2001 Cognizant Technology Solutions

Life Cycle Approach Towards Software Validation

Introduction
According to FDA guidelines, validation is confirmation y e!amination and "rovision of o #ective evidence that soft$are s"ecifications conform to user needs and intended uses, and that the "articular re%uirements im"lemented through soft$are can e consistently fulfilled &ife cycle a""roach to$ards soft$are validation ensures that validation activities occur not only at the end ut also through out soft$are develo"ment life cycle' (alidation of soft$are includes evidence that all soft$are re%uirements have een im"lemented correctly and com"letely and are tracea le to system re%uirements' Soft$are validation is #oint res"onsi ility of "arty $ith regulatory res"onsi ility )for e'g' "harmaceutical com"any* and Soft$are vendor' +harmaceutical com"anies regularly audit soft$are,s vendor,s %uality "rocesses, "rocedures and systems for com"liance $ith -.+ and FDA guidelines on soft$are validation' A conclusion that soft$are is validated is highly de"endent u"on intended use to $hich soft$are is "ut and re%uires com"rehensive testing, ins"ections, analyses, and other verification tas/s at each stage of the soft$are develo"ment life cycle'

Regulatory requirements
(arious governing odies "u lish regulatory re%uirements' These regulations com"lement industry standards and %uality system such as 0111, 0S2 and C33' A"art from 21 CF4 +art11, soft$are in "harmaceutical industry is also governed y regulatory re%uirements in -.+ regulations' Some of the "rominent rules outlining regulatory re%uirements are discussed elo$' GMP 4egulatory re%uirements as defined in -ood 3anufacturing +ractices )21 CF4 210 and 21 CF4 211* cover areas li/e5 3aintenance "rocedures 6ac/ u"s and archival "rocedures Documentation of master formulas, s"ecifications, test records, master "roduction and control records atch "roduction records Change control "rocedures Data accuracy and security "rinci"les Controls on electronic record li/e ac/ u"s, security and retention -uidelines on record retention, re"roduction accuracy, record verification, 7C revie$ etc' +ro"osed amendment to c-3+ regulations ma/e validation com"ulsory for drug "roduct manufacturing "rocesses' These "rocesses include, ut not limited to, com"uterized systems that monitor and8 include documented rigorous testing to demonstrate the effectiveness and re"roduci ility of the "rocess'

919

 2001 Cognizant Technology Solutions

GCP -C+ regulatory re%uirements $ere develo"ed out of need to limit mal"ractice' 0nternational Conference on :armonization -ood Clinical +ractice defines regulatory re%uirements in areas including5 Trial 3anagement covering data handling, record /ee"ing +rovision for inde"endent data monitoring committee 3aintaining audit trail, edit trail, data trail Security "rocedures Safeguarding linding in Clinical Data 3anagement

Some of the regulatory re%uirements defined in FDA guidance on Com"uterized Systems used in Clinical Trials cover areas such as5 System 3aintenance Data ac/u", recovery and contingency +lans Security Change Control Data retrieval and reconstruction of study Soft$are (ersion Control

GLP 4egulatory re%uirements as defined in -ood &a oratory +ractices cover areas li/e5 0dentification and definition of systems &ife Cycle control "rocedures covering re%uirements, design and testing Security measures 4a$ data verification covering ra$ data storage, maintenance logs, cali ration records, reconstruction of study Data Archival and 4etention 7uality Assurance and Training

21 CFR PART11 The sco"e of 21 CF4 "art11 regulation a""lies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any record re%uirements set forth in agency regulations'; This includes the -ood Clinical +ractice )-C+*, -ood &a oratory +ractice )-&+*, and -ood 3anufacturing +ractice )-3+* regulations )collectively /no$n as the -.+ regulations*' 4egulatory re%uirements as defined in 21 CF4 +art11 cover areas li/e5 Time9date stam"ed Audit Trails Document 3anagement covering document creation, signing, modification, a""roval, archival ad retrieval Security of closed and o"en systems covering authority chec/s, o"erations chec/s and device chec/s 1lectronic records covering $or/flo$

929

 2001 Cognizant Technology Solutions

1lectronic signature covering user authentication, loss management "rocedures and transaction safeguards 3igration and com"uter system retention re%uirements

Software validation- Life Cycle Approach

Ta/ing a life cycle a""roach to$ards soft$are validation means that validation "rocess is defined and controlled y use of "lans $hile a "rocess is e!ecuted through use of "rocedures' A validation "lan should address the validation coverage ased on soft$are,s com"le!ity and safety ris/ and should define the sco"e, a""roach, resources schedules, ty"es and e!tent of activities and $or/ items' &ife cycle a""roach to$ards Soft$are validation ensures com"liance $ith regulatory re%uirement irres"ective of soft$are lifecycle models eing follo$ed )for e'g' s"iral, $aterfall etc'*' &ife cycle a""roach addresses validation y covering areas such as 4e%uirements, Design, Construction, Testing, Change Control, Configuration 3anagement, Training, and Defect +revention'

Req ire!ents 4e%uirements should state clearly the intended use of soft$are' FDA s"ecifically mentions that each re%uirement identified in re%uirements s"ecification should e evaluated for accuracy,

9<9

 2001 Cognizant Technology Solutions com"leteness, consistency, testa ility, correctness and clarity' 3ore ever a trace a ility matri! should e "re"ared to trace soft$are re%uirements to design and to su se%uent testing' "esi#n Design s"ecification can further e classified in to :igh9level design and lo$9level design' Soft$are design should address =sa ility and =ser interface factors for user,s intuitive e!"ectations for o"eration' A structured and formal design revie$ from 7uality Assurance team can allo$ management to confirm that all goals defined in soft$are validation "lan have een achieved' Team should com"rise of "eo"le $ho are not "art of design or develo"ment ut carry sufficient functional and technical /no$ledge to evaluate the delivera les' +rototy"e and +roof of Conce"ts can "rove to e good validation vehicles as they hel" in "erforming soft$are ris/ analysis' Constr ction Definition of develo"ment "rocedures and coding guidelines is crucial in soft$are validation' 1valuation of source code should e done y code revie$s' +eer revie$s hel" in validating the lin/ages et$een functional modules and different architectural layers' Testin# Soft$are testing at various levels hel" in verifying end user re%uirements against the soft$are in ma/ing' >hile unit test "lans and "rocedures )>hite o! testing* hel" in validating the construction as "er the design, System and integration testing )6lac/ o! testing* chec/s the conformance of soft$are for its intended use' Formal testing "rocesses and documentation for test "lan, test results and test summaries should e maintained' Finally, a =ser Acce"tance Testing should e "erformed at user site $ith actual hard$are and soft$are that $ill e "art of installed system system configuration' 3easures such as defects found in s"ecifications documents, estimates of defects remaining, testing coverage, and other techni%ues are all used to develo" an acce"ta le level of confidence efore im"lementing the "roduct' Chan#e Control Change control not only attem"ts to maintain the integrity of validation "arameters, it tests the im"act of even moderate changes on functional "erformance' FDA guidance for soft$are validation mentions that $henever soft$are is changed, a validation analysis should e conducted not #ust for validation of individual change, ut also to determine the e!tent and im"act of that change on the entire soft$are system' 0t is very im"ortant that a documented "rocess for controlling the changes e in "lace and enforced' Another often9ignored as"ect of change control includes u"grades, "atches or add9ons "rovided y soft$are vendor' These add9ons or "atches can change the "arameters of a validated system and therefore their im"act must e tested and validated to ensure system integrity' >henever changes are made to soft$are system, sufficient regression testing should conducted to demonstrate the correctness of im"lemented changes' Confi# ration Mana#e!ent Configuration management "lan should e defined and follo$ed to guide and control multi"le "arallel develo"ment activities and ensure version control and documentation' e

9?9

 2001 Cognizant Technology Solutions >or/s"aces, $here develo"ers uild, test, and de ug should not e shared and code should e chec/ed9in fre%uently' Code lines, the canonical sets of source files, should e given an o$ner' Change "ro"agation, getting changes from one code line to another, should e "ro"agated early and often' Trainin# +ersons $ho develo", maintain, or use systems that fall under regulatory su"ervision, should have the education, training, and e!"erience to "erform their assigned tas/s' FDA regards this re%uirement as fundamental to the "ro"er o"eration of a facility' (alidation does not lessen the need for "ersonnel to have the education, training, and e!"erience to do their #o s "ro"erly' Along $ith formal education )e'g', academic studies* and general industry e!"erience, some degree of on9the9#o training is e!"ected' FDA also elieves that documentation of such training is also customary' The %ualifications of "ersonnel $ho develo" systems are relevant to the e!"ected "erformance of the systems they uild and their a ility to e!"lain and su""ort these systems' 0t is vital that Soft$are vendor "ersonnel are li/e$ise %ualified to do their $or/' $ndependence of Re%iew (alidation activities should e conducted using inde"endent evaluation and validation staff should not re"ort directly to system im"lementation team' >hile one $ay of "erforming inde"endent revie$ is to assign internal staff mem ers $ho have sufficient /no$ledge to evaluate the "ro#ect and conduct validation' 2ther a""roach is to involve third "arty validation e!"erts' 2 #ectivity of third "arty vendors "rotects validation activities from "otential conflicts $ith internal "roduction schedules'

Summary
Soft$are validation in conformance $ith regulatory re%uirements directly im"acts ottom line' Cost of non9com"liance, loss in client confidence and "otential for legal action are ig enough reasons for com"anies to ta/e a structured vie$ to$ards soft$are validation' >ith regulations "ro"osed on ma/ing validation com"ulsory, life cycle a""roach can hel" in articulating an enterprise-wide plan when addressing software validation, including people, processes and infrastructure as well as information systems. For further details please contact: Pan&a' " (ey Co#ni)ant Technolo#y Sol tions dpan&a'*chn+co#ni)ant+co!

9@9