Jerold Martin, Charlie Wakeham and Xiaohan Wei of Pall Corporation ask if GAMP is important for maintaining 21 CFR Part 11 compliance
Since its enforcement, in 1997, Title 21 of the US Code of Federal Regulations (CFR) Part 11 has had a resounding impact on the biotechnology and pharmaceutical industries. For cleanroom operators, in addition to validating all ventilation, monitoring, temperature and pressure systems, this means also ensuring compliance with 21 CFR Part 11 when data related to the manufacture of drugs and therapies is maintained electronically or submitted to the FDA electronically. In the strictest sense, 21 CFR Part 11 is applied to any pharmaceutical manufacturing process utilising automated controls that generate data which is maintained in electronic format. The aim of this regulation is to ensure the authenticity and integrity of electronic records. It is also designed to prevent the signer from readily refuting the authenticity of his signature. In this article, we focus on small Commercial Off-The-Shelf (COTS) automated filter integrity test instruments used to test sterilising and other process filters in cleanroom environments and suggest how the latest version of the Good Automated Manufacturing Practices – GAMP 4 – released in December 2001, can help ensure the accuracy and integrity of these systems.
Excellent framework The Good Automated Manufacturing Practices (GAMP) guidelines are the most widely used, internationally accepted guidelines for validation of computer systems. While GAMP addresses a broad range of issues related to the validation of computer-based systems, for example automated filter integrity testers, another document that can assist cleanroom operators in maintaining 21 CFR Part 11 compliance is the joint PDA/ISPE publication, Complying with 21 CFR Part 11, Electronic Records and Electronic Signatures, a companion document to GAMP 4 available through International Society of Pharmaceutical Engineering (ISPE)'s website: www.ispe.org
Historical perspective The first edition of GAMP was published in March 1994 as a draft for comment by suppliers and the industry in the UK. Following the incorporation of comments, mostly from suppliers, GAMP 1 was published in March 1995. While GAMP has no regulatory authority, its guidelines provide pharmaceutical, biotechnology and now healthcare companies with an effective tool to assist with FDA compliance. Since the publication of GAMP 1 in 1995, three subsequent versions have been produced, the last two in collaboration with ISPE. The latest version, GAMP 4, improved on previous revisions with greater clarification of responsibilities and necessary actions, as well as features to make the document easier to navigate and use. GAMP 4 guidelines were issued in December 2001. Complying with 21 CFR Part 11, Electronic Records and Electronic Signatures was written by a GAMP special interest group and published jointly by ISPE and PDA in October 2001. Cleanroom environment Applying GAMP guidelines to the validation of COTS filter test instruments provides a critical safeguard for contamination control in cleanrooms. The fact that the failure of the unit could result in the loss of a production batch or release of a non-sterile product underscores GAMP's importance. Worse yet, if a filter integrity tester returned a false pass on a non-integral product-sterilising or virus removal filter, the subsequent contamination of the batch may or may not be detected even after the batch is completed and subjected to laboratory analyses. Subsequent reprocessing or destruction of the batch could cost millions of dollars. While GAMP 4 clearly defines the responsibilities of suppliers and users, some suppliers have taken the initiative to offer assistance beyond the scope of the responsibilities specified by GAMP. For instance, a supplier may elect to produce a Validation Plan, which is defined in GAMP 4 as the document in which the end-user should "summarise the entire project, identify measures for success and clearly define criteria for final acceptance". In other words, this plan defines the design documentation and qualification testing that the product must undergo before commercial release. This allows the end user to assess the level of additional validation (e.g. Installation Qualification, Operational Qualification and Performance Qualification) that they may require before putting the instrument into service. Likewise, a supplier may also make requirements for its own standard off-the-shelf products and new software versions available to the end-user through the User Requirement Specification section, which is designated as the responsibility of the end-user in GAMP 4. This added input from the supplier provides end-users with a basis for developing their own versions of these documents. Naturally, suppliers need to effectively address sections designated for suppliers, including Functional Specification, Hardware Design Specification and Software Design Specification, which are made available to the end user. General validation activities comprise Installation Qualification (IQ), Operational Qualification (OQ), Performance Qualification (PQ), and Design Qualification (DQ). For the most part, these validation activities are performed by the user. However, use of supplier documents, as they relate to IQ or OQ, can simplify the overall validation process. For example, to streamline OQ of an off-the-shelf instrument, suppliers can test the instrument software remotely from the hardware using a Software Test Specification. Separate tests can be performed to ensure that the final hardware configuration meets the requirements of the original design specification.
Minimising the burden This approach minimises validation burden on end users by enabling OQ to be separated into testing at the supplier site (OQ1) and testing in the operational environment (OQ2). Prior to technical release of a new instrument or new software version, the supplier performs an extensive qualification on a standard production instrument, thus qualifying the software version when loaded into the standard hardware of each individual production instrument. This forms OQ1. A much condensed test protocol, OQ2, can be performed on the end user's instrument upon installation. This serves to verify that the pre-qualified software is functioning correctly when integrated with the standard hardware. Availability of this IQ/OQ1/OQ2 format greatly reduces the time and cost of IQ/OQ for a newly installed instrument. Once an automated system is validated and in operation, it is important to ensure that it remains in a validated state. Suppliers must stay abreast of evolving validation requirements, and continually assess the changing market and regulatory environment with respect to its instruments. Period releases of software or hardware upgrades can enhance the benefits provided by the instrument to the user. Such new releases must be governed by strict change control protocols. The instrument user should only install upgrades after assessment of the impact on the validated status. For each new software version, the supplier should update the design and qualification documentation of the instrument. Recommendations on whether requalification is required after upgrade are also useful for the end-user. 21 CFR Part 11 requires that a "system is validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records". From a procedural perspective, GAMP 4 addresses 21 CFR Part 11 requirements by providing guidelines for development and validation of automated systems. GAMP 4 guidelines can be purchased from ISPE (see www.ispe.org). 21 CFR Part 11 states that both technological controls (supplied by the instrument) and procedural controls (supplied by the user) are required for compliance with the regulation. For example, an instrument might include technological controls that give each user a User ID and password that has to be input before access to the instrument is granted. An end-user procedural control is required to ensure that operators are given the correct training before a User ID is created for them. The joint PDA/ISPE publication, Complying with 21 CFR Part 11, Electronic Records and Electronic Signatures, usefully lists each part of the regulation and states whether a technological or procedural control is required to meet it and whether this is the supplier or end-user's responsibility. Understanding the technical features and functions needed to meet 21 CFR Part 11 requirements is a large part of the compliance equation. An example of a control in a filter test instrument for compliance with 21CFR Part 11 requirements is to have no capability to modify an electronic record. Instead, the device stores a new record every time a test program is created or modified, while ensuring that an electronic signature of the user is obtained. In a similar way, the device has been designed so that the creation or deletion of User Access Rights results in a new record in the User Access list, which also requires an electronic signature from the system administrator. The electronic signature and date and time stamp on the electronic record form the audit trail. Creating a new record each time also ensures that previous data is not obscured – an important requirement for compliance with 21 CFR Part 11. Suppliers who are mindful of 21 CFR Part 11 requirements are also developing COTS filter test instruments with greater data storage capacity so that more records can be retained for a longer period of time on the instrument which generated the data.
GAMP 4: A necessity in cleanrooms Applying GAMP protocols to entire cleanroom systems fosters synergy and understanding between users and suppliers, and creates a safer, cleaner development environment. Within the context of automated filter integrity testers, GAMP and its related publications help cleanroom operators address one of the most pressing regulatory issues today, 21 CFR Part 11. n