Computer System Validation for Cloud and COTS Applications
Most companies today are buying, rather than building, the computer systems that they use in their GxP-regulated activities. However, for pharmaceutical, biotech, medical device, and similar companies, computer system validation (CSV) is still required. But CSV responsibilities and approaches have changed.
Whether your solution is cloud-based, SaaS, COTS (commercial-off-the-shelf), or OOTB (out-of-the-box), this seminar has been designed to ensure that you leave knowing what to validate, how to validate, and when to leverage vendor-supplied documentation in your validation. You will also learn the necessity and power of vendor assessments and risk-based validation.
This computer system validation course incorporates FDA, ICH, and Eudralex expectations for risk-based computer system validation, and aligns with industry-wide standards, such as those defined by GAMP and PIC/S.
Our Approach to Computer System Validation Training
Our experienced computer system validation consultants have designed a concise, yet thorough course to equip you with the information you need to validate purchased applications. A mixture of instructor lectures, class activities, and real-world examples will keep you engaged. And, there will be plenty of opportunities to get answers to your company-specific questions.
What You Get
- Knowledge of the many models of cloud implementation, e.g., SaaS, PaaS, IaaS
- Understanding of appropriate validation approaches for cloud (e.g., SaaS) and purchased (e.g., COTS) systems
- Recognition of the company and vendor responsibilities that occur when implementing purchased (e.g., COTS) system and Cloud solutions
- Appreciation for the increased importance of vendor assessments, the methods of vendor assessments, and how these assessments impact your validation approach
- Comprehension of which software does and does not require validation.
- Understanding of the purpose and required contents of all validation deliverables, including Validation Plans, Requirements Specifications, Validation Tests (IQ, OQ, PQ), Trace Matrices, and Validation Reports
- A walk-through of a complete package of validation deliverables for a configured, off-the-shelf system.
- A methodology for system risk assessment and an implementation model for risk-based computer system validation
- Awareness of what it really takes to be 21 CFR Part 11 and Annex 11 compliant
- Data and examples of common FDA Warning Letter topics regarding software validation and system quality
Who Should Attend CSV for Cloud and COTS Applications?
IT, QA, Engineering & Business Managers and Professionals who need to:
- Manage computer system validation projects
- Approve CSV project deliverables, such as validation plans, requirements documents, validation protocols (IQ, OQ, PQ), trace matrices, and validation reports
- Audit computer system validation processes and documents
- Assess software vendors’ quality assurance practices prior to purchasing systems for use in GxP activities
Materials Provided
Course binder, Example validation package, Certificate of Completion
Course Agenda
Module 1: Computer System Validation (CSV) Regulations
- CSV Purpose and Benefits
- Validation definition
- Which systems require validation
- Global CSV regulations and guidelines, e.g., FDA, ICH, EudraLex, PIC/S, WHO
- Specific COTS, Cloud, and SaaS requirements
- FDA Predicate Rules
Module 2: FDA 21 CFR Part 11
- Which systems require Part 11 compliance
- Electronic Records Requirements
- Electronic Signatures Requirements
- Closed Systems Requirements
- Open Systems Requirements
- Part 11 Guidance and Enforcement
Module 3: Annex 11
- Which systems require Annex 11 compliance
- Risk Management requirements
- Software and service provider requirements
- Validation requirements
- Data protection requirements
- Electronic signature requirements
- Business continuity requirements
Module 4: Implementation Models
- COTS and OOTB models
- Cloud models
- SaaS, PaaS, and IaaS models
- Additional models
Module 5: CSV Methodology
- Validation “V” model, e.g., GAMP
- Validation, Verification, and Qualification
- Validation approaches for COTS, Cloud, and SaaS models
- Validation Responsibilities with COTS, Cloud, and SaaS models
Module 6: Requirements
- User Requirements Specification (URS)
- Functional Requirements Specification (FRS)
- Requirements writing best practices
- URS and FRS content
- Example URS and FRS for a purchased system
Module 7: Risk Assessment and Mitigation
- Risk management terminology
- Risk assessment methodology
- Risk mitigation practices
- Risk-based computer system validation
- Example Risk Assessment for a purchased system
Module 8: Validation Plan
- QMS to support validated systems
- Scaling and sequencing validation activities
- Acceptance criteria
- Validation Plan contents
- Example risk-based Validation Plan for a purchased system
Module 9: Design and Development
- Design contents
- Design reviews and Code reviews
- Coding standards
- Example Design for a purchased system
Module 10: Validation Test Writing
- Testing techniques
- Test Plan purpose and contents
- IQ, OQ, and PQ
- IQ structure and contents
- OQ and PQ structure and contents
- Validation test writing best practices
- Example Test Plan for a purchased system
- Example IQ for a purchased system
- Example OQ and PQ for a purchased system
Module 11: Validation Test Execution
- Validation test execution process
- Validation testing documentation
- Validation test execution best practices
- Validation testing failures
- Example Validation Incident Report for a purchased system
- Example executed OQ and PQ for a purchased system
Module 12: Trace Matrices
- Trace matrices contents
- Example Trace Matrix for a purchased system
Module 13: Validation Report
- Validation Report contents
- Validation Plan deviations
- Example Validation Report for a purchased system
Module 14: Supplier Assessment
- Assessment timing
- Supplier assessment methods
- Risk-based method selection
- Supplier assessment topics
- Supplier audit process and best practices
- Leveraging audit results in risk-based validation
Module 15: Service Level Agreements
- Important of Service Level Agreements (SLAs)
- SLA role in risk mitigation
- Contents of SLAs
Module 16: CSV Failure Consequences
- FDA enforcement options
- FDA Warning Letter statistics for software
- Examples FDA Warning Letters for purchased systems
Module 17: Program Implementation
- CSV program implementation steps
- Supplier assessment program implementation steps