White Paper: Paper: GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
White Paper
The new GAMP®5 guidelines were released February 2008 at the ISPE Manufacturing Excellence Conference in Tampa, Florida. These guidelines are the latest, up-to-date thinking in the approach to validation of GxP computerized systems. The purpose of the guidelines is to “provide a cost effective framework of good practice to ensure that computerized systems are t for use and compliant with regulation.” 1 GAMP History GAMP (Good Automated Manufacturing Practice) was started in 1991 by a group of pharmaceutical experts in the UK who wanted to meet the changing FDA expectations for GMP compliance of manufacturing and related systems. They joined forces with ISPE (International Society for Pharmaceutical Engineering) as a “technical sub-committee” and in 1995 released the rst GAMP guidelines. GAMP 4, which was released in 2001, has been one of the standards GxP companies have been using for computerized system validation for the last seven years.
Today GAMP is a global organization which has “communities of practice” (COP) in Europe, Japan, and the Americas. The GAMP guidances are accepted by regulators world wide and referenced by the FDA and PIC/S in their documents. Why GAMP 5 Now? Since the release of GAMP 4 in 2001 the regulatory bodies had made signicant updates in their thinking and approach to regulatory compliance. These changes include;
•
FDA cGMPs for the 21st Century initiative and associated guidance promoting science-based risk management.
•
ICH Guidance Q8, Q9, and soon to be released Q10, which is expected to promote science based risk management.
•
PIC/S Guidance Practice for Computerized Systems in Regulated GxP Environments which clarify regulatory expectations.
GAMP also designed GAMP 5 to be compatible with IEEE standards, ISO 9000 and 12207, IT Infrastructure Library (ITIL), and other international standards. GAMP also wanted to: •
Focus attention on computerized systems that most impact patient safety, product quality, and data integrity
•
Leverage supplier activities to the maximum possible extent while ensuring tness for intended use
GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
2
White Paper
•
Recognize that most computerized systems are now based on congurable packages
GAMP 5 Overview GAMP wants to make it clear that GAMP 5 is “not a prescriptive method or standard, but rather provides pragmatic guidance, approaches and tools for the practitioner.” 1 This means that companies should use these guidelines along with other guidelines and industry best practice to determine the best approach for validating GxP computerized systems.
There are ve key concepts to GAMP 5 • • • • •
Product and Process Understanding Lifecycle approach within QMS Scalable Lifecycle Activities Science Based Quality Risk Management Leveraging Supplier Involvement
Product and Process Understanding Understanding the product and process is critical in determining system requirements and for making science and risk-based decisions to ensure that the system is “t for use.” In determining “t for use,” attention should be focused on “those aspects that are critical to patient safety, product quality, and data integrity.” 1 GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
3
White Paper
Product and process knowledge is also important in other phases of the computerized software lifecycle including the “operation” phase. Here it is important to have knowledge of the product and process to determine if changes to the system or failures of the system could affect patient safety, product quality, or data integrity. Lifecycle Approach within a QMS Dening a lifecycle approach to a computerized system has been expanded from GAMP 4 to include all phases and activities from concept and implementation through operation and retirement. These activities should be dened within the quality management system (QMS). This allows for a consistent approach across all systems.
There are four major phases dened for any system: • • • •
Concept Project Operation Retirement
GAMP recognizes that suppliers can be valuable in assisting the companies in any or all phases of the lifecycle.
GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
4
White Paper
Scalable Lifecycle Activities Within the GAMP 5 guidelines GAMP outlines that lifecycle activities should be scaled according to:
• • •
System impact on patient safety, product quality, and data integrity (Risk Assessment) System complexity and novelty Outcome of supplier assessment
There may be other factors that companies may want to consider when making assessments, but this process should be documented and follow established policies and procedures. By conducting this assessment companies can scale their validation effort and other lifecycle activities to the appropriate levels. Because of the use of a “scaled” approach, GAMP has reassessed their V-model and has “generalized” the model to account for other possible approaches.
This model can be expanded or even reduced depending on the scale or scope of the system being validated. GAMP gives three practical examples of the V-model in their guidelines.
GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
5
White Paper
Science Based Quality Risk Management Science Based Quality Risk Management allows companies to focus on critical aspects of the computerized system and develop controls to mitigate those risks. This is where a clear understanding of the product and process is critical to determine potential risks to patient safety, product quality, and data integrity.
GAMP 5 describes and talks about a ve step process for risk management based on ICH Guidelines. They acknowledge that this is not the only approach and that each company needs to decide what approach best works for its intended use.
GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
6
White Paper
Risks that have been identied can be mitigated by: • • •
Elimination by design Reduction to suitable level Verication to demonstrate that the risks are managed to an acceptable level
Leveraging Supplier Involvement Regulated companies regularly involve suppliers throughout the system lifecycle. Suppliers have the knowledge, experience, and documentation to assist companies throughout the system’s lifecycle. GAMP 5 suggests regulated companies need to maximize that involvement to “determine how best to use supplier documentation, including existing test documentation, to avoid wasteful effort and duplication. … Documentation should be assessed for suitability, accuracy, and completeness. There should be exibility regarding acceptable format, structure and documentation practices.” 1
Suppliers can be used to assist companies with: • • • • • • •
Gathering requirements Creation of functional and other specications System conguration Testing Support Maintenance System retirement
It is important to remember that the regulated company has the responsibility for the documentation, approval, and compliance of each element of the computerized system lifecycle. With increased involvement of the supplier in the lifecycle, regulated companies need to assess that the supplier has processes in place to ensure quality of the product. GAMP has included a section in GAMP 5 dedicated to supplier activities to assist suppliers in understanding the needs of their customers. Other Highlights Verifcation vs. Validation
Throughout the guidelines GAMP in many places uses “verication” in place of “validation” where appropriate. The industry has used “validation” inappropriately for many years now. Verication is dened as the conrmation that the specications have been met. The verication process may involve reviews and testing.
GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
7
White Paper
Category Updates As computerized systems have changed over the years GAMP has updated the categories used to dene computerized systems. The most signicant change is the removal of category 2 “rmware” from the list. Due to the improvements in rmware, rmware has become so complex that it is no longer functionally distinguishable from software.
Other changes include updating the categories names to better dene the categories. Below is a chart showing the differences between GAMP 4 and GAMP 5. Category
GAMP 4
GAMP 5
1 2 3 4 5
OS Firmware Standard Software Congurable Software Custom Software
Infrastructure (OS, DB, MW, etc.) -REMOVED Non-congurable Software Congurable Software Customizable Software
Updated Templates Based on the changes to the GAMP guidelines, the templates in the appendices have also been updated to reect the changes to GAMP 5 and other regulatory requirements. These templates are useful for creating or updating your policies, procedures, or processes. The appendix gives more examples on “how” and incorporates comments, suggestions, and changes over the last seven years.
The Operational appendices have been updated to cover all phases of the Operation Phase. A new appendix has been introduced, called “Special Interest Topics,” which adds to the extensive number of templates. Conclusion While there are new revolutionary concepts in GAMP 5, it does bring together the latest industry and regulatory thinking in GxP computerized system validation into one concise guidance. By using the basic concepts that the GAMP, FDA, PIC/S, and other groups have been touting—such as using a scientic risked based approach to validation and leveraging vendor documentation—regulated companies can reduce the time and cost necessary for validation and maintain their systems in a compliant state.
For more information or to order the GAMP 5 guidelines see the ISPE website at www.ispe.org. Reference 1. GAMP®5: A Risk-Based Approach to Compliant GxP Computerized Systems. © Copyright ISPE 2008. All right reserved. www.ISPE.org.
GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
8
White Paper
About MasterControl MasterControl Inc. is a global provider of GxP process, quality audit, and document management software solutions for life science companies. MasterControl™ products are easy to use, easy to deploy, easy to validate, and easy to maintain. They incorporate industry best practices for automating and connecting every stage of the product development cycle, while facilitating regulatory compliance. By combining an integrated platform with a continuum of risk-based software validation products and services, MasterControl drives down the total cost of ownership and enables customers to extend their investment across the enterprise. Hundreds of companies, including 50 percent of the top 20 pharmaceutical enterprises, currently use MasterControl solutions for easier compliance, faster validation, and better process management. For more information about MasterControl, visit www. mastercontrol.com, or call 800-825-9117 (U.S.) or +44 118 9812838 (Europe).
GAMP®5: A Risk-based Approach to Compliant GxP Computerized Systems
9
MasterControl Inc. USA 6322 S. 3000 E. Suite 110 Salt Lake City, UT 84121 P. 800.825.9117 F. 801.942.7088 www.mastercontrol.com Europe 7200 The Quorum Oxford Business Park North Garsington Road Oxford OX4 2JZ United Kingdom P. +44 (0) 1865 481481 F. +44 (0) 1865 481482 www.mastercontrolglobal.co.uk
