Examples of Recent FDA Warning Letters / 483s Related
to Software and Computer System Validation
Increasing FDA Focus on Computer Validation
While FDA was quiet about software and computer system
validation between 2002 and 2006 this has changed significantly since 2006.
Software and computer system validation has become an inspection focus for
pharmaceutical, API and device industry. Deviations have been cited related
to all steps of computer validation from writing specification and risk
assessment to IQ/OQ/PQ, revalidation, reporting and change control. Here are
examples.
- No risk assessment for software changes
- Off-the shelf software not validated for intended
purpose
- Validation relied on validation at the vendor’s site,
no validation at the user’s site
- 3rd Party validation not reviewed
- Software versions not revalidated, e.g., patches
- Not all test scripts available
- Test results don’t meet acceptance criteria
The warning letter can be downloaded from the
Labcompliance
Usersclub. Non members can
preview
excerpts (scroll down to the W number as shown below.)
To prepare your organization for FDA inspections, and
to avoid FDA warning letters related to electronic records and signatures,
attend the
Audio
seminar "Computer System Validation - Step-by-Step, with example
documents from planning to reporting))
Examples of FDA Warning Letters / 483's Related to
Computer System Validation
- No IQ, OQ or PQ has been performed throughout the
life of the system. (W-190)
- No validation reports have been generated
historically (for the legacy system). (W-190)
- The (system) has not been maintained under
established procedures for change control. This is true throughout the
life of this software application. (W-190)
- Regarding computer validation and security
issues, you did not provide a time frame for writing and implementation
of a computer security SOP (W-198)
- The firm has failed to generate or maintain
design control documentation sufficient to define all customized
elements making up the (system) configuration (i.e., functional or
structural design documentation defining all program making up (the
system) (W-190)
- Software used as part of the production quality
system was not validated for its intended use according to an
established protocol]. Specifically, (a) Spreadsheets intended to check
for outliers and calculate mean, SC, % CV, value assignments for
finished devices. (b) Complaint handling software (c) Quantrol database
program (W-201)
- A formal risk analysis of the original system
design and software changes to correct software bugs that caused
incorrect functionality or performance problems, and to enhance the
product, has not been documented. (W-158)
- Software release notes do not explain the impact
of these software bugs on user needs and intended uses" (W-158)
- There was a failure to check for accuracy the
inputs to and outputs from the xxx Data Acquisition System, which is
used to run your firm's HPLC instruments during analysis of drug
products. For example, electronic data files were not routinely checked
for accuracy. (W-180)
- The company failed to validate software for a
device. Specifically the controller unit software version xxx was
changed to xxx. Your firm did not have any documentation showing that
the current software version was validated". (W-144)
- You made changes to versions of the ISOLOC
software. For example, you released software patches for these various
changes to your customers on xxx. You have no documentation of
validation or justification of verification for the seven patches.
(W-208)
- Training Database software validation used to
document employee training was deficient in that the test scripts were
not available to show the execution of the software validation protocol.
It appears that at least five (5) tests specified in the approved
protocol were not performed. (W-206)
- The validation results do not meet the
pre-determined acceptance criteria, and there was no documentation why
the results were acceptable. The validation reports do not contain an
evaluation of the validation data and activities. Nor does it contain
validation analyses and conclusion (W-204)
- During the inspection, I asked if the computer
software has been validated. I was told that the software was validated
by the manufacturer.
The managing director provided me a copy of the letter the received from
(the vendor). The letter indicated that the software was validated. I
told the managing director I still need to see what they have done to
validate the system since the computer was making a decision to accept
or reject potential donors. (W-191)
- Failure to adequately validate computer software
used in an automated process for its intended use according to an
established protocol, as required by 21 CFR 820.70(i).
For example, no person from your firm
reviewed or approved the third party approval test results for the
original "[redacted] Complaint System Validation" used in your firm's
quality system. (W-210)
- No procedures are established to validate for its
intended purpose the Microsoft Word or Microsoft Excel software used in
creating and maintaining nonconformance records, product return records,
internal audit records, or corrective action records.
We have reviewed your response and have concluded that it is inadequate
because off-the-shelf software must validated for its intended purpose.
(W-189)
- Failure to check input to and output from the
computer or related systems of formulas or other records or data for
accuracy as required by 21 CFR 211.68 (b).(W-223)
- - Your quality unit personnel informed the
investigators that the computer software was upgraded and the raw data
was lost during the software upgrade, We have serious concerns about
your firms implementation of changes to your computer system (E.g.,
software upgrade). It is your responsibility to provide the means of
ensuring data protection (e.g., back-up system) for your computerized
system to prevent the permanent loss of records.(W-222)
- You failed to exercise appropriate controls over
computer or related systems to assure that changes in master production
are instituted and input and output from the computer or related system
of formulas are checked for accuracy and maintained (W-217)
- There is no documentation to support software
change (W-217)
- - A viable timetable for completion of all
(computer system) qualifications and validations should be
established and followed. Complete the activities and assessments
including upgrades to the current system with high priority.(W-216)
- Your firm failed to maintain computerized
systems in a validated state. The inspection team noted that this
automated system, containing formulas and recipes for buffers was
programmed in 1999 and has not been reviewed or updated. We are
concerned that other discrepancies in other values may exist. Please
comment on how you will assure all values programmed into the automated
system, and other automated systems, are consistent with current master
batch records (W-215)
- We have reviewed your response received by the
Atlanta District office on October 22, 2007 and have concluded that it
is inadequate in that while you indicate that you have performed the
[redacted] software verification, no documentation was provided.
Documentation provided in your December response is incomplete and does
not fully address software verification. While various printouts of
output testing were provided, there was no protocol one could follow to
assess what your testing is actually accomplishing (W-211)
- Computer Numerical Control (CNC) Machine #C-4 had
out of specification results during operational qualification conducted
during validation. These out of specification results were not
investigated or addressed in the validation report (W-207)
- Failure to validate your software used for xxx.
For example, implementations of remote changes in operating parameters
change the output of the system. These types of changes require
re-validation of the system. You failed to follow your own procedure for
change controls when critical limits were changed to suit a client's
needs.(W-205)
- No written procedures for this computer
system that outlines the responsibilities and privileges of the
laboratory personnel who utilize the software (231)
- Failure to adequately validate computer software
for its intended use according to an established protocol, as required
by 21 CFR 820.70(i). For example, your firm failed to provide
documentation detailing the validation o prior to production use.
Software on both systems were reprogrammed on August 9-10, 2008, and
utilized in production on August 11, 2008. The validation was not
completed until October 6, 2008 (228)
- The performance of vendor supplier computer
software has not been verified. Specifically, your firm has not verified
the computer software program being used of their donor referral
operation to ensure that the electronic records are trustworthy,
accurate and reliable. (226)
- Failure to check input to and output from the
computer or related systems of formulas or other records or data for
accuracy as required by 21 CFR 211.68 (b).(223)
Examples of FDA Warning Letters / 483's Related to
Electronic Records
FDA Inspectors also found many deviations related to integrity and
authenticity of electroin records. To see examples,
click here
E-mail this page
