Examples of Recent FDA Warning Letters / 483s Related to Software and Computer System Validation

Increasing FDA Focus on Computer Validation

While FDA was quiet about software and computer system validation between 2002 and 2006 this has changed significantly since 2006. Software and computer system validation has become an inspection focus for pharmaceutical, API and device industry. Deviations have been cited related to all steps of computer validation from writing specification and risk assessment to IQ/OQ/PQ, revalidation, reporting and change control. Here are examples.

• No risk assessment for software changes
• Off-the shelf software not validated for intended purpose
• Validation relied on validation at the vendor’s site, no validation at the user’s site
• 3rd Party validation not reviewed
• Software versions not revalidated, e.g., patches
• Not all test scripts available
• Test results don’t meet acceptance criteria

The warning letter can be downloaded from the Labcompliance Usersclub. Non members can preview excerpts (scroll down to the W number as shown below.)

To prepare your organization for FDA inspections, and to avoid FDA warning letters related to electronic records and signatures, attend the  Audio seminar "Computer System Validation - Step-by-Step, with example documents from planning to reporting))

Examples of FDA Warning Letters / 483's Related to Computer System Validation

• No IQ, OQ or PQ has been performed throughout the life of the system. (W-190)
• No validation reports have been generated historically (for the legacy system). (W-190)
• The (system) has not been maintained under established procedures for change control. This is true throughout the life of this software application. (W-190)
• Regarding computer validation and security issues, you did not provide a time frame for writing and implementation of a computer security SOP (W-198)
• The firm has failed to generate or maintain design control documentation sufficient to define all customized elements making up the (system) configuration (i.e., functional or structural design documentation defining all program making up (the system) (W-190)
• Software used as part of the production quality system was not validated for its intended use according to an established protocol]. Specifically, (a) Spreadsheets intended to check for outliers and calculate mean, SC, % CV, value assignments for finished devices. (b) Complaint handling software (c) Quantrol database program (W-201)
• A formal risk analysis of the original system design and software changes to correct software bugs that caused incorrect functionality or performance problems, and to enhance the product, has not been documented. (W-158)
• Software release notes do not explain the impact of these software bugs on user needs and intended uses" (W-158)
• There was a failure to check for accuracy the inputs to and outputs from the xxx Data Acquisition System, which is used to run your firm's HPLC instruments during analysis of drug products. For example, electronic data files were not routinely checked for accuracy. (W-180)
• The company failed to validate software for a device. Specifically the controller unit software version xxx was changed to xxx. Your firm did not have any documentation showing that the current software version was validated". (W-144)
• You made changes to versions of the ISOLOC software. For example, you released software patches for these various changes to your customers on xxx. You have no documentation of validation or justification of verification for the seven patches. (W-208)
• Training Database software validation used to document employee training was deficient in that the test scripts were not available to show the execution of the software validation protocol. It appears that at least five (5) tests specified in the approved protocol were not performed. (W-206)
• The validation results do not meet the pre-determined acceptance criteria, and there was no documentation why the results were acceptable. The validation reports do not contain an evaluation of the validation data and activities. Nor does it contain validation analyses and conclusion (W-204)
• During the inspection, I asked if the computer software has been validated. I was told that the software was validated by the manufacturer.
  The managing director provided me a copy of the letter the received from (the vendor). The letter indicated that the software was validated. I told the managing director I still need to see what they have done to validate the system since the computer was making a decision to accept or reject potential donors. (W-191)
• Failure to adequately validate computer software used in an automated process for its intended use according to an established protocol, as required by 21 CFR 820.70(i).
   For example, no person from your firm reviewed or approved the third party approval test results for the original "[redacted] Complaint System Validation" used in your firm's quality system. (W-210)
• No procedures are established to validate for its intended purpose the Microsoft Word or Microsoft Excel software used in creating and maintaining nonconformance records, product return records, internal audit records, or corrective action records.
  We have reviewed your response and have concluded that it is inadequate because off-the-shelf software must validated for its intended purpose. (W-189)
•  Failure to check input to and output from the computer or related systems of formulas or other records or data for accuracy as required by 21 CFR 211.68 (b).(W-223)
• - Your quality unit personnel informed the investigators that the computer software was upgraded and the raw data was lost during the software upgrade, We have serious concerns about your firms  implementation of changes to your computer system (E.g., software upgrade). It is your responsibility to provide the means of ensuring data protection (e.g., back-up system) for your computerized system to prevent the permanent loss of records.(W-222)
• You failed to exercise appropriate controls over computer or related systems to assure that changes in master production are instituted and input and output from the computer or related system of formulas are checked for accuracy and maintained (W-217)
• There is no documentation to support software change (W-217)
• - A viable timetable for completion of all (computer system) qualifications and validations should be established and followed. Complete the activities and assessments including upgrades to the current system with high priority.(W-216)
• Your firm failed to maintain computerized systems in a validated state. The inspection team noted that this automated system, containing formulas and recipes for buffers was programmed in 1999 and has not been reviewed or updated. We are concerned that other discrepancies in other values may exist. Please comment on how you will assure all values programmed into the automated system, and other automated systems, are consistent with current master batch records (W-215)
• We have reviewed your response received by the Atlanta District office on October 22, 2007 and have concluded that it is inadequate in that while you indicate that you have performed the [redacted] software verification, no documentation was provided. Documentation provided in your December response is incomplete and does not fully address software verification. While various printouts of output testing were provided, there was no protocol one could follow to assess what your testing is actually accomplishing (W-211)
• Computer Numerical Control (CNC) Machine #C-4 had out of specification results during operational qualification conducted during validation. These out of specification results were not investigated or addressed in the validation report (W-207)
• Failure to validate your software used for xxx. For example, implementations of remote changes in operating parameters change the output of the system. These types of changes require re-validation of the system. You failed to follow your own procedure for change controls when critical limits were changed to suit a client's needs.(W-205)
•  No written procedures for this computer system that outlines the responsibilities and privileges of the laboratory personnel who utilize the software (231)
• Failure to adequately validate computer software for its intended use according to an established protocol, as required by 21 CFR 820.70(i). For example, your firm failed to provide documentation detailing the validation o prior to production use. Software on both systems were reprogrammed on August 9-10, 2008, and utilized in production on August 11, 2008. The validation was not completed until October 6, 2008 (228)
• The performance of vendor supplier computer software has not been verified. Specifically, your firm has not verified the computer software program being used of their donor referral operation to ensure that the electronic records are trustworthy, accurate and reliable. (226)
• Failure to check input to and output from the computer or related systems of formulas or other records or data for accuracy as required by 21 CFR 211.68 (b).(223)

Examples of FDA Warning Letters / 483's Related to Electronic Records

FDA Inspectors also found many deviations related to integrity and authenticity of electroin records. To see examples, click here

E-mail this page