Risk-Based Validation – The Benefits of the GAMP® Approach Kevin C. Martin Chair, GAMP ® Americas Sr. Vice President Azzur Group LLC
Agenda • 20 Years of the GAMP® Organization • GAMP Benefits • GAMP Contribution • Validation Productivity • Lean Validation • Current Technology Trends • Current Regulatory Activity
Agenda • 20 Years of the GAMP® Organization • GAMP Benefits • GAMP Contribution • Validation Productivity • Lean Validation • Current Technology Trends • Current Regulatory Activity
20 years of GAMP Development Validation Productivity!
plus …
GAMP ® Americas Leadership • Officers • •
Chairman:
•
Kevin Martin, Azzur Group
•
Co-Chairman: Michael Rutherford, Eli Lilly
•
Secretary: Lorrie Schuessler, GSK
• ISPE Staff PM •
• Steering Committee
Scott Ludlum
Blue indicates GAMP® Council *Denotes GAMP Council Chair
• • • •
• • • • •
Winnie Cappucci* , Retired- Bayer
Waunetka Clark, Abbott Jim John, ProPharma Group Paige Kane, Pfizer Klaus Krause, Allergan Eugene Longo , GAMP® Puerto Rico Randy Perez, Novartis Judy Samardelis, Medimmune Eric Staib, Covance Robert Tollefsen, FDA Bob Wherry, Sunovion
Active GAMP ® SIGs GAMP ® Americas
GAMP ® Europe
•
Laboratory Systems
•
Process Control Systems
•
Manufacturing Execution Systems (co-chaired with Europe)
•
Testing (with USA)
•
Supplier Relationships
•
Risk Management
•
Outsourcing and Offshoring (with USA)
•
Joint Equipment Transition Team (JETT)
• •
Calibration
Outsourcing and Offshoring (with Europe)
•
Development Models and Methods
IT Infrastructure Control & Compliance (with Europe)
•
•
GxP Controls Framework (proposed)
R&D / Clinical Systems (coordinated GAMP ® D-A-CH with Europe) • Supplier Cooperation • Automated Testing (sub-set of • Open Source Software Testing SIG)
• • •
Metrics
GAMP ® Italia
Equipment Qualification Workgroup
GAMP ® Nordic
•
Virtualization
Active GAMP ® SIGs - Brazil • • •
GTG "Validation of IT Infrastructure and Processes”
•
GTG “Understanding e-records and e-signatures (ANVISA / EMA Annex 11 / 21CFR Part 11 / GAMP)”
• • • • •
GTG “Validation Master Plan and Validation Plan for CSV”
GTG " Validation of PLCs, Automated Systems, Shop-floor Systems, MES and BMS” GTG "Change Management for Computerized Systems and Maintenance of Validated Status”:
GTG “Legacy Systems” GTG " Qualification and Suppliers Assessment” GTG "Testing GxP Systems (base GPG GAMP)“ GTG "Organizational Structure for CSV”
GAMP Good Practice Guides 1.
Validation of Process Controls Systems (Second Edition Feb 2011)
2.
Calibration Management (Second Edition Nov 2010)
3.
Manufacturing Execution Systems – A Strategic and Program Management Approach (Feb 2010)
4.
A Risk-Based Approach to Operation of GxP Computerized Systems - A Companion Volume to GAMP® 5 (Jan 2010)
5.
Electronic Data Archiving (Jul 2007)
6.
Testing of GxP Systems (Dec 2005)* (2nd Edition 3Q2012)
7.
Global Information Systems Control and Compliance (Nov 2005)
8.
IT Infrastructure Control and Compliance (Sep 2005)
9.
Validation of Laboratory Computerized Systems 2Q2012)
(Apr 2005) (2nd Edition
10. Risk-Based Approach to Electronic Records and Signatures (Feb 2005)
11. Legacy Systems (Nov/ Dec 2003)* * Available as a download at no cost to ISPE Members Only
G A M P ® 5
GAMP® 5 Overview Published: Feb 2008
G A M P ® 5 Continues to Address… • Current regulatory initiatives
FDA’s cGMPs for the 21st Century
PIC/S Guidance Risk-based Part 11 Guidance
• Global Standards
ICH Q8, Q9, Q10 ASTM E2500
• Escalating cost pressures mandate efficiency
Facilitate a single company QMS Need to take full advantage of supplier capability Better compliance with less cost!
G A M P ® 5 Simplified V-model Verifies Validationmodel better illustrates scalability Validation This options for phases Plan
Report
Validation Activities • Blended specifications (e.g. URS/FS, FS/DS, even URS/FS/DS) • Design review as opposed to formal DQ • Blending User of “classical” qualification Acceptance of Verifies(e.g. IOQ, OQ/PQ, melding Requirements computer validation with equipment C&Q) (URS)
Plan Functional Specification (FS)
Development Activities
Design Specify Specification (DS)
GAMP ® 5 stresses that this model does not imply
Verifies Risk Management throughout the Verifies process
testing (PQ)
Report Functional testing (OQ) Installation Verify
Verification Activities
(IQ)
This can be applied to nonlinear approaches like spiral or or testsiterative methodologies, agile Build Developer aSystem waterfallBuild development SystemBuild (Structural, unit, & (including Configure integration) software development, etc. methodology developer tests) Activities
G A M P ® 5 Life Cycle Concept Features: • Simplified V-
Repetitive “V” Activities Within the Life Cycle
migration
Model
URS
Release
Changes
GxP Assessment
Concept
Project
Operation
Retirement
Supplier Involvement*
* • This could be a complex supply chain • Supplier may provide knowledge, experience, documentation & services throughout lifecycle
Plan Specify Build Verify Report Risk mgmt throughout process
• Repetition of Vactivities for changes • Incorporates end-of-life activities
Risk Management Goals • Systematic process for identifying, assessing, mitigating, controlling, and communicating risk, based on
Good science Process and product understanding
• Recognize that zero risk is impractical and unattainable
Aim is for a c c e p t a b l e r i s k
• Consistent with risk-based approach based on ISO 14971 (and ERES GPG) as well as other contemporary risk based tools
5-Step Quality Risk Management Process Step 1
Perform initial risk assessment & determine system impact Step 2
Identify functions impacting patient safety, quality, and data integrity Step 3
Perform functional risk assessments & identify controls Step 4
Implement & verify appropriate controls Step 5
Review Risks and monitor controls
The Desired State… Historical State
Desired State
1990’s Validation Approach t r o f f E n o i t a d i l a V s u c o F
High
Medium
Low
Risk Based Approach t r o f f E n o i t a d i l a V s u c o F
High Medium Low
Stakeholders – the GAMP ® Benefits • All stakeholders depend on reliable systems
Performing as expected …
from the beginning …
…continuously …
with minimal attention
• A proven roadmap when going from ‘manual’ to automated systems We have a great responsibility!
GAMP ® 5 – Enables Increased Validation Productivity • Focussed on efficient and effective validation • Making validation ‘productive’ • OED: ‘producing abundantly’ • Webster's: ‘Yielding results, benefit or profit’ Eliminate the Waste!!!
Universal Approach • GAMP methodology applies to all types of systems • Large database systems • Process control systems • Spreadsheets etc. • Needs tailoring to each project for maximum efficiency
Consider all the elements of the validation process
Uniform Approach • The ‘V’ model is almost universally applicable • It is capable of considerable flexibility • Many ‘dialects’ exist • Fundamentals remain Design Review
Document Handover
Plan >Check > Do > Record Planning Specifications
Protocols Change management
QMS* for Systems Validation The Validation Process is well-documented • Based on QMS principles • Widely understood • Adopts standard elements of QMS
Planning Specifications Risk-based approach Verification Documentation Change management Continuous improvement
*QMS = Quality Management System
Knowledge of Systems • To validate effectively we need to know our systems;
Why we want them What they do How they do it Where the risks lie How the risks are controlled
• Follow a System Life Cycle - Use GAMP5 ® as a tool • Payback is immediate – increased efficiency of operation
Benchmarking for Continuous Improvement
12 Good Validation Practices • • • • • •
Policies and Procedures Good Project Management Practices Validation Planning Validation Strategy Specifications and Design Review Protocols
Acknowledgment: David Selby, NSF-DBA
• • • • • •
Documentation Change Management Practices Training Handover Maintaining Control in Operation Post-project reviews
Benchmark Assessment • Highest scores highlighted Green • Next lowest highlighted Yellow • Lowest Scores highlighted Red • Absolute numbers not meaningful • Averages are more reliable • Look at the concentration of colour
Acknowledgment: David Selby, NSF-DBA
Benchmarking Results - Typical •8
•9
•7
•6
•7
•7
•9
•9
•8
•6
•6
•7
•7
•5
•5
•8
•8
•10
•6
•5
•7
•8
•9
•8
•7
•6
•6
•5
•4
•5
•7
•8
•4
•5
•7
•8
•5
•4
•7
•5
•7
•6
•7
•6
•7
•6
Protocols, •6 •8 •6 Documentation •6 •8 •8 Change •8 •7 •8 Management
•5
•4
•5
•1
•3
•5
•7
•6
•8
•4
•5
•6
•10
•8
•5
•3
•7
•9
•8
•6
•4
•5
•7
•7
•7
•8
•8
•4
•3
•2
•7
•6
•8
•6
•5
•2
•5
•6
•7
•7
•4
•6
•6
•8
•9
•7
•6
•7
•8
•8
•9
•3
•4
•3
•1
•6
•5
•3
•8
•9
•8
•6
•3
•6
•4
•4
•6
•7
•6
•8
•7
•6
•4
•2
•2
•0
•6
•5
•5
•5
•7
•7
•7
•5
•4
•4
•1
•8
•4
•3
•8
•6
•7
•7
•7
•4
•4
•3
•1
•7
•4
•5
•5
•6
•8
•6
•8
•4
•5
•3
•5
•6
•6
•8
•7
•5
•7
•7
•6
•3
•5
•5
•3
•5
•3
•6
•8
•7
•2
•3
•4
•3
•5
•5
•8
•9
•6
•6 Training
•4
•5
•3
•7
•6
•7
•8
•6
•6
•5
•6
•6
•6
•6
•7
•8
•9
•8
•7
•8
•5
Policies and •4 Procedures•7
•3 •7 •7 •8
•4 •6 Specifications and •5 •6 •5 Design Review •9
Project •2 •4 Management •5 •4 Planning •5 •7 Strategy •7 •4
Handover •4 •4 •3 Control in Operation •3 •6 •5 Post-project Reviews
•8
•7
•5
•6
•6
•8
•8
•8
•7
•5
•6
•5
•7
•7
•3
•3
•4
•6
•6
•7
•6
•5
•4
•4
•145
•137
•133
•126
•120
•154
•165
•162
•121
•97
•101
•79
•6.6
•6.2
•6.0
•5.7
•5.5
•7.0
•7.5
•7.4
•5.5
•4.4
•4.6
•3.6
Example 1: Ampoule Filling Line • Mid ’90s • Comparison of validation of two liquid injection filling lines Pre-GAMP
Post-GAMP2
Specification Development
5 days
Specification Development
5 weeks
Protocol Development
1 week
Protocol Development
4 weeks
FAT Testing
3 days
FAT Testing
2 weeks
Initial efficiency
35%
Initial efficiency
75%
Final Efficiency
65%
Final Efficiency
95%
Cost Effective Approach How much does Validation Cost?
• Some figures (% of total project cost):
Current industry average 20 – 25% Major pharma company (top 10) 16% GSK ≤ 4%*
Pfizer ≤ 4%*
Best in class ~ 1.2%
* Figures published in 2008
Example 2: SAP Financials • GAMP methodology applied to global implementation of SAP Financials
Scenario: – Lead site – Decision to use “validation rigor” (GAMP Methodology) for
all modules – Lead by QA validation expert – Tough to get Finance to understand what that meant – IT Project manager: “This guy has no idea how to implement a finance system.” – Testing went like a dream!
– Project on time and on budget – “We’ve never had a test phase that went so smoothly with so few problems” Acknowledgment: Randy Perez, Novartis
Example 3: Re-engineering the Verification Process
Validation Waste Waiting
Motion Slow project initiation
Inactive players
Physical document circulation
Sequential activities
Priority conflicts
Long lead times for meetings High training requirement
Defects
Staff turnover
Wrong skills mix
Implementation of optional features
Unclear purpose
Acknowledgment: Guy Wingate, GSK
Effort to re-work
WASTE Multiple planners
Too many documents
Multiple forms
Too many signatures
Over-production Transportation
Late detection
Extra Processing
Too many people
Inventory
Example 3: Re-engineering the Verification Process
Savings identified: Adopting good practices
~5%
Adopting standardized practices Focussing of GMP activities
~30+% ~20%
Scaled approach ~10% Leverage supplier expertise Rigorously applied risk-based approach
Average Cost of Validation Acknowledgment: Guy Wingate, GSK
Example 3: Re-engineering the Validation Process
Upgrade Projects
Cost Savings*
1
50%
2
58%
3
72%
Total Savings
>$1.5m
Cost savings comparing V model alone (GAMP 4) vs. V model + E 2500 (GAMP 5)
Acknowledgment: Lily Mo, Pfizer Global Quality Operations
Example 4: Application of Risk Management (Scaleability) High
Medium
Low
Definition
Severe potential harm to patients, (e.g. death, hospitalization, long term effects).
Risk has potential for nonserious impact on patient safety and/or product quality.
Risk has little or no potential impact on patient safety and/or product quality.
Criteria
•Product is unusable or
•Impacts product quality but with
•Regulatory requirement with
ineffective such that harm is likely. •Loss or corruption of records has potential for severe harm to patients.
no or negligible impact on patient safety (e.g. cosmetic defect). •Loss or corruption of records would have non-serious impact on patient safety or product quality. •..... and so on for your
little or no impact on product quality and/or patient safety. •Loss or corruption of records would violate regulatory requirements but have no impact on patient safety or product quality • ...and so on for your
organisation.
organisation.
•....and so on for your organisation.
...Thin k c arefu lly h ere... Possible Examples
•Training management for staff
•Incomplete break line on OTC
•Training management for non-
operating in aseptic area. •Dispensing of active ingredients for production, sterilization hold times.
tablet. •Checkweigher detection of incompletely filled blister packs.
production staff. •Corrupt electronic signature on audit report.
Acknowledgment: Ellis Daw, GSK
Example 4: Application of Risk Management (Scaleability) Probability of Failure (Development Classification)
1 (Customised)
2 (Configurable)
3 (Non-Configurable)
High (H)
Intensive
Standard
Minimal
Medium (M)
Intensive
Standard
Minimal
Low (L)
Standard
Minimal
Minimal
Severity
Rigor of Verification Intensive
Standard
Minimal
Positive and negative testing (as appropriate) -evidence required (e.g., critical screen shots, report(s), witness signatures - QA and 2nd person review required Positive testing, including multiple/alternative path testing -standard evidence required (outcome, tester initials, date) - 2nd person review required (QA review not required) Minimal testing -Vendor or leveraged documentation - verification may be required to test requirement - 2nd person review required (QA review not required)
High: functions impacting product release, process control, batch records, complaints, recall,
regulatory filings, adverse event recording etc. Medium: functions impacting support processes driven by GMP regulations, critical business processes Low: functions impacting supporting processes NOT driven by regulation Acknowledgment: Lily Mo, Pfizer Global Quality Operations
Example 5: Leveraging Supplier Testing
• System – Business Workflow Mapping Tool – Limited configuration required to implement at customer’s site
• Approach – Extended audit to verify Supplier
Functional Risk Assessment and Testing – Additional effort, 4 days to conduct the review of Functional Risk Assessment and Supplier Testing
• Outcome – Regulated company testing more spot
checks of high impact functions (3 days) – Original regulated company test plan allowed for 6 man weeks testing Acknowledgment: Chris Reid, Integrity Solutions Ltd.
Example 6: Business Benefits •
Pre GAMP
Business processes not defined Requirements unclear/incomplete Projects over-ran User expectations not met
Acknowledgment: Winnie Cappucci (formerly Bayer)
•
Post GAMP •
Adoption of lifecycle approach
•
Brought discipline (painfully!)
•
Users understood business processes
•
Users understood business needs
•
Requirements and quality attributes traceable to business process
•
Requirements prioritised
•
Compliance to timelines and costs (mostly)
•
System understood by users
•
Systems accepted by users
•
Traceability made maintenance easy
What is Lean Validation? • Lean Validation is defined as the delivery of validation services with as little “waste” as possible.
History of the Problem
Problem Statement • COST OF VALIDATION
~ 25% of the total capital
• TIME
Inadequate cycle times Effort takes too long Inability to support timelines based on business needs
What have we typically seen? • • • • • • • •
No uniform practice Unclear expectations Unclear roles and responsibilities Duplication of effort and rework Significant resource commitment Inconsistencies Functionally siloed activities Re-interpretation of requirements leading to re-drafting of protocols • Multiple reviews / approvals for each protocol
What is the impact? • Major cause of contract breaks
schedule
cost
• Work environment
stress
anxiety
morale
Current Qualification Practice rework IQ
“churn”
OQ PQ rework
Let’s Re-design the Process • Integration and alignment of Qualification & Capital execution
• Application of Front-End Loading (FEL) principles
Early cross-functional involvement, understanding, consensus and commitment
• Conformance to regulatory and cGMP expectations from the start
Re-design Tools • Defined, integrated work flow process Identification of key milestones identified interdependencies between construction & qualification activities • Responsibilities Matrix Defined roles and responsibilities • Standard Qualification templates Process & Packaging Equipment Laboratory Systems Any Automation!!!
Cost Savings • Reduced cost to less than 20% of capital expenses • Achieved a cost profile of 10% or less of capital expenses • Eliminating or reducing non-value added work
Some Other Cost Savings Measures…
Document Approvers • Typical approval cycle is five validation documents approvers • Lean Approach: Should be two document approvers
System Owner Quality
Benefits (of reduced approvers) • Reduced cycle times • Faster turnaround of verification documents • Cost efficient • Reduced numbers of EDM users
Lower license cost for reduced number of document approvers
Verification Forms Implementation of verification forms instead of protocols • • • •
Driven by SOP Individual Forms are pre-approved Installation & Functional Verification forms Forms can be created by leveraging existing protocols
Verification Forms (cont.) • Forms can be created from requirements and design documents • Forms can be used for the validation of changes to existing systems • Examples of verification forms
Security verification Recipe verification Audit trail verification Parameter verification P&ID verification Loop check verification
Benefits of implementing verification forms • • • •
Cycle time reduction Faster turnaround time Only one approval cycle Cost reduction: ~ $ 750 per form vs $ 5,000 per protocol
Productive Validation – its Very Important! • Companies need systems for:
operations to make much-needed products for patients
• And to promote:
increased assurance of product quality sustainability
• Systems need validation • Validation needs to be efficient and effective by:
having an efficient validation process applying effective governance good in-depth training and expertise continuous improvement
So what is left to do? • Improve our validation processes
they’re capable of much further
refinement
• Standardize the approach • Judiciously apply risk management and E 2500 • Spend project time on the front end of the system life cycle process • Look at the final steps around handover • Get into the continuous improvement mind-set
Validation Productivity Priorities • Upgrade the validation system • Focus on the
•6.6
the front end (validation planning, strategy and specification development) the back end (handover and maintaining control in operation)
•6.2
•6.0
•5.7
•5.5
•7.0
•7.5
•7.4
•5.5
•4.4
•4.6
•3.6
Validation Productivity Priorities
• Standardize the approach across the organization • Focus on
Defining the deliverables Scalability Integration of E 2500 into the process Involvement of SMEs and QA Applying Globally
Validation Productivity Priorities
• Focus on
Integrating risk management into the entire process Apply it ruthlessly Spread it throughout the organization … … once it’s right
High
Medium
Low
Validation Productivity Priorities
• Spend project time
on planning using risk management using the expertise of SMEs on design review
Validation Productivity Priorities
• … and don’t forget
Handover – data accessibility for users – knowledge transfer – measured performance criteria
Validation Productivity Priorities
• Continuous Improvement
Embrace new approaches Learn from each project Build the learning back into the validation process Spread the word
Validation Productivity – The target? • Continuous improvement
cost effective validation projects – a few % of project cost
from
be part of the solution
