AVOID COMMONLY CITED VALIDATION ERRROS THROUGH VALGENESIS

Many regulated manufacturing companies struggle to understand how to avoid common mistakes in the validation process. Identifying common validation issues reported in the recent FDA warning letters help regulated companies understand the expectations of regulatory bodies. Understanding the root-cause and compliance risks associated with these reported issues, will help to avoid, or mitigate these issues in the future, by adopting appropriate processes, controls and systems.

In this study, common validation issues reported in FDA warning letters issued from January 2008 – August 2010 have been compiled and has identified the most frequently cited validation related Code of Federal Regulation (CFR) violations. There were 1415 warning letters issued during this period. Nearly 13% or 182 of these warning letters are directly related to validation deficiencies. The objective of this report is to correlate the commonly reported validation issues with features and functionality of ValGenesis system, which demonstrates how an electronic system will help to avoid and/or mitigate these issues. Most validation related issues can be avoided, or largely mitigated, using ValGenesis system.

In the first part of the analysis, the most frequently cited validation related CFR violations were grouped into seven different categories.  In the second part, the most commonly reported validation errors have been identified and correlated with the functionality of an Electronic Validation Lifecycle Management system, using ValGenesis as an example to demonstrate how an electronic system will help to avoid these issues.

Frequently cited validation related CFR violations

An increase in the number of federal FDA investigators has led to an elevated level of inspections across the industry. Consequently, there has been an array of new, as well as repeated violations. Repeated violations resulted in the formation of industry trends and can be quite alarming considering that regulated companies are repeating the same mistakes. The following validation related CFR regulations have been cited frequently in the warning letters.  Based on these findings, there should be a better way to prevent these repeated violations from occurring.

The following diagram shows the comparison of validation related citations issued between Jan 2008 to Aug 2010.

Fig 1.0 Validation Related Citations reported in FDA warning letters issued from Jan 2008-Aug 2010

Frequently Reported Validation Errors

The following validation errors have been frequently reported in the warning letters issued from Jan 2008 – Aug 2010.

• Failure to validate and approve GXP Systems
• Failure to Validate the GxP System for its Intended Use
• Changes to the validated GxP system without a proper change control process
• Failure to Perform Revalidation
• Unverifiable Test Results and Incomplete Testing
• Insufficient Risk Assessment
• Missing Validation Protocol Information
• Summary

Failure to validate and approve GXP Systems

This commonly repeated validation violation pertains to failure in documenting the process validation activities and results. Several companies have been cited for this violation. One of these regulated companies was cited with the following observation: “Failure to adequately ensure that when the results of a process cannot be fully verified by subsequent inspection and tests, that the process shall be validated with a high degree of assurance and approved according to established procedure”. This particular violation is not only frequent, but also alarming.

As per regulatory requirements, validation protocols with intended use of the system should be tested and approved before releasing the system for any GMP activities.  Another Pharmaceutical company was cited with the following observation: ‘The validation protocol was not approved until April 2008, which is four months after the validation lot SO712012 was manufactured’.

 The Solution that Prevents these Issues

In ValGenesis, anything that needs to be validated is registered as an ‘Entity.’  ‘Entities’ can be physical assets such as equipment, computer systems, instruments, processes, and cleaning etc.

ValGenesis helps to enforce the validation deliverable requirements for any GxP system, or process, across the site/company to qualify them as ‘Validated’ and to release into production environments. ValGenesis provides real time validation status as well as the holistic view of these systems to management users through dashboard during the entire lifecycle process. Before releasing these systems into production, restrictions can be enforced to complete all the required validation deliverables for any GxP system.  In addition, management users will be alerted if there are any pending deliverables, or delays in the validation process.

In ValGenesis, validation projects follow a phased approach and a document deliverable sequence can be enforced to meet the compliance requirements. For example, certain tests have to be completed, documented and approved before conducting other tests.

These ValGenesis features help companies enforce compliance in the validation process and avoid citations related to ‘failure to validate and approve GxP systems’.

Failure to Validate the GxP System for its Intended Use

Validating per intended use is a big sticking point for federal FDA investigators. To assure that no errors are made when processing data, investigators want to be certain that users are verifying that systems operate as intended. Proper user requirements and documented testing of approved requirements are important to ensure that the system performs as intended. As there must be at least one test script per user requirement, if the intended use is documented in the user requirements document, there is a high degree of assurance that the intended use will be tested.

The commonly repeated validation violation under this category is, ‘Failure to validate computer software for its intended use according to an established protocol. Several firms have been cited for this violation. A regulated company was cited with the following observation: ‘Failure to validate computer software for its intended use according to an established protocol when computers or automated data processing systems are used as part of production or the quality system’.

Another very common FDA violation is not establishing a protocol for conducting validation testing. A number of companies have been cited with the following observation: “Validation of your device design is incomplete in that the firm has not established a protocol for conducting validation testing and did not validate the software to ensure that devices conform to the defined user needs and intended uses”.

The Solution that Prevents these Issues

ValGenesis provides functionality to manage the intended use in the Requirements Manager module; the intended use will be documented, reviewed and approved through controlled workflow. The approved intended use documents will be living documents that are maintained with risk assessment details.

These intended uses will be dynamically linked with test cases through auto generated traceability matrices. System will ensure that all the intended uses are covered with at least one test case. System will alert the users if there are any orphan or untested intended uses during the traceability matrix generation. During the testing process, the intended uses will be dynamically updated with test results, to ensure that the indented uses have been tested completely. ValGenesis will ensure that all intended uses have been tested with required test cases.  

ValGenesis helps to document, review and approve the intended uses with risk assessment. These intended uses are tested in ValGenesis to assure that all GxP systems and processes are validated against intended use as documented. These features help companies enforce the compliance requirements and avoid the commonly cited ‘Failure to validate the GxP system for its intended use violation'.

Changes to the validated GxP system without a proper change control process

Change management is not just a matter of best practice; it is the law for regulated companies.  In accordance with the FDA, change control- or controlling, or managing changes within an organization- must be conducted to ensure that the organization can maintain and improve quality by identifying changes that could improve the product. Any change to the validated system requires assessment and revalidation based on the changes with sufficient documentation.

The commonly repeated change control violations pertain to changes made without documentation.  Product and equipment changes not properly approved internally, prior to implementation include lack of validation to support change, an inability to maintain control over the change control program, lack of impact assessment, and failure to evaluate cumulative effects of changes to the system.

Another surgical company was cited with the following observation: ‘Software System was validated on 1/16/07. There was no engineering change order, nor verification, or validation for changes made to this software on 5/8/07’.

The Solution that Prevents these Issues

ValGenesis offers a pre-configured closed-loop change control process with multi-page best-practice form for collecting and tracking data throughout the entire change control process. This helps regulated companies manage any type of change request. It offers a best-practice process that captures priority levels (by identifying the change as routine or temporary or emergency), type of change, and justification with impact details etc. This change request will be routed to a change review board for their assessment.

The Change control process in ValGenesis helps to define the Validation deliverable requirements for the impacted system and these deliverables will be revised and approved within ValGenesis. The approved validation document deliverables will be available at the time of final closure of change requests.

In addition, ValGenesis provides a configurable interface with other third party change management systems, which pull the changes into ValGenesis to provide risk assessment. Required validation deliverables will be generated based on the risk level.

Every change request will go through the approval process with a controlled workflow. The system helps to define the validation deliverable requirements for the impacted system and these deliverables will be revised and approved in ValGenesis. These approved validation document deliverables will be available at the time of final closure of a change request. This closed-loop quality process ensures that the citations related to ‘Changes on the validated GxP system without proper change control process and failure to maintain validation status after the changes’ can be completely avoided.

Failure to Perform Revalidation

“Review and evaluate the process, perform revalidation when changes or process deviations occur, as required by 21 CFR 820.75(c). Systems and processes should be periodically evaluated to verify that they are still operating in a valid manner” as recommended by ICH Q7A GMP Guidance.

Another very common revalidation violation is ‘Failure to review and evaluate the process and perform revalidation when changes or process deviations occur’ - Several companies have received this citation in the past twenty-four months.  A regulated company was cited with the following observation: ‘Failure to perform and document revalidation activities when changes or process deviations occur in the manufacturing operations’.

The Solution that Prevents these Issues

The Scheduler Module permits users to create any number of periodic reviews and revalidation schedules.  ValGenesis allows users to conduct risk assessment based on approved change requests. This function helps determine if an entity (impacted GxP system, instrument, process etc.) has been impacted because of the change requests. Risk Assessments are automatically generated in the system, if the number of changes to an entity has met its risk threshold. Based on the risk assessment outcome, systems will be revalidated to maintain the validation status, and required users will be alerted about the risk assessment requirements.  If there is any delay, the system will automatically escalate the risk assessment task, to expedite, or create a CAPA as required.

Unverifiable Test Results and Incomplete Testing

The IEEE Standard for Software Test Documentation, Std. 829.1988, Clause 6.2.4 says, “provide the exact value (with tolerances where appropriate) for each required output or feature.” During the validation, actual test results should be documented with required evidence. Expected results should be described sufficiently so that an independent reviewer could compare and verify the actual results.

The frequently cited violation under this category is: ‘Test scripts did not fully or adequately test the associated requirement.’ Several companies have received this citation in their warning letters.  Another regulated company was cited with the following observations, ‘Your firm's validation of the interface between the automated blood testing instrument and the database system,

a) Validation sample testing and data collection was conducted on December 9, 2008, prior to approval of the validation test plan on December 19, 2008;
b) The validation pass/fail criteria was not met;
c) The validation test plan was not followed; and
d) The validation data was incomplete.

The Solution that Prevents these Issues

ValGenesis helps to quantify the test results with documented evidence, including screen shots and file attachments. Each test case row captures the user name and executed time stamp that provides evidence and an audit trail for each action during the testing process along with electronic execution capabilities, any execution failure that is witnessed during an execution is captured in the system, whereby the executor can bundle one-to-many failures together to create a deviation.  Deviations can be managed electronically through an assessment, review and approval workflow along with intended use requirements and associated risk assessment details. The System can be configured to stop the testing process, if there is any major deviation.

Executed test cases, with summary report, will be routed for review and approval through a controlled workflow. Before routing for approval, the system will check the tested document to make sure all test cases are executed and test results are documented. Using the ValGenesis electronic execution option, the citations related to ‘Unverifiable Test Results and incomplete Testing’ can be avoided.

Insufficient Risk Assessment

According to the International Conference on Harmonization (ICH) “Q9 Quality Risk Management” draft guidance, effective quality risk management can facilitate better and more informed decisions by manufacturers and provide regulators with greater assurance of a company’s ability to deal with potential risks.

The common repeated violation under this category is: ‘risk analysis is not routinely updated and evaluated when there is a change in the validated system.’ Several firms have been cited for this frequently cited violation.

A medical device was cited with the following observation: ‘Failure Modes and Effects Analysis (FMEA) Risk Priority Numbers (RPNs) for the changed design fell within your predefined unacceptable zone for the set screws, multi axial body assemblies, offset body assemblies and multi axial screws. No actions to reduce the risk or to add additional risk control measures were identified or implemented as required by your firm's Risk Management Procedure’.

The Solution that Prevents these Issues

ValGenesis maintains risk assessment at the system and functional levels. ValGenesis mandates approval for the changes in the system requirements (intended use), or with associated test cases.

The System mandates users to update and evaluate the risk analysis if there is any change in the validated systems. This helps to avoid the commonly cited ‘risk analysis is not routinely updated and evaluated when there is a change in the validated system’ issue.

The System can be configured to alert specific user groups if Risk Priority Numbers (RPNs) fall within the predefined unacceptable zone. These types of out-of-risk threshold limits can be prevented.

Missing Validation Protocol Information

Validation Documents, or test specification documents were missing fundamental information or content that should have been included. The missing information includes Equipment ID, Model Number and Version Numbers, etc. In some cases, the approved validation protocols were missing from the primary validation document storage place.

The commonly repeated violations under this category refer to ‘Verification and Validation report for a specific software version or Instrument or Equipment is not available for review.’ Recently, several firms received this citation in their warning letters. Another medical device company was cited with the following observation: ‘Validation report revealed that your firm failed to document: (1) what type of sterilization process is used to sterilize the tubing; (2) how the sterilization causes a reduction in the flow rate in the tubing; (3) whether the reduced flow rate can still meet user needs in actual clinical settings; and (4) whether re-sterilization of the tubing-set is allowed in case of sterility test failures, and the impact of re-sterilization on the flow rate’.

The Solution that Prevents these Issues

Validation, or test specification, documents created in ValGenesis are securely stored in the Library module. This includes approved documents and those that are currently ‘In Progress.’  Documents that have been generated in the system (developed and/or executed) will be converted to PDF, with a sign-off page. This library module can be treated as a primary source for the validation documents, or documents can be migrated into the corporate document management system (DMS) through the synchronization function. These documents can be seen by anyone who has privileged access to these documents. This particular function eliminates the possibility of lost documents from the primary document storage system.

In ValGenesis, when creating a validation document template, headers and footers are attached to the template with tags for version, model numbers, etc. During the development and execution, the document is populated with entity related information such as a model and version numbers from the database.

As with the template creation, header and footer templates are configurable and easy to create. This helps eliminate citations relative to missing information, which includes Equipment ID, Model Numbers and Version Numbers, etc.

Summary

Analysis of FDA warning letters issued from Jan 2007 – Aug 2010 reveal that there has been an array of new, as well as repeated, violations. Most commonly reported repeat validation errors have been grouped and correlated into seven groups with features and functions of an Electronic Validation Lifecycle Management system so as to understand how these systems can address these issues. This analysis reveals that adopting an electronic system can avoid repeat validation errors and provides a real time status for management users, which shows any gaps in the validation status, or deliverables.

Though many life science organizations are cautious about implementing automation technologies in FDA-regulated environments, many others are discovering that these tools actually help to reduce compliance uncertainty, as well as decreasing the cycle time and cost of validation process. As validation has become extremely important to the success and survival of companies, automation has proven to greatly streamline the operations. In effect, properly deployed automation technology actually lowers compliance risk, thereby making the validation process far more efficient.