GAMP categories and CSV workshop

Effective way to achieved compliance in GxP computerized system

Arnold Edrick, Fajar Sidik, M.Thoha, Ruri Nitrita, Angga Lazuardy, Narya Wijaya
23-24 September 2019
 Hardware Categories
01
Agenda 02 Software Categories

Benefit
03

23-24 September 2019

• Hardware Categories

Standard
Ready to use hardware/
01 infrastructure

Custom
Specially design hardware
specification (DS) must be available
02

23-24 September 2019

 • History GAMP 4 vs GAMP 5
software categories
GAMP 4 GAMP 5

Categories 1 Operating System Categories 1 Infrastructure &

only Layered software
Categories 2 Firmware USP <1058>
Categories 3 Standard Software Categories 3 Non-configured
Package product
Categories 4 Configurable Categories 4 Configured
software package product
Categories 5 Custom
Categories 5 Custom software application

23-24 September 2019

 •Software Categories GAMP 5
Category 1 – Infrastructure
Software/ Layered software Category 3 – Non-Configured Product

Form an integrated environment for “Out of the box product” / “Off the
running and support application shelf product”
and service.
Used by default configuration or else
called parameterization
GAMP 5
Software
Categories
Category 4 – Configured Product
Category 5 – Custom Application You can simply impress your
audience and add a unique zing
Developed software using scripting and appeal to your Presentations.
language to satisfy specific business Easy to change colors, photos.
needs.
23-24 September 2019
•Software Categories 1

Typical example of Commercially available layered software

• Operating System • Spreadsheet package

• Database Managers • Ladder logic
• Programming Interpreters
Language • Statistical programming
• Middleware • Is the system commercially
available (widely common)?
Typical Example of Infrastructure Software
• Is the software or system
• Network monitoring • Configuration used in IT environment?
software management tools
• Batch job scheduling • Version control tools
• Security software

23-24 September 2019

•Software Categories 3
Typical Example of Non-Configured

• Firmware based • Instruments

application • Some Programmable
Logic Control (PLC) • Is the system / application use without
configuration (use immediately)?

• Is the system configuration scope is

printer availability, report header ?

• Is configuration within the scope of

installed application (parameter
modification) ?

23-24 September 2019

 •Software Categories 4 & 5
Typical Example of Configured product* • Is the business process can be changed ?
• How did you change the process?
• LIMS
This example may • Did you develop this application inhouse?
• SCADA
have some custom • Do you following SDLC on your application
• ERP
modulation. before release it to the costumer ?
• BMS
• Do you create the application for each
• EMS
costumer ?
• HMI

Typical example of custom application

• Internally developed IT application
• Internally developed process control
• Custom ladder logic
• VBA macro or excel with macro
• Custom firmware

23-24 September 2019

 Benefit

• Resource and timeline projection

• Necessary vendor audit plan

• Document necessary for compliance

• Minimize validation effort

23-24 September 2019

CSV Model
verifies
Planning Reporting

User verifies Performance

Requirements Qualification Tests
Specification (PQ)
Functional Risk verifies Operational
Functional Assessment Qualification Tests
Specifications
(OQ)
verifies Installation
Design
Qualification Tests
Specifications
(IQ)

System Build
23-24 September 2019
 • CSV Component

1. System overview
1. Purpose 2. System architecture
2. System overview 1. System overview 1. Deviation
3. Data & access
3. System Requirement 2. Scope 2. Justification of
management
4. Functional 3. Responsibilities deviation
4. Security matrix
Specification 4. Test plan and 3. Result
5. Process description
5. Technical procedure 4. Conclusion
6. Infrastructure &
Specification 5. Recommendation
software
6. Design Specification 7. Reference document
8. Risk analysis

URS Risk Assessment Protocol Report

23-24 September 2019

 • CSV Component URS
Indicate the wished key objectives and benefits of company
Ensure that these benefits are covered by the specific requirements
1. Purpose Summary of system main function
2. System overview
3. System Requirement Describes the specific required quality, operational capacity,
regulation, HSE, computerized
4. Functional Describes of how the system/ equipment will work to fulfill the
Specification requirement
5. Technical
Defined the utility, area, service, certification needed to ensure the
Specification
achievement of system requirements
6. Design Specification
Giving the design of system looks and specification of the infrastructure,
peripheral hardware and software to support the functional specification

URS

23-24 September 2019

Environment Monitoring System 2.1 Operational range of sensor is within 20,0°C to 35°C with calculation
of MKT of adjustable period
Installed in warehouse
The area is ambient and cool 2.2 Sensor will give temperature result in °Celsius accurately and
immediately shown on the client PC.
room
2.3 System will record a real time temperature monitoring and save the
data at client PC internal har disk
Requirements
Point 2 in the 2.4 Limited access to the system using security matrix divided per level
document of access with 2 points verification (ID and password)

2.5 Audit trail will record the specific ID start from login until logout with
provided audit trail reporting function in unchangeable format for every
action been done in the system

2.6 No generic ID was possible to be used in the system, unique ID

should be mandatory for every username creation

2.7 Periodic backup and restore data can be successfully performed by

user and backup system should be available

23-24 September 2019

HPLC 2.1 HPLC with auto sampler with minimum vial capacity are 100 vial
Installed in QC Lab.
2.2 HPLC pump operation range minimum is 600bar or 8000psi

2.3 HPLC pump can be as isocratic elution and gradient elution

2.4 During HPLC running a sample no electrical shortage will affect the
system for until minimum of 24hours
Requirements
Point 2 in the 2.5 Limited access to the system using security matrix divided per level
document of access with 2 points verification (ID and password)

2.6 Audit trail will record the specific ID start from login until logout with
provided audit trail reporting function in unchangeable format for every
action been done in the system

2.7 Periodic backup and restore data can be successfully performed by

user and backup system should be available

23-24 September 2019

 •CSV Component Risk Assessment
Provide the access
registered in the system and
how the system manage
data including saving,
backup, archiving,
modifying, and transferring
Provide system business
process and/or system
functionality description
List of document related
in creating risk
assessment (manual
books, supplier FS/ DS,
URS, etc)
Summary of system main function
1. System overview
Defined the system conceptual model as
2. System
representative of the actual system installed that
architecture
give overall understanding of structures and
3. Data & access
behavior
management Give the list of access capabilities to each
4. Security matrix
function related to the system
5. Process
Provide system infrastructure
description
(including peripheral hardware) and
6. Infrastructure &
software
software
7. Reference Assessing the risk according to process
document description with detailed risk scenario,
consequences and risk category.
8. Risk analysis
The result is a test plan related to the
Risk Assessment functional and/or business process
23-24 September 2019
• Risk level assessment method
Risk Level Consequences
Critical (C) 1. Has possibility on data lose, stopped
analysis or manipulation data.
2. There is a violation of GMP regulation
with an impact on public health.
Major (M) 1. Has no possibility on data lose or
manipulation data but has impact for
analysis.
2. There is a direct and undetectable
violation of GMP regulations, without
impact on public health
Minor (m) 1. There is no effect on data and
process of analysis.
2. Indirect or detectable violation of
GMP regulations, without impact on
public health.
Example
Sample can be reinjected and
previous inject not shown on the
result (must be tested)
And some negative test may in
coorporated to the OQ/PQ
Data saved at server can’t be
accessed using menu. (must be
tested)
Report can’t be printed (may not be
tested, better if tested)
23-24 September 2019
 2 HPLC Risk Assessment
Process a. Lockout threshold: 3 times
GxP Risk
Description (maximum login retries) Process
ID Risk scenario consequence leve Action
step
s l
Data may be OQ: Perform
loss in the validation of
Data backup and
event of C backup process
restore failure
system and restore
corrupt process
OQ: Test plan
System
2.3.1.5 Backup and to verify the
backup and
/6. restore backup and
Backup and restore restore may
restore access
may be performed by performed in
C are limited to
unauthorized the such
personnel
personnel event that
according to
will impact
default security
existing data
matrix
Risk analysis
ID Process step Risk scenario GxP consequences Risk level Action
OQ: Test plan to verify any
login without ID is not
Login may be performed without ID or
2. Login Security of data in HPLC C possible
a correct password
Any login with incorrect
password also no possible
OQ: Verify there is threshold
Wrong login may be performed
HPLC is vulnerable to lockout system incorporated
2a repeatedly in attempt to breach the C
unauthorized access for maximum number of
HPLC system 23-24 September 2019
login retries
 Serialization server
Process description Serialization Risk Assessment
ERP recipe/ with recipe/ material
material
2.1 products management
management

a.Recipe management

GxP Risk
ID Process step Risk scenario Action
consequences level
1. System OQ: Test plan to
architecture Recipe management verify the data set
(According to system Wrong set of from ERP
Serialization The data set from
Client PC
architecture recipe data will lead to transferred
2.1.a ERP will not be C
for serialization will incorrect serial successfully and
transferred correctly
be interfaced from code generation correctly in the
ERP) Serialization client
PC

ID Process step Risk scenario GxP consequences Risk level Action

OQ: Accessing the recipe
Recipe management may be accessed by Uncontrolled serialization management should be
C
unauthorized person result limited and on authorized
person possible
OQ: Test plan to verify any
2.1.a Recipe management
modification will increase the
Any change to the recipe
Activity in recipe management recipe version
will have impact in final C
untraceable print record audit trail after
serialize product
recipe management been
23-24accessSeptember 2019
 Mixing Tank Risk Assessment
GxP
Risk
ID Process step Risk scenario consequenc Action
level
es
OQ: Test case to
Incorrect temperature Impairment to
verify the actual
setting and actual value product M
value show on
output stability
display is correct
OQ: Test case to
Temperature did not Process verify the setup
M
stop at specific run time interrupted temperature run
Temperature
for period
2.5.2 command
OQ: Test case to
button
capability of
mixing tank to
Mixing tank cannot
Process maintain
maintain temperature M
interrupted temperature
inside
after holding
function is
activated

ID Process step Risk scenario GxP consequences Risk level Action

OQ: Verified with taco
Incorrect speed output to the Product not
M meter and verify the
HMI dissolved
result with HMI display
2.5.1 Stirrer command button
OQ: Tested on machine
Product not
Incorrect run time output M initial PQ with calibrated
dissolved
stopwatch
23-24 September 2019
 • CSV Component Protocol
Explain system overall summary

Explain the protocol usage whether it is a initial

validation of validation because of some 1. System overview
modification or system upgrade, etc 2. Scope
3. Responsibilities
Personnel responsibilities list for who will perform 4. Test plan and
the test, review the test and approved the protocol procedure

Include the test name and reference number, test

purpose, test step/procedure, acceptance criteria
and personnel sign for every test

Protocol

23-24 September 2019

Testing 1 - Unauthorized Login
Unauthorized / unregistered User ID, incorrect User ID, incorrect
HPLC Protocol
password, will prohibit user from entering the system.
Test Objective Risk assessment

To ensure that unauthorized / unregistered user ID or password GxP Risk

Process
cannot be used for login ID Risk scenario consequenc lev Action
step
es el
Test Description OQ: Test plan
1. user ID (empty) and correct password to verify any
login without
2. Verify that it cannot login
Login may be ID is not
Security of
3. Type valid user ID and incorrect password performed without possible
2. Login data in C
4. Verify that it cannot login ID or a correct Any login
HPLC
Acceptance Criteria
password with incorrect
password
System cannot be accessed by unauthorized / unregistered user using
also no
no ID or using incorrect password
possible
Results

23-24 September 2019

Testing 2 - Backup Restore
This function is for the project database and the log database can be HPLC Protocol
backed up. GxP Risk
ID Process step Risk scenario Action
Test Objective consequences level
To ensure the user with proper rights can use this function. OQ: Perform
Data may
Test Description validation of
Backup be loss in
1. Login to LabSolutions as System Administrator 2.3.1. Data backup and backup
2. Click the [Administration] icon and select the [Backup] by clicking
and the event C
5/6. restore failure process and
the icon to start the Backup program. restore of system
restore
3. Select 1 or more data from database corrupt
process
4. Verify that the [Backup] function is working
5. Login to LabSolutions as System administrator
6. Click the [Administration] icon and select the [Restore] by clicking
the icon to start the Restore program
7. Verify that the [Restore] function is opened to start the [Restore].
8. Verify that the restore result

Acceptance Criteria
Successful backup and restore sequence
Results
Point 4 – backup result

Point 8 – Restore result

Conclusion:
23-24 September 2019
• CSV Component Report

Deviation happen for each test

1. Deviation
Justification whether the deviation have impact or 2. Justification of
not to the operating system and regulation deviation
3. Result (with
Test protocol result (success or not) (with evidence)
attached evidence) of test plan 4. Conclusion
5. Recommendation
State whether the system is valid or not

Any observable suggestion to increase the

system compliance

Report

23-24 September 2019

Testing 1 - Unauthorized Login
Unauthorized / unregistered User ID, incorrect User ID, incorrect HPLC Report
password, will prohibit user from entering the system.
Test Objective
To ensure that unauthorized / unregistered user ID or password
cannot be used for login

Test Description
1. user ID (empty) and correct password
2. Verify that it cannot login
3. Type valid user ID and incorrect password
4. Verify that it cannot login
Acceptance Criteria Evidence

System cannot be accessed by unauthorized / unregistered user using

no ID or using incorrect password

Results
Testing 2 - Backup Restore
This function is for the project database and the log database can be backed up. HPLC Report
Test Objective
To ensure the user with proper rights can use this function.
Test Description
1. Login to LabSolutions as System Administrator
2. Click the [Administration] icon and select the [Backup] by clicking the icon to
start the Backup program.
3. Select 1 or more data from database
4. Verify that the [Backup] function is working
5. Login to LabSolutions as System administrator
6. Click the [Administration] icon and select the [Restore] by clicking the icon to
start the Restore program
7. Verify that the [Restore] function is opened to start the [Restore].
8. Verify that the restore result

Acceptance Criteria
Successful backup and restore sequence
Results
Point 4 – backup result
Point 8 – Restore result
Conclusion:
 Template URS
Purpose
(Indicate the wished key objectives and benefits and ensure that these
benefits are covered by the specific requirements included in section 3 and
1.
satisfied using indexes/percentages of improvement.)
Example: 5% of improvement process efficiency.

System overview
2. (Summary of system main function)

3. System Requirement
3.1 Data management (scope backup-restore, data saving, data modification)
3.2 Access level requirement
3.2 ALCOA+ requirement
3.3 Business requirement
3.4 Technical requirement (utility, space, ducting)
3.5 HSE requirement
3.6 Document / Certificate requirement
 Template Risk Assessment

ID
(refer to Requirement/ GxP Risk Action
Risk scenario
requirement) process flow consequences level (IQ/OQ/PQ)

1.
2.
3.1
3.2
…
 Template IQ Protocol

Protocol
Observations /
Pass/Fail/Pass
No. Action Expected Result Deviations / Sign / Date
with notes
Attachments
I. Sub section of IQ Protocol (system installation condition) / hardware specification / software specification / supporting procedure
/vendor document and certification
1. Verify Procedure … in place Procedure … in place Procedure number : XXxXX Pass ßÀ© 24 Sep 2019
2.
3.
…

Observations /
No. Action Expected Result Deviations / Pass/Fail Initials / Date
Attachments
II. Sub section of IQ (system installation condition) / hardware specification / software specification / supporting procedure / vendor
document and certification
Installed according to
4. UPS installed UPS brand, specification expected result Pass ßÀ© 24 Sep 2019
5.
6.
..
 Template OQ Protocol
Test 1 Test 2
General test title General test title
Test Objective Test Objective
what function that this test wanted to introduce/ what function that this test wanted to introduce/
challenged challenged
Test Description Test Description
1. Test step or process to achived objective 1. Test step or process to achived objective
2. 2.
3. 3.
4. 4.
… …
Acceptance Criteria Acceptance Criteria
Result of the test that we are hoping to meet Result of the test that we are hoping to meet
requirements requirements
Results Results

Test pass or not Test pass or not

 Template Report
Report
Deviation
Explain which and what test protocol have deviation
Justification for Deviation

Result
Attachment 1 - Evidence (screenshot)
Attachment 2 - Evidence (screenshot)

Conclusion
The system valid or not
Recommendation
Any observable recommendation
THANK YOU