potential increased data integrity risk. Report #18: Validation of Computer Systems.”
The Consumer Healthcare Product Association leads the In-
Current industry effort dustry Coalition on 21 CFR Part 11, which is a coalition of 10
Several professional organizations currently are working on national trade associations representing industries regulated by
guidelines and standards that will affect the future of computer FDA, and is working with the agency in preparation of FDA
validation principles and practices. guidance on the implementation of 21 CFR Part 11.
The Good Automated Manufacturing Practice (GAMP) The Pharmaceutical Inspection Convention (PIC) has de-
Forum together with ISPE have recently established GAMP veloped a draft guidance titled “Best Practices for Computer-
Americas (34). This newly formed GAMP structure is currently ized Systems in Regulated ‘GxP’ (GMP, GCP, or GLP) Envi-
working on a new version of the GAMP guide (version 4) that ronments.” In support of this effort, international regulatory
will be available by the end of this year. GAMP special interest agencies have collaborated to produce this harmonized guid-
groups (SIGs) also are drafting papers on network qualifica- ance for the validation, control, and use of computer systems

92 Pharmaceutical Technology JULY 2001 www.phar maportal.com

in GxP-regulated applications in the pharmaceutical industry. on computer systems, including the data integrity and secu-
It is intended for both external reference by the pharmaceuti- rity of those systems.
cal industry and its suppliers and also for internal use by regu- ● Business. The need for cost-effective and efficient good fast

latory inspectors and investigators (36). production without compromising the quality and regula-
Other professional organizations related to the computer tory compliance factors through business globalization, inte-
industry also are working on standards that may affect the way gration of systems, and use of new information technologies.
regulated business is conducted as well as the method and ex- ● Technology. The need to increase the system’s scalability, com-

tent of computer validation practices. For example, the Infor- patibility, availability, modifiability, performance, and inter-
mation Society Standardization System has the mission of pro- operability factor to meet business needs.
viding market players with a comprehensive and integrated ● Industry. Provide standards and guidelines for assisting the

range of standardization-oriented services and products to business needs of meeting regulatory compliance in the use
contribute to the success of the Information Society in Europe of current technologies.
(37). The International Biometric Industry Association pro- Therefore, there is a clear sign that the future need for com-
vides information and a list of biometric companies (38). AAMI puter validation will increase as the business needs for more
is currently developing a software engineering standard ap- systems, faster transactions, and information availability be-
plicable to medical device software life-cycle processes. The come more prominent. The trends noted above, coupled with
title of this draft document is “Medical Device Software — more sophisticated compliance demands from regulatory agen-
Software Life Cycle Processes.” Of course, many other organi- cies, are driving the industry toward an ever-increasing depen-
zations are developing standards but are too numerous to ref- dence upon electronic business solutions. This in turn will am-
erence in this article. plify the need for effective and efficient computer validation
processes. Approaches to developing or improving these
Summary of the trends processes are suggested in the remainder of this article.
The following points summarize the trends from the regula- future infrastructure (please note that these concepts are sim-
tory, business, technological advances, and industry sections of ply food for thought).
this article: Part II of this article, including references, will be published
● Regulatory. Moving toward the e-format and increasing focus in Pharm Tech’s IT supplement in September 2001. PT

Circle/eINFO 62
Pharmaceutical Technology JULY 2001 93